libewf_section.c

sleuthit-2.09 一个磁盘的工具集

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			return( -1 );
		}
		/* TODO Try to correct the table
		 */
	}
	return( (int32_t) size );
}

/* Reads a sectors section
 * Returns the amount of bytes read, or -1 on error
 */
ssize_t libewf_section_sectors_read( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, size_t size )
{
	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_sectors_read: invalid handle.\n" );

		return( -1 );
	}
	/* In the EWF-E01 format the sectors section holds the actual data chunks
	 */
	if( internal_handle->ewf_format == EWF_FORMAT_S01 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_sectors_read: EWF-S01 format should not contain sectors section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			return( -1 );
		}
	}
	/* Skip the chunk data within the section
	 */
	if( libewf_common_lseek( file_descriptor, size, SEEK_CUR ) == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_sectors_read: unable to align with next section.\n" );

		return( -1 );
	}
	return( (int32_t) size );
}

/* Reads a ltree section
 * Returns the amount of bytes read, or -1 on error
 */
ssize_t libewf_section_ltree_read( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, size_t size )
{
	EWF_LTREE *ltree          = NULL;
	EWF_LTREE_DATA *tree_data = NULL;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_ltree_read: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->ewf_format == EWF_FORMAT_S01 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_sectors_read: EWF-S01 format should not contain ltree section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			return( -1 );
		}
	}
	internal_handle->ewf_format = EWF_FORMAT_L01;

	ltree = (EWF_LTREE *) libewf_common_alloc( EWF_LTREE_SIZE );

	if( ltree == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_ltree_read: unable to allocate ltree.\n" );

		return( -1 );
	}
	if( ewf_ltree_read( ltree, file_descriptor ) <= -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_ltree_read: unable to read ltree.\n" );

		libewf_common_free( ltree );

		return( -1 );
	}
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( ltree->unknown1, 16 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( ltree->tree_size, 4 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( ltree->unknown2, 4 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( ltree->unknown3, 4 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( ltree->unknown4, 20 ); );

	libewf_common_free( ltree );

	tree_data = ewf_tree_data_read( file_descriptor, ( size - EWF_LTREE_SIZE ) );

	LIBEWF_VERBOSE_EXEC( libewf_debug_header2_fprint( stderr, tree_data, size ); );

	libewf_common_free( tree_data );

	return( (int32_t) size );
}

/* Reads a data section
 * Returns the amount of bytes read, or -1 on error
 */
ssize_t libewf_section_data_read( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, size_t size )
{
	EWF_DATA *data             = NULL;
	EWF_CRC calculated_crc     = 0;
	EWF_CRC stored_crc         = 0;
	uint32_t amount_of_chunks  = 0;
	uint32_t sectors_per_chunk = 0;
	uint32_t bytes_per_sector  = 0;
	uint32_t amount_of_sectors = 0;
	uint32_t error_granularity = 0;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	if( internal_handle->ewf_format == EWF_FORMAT_S01 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_sectors_read: EWF-S01 format should not contain data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			return( -1 );
		}
	}
	if( size != EWF_DATA_SIZE )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: mismatch in section data size.\n" );

		return( -1 );
	}
	data = (EWF_DATA *) libewf_common_alloc( EWF_DATA_SIZE );

	if( data == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to create data.\n" );

		return( -1 );
	}
	if( ewf_data_read( data, file_descriptor ) < -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to read data.\n" );

		libewf_common_free( data );

		return( -1 );
	}
#ifdef HAVE_DEBUG_OUTPUT
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown1, 3 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown2, 16 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown3, 3 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown4, 12 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown5, 3 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown6, 4 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->unknown7, 963 ); );
	LIBEWF_VERBOSE_EXEC( libewf_dump_data( data->signature, 5 ); );
#endif
	if( ewf_crc_calculate( &calculated_crc, (uint8_t *) data, ( EWF_DATA_SIZE - EWF_CRC_SIZE ), 1 ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to calculate CRC.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( libewf_endian_convert_32bit( &stored_crc, data->crc ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to convert stored CRC value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( stored_crc != calculated_crc )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: CRC does not match (in file: %" PRIu32 " calculated: %" PRIu32 ").\n", stored_crc, calculated_crc );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	/* TODO add more checks
	 */
	if( internal_handle->media->media_type != data->media_type )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: media type does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &amount_of_chunks, data->amount_of_chunks ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to convert amount of chunks value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( internal_handle->media->amount_of_chunks != amount_of_chunks )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: amount of chunks does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &sectors_per_chunk, data->sectors_per_chunk ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to convert sectors per chunk value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( internal_handle->media->sectors_per_chunk != sectors_per_chunk )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: sectors per chunk does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &bytes_per_sector, data->bytes_per_sector ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to convert bytes per sector value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( internal_handle->media->bytes_per_sector != bytes_per_sector )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: bytes per sector does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &amount_of_sectors, data->amount_of_sectors ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to convert amount of sectors value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( internal_handle->media->amount_of_sectors != amount_of_sectors )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: amount of sectors does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( libewf_endian_convert_32bit( &error_granularity, data->error_granularity ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: unable to convert error granularity value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( internal_handle->media->error_granularity != error_granularity )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: error granularity does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( internal_handle->media->media_flags != data->media_flags )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: media flags do not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	if( libewf_common_memcmp( internal_handle->guid, data->guid, 16 ) != 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_read: GUID does not match in data section.\n" );

		if( internal_handle->error_tollerance < LIBEWF_ERROR_TOLLERANCE_COMPENSATE )
		{
			libewf_common_free( data );

			return( -1 );
		}
	}
	libewf_common_free( data );

	return( (int32_t) size );
}

/* Write a data section to file
 * Returns the amount of bytes written, or -1 on error
 */
ssize_t libewf_section_data_write( LIBEWF_INTERNAL_HANDLE *internal_handle, int file_descriptor, off_t start_offset )
{
	EWF_DATA *data              = NULL;
	ssize_t section_write_count = 0;
	ssize_t data_write_count    = 0;
	size_t size                 = EWF_DATA_SIZE;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	data = (EWF_DATA *) libewf_common_alloc( size );

	if( data == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: unable to create data.\n" );

		return( -1 );
	}
	if( libewf_common_memset( data, 0, size ) == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: unable to clear data.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( internal_handle->format == LIBEWF_FORMAT_FTK )
	{
		data->media_type = 0x01;
	}
	else
	{
		data->media_type = internal_handle->media->media_type;
	}
	data->media_flags = internal_handle->media->media_flags;

	if( libewf_endian_revert_32bit( internal_handle->media->amount_of_chunks, data->amount_of_chunks ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: unable to revert amount of chunks value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( libewf_endian_revert_32bit( internal_handle->media->sectors_per_chunk, data->sectors_per_chunk ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: unable to revert sectors per chunk value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( libewf_endian_revert_32bit( internal_handle->media->bytes_per_sector, data->bytes_per_sector ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: unable to revert bytes per sector value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( libewf_endian_revert_32bit( internal_handle->media->amount_of_sectors, data->amount_of_sectors ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_section_data_write: unable to revert amount of sectors value.\n" );

		libewf_common_free( data );

		return( -1 );
	}
	if( ( internal_handle->format == LIBEWF_FORMAT_ENCASE5 )
	 || ( internal_handle->format == LIBEWF_FORMAT_ENCASE6 )
	 || ( internal_handle->format == LIBEWF_FORMAT_LINEN5 )
	 || ( internal_handle->format == LIBEWF_FORMAT_LINEN6 )
	 || ( internal_handle->format == LIBEWF_FORMAT_EWFX ) )
	{
		data->compression_level = (uint8_t) internal_handle->compressio