Re: [sleuthkit-users] ntfs.c.patch

[Brian C. <ca...@at...>]

 > I use TASK&Autopsy to analyze NTFS.
 > NTFS disk image includes a Japanese file name.
 > However Autopsy cannot display Japanese file names.

This is true (well, actually TASK has the issues with Unicode).  I will 
begin by stating that I have extremely little knowledge about the 
details of Unicode beyond the ASCII subset of UTF-16.  Which, is why 
that is the only part of Unicode for NTFS that has been implemented 
thus far.

 >
 > Mr.Takahashi wrote the patch which converted file
 > names into Unicode(UTF-8).
 > http://damedame.monyo.com/ntfs.c.patch
 >
 > Using the above patch, it is possible to display Japanese name.
 > Please check the following URL.
 > http://www.port139.co.jp/task/taskjptest.JPG
 >
 > However, it is not a complete patch.
 > If I use a long file name, Buffer over flow occurs.

This is because the bounds on the 'asc' array are not being checked.  
You need to make sure that 'i' is less than 'alen'.  Since it appears 
that you could have three bytes per character, then the size of the 
array should be increased in the functions that call uni2ascii and the 
check when 'l' is set should be modified.

 > I hope that TASK supports a Unicode option at the next version.

I can't really do much in this area with out help and testing from 
non-english users since I don't have access to test images.  And, this 
is the first request that I have gotten for it.  What happens when you 
run this on the command line?  Does the shell display the Japanese 
symbols?   For example:

	fls -f ntfs img.dd

thanks,
brian




--- ntfs.c.org  Mon Jan 13 06:58:16 2003
+++ ntfs.c      Sat Feb 15 21:42:12 2003
@@ -103,7 +103,7 @@
  void
  uni2ascii(char *uni, int ulen, char *asc, int alen)
  {
-       int i, l;
+       int i, l, j;


         /* find the maximum that we can go
@@ -115,15 +115,31 @@
         else
                 l = ulen;

-       for (i = 0; i < l; i++) {
-               /* If this value is NULL, then stop */
-               if (uni[i*2] == 0 && uni[i*2 + 1] == 0)
-                       break;
+       i = 0; j = 0;

-               if (isprint((int)uni[i*2]))
-                       asc[i] = uni[i*2];
-               else
-                       asc[i] = '?';
+       while (i < l) {
+         unsigned short *uni2p = (unsigned short *)uni;
+         /* If this value is NULL, then stop */
+         if (uni2p[j] == 0)
+           break;
+         /* If this value is NULL, then stop */
+
+          if (uni2p[j] <= 0x7f) {
+           asc[i] = uni2p[j] & 0x007f;
+           i++;
+         }
+         else if (uni2p[j] <= 0x7ff) {
+           asc[i] = 0xc0 | ((uni2p[j] & 0x7c0) >> 6);
+           asc[i+1] = 0x80 | (uni2p[j] & 0x003f);
+           i = i + 2;
+         }
+         else if (uni2p[j] > 0x800) {
+           asc[i] = 0xe0 | ((uni2p[j] & 0xf000) >> 12);
+           asc[i+1] = 0x80 | (uni2p[j] & 0xfc0) >> 6;
+           asc[i+2] = 0x80 | (uni2p[j] & 0x003f);
+           i = i + 3;
+         }
+         j++;
         }
         /* NULL Terminate */
         asc[i] = '\0';