Changes by: flatcap
Update of /cvsroot/linux-ntfs/linux-ntfs/ntfstools
In directory usw-pr-cvs1:/tmp/cvs-serv18829
Added Files:
efs.c indx.c sdh.c sds.c sii.c stdinfo.c upcase2.c usnjrnl.c
Log Message:
Crude tools for examining an NTFS Volume
--- NEW FILE ---
/*
* $Id: efs.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* EFS - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump EFS data
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
long display_sid (unsigned char *sid)
{
int revision;
int subauth_count;
int i;
unsigned long long ident_auth = 0;
revision = *sid; /* Should always be 1 */
sid++;
subauth_count = *sid; /* Number of Sub-authorities */
sid++;
for (i = 0; i < 6; i ++) /* This number is a 48 bit BIG-endian */
{
ident_auth <<= 8;
ident_auth += *sid;
sid++;
}
printf ("S-%d-%Lu", revision, ident_auth);
for (i = 0; i < subauth_count; i++)
{
printf ("-%u", *((unsigned long*) sid));
sid += 4;
}
return 8 + (subauth_count * 4);
}
int print_unicode (unsigned short *string)
{
unsigned char c = 0;
int length = 0;
if (!string)
{
return;
}
for (; c = *string; string++, length++)
{
printf ("%c", isprint (c) ? c : '.');
}
return length;
}
/* 0 = end
* n = size
* -n = size (buffer end)
*/
int dump_efs_entry (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int size = 0;
unsigned char *block = NULL;
unsigned long tmp = 0;
unsigned long length = 0;
if (!buffer)
return 0;
size = *((unsigned short*) (buffer + offset + 4));
if (size == 0)
{
return 0;
}
if ((offset + size) > bufsize)
{
printf ("ERROR\n");
return 0;
}
absoff += offset;
block = buffer + offset;
printf ("%06x 4 %02x %02x %02x %02x (version?)\n", absoff + 0, block[0], block[1], block[2], block[3]);
printf ("\n");
printf ("%06x 4 %02x %02x %02x %02x size of entry\n", absoff + 4, block[4], block[5], block[6], block[7]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 8, block[8], block[9], block[10], block[11]);
printf ("%06x 4 %02x %02x %02x %02x key length?\n", absoff + 12, block[12], block[13], block[14], block[15]);
printf ("%06x 4 %02x %02x %02x %02x offset to key?\n", absoff + 16, block[16], block[17], block[18], block[19]);
printf ("%06x 4 %02x %02x %02x %02x offset to final block?\n", absoff + 20, block[20], block[21], block[22], block[23]);
printf ("\n");
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 24, block[24], block[25], block[26], block[27]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 28, block[28], block[29], block[30], block[31]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 32, block[32], block[33], block[34], block[35]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 36, block[36], block[37], block[38], block[39]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 40, block[40], block[41], block[42], block[43]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 44, block[44], block[45], block[46], block[47]);
printf ("%06x 4 %02x %02x %02x %02x don't know?\n", absoff + 48, block[48], block[49], block[50], block[51]);
printf ("\n");
printf ("%06x V ", absoff + 52);
length = display_sid (buffer + offset + 52);
printf ("\n");
printf ("\n");
block = buffer + offset + 52 + length;
printf ("%06x 4 %02x %02x %02x %02x offset to key?\n", absoff + 80, block[0], block[1], block[2], block[3]);
printf ("%06x 4 %02x %02x %02x %02x size of key?\n", absoff + 84, block[4], block[5], block[6], block[7]);
printf ("%06x 4 %02x %02x %02x %02x offset to string 1\n", absoff + 88, block[8], block[9], block[10], block[11]);
printf ("%06x 4 %02x %02x %02x %02x offset to string 2\n", absoff + 92, block[12], block[13], block[14], block[15]);
printf ("%06x 4 %02x %02x %02x %02x offset to string 3\n", absoff + 96, block[16], block[17], block[18], block[19]);
printf ("\n");
printf ("160 bits\n");
printf ("%06x 4 %02x %02x %02x %02x key?\n", absoff + 100, block[20], block[21], block[22], block[23]);
printf ("%06x 4 %02x %02x %02x %02x key?\n", absoff + 104, block[24], block[25], block[26], block[27]);
printf ("%06x 4 %02x %02x %02x %02x key?\n", absoff + 108, block[28], block[29], block[30], block[31]);
printf ("%06x 4 %02x %02x %02x %02x key?\n", absoff + 112, block[32], block[33], block[34], block[35]);
printf ("%06x 4 %02x %02x %02x %02x key?\n", absoff + 116, block[36], block[37], block[38], block[39]);
printf ("\n");
length = 0;
tmp = *((unsigned long*) (block + 8));
if (tmp)
{
printf ("%06x V \"", absoff + 80 + tmp);
length += 2 * (print_unicode ((unsigned short*)(block + tmp)) + 1);
printf ("\"\n");
}
tmp = *((unsigned long*) (block + 12));
if (tmp)
{
printf ("%06x V \"", absoff + 80 + tmp);
length += 2 * (print_unicode ((unsigned short*)(block + tmp)) + 1);
printf ("\"\n");
}
tmp = *((unsigned long*) (block + 16));
if (tmp)
{
printf ("%06x V \"", absoff + 80 + tmp);
length += 2 * (print_unicode ((unsigned short*)(block + tmp)) + 1);
printf ("\"\n");
}
printf ("\n");
absoff += length;
block += length + 40;
printf ("1024 bits\n");
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 120, block[0], block[1], block[2], block[3], block[4], block[5], block[6], block[7], block[8], block[9], block[10], block[11], block[12], block[13], block[14], block[15]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 136, block[16], block[17], block[18], block[19], block[20], block[21], block[22], block[23], block[24], block[25], block[26], block[27], block[28], block[29], block[30], block[31]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 152, block[32], block[33], block[34], block[35], block[36], block[37], block[38], block[39], block[40], block[41], block[42], block[43], block[44], block[45], block[46], block[47]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 168, block[48], block[49], block[50], block[51], block[52], block[53], block[54], block[55], block[56], block[57], block[58], block[59], block[60], block[61], block[62], block[63]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 184, block[64], block[65], block[66], block[67], block[68], block[69], block[70], block[71], block[72], block[73], block[74], block[75], block[76], block[77], block[78], block[79]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 200, block[80], block[81], block[82], block[83], block[84], block[85], block[86], block[87], block[88], block[89], block[90], block[91], block[92], block[93], block[94], block[95]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 216, block[96], block[97], block[98], block[99], block[100], block[101], block[102], block[103], block[104], block[105], block[106], block[107], block[108], block[109], block[110], block[111]);
printf ("%06x 16 %02x %02x %02x %02x %02x %02x %02x %02x - %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 232, block[112], block[113], block[114], block[115], block[116], block[117], block[118], block[119], block[120], block[121], block[122], block[123], block[124], block[125], block[126], block[127]);
printf ("\n");
block += 128;
printf ("final block\n");
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 248, block[0], block[1], block[2], block[3]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 252, block[4], block[5], block[6], block[7]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 256, block[8], block[9], block[10], block[11]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 260, block[12], block[13], block[14], block[15]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 264, block[16], block[17], block[18], block[19]);
printf ("\n");
return size;
}
int dump_efs (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int size = 0;
int i = 0;
unsigned char *block = NULL;
if (!buffer)
return 0;
size = *((unsigned short*) (buffer + offset));
if (size == 0)
{
return 0;
}
if ((offset + size) > bufsize)
{
printf ("ERROR\n");
return 0;
}
absoff += offset;
block = buffer + offset;
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x size of record\n", absoff + 0, block[0], block[1], block[2], block[3], block[4], block[5], block[6], block[7]);
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x don't know\n", absoff + 8, block[8], block[9], block[10], block[11], block[12], block[13], block[14], block[15]);
printf ("\n");
printf ("256 bits\n");
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 16, block[16], block[17], block[18], block[19], block[20], block[21], block[22], block[23]);
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 24, block[24], block[25], block[26], block[27], block[28], block[29], block[30], block[31]);
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 32, block[32], block[33], block[34], block[35], block[36], block[37], block[38], block[39]);
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 40, block[40], block[41], block[42], block[43], block[44], block[45], block[46], block[47]);
printf ("\n");
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 48, block[48], block[49], block[50], block[51], block[52], block[53], block[54], block[55]);
printf ("%06x 8 %02x %02x %02x %02x %02x %02x %02x %02x\n", absoff + 56, block[56], block[57], block[58], block[59], block[60], block[61], block[62], block[63]);
printf ("\n");
printf ("%06x 4 %02x %02x %02x %02x offset to entry 1\n", absoff + 64, block[64], block[65], block[66], block[67]);
printf ("%06x 4 %02x %02x %02x %02x offset to entry 2\n", absoff + 68, block[68], block[69], block[70], block[71]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 72, block[72], block[73], block[74], block[75]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 76, block[76], block[77], block[78], block[79]);
printf ("%06x 4 %02x %02x %02x %02x don't know\n", absoff + 80, block[80], block[81], block[82], block[83]);
printf ("\n");
for (i = 0; i < 2; i++)
{
offset = *((unsigned long*) (block + 64 + 4*i));
if (!offset)
break;
printf ("Entry %d\n", i+1);
dump_efs_entry (buffer, offset, bufsize, absoff);
}
return 0;
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[4096];
int absoff = 0;
int offset = 0;
int ret = 0;
int skip = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer + skip, sizeof (buffer) - skip, 1, f) == 1)
{
skip = 0;
offset = 0;
do
{
ret = dump_efs (buffer, offset, sizeof (buffer), absoff);
offset += ret;
}
while (ret > 0);
absoff += sizeof (buffer);
}
fclose (f);
return 0;
}
--- NEW FILE ---
/*
* $Id: indx.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* Indx - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump and INDX Record
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
void unfixup (unsigned char *buffer, int bufsize)
{
int num = bufsize / 512;
int off = *((unsigned short*) (buffer + 4));
int size = *((unsigned short*) (buffer + 6));
unsigned short fixup = 0;
int i;
if ((num + 1) != size)
{
printf ("fixup error\n");
return;
}
for (i = 1; i <= num; i++)
{
fixup = *((unsigned short*) (buffer + off + 2*i));
//printf ("f %04x @ %04x\n", fixup, 512*i - 2);
*((unsigned short*) (buffer + 512*i - 2)) = fixup;
}
}
int bitcount (unsigned long l)
{
int count = 0;
while (l)
{
if (l & 1)
count++;
l>>=1;
}
return count;
}
/* 0 = end
* n = size
* -n = size (buffer end)
*/
int dump_indx (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int indexflags = 0;
int size = 0;
int fs = 0;
int i;
if (!buffer)
return 0;
size = *((unsigned short*) (buffer + offset + 8));
if (size == 0)
{
return 0;
}
if ((offset + size) > bufsize)
{
printf ("ERROR\n");
return 0;
}
indexflags = *((unsigned short*) (buffer + offset + 12));
if (indexflags & 2)
{
printf ("END MARKER\n");
size = 0;
}
else
{
printf ("%06x mft reference of file 0x%016llx\n", absoff + offset + 0, *((unsigned long long*) (buffer + offset + 0)));
printf ("%06x size of index entry 0x%04x\n", absoff + offset + 8, *((unsigned short*) (buffer + offset + 8)));
printf ("%06x offset to filename 0x%04x\n", absoff + offset + 10, *((unsigned long long*) (buffer + offset + 10)));
printf ("%06x index flags %02x %02x (%d bits)\n", absoff + offset + 12, buffer[offset+12], buffer[offset+13], bitcount (*((unsigned short*) (buffer + offset + 12))));
printf ("%06x padding %02x %02x\n", absoff + offset + 14, buffer[offset+14], buffer[offset+15]);
printf ("%06x mft reference of parent 0x%016llx\n",absoff + offset + 16, *((unsigned long long*) (buffer + offset + 16)));
printf ("%06x c time 0x%016llx\n", absoff + offset + 24, *((unsigned long long*) (buffer + offset + 24)));
printf ("%06x a time 0x%016llx\n", absoff + offset + 32, *((unsigned long long*) (buffer + offset + 32)));
printf ("%06x m time 0x%016llx\n", absoff + offset + 40, *((unsigned long long*) (buffer + offset + 40)));
printf ("%06x r time 0x%016llx\n", absoff + offset + 48, *((unsigned long long*) (buffer + offset + 48)));
printf ("%06x alloc size 0x%016llx\n", absoff + offset + 56, *((unsigned long long*) (buffer + offset + 56)));
printf ("%06x real size 0x%016llx\n", absoff + offset + 64, *((unsigned long long*) (buffer + offset + 64)));
printf ("%06x file flags %02x %02x %02x %02x %02x %02x %02x %02x (%d bits)\n",absoff + offset + 72, buffer[offset+72], buffer[offset+73], buffer[offset+74], buffer[offset+75], buffer[offset+76], buffer[offset+77], buffer[offset+78], buffer[offset+79], bitcount (*((unsigned long*) (buffer + offset + 72))) + bitcount (*((unsigned long*) (buffer + offset + 76))));
printf ("%06x length of filename %d\n", absoff + offset + 80, buffer[offset+80]);
printf ("%06x filename space %d\n", absoff + offset + 81, buffer[offset+81]);
printf ("%06x filename \"", absoff + offset + 82);
fs = *((unsigned char*) (buffer + offset + 80)) * 2;
for (i = 0; i < fs; i += 2)
{
printf ("%c", buffer[offset + 82 + i]);
}
printf ("\"\n");
if (indexflags & 1) // mutually exclusive to 2
{
printf ("%06x VCN of index buffer with subnode 0x%016llx\n", absoff + offset + size - 8, *((unsigned long long*) (buffer + offset + size -8)));
}
}
printf ("\n");
return size;
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[4096];
int absoff = 0;
int offset = 0;
int ret = 0;
int skip = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer + skip, sizeof (buffer) - skip, 1, f) == 1)
{
unfixup (buffer, sizeof (buffer));
skip = 0;
offset = 0x40;/*4KB cluster, skip INDX header*/
do
{
ret = dump_indx (buffer, offset, sizeof (buffer), absoff);
offset += ret;
}
while (ret > 0);
absoff += sizeof (buffer);
}
fclose (f);
return 0;
}
--- NEW FILE ---
/*
* $Id: sdh.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* SDH - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump the $SDH Index
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
/* 0 = end
* n = size
* -n = size (buffer end)
*/
int dump_sdh (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int size = 0;
if (!buffer)
return 0;
if ((bufsize - offset) < 20) // needed to read the size
{
printf ("overflow1\n");
return offset - bufsize;
}
size = *((unsigned short*) (buffer + offset + 8));
if (size == 0)
{
printf ("zero size\n");
return 0;
}
if ((offset + size) > bufsize)
{
printf ("overflow2\n");
return offset - bufsize;
}
printf ("%06x 0x%04x offset to data\n", absoff + offset + 0, *((unsigned short*) (buffer + offset + 0)));
printf ("%06x 0x%04x size of data\n", absoff + offset + 2, *((unsigned short*) (buffer + offset + 2)));
printf ("%06x 0x%08lx padding\n", absoff + offset + 4, *((unsigned long*) (buffer + offset + 4)));
printf ("%06x 0x%04x size of index entry\n", absoff + offset + 8, *((unsigned short*) (buffer + offset + 8)));
printf ("%06x 0x%04x size of index key\n", absoff + offset + 10, *((unsigned short*) (buffer + offset + 10)));
printf ("%06x 0x%04x flags\n", absoff + offset + 12, *((unsigned short*) (buffer + offset + 12)));
printf ("%06x 0x%04x padding\n", absoff + offset + 14, *((unsigned short*) (buffer + offset + 14)));
printf ("%06x %02x %02x %02x %02x %02x %02x %02x %02x key\n", absoff + offset + 16, buffer[offset+16], buffer[offset+17], buffer[offset+18], buffer[offset+19], buffer[offset+20], buffer[offset+21], buffer[offset+22], buffer[offset+23]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 24, buffer[offset+24], buffer[offset+25], buffer[offset+26], buffer[offset+27]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 28, buffer[offset+28], buffer[offset+29], buffer[offset+30], buffer[offset+31]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 32, buffer[offset+32], buffer[offset+33], buffer[offset+34], buffer[offset+35]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 36, buffer[offset+36], buffer[offset+37], buffer[offset+38], buffer[offset+39]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 40, buffer[offset+40], buffer[offset+41], buffer[offset+42], buffer[offset+43]);
printf ("%06x 0x%08x padding\n", absoff + offset + 0, *((unsigned long*) (buffer + offset + 44)));
printf ("\n");
return size;
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[4096];
int absoff = 0;
int offset = 0;
int ret = 0;
int skip = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer + skip, sizeof (buffer) - skip, 1, f) == 1)
{
skip = 0;
offset = 0x40; // Skip INDX header
do
{
ret = dump_sdh (buffer, offset, sizeof (buffer), absoff);
offset += ret;
}
while (ret > 0);
if (ret == 0)
{
printf ("end\n");
break;
}
printf ("ret = %d\n", ret);
skip = -ret;
memmove (buffer, buffer + sizeof (buffer) - skip, skip);
absoff += sizeof (buffer) - skip;
}
fclose (f);
return 0;
}
--- NEW FILE ---
/*
* $Id: sds.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* SDS - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump the $SDS Data Attribute
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
/* 0 = end
* n = size
* -n = size (buffer end)
*/
int dump_sds (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int size = 0;
int fs = 0;
int i;
int entry = 0;
int hash = 0;
if (!buffer)
return 0;
if ((bufsize - offset) < 20) // needed to read the size
{
printf ("overflow1\n");
return offset - bufsize;
}
size = *((unsigned long*) (buffer + offset + 16));
if (size == 0)
{
printf ("zero size\n");
return 0;
}
size += 15;
size &= ~15; // Align to a 16 byte boundary
if ((offset + size) > bufsize)
{
printf ("overflow2\n");
return offset - bufsize;
}
hash = *((int*) (buffer + offset + 0));
entry = *((int*) (buffer + offset + 8));
if (hash)
{
if (entry != (absoff + offset))
{
printf ("entry didn't match (%d,%d)\n", entry, absoff+offset);
return 0;
}
}
printf ("%06x 0x%08lx hash\n", absoff + offset + 0, *((unsigned long*) (buffer + offset + 0)));
printf ("%06x 0x%04x security id\n", absoff + offset + 4, *((unsigned long*) (buffer + offset + 4)));
printf ("%06x 0x%08llx offset of this entry\n", absoff + offset + 8, *((unsigned long long*) (buffer + offset + 8)));
printf ("%06x 0x%x (0x%x) size (aligned)\n", absoff + offset + 16, *((unsigned long*) (buffer + offset + 16)), size);
printf ("\n");
return size;
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[4096];
int absoff = 0;
int offset = 0;
int ret = 0;
int skip = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer + skip, sizeof (buffer) - skip, 1, f) == 1)
{
skip = 0;
offset = 0;
do
{
ret = dump_sds (buffer, offset, sizeof (buffer), absoff);
offset += ret;
}
while (ret > 0);
if (ret == 0)
{
printf ("end\n");
break;
}
printf ("ret = %d\n", ret);
skip = -ret;
memmove (buffer, buffer + sizeof (buffer) - skip, skip);
absoff += sizeof (buffer) - skip;
}
fclose (f);
return 0;
}
--- NEW FILE ---
/*
* $Id: sii.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* SII - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump the $SII Index
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
/* 0 = end
* n = size
* -n = size (buffer end)
*/
int dump_sii (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int size = 0;
if (!buffer)
return 0;
if ((bufsize - offset) < 20) // needed to read the size
{
printf ("overflow1\n");
return offset - bufsize;
}
size = *((unsigned short*) (buffer + offset + 8));
if (size == 0)
{
printf ("zero size\n");
return 0;
}
if ((offset + size) > bufsize)
{
printf ("overflow2\n");
return offset - bufsize;
}
printf ("%06x 0x%04x offset to data\n", absoff + offset + 0, *((unsigned short*) (buffer + offset + 0)));
printf ("%06x 0x%04x size of data\n", absoff + offset + 2, *((unsigned short*) (buffer + offset + 2)));
printf ("%06x 0x%08lx padding\n", absoff + offset + 4, *((unsigned long*) (buffer + offset + 4)));
printf ("%06x 0x%04x size of index entry\n", absoff + offset + 8, *((unsigned short*) (buffer + offset + 8)));
printf ("%06x 0x%04x size of index key\n", absoff + offset + 10, *((unsigned short*) (buffer + offset + 10)));
printf ("%06x 0x%04x flags\n", absoff + offset + 12, *((unsigned short*) (buffer + offset + 12)));
printf ("%06x 0x%04x padding\n", absoff + offset + 14, *((unsigned short*) (buffer + offset + 14)));
printf ("%06x %02x %02x %02x %02x key\n", absoff + offset + 16, buffer[offset+16], buffer[offset+17], buffer[offset+18], buffer[offset+19]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 20, buffer[offset+20], buffer[offset+21], buffer[offset+22], buffer[offset+23]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 24, buffer[offset+24], buffer[offset+25], buffer[offset+26], buffer[offset+27]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 28, buffer[offset+28], buffer[offset+29], buffer[offset+30], buffer[offset+31]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 32, buffer[offset+32], buffer[offset+33], buffer[offset+34], buffer[offset+35]);
printf ("%06x %02x %02x %02x %02x data\n", absoff + offset + 36, buffer[offset+36], buffer[offset+37], buffer[offset+38], buffer[offset+39]);
printf ("%06x 0x%08x padding\n", absoff + offset + 0, *((unsigned long*) (buffer + offset + 44)));
printf ("\n");
return size;
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[4096];
int absoff = 0;
int offset = 0;
int ret = 0;
int skip = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer + skip, sizeof (buffer) - skip, 1, f) == 1)
{
skip = 0;
offset = 0x40; // Skip INDX header
do
{
ret = dump_sii (buffer, offset, sizeof (buffer), absoff);
offset += ret;
}
while (ret > 0);
if (ret == 0)
{
printf ("end\n");
break;
}
printf ("ret = %d\n", ret);
skip = -ret;
memmove (buffer, buffer + sizeof (buffer) - skip, skip);
absoff += sizeof (buffer) - skip;
}
fclose (f);
return 0;
}
--- NEW FILE ---
/*
* $Id: stdinfo.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* StdInfo - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump the $STANDARD_INFORMATION Attribute
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
void unfixup (unsigned char *buffer, int bufsize)
{
int num = bufsize / 512;
int off = *((unsigned short*) (buffer + 4));
int size = *((unsigned short*) (buffer + 6));
unsigned short fixup = 0;
int i;
if ((num + 1) != size)
{
printf ("fixup error\n");
return;
}
for (i = 1; i <= num; i++)
{
fixup = *((unsigned short*) (buffer + off + 2*i));
//printf ("f %04x @ %04x\n", fixup, 512*i - 2);
*((unsigned short*) (buffer + 512*i - 2)) = fixup;
}
}
int bitcount (unsigned long l)
{
int count = 0;
while (l)
{
if (l & 1)
count++;
l>>=1;
}
return count;
}
void dump_stdinfo (unsigned char *buffer, int bufsize, int absoff)
{
int size = 0;
if (!buffer)
return;
if (0x10 != *((unsigned short*) (buffer + 0x30)))
{
printf ("%06x ERROR\n", absoff); // prob an extension record
return;
}
size = *((unsigned short*) (buffer + 0x34));
if (size != 0x60)
{
printf ("%06x Size = %x\n", absoff, size);
return;
}
printf ("Inode %d\n", absoff / 1024);
printf ("%06x Max Ver 0x%08lx\n", 0x24, *((unsigned long*) (buffer + 0x48 + 0x24)));
printf ("%06x Ver No 0x%08lx\n", 0x28, *((unsigned long*) (buffer + 0x48 + 0x28)));
printf ("%06x Cls Id 0x%08lx\n", 0x2c, *((unsigned long*) (buffer + 0x48 + 0x2c)));
printf ("%06x Own Id 0x%08lx\n", 0x30, *((unsigned long*) (buffer + 0x48 + 0x30)));
printf ("%06x Sec Id 0x%08lx\n", 0x34, *((unsigned long*) (buffer + 0x48 + 0x34)));
printf ("\n");
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[1024];
int absoff = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer, sizeof (buffer), 1, f) == 1)
{
unfixup (buffer, sizeof (buffer));
dump_stdinfo (buffer, sizeof (buffer), absoff);
absoff += sizeof (buffer);
}
fclose (f);
return 0;
}
--- NEW FILE ---
/*
* $Id: upcase2.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* UpCase - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* This utility will create an UpCase file, identical to the Metadata file.
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
#include <string.h>
int main (void)
{
static int run[][3] = { /* Start, End, Add */
{ 0x0061, 0x007B, -32 }, { 0x0451, 0x045D, -80 }, { 0x1F70, 0x1F72, 74 },
{ 0x00E0, 0x00F7, -32 }, { 0x045E, 0x0460, -80 }, { 0x1F72, 0x1F76, 86 },
{ 0x00F8, 0x00FF, -32 }, { 0x0561, 0x0587, -48 }, { 0x1F76, 0x1F78, 100 },
{ 0x0256, 0x0258, -205 }, { 0x1F00, 0x1F08, 8 }, { 0x1F78, 0x1F7A, 128 },
{ 0x028A, 0x028C, -217 }, { 0x1F10, 0x1F16, 8 }, { 0x1F7A, 0x1F7C, 112 },
{ 0x03AC, 0x03AD, -38 }, { 0x1F20, 0x1F28, 8 }, { 0x1F7C, 0x1F7E, 126 },
{ 0x03AD, 0x03B0, -37 }, { 0x1F30, 0x1F38, 8 }, { 0x1FB0, 0x1FB2, 8 },
{ 0x03B1, 0x03C2, -32 }, { 0x1F40, 0x1F46, 8 }, { 0x1FD0, 0x1FD2, 8 },
{ 0x03C2, 0x03C3, -31 }, { 0x1F51, 0x1F52, 8 }, { 0x1FE0, 0x1FE2, 8 },
{ 0x03C3, 0x03CC, -32 }, { 0x1F53, 0x1F54, 8 }, { 0x1FE5, 0x1FE6, 7 },
{ 0x03CC, 0x03CD, -64 }, { 0x1F55, 0x1F56, 8 }, { 0x2170, 0x2180, -16 },
{ 0x03CD, 0x03CF, -63 }, { 0x1F57, 0x1F58, 8 }, { 0x24D0, 0x24EA, -26 },
{ 0x0430, 0x0450, -32 }, { 0x1F60, 0x1F68, 8 }, { 0xFF41, 0xFF5B, -32 },
{ 0 }
};
static int dup[][2] = { /* Start, End */
{ 0x0100, 0x012F }, { 0x01A0, 0x01A6 }, { 0x03E2, 0x03EF }, { 0x04CB, 0x04CC },
{ 0x0132, 0x0137 }, { 0x01B3, 0x01B7 }, { 0x0460, 0x0481 }, { 0x04D0, 0x04EB },
{ 0x0139, 0x0149 }, { 0x01CD, 0x01DD }, { 0x0490, 0x04BF }, { 0x04EE, 0x04F5 },
{ 0x014A, 0x0178 }, { 0x01DE, 0x01EF }, { 0x04BF, 0x04BF }, { 0x04F8, 0x04F9 },
{ 0x0179, 0x017E }, { 0x01F4, 0x01F5 }, { 0x04C1, 0x04C4 }, { 0x1E00, 0x1E95 },
{ 0x018B, 0x018B }, { 0x01FA, 0x0218 }, { 0x04C7, 0x04C8 }, { 0x1EA0, 0x1EF9 },
{ 0 }
};
static int byte[][2] = { /* Offset, Value */
{ 0x00FF, 0x0178 }, { 0x01AD, 0x01AC }, { 0x01F3, 0x01F1 }, { 0x0269, 0x0196 },
{ 0x0183, 0x0182 }, { 0x01B0, 0x01AF }, { 0x0253, 0x0181 }, { 0x026F, 0x019C },
{ 0x0185, 0x0184 }, { 0x01B9, 0x01B8 }, { 0x0254, 0x0186 }, { 0x0272, 0x019D },
{ 0x0188, 0x0187 }, { 0x01BD, 0x01BC }, { 0x0259, 0x018F }, { 0x0275, 0x019F },
{ 0x018C, 0x018B }, { 0x01C6, 0x01C4 }, { 0x025B, 0x0190 }, { 0x0283, 0x01A9 },
{ 0x0192, 0x0191 }, { 0x01C9, 0x01C7 }, { 0x0260, 0x0193 }, { 0x0288, 0x01AE },
{ 0x0199, 0x0198 }, { 0x01CC, 0x01CA }, { 0x0263, 0x0194 }, { 0x0292, 0x01B7 },
{ 0x01A8, 0x01A7 }, { 0x01DD, 0x018E }, { 0x0268, 0x0197 },
{ 0 }
};
unsigned short buffer[65536];
FILE *f;
int r;
int i;
int ret = 1;
memset (buffer, 0, sizeof (buffer));
f = fopen ("upcase", "w+");
if (!f)
{
printf ("fopen\n");
goto end;
}
for (i = 0; i < sizeof (buffer) / 2; i++)
{
buffer[i] = i;
}
for (r = 0; run[r][0]; r++)
{
for (i = run[r][0]; i < run[r][1]; i++)
{
buffer[i] += run[r][2];
}
}
for (r = 0; dup[r][0]; r++)
{
for (i = dup[r][0]; i < dup[r][1]; i+=2)
{
buffer[i+1] -= 1;
}
}
for (r = 0; byte[r][0]; r++)
{
buffer[byte[r][0]] = byte[r][1];
}
if (fwrite (buffer, sizeof (buffer), 1, f) != 1)
{
printf ("fwrite\n");
goto close;
}
ret = 0;
close:
fclose (f);
end:
return ret;
}
--- NEW FILE ---
/*
* $Id: usnjrnl.c,v 1.1 2001/06/03 00:53:07 flatcap Exp $
*
* UsnJrnl - Part of the Linux-NTFS project.
*
* Copyright (c) 2001 Richard Russon.
*
* Dump $UsnJrnl data
*
* Richard Russon <nt...@fl...>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <stdio.h>
int bitcount (unsigned long l)
{
int count = 0;
while (l)
{
if (l & 1)
count++;
l>>=1;
}
return count;
}
/* 0 = end
* n = size
* -n = size (buffer end)
*/
int dump_usnjrnl (unsigned char *buffer, int offset, int bufsize, int absoff)
{
int size = 0;
int fs = 0;
int i;
if (!buffer)
return 0;
size = *((unsigned long*) (buffer + offset));
if (size == 0)
{
return 0;
}
if ((offset + size) > bufsize)
{
printf ("ERROR\n");
return 0;
}
printf ("%06x size 0x%x\n", absoff + offset + 0, *((unsigned long*) (buffer + offset + 0)));
printf ("%06x unknown1 %02x %02x %02x %02x\n", absoff + offset + 4, buffer[offset+4], buffer[offset+5], buffer[offset+6], buffer[offset+7]);
printf ("%06x mft reference 0x%016llx\n", absoff + offset + 8, *((unsigned long long*) (buffer + offset + 8)));
printf ("%06x mft reference 0x%016llx\n", absoff + offset + 16, *((unsigned long long*) (buffer + offset + 16)));
printf ("%06x offset in this file 0x%016llx\n", absoff + offset + 24, *((unsigned long long*) (buffer + offset + 24)));
printf ("%06x time 0x%016llx\n", absoff + offset + 32, *((unsigned long long*) (buffer + offset + 32)));
printf ("%06x unknown4 %02x %02x %02x %02x (%d bits)\n", absoff + offset + 40, buffer[offset+40], buffer[offset+41], buffer[offset+42], buffer[offset+43], bitcount (*((unsigned long*) (buffer + offset + 40))));
printf ("%06x unknown5 %02x %02x %02x %02x\n", absoff + offset + 44, buffer[offset+44], buffer[offset+45], buffer[offset+46], buffer[offset+47]);
printf ("%06x unknown6 %02x %02x %02x %02x (%d bits)\n", absoff + offset + 48, buffer[offset+48], buffer[offset+49], buffer[offset+50], buffer[offset+51], bitcount (*((unsigned long*) (buffer + offset + 48))));
printf ("%06x unknown7 %02x %02x %02x %02x (%d bits)\n", absoff + offset + 52, buffer[offset+52], buffer[offset+53], buffer[offset+54], buffer[offset+55], bitcount (*((unsigned long*) (buffer + offset + 52))));
printf ("%06x filename \"", absoff + offset + 56);
fs = *((unsigned short*) (buffer + offset + 56));
for (i = 0; i < fs; i += 2)
{
printf ("%c", buffer[offset + 56 + i + 4]);
}
printf ("\"\n\n");
if (offset + size >= bufsize)
size = 0;
return size;
}
int main (int argc, char *argv[])
{
FILE *f = NULL;
unsigned char buffer[4096];
int absoff = 0;
int offset = 0;
int ret = 0;
int skip = 0;
if (argc != 2)
{
printf ("args\n");
return 1;
}
f = fopen (argv[1], "r");
if (!f)
{
printf ("fopen");
return 1;
}
memset (buffer, 0, sizeof (buffer));
while (fread (buffer + skip, sizeof (buffer) - skip, 1, f) == 1)
{
skip = 0;
offset = 0;
do
{
ret = dump_usnjrnl (buffer, offset, sizeof (buffer), absoff);
offset += ret;
}
while (ret > 0);
absoff += sizeof (buffer);
}
fclose (f);
return 0;
}
|