/* Sector walking */ static void walk_sectors(open_file_t *file, uint32_t num_sectors) { /* Update the sector number */ file->sector_number += num_sectors; /* Walk forward num_sectors */ while(num_sectors) { file_entry_t *next_sector = get_next_sector(&file->cur_sector); grab_sector(next_sector, &file->cur_sector); num_sectors--; } }
static int fill_delta(struct block_delta *delta, const struct bio *bio, bvec_iter iter, const int start_sector) { int count; int next_sector; char *data; delta->start_sector = start_sector; delta->size = bio_iter_len(bio, iter); next_sector = get_next_sector(delta); delta->end_sector = next_sector - 1; delta->offset = bio_iter_offset(bio, iter); data = kmap(bio_iter_page(bio, iter)); count = find_word_count("DAMN", data, PAGE_SIZE); if (count > 0) LOG("Found DAMN from page %d times", count); delta->data = vmalloc(delta->size); if (delta->data != NULL) memcpy(delta->data, data + delta->offset, delta->size); kunmap(bio_iter_page(bio, iter)); return (delta->data != NULL)? next_sector : -1; }
static int pfind_sectors_per_cluster(disk_t *disk, partition_t *partition, const int verbose, unsigned int *sectors_per_cluster, uint64_t *offset_org, alloc_data_t *list_search_space) { uint64_t offset=0; unsigned int nbr_subdir=0; sector_cluster_t sector_cluster[10]; alloc_data_t *current_search_space; unsigned char *buffer_start=(unsigned char *)MALLOC(READ_SIZE); unsigned char *buffer=buffer_start; current_search_space=td_list_entry(list_search_space->list.next, alloc_data_t, list); if(current_search_space!=list_search_space) offset=current_search_space->start; if(verbose>0) info_list_search_space(list_search_space, current_search_space, disk->sector_size, 0, verbose); #ifdef HAVE_NCURSES wmove(stdscr,22,0); wattrset(stdscr, A_REVERSE); waddstr(stdscr," Stop "); wattroff(stdscr, A_REVERSE); #endif disk->pread(disk, buffer_start, READ_SIZE, offset); while(current_search_space!=list_search_space && nbr_subdir<10) { const uint64_t old_offset=offset; #ifdef HAVE_NCURSES if((offset&(1024*disk->sector_size-1))==0) { wmove(stdscr,9,0); wclrtoeol(stdscr); wprintw(stdscr,"Search subdirectory %10lu/%lu %u",(unsigned long)(offset/disk->sector_size),(unsigned long)(partition->part_size/disk->sector_size),nbr_subdir); wrefresh(stdscr); } #endif if(memcmp(buffer, ". ", 8+3)==0 && memcmp(&buffer[0x20], ".. ", 8+3)==0) { const unsigned long int cluster=(buffer[0*0x20+0x15]<<24) + (buffer[0*0x20+0x14]<<16) + (buffer[0*0x20+0x1B]<<8) + buffer[0*0x20+0x1A]; log_info("sector %lu, cluster %lu\n", (unsigned long)(offset/disk->sector_size), cluster); sector_cluster[nbr_subdir].cluster=cluster; sector_cluster[nbr_subdir].sector=offset/disk->sector_size; log_flush(); nbr_subdir++; } get_next_sector(list_search_space, ¤t_search_space, &offset, 512); buffer+=512; if( old_offset+512!=offset || buffer+512>buffer_start+READ_SIZE) { buffer=buffer_start; if(verbose>1) { log_verbose("Reading sector %10llu/%llu\n", (unsigned long long)((offset-partition->part_offset)/disk->sector_size), (unsigned long long)((partition->part_size-1)/disk->sector_size)); } if(disk->pread(disk, buffer_start, READ_SIZE, offset) != READ_SIZE) { } } } /* end while(current_search_space!=list_search_space) */ free(buffer_start); return find_sectors_per_cluster_aux(sector_cluster,nbr_subdir,sectors_per_cluster,offset_org,verbose,partition->part_size/disk->sector_size, UP_UNK); }
static int pfind_sectors_per_cluster(disk_t *disk, partition_t *partition, const int verbose, unsigned int *sectors_per_cluster, uint64_t *offset_org, alloc_data_t *list_search_space) { uint64_t offset=0; uint64_t next_offset=0; uint64_t diff_offset=0; time_t previous_time=0; unsigned int nbr_subdir=0; sector_cluster_t sector_cluster[10]; alloc_data_t *current_search_space; unsigned char *buffer_start=(unsigned char *)MALLOC(READ_SIZE); unsigned char *buffer=buffer_start; assert(disk->sector_size!=0); current_search_space=td_list_first_entry(&list_search_space->list, alloc_data_t, list); if(current_search_space!=list_search_space) offset=current_search_space->start; if(verbose>0) info_list_search_space(list_search_space, current_search_space, disk->sector_size, 0, verbose); #ifdef HAVE_NCURSES wmove(stdscr,22,0); wattrset(stdscr, A_REVERSE); waddstr(stdscr," Stop "); wattroff(stdscr, A_REVERSE); #endif disk->pread(disk, buffer_start, READ_SIZE, offset); while(current_search_space!=list_search_space && nbr_subdir<10) { const uint64_t old_offset=offset; if(buffer[0]=='.' && is_fat_directory(buffer)) { const unsigned long int cluster=fat_get_cluster_from_entry((const struct msdos_dir_entry *)buffer); log_info("sector %lu, cluster %lu\n", (unsigned long)(offset/disk->sector_size), cluster); sector_cluster[nbr_subdir].cluster=cluster; sector_cluster[nbr_subdir].sector=offset/disk->sector_size; log_flush(); nbr_subdir++; } get_next_sector(list_search_space, ¤t_search_space, &offset, 512); buffer+=512; if( old_offset+512!=offset || buffer+512>buffer_start+READ_SIZE) { buffer=buffer_start; #ifdef HAVE_NCURSES if(offset > next_offset) { const time_t current_time=time(NULL); if(current_time==previous_time) diff_offset<<=1; else diff_offset>>=1; if(diff_offset < disk->sector_size) diff_offset=disk->sector_size; next_offset=offset+diff_offset; previous_time=current_time; wmove(stdscr,9,0); wclrtoeol(stdscr); wprintw(stdscr,"Search subdirectory %10lu/%lu %u",(unsigned long)(offset/disk->sector_size),(unsigned long)(partition->part_size/disk->sector_size),nbr_subdir); wrefresh(stdscr); } #endif if(verbose>1) { log_verbose("Reading sector %10llu/%llu\n", (unsigned long long)((offset-partition->part_offset)/disk->sector_size), (unsigned long long)((partition->part_size-1)/disk->sector_size)); } if(disk->pread(disk, buffer_start, READ_SIZE, offset) != READ_SIZE) { #ifdef HAVE_NCURSES wmove(stdscr,11,0); wclrtoeol(stdscr); wprintw(stdscr,"Error reading sector %10lu\n", (unsigned long)((offset - partition->part_offset) / disk->sector_size)); #endif } } } /* end while(current_search_space!=list_search_space) */