/* Reads a chunk * Callback function for the chunk vector * Returns 1 if successful or -1 on error */ int libevtx_chunks_table_read_record( intptr_t *io_handle, libbfio_handle_t *file_io_handle, libfdata_list_element_t *list_element, libfdata_cache_t *cache, int data_range_file_index LIBEVTX_ATTRIBUTE_UNUSED, off64_t data_range_offset, size64_t data_range_size, uint32_t data_range_flags LIBEVTX_ATTRIBUTE_UNUSED, uint8_t read_flags LIBEVTX_ATTRIBUTE_UNUSED, libcerror_error_t **error ) { libevtx_chunk_t *chunk = NULL; libevtx_chunks_table_t *chunks_table = NULL; libevtx_record_values_t *chunk_record_values = NULL; libevtx_record_values_t *record_values = NULL; static char *function = "libevtx_io_handle_read_chunk"; size_t calculated_chunk_data_offset = 0; size_t chunk_data_offset = 0; uint16_t number_of_records = 0; uint16_t record_index = 0; LIBEVTX_UNREFERENCED_PARAMETER( data_range_file_index ); LIBEVTX_UNREFERENCED_PARAMETER( data_range_flags ); LIBEVTX_UNREFERENCED_PARAMETER( read_flags ); if( io_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid IO handle.", function ); return( -1 ); } chunks_table = (libevtx_chunks_table_t *) io_handle; /* The chunk index is stored in the data range size */ if( data_range_size > (uint64_t) UINT16_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid data range size value out of bounds.", function ); goto on_error; } if( libfdata_vector_get_element_value_by_index( chunks_table->chunks_vector, (intptr_t *) file_io_handle, (libfdata_cache_t *) chunks_table->chunks_cache, (uint16_t) data_range_size, (intptr_t **) &chunk, 0, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve chunk: %" PRIu64 ".", function, data_range_size ); goto on_error; } if( chunk == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: missing chunk: %" PRIu64 ".", function, data_range_size ); goto on_error; } if( ( data_range_offset < chunk->file_offset ) || ( data_range_offset >= (off64_t) ( chunk->file_offset + chunk->data_size ) ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid chunk file offset value out of bounds.", function ); goto on_error; } calculated_chunk_data_offset = (size_t) ( data_range_offset - chunk->file_offset ); if( libevtx_chunk_get_number_of_records( chunk, &number_of_records, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of records from chunk.", function ); goto on_error; } /* TODO optimize determining the corresponding record */ for( record_index = 0; record_index < number_of_records; record_index++ ) { if( libevtx_chunk_get_record( chunk, record_index, &chunk_record_values, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve record: %" PRIu16 " from chunk.", function, record_index ); goto on_error; } if( chunk_record_values == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: missing record: %" PRIu16 ".", function, record_index ); goto on_error; } chunk_data_offset = chunk_record_values->chunk_data_offset; if( calculated_chunk_data_offset == chunk_data_offset ) { break; } } /* TODO allow to control look up in normal vs recovered */ if( calculated_chunk_data_offset != chunk_data_offset ) { if( libevtx_chunk_get_number_of_recovered_records( chunk, &number_of_records, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of recovered records from chunk.", function ); goto on_error; } for( record_index = 0; record_index < number_of_records; record_index++ ) { if( libevtx_chunk_get_recovered_record( chunk, record_index, &chunk_record_values, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve recovered record: %" PRIu16 " from chunk.", function, record_index ); goto on_error; } if( chunk_record_values == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: missing recovered record: %" PRIu16 ".", function, record_index ); goto on_error; } chunk_data_offset = chunk_record_values->chunk_data_offset; if( calculated_chunk_data_offset == chunk_data_offset ) { break; } } } if( calculated_chunk_data_offset != chunk_data_offset ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: no record found at offset: %" PRIi64 ".", function, data_range_offset ); goto on_error; } /* The record values are managed by the chunk and freed after usage * A copy is created to make sure that the records values that are passed * to the records list can be managed by the list */ if( libevtx_record_values_clone( &record_values, chunk_record_values, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create record values.", function ); goto on_error; } if( libevtx_record_values_read_xml_document( record_values, chunks_table->io_handle, chunk->data, chunk->data_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_READ_FAILED, "%s: unable to read record values XML document.", function ); goto on_error; } if( libfdata_list_element_set_element_value( list_element, (intptr_t *) file_io_handle, cache, (intptr_t *) record_values, (int (*)(intptr_t **, libcerror_error_t **)) &libevtx_record_values_free, LIBFDATA_LIST_ELEMENT_VALUE_FLAG_MANAGED, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to set record values as element value.", function ); goto on_error; } return( 1 ); on_error: if( record_values != NULL ) { libevtx_record_values_free( &record_values, NULL ); } return( -1 ); }
/* Reads a grain * Callback function for the grains list * Returns 1 if successful or -1 on error */ int libvmdk_grain_data_read_element_data( libvmdk_io_handle_t *io_handle, libbfio_pool_t *file_io_pool, libfdata_list_element_t *element, libfcache_cache_t *cache, int file_io_pool_entry, off64_t grain_data_offset, size64_t grain_data_size, uint32_t grain_data_flags, uint8_t read_flags LIBVMDK_ATTRIBUTE_UNUSED, libcerror_error_t **error ) { libvmdk_grain_data_t *grain_data = NULL; uint8_t *compressed_data = NULL; static char *function = "libvmdk_grain_data_read_element_data"; ssize_t read_count = 0; LIBVMDK_UNREFERENCED_PARAMETER( read_flags ) if( io_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid IO handle.", function ); return( -1 ); } if( ( grain_data_size == (size64_t) 0 ) || ( grain_data_size > (size64_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid grain data size value out of bounds.", function ); return( -1 ); } if( ( grain_data_flags & LIBVMDK_RANGE_FLAG_IS_SPARSE ) != 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, "%s: sparse grain not supported.", function ); return( -1 ); } if( libbfio_pool_seek_offset( file_io_pool, file_io_pool_entry, grain_data_offset, SEEK_SET, error ) == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_SEEK_FAILED, "%s: unable to seek grain offset: %" PRIi64 " in file IO pool entry: %d.", function, grain_data_offset, file_io_pool_entry ); goto on_error; } if( ( grain_data_flags & LIBVMDK_RANGE_FLAG_IS_COMPRESSED ) != 0 ) { if( io_handle->grain_size > (size64_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid IO handle - grain size value exceeds maximum.", function ); goto on_error; } if( libvmdk_grain_data_initialize( &grain_data, (size_t) io_handle->grain_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create grain data.", function ); goto on_error; } read_count = libvmdk_grain_data_read_compressed_header( grain_data, io_handle, file_io_pool, file_io_pool_entry, error ); if( read_count == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_READ_FAILED, "%s: unable to read compressed grain data header.", function ); goto on_error; } #if SIZEOF_UINT32 <= SIZEOF_SIZE_T if( grain_data->compressed_data_size > (uint32_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid grain data - compressed data size value exceeds maximum.", function ); goto on_error; } #endif if( grain_data->compressed_data_size == 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid grain data - compressed data size value out of bounds.", function ); goto on_error; } compressed_data = (uint8_t *) memory_allocate( sizeof( uint8_t ) * (size_t) grain_data->compressed_data_size ); if( compressed_data == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create compressed data.", function ); goto on_error; } read_count = libbfio_pool_read_buffer( file_io_pool, file_io_pool_entry, compressed_data, (size_t) grain_data->compressed_data_size, error ); if( read_count != (ssize_t) grain_data->compressed_data_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_READ_FAILED, "%s: unable to read compressed grain data.", function ); goto on_error; } if( libvmdk_decompress_data( compressed_data, (size_t) grain_data->compressed_data_size, LIBVMDK_COMPRESSION_METHOD_DEFLATE, grain_data->data, &( grain_data->data_size ), error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_COMPRESSION, LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED, "%s: unable to decompress grain data.", function ); goto on_error; } memory_free( compressed_data ); compressed_data = NULL; } else { if( libvmdk_grain_data_initialize( &grain_data, (size_t) grain_data_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create grain data.", function ); goto on_error; } if( grain_data == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: missing grain data.", function ); goto on_error; } read_count = libbfio_pool_read_buffer( file_io_pool, file_io_pool_entry, grain_data->data, (size_t) grain_data_size, error ); if( read_count != (ssize_t) grain_data_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_READ_FAILED, "%s: unable to read grain data.", function ); goto on_error; } } if( libfdata_list_element_set_element_value( element, (intptr_t *) file_io_pool, cache, (intptr_t *) grain_data, (int (*)(intptr_t **, libcerror_error_t **)) &libvmdk_grain_data_free, LIBFDATA_LIST_ELEMENT_VALUE_FLAG_MANAGED, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to set grain data as element value.", function ); goto on_error; } return( 1 ); on_error: if( compressed_data != NULL ) { memory_free( compressed_data ); } if( grain_data != NULL ) { libvmdk_grain_data_free( &grain_data, NULL ); } return( -1 ); }