/src/libesedb/libesedb/libesedb_file_header.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * File header functions |
3 | | * |
4 | | * Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com> |
5 | | * |
6 | | * Refer to AUTHORS for acknowledgements. |
7 | | * |
8 | | * This program is free software: you can redistribute it and/or modify |
9 | | * it under the terms of the GNU Lesser General Public License as published by |
10 | | * the Free Software Foundation, either version 3 of the License, or |
11 | | * (at your option) any later version. |
12 | | * |
13 | | * This program is distributed in the hope that it will be useful, |
14 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | | * GNU General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
20 | | */ |
21 | | |
22 | | #include <common.h> |
23 | | #include <byte_stream.h> |
24 | | #include <memory.h> |
25 | | #include <types.h> |
26 | | |
27 | | #include "libesedb_checksum.h" |
28 | | #include "libesedb_debug.h" |
29 | | #include "libesedb_file_header.h" |
30 | | #include "libesedb_io_handle.h" |
31 | | #include "libesedb_libcerror.h" |
32 | | #include "libesedb_libcnotify.h" |
33 | | |
34 | | #include "esedb_file_header.h" |
35 | | |
36 | | /* Creates file header |
37 | | * Make sure the value file_header is referencing, is set to NULL |
38 | | * Returns 1 if successful or -1 on error |
39 | | */ |
40 | | int libesedb_file_header_initialize( |
41 | | libesedb_file_header_t **file_header, |
42 | | libcerror_error_t **error ) |
43 | 12.3k | { |
44 | 12.3k | static char *function = "libesedb_file_header_initialize"; |
45 | | |
46 | 12.3k | if( file_header == NULL ) |
47 | 0 | { |
48 | 0 | libcerror_error_set( |
49 | 0 | error, |
50 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
51 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
52 | 0 | "%s: invalid file header.", |
53 | 0 | function ); |
54 | |
|
55 | 0 | return( -1 ); |
56 | 0 | } |
57 | 12.3k | if( *file_header != NULL ) |
58 | 0 | { |
59 | 0 | libcerror_error_set( |
60 | 0 | error, |
61 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
62 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
63 | 0 | "%s: invalid file header value already set.", |
64 | 0 | function ); |
65 | |
|
66 | 0 | return( -1 ); |
67 | 0 | } |
68 | 12.3k | *file_header = memory_allocate_structure( |
69 | 12.3k | libesedb_file_header_t ); |
70 | | |
71 | 12.3k | if( *file_header == NULL ) |
72 | 0 | { |
73 | 0 | libcerror_error_set( |
74 | 0 | error, |
75 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
76 | 0 | LIBCERROR_MEMORY_ERROR_INSUFFICIENT, |
77 | 0 | "%s: unable to create file header.", |
78 | 0 | function ); |
79 | |
|
80 | 0 | goto on_error; |
81 | 0 | } |
82 | 12.3k | if( memory_set( |
83 | 12.3k | *file_header, |
84 | 12.3k | 0, |
85 | 12.3k | sizeof( libesedb_file_header_t ) ) == NULL ) |
86 | 0 | { |
87 | 0 | libcerror_error_set( |
88 | 0 | error, |
89 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
90 | 0 | LIBCERROR_MEMORY_ERROR_SET_FAILED, |
91 | 0 | "%s: unable to clear file header.", |
92 | 0 | function ); |
93 | |
|
94 | 0 | goto on_error; |
95 | 0 | } |
96 | 12.3k | return( 1 ); |
97 | | |
98 | 0 | on_error: |
99 | 0 | if( *file_header != NULL ) |
100 | 0 | { |
101 | 0 | memory_free( |
102 | 0 | *file_header ); |
103 | |
|
104 | 0 | *file_header = NULL; |
105 | 0 | } |
106 | 0 | return( -1 ); |
107 | 12.3k | } |
108 | | |
109 | | /* Frees file header |
110 | | * Returns 1 if successful or -1 on error |
111 | | */ |
112 | | int libesedb_file_header_free( |
113 | | libesedb_file_header_t **file_header, |
114 | | libcerror_error_t **error ) |
115 | 12.3k | { |
116 | 12.3k | static char *function = "libesedb_file_header_free"; |
117 | | |
118 | 12.3k | if( file_header == NULL ) |
119 | 0 | { |
120 | 0 | libcerror_error_set( |
121 | 0 | error, |
122 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
123 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
124 | 0 | "%s: invalid file header.", |
125 | 0 | function ); |
126 | |
|
127 | 0 | return( -1 ); |
128 | 0 | } |
129 | 12.3k | if( *file_header != NULL ) |
130 | 12.3k | { |
131 | 12.3k | memory_free( |
132 | 12.3k | *file_header ); |
133 | | |
134 | 12.3k | *file_header = NULL; |
135 | 12.3k | } |
136 | 12.3k | return( 1 ); |
137 | 12.3k | } |
138 | | |
139 | | /* Reads the file header data |
140 | | * Returns 1 if successful or -1 on error |
141 | | */ |
142 | | int libesedb_file_header_read_data( |
143 | | libesedb_file_header_t *file_header, |
144 | | const uint8_t *data, |
145 | | size_t data_size, |
146 | | libcerror_error_t **error ) |
147 | 12.0k | { |
148 | 12.0k | static char *function = "libesedb_file_header_read_data"; |
149 | 12.0k | uint32_t calculated_xor32_checksum = 0; |
150 | 12.0k | uint32_t stored_xor32_checksum = 0; |
151 | | |
152 | | #if defined( HAVE_DEBUG_OUTPUT ) |
153 | | uint32_t value_32bit = 0; |
154 | | #endif |
155 | | |
156 | 12.0k | if( file_header == NULL ) |
157 | 0 | { |
158 | 0 | libcerror_error_set( |
159 | 0 | error, |
160 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
161 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
162 | 0 | "%s: invalid file header.", |
163 | 0 | function ); |
164 | |
|
165 | 0 | return( -1 ); |
166 | 0 | } |
167 | 12.0k | if( data == NULL ) |
168 | 0 | { |
169 | 0 | libcerror_error_set( |
170 | 0 | error, |
171 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
172 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
173 | 0 | "%s: invalid data.", |
174 | 0 | function ); |
175 | |
|
176 | 0 | return( -1 ); |
177 | 0 | } |
178 | 12.0k | if( data_size < sizeof( esedb_file_header_t ) ) |
179 | 0 | { |
180 | 0 | libcerror_error_set( |
181 | 0 | error, |
182 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
183 | 0 | LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL, |
184 | 0 | "%s: invalid data size value too small.", |
185 | 0 | function ); |
186 | |
|
187 | 0 | return( -1 ); |
188 | 0 | } |
189 | 12.0k | if( data_size > (size_t) SSIZE_MAX ) |
190 | 0 | { |
191 | 0 | libcerror_error_set( |
192 | 0 | error, |
193 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
194 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, |
195 | 0 | "%s: invalid data size value exceeds maximum.", |
196 | 0 | function ); |
197 | |
|
198 | 0 | return( -1 ); |
199 | 0 | } |
200 | | #if defined( HAVE_DEBUG_OUTPUT ) |
201 | | if( libcnotify_verbose != 0 ) |
202 | | { |
203 | | libcnotify_printf( |
204 | | "%s: file header:\n", |
205 | | function ); |
206 | | libcnotify_print_data( |
207 | | data, |
208 | | sizeof( esedb_file_header_t ), |
209 | | LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA ); |
210 | | } |
211 | | #endif |
212 | 12.0k | if( memory_compare( |
213 | 12.0k | ( (esedb_file_header_t *) data )->signature, |
214 | 12.0k | esedb_file_signature, |
215 | 12.0k | 4 ) != 0 ) |
216 | 228 | { |
217 | 228 | libcerror_error_set( |
218 | 228 | error, |
219 | 228 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
220 | 228 | LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, |
221 | 228 | "%s: unsupported file signature.", |
222 | 228 | function ); |
223 | | |
224 | 228 | return( -1 ); |
225 | 228 | } |
226 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
227 | 11.8k | ( (esedb_file_header_t *) data )->checksum, |
228 | 11.8k | stored_xor32_checksum ); |
229 | | |
230 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
231 | 11.8k | ( (esedb_file_header_t *) data )->format_version, |
232 | 11.8k | file_header->format_version ); |
233 | | |
234 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
235 | 11.8k | ( (esedb_file_header_t *) data )->file_type, |
236 | 11.8k | file_header->file_type ); |
237 | | |
238 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
239 | 11.8k | ( (esedb_file_header_t *) data )->database_state, |
240 | 11.8k | file_header->database_state ); |
241 | | |
242 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
243 | 11.8k | ( (esedb_file_header_t *) data )->format_revision, |
244 | 11.8k | file_header->format_revision ); |
245 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
246 | 11.8k | ( (esedb_file_header_t *) data )->page_size, |
247 | 11.8k | file_header->page_size ); |
248 | | |
249 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
250 | 11.8k | ( (esedb_file_header_t *) data )->creation_format_version, |
251 | 11.8k | file_header->creation_format_version ); |
252 | 11.8k | byte_stream_copy_to_uint32_little_endian( |
253 | 11.8k | ( (esedb_file_header_t *) data )->creation_format_revision, |
254 | 11.8k | file_header->creation_format_revision ); |
255 | | |
256 | | #if defined( HAVE_DEBUG_OUTPUT ) |
257 | | if( libcnotify_verbose != 0 ) |
258 | | { |
259 | | libcnotify_printf( |
260 | | "%s: checksum\t\t\t\t: 0x%08" PRIx32 "\n", |
261 | | function, |
262 | | stored_xor32_checksum ); |
263 | | |
264 | | byte_stream_copy_to_uint32_little_endian( |
265 | | ( (esedb_file_header_t *) data )->signature, |
266 | | value_32bit ); |
267 | | libcnotify_printf( |
268 | | "%s: signature\t\t\t\t: 0x%08" PRIx32 "\n", |
269 | | function, |
270 | | value_32bit ); |
271 | | |
272 | | libcnotify_printf( |
273 | | "%s: format version\t\t\t\t: 0x%08" PRIx32 "\n", |
274 | | function, |
275 | | file_header->format_version ); |
276 | | |
277 | | libcnotify_printf( |
278 | | "%s: file type\t\t\t\t: %" PRIu32 " (", |
279 | | function, |
280 | | file_header->file_type ); |
281 | | libesedb_debug_print_file_type( |
282 | | file_header->file_type ); |
283 | | libcnotify_printf( |
284 | | ")\n" ); |
285 | | |
286 | | libcnotify_printf( |
287 | | "%s: database time:\n", |
288 | | function ); |
289 | | libcnotify_print_data( |
290 | | ( (esedb_file_header_t *) data )->database_time, |
291 | | 8, |
292 | | 0 ); |
293 | | |
294 | | libcnotify_printf( |
295 | | "%s: database signature:\n", |
296 | | function ); |
297 | | libcnotify_print_data( |
298 | | ( (esedb_file_header_t *) data )->database_signature, |
299 | | 28, |
300 | | 0 ); |
301 | | |
302 | | libcnotify_printf( |
303 | | "%s: database state\t\t\t\t: %" PRIu32 " ", |
304 | | function, |
305 | | file_header->database_state ); |
306 | | libesedb_debug_print_database_state( |
307 | | file_header->database_state ); |
308 | | libcnotify_printf( |
309 | | "\n" ); |
310 | | |
311 | | libcnotify_printf( |
312 | | "%s: consistent position:\n", |
313 | | function ); |
314 | | libcnotify_print_data( |
315 | | ( (esedb_file_header_t *) data )->consistent_postition, |
316 | | 8, |
317 | | 0 ); |
318 | | libesedb_debug_print_log_time( |
319 | | ( (esedb_file_header_t *) data )->consistent_time, |
320 | | 8, |
321 | | "consistent time", |
322 | | "\t\t\t\t", |
323 | | NULL ); |
324 | | |
325 | | libesedb_debug_print_log_time( |
326 | | ( (esedb_file_header_t *) data )->attach_time, |
327 | | 8, |
328 | | "attach time", |
329 | | "\t\t\t\t", |
330 | | NULL ); |
331 | | libcnotify_printf( |
332 | | "%s: attach position:\n", |
333 | | function ); |
334 | | libcnotify_print_data( |
335 | | ( (esedb_file_header_t *) data )->attach_postition, |
336 | | 8, |
337 | | 0 ); |
338 | | |
339 | | libesedb_debug_print_log_time( |
340 | | ( (esedb_file_header_t *) data )->detach_time, |
341 | | 8, |
342 | | "detach time", |
343 | | "\t\t\t\t", |
344 | | NULL ); |
345 | | libcnotify_printf( |
346 | | "%s: detach position:\n", |
347 | | function ); |
348 | | libcnotify_print_data( |
349 | | ( (esedb_file_header_t *) data )->detach_postition, |
350 | | 8, |
351 | | 0 ); |
352 | | |
353 | | byte_stream_copy_to_uint32_little_endian( |
354 | | ( (esedb_file_header_t *) data )->unknown1, |
355 | | value_32bit ); |
356 | | libcnotify_printf( |
357 | | "%s: unknown1\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n", |
358 | | function, |
359 | | value_32bit, |
360 | | value_32bit ); |
361 | | |
362 | | libcnotify_printf( |
363 | | "%s: log signature:\n", |
364 | | function ); |
365 | | libcnotify_print_data( |
366 | | ( (esedb_file_header_t *) data )->log_signature, |
367 | | 28, |
368 | | 0 ); |
369 | | |
370 | | libcnotify_printf( |
371 | | "%s: previous full backup:\n", |
372 | | function ); |
373 | | libcnotify_print_data( |
374 | | ( (esedb_file_header_t *) data )->previous_full_backup, |
375 | | 24, |
376 | | 0 ); |
377 | | libcnotify_printf( |
378 | | "%s: previous incremental backup:\n", |
379 | | function ); |
380 | | libcnotify_print_data( |
381 | | ( (esedb_file_header_t *) data )->previous_incremental_backup, |
382 | | 24, |
383 | | 0 ); |
384 | | libcnotify_printf( |
385 | | "%s: current full backup:\n", |
386 | | function ); |
387 | | libcnotify_print_data( |
388 | | ( (esedb_file_header_t *) data )->current_full_backup, |
389 | | 24, |
390 | | 0 ); |
391 | | |
392 | | byte_stream_copy_to_uint32_little_endian( |
393 | | ( (esedb_file_header_t *) data )->shadowing_disabled, |
394 | | value_32bit ); |
395 | | libcnotify_printf( |
396 | | "%s: shadowing disabled\t\t\t: %" PRIu32 "\n", |
397 | | function, |
398 | | value_32bit ); |
399 | | |
400 | | byte_stream_copy_to_uint32_little_endian( |
401 | | ( (esedb_file_header_t *) data )->last_object_identifier, |
402 | | value_32bit ); |
403 | | libcnotify_printf( |
404 | | "%s: last object identifier\t\t\t: %" PRIu32 "\n", |
405 | | function, |
406 | | value_32bit ); |
407 | | |
408 | | byte_stream_copy_to_uint32_little_endian( |
409 | | ( (esedb_file_header_t *) data )->index_update_major_version, |
410 | | value_32bit ); |
411 | | libcnotify_printf( |
412 | | "%s: index update major version\t\t: %" PRIu32 "\n", |
413 | | function, |
414 | | value_32bit ); |
415 | | byte_stream_copy_to_uint32_little_endian( |
416 | | ( (esedb_file_header_t *) data )->index_update_minor_version, |
417 | | value_32bit ); |
418 | | libcnotify_printf( |
419 | | "%s: index update minor version\t\t: %" PRIu32 "\n", |
420 | | function, |
421 | | value_32bit ); |
422 | | byte_stream_copy_to_uint32_little_endian( |
423 | | ( (esedb_file_header_t *) data )->index_update_build_number, |
424 | | value_32bit ); |
425 | | libcnotify_printf( |
426 | | "%s: index update build number\t\t: %" PRIu32 "\n", |
427 | | function, |
428 | | value_32bit ); |
429 | | byte_stream_copy_to_uint32_little_endian( |
430 | | ( (esedb_file_header_t *) data )->index_update_service_pack_number, |
431 | | value_32bit ); |
432 | | libcnotify_printf( |
433 | | "%s: index update service pack number\t: %" PRIu32 "\n", |
434 | | function, |
435 | | value_32bit ); |
436 | | |
437 | | libcnotify_printf( |
438 | | "%s: format revision\t\t\t\t: %" PRIu32 " (0x%08" PRIx32 ")\n", |
439 | | function, |
440 | | file_header->format_revision, |
441 | | file_header->format_revision ); |
442 | | libcnotify_printf( |
443 | | "%s: page size\t\t\t\t: %" PRIu32 "\n", |
444 | | function, |
445 | | file_header->page_size ); |
446 | | |
447 | | byte_stream_copy_to_uint32_little_endian( |
448 | | ( (esedb_file_header_t *) data )->repair_count, |
449 | | value_32bit ); |
450 | | libcnotify_printf( |
451 | | "%s: repair count\t\t\t\t: %" PRIu32 "\n", |
452 | | function, |
453 | | value_32bit ); |
454 | | libesedb_debug_print_log_time( |
455 | | ( (esedb_file_header_t *) data )->repair_time, |
456 | | 8, |
457 | | "repair time", |
458 | | "\t\t\t\t", |
459 | | NULL ); |
460 | | |
461 | | libcnotify_printf( |
462 | | "%s: unknown2:\n", |
463 | | function ); |
464 | | libcnotify_print_data( |
465 | | ( (esedb_file_header_t *) data )->unknown2, |
466 | | 28, |
467 | | 0 ); |
468 | | |
469 | | libcnotify_printf( |
470 | | "%s: scrub database time:\n", |
471 | | function ); |
472 | | libcnotify_print_data( |
473 | | ( (esedb_file_header_t *) data )->scrub_database_time, |
474 | | 8, |
475 | | 0 ); |
476 | | libesedb_debug_print_log_time( |
477 | | ( (esedb_file_header_t *) data )->scrub_time, |
478 | | 8, |
479 | | "scrub time", |
480 | | "\t\t\t\t", |
481 | | NULL ); |
482 | | |
483 | | libcnotify_printf( |
484 | | "%s: required log:\n", |
485 | | function ); |
486 | | libcnotify_print_data( |
487 | | ( (esedb_file_header_t *) data )->required_log, |
488 | | 8, |
489 | | 0 ); |
490 | | |
491 | | byte_stream_copy_to_uint32_little_endian( |
492 | | ( (esedb_file_header_t *) data )->upgrade_exchange5_format, |
493 | | value_32bit ); |
494 | | libcnotify_printf( |
495 | | "%s: upgrade Exchange 5.5 format\t\t: %" PRIu32 "\n", |
496 | | function, |
497 | | value_32bit ); |
498 | | byte_stream_copy_to_uint32_little_endian( |
499 | | ( (esedb_file_header_t *) data )->upgrade_free_pages, |
500 | | value_32bit ); |
501 | | libcnotify_printf( |
502 | | "%s: upgrade free pages\t\t\t: %" PRIu32 "\n", |
503 | | function, |
504 | | value_32bit ); |
505 | | byte_stream_copy_to_uint32_little_endian( |
506 | | ( (esedb_file_header_t *) data )->upgrade_space_map_pages, |
507 | | value_32bit ); |
508 | | libcnotify_printf( |
509 | | "%s: upgrade space map pages\t\t\t: %" PRIu32 "\n", |
510 | | function, |
511 | | value_32bit ); |
512 | | |
513 | | libcnotify_printf( |
514 | | "%s: current shadow volume backup:\n", |
515 | | function ); |
516 | | libcnotify_print_data( |
517 | | ( (esedb_file_header_t *) data )->current_shadow_volume_backup, |
518 | | 24, |
519 | | 0 ); |
520 | | |
521 | | libcnotify_printf( |
522 | | "%s: creation format version\t\t\t: 0x%08" PRIx32 "\n", |
523 | | function, |
524 | | file_header->creation_format_version ); |
525 | | libcnotify_printf( |
526 | | "%s: creation format revision\t\t: %" PRIu32 " (0x%08" PRIx32 ")\n", |
527 | | function, |
528 | | file_header->creation_format_revision, |
529 | | file_header->creation_format_revision ); |
530 | | |
531 | | libcnotify_printf( |
532 | | "%s: unknown3:\n", |
533 | | function ); |
534 | | libcnotify_print_data( |
535 | | ( (esedb_file_header_t *) data )->unknown3, |
536 | | 16, |
537 | | 0 ); |
538 | | |
539 | | byte_stream_copy_to_uint32_little_endian( |
540 | | ( (esedb_file_header_t *) data )->old_repair_count, |
541 | | value_32bit ); |
542 | | libcnotify_printf( |
543 | | "%s: old repair count\t\t\t: %" PRIu32 "\n", |
544 | | function, |
545 | | value_32bit ); |
546 | | |
547 | | byte_stream_copy_to_uint32_little_endian( |
548 | | ( (esedb_file_header_t *) data )->ecc_fix_success_count, |
549 | | value_32bit ); |
550 | | libcnotify_printf( |
551 | | "%s: ECC fix success count\t\t\t: %" PRIu32 "\n", |
552 | | function, |
553 | | value_32bit ); |
554 | | libesedb_debug_print_log_time( |
555 | | ( (esedb_file_header_t *) data )->ecc_fix_success_time, |
556 | | 8, |
557 | | "ECC fix success time", |
558 | | "\t\t\t", |
559 | | NULL ); |
560 | | byte_stream_copy_to_uint32_little_endian( |
561 | | ( (esedb_file_header_t *) data )->old_ecc_fix_success_count, |
562 | | value_32bit ); |
563 | | libcnotify_printf( |
564 | | "%s: old ECC fix success count\t\t: %" PRIu32 "\n", |
565 | | function, |
566 | | value_32bit ); |
567 | | |
568 | | byte_stream_copy_to_uint32_little_endian( |
569 | | ( (esedb_file_header_t *) data )->ecc_fix_error_count, |
570 | | value_32bit ); |
571 | | libcnotify_printf( |
572 | | "%s: ECC fix error count\t\t\t: %" PRIu32 "\n", |
573 | | function, |
574 | | value_32bit ); |
575 | | libesedb_debug_print_log_time( |
576 | | ( (esedb_file_header_t *) data )->ecc_fix_error_time, |
577 | | 8, |
578 | | "ECC fix error time", |
579 | | "\t\t\t", |
580 | | NULL ); |
581 | | byte_stream_copy_to_uint32_little_endian( |
582 | | ( (esedb_file_header_t *) data )->old_ecc_fix_error_count, |
583 | | value_32bit ); |
584 | | libcnotify_printf( |
585 | | "%s: old ECC fix error count\t\t\t: %" PRIu32 "\n", |
586 | | function, |
587 | | value_32bit ); |
588 | | |
589 | | byte_stream_copy_to_uint32_little_endian( |
590 | | ( (esedb_file_header_t *) data )->bad_checksum_error_count, |
591 | | value_32bit ); |
592 | | libcnotify_printf( |
593 | | "%s: bad checksum error count\t\t: %" PRIu32 "\n", |
594 | | function, |
595 | | value_32bit ); |
596 | | libesedb_debug_print_log_time( |
597 | | ( (esedb_file_header_t *) data )->bad_checksum_error_time, |
598 | | 8, |
599 | | "bad checksum error time", |
600 | | "\t\t\t", |
601 | | NULL ); |
602 | | byte_stream_copy_to_uint32_little_endian( |
603 | | ( (esedb_file_header_t *) data )->old_bad_checksum_error_count, |
604 | | value_32bit ); |
605 | | libcnotify_printf( |
606 | | "%s: old bad checksum error count\t\t: %" PRIu32 "\n", |
607 | | function, |
608 | | value_32bit ); |
609 | | |
610 | | libcnotify_printf( |
611 | | "%s: committed log:\n", |
612 | | function ); |
613 | | libcnotify_print_data( |
614 | | ( (esedb_file_header_t *) data )->committed_log, |
615 | | 4, |
616 | | 0 ); |
617 | | |
618 | | libcnotify_printf( |
619 | | "%s: previous shadow volume backup:\n", |
620 | | function ); |
621 | | libcnotify_print_data( |
622 | | ( (esedb_file_header_t *) data )->previous_shadow_volume_backup, |
623 | | 24, |
624 | | 0 ); |
625 | | libcnotify_printf( |
626 | | "%s: previous differential backup:\n", |
627 | | function ); |
628 | | libcnotify_print_data( |
629 | | ( (esedb_file_header_t *) data )->previous_differential_backup, |
630 | | 24, |
631 | | 0 ); |
632 | | |
633 | | libcnotify_printf( |
634 | | "%s: unknown4:\n", |
635 | | function ); |
636 | | libcnotify_print_data( |
637 | | ( (esedb_file_header_t *) data )->unknown4, |
638 | | 40, |
639 | | 0 ); |
640 | | |
641 | | byte_stream_copy_to_uint32_little_endian( |
642 | | ( (esedb_file_header_t *) data )->nls_major_version, |
643 | | value_32bit ); |
644 | | libcnotify_printf( |
645 | | "%s: NLS major version\t\t\t: 0x%08" PRIx32 "\n", |
646 | | function, |
647 | | value_32bit ); |
648 | | byte_stream_copy_to_uint32_little_endian( |
649 | | ( (esedb_file_header_t *) data )->nls_minor_version, |
650 | | value_32bit ); |
651 | | libcnotify_printf( |
652 | | "%s: NLS minor version\t\t\t: 0x%08" PRIx32 "\n", |
653 | | function, |
654 | | value_32bit ); |
655 | | |
656 | | libcnotify_printf( |
657 | | "%s: unknown5:\n", |
658 | | function ); |
659 | | libcnotify_print_data( |
660 | | ( (esedb_file_header_t *) data )->unknown5, |
661 | | 148, |
662 | | LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA ); |
663 | | |
664 | | byte_stream_copy_to_uint32_little_endian( |
665 | | ( (esedb_file_header_t *) data )->unknown_flags, |
666 | | value_32bit ); |
667 | | libcnotify_printf( |
668 | | "%s: unknown flags\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n", |
669 | | function, |
670 | | value_32bit, |
671 | | value_32bit ); |
672 | | |
673 | | libcnotify_printf( |
674 | | "\n" ); |
675 | | } |
676 | | #endif /* defined( HAVE_DEBUG_OUTPUT ) */ |
677 | | |
678 | 11.8k | if( libesedb_checksum_calculate_little_endian_xor32( |
679 | 11.8k | &calculated_xor32_checksum, |
680 | 11.8k | &( data[ 4 ] ), |
681 | 11.8k | data_size - 4, |
682 | 11.8k | 0x89abcdef, |
683 | 11.8k | error ) != 1 ) |
684 | 0 | { |
685 | 0 | libcerror_error_set( |
686 | 0 | error, |
687 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
688 | 0 | LIBCERROR_RUNTIME_ERROR_GENERIC, |
689 | 0 | "%s: unable to calculate XOR-32 checksum.", |
690 | 0 | function ); |
691 | |
|
692 | 0 | return( -1 ); |
693 | 0 | } |
694 | 11.8k | if( ( file_header->database_state != 2 ) |
695 | 11.8k | && ( stored_xor32_checksum != calculated_xor32_checksum ) ) |
696 | 281 | { |
697 | 281 | libcerror_error_set( |
698 | 281 | error, |
699 | 281 | LIBCERROR_ERROR_DOMAIN_INPUT, |
700 | 281 | LIBCERROR_INPUT_ERROR_CHECKSUM_MISMATCH, |
701 | 281 | "%s: mismatch in file header checksum ( 0x%08" PRIx32 " != 0x%08" PRIx32 " ).", |
702 | 281 | function, |
703 | 281 | stored_xor32_checksum, |
704 | 281 | calculated_xor32_checksum ); |
705 | | |
706 | 281 | return( -1 ); |
707 | 281 | } |
708 | | /* TODO add more values to internal structures */ |
709 | | |
710 | 11.5k | return( 1 ); |
711 | 11.8k | } |
712 | | |
713 | | /* Reads the file header |
714 | | * Returns 1 if successful or -1 on error |
715 | | */ |
716 | | int libesedb_file_header_read_file_io_handle( |
717 | | libesedb_file_header_t *file_header, |
718 | | libbfio_handle_t *file_io_handle, |
719 | | off64_t file_offset, |
720 | | libcerror_error_t **error ) |
721 | 13.9k | { |
722 | 13.9k | uint8_t file_header_data[ sizeof( esedb_file_header_t ) ]; |
723 | | |
724 | 13.9k | static char *function = "libesedb_file_header_read_file_io_handle"; |
725 | 13.9k | ssize_t read_count = 0; |
726 | | |
727 | 13.9k | if( file_header == NULL ) |
728 | 0 | { |
729 | 0 | libcerror_error_set( |
730 | 0 | error, |
731 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
732 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
733 | 0 | "%s: invalid file header.", |
734 | 0 | function ); |
735 | |
|
736 | 0 | return( -1 ); |
737 | 0 | } |
738 | | #if defined( HAVE_DEBUG_OUTPUT ) |
739 | | if( libcnotify_verbose != 0 ) |
740 | | { |
741 | | libcnotify_printf( |
742 | | "%s: reading file header at offset: %" PRIi64 " (0x%08" PRIx64 ")\n", |
743 | | function, |
744 | | file_offset, |
745 | | file_offset ); |
746 | | } |
747 | | #endif |
748 | 13.9k | read_count = libbfio_handle_read_buffer_at_offset( |
749 | 13.9k | file_io_handle, |
750 | 13.9k | file_header_data, |
751 | 13.9k | sizeof( esedb_file_header_t ), |
752 | 13.9k | file_offset, |
753 | 13.9k | error ); |
754 | | |
755 | 13.9k | if( read_count != (ssize_t) sizeof( esedb_file_header_t ) ) |
756 | 1.90k | { |
757 | 1.90k | libcerror_error_set( |
758 | 1.90k | error, |
759 | 1.90k | LIBCERROR_ERROR_DOMAIN_IO, |
760 | 1.90k | LIBCERROR_IO_ERROR_READ_FAILED, |
761 | 1.90k | "%s: unable to read file header data at offset: %" PRIi64 " (0x%08" PRIx64 ").", |
762 | 1.90k | function, |
763 | 1.90k | file_offset, |
764 | 1.90k | file_offset ); |
765 | | |
766 | 1.90k | return( -1 ); |
767 | 1.90k | } |
768 | 12.0k | if( libesedb_file_header_read_data( |
769 | 12.0k | file_header, |
770 | 12.0k | file_header_data, |
771 | 12.0k | sizeof( esedb_file_header_t ), |
772 | 12.0k | error ) != 1 ) |
773 | 509 | { |
774 | 509 | libcerror_error_set( |
775 | 509 | error, |
776 | 509 | LIBCERROR_ERROR_DOMAIN_IO, |
777 | 509 | LIBCERROR_IO_ERROR_READ_FAILED, |
778 | 509 | "%s: unable to read file header.", |
779 | 509 | function ); |
780 | | |
781 | 509 | return( -1 ); |
782 | 509 | } |
783 | 11.5k | return( 1 ); |
784 | 12.0k | } |
785 | | |