|
From: Anton A. <an...@us...> - 2001-06-15 16:45:16
|
Changes by: antona
Update of /cvsroot/linux-ntfs/linux-ntfs/ntfstools
In directory usw-pr-cvs1:/tmp/cvs-serv11321
Added Files:
logfile.c dumplog.c
Log Message:
New log dumper to operate on a file rather than a partition and it is more
advanced and corrected compared to ntfsdump_logfile.
Also add a file that will do the creation of the logfile structures for mkntfs.
--- NEW FILE ---
//#include <unistd.h>
//#include <stdlib.h>
#include <stdio.h>
#include <errno.h>
//#include <string.h>
#include "types.h"
#include "endians.h"
#include "ntfs_rec.h"
#include "logfile.h"
static void init_restart_records(char *log_buf, __u32 log_buf_size)
{
}
static void init_log_records(char *log_buf, __u32 log_buf_size)
{
}
void init_logfile(char *log_buf, __u32 log_buf_size)
{
__s64 l;
unsigned char *lfd = NULL;
RESTART_PAGE_HEADER *rph;
RESTART_AREA *rr;
RESTART_CLIENT *cr;
int pass = 1;
int i, lps;
int f = 0;
/* Check restart area. */
if (!is_rstr_recordp(lfd)) {
__s64 _l;
for (_l = 0LL; _l < l; _l++)
if (lfd[_l] != (unsigned char)-1)
break;
if (_l < l)
puts("$LogFile contents are corrupt (magic RSTR "
"missing)!");
else
puts("$LogFile is empty.");
goto log_file_error;
}
/* Do the interpretation and display now. */
rph = (RESTART_PAGE_HEADER*)lfd;
lps = le32_to_cpu(rph->log_page_size);
pass_loc:
if (!post_read_mst_fixup((NTFS_RECORD*)rph, lps) ||
is_baad_recordp(rph)) {
puts("$LogFile incomplete multi sector transfer detected! "
"Cannot handle this yet!");
goto log_file_error;
}
if (le16_to_cpu(rph->major_ver != 1) ||
le16_to_cpu(rph->minor_ver != 1)) {
fprintf(stderr, "$LogFile version %i.%i! Error: Unknown "
"$LogFile version!\n",
le16_to_cpu(rph->major_ver),
le16_to_cpu(rph->minor_ver));
goto log_file_error;
}
rr = (RESTART_AREA*)((char*)rph + le16_to_cpu(rph->restart_offset));
cr = (RESTART_CLIENT*)((char*)rr + sizeof(RESTART_AREA));
/* Dump of the interpreted $LogFile restart area. */
if (pass == 1)
printf("\n$LogFile version %i.%i.\n",
le16_to_cpu(rph->major_ver),
le16_to_cpu(rph->minor_ver));
printf("%s restart area:\n", pass == 1? "1st": "2nd");
printf("magic = RSTR\n");
printf("Lsn = 0x%Lx\n", sle64_to_cpu(rph->chkdsk_lsn));
printf("SystempageSize = %u\n", le32_to_cpu(rph->system_page_size));
printf("LogPageSize = %u\n", le32_to_cpu(rph->log_page_size));
printf("RestartOffset = 0x%x\n", le16_to_cpu(rph->restart_offset));
printf("\n(1st) restart record:\n");
printf("CurrentLsn = %Lx\n", sle64_to_cpu(rr->current_lsn));
printf("LogClients = %u\n", le16_to_cpu(rr->log_clients));
printf("ClientFreeList = %u\n", le16_to_cpu(rr->client_free_list));
printf("ClientInUseList = %u\n", le16_to_cpu(rr->client_in_use_list));
printf("Flags = 0x%x\n", le16_to_cpu(rr->flags));
printf("SeqNumberBits = %u\n", le32_to_cpu(rr->seq_number_bits));
printf("RestartAreaLength = 0x%x\n",
le16_to_cpu(rr->restart_area_length));
printf("ClientArrayOffset = 0x%x\n",
le16_to_cpu(rr->client_array_offset));
printf("FileSize = %Lu\n", le64_to_cpu(rr->file_size));
if (le64_to_cpu(rr->file_size) != l)
puts("$LogFile restart area indicates a log file size"
"different from the actual size!");
printf("LastLsnDataLength = 0x%x\n",
le32_to_cpu(rr->last_lsn_data_length));
printf("RecordLength = 0x%x\n", le16_to_cpu(rr->record_length));
printf("LogPageDataOffset = 0x%x\n",
le16_to_cpu(rr->log_page_data_offset));
printf("\n1st Client record:\n");
printf("OldestLsn = 0x%Lx\n", sle64_to_cpu(cr->oldest_lsn));
printf("ClientRestartLsn = 0x%Lx\n",
sle64_to_cpu(cr->client_restart_lsn));
printf("PrevClient = 0x%x\n", le16_to_cpu(cr->prev_client));
printf("NextClient = 0x%x\n", le16_to_cpu(cr->next_client));
printf("SeqNumber = 0x%x\n", le16_to_cpu(cr->seq_number));
printf("ClientName = %u\n", le16_to_cpu(cr->client_name));
printf("\nTerminator = 0x%x\n", *(__u32*)((char*)cr +
sizeof(RESTART_CLIENT)));
if (*(__u32*)((char*)cr + sizeof(RESTART_CLIENT)) != 0xffffffff)
puts("$LogFile restart area is not terminated!");
printf("Unicode string \"NTFS\"%spresent\n", *(__u64*)((char*)cr +
sizeof(RESTART_CLIENT) + 0x10) ==
cpu_to_le64(0x005300460054004e) ? " ": " not ");
rph = (RESTART_PAGE_HEADER*)((char*)rph + lps);
if (pass == 1) {
++pass;
goto pass_loc;
}
if (!is_rcrd_recordp(rph))
puts("$LogFile's first record area magic RCRD is missing!");
puts("That's all for now. Dumping of the actual log contents is not "
"implemented yet.");
log_file_error:
printf("\n");
/* Set return code to 0. */
i = 0;
final_exit:
return i;
error_exit:
i = 1;
goto final_exit;
}
--- NEW FILE ---
const char *EXEC_NAME = "dumplog";
const char *EXEC_VERSION = "1.0";
/*
* $Id: dumplog.c,v 1.1 2001/06/15 16:45:12 antona Exp $
*
* DumpLog - Part of the Linux-NTFS project.
*
* Copyright (c) 2000,2001 Anton Altaparmakov.
*
* This utility will interpret the contents of the journal ($LogFile) specified
* on the command line and display the results on stdout. Errors will be output
* to stderr.
*
* Anton Altaparmakov <ai...@ca...>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
#include "types.h"
#include "endians.h"
#include "ntfs_rec.h"
#include "logfile.h"
int main(int argc, char **argv)
{
__s64 l, br;
unsigned char *lfd = NULL;
RESTART_PAGE_HEADER *rph;
RESTART_AREA *rr;
RESTART_CLIENT *cr;
RECORD_PAGE_HEADER *rcrd_ph;
LOG_RECORD *lr;
int pass = 1;
int i, lps, client;
int f = 0;
printf("\n");
if (argc != 2) {
printf("%s v%s - Interpret and display information about the "
"journal\ngiven on the command line.\n\n"
/* Generic copyright / disclaimer. */
"Copyright (c) 2001 Anton Altaparmakov.\n\n"
"%s is free software, released under the GNU "
"General Public License\nand you are welcome to "
"redistribute it under certain conditions.\n"
"%s comes with ABSOLUTELY NO WARRANTY; for details "
"read the GNU\nGeneral Public License to be found "
"in the file COPYING in the main Linux-NTFS\n"
"distribution directory.\n\n"
/* Generic part ends here. */
"Syntax: dumplog log_file_name\n"
" e.g. dumplog log_file_copy\n\n",
EXEC_NAME, EXEC_VERSION, EXEC_NAME, EXEC_NAME);
fprintf(stderr, "Error: incorrect syntax\n");
exit(1);
}
f = open(argv[1], O_RDONLY);
if (f == -1) {
perror("Couldn't open file");
exit(1);
}
l = (__s64)(0x5000);
printf("Only analysing the first 0x%Lx bytes of the logfile.\n", l);
lfd = (unsigned char*)calloc(1, l);
if (!lfd) {
perror("Couldn't allocate internal buffer");
goto log_file_error;
}
/* Read in the $LogFile into the buffer. */
if ((br = read(f, lfd, l)) == -1) {
perror("Couldn't read file");
goto log_file_error;
}
/* Valid data length in buffer. */
l = min(br, l);
/* Check restart area. */
if (!is_rstr_recordp(lfd)) {
__s64 _l;
for (_l = 0LL; _l < l; _l++)
if (lfd[_l] != (unsigned char)-1)
break;
if (_l < l)
puts("Logfile contents are corrupt (magic RSTR "
"missing)!");
else
puts("Logfile is empty.");
goto log_file_error;
}
/* Do the interpretation and display now. */
rph = (RESTART_PAGE_HEADER*)lfd;
lps = le32_to_cpu(rph->log_page_size);
pass_loc:
if (!post_read_mst_fixup((NTFS_RECORD*)rph, lps) ||
is_baad_recordp(rph)) {
puts("Logfile incomplete multi sector transfer detected! "
"Cannot handle this yet!");
goto log_file_error;
}
if (pass == 2 && !memcmp(lfd, rph, lps)) {
printf("2nd restart area fully matches the 1st one. Skipping "
"display.\n");
goto skip_rstr_pass;
}
if (le16_to_cpu(rph->major_ver != 1) ||
le16_to_cpu(rph->minor_ver != 1)) {
fprintf(stderr, "$LogFile version %i.%i! Error: Unknown "
"$LogFile version!\n",
le16_to_cpu(rph->major_ver),
le16_to_cpu(rph->minor_ver));
goto log_file_error;
}
rr = (RESTART_AREA*)((char*)rph + le16_to_cpu(rph->restart_offset));
cr = (RESTART_CLIENT*)((char*)rr +
le16_to_cpu(rr->client_array_offset));
/* Dump of the interpreted $LogFile restart area. */
if (pass == 1)
printf("\n$LogFile version %i.%i.\n",
le16_to_cpu(rph->major_ver),
le16_to_cpu(rph->minor_ver));
printf("%s restart area:\n", pass == 1? "1st": "2nd");
printf("magic = RSTR\n");
printf("Lsn = 0x%Lx\n", sle64_to_cpu(rph->chkdsk_lsn));
printf("SystemPageSize = %u\n", le32_to_cpu(rph->system_page_size));
printf("LogPageSize = %u\n", le32_to_cpu(rph->log_page_size));
printf("RestartOffset = 0x%x\n", le16_to_cpu(rph->restart_offset));
printf("\n(1st) restart record:\n");
printf("CurrentLsn = %Lx\n", sle64_to_cpu(rr->current_lsn));
printf("LogClients = %u\n", le16_to_cpu(rr->log_clients));
printf("ClientFreeList = %u\n", le16_to_cpu(rr->client_free_list));
printf("ClientInUseList = %u\n", le16_to_cpu(rr->client_in_use_list));
printf("Flags = 0x%x\n", le16_to_cpu(rr->flags));
printf("SeqNumberBits = %u\n", le32_to_cpu(rr->seq_number_bits));
printf("RestartAreaLength = 0x%x\n",
le16_to_cpu(rr->restart_area_length));
printf("ClientArrayOffset = 0x%x\n",
le16_to_cpu(rr->client_array_offset));
printf("FileSize = %Lu\n", le64_to_cpu(rr->file_size));
if (le64_to_cpu(rr->file_size) != l)
puts("Logfile restart area indicates a log file size"
"different from the actual size!");
printf("LastLsnDataLength = 0x%x\n",
le32_to_cpu(rr->last_lsn_data_length));
printf("RecordLength = 0x%x\n", le16_to_cpu(rr->record_length));
printf("LogPageDataOffset = 0x%x\n",
le16_to_cpu(rr->log_page_data_offset));
for (client = 0; client < le16_to_cpu(rr->log_clients); client++) {
printf("\nRestart client record number %i:\n", client);
printf("OldestLsn = 0x%Lx\n", sle64_to_cpu(cr->oldest_lsn));
printf("ClientRestartLsn = 0x%Lx\n",
sle64_to_cpu(cr->client_restart_lsn));
printf("PrevClient = 0x%x\n", le16_to_cpu(cr->prev_client));
printf("NextClient = 0x%x\n", le16_to_cpu(cr->next_client));
printf("SeqNumber = 0x%Lx\n", le64_to_cpu(cr->seq_number));
printf("ClientNameLength = 0x%x\n",
le32_to_cpu(cr->client_name_lengthi));
if (le32_to_cpu(cr->client_name_length)) {
// convert to ascii and print out.
// printf("ClientName = %u\n", le16_to_cpu(cr->client_name));
}
/* Size of a restart client record is fixed at 0xa0 bytes. */
cr = (char*)cr + 0xa0;
}
skip_rstr_pass:
if (pass == 1) {
rph = (RESTART_PAGE_HEADER*)((char*)rph + lps);
++pass;
goto pass_loc;
}
rcrd_ph = (RECORD_PAGE_HEADER*)rph;
/* Reuse pass for log record counter. */
pass = 0;
printf("\nFinished with restart area. Beginning with log area.\n");
rcrd_pass_loc:
printf("Log record page number %i", pass);
rcrd_ph = (RECORD_PAGE_HEADER*)((char*)rcrd_ph + lps);
if ((char*)rcrd_ph + lps > lfd + l)
goto end_of_rcrd_passes;
if (!is_rcrd_recordp(rcrd_ph)) {
for (i = 0; i < lps; i++)
if (((char*)rcrd_ph)[i] != (char)-1)
break;
if (i < lps)
puts(" is corrupt (magic RCRD is missing).");
else
puts(" is empty.");
pass++;
goto rcrd_pass_loc;
}
/* Dump log record page */
// ...
pass++;
goto rcrd_pass_loc;
end_of_rcrd_passes:
log_file_error:
("\n");
/* Set return code to 0. */
i = 0;
final_exit:
if (lfd)
free(lfd);
if (f)
close(f);
return i;
error_exit:
i = 1;
goto final_exit;
}
|
