/src/libfsntfs/libfsntfs/libfsntfs_object_identifier_values.c
Line | Count | Source |
1 | | /* |
2 | | * Object identifier attribute ($OBJECT_ID) values functions |
3 | | * |
4 | | * Copyright (C) 2010-2026, Joachim Metz <joachim.metz@gmail.com> |
5 | | * |
6 | | * Refer to AUTHORS for acknowledgements. |
7 | | * |
8 | | * This program is free software: you can redistribute it and/or modify |
9 | | * it under the terms of the GNU Lesser General Public License as published by |
10 | | * the Free Software Foundation, either version 3 of the License, or |
11 | | * (at your option) any later version. |
12 | | * |
13 | | * This program is distributed in the hope that it will be useful, |
14 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | | * GNU General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
20 | | */ |
21 | | |
22 | | #include <common.h> |
23 | | #include <byte_stream.h> |
24 | | #include <memory.h> |
25 | | #include <system_string.h> |
26 | | #include <types.h> |
27 | | |
28 | | #include "libfsntfs_debug.h" |
29 | | #include "libfsntfs_definitions.h" |
30 | | #include "libfsntfs_libcerror.h" |
31 | | #include "libfsntfs_libcnotify.h" |
32 | | #include "libfsntfs_libfguid.h" |
33 | | #include "libfsntfs_mft_attribute.h" |
34 | | #include "libfsntfs_object_identifier_values.h" |
35 | | |
36 | | #include "fsntfs_object_identifier.h" |
37 | | |
38 | | /* Creates object identifier values |
39 | | * Make sure the value object_identifier_values is referencing, is set to NULL |
40 | | * Returns 1 if successful or -1 on error |
41 | | */ |
42 | | int libfsntfs_object_identifier_values_initialize( |
43 | | libfsntfs_object_identifier_values_t **object_identifier_values, |
44 | | libcerror_error_t **error ) |
45 | 0 | { |
46 | 0 | static char *function = "libfsntfs_object_identifier_values_initialize"; |
47 | |
|
48 | 0 | if( object_identifier_values == NULL ) |
49 | 0 | { |
50 | 0 | libcerror_error_set( |
51 | 0 | error, |
52 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
53 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
54 | 0 | "%s: invalid object identifier values.", |
55 | 0 | function ); |
56 | |
|
57 | 0 | return( -1 ); |
58 | 0 | } |
59 | 0 | if( *object_identifier_values != NULL ) |
60 | 0 | { |
61 | 0 | libcerror_error_set( |
62 | 0 | error, |
63 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
64 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
65 | 0 | "%s: invalid object identifier values values value already set.", |
66 | 0 | function ); |
67 | |
|
68 | 0 | return( -1 ); |
69 | 0 | } |
70 | 0 | *object_identifier_values = memory_allocate_structure( |
71 | 0 | libfsntfs_object_identifier_values_t ); |
72 | |
|
73 | 0 | if( *object_identifier_values == NULL ) |
74 | 0 | { |
75 | 0 | libcerror_error_set( |
76 | 0 | error, |
77 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
78 | 0 | LIBCERROR_MEMORY_ERROR_INSUFFICIENT, |
79 | 0 | "%s: unable to create object identifier values.", |
80 | 0 | function ); |
81 | |
|
82 | 0 | goto on_error; |
83 | 0 | } |
84 | 0 | if( memory_set( |
85 | 0 | *object_identifier_values, |
86 | 0 | 0, |
87 | 0 | sizeof( libfsntfs_object_identifier_values_t ) ) == NULL ) |
88 | 0 | { |
89 | 0 | libcerror_error_set( |
90 | 0 | error, |
91 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
92 | 0 | LIBCERROR_MEMORY_ERROR_SET_FAILED, |
93 | 0 | "%s: unable to clear object identifier values.", |
94 | 0 | function ); |
95 | |
|
96 | 0 | goto on_error; |
97 | 0 | } |
98 | 0 | return( 1 ); |
99 | | |
100 | 0 | on_error: |
101 | 0 | if( *object_identifier_values != NULL ) |
102 | 0 | { |
103 | 0 | memory_free( |
104 | 0 | *object_identifier_values ); |
105 | |
|
106 | 0 | *object_identifier_values = NULL; |
107 | 0 | } |
108 | 0 | return( -1 ); |
109 | 0 | } |
110 | | |
111 | | /* Frees object identifier values |
112 | | * Returns 1 if successful or -1 on error |
113 | | */ |
114 | | int libfsntfs_object_identifier_values_free( |
115 | | libfsntfs_object_identifier_values_t **object_identifier_values, |
116 | | libcerror_error_t **error ) |
117 | 0 | { |
118 | 0 | static char *function = "libfsntfs_object_identifier_values_free"; |
119 | |
|
120 | 0 | if( object_identifier_values == NULL ) |
121 | 0 | { |
122 | 0 | libcerror_error_set( |
123 | 0 | error, |
124 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
125 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
126 | 0 | "%s: invalid object identifier values.", |
127 | 0 | function ); |
128 | |
|
129 | 0 | return( -1 ); |
130 | 0 | } |
131 | 0 | if( *object_identifier_values != NULL ) |
132 | 0 | { |
133 | 0 | memory_free( |
134 | 0 | *object_identifier_values ); |
135 | |
|
136 | 0 | *object_identifier_values = NULL; |
137 | 0 | } |
138 | 0 | return( 1 ); |
139 | 0 | } |
140 | | |
141 | | /* Reads the object identifier values |
142 | | * Returns 1 if successful or -1 on error |
143 | | */ |
144 | | int libfsntfs_object_identifier_values_read_data( |
145 | | libfsntfs_object_identifier_values_t *object_identifier_values, |
146 | | const uint8_t *data, |
147 | | size_t data_size, |
148 | | libcerror_error_t **error ) |
149 | 0 | { |
150 | 0 | static char *function = "libfsntfs_object_identifier_read_data"; |
151 | |
|
152 | 0 | if( object_identifier_values == NULL ) |
153 | 0 | { |
154 | 0 | libcerror_error_set( |
155 | 0 | error, |
156 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
157 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
158 | 0 | "%s: invalid object identifier values.", |
159 | 0 | function ); |
160 | |
|
161 | 0 | return( -1 ); |
162 | 0 | } |
163 | 0 | if( data == NULL ) |
164 | 0 | { |
165 | 0 | libcerror_error_set( |
166 | 0 | error, |
167 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
168 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, |
169 | 0 | "%s: invalid data.", |
170 | 0 | function ); |
171 | |
|
172 | 0 | return( -1 ); |
173 | 0 | } |
174 | 0 | if( data_size > (size_t) SSIZE_MAX ) |
175 | 0 | { |
176 | 0 | libcerror_error_set( |
177 | 0 | error, |
178 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
179 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, |
180 | 0 | "%s: invalid data size value out of bounds.", |
181 | 0 | function ); |
182 | |
|
183 | 0 | return( -1 ); |
184 | 0 | } |
185 | | #if defined( HAVE_DEBUG_OUTPUT ) |
186 | | if( libcnotify_verbose != 0 ) |
187 | | { |
188 | | libcnotify_printf( |
189 | | "%s: object identifier data:\n", |
190 | | function ); |
191 | | libcnotify_print_data( |
192 | | data, |
193 | | data_size, |
194 | | 0 ); |
195 | | } |
196 | | #endif |
197 | 0 | if( ( data_size != 16 ) |
198 | 0 | && ( data_size != 64 ) ) |
199 | 0 | { |
200 | 0 | libcerror_error_set( |
201 | 0 | error, |
202 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
203 | 0 | LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, |
204 | 0 | "%s: unsupported object identifier data size: %" PRIzd "\n", |
205 | 0 | function, |
206 | 0 | data_size ); |
207 | |
|
208 | 0 | return( -1 ); |
209 | 0 | } |
210 | 0 | if( memory_copy( |
211 | 0 | object_identifier_values->droid_file_identifier, |
212 | 0 | ( (fsntfs_object_identifier_t *) data )->droid_file_identifier, |
213 | 0 | 16 ) == NULL ) |
214 | 0 | { |
215 | 0 | libcerror_error_set( |
216 | 0 | error, |
217 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
218 | 0 | LIBCERROR_MEMORY_ERROR_COPY_FAILED, |
219 | 0 | "%s: unable to copy droid file identifier.", |
220 | 0 | function ); |
221 | |
|
222 | 0 | return( -1 ); |
223 | 0 | } |
224 | | #if defined( HAVE_DEBUG_OUTPUT ) |
225 | | if( libcnotify_verbose != 0 ) |
226 | | { |
227 | | if( libfsntfs_debug_print_guid_value( |
228 | | function, |
229 | | "droid file identifier\t\t\t", |
230 | | object_identifier_values->droid_file_identifier, |
231 | | 16, |
232 | | LIBFGUID_ENDIAN_LITTLE, |
233 | | LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE, |
234 | | error ) != 1 ) |
235 | | { |
236 | | libcerror_error_set( |
237 | | error, |
238 | | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
239 | | LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, |
240 | | "%s: unable to print GUID value.", |
241 | | function ); |
242 | | |
243 | | return( -1 ); |
244 | | } |
245 | | } |
246 | | #endif |
247 | 0 | if( data_size > 16 ) |
248 | 0 | { |
249 | 0 | if( memory_copy( |
250 | 0 | object_identifier_values->birth_droid_volume_identifier, |
251 | 0 | ( (fsntfs_object_identifier_t *) data )->birth_droid_volume_identifier, |
252 | 0 | 16 ) == NULL ) |
253 | 0 | { |
254 | 0 | libcerror_error_set( |
255 | 0 | error, |
256 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
257 | 0 | LIBCERROR_MEMORY_ERROR_COPY_FAILED, |
258 | 0 | "%s: unable to copy birth droid volume identifier.", |
259 | 0 | function ); |
260 | |
|
261 | 0 | return( -1 ); |
262 | 0 | } |
263 | 0 | if( memory_copy( |
264 | 0 | object_identifier_values->birth_droid_file_identifier, |
265 | 0 | ( (fsntfs_object_identifier_t *) data )->birth_droid_file_identifier, |
266 | 0 | 16 ) == NULL ) |
267 | 0 | { |
268 | 0 | libcerror_error_set( |
269 | 0 | error, |
270 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
271 | 0 | LIBCERROR_MEMORY_ERROR_COPY_FAILED, |
272 | 0 | "%s: unable to copy birth droid file identifier.", |
273 | 0 | function ); |
274 | |
|
275 | 0 | return( -1 ); |
276 | 0 | } |
277 | 0 | if( memory_copy( |
278 | 0 | object_identifier_values->birth_droid_domain_identifier, |
279 | 0 | ( (fsntfs_object_identifier_t *) data )->birth_droid_domain_identifier, |
280 | 0 | 16 ) == NULL ) |
281 | 0 | { |
282 | 0 | libcerror_error_set( |
283 | 0 | error, |
284 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
285 | 0 | LIBCERROR_MEMORY_ERROR_COPY_FAILED, |
286 | 0 | "%s: unable to copy birth droid domain identifier.", |
287 | 0 | function ); |
288 | |
|
289 | 0 | return( -1 ); |
290 | 0 | } |
291 | | #if defined( HAVE_DEBUG_OUTPUT ) |
292 | | if( libcnotify_verbose != 0 ) |
293 | | { |
294 | | if( libfsntfs_debug_print_guid_value( |
295 | | function, |
296 | | "birth droid volume identifier\t\t", |
297 | | object_identifier_values->birth_droid_volume_identifier, |
298 | | 16, |
299 | | LIBFGUID_ENDIAN_LITTLE, |
300 | | LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE, |
301 | | error ) != 1 ) |
302 | | { |
303 | | libcerror_error_set( |
304 | | error, |
305 | | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
306 | | LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, |
307 | | "%s: unable to print GUID value.", |
308 | | function ); |
309 | | |
310 | | return( -1 ); |
311 | | } |
312 | | if( libfsntfs_debug_print_guid_value( |
313 | | function, |
314 | | "birth droid file identifier\t\t", |
315 | | object_identifier_values->birth_droid_file_identifier, |
316 | | 16, |
317 | | LIBFGUID_ENDIAN_LITTLE, |
318 | | LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE, |
319 | | error ) != 1 ) |
320 | | { |
321 | | libcerror_error_set( |
322 | | error, |
323 | | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
324 | | LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, |
325 | | "%s: unable to print GUID value.", |
326 | | function ); |
327 | | |
328 | | return( -1 ); |
329 | | } |
330 | | if( libfsntfs_debug_print_guid_value( |
331 | | function, |
332 | | "birth droid domain identifier\t\t", |
333 | | object_identifier_values->birth_droid_domain_identifier, |
334 | | 16, |
335 | | LIBFGUID_ENDIAN_LITTLE, |
336 | | LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE, |
337 | | error ) != 1 ) |
338 | | { |
339 | | libcerror_error_set( |
340 | | error, |
341 | | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
342 | | LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, |
343 | | "%s: unable to print GUID value.", |
344 | | function ); |
345 | | |
346 | | return( -1 ); |
347 | | } |
348 | | } |
349 | | #endif |
350 | 0 | } |
351 | | #if defined( HAVE_DEBUG_OUTPUT ) |
352 | | if( libcnotify_verbose != 0 ) |
353 | | { |
354 | | libcnotify_printf( |
355 | | "\n" ); |
356 | | } |
357 | | #endif |
358 | 0 | return( 1 ); |
359 | 0 | } |
360 | | |
361 | | /* Reads the object identifier values from an MFT attribute |
362 | | * Returns 1 if successful or -1 on error |
363 | | */ |
364 | | int libfsntfs_object_identifier_values_read_from_mft_attribute( |
365 | | libfsntfs_object_identifier_values_t *object_identifier_values, |
366 | | libfsntfs_mft_attribute_t *mft_attribute, |
367 | | libcerror_error_t **error ) |
368 | 0 | { |
369 | 0 | uint8_t *data = NULL; |
370 | 0 | static char *function = "libfsntfs_object_identifier_values_read_from_mft_attribute"; |
371 | 0 | size_t data_size = 0; |
372 | 0 | uint32_t attribute_type = 0; |
373 | 0 | int result = 0; |
374 | |
|
375 | 0 | if( object_identifier_values == NULL ) |
376 | 0 | { |
377 | 0 | libcerror_error_set( |
378 | 0 | error, |
379 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
380 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
381 | 0 | "%s: invalid object identifier values.", |
382 | 0 | function ); |
383 | |
|
384 | 0 | return( -1 ); |
385 | 0 | } |
386 | 0 | if( libfsntfs_mft_attribute_get_type( |
387 | 0 | mft_attribute, |
388 | 0 | &attribute_type, |
389 | 0 | error ) != 1 ) |
390 | 0 | { |
391 | 0 | libcerror_error_set( |
392 | 0 | error, |
393 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
394 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
395 | 0 | "%s: unable to retrieve type from attribute.", |
396 | 0 | function ); |
397 | |
|
398 | 0 | return( -1 ); |
399 | 0 | } |
400 | 0 | if( attribute_type != LIBFSNTFS_ATTRIBUTE_TYPE_OBJECT_IDENTIFIER ) |
401 | 0 | { |
402 | 0 | libcerror_error_set( |
403 | 0 | error, |
404 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
405 | 0 | LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, |
406 | 0 | "%s: unsupported attribute type.", |
407 | 0 | function ); |
408 | |
|
409 | 0 | return( -1 ); |
410 | 0 | } |
411 | 0 | result = libfsntfs_mft_attribute_data_is_resident( |
412 | 0 | mft_attribute, |
413 | 0 | error ); |
414 | |
|
415 | 0 | if( result == -1 ) |
416 | 0 | { |
417 | 0 | libcerror_error_set( |
418 | 0 | error, |
419 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
420 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
421 | 0 | "%s: unable to determine if attribute data is resident.", |
422 | 0 | function ); |
423 | |
|
424 | 0 | return( -1 ); |
425 | 0 | } |
426 | 0 | else if( result == 0 ) |
427 | 0 | { |
428 | 0 | libcerror_error_set( |
429 | 0 | error, |
430 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
431 | 0 | LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, |
432 | 0 | "%s: unsupported non-resident attribute.", |
433 | 0 | function ); |
434 | |
|
435 | 0 | return( 1 ); |
436 | 0 | } |
437 | 0 | if( libfsntfs_mft_attribute_get_resident_data( |
438 | 0 | mft_attribute, |
439 | 0 | &data, |
440 | 0 | &data_size, |
441 | 0 | error ) != 1 ) |
442 | 0 | { |
443 | 0 | libcerror_error_set( |
444 | 0 | error, |
445 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
446 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
447 | 0 | "%s: unable to retrieve resident data from attribute.", |
448 | 0 | function ); |
449 | |
|
450 | 0 | return( -1 ); |
451 | 0 | } |
452 | 0 | if( libfsntfs_object_identifier_values_read_data( |
453 | 0 | object_identifier_values, |
454 | 0 | data, |
455 | 0 | data_size, |
456 | 0 | error ) != 1 ) |
457 | 0 | { |
458 | 0 | libcerror_error_set( |
459 | 0 | error, |
460 | 0 | LIBCERROR_ERROR_DOMAIN_IO, |
461 | 0 | LIBCERROR_IO_ERROR_READ_FAILED, |
462 | 0 | "%s: unable to read object identifier values.", |
463 | 0 | function ); |
464 | |
|
465 | 0 | return( -1 ); |
466 | 0 | } |
467 | 0 | return( 1 ); |
468 | 0 | } |
469 | | |