filesystems

sleuthit-2.09 一个磁盘的工具集

# variant
>>>>417		ubyte&0xDF	>0			
>>>>>417	string		x			%-.5s
>>>>>>422	ubyte&0xDF	>0			
>>>>>>>422	string		x 			\b%-.3s
>>>>>425	ubyte&0xDF	>0			
>>>>>>425	string		>\ 			\b.%-.3s
#
>430	string	Datentr\204ger\ entfernen\xFF\r\n	
>>454	string	Medienfehler\xFF\r\n			
>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
>>>>368		ubyte&0xDF	>0			
>>>>>368	string		x 			%-.5s
>>>>>>373	ubyte&0xDF	>0			
>>>>>>>373	string		x 			\b%-.3s
>>>>>376	ubyte&0xDF	>0			
>>>>>>376	string		x 			\b.%-.3s
#>3	string	NTFS\ \ \ \ 				
>389	string	Fehler\ beim\ Lesen\ 
>>407	string	des\ Datentr\204gers
>>>426	string	NTLDR\ fehlt				
>>>>440	string	NTLDR\ ist\ komprimiert
>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
#>3	string	NTFS\ \ \ \ 				
>313	string	A\ disk\ read\ error\ occurred.\r
>>345	string	A\ kernel\ file\ is\ missing\ 	
>>>370	string	from\ the\ disk.\r		
>>>>484	string	NTLDR\ is\ compressed		
>>>>>429 string	Insert\ a\ system\ diskette\ 	
>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
# DOS loader variants different languages,offsets
>472	ubyte&0xDF	>0
>>389	string	Invalid\ system\ disk\xFF\r\n		
>>>411	string	Disk\ I/O\ error			
>>>>428	string	Replace\ the\ disk,\ and\ 		
>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
#IO.SYS
>>>>>>472	ubyte&0xDF	>0			
>>>>>>>472	string		x 			\b %-.2s
>>>>>>>>474	ubyte&0xDF	>0			
>>>>>>>>>474	string		x 			\b%-.5s
>>>>>>>>>>479	ubyte&0xDF	>0			
>>>>>>>>>>>479 string		x 			\b%-.1s
>>>>>>>480	ubyte&0xDF	>0			
>>>>>>>>480	string		x 			\b.%-.3s
#MSDOS.SYS
>>>>>>>483	ubyte&0xDF	>0			\b+
>>>>>>>>483	string		x 			\b%-.5s
>>>>>>>>>488	ubyte&0xDF	>0			
>>>>>>>>>>488	string		x 			\b%-.3s
>>>>>>>>491	ubyte&0xDF	>0			
>>>>>>>>>491	string		x 			\b.%-.3s
#
>>390	string	Invalid\ system\ disk\xFF\r\n		
>>>412	string	Disk\ I/O\ error\xFF\r\n		
>>>>429	string	Replace\ the\ disk,\ and\ 		
>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
>>388	string	Ungueltiges\ System\ \xFF\r\n		
>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n		
>>>>427	string	Datentraeger\ wechseln\ und\ 		
>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
#WINBOOT.SYS only not spaces (0xDF)
>>>>>>497	ubyte&0xDF	>0			
>>>>>>>497	string		x 			%-.5s
>>>>>>>>502	ubyte&0xDF	>0			
>>>>>>>>>502	string		x 			\b%-.1s
>>>>>>>>>>503	ubyte&0xDF	>0			
>>>>>>>>>>>503	string		x 			\b%-.1s
>>>>>>>>>>>>504	ubyte&0xDF	>0			
>>>>>>>>>>>>>504 string		x 			\b%-.1s
>>>>>>505	ubyte&0xDF	>0			
>>>>>>>505	string		x 			\b.%-.3s
#IO.SYS
>>>>>>472	ubyte&0xDF	>0			or
>>>>>>>472	string		x 			\b %-.2s
>>>>>>>>474	ubyte&0xDF	>0			
>>>>>>>>>474	string		x 			\b%-.5s
>>>>>>>>>>479	ubyte&0xDF	>0			
>>>>>>>>>>>479 string		x 			\b%-.1s
>>>>>>>480	ubyte&0xDF	>0			
>>>>>>>>480	string		x 			\b.%-.3s
#MSDOS.SYS
>>>>>>>483	ubyte&0xDF	>0			\b+
>>>>>>>>483	string		x 			\b%-.5s
>>>>>>>>>488	ubyte&0xDF	>0			
>>>>>>>>>>488	string		x 			\b%-.3s
>>>>>>>>491	ubyte&0xDF	>0			
>>>>>>>>>491	string		x 			\b.%-.3s
#
>>390	string	Ungueltiges\ System\ \xFF\r\n		
>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n		
>>>>429	string	Datentraeger\ wechseln\ und\ 		
>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
#WINBOOT.SYS only not spaces (0xDF)
>>>>>>497	ubyte&0xDF	>0			
>>>>>>>497	string		x 			%-.7s
>>>>>>>>504	ubyte&0xDF	>0			
>>>>>>>>>504	string		x 			\b%-.1s
>>>>>>505	ubyte&0xDF	>0			
>>>>>>>505	string		x 			\b.%-.3s
#IO.SYS
>>>>>>472	ubyte&0xDF	>0			or
>>>>>>>472	string		x 			\b %-.2s
>>>>>>>>474	ubyte&0xDF	>0			
>>>>>>>>>474	string		x 			\b%-.6s
>>>>>>>480	ubyte&0xDF	>0			
>>>>>>>>480	string		x 			\b.%-.3s
#MSDOS.SYS
>>>>>>>483	ubyte&0xDF	>0			\b+
>>>>>>>>483	string		x 			\b%-.5s
>>>>>>>>>488	ubyte&0xDF	>0			
>>>>>>>>>>488	string		x 			\b%-.3s
>>>>>>>>491	ubyte&0xDF	>0			
>>>>>>>>>491	string		x 			\b.%-.3s
#
>>389	string	Ungueltiges\ System\ \xFF\r\n		
>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n		
>>>>428	string	Datentraeger\ wechseln\ und\ 		
>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
>>>>>>472	string		x 			%-.2s
>>>>>>>474	ubyte&0xDF	>0			
>>>>>>>>474	string		x 			\b%-.5s
>>>>>>>>479	ubyte&0xDF	>0			
>>>>>>>>>479	string		x 			\b%-.1s
>>>>>>480	ubyte&0xDF	>0			
>>>>>>>480	string		x 			\b.%-.3s
>>>>>>483	ubyte&0xDF	>0			\b+
>>>>>>>483	string		x 			\b%-.5s
>>>>>>>488	ubyte&0xDF	>0			
>>>>>>>>488	string		x 			\b%-.2s
>>>>>>>>490	ubyte&0xDF	>0			
>>>>>>>>>490	string		x 			\b%-.1s
>>>>>>>491	ubyte&0xDF	>0			
>>>>>>>>491	string		x 			\b.%-.3s
>479	ubyte&0xDF	>0
>>416	string	Kein\ System\ oder\ 			
>>>433	string	Laufwerksfehler				
>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
#IO.SYS
>>>>>479	string		x 			\b %-.2s
>>>>>>481	ubyte&0xDF	>0			
>>>>>>>481	string		x 			\b%-.6s
>>>>>487	ubyte&0xDF	>0			
>>>>>>487	string		x 			\b.%-.3s
#MSDOS.SYS
>>>>>>490	ubyte&0xDF	>0			\b+
>>>>>>>490	string		x 			\b%-.5s
>>>>>>>>495	ubyte&0xDF	>0			
>>>>>>>>>495	string		x 			\b%-.3s
>>>>>>>498	ubyte&0xDF	>0			
>>>>>>>>498	string		x 			\b.%-.3s
#
>486	ubyte&0xDF	>0
>>416	string	Non-System\ disk\ or\ 			
>>>435	string	disk\ error\r				
>>>>447	string	Replace\ and\ press\ any\ key\ 		
>>>>>473 string	when\ ready\r				\b, Microsoft DOS Bootloader
>480	ubyte&0xDF	>0			
>>393	string	Non-System\ disk\ or\ 			
>>>412	string	disk\ error\r				
>>>>424	string	Replace\ and\ press\ any\ key\ 		
>>>>>450 string	when\ ready\r				\b, Microsoft DOS bootloader
#IO.SYS
>>>>>480	string		x 			\b %-.2s
>>>>>>482	ubyte&0xDF	>0			
>>>>>>>48	string		x 			\b%-.6s
>>>>>488	ubyte&0xDF	>0			
>>>>>>488	string		x 			\b.%-.3s
#MSDOS.SYS
>>>>>>491	ubyte&0xDF	>0			\b+
>>>>>>>491	string		x 			\b%-.5s
>>>>>>>>496	ubyte&0xDF	>0			
>>>>>>>>>496	string		x 			\b%-.3s
>>>>>>>499	ubyte&0xDF	>0			
>>>>>>>>499	string		x 			\b.%-.3s
#>43	string	\224R-LOADER\ \ SYS			=label					
>54	string	SYS
>>324	string	VASKK
>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
#
>70	string	IBMBIO\ \ COM				
>>472	string	Cannot\ load\ DOS!\ 			
>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
>>471	string	Cannot\ load\ DOS\ 			
>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
>444	string	KERNEL\ \ SYS					
>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
>499	string	KERNEL\ \ SYS				
>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
>449	string	KERNEL\ \ SYS				
>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
>125	string	Loading\ FreeDOS...\r			
>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
>>>441		ubyte&0xDF	>0			
>>>>441		string		x 			\b %-.6s
>>>>>447	ubyte&0xDF	>0			
>>>>>>447	string		x 			\b%-.1s
>>>>>>>448	ubyte&0xDF	>0			
>>>>>>>>448	string		x 			\b%-.1s
>>>>449		ubyte&0xDF	>0			
>>>>>449	string		x 			\b.%-.3s
>124	string	FreeDOS\0				
>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
>>>497		ubyte&0xDF	>0			
>>>>497		string		x 			\b %-.6s
>>>>>503	ubyte&0xDF	>0			
>>>>>>503	string		x 			\b%-.1s
>>>>>>>504	ubyte&0xDF	>0			
>>>>>>>>504	string		x 			\b%-.1s
>>>>505		ubyte&0xDF	>0			
>>>>>505	string		x 			\b.%-.3s
>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
>>>497		ubyte&0xDF	>0			
>>>>497		string		x 			\b %-.6s
>>>>>503	ubyte&0xDF	>0			
>>>>>>503	string		x 			\b%-.1s
>>>>>>>504	ubyte&0xDF	>0			
>>>>>>>>504	string		x 			\b%-.1s
>>>>505		ubyte&0xDF	>0			
>>>>>505	string		x 			\b.%-.3s
>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
>>>497		ubyte&0xDF	>0			
>>>>497		string		x 			\b %-.6s
>>>>>503	ubyte&0xDF	>0			
>>>>>>503	string		x 			\b%-.1s
>>>>>>>504	ubyte&0xDF	>0			
>>>>>>>>504	string		x 			\b%-.1s
>>>>505		ubyte&0xDF	>0			
>>>>>505	string		x 			\b.%-.3s
>336	string	Error!\ 				
>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
>>>497		ubyte&0xDF	>0			
>>>>497		string		x 			\b %-.6s
>>>>>503	ubyte&0xDF	>0			
>>>>>>503	string		x 			\b%-.1s
>>>>>>>504	ubyte&0xDF	>0			
>>>>>>>>504	string		x 			\b%-.1s
>>>>505		ubyte&0xDF	>0			
>>>>>505	string		x 			\b.%-.3s
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
# OEM-ID=Visopsys
>478		ulelong	0					
>>(1.b+326)	string	I/O\ Error\ reading\ 			
>>>(1.b+344)	string	Visopsys\ loader\r			
>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
# http://alexfru.chat.ru/epm.html#bootprog
>494	ubyte	>0x4D					
>>495	string	>E					
>>>495	string	<S					
#OEM-ID is not reliable
>>>>3	string	BootProg				
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
>>>>>499		string		x 		\b %-.1s
>>>>>>500		ubyte&0xDF	>0		
>>>>>>>500		string		x 		\b%-.1s
>>>>>>>>501		ubyte&0xDF	>0		
>>>>>>>>>501		string		x 		\b%-.1s
>>>>>>>>>>502		ubyte&0xDF	>0		
>>>>>>>>>>>502		string		x 		\b%-.1s
>>>>>>>>>>>>503		ubyte&0xDF	>0		
>>>>>>>>>>>>>503	string		x 		\b%-.1s
>>>>>>>>>>>>>>504	ubyte&0xDF	>0		
>>>>>>>>>>>>>>>504	string		x 		\b%-.1s
>>>>>>>>>>>>>>>>505	ubyte&0xDF	>0		
>>>>>>>>>>>>>>>>>505	string		x 		\b%-.1s
>>>>>>>>>>>>>>>>>>506	ubyte&0xDF	>0		
>>>>>>>>>>>>>>>>>>>506	string		x 		\b%-.1s
#name extension
>>>>>507		ubyte&0xDF	>0		\b.
>>>>>>507		string		x 		\b%-.1s
>>>>>>>508		ubyte&0xDF	>0		
>>>>>>>>508		string		x 		\b%-.1s
>>>>>>>>>509		ubyte&0xDF	>0		
>>>>>>>>>>509		string		x 		\b%-.1s
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
#If the boot sector fails to find needed program in the root directory,
#it also hangs with another message ("NF").
>>>>>492		string		RENF		\b, FAT (12 bit)
>>>>>495		string		RENF		\b, FAT (16 bit)
# http://alexfru.chat.ru/epm.html#bootprog
>494	ubyte	>0x4D					
>>495	string	>E					
>>>495	string	<S					
#OEM-ID is not reliable
>>>>3	string	BootProg				
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
>>>>>499		string		x 		\b %-.1s
>>>>>>500		ubyte&0xDF	>0		
>>>>>>>500		string		x 		\b%-.1s
>>>>>>>>501		ubyte&0xDF	>0		
>>>>>>>>>501		string		x 		\b%-.1s
>>>>>>>>>>502		ubyte&0xDF	>0		
>>>>>>>>>>>502		string		x 		\b%-.1s
>>>>>>>>>>>>503		ubyte&0xDF	>0		
>>>>>>>>>>>>>503	string		x 		\b%-.1s
>>>>>>>>>>>>>>504	ubyte&0xDF	>0		
>>>>>>>>>>>>>>>504	string		x 		\b%-.1s
>>>>>>>>>>>>>>>>505	ubyte&0xDF	>0		
>>>>>>>>>>>>>>>>>505	string		x 		\b%-.1s
>>>>>>>>>>>>>>>>>>506	ubyte&0xDF	>0		
>>>>>>>>>>>>>>>>>>>506	string		x 		\b%-.1s
#name extension
>>>>>507		ubyte&0xDF	>0		\b.
>>>>>>507		string		x 		\b%-.1s
>>>>>>>508		ubyte&0xDF	>0		
>>>>>>>>508		string		x 		\b%-.1s
>>>>>>>>>509		ubyte&0xDF	>0		
>>>>>>>>>>509		string		x 		\b%-.1s
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
#If the boot sector fails to find needed program in the root directory,
#it also hangs with another message ("NF").
>>>>>492		string		RENF		\b, FAT (12 bit)
>>>>>495		string		RENF		\b, FAT (16 bit)
# loader end
# Joerg Jenderek
>446	ubyte	0			
>>450	ubyte	>0			
>>>482	ubyte	0			
>>>>498	ubyte	0			
>>>>466	ubyte	0x05			\b, extended partition table
>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
>>>>466	ubyte	0x0			\b, extended partition table (last)	
# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
# older drives may use E9 xx xx
>0		lelong&0x009000EB	0x009000EB 
>0		lelong&0x000000E9	0x000000E9 
>>1		ubyte			>37	\b, code offset 0x%x
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize are from 32 to 2048
>>>11		uleshort	<2049	
>>>>11		uleshort	>31	
>>>>>3		string		>\0		\b, OEM-ID "%8.8s"
>>>>>11		uleshort	>512		\b, Bytes/sector %u
#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
>>>>>11		uleshort	<512		\b, Bytes/sector %u
>>>>>13		ubyte		>1		\b, sectors/cluster %u
#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
>>>>>14		uleshort	>32		\b, reserved sectors %u
#>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
#>>>>>14	uleshort	>1		\b, reserved sectors %u
#>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
>>>>>14		uleshort	<1		\b, reserved sectors %u
>>>>>16		ubyte		>2		\b, FATs %u