afflib.h

sleuthit-2.09 一个磁盘的工具集

#ifndef _AFFLIB_H_
#define _AFFLIB_H_ 

/*
 * afflib.h:
 * 
 * This file describes the public AFFLIB interface.
 * The interface to reading AFF files and Raw files. 
 * (Soon Encase files!)
 */

/* Figure out what kind of OS we are running on */

/* Check to make sure config.h was included */

/* These are both needed; no need to bother with config.h #defines */
#include <stdio.h>
#include <sys/types.h>

#ifdef HAVE_SYS_CDEFS_H
#include <sys/cdefs.h>
#endif

#ifdef __FreeBSD__
#define BSD_LIKE
#endif

#ifdef __OpenBSD__
#define BSD_LIKE
#endif

#ifdef __NetBSD__
#define BSD_LIKE
#endif

#ifdef __APPLE__
#define BSD_LIKE
#endif

#ifdef BSD_LIKE
#define UNIX
typedef unsigned long long uint64;
typedef long long int64;
#define I64d "qd"
#define I64u "qu"
#endif

#ifdef linux
#define UNIX
typedef unsigned long long uint64;
typedef long long  int64;
#define I64d "qd"
#define I64u "qu"
/* Horrible lossage stuff for largefile support under Linux */
#define _LARGEFILE_SOURCE 1
#define _FILE_OFFSET_BITS 64
#endif

#ifdef sun
typedef unsigned long long uint64;
typedef long long  int64;
#define I64d "qd"
#define I64u "qu"
#define UNIX
#ifdef HAVE_INTTYPES_H
#include <inttypes.h>
#endif
#endif 

#ifdef __CYGWIN__
typedef unsigned long long uint64;
typedef long long  int64;
#define I64d "qd"
#define I64u "qu"
#define UNIX
#endif



/* WIN32 is defined by the NMAKE makefile for Visual C++ under Windows */
#ifdef WIN32                            
typedef unsigned long uint;
typedef unsigned _int64 uint64;		/* 64-bit types Types */
typedef          _int64  int64;
#define I64d      "I64d"		/* windows doesn't do %qd */
#define I64u      "I64u"
int64   ftello(FILE *stream);	 /* Functions that Microsoft forgot */
int     fseeko(FILE *stream,int64 offset,int whence);
#endif


/* If our types still aren't defined, assume that we are running
 * on some kind of Unix with GCC.
 */
#ifndef I64d
/* Assume some kind of Unix running GCC */
typedef unsigned long long uint64;
typedef long long int64;
#define I64d "qd"
#define I64u "qu"
#define UNIX
#endif 

#define USE_LZMA

struct affcallback_info;
struct aff_pagebuf {
    int64         pagenum;		// -1 means no page loaded 
    unsigned char *pagebuf;		// where the data is; size is image_pagesize
    size_t        pagebuf_bytes;        // number of bytes in the pagebuf that are valid.
    unsigned int  pagenum_valid:1;	// buffer contains data
    unsigned int  pagebuf_valid:1;	// buffer contains data
    unsigned int  pagebuf_dirty:1;	// data was modified
    int		  last;			// when the page was last visited
};

typedef struct _AFFILE {
    int     version;			// 2
    void   *tag;			// available to callers; unused by AFFLIB
    struct af_vnode *v;			// which function table to use.
    struct _AFFILE *parent;		// if we have one

    /* For all files */
    int     openflags;			// how it was opened
    int     openmode;			// how we were asked to open it; more
    int     exists;			// did file exist before open was called?

    /* For extended logging */
    char    *fname;			// Filename of file; be sure to free when done
    char    error_str[64];		// what went wrong

    /* Implement a stream abstraction */
    uint64        image_size;		// last mappable byte of disk image
    uint64        image_size_in_file;	// see if it was changed...
    unsigned long image_pagesize;	// the size of image data segments in this file
    unsigned long image_sectorsize;
    uint64	  pos;			// location in stream
    unsigned int  writing:1;		// is file open for writing?

    /* Page buffer cache */
    struct aff_pagebuf *pb;		// the current page buffer
    struct aff_pagebuf *pbcache;	// array of pagebufs
    int		num_pbufs;	   // number of pagebufs; default is 1
    int		afftime;		// for updating last
    int64	cur_page;		// used by vnode_raw and vnode_ewf to fake pages

    int		  debug;		// for debugging, of course
    unsigned int  badflag_set:1;	// is badflag set?
    unsigned char *badflag;		// bad sector flag


    /****************************************************************/
    /* Right now the instance variables for each implementation are here,
     * which is ugly but easier for development...
     */

    /* For AFF Segment Files; this could be moved into private storage... */
    FILE          *aseg;
    struct af_toc_mem *toc;		// table of contents
    int	           toc_count;	       // number of directory elements
    unsigned int   disable_toc:1;	// true if ToC is not in use because of error

    /****************************************************************/

    /* additional support for writing. */
    unsigned int compression_type;	// preferred compression type
    int		 compression_level;	// 0 is no compression

    /* w_callback:
     * A callback that is called before and after each segment is written.
     * Called with the arguments (i,0,0) at the beginning of the write operation.
     * Called with the arguments (i,j,k) at the end of the write operation.
     * i = segment number
     * j = segment length
     * If segment is being written with compresison, k = compressed length.
     * If segment is written w/o compression, k = 0
     */
    void (*w_callback)(struct affcallback_info *acbi);
    // called at start and end of compression.

    uint64	maxsize;		// maximum file size of a multi-segment files,
                                        // or 0 if this is not a multi-segment file

    /* Performance Counters */
    uint64	bytes_memcpy;		// total number of bytes memcpy'ed
    uint64      pages_written;		// total number of pages written
    uint64      pages_compressed;	// total number of pages compressed
    uint64	pages_decompressed;
    uint64      pages_read;		// total number of pages read
    uint64	bytes_written;
    uint64	cache_hits;
    uint64	cache_misses;		// total number of pages flushed from cache

    void	*vnodeprivate;	      // private storage for the vnode
    void	(*error_reporter)(const char *fmt, ...);
} AFFILE;

/* The information that is provided in the aff callback */
struct affcallback_info {
    int info_version;			// version number for this segment
    AFFILE *af;				// v1: the AFFILE responsibile for the callback 
    int phase;				// v1: 1 = before compress; 2 = after compressing;
					//     3 = before writing; 4 = after writing
    int64 pagenum;			// v1: page number being written
    int bytes_to_write;			// v1: >0 if we are going to write bytes
    int bytes_written;			// v1: >0 if bytes were written
    int compressed;			// v1: >0 if bytes were/will be compressed
    int compression_alg;		// v1: compression algorithm
    int compression_level;		// v1: compression level
};

/* Utility Functions */

#ifdef __cplusplus
extern "C" {
#endif
#ifdef __never_defined__
}
#endif

/****************************************************************
 ***
 *** Intended user AFF interface
 ***
 ****************************************************************/

/* af_file stream functions */
int     af_identify_file_type(const char *filename,int exists); // returns type of a file; if exists=1, file must exist
const char *af_identify_file_name(const char *filename,int exists); // returns name of a file type; 

AFFILE *af_open(const char *filename,int flags,int mode);
AFFILE *af_freopen(FILE *file);		// reopen a raw file as an AFFILE
AFFILE *af_popen(const char *command,const char *type);	// no need to use pclose(); af_close() is fine
int	af_close(AFFILE *af);
void	af_set_error_reporter(AFFILE *af,void (*reporter)(const char *fmt,...));
void	af_stats(AFFILE *af,FILE *f);	// print stats to f
void	af_set_cachesize(AFFILE *af,int max); // how much memory can the cache use?


/* Special AFOPEN flags */
#define AF_OPEN_PRIMITIVE (1<<31)	// only open primtive, not compound files