/* Reads a chunk
* Callback function for the chunk vector
* Returns 1 if successful or -1 on error
*/
int libevtx_chunks_table_read_record(
intptr_t *io_handle,
libbfio_handle_t *file_io_handle,
libfdata_list_element_t *list_element,
libfdata_cache_t *cache,
int data_range_file_index LIBEVTX_ATTRIBUTE_UNUSED,
off64_t data_range_offset,
size64_t data_range_size,
uint32_t data_range_flags LIBEVTX_ATTRIBUTE_UNUSED,
uint8_t read_flags LIBEVTX_ATTRIBUTE_UNUSED,
libcerror_error_t **error )
{
libevtx_chunk_t *chunk = NULL;
libevtx_chunks_table_t *chunks_table = NULL;
libevtx_record_values_t *chunk_record_values = NULL;
libevtx_record_values_t *record_values = NULL;
static char *function = "libevtx_io_handle_read_chunk";
size_t calculated_chunk_data_offset = 0;
size_t chunk_data_offset = 0;
uint16_t number_of_records = 0;
uint16_t record_index = 0;
LIBEVTX_UNREFERENCED_PARAMETER( data_range_file_index );
LIBEVTX_UNREFERENCED_PARAMETER( data_range_flags );
LIBEVTX_UNREFERENCED_PARAMETER( read_flags );
if( io_handle == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid IO handle.",
function );
return( -1 );
}
chunks_table = (libevtx_chunks_table_t *) io_handle;
/* The chunk index is stored in the data range size
*/
if( data_range_size > (uint64_t) UINT16_MAX )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid data range size value out of bounds.",
function );
goto on_error;
}
if( libfdata_vector_get_element_value_by_index(
chunks_table->chunks_vector,
(intptr_t *) file_io_handle,
(libfdata_cache_t *) chunks_table->chunks_cache,
(uint16_t) data_range_size,
(intptr_t **) &chunk,
0,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve chunk: %" PRIu64 ".",
function,
data_range_size );
goto on_error;
}
if( chunk == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: missing chunk: %" PRIu64 ".",
function,
data_range_size );
goto on_error;
}
if( ( data_range_offset < chunk->file_offset )
|| ( data_range_offset >= (off64_t) ( chunk->file_offset + chunk->data_size ) ) )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid chunk file offset value out of bounds.",
function );
goto on_error;
}
calculated_chunk_data_offset = (size_t) ( data_range_offset - chunk->file_offset );
if( libevtx_chunk_get_number_of_records(
chunk,
&number_of_records,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve number of records from chunk.",
function );
goto on_error;
}
/* TODO optimize determining the corresponding record */
for( record_index = 0;
record_index < number_of_records;
record_index++ )
{
if( libevtx_chunk_get_record(
chunk,
record_index,
&chunk_record_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve record: %" PRIu16 " from chunk.",
function,
record_index );
goto on_error;
}
if( chunk_record_values == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: missing record: %" PRIu16 ".",
function,
record_index );
goto on_error;
}
chunk_data_offset = chunk_record_values->chunk_data_offset;
if( calculated_chunk_data_offset == chunk_data_offset )
{
break;
}
}
/* TODO allow to control look up in normal vs recovered */
if( calculated_chunk_data_offset != chunk_data_offset )
{
if( libevtx_chunk_get_number_of_recovered_records(
chunk,
&number_of_records,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve number of recovered records from chunk.",
function );
goto on_error;
}
for( record_index = 0;
record_index < number_of_records;
record_index++ )
{
if( libevtx_chunk_get_recovered_record(
chunk,
record_index,
&chunk_record_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve recovered record: %" PRIu16 " from chunk.",
function,
record_index );
goto on_error;
}
if( chunk_record_values == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: missing recovered record: %" PRIu16 ".",
function,
record_index );
goto on_error;
}
chunk_data_offset = chunk_record_values->chunk_data_offset;
if( calculated_chunk_data_offset == chunk_data_offset )
{
break;
}
}
}
if( calculated_chunk_data_offset != chunk_data_offset )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: no record found at offset: %" PRIi64 ".",
function,
data_range_offset );
goto on_error;
}
/* The record values are managed by the chunk and freed after usage
* A copy is created to make sure that the records values that are passed
* to the records list can be managed by the list
*/
if( libevtx_record_values_clone(
&record_values,
chunk_record_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
"%s: unable to create record values.",
function );
goto on_error;
}
if( libevtx_record_values_read_xml_document(
record_values,
chunks_table->io_handle,
chunk->data,
chunk->data_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_READ_FAILED,
"%s: unable to read record values XML document.",
function );
goto on_error;
}
if( libfdata_list_element_set_element_value(
list_element,
(intptr_t *) file_io_handle,
cache,
(intptr_t *) record_values,
(int (*)(intptr_t **, libcerror_error_t **)) &libevtx_record_values_free,
LIBFDATA_LIST_ELEMENT_VALUE_FLAG_MANAGED,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_SET_FAILED,
"%s: unable to set record values as element value.",
function );
goto on_error;
}
return( 1 );
on_error:
if( record_values != NULL )
{
libevtx_record_values_free(
&record_values,
NULL );
}
return( -1 );
}
/* Reads a grain
* Callback function for the grains list
* Returns 1 if successful or -1 on error
*/
int libvmdk_grain_data_read_element_data(
libvmdk_io_handle_t *io_handle,
libbfio_pool_t *file_io_pool,
libfdata_list_element_t *element,
libfcache_cache_t *cache,
int file_io_pool_entry,
off64_t grain_data_offset,
size64_t grain_data_size,
uint32_t grain_data_flags,
uint8_t read_flags LIBVMDK_ATTRIBUTE_UNUSED,
libcerror_error_t **error )
{
libvmdk_grain_data_t *grain_data = NULL;
uint8_t *compressed_data = NULL;
static char *function = "libvmdk_grain_data_read_element_data";
ssize_t read_count = 0;
LIBVMDK_UNREFERENCED_PARAMETER( read_flags )
if( io_handle == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid IO handle.",
function );
return( -1 );
}
if( ( grain_data_size == (size64_t) 0 )
|| ( grain_data_size > (size64_t) SSIZE_MAX ) )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid grain data size value out of bounds.",
function );
return( -1 );
}
if( ( grain_data_flags & LIBVMDK_RANGE_FLAG_IS_SPARSE ) != 0 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
"%s: sparse grain not supported.",
function );
return( -1 );
}
if( libbfio_pool_seek_offset(
file_io_pool,
file_io_pool_entry,
grain_data_offset,
SEEK_SET,
error ) == -1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_SEEK_FAILED,
"%s: unable to seek grain offset: %" PRIi64 " in file IO pool entry: %d.",
function,
grain_data_offset,
file_io_pool_entry );
goto on_error;
}
if( ( grain_data_flags & LIBVMDK_RANGE_FLAG_IS_COMPRESSED ) != 0 )
{
if( io_handle->grain_size > (size64_t) SSIZE_MAX )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid IO handle - grain size value exceeds maximum.",
function );
goto on_error;
}
if( libvmdk_grain_data_initialize(
&grain_data,
(size_t) io_handle->grain_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
"%s: unable to create grain data.",
function );
goto on_error;
}
read_count = libvmdk_grain_data_read_compressed_header(
grain_data,
io_handle,
file_io_pool,
file_io_pool_entry,
error );
if( read_count == -1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_READ_FAILED,
"%s: unable to read compressed grain data header.",
function );
goto on_error;
}
#if SIZEOF_UINT32 <= SIZEOF_SIZE_T
if( grain_data->compressed_data_size > (uint32_t) SSIZE_MAX )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid grain data - compressed data size value exceeds maximum.",
function );
goto on_error;
}
#endif
if( grain_data->compressed_data_size == 0 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid grain data - compressed data size value out of bounds.",
function );
goto on_error;
}
compressed_data = (uint8_t *) memory_allocate(
sizeof( uint8_t ) * (size_t) grain_data->compressed_data_size );
if( compressed_data == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_MEMORY,
LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
"%s: unable to create compressed data.",
function );
goto on_error;
}
read_count = libbfio_pool_read_buffer(
file_io_pool,
file_io_pool_entry,
compressed_data,
(size_t) grain_data->compressed_data_size,
error );
if( read_count != (ssize_t) grain_data->compressed_data_size )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_READ_FAILED,
"%s: unable to read compressed grain data.",
function );
goto on_error;
}
if( libvmdk_decompress_data(
compressed_data,
(size_t) grain_data->compressed_data_size,
LIBVMDK_COMPRESSION_METHOD_DEFLATE,
grain_data->data,
&( grain_data->data_size ),
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_COMPRESSION,
LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
"%s: unable to decompress grain data.",
function );
goto on_error;
}
memory_free(
compressed_data );
compressed_data = NULL;
}
else
{
if( libvmdk_grain_data_initialize(
&grain_data,
(size_t) grain_data_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
"%s: unable to create grain data.",
function );
goto on_error;
}
if( grain_data == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: missing grain data.",
function );
goto on_error;
}
read_count = libbfio_pool_read_buffer(
file_io_pool,
file_io_pool_entry,
grain_data->data,
(size_t) grain_data_size,
error );
if( read_count != (ssize_t) grain_data_size )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_READ_FAILED,
"%s: unable to read grain data.",
function );
goto on_error;
}
}
if( libfdata_list_element_set_element_value(
element,
(intptr_t *) file_io_pool,
cache,
(intptr_t *) grain_data,
(int (*)(intptr_t **, libcerror_error_t **)) &libvmdk_grain_data_free,
LIBFDATA_LIST_ELEMENT_VALUE_FLAG_MANAGED,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_SET_FAILED,
"%s: unable to set grain data as element value.",
function );
goto on_error;
}
return( 1 );
on_error:
if( compressed_data != NULL )
{
memory_free(
compressed_data );
}
if( grain_data != NULL )
{
libvmdk_grain_data_free(
&grain_data,
NULL );
}
return( -1 );
}
