afinfo.cpp

sleuthit-2.09 一个磁盘的工具集

{
    unsigned long arg;

    /* Check to see if this is a null page. */
    if(segname[0]==0 && opt_all==0){
	return;
    }

    /* Check to see if this is a data page */
    int64 page_num = af_segname_page_number(segname);
	
    size_t data_len = 0;
    /* First find out how big the segment is, then get the data */
    if(af_get_seg(af,segname,&arg,0,&data_len)){
	printf("%-25s  SEGMENT NOT FOUND\n",segname);
	return;
    }

    /* Start the output line */

    char output_line[OUTLINE_LEN];		
    memset(output_line,0,sizeof(output_line));

    /* Now append the arg and the data len */
    sprintf(output_line,"%-24s %8ld   %6ld   ",segname,arg,(long)data_len);

    if(opt_no_data){
	printf("%s\n",output_line);
	return;
    }

    unsigned char *data = (unsigned char *)malloc(data_len);
    if(af_get_seg(af,segname,0,data,&data_len)){
	warn("af_get_seg_2");
	free(data);
	return;
    }

    /* Special handling of values that should be displayed as time */
    if(display_as_time(segname)){
	int hours   = arg / 3600;
	int minutes = (arg / 60) % 60;
	int seconds = arg % 60;
	printf("%s= %02d:%02d:%02d (hh:mm:ss)\n",output_line,hours,minutes,seconds);
	free(data);
	return;
    }

    /* Special handling of quadwords that should be printed as such? */
    if(((arg == AF_SEG_QUADWORD) && (data_len==8)) || display_as_quad(segname)){
	/* Print it as a 64-bit value.
	 * The strcmp is there because early AF_IMAGESIZE segs didn't set
	 * AF_SEG_QUADWORD...
	 */
	switch(data_len){
	case 8:
	    printf("%s= %"I64d" (64-bit value)\n",
		   output_line,af_decode_q(data));
	    break;
	case 0:
	    printf("%s= 0 (0-length segment)\n",output_line);
	    break;
	default:
	    printf("%s= CANNOT DECODE %d byte segment\n",output_line,(int)data_len);
	}
	free(data);
	return;
    }


    /* See if I need to truncate */
    int dots = 0;
    uint display_len = data_len;
    if(opt_wide==0 && data_len>32){ // don't bother showing more than first 32 bytes
	dots = 1;
	display_len = 32;
    }
	    
    char *cc = output_line + strlen(output_line);

    if(display_as_hex(segname,display_len)){
	char buf[80];
	snprintf(cc,sizeof(output_line)-strlen(output_line),
		 "%s%s",af_hexbuf(buf,sizeof(buf),data,display_len,opt_hexbuf),
		dots ? "..." : "");
	/* Special code for SHA1 */
	if(!opt_wide && strcmp(segname,AF_SHA1)==0){
	    fwrite(output_line,1,78,stdout);
	    printf("\n%49s\n",output_line+78);
	    free(data);
	    return;
	}
    }
    else {
	/* Fill it out with some printable data */
	unsigned int i;
	if(display_len > sizeof(output_line)-strlen(output_line)){
	    display_len = sizeof(output_line)-strlen(output_line);
	}
	for(i=0;i<display_len;i++){
	    *cc = data[i];
	    if(isprint(*cc)==0) *cc='.';
	    if(*cc=='\n' || *cc=='\r') *cc=' ';
	    cc++;
	}
	*cc = 0;
    }
	
    /* Now print the results... */
    if(!opt_wide){
	if(strlen(output_line)>cols){
	    output_line[cols-4] = '.';
	    output_line[cols-3] = '.';
	    output_line[cols-2] = '.';
	    output_line[cols-1] = '\000';
	}
    }
    fputs(output_line,stdout);
    if(page_num>=0 && opt_b){
	badscan(af,page_num,data_len);
    }
    if(opt_page_validate && page_num>=0){
	/* Get the page again; this may involve decompression */
	unsigned char *page_data = (unsigned char *)malloc(af->image_pagesize);
	size_t page_data_len = af->image_pagesize;
	if(af_get_page(af,page_num,page_data,&page_data_len)){
	    printf("** COULD NOT READ UNCOMPRESSED PAGE ");
	    goto skip1;
	}

	char hash_segname[32];
	unsigned char hash_buf[16];
	unsigned char hash_calc[16];
	size_t hash_len = sizeof(hash_buf);
	snprintf(hash_segname,sizeof(hash_segname),AF_PAGE_MD5,page_num);
	printf("          ");
	if(af_get_seg(af,hash_segname,0,hash_buf,&hash_len)){
	    printf("** NO SEGMENT %s ** ",hash_segname);
	    goto skip1;
	}
	
	MD5(page_data,page_data_len,hash_calc);
	if(memcmp(hash_buf,hash_calc,sizeof(hash_buf))!=0){
	    char hb[32];
	    printf("** HASH INVALID **\n%30s Calculated %s\n","",
		   af_hexbuf(hb,sizeof(hb),hash_calc,16,opt_hexbuf));
	    printf("%30s Wanted %s ","",af_hexbuf(hb,sizeof(hb),hash_buf,16,opt_hexbuf));
	    printf("data_len=%d\n",(int)data_len);
	} else{
	    printf("HASH OK ");
	}
	free(page_data);
    }
 skip1:;
    putchar('\n');

    free(data);
}


int info_file(const char *infile)
{
    unsigned long total_segs = 0;
    unsigned long total_pages = 0;
    unsigned long total_hashes = 0;
    unsigned long null_segs = 0;

    AFFILE *af = af_open(infile,O_RDONLY,0);
    
    if(!af){
	err(1,"Cannot open %s",infile);
    }

    printf("\n%s\n",af_filename(af));
    if(opt_all==0) printf("[skipping data segments]\n");
    printf("                                      data       \n");
    printf("Segment                       arg    length    data\n");
    printf("=======                 =========    ======    ====\n");

    /* If a list of segments was specified by the user, just use that list */
    if(opt_seglist.size()>0){
	for(vector<string>::iterator i = opt_seglist.begin(); i != opt_seglist.end(); i++){
	    print_info(af,i->c_str());
	}
	af_close(af);
	return 0;
    }

    /* Go through the whole file, get all of the segments, put them in a list */
    vector <string> segments;
    char segname[AF_MAX_NAME_LEN];
    af_rewind_seg(af);			// start at the beginning
    memset(segname,0,sizeof(segname));
    while(af_get_next_seg(af,segname,sizeof(segname),0,0,0)==0){

	total_segs ++;
	if(segname[0]==0) null_segs++;

	/* Check to see if this is a regular page or a hash page */
	char hash[64];
	int64 page_num = af_segname_page_number(segname);
	int64 hash_num = af_segname_hash_page_number(segname,hash,sizeof(hash));
	if(page_num>=0) total_pages++;
	if(hash_num>=0) total_hashes++;
	if(opt_all==0 && (page_num>=0||hash_num>=0)) continue;	// skip
	segments.push_back(segname);
    }

    /* Now process the segments */
    for(vector<string>::iterator i = segments.begin(); i != segments.end(); i++){
	print_info(af,i->c_str());
    }
    printf("\n");
    printf("Page  segments:        %8lu\n",total_pages);
    printf("Hash  segments:        %8lu\n",total_hashes);
    printf("Total segments:        %8lu\n", total_segs);
    //printf("Empty segments:        %8lu\n",null_segs);

    int64 device_sectors = 0;
    af_get_segq(af,AF_DEVICE_SECTORS,&device_sectors);
    if(device_sectors==0){
	/* See if we can fake it */
	unsigned long cylinders=0;
	unsigned long heads=0;
	unsigned long sectors_per_track=0;
	af_get_seg(af,AF_CYLINDERS,&cylinders,0,0);
	af_get_seg(af,AF_HEADS,&heads,0,0);
	af_get_seg(af,AF_SECTORS_PER_TRACK,&sectors_per_track,0,0);
	device_sectors = cylinders * heads * sectors_per_track;
    }
    //printf("device_sectors=%qd\n",device_sectors);


    if(af->image_pagesize && af->image_sectorsize && device_sectors){
	int64 device_bytes = (int64)device_sectors * af->image_sectorsize;
	int64 device_pages = (device_bytes+af->image_pagesize-1) / af->image_pagesize;
	int64 missing_pages = device_pages - total_pages;
	//printf("device_bytes=%qd\n",device_bytes);
	//printf("device_pages=%qd\n",device_pages);
	if(missing_pages!=0){
	    printf("Missing page segments: %8"I64u"\n",missing_pages);
	}
    }
    else{
	printf("Cannot calculate missing pages\n");
	printf("  device_sectors=%"I64d" image_pagesize=%"I64d" sectorsize=%d\n",
	       device_sectors,af->image_pagesize,af->image_sectorsize);
    }
    af_close(af);
    return 0;

}
	 

int main(int argc,char **argv)
{
    int ch;
    const char *infile;

    /* Figure out how many cols the screen has... */
#ifdef HAVE_LIBNCURSES
    setupterm((char *)0,1,(int *)0);
    cols = tgetnum("co");
#endif

    while ((ch = getopt(argc, argv, "abh?s:SmiIwj:pxVX")) != -1) {
	switch (ch) {
	case 'a': opt_all++; break;
	case 'b': opt_all ++; opt_b   ++; break;
	case 'i': opt_info=0; opt_identify = 1; break;
	case 'w': opt_wide++; break;
	case 'X': opt_no_data++;break;
	case 'x': opt_x++; break;
	case 'y': opt_y++; break;
	case 'm': opt_validate |= VALIDATE_MD5; break;
	case 'S': opt_validate |= VALIDATE_SHA1; break;
	case 'p': opt_page_validate = 1;break;

	case 'h':
	case '?':
	default:
	    usage();
	    break;
	case 's':
	    opt_seglist.push_back(optarg); // add to the list of segments to info
	    break;
	case 'V':
	    printf("%s version %s\n",progname,PACKAGE_VERSION);
	    exit(0);
	}
    }
    argc -= optind;
    argv += optind;

    if(argc<1){
	usage();
    }


    /* Loop through all of the files */
    while(*argv){
	infile = *argv++;		// get the file
	argc--;				// decrement argument counter
	 
	const char *name = af_identify_file_name(infile,1);
	if(!name) err(1,"%s",infile);

	if(opt_identify) printf("%s is a %s file\n",infile,name);
	 
	if(opt_info)	 info_file(infile);
	if(opt_validate) validate(infile);
    }
#ifdef USE_S3
    s3_audit(0);
#endif
    return 0;
}