libewf_section.c

sleuthit-2.09 一个磁盘的工具集

	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	if( size != EWF_VOLUME_SMART_SIZE )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: mismatch in section volume size.\n" );

		return( -1 );
	}
	volume_smart = (EWF_VOLUME_SMART *) libewf_common_alloc( EWF_VOLUME_SMART_SIZE );

	if( volume_smart == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to allocate volume.\n" );

		return( -1 );
	}
	if( ewf_volume_smart_read( volume_smart, file_descriptor ) <= -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to read volume.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
#ifdef HAVE_DEBUG_OUTPUT
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume_smart->unknown1, 4 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume_smart->unknown2, 20 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume_smart->unknown3, 45 ); );
#endif

	if( ewf_crc_calculate( &calculated_crc, (uint8_t *) volume_smart, ( EWF_VOLUME_SMART_SIZE - EWF_CRC_SIZE ), 1 ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to calculate CRC.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &stored_crc, volume_smart->crc ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to convert stored CRC value.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
	bytes_per_chunk = ewf_volume_smart_calculate_chunk_size( volume_smart );

	if( bytes_per_chunk <= -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to calculate chunk size - using default.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( volume_smart );

			return( -1 );
		}
		bytes_per_chunk = EWF_MINIMUM_CHUNK_SIZE;
	}
	if( stored_crc != calculated_crc )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: CRC does not match (in file: %" PRIu32 ", calculated: %" PRIu32 ").\n", stored_crc, calculated_crc );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( volume_smart );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->amount_of_chunks, volume_smart->amount_of_chunks ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to convert amount of chunks value.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->sectors_per_chunk, volume_smart->sectors_per_chunk ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to convert sectors per chunk value.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->bytes_per_sector, volume_smart->bytes_per_sector ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to convert bytes per sector value.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->amount_of_sectors, volume_smart->amount_of_sectors ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_read: unable to convert amount of sectors value.\n" );

		libewf_common_free( volume_smart );

		return( -1 );
	}
	internal_handle->media->chunk_size = (uint32_t) bytes_per_chunk;

	LIBEWF_VERBOSE_PRINT( "libewf_section_volume_s01_read: This volume has %" PRIu32 " chunks of %" PRIi32 " bytes each, CRC %" PRIu32 " (%" PRIu32 ").\n", internal_handle->media->amount_of_chunks, bytes_per_chunk, stored_crc, calculated_crc );
	LIBEWF_VERBOSE_PRINT( "libewf_section_volume_s01_read: This volume has %" PRIu32 " sectors of %" PRIi32 " bytes each.\n", internal_handle->media->amount_of_sectors, internal_handle->media->bytes_per_sector );

	if( libewf_common_memcmp( (void *) volume_smart->signature, (void *) "SMART", 5 ) == 0 )
	{
		internal_handle->format = LIBEWF_FORMAT_SMART;
	}
	else
	{
		internal_handle->format = LIBEWF_FORMAT_EWF;
	}
	libewf_common_free( volume_smart );

	return( (int32_t) size );
}

/* Write an EWF-S01 (SMART) volume section to file
 * Returns the amount of bytes written, or -1 on error
 */
ssize_t libewf_section_volume_s01_write( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, off_t start_offset )
{
	EWF_VOLUME_SMART *volume    = NULL;
	ssize_t section_write_count = 0;
	ssize_t volume_write_count  = 0;
	size_t size               = EWF_VOLUME_SMART_SIZE;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	volume = (EWF_VOLUME_SMART *) libewf_common_alloc( size );

	if( volume == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to create volume.\n" );

		return( -1 );
	}
	if( libewf_common_memset( volume, 0, size ) == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_write: unable to clear volume.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	volume->unknown1[ 0 ] = 1;

	if( libewf_endian_revert_32bit( internal_handle->media->amount_of_chunks, volume->amount_of_chunks ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to revert amount of chunks value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_revert_32bit( internal_handle->media->sectors_per_chunk, volume->sectors_per_chunk ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to revert sectors per chunk value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_revert_32bit( internal_handle->media->bytes_per_sector, volume->bytes_per_sector ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to revert bytes per sector value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_revert_32bit( internal_handle->media->amount_of_sectors, volume->amount_of_sectors ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to revert amount of sectors value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	LIBEWF_VERBOSE_PRINT( "libewf_section_volume_s01_write: amount_of_chunks: %" PRIu32 ", sectors_per_chunk: %" PRIu32 ", bytes_per_sector: %" PRIu32 ", amount_of_sectors: %" PRIu32 ".\n", internal_handle->media->amount_of_chunks, internal_handle->media->sectors_per_chunk, internal_handle->media->bytes_per_sector, internal_handle->media->amount_of_sectors );

	if( internal_handle->format == LIBEWF_FORMAT_SMART )
	{
		volume->signature[ 0 ] = (uint8_t) 'S';
		volume->signature[ 1 ] = (uint8_t) 'M';
		volume->signature[ 2 ] = (uint8_t) 'A';
		volume->signature[ 3 ] = (uint8_t) 'R';
		volume->signature[ 4 ] = (uint8_t) 'T';
	}
	section_write_count = libewf_section_start_write( internal_handle, file_descriptor, (EWF_CHAR *) "volume", size, start_offset );

	if( section_write_count == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to write section to file.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	volume_write_count = ewf_volume_smart_write( volume, file_descriptor );

	libewf_common_free( volume );

	if( volume_write_count == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_s01_write: unable to write volume to file.\n" );

		return( -1 );
	}
	return( section_write_count + volume_write_count );
}

/* Reads an EWF-E01 (EnCase) volume section
 * Returns the amount of bytes read, or -1 on error
 */
ssize_t libewf_section_volume_e01_read( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, size_t size )
{
	EWF_VOLUME *volume      = NULL;
	EWF_CRC calculated_crc  = 0;
	EWF_CRC stored_crc      = 0;
	int32_t bytes_per_chunk = 0;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	if( size != EWF_VOLUME_SIZE )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: mismatch in section volume size.\n" );

		return( -1 );
	}
	volume = (EWF_VOLUME *) libewf_common_alloc( size );

	if( volume == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to read volume.\n" );

		return( -1 );
	}
	if( ewf_volume_read( volume, file_descriptor ) <= -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to read volume.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
#ifdef HAVE_DEBUG_OUTPUT
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown1, 3 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown2, 16 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown3, 3 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown4, 12 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown5, 3 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown6, 4 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->unknown7, 963 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( volume->signature, 5 ); );
#endif

	if( ewf_crc_calculate( &calculated_crc, (uint8_t *) volume, ( EWF_VOLUME_SIZE - EWF_CRC_SIZE ), 1 ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to calculate CRC.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &stored_crc, volume->crc ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to convert stored CRC value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	bytes_per_chunk = ewf_volume_calculate_chunk_size( volume );

	if( bytes_per_chunk <= -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to calculate chunk size - using default.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( volume );

			return( -1 );
		}
		bytes_per_chunk = EWF_MINIMUM_CHUNK_SIZE;
	}
	if( stored_crc != calculated_crc )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: CRC does not match (in file: %" PRIu32 ", calculated: %" PRIu32 ").\n", stored_crc, calculated_crc );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( volume );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->amount_of_chunks, volume->amount_of_chunks ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to convert amount of chunks value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->sectors_per_chunk, volume->sectors_per_chunk ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to convert sectors per chunk value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->bytes_per_sector, volume->bytes_per_sector ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to convert bytes per sector value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->amount_of_sectors, volume->amount_of_sectors ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to convert amount of sectors value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &internal_handle->media->error_granularity, volume->error_granularity ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to convert error granularity value.\n" );

		libewf_common_free( volume );

		return( -1 );
	}
	internal_handle->media->chunk_size  = (uint32_t) bytes_per_chunk;
	internal_handle->media->media_type  = volume->media_type;
	internal_handle->media->media_flags = volume->media_flags;
	internal_handle->compression_level  = (int8_t) volume->compression_level;

	LIBEWF_VERBOSE_PRINT( "libewf_section_volume_e01_read: this volume has %" PRIu32 " chunks of %" PRIi32 " bytes each, CRC %" PRIu32 " (%" PRIu32 ").\n", internal_handle->media->amount_of_chunks, bytes_per_chunk, stored_crc, calculated_crc );
	LIBEWF_VERBOSE_PRINT( "libewf_section_volume_e01_read: This volume has %" PRIu32 " sectors of %" PRIi32 " bytes each.\n", internal_handle->media->amount_of_sectors, internal_handle->media->bytes_per_sector );

	if( libewf_common_memcpy( internal_handle->guid, volume->guid, 16 ) == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_e01_read: unable to set GUID.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( volume );

			return( -1 );
		}
	}
	if( internal_handle->amount_of_header_sections == 1 )
	{
		internal_handle->format = LIBEWF_FORMAT_ENCASE1;
	}
	libewf_common_free( volume );

	return( (int32_t) size );
}

/* Reads a volume section
 * Returns the amount of bytes read, or -1 on error
 */
ssize_t libewf_section_volume_read( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, size_t size )
{
	ssize_t count = 0;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_read: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_volume_read: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	if( size == EWF_VOLUME_SMART_SIZE )
	{
		internal_handle->ewf_format = EWF_FORMAT_S01;
		count              = libewf_section_volume_s01_read( internal_handle, file_descriptor, size );
	}
	else if( size == EWF_VOLUME_SIZE )
	{
		internal_handle->ewf_format = EWF_FORMAT_E01;