int Fat::vopen(Handle *handle)
{
FileInfo *fi;
FDInfo *fd;
int i;
if (handle == NULL)
throw vfsError("Fat::vopen handle null\n");
try
{
fi = filehandler->get(handle->id);
if (fi != NULL)
{
fd = new FDInfo;
fd->fdata = fi;
fd->current = 0;
i = fdm->AllocFD(fd);
return (i);
}
else
throw vfsError("Fat::vopen can't find\n");
}
catch(...)
{
throw vfsError("Fat::vopen can't find\n");
return -1;
}
return -1;
}
VFile* Node::open()
{
int32_t fd;
VFile *temp;
if (this->__fsobj == NULL)
throw vfsError("Can't Open file");
try
{
if ((fd = this->__fsobj->vopen(this)) >= 0)
{
temp = new VFile(fd, this->__fsobj, this);
return (temp);
}
throw vfsError("Can't Open file");
}
catch (vfsError e)
{
throw vfsError("Node::open(void) throw\n" + e.error);
}
}
int Fat::Close()
{
try
{
if (!File)
return 0;
File->close();
}
catch(vfsError e)
{
throw vfsError("Fat::Close throw\n" + e.error);
}
return 0;
}
int Fat::Open()
{
try
{
if (!ParentNode)
ParentNode = VFS::Get().GetNode(ParentNodePath);
File = ParentNode->open();
ParentNodePath = ParentNode->path + "/" + ParentNode->name;
}
catch(vfsError e)
{
throw vfsError("Fat::Open() throw\n" + e.error);
}
return (1);
}
dff_ui64 Fat::Seek(dff_ui64 offset)
{
try
{
if (!File)
{
ParentNode = VFS::Get().GetNode(ParentNodePath);
File = ParentNode->open();
}
offset = File->seek(offset);
return (offset);
}
catch(vfsError e)
{
throw vfsError("Fat::Seek throw\n" + e.error);
}
}
void Ext4Extents::push_extended_blocks(Inode * inode)
throw (vfsError)
{
if (!inode)
throw vfsError("Ext4Extents::push_extended_blocks() : inode is NULL.");
__inode = inode;
__size = inode->lower_size();
__block_size = inode->SB()->block_size();
__node = inode->extfs()->node();
__extfs = inode->extfs();
if (!inode->extent_header()->depth)
read_extents(inode->extent_header(),
(uint8_t *)&inode->block_pointers()[3]);
else
read_indexes(inode->extent_header(),
(uint8_t *)&inode->block_pointers()[3]);
}
int Fat::Read(void *buff, unsigned int size)
{
try
{
//check if !ParentNode bye bye...
if (!File)
{
ParentNode = VFS::Get().GetNode(ParentNodePath);
File = ParentNode->open();
}
return (File->read(buff, size));
}
catch(vfsError e)
{
throw vfsError("Fat::Read throw\n" + e.error);
}
return (1);
}
uint64_t Ext4Extents::calc_size(Inode * inode)
{
if (!inode)
throw vfsError("Ext4Extents::calc_size() : inode is NULL.");
__inode = inode;
__size = inode->lower_size();
__block_size = inode->SB()->block_size();
__node = inode->extfs()->node();
__extfs = inode->extfs();
if (!inode->extent_header())
__c_size = 0;
else if (!inode->extent_header()->depth)
read_extents_x(inode->extent_header(),
(uint8_t *)&inode->block_pointers()[3]);
else
read_indexes(inode->extent_header(),
(uint8_t *)&inode->block_pointers()[3]);
return __c_size;
}
int Fat::vread(int fd, void *buff, unsigned int size)
{
unsigned int BytesRead;
unsigned int Size;
unsigned int real_size;
unsigned int index;
unsigned int TotalBytesRead;
unsigned int Cluster;
unsigned int OffsetInCluster;
dff_ui64 RealOffset;
FDInfo *vfd;
FileInfo *fi;
TotalBytesRead = 0;
vfd = fdm->GetFDInfo(fd);
if (vfd != NULL)
{
fi = (FileInfo*)vfd->fdata;
if (fi != NULL)
{
Size = -1;
if (vfd->current >= fi->size)
return (0);
if (size > (fi->size - vfd->current))
Size = fi->size - vfd->current;
else
Size = size;
if (Size >= 0)
{
vector<unsigned int> tmp;
tmp = *(fi->clusters);
while (TotalBytesRead < Size)
{
if (fi->type == SLACK)
{
if (fi->clusters->size() - 1 < 0)
throw vfsError("Fat::vread error index\n");
Cluster = tmp[0];
OffsetInCluster = ClusterSize - fi->size + vfd->current;
RealOffset = (GETCLUSTEROFFSET(Cluster, ClusterSize, DataOffset));
RealOffset += OffsetInCluster;
real_size = Size;
}
else if (fi->type == NORMAL)
{
Cluster = vfd->current / ClusterSize;
OffsetInCluster = vfd->current - (Cluster * ClusterSize);
RealOffset = (GETCLUSTEROFFSET(tmp[Cluster], ClusterSize, DataOffset));
RealOffset += OffsetInCluster;
if ((Size - TotalBytesRead) > (ClusterSize - OffsetInCluster))
real_size = ClusterSize - OffsetInCluster;
else
real_size = Size - TotalBytesRead;
}
else if (fi->type == DELETED)
{
RealOffset = (GETCLUSTEROFFSET(tmp[0], ClusterSize, DataOffset)) + vfd->current;
real_size = Size;
}
else
real_size = 0;
try
{
Seek(RealOffset);
BytesRead = Read(((char *)buff) + TotalBytesRead, real_size);
if (BytesRead == 0)
return (TotalBytesRead);
TotalBytesRead += BytesRead;
vfd->current += BytesRead;
}
catch(vfsError e)
{
throw vfsError("Fat::vread throw\n" + e.error);
}
}
return TotalBytesRead;
}
throw vfsError("Fat::vread error size problem\n");
}
else
printf("FI NULL !!!!\n");
}
else
printf("FD NULL\n");
throw vfsError("Fat::vread end\n");
}
void Ntfs::start(std::map<std::string, Variant*> args)
{
uint64_t offset = 0;
uint16_t mftEntryNumber;
std::map<std::string, Variant*>::iterator it;
if ((it = args.find("mftdecode")) != args.end())
this->_mftDecode = it->second->value<uint64_t>();
else
this->_mftDecode = (uint64_t)-1;
#if __WORDSIZE == 64
DEBUG(INFO, "Only have to decode mft entry at offset 0x%lx\n", _mftDecode);
#else
DEBUG(INFO, "Only have to decode mft entry at offset 0x%llx\n", _mftDecode);
#endif
if ((it = args.find("indexdecode")) != args.end())
this->_indexDecode = it->second->value<uint64_t>();
else
this->_indexDecode = (uint64_t)-1;
#if __WORDSIZE == 64
DEBUG(INFO, "Only have to decode index entries at offset 0x%lx\n", _indexDecode);
#else
DEBUG(INFO, "Only have to decode index entries at offset 0x%llx\n", _indexDecode);
#endif
/* Assume NTFS Boot sector is present */
if ((it = args.find("file")) != args.end())
{
try
{
this->_node = it->second->value<Node*>();
_vfile = _node->open();
_boot = new Boot(_vfile);
_mftEntry = new MftEntry(_vfile);
#if __WORDSIZE == 64
if (_boot->isBootBlock(offset) && _mftDecode == 0x0UL - 1 && _indexDecode == 0x0UL - 1)
#else
if (_boot->isBootBlock(offset) && _mftDecode == 0x0ULL - 1 && _indexDecode == 0x0ULL - 1)
#endif
{
/* Set offset to first MFT Entry */
offset = _boot->clusterSize() * _boot->getBootBlock()->startMft;
/* Set size of read buffer
* and set size of a tree node */
_mftEntry->clusterSize(_boot->clusterSize());
_mftEntry->indexRecordSize(_boot->indexRecordSize());
_mftEntry->sectorSize(_boot->sectorSize());
_mftEntry->mftEntrySize(_boot->mftEntrySize());
_setStateInfo("Boot block found");
}
#if __WORDSIZE == 64
else if (_mftDecode == 0x0UL - 1 && _indexDecode == 0x0UL - 1)
#else
else if (_mftDecode == 0x0ULL - 1 && _indexDecode == 0x0ULL - 1)
#endif
{
std::cerr << "No NTFS Boot Sector found" << std::endl;
_setStateInfo(std::string("No NTFS Boot Sector found"));
}
#if __WORDSIZE == 64
else if (_mftDecode != 0x0UL -1)
#else
else if (_mftDecode != 0x0ULL - 1)
#endif
{
std::ostringstream result;
// switching to mft decode only, usefull for DC3 2k10
_mftEntry->clusterSize(4096);
_mftEntry->indexRecordSize(4096);
_mftEntry->sectorSize(512);
_mftEntry->mftEntrySize(1024);
if (_mftEntry->decode(_mftDecode)) {
Attribute *attribute;
//_mftEntry->dumpHeader();
#if __WORDSIZE == 64
printf("Decoding MFT entry at offset 0x%lx\n", _mftDecode);
#else
printf("Decoding MFT entry at offset 0x%llx\n", _mftDecode);
#endif
while ((attribute = _mftEntry->getNextAttribute())) {
attribute->readHeader();
attribute->dumpHeader();
if (attribute->getType() == ATTRIBUTE_DATA) {
AttributeData *_data = new AttributeData(*attribute);
_data->setRunList();
}
_mftEntry->dumpAttribute(attribute);
}
result << "MFT entry at offset " << _mftDecode << " (0x" << std::hex << _mftDecode << ") decoded, see std::out";
}
else {
result << "Unable to decode MFT entry at offset " << _mftDecode << " (0x" << std::hex << _mftDecode << ")";
}
_setStateInfo(std::string(result.str()));
return ;
}
#if __WORDSIZE == 64
else if (_indexDecode != 0x0UL - 1)
#else
else if (_indexDecode != 0x0ULL - 1)
#endif
{
// switching to index decode only
AttributeIndexAllocation *content = new AttributeIndexAllocation(_vfile, _indexDecode);
std::ostringstream result;
#if __WORDSIZE == 64
printf("Decoding Index entry at offset 0x%lx\n", _indexDecode);
#else
printf("Decoding Index entry at offset 0x%llx\n", _indexDecode);
#endif
content->dumpNodeHeader();
content->dumpEntries();
result << "Index record entry at offset " << _indexDecode << " (0x" << std::hex << _indexDecode << ") decoded, see std::out";
_setStateInfo(std::string(result.str()));
return ;
}
/* MFTEntry size related
*/
if (!_boot->mftEntrySize()) {
// No mft entry size discovered, so discover it
DEBUG(INFO, "No MFTEntry size found, trying to search it\n");
_boot->mftEntrySize(_mftEntry->discoverMftEntrySize(offset));
}
/* in case mftEntrySize is not present in boot block
*/
if (!_boot->mftEntrySize() &&
_boot->isPow2(_mftEntry->getMftEntryBlock()->allocatedSizeMftEntry)) {
/* Set MFT entry size if ones in bootsector is invalid */
_boot->mftEntrySize(_mftEntry->getMftEntryBlock()->allocatedSizeMftEntry);
}
if (_boot->mftEntrySize() == 0) {
/* Unable to find mft entry size either in bootsector or directly in an mft entry */
DEBUG(INFO, "Unable to find mft entry size either in bootsector or directly in an mft entry\n");
throw(vfsError(std::string("Unable to find mft entry size either in bootsector or directly in an mft entry")));
}
_mftEntry->mftEntrySize(_boot->mftEntrySize());
if (_mftEntry->isMftEntryBlock(offset)) {
// Mft is valid
DEBUG(INFO, "\tValid MFTEntry found\n");
_root = new NtfsNode("NTFS", 0, NULL, this, false, NULL, NULL, NULL);
mftEntryNumber = 0;
_mftMainFile = new MftFile(_vfile, _boot->mftEntrySize(),
_boot->indexRecordSize(),
_boot->sectorSize(),
_boot->clusterSize());
_setMftMainFile(offset);
// search every files in MFT
_setStateInfo("Searching for regular files and directories");
_walkMftMainFile();
_setStateInfo("Searching for deleted and orphans files and directories");
DEBUG(INFO, "Searching for deleted and orphans files\n");
_checkOrphanEntries();
_setStateInfo("Done");
}
else {
std::cerr << "No NTFS MFT Entry found" << std::endl;
_setStateInfo(std::string("No NTFS MFT Entry found"));
}
if (_node && _root) {
registerTree(_node, _root);
}
}
catch (vfsError & e)
{
std::cerr << "Exception vfsError caught in module Ntfs method start(): " << e.error << std::endl;
_setStateInfo(std::string(e.error));
//throw e;
}
catch (envError & e)
{
std::cerr << "Exception envError caught in module Ntfs method start(): " << e.error << std::endl;
_setStateInfo(e.error);
//throw e;
}
catch (std::exception & e)
{
std::cerr << "Exception std::exception caught in module Ntfs method start(): " << e.what() << std::endl;
_setStateInfo(e.what());
//throw e;
}
}
else
{
