/src/libesedb/libesedb/libesedb_file_header.c
Line | Count | Source |
1 | | /* |
2 | | * File header functions |
3 | | * |
4 | | * Copyright (C) 2009-2026, Joachim Metz <joachim.metz@gmail.com> |
5 | | * |
6 | | * Refer to AUTHORS for acknowledgements. |
7 | | * |
8 | | * This program is free software: you can redistribute it and/or modify |
9 | | * it under the terms of the GNU Lesser General Public License as published by |
10 | | * the Free Software Foundation, either version 3 of the License, or |
11 | | * (at your option) any later version. |
12 | | * |
13 | | * This program is distributed in the hope that it will be useful, |
14 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | | * GNU General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
20 | | */ |
21 | | |
22 | | #include <common.h> |
23 | | #include <byte_stream.h> |
24 | | #include <memory.h> |
25 | | #include <types.h> |
26 | | |
27 | | #include "libesedb_checksum.h" |
28 | | #include "libesedb_debug.h" |
29 | | #include "libesedb_file_header.h" |
30 | | #include "libesedb_io_handle.h" |
31 | | #include "libesedb_libcerror.h" |
32 | | #include "libesedb_libcnotify.h" |
33 | | |
34 | | #include "esedb_file_header.h" |
35 | | |
36 | | /* Creates file header |
37 | | * Make sure the value file_header is referencing, is set to NULL |
38 | | * Returns 1 if successful or -1 on error |
39 | | */ |
40 | | int libesedb_file_header_initialize( |
41 | | libesedb_file_header_t **file_header, |
42 | | libcerror_error_t **error ) |
43 | 13.4k | { |
44 | 13.4k | static char *function = "libesedb_file_header_initialize"; |
45 | | |
46 | 13.4k | if( file_header == NULL ) |
47 | 0 | { |
48 | 0 | libcerror_error_set( |
49 | 0 | error, |
50 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
51 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
52 | 0 | "%s: invalid file header.", |
53 | 0 | function ); |
54 | |
|
55 | 0 | return( -1 ); |
56 | 0 | } |
57 | 13.4k | if( *file_header != NULL ) |
58 | 0 | { |
59 | 0 | libcerror_error_set( |
60 | 0 | error, |
61 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
62 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
63 | 0 | "%s: invalid file header value already set.", |
64 | 0 | function ); |
65 | |
|
66 | 0 | return( -1 ); |
67 | 0 | } |
68 | 13.4k | *file_header = memory_allocate_structure( |
69 | 13.4k | libesedb_file_header_t ); |
70 | | |
71 | 13.4k | if( *file_header == NULL ) |
72 | 0 | { |
73 | 0 | libcerror_error_set( |
74 | 0 | error, |
75 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
76 | 0 | LIBCERROR_MEMORY_ERROR_INSUFFICIENT, |
77 | 0 | "%s: unable to create file header.", |
78 | 0 | function ); |
79 | |
|
80 | 0 | goto on_error; |
81 | 0 | } |
82 | 13.4k | if( memory_set( |
83 | 13.4k | *file_header, |
84 | 13.4k | 0, |
85 | 13.4k | sizeof( libesedb_file_header_t ) ) == NULL ) |
86 | 0 | { |
87 | 0 | libcerror_error_set( |
88 | 0 | error, |
89 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
90 | 0 | LIBCERROR_MEMORY_ERROR_SET_FAILED, |
91 | 0 | "%s: unable to clear file header.", |
92 | 0 | function ); |
93 | |
|
94 | 0 | goto on_error; |
95 | 0 | } |
96 | 13.4k | return( 1 ); |
97 | | |
98 | 0 | on_error: |
99 | 0 | if( *file_header != NULL ) |
100 | 0 | { |
101 | 0 | memory_free( |
102 | 0 | *file_header ); |
103 | |
|
104 | 0 | *file_header = NULL; |
105 | 0 | } |
106 | 0 | return( -1 ); |
107 | 13.4k | } |
108 | | |
109 | | /* Frees file header |
110 | | * Returns 1 if successful or -1 on error |
111 | | */ |
112 | | int libesedb_file_header_free( |
113 | | libesedb_file_header_t **file_header, |
114 | | libcerror_error_t **error ) |
115 | 13.4k | { |
116 | 13.4k | static char *function = "libesedb_file_header_free"; |
117 | | |
118 | 13.4k | if( file_header == NULL ) |
119 | 0 | { |
120 | 0 | libcerror_error_set( |
121 | 0 | error, |
122 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
123 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
124 | 0 | "%s: invalid file header.", |
125 | 0 | function ); |
126 | |
|
127 | 0 | return( -1 ); |
128 | 0 | } |
129 | 13.4k | if( *file_header != NULL ) |
130 | 13.4k | { |
131 | 13.4k | memory_free( |
132 | 13.4k | *file_header ); |
133 | | |
134 | 13.4k | *file_header = NULL; |
135 | 13.4k | } |
136 | 13.4k | return( 1 ); |
137 | 13.4k | } |
138 | | |
139 | | /* Reads the file header data |
140 | | * Returns 1 if successful or -1 on error |
141 | | */ |
142 | | int libesedb_file_header_read_data( |
143 | | libesedb_file_header_t *file_header, |
144 | | const uint8_t *data, |
145 | | size_t data_size, |
146 | | libcerror_error_t **error ) |
147 | 13.2k | { |
148 | 13.2k | static char *function = "libesedb_file_header_read_data"; |
149 | 13.2k | uint32_t calculated_xor32_checksum = 0; |
150 | 13.2k | uint32_t stored_xor32_checksum = 0; |
151 | | |
152 | | #if defined( HAVE_DEBUG_OUTPUT ) |
153 | | uint32_t value_32bit = 0; |
154 | | #endif |
155 | | |
156 | 13.2k | if( file_header == NULL ) |
157 | 0 | { |
158 | 0 | libcerror_error_set( |
159 | 0 | error, |
160 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
161 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
162 | 0 | "%s: invalid file header.", |
163 | 0 | function ); |
164 | |
|
165 | 0 | return( -1 ); |
166 | 0 | } |
167 | 13.2k | if( data == NULL ) |
168 | 0 | { |
169 | 0 | libcerror_error_set( |
170 | 0 | error, |
171 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
172 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
173 | 0 | "%s: invalid data.", |
174 | 0 | function ); |
175 | |
|
176 | 0 | return( -1 ); |
177 | 0 | } |
178 | 13.2k | if( data_size < sizeof( esedb_file_header_t ) ) |
179 | 0 | { |
180 | 0 | libcerror_error_set( |
181 | 0 | error, |
182 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
183 | 0 | LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL, |
184 | 0 | "%s: invalid data size value too small.", |
185 | 0 | function ); |
186 | |
|
187 | 0 | return( -1 ); |
188 | 0 | } |
189 | 13.2k | if( data_size > (size_t) SSIZE_MAX ) |
190 | 0 | { |
191 | 0 | libcerror_error_set( |
192 | 0 | error, |
193 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
194 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, |
195 | 0 | "%s: invalid data size value exceeds maximum.", |
196 | 0 | function ); |
197 | |
|
198 | 0 | return( -1 ); |
199 | 0 | } |
200 | | #if defined( HAVE_DEBUG_OUTPUT ) |
201 | | if( libcnotify_verbose != 0 ) |
202 | | { |
203 | | libcnotify_printf( |
204 | | "%s: file header:\n", |
205 | | function ); |
206 | | libcnotify_print_data( |
207 | | data, |
208 | | sizeof( esedb_file_header_t ), |
209 | | LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA ); |
210 | | } |
211 | | #endif |
212 | 13.2k | if( memory_compare( |
213 | 13.2k | ( (esedb_file_header_t *) data )->signature, |
214 | 13.2k | esedb_file_signature, |
215 | 13.2k | 4 ) != 0 ) |
216 | 334 | { |
217 | 334 | libcerror_error_set( |
218 | 334 | error, |
219 | 334 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
220 | 334 | LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, |
221 | 334 | "%s: unsupported file signature.", |
222 | 334 | function ); |
223 | | |
224 | 334 | return( -1 ); |
225 | 334 | } |
226 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
227 | 12.8k | ( (esedb_file_header_t *) data )->checksum, |
228 | 12.8k | stored_xor32_checksum ); |
229 | | |
230 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
231 | 12.8k | ( (esedb_file_header_t *) data )->format_version, |
232 | 12.8k | file_header->format_version ); |
233 | | |
234 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
235 | 12.8k | ( (esedb_file_header_t *) data )->file_type, |
236 | 12.8k | file_header->file_type ); |
237 | | |
238 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
239 | 12.8k | ( (esedb_file_header_t *) data )->database_state, |
240 | 12.8k | file_header->database_state ); |
241 | | |
242 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
243 | 12.8k | ( (esedb_file_header_t *) data )->format_revision, |
244 | 12.8k | file_header->format_revision ); |
245 | | |
246 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
247 | 12.8k | ( (esedb_file_header_t *) data )->page_size, |
248 | 12.8k | file_header->page_size ); |
249 | | |
250 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
251 | 12.8k | ( (esedb_file_header_t *) data )->creation_format_version, |
252 | 12.8k | file_header->creation_format_version ); |
253 | | |
254 | 12.8k | byte_stream_copy_to_uint32_little_endian( |
255 | 12.8k | ( (esedb_file_header_t *) data )->creation_format_revision, |
256 | 12.8k | file_header->creation_format_revision ); |
257 | | |
258 | | #if defined( HAVE_DEBUG_OUTPUT ) |
259 | | if( libcnotify_verbose != 0 ) |
260 | | { |
261 | | libcnotify_printf( |
262 | | "%s: checksum\t\t\t\t: 0x%08" PRIx32 "\n", |
263 | | function, |
264 | | stored_xor32_checksum ); |
265 | | |
266 | | byte_stream_copy_to_uint32_little_endian( |
267 | | ( (esedb_file_header_t *) data )->signature, |
268 | | value_32bit ); |
269 | | libcnotify_printf( |
270 | | "%s: signature\t\t\t\t: 0x%08" PRIx32 "\n", |
271 | | function, |
272 | | value_32bit ); |
273 | | |
274 | | libcnotify_printf( |
275 | | "%s: format version\t\t\t\t: 0x%08" PRIx32 "\n", |
276 | | function, |
277 | | file_header->format_version ); |
278 | | |
279 | | libcnotify_printf( |
280 | | "%s: file type\t\t\t\t: %" PRIu32 " (", |
281 | | function, |
282 | | file_header->file_type ); |
283 | | libesedb_debug_print_file_type( |
284 | | file_header->file_type ); |
285 | | libcnotify_printf( |
286 | | ")\n" ); |
287 | | |
288 | | libcnotify_printf( |
289 | | "%s: database time:\n", |
290 | | function ); |
291 | | libcnotify_print_data( |
292 | | ( (esedb_file_header_t *) data )->database_time, |
293 | | 8, |
294 | | 0 ); |
295 | | |
296 | | libcnotify_printf( |
297 | | "%s: database signature:\n", |
298 | | function ); |
299 | | libcnotify_print_data( |
300 | | ( (esedb_file_header_t *) data )->database_signature, |
301 | | 28, |
302 | | 0 ); |
303 | | |
304 | | libcnotify_printf( |
305 | | "%s: database state\t\t\t\t: %" PRIu32 " ", |
306 | | function, |
307 | | file_header->database_state ); |
308 | | libesedb_debug_print_database_state( |
309 | | file_header->database_state ); |
310 | | libcnotify_printf( |
311 | | "\n" ); |
312 | | |
313 | | libcnotify_printf( |
314 | | "%s: consistent position:\n", |
315 | | function ); |
316 | | libcnotify_print_data( |
317 | | ( (esedb_file_header_t *) data )->consistent_postition, |
318 | | 8, |
319 | | 0 ); |
320 | | libesedb_debug_print_log_time( |
321 | | ( (esedb_file_header_t *) data )->consistent_time, |
322 | | 8, |
323 | | "consistent time", |
324 | | "\t\t\t\t", |
325 | | NULL ); |
326 | | |
327 | | libesedb_debug_print_log_time( |
328 | | ( (esedb_file_header_t *) data )->attach_time, |
329 | | 8, |
330 | | "attach time", |
331 | | "\t\t\t\t", |
332 | | NULL ); |
333 | | libcnotify_printf( |
334 | | "%s: attach position:\n", |
335 | | function ); |
336 | | libcnotify_print_data( |
337 | | ( (esedb_file_header_t *) data )->attach_postition, |
338 | | 8, |
339 | | 0 ); |
340 | | |
341 | | libesedb_debug_print_log_time( |
342 | | ( (esedb_file_header_t *) data )->detach_time, |
343 | | 8, |
344 | | "detach time", |
345 | | "\t\t\t\t", |
346 | | NULL ); |
347 | | libcnotify_printf( |
348 | | "%s: detach position:\n", |
349 | | function ); |
350 | | libcnotify_print_data( |
351 | | ( (esedb_file_header_t *) data )->detach_postition, |
352 | | 8, |
353 | | 0 ); |
354 | | |
355 | | byte_stream_copy_to_uint32_little_endian( |
356 | | ( (esedb_file_header_t *) data )->unknown1, |
357 | | value_32bit ); |
358 | | libcnotify_printf( |
359 | | "%s: unknown1\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n", |
360 | | function, |
361 | | value_32bit, |
362 | | value_32bit ); |
363 | | |
364 | | libcnotify_printf( |
365 | | "%s: log signature:\n", |
366 | | function ); |
367 | | libcnotify_print_data( |
368 | | ( (esedb_file_header_t *) data )->log_signature, |
369 | | 28, |
370 | | 0 ); |
371 | | |
372 | | libcnotify_printf( |
373 | | "%s: previous full backup:\n", |
374 | | function ); |
375 | | libcnotify_print_data( |
376 | | ( (esedb_file_header_t *) data )->previous_full_backup, |
377 | | 24, |
378 | | 0 ); |
379 | | libcnotify_printf( |
380 | | "%s: previous incremental backup:\n", |
381 | | function ); |
382 | | libcnotify_print_data( |
383 | | ( (esedb_file_header_t *) data )->previous_incremental_backup, |
384 | | 24, |
385 | | 0 ); |
386 | | libcnotify_printf( |
387 | | "%s: current full backup:\n", |
388 | | function ); |
389 | | libcnotify_print_data( |
390 | | ( (esedb_file_header_t *) data )->current_full_backup, |
391 | | 24, |
392 | | 0 ); |
393 | | |
394 | | byte_stream_copy_to_uint32_little_endian( |
395 | | ( (esedb_file_header_t *) data )->shadowing_disabled, |
396 | | value_32bit ); |
397 | | libcnotify_printf( |
398 | | "%s: shadowing disabled\t\t\t: %" PRIu32 "\n", |
399 | | function, |
400 | | value_32bit ); |
401 | | |
402 | | byte_stream_copy_to_uint32_little_endian( |
403 | | ( (esedb_file_header_t *) data )->last_object_identifier, |
404 | | value_32bit ); |
405 | | libcnotify_printf( |
406 | | "%s: last object identifier\t\t\t: %" PRIu32 "\n", |
407 | | function, |
408 | | value_32bit ); |
409 | | |
410 | | byte_stream_copy_to_uint32_little_endian( |
411 | | ( (esedb_file_header_t *) data )->index_update_major_version, |
412 | | value_32bit ); |
413 | | libcnotify_printf( |
414 | | "%s: index update major version\t\t: %" PRIu32 "\n", |
415 | | function, |
416 | | value_32bit ); |
417 | | byte_stream_copy_to_uint32_little_endian( |
418 | | ( (esedb_file_header_t *) data )->index_update_minor_version, |
419 | | value_32bit ); |
420 | | libcnotify_printf( |
421 | | "%s: index update minor version\t\t: %" PRIu32 "\n", |
422 | | function, |
423 | | value_32bit ); |
424 | | byte_stream_copy_to_uint32_little_endian( |
425 | | ( (esedb_file_header_t *) data )->index_update_build_number, |
426 | | value_32bit ); |
427 | | libcnotify_printf( |
428 | | "%s: index update build number\t\t: %" PRIu32 "\n", |
429 | | function, |
430 | | value_32bit ); |
431 | | byte_stream_copy_to_uint32_little_endian( |
432 | | ( (esedb_file_header_t *) data )->index_update_service_pack_number, |
433 | | value_32bit ); |
434 | | libcnotify_printf( |
435 | | "%s: index update service pack number\t: %" PRIu32 "\n", |
436 | | function, |
437 | | value_32bit ); |
438 | | |
439 | | libcnotify_printf( |
440 | | "%s: format revision\t\t\t\t: %" PRIu32 " (0x%08" PRIx32 ")\n", |
441 | | function, |
442 | | file_header->format_revision, |
443 | | file_header->format_revision ); |
444 | | libcnotify_printf( |
445 | | "%s: page size\t\t\t\t: %" PRIu32 "\n", |
446 | | function, |
447 | | file_header->page_size ); |
448 | | |
449 | | byte_stream_copy_to_uint32_little_endian( |
450 | | ( (esedb_file_header_t *) data )->repair_count, |
451 | | value_32bit ); |
452 | | libcnotify_printf( |
453 | | "%s: repair count\t\t\t\t: %" PRIu32 "\n", |
454 | | function, |
455 | | value_32bit ); |
456 | | libesedb_debug_print_log_time( |
457 | | ( (esedb_file_header_t *) data )->repair_time, |
458 | | 8, |
459 | | "repair time", |
460 | | "\t\t\t\t", |
461 | | NULL ); |
462 | | |
463 | | libcnotify_printf( |
464 | | "%s: unknown2:\n", |
465 | | function ); |
466 | | libcnotify_print_data( |
467 | | ( (esedb_file_header_t *) data )->unknown2, |
468 | | 28, |
469 | | 0 ); |
470 | | |
471 | | libcnotify_printf( |
472 | | "%s: scrub database time:\n", |
473 | | function ); |
474 | | libcnotify_print_data( |
475 | | ( (esedb_file_header_t *) data )->scrub_database_time, |
476 | | 8, |
477 | | 0 ); |
478 | | libesedb_debug_print_log_time( |
479 | | ( (esedb_file_header_t *) data )->scrub_time, |
480 | | 8, |
481 | | "scrub time", |
482 | | "\t\t\t\t", |
483 | | NULL ); |
484 | | |
485 | | libcnotify_printf( |
486 | | "%s: required log:\n", |
487 | | function ); |
488 | | libcnotify_print_data( |
489 | | ( (esedb_file_header_t *) data )->required_log, |
490 | | 8, |
491 | | 0 ); |
492 | | |
493 | | byte_stream_copy_to_uint32_little_endian( |
494 | | ( (esedb_file_header_t *) data )->upgrade_exchange5_format, |
495 | | value_32bit ); |
496 | | libcnotify_printf( |
497 | | "%s: upgrade Exchange 5.5 format\t\t: %" PRIu32 "\n", |
498 | | function, |
499 | | value_32bit ); |
500 | | byte_stream_copy_to_uint32_little_endian( |
501 | | ( (esedb_file_header_t *) data )->upgrade_free_pages, |
502 | | value_32bit ); |
503 | | libcnotify_printf( |
504 | | "%s: upgrade free pages\t\t\t: %" PRIu32 "\n", |
505 | | function, |
506 | | value_32bit ); |
507 | | byte_stream_copy_to_uint32_little_endian( |
508 | | ( (esedb_file_header_t *) data )->upgrade_space_map_pages, |
509 | | value_32bit ); |
510 | | libcnotify_printf( |
511 | | "%s: upgrade space map pages\t\t\t: %" PRIu32 "\n", |
512 | | function, |
513 | | value_32bit ); |
514 | | |
515 | | libcnotify_printf( |
516 | | "%s: current shadow volume backup:\n", |
517 | | function ); |
518 | | libcnotify_print_data( |
519 | | ( (esedb_file_header_t *) data )->current_shadow_volume_backup, |
520 | | 24, |
521 | | 0 ); |
522 | | |
523 | | libcnotify_printf( |
524 | | "%s: creation format version\t\t\t: 0x%08" PRIx32 "\n", |
525 | | function, |
526 | | file_header->creation_format_version ); |
527 | | libcnotify_printf( |
528 | | "%s: creation format revision\t\t: %" PRIu32 " (0x%08" PRIx32 ")\n", |
529 | | function, |
530 | | file_header->creation_format_revision, |
531 | | file_header->creation_format_revision ); |
532 | | |
533 | | libcnotify_printf( |
534 | | "%s: unknown3:\n", |
535 | | function ); |
536 | | libcnotify_print_data( |
537 | | ( (esedb_file_header_t *) data )->unknown3, |
538 | | 16, |
539 | | 0 ); |
540 | | |
541 | | byte_stream_copy_to_uint32_little_endian( |
542 | | ( (esedb_file_header_t *) data )->old_repair_count, |
543 | | value_32bit ); |
544 | | libcnotify_printf( |
545 | | "%s: old repair count\t\t\t: %" PRIu32 "\n", |
546 | | function, |
547 | | value_32bit ); |
548 | | |
549 | | byte_stream_copy_to_uint32_little_endian( |
550 | | ( (esedb_file_header_t *) data )->ecc_fix_success_count, |
551 | | value_32bit ); |
552 | | libcnotify_printf( |
553 | | "%s: ECC fix success count\t\t\t: %" PRIu32 "\n", |
554 | | function, |
555 | | value_32bit ); |
556 | | libesedb_debug_print_log_time( |
557 | | ( (esedb_file_header_t *) data )->ecc_fix_success_time, |
558 | | 8, |
559 | | "ECC fix success time", |
560 | | "\t\t\t", |
561 | | NULL ); |
562 | | byte_stream_copy_to_uint32_little_endian( |
563 | | ( (esedb_file_header_t *) data )->old_ecc_fix_success_count, |
564 | | value_32bit ); |
565 | | libcnotify_printf( |
566 | | "%s: old ECC fix success count\t\t: %" PRIu32 "\n", |
567 | | function, |
568 | | value_32bit ); |
569 | | |
570 | | byte_stream_copy_to_uint32_little_endian( |
571 | | ( (esedb_file_header_t *) data )->ecc_fix_error_count, |
572 | | value_32bit ); |
573 | | libcnotify_printf( |
574 | | "%s: ECC fix error count\t\t\t: %" PRIu32 "\n", |
575 | | function, |
576 | | value_32bit ); |
577 | | libesedb_debug_print_log_time( |
578 | | ( (esedb_file_header_t *) data )->ecc_fix_error_time, |
579 | | 8, |
580 | | "ECC fix error time", |
581 | | "\t\t\t", |
582 | | NULL ); |
583 | | byte_stream_copy_to_uint32_little_endian( |
584 | | ( (esedb_file_header_t *) data )->old_ecc_fix_error_count, |
585 | | value_32bit ); |
586 | | libcnotify_printf( |
587 | | "%s: old ECC fix error count\t\t\t: %" PRIu32 "\n", |
588 | | function, |
589 | | value_32bit ); |
590 | | |
591 | | byte_stream_copy_to_uint32_little_endian( |
592 | | ( (esedb_file_header_t *) data )->bad_checksum_error_count, |
593 | | value_32bit ); |
594 | | libcnotify_printf( |
595 | | "%s: bad checksum error count\t\t: %" PRIu32 "\n", |
596 | | function, |
597 | | value_32bit ); |
598 | | libesedb_debug_print_log_time( |
599 | | ( (esedb_file_header_t *) data )->bad_checksum_error_time, |
600 | | 8, |
601 | | "bad checksum error time", |
602 | | "\t\t\t", |
603 | | NULL ); |
604 | | byte_stream_copy_to_uint32_little_endian( |
605 | | ( (esedb_file_header_t *) data )->old_bad_checksum_error_count, |
606 | | value_32bit ); |
607 | | libcnotify_printf( |
608 | | "%s: old bad checksum error count\t\t: %" PRIu32 "\n", |
609 | | function, |
610 | | value_32bit ); |
611 | | |
612 | | libcnotify_printf( |
613 | | "%s: committed log:\n", |
614 | | function ); |
615 | | libcnotify_print_data( |
616 | | ( (esedb_file_header_t *) data )->committed_log, |
617 | | 4, |
618 | | 0 ); |
619 | | |
620 | | libcnotify_printf( |
621 | | "%s: previous shadow volume backup:\n", |
622 | | function ); |
623 | | libcnotify_print_data( |
624 | | ( (esedb_file_header_t *) data )->previous_shadow_volume_backup, |
625 | | 24, |
626 | | 0 ); |
627 | | libcnotify_printf( |
628 | | "%s: previous differential backup:\n", |
629 | | function ); |
630 | | libcnotify_print_data( |
631 | | ( (esedb_file_header_t *) data )->previous_differential_backup, |
632 | | 24, |
633 | | 0 ); |
634 | | |
635 | | libcnotify_printf( |
636 | | "%s: unknown4:\n", |
637 | | function ); |
638 | | libcnotify_print_data( |
639 | | ( (esedb_file_header_t *) data )->unknown4, |
640 | | 40, |
641 | | 0 ); |
642 | | |
643 | | byte_stream_copy_to_uint32_little_endian( |
644 | | ( (esedb_file_header_t *) data )->nls_major_version, |
645 | | value_32bit ); |
646 | | libcnotify_printf( |
647 | | "%s: NLS major version\t\t\t: 0x%08" PRIx32 "\n", |
648 | | function, |
649 | | value_32bit ); |
650 | | byte_stream_copy_to_uint32_little_endian( |
651 | | ( (esedb_file_header_t *) data )->nls_minor_version, |
652 | | value_32bit ); |
653 | | libcnotify_printf( |
654 | | "%s: NLS minor version\t\t\t: 0x%08" PRIx32 "\n", |
655 | | function, |
656 | | value_32bit ); |
657 | | |
658 | | libcnotify_printf( |
659 | | "%s: unknown5:\n", |
660 | | function ); |
661 | | libcnotify_print_data( |
662 | | ( (esedb_file_header_t *) data )->unknown5, |
663 | | 148, |
664 | | LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA ); |
665 | | |
666 | | byte_stream_copy_to_uint32_little_endian( |
667 | | ( (esedb_file_header_t *) data )->unknown_flags, |
668 | | value_32bit ); |
669 | | libcnotify_printf( |
670 | | "%s: unknown flags\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n", |
671 | | function, |
672 | | value_32bit, |
673 | | value_32bit ); |
674 | | |
675 | | libcnotify_printf( |
676 | | "\n" ); |
677 | | } |
678 | | #endif /* defined( HAVE_DEBUG_OUTPUT ) */ |
679 | | |
680 | 12.8k | if( libesedb_checksum_calculate_little_endian_xor32( |
681 | 12.8k | &calculated_xor32_checksum, |
682 | 12.8k | &( data[ 4 ] ), |
683 | 12.8k | data_size - 4, |
684 | 12.8k | 0x89abcdef, |
685 | 12.8k | error ) != 1 ) |
686 | 0 | { |
687 | 0 | libcerror_error_set( |
688 | 0 | error, |
689 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
690 | 0 | LIBCERROR_RUNTIME_ERROR_GENERIC, |
691 | 0 | "%s: unable to calculate XOR-32 checksum.", |
692 | 0 | function ); |
693 | |
|
694 | 0 | return( -1 ); |
695 | 0 | } |
696 | | |
697 | | #if defined( HAVE_DEBUG_OUTPUT ) |
698 | | if( libcnotify_verbose != 0 ) |
699 | | { |
700 | | libcnotify_printf( |
701 | | "%s: calculated checksum\t\t\t: 0x%08" PRIx32 "\n", |
702 | | function, |
703 | | calculated_xor32_checksum ); |
704 | | |
705 | | libcnotify_printf( |
706 | | "\n" ); |
707 | | } |
708 | | #endif |
709 | 12.8k | if( ( file_header->database_state != 2 ) |
710 | 415 | && ( stored_xor32_checksum != calculated_xor32_checksum ) ) |
711 | 323 | { |
712 | 323 | libcerror_error_set( |
713 | 323 | error, |
714 | 323 | LIBCERROR_ERROR_DOMAIN_INPUT, |
715 | 323 | LIBCERROR_INPUT_ERROR_CHECKSUM_MISMATCH, |
716 | 323 | "%s: mismatch in file header checksum ( 0x%08" PRIx32 " != 0x%08" PRIx32 " ).", |
717 | 323 | function, |
718 | 323 | stored_xor32_checksum, |
719 | 323 | calculated_xor32_checksum ); |
720 | | |
721 | 323 | return( -1 ); |
722 | 323 | } |
723 | | /* TODO add more values to internal structures */ |
724 | | |
725 | 12.5k | return( 1 ); |
726 | 12.8k | } |
727 | | |
728 | | /* Reads the file header |
729 | | * Returns 1 if successful or -1 on error |
730 | | */ |
731 | | int libesedb_file_header_read_file_io_handle( |
732 | | libesedb_file_header_t *file_header, |
733 | | libbfio_handle_t *file_io_handle, |
734 | | off64_t file_offset, |
735 | | libcerror_error_t **error ) |
736 | 15.2k | { |
737 | 15.2k | uint8_t file_header_data[ sizeof( esedb_file_header_t ) ]; |
738 | | |
739 | 15.2k | static char *function = "libesedb_file_header_read_file_io_handle"; |
740 | 15.2k | ssize_t read_count = 0; |
741 | | |
742 | 15.2k | if( file_header == NULL ) |
743 | 0 | { |
744 | 0 | libcerror_error_set( |
745 | 0 | error, |
746 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
747 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
748 | 0 | "%s: invalid file header.", |
749 | 0 | function ); |
750 | |
|
751 | 0 | return( -1 ); |
752 | 0 | } |
753 | | #if defined( HAVE_DEBUG_OUTPUT ) |
754 | | if( libcnotify_verbose != 0 ) |
755 | | { |
756 | | libcnotify_printf( |
757 | | "%s: reading file header at offset: %" PRIi64 " (0x%08" PRIx64 ")\n", |
758 | | function, |
759 | | file_offset, |
760 | | file_offset ); |
761 | | } |
762 | | #endif |
763 | 15.2k | read_count = libbfio_handle_read_buffer_at_offset( |
764 | 15.2k | file_io_handle, |
765 | 15.2k | file_header_data, |
766 | 15.2k | sizeof( esedb_file_header_t ), |
767 | 15.2k | file_offset, |
768 | 15.2k | error ); |
769 | | |
770 | 15.2k | if( read_count != (ssize_t) sizeof( esedb_file_header_t ) ) |
771 | 2.06k | { |
772 | 2.06k | libcerror_error_set( |
773 | 2.06k | error, |
774 | 2.06k | LIBCERROR_ERROR_DOMAIN_IO, |
775 | 2.06k | LIBCERROR_IO_ERROR_READ_FAILED, |
776 | 2.06k | "%s: unable to read file header data at offset: %" PRIi64 " (0x%08" PRIx64 ").", |
777 | 2.06k | function, |
778 | 2.06k | file_offset, |
779 | 2.06k | file_offset ); |
780 | | |
781 | 2.06k | return( -1 ); |
782 | 2.06k | } |
783 | 13.2k | if( libesedb_file_header_read_data( |
784 | 13.2k | file_header, |
785 | 13.2k | file_header_data, |
786 | 13.2k | sizeof( esedb_file_header_t ), |
787 | 13.2k | error ) != 1 ) |
788 | 657 | { |
789 | 657 | libcerror_error_set( |
790 | 657 | error, |
791 | 657 | LIBCERROR_ERROR_DOMAIN_IO, |
792 | 657 | LIBCERROR_IO_ERROR_READ_FAILED, |
793 | 657 | "%s: unable to read file header.", |
794 | 657 | function ); |
795 | | |
796 | 657 | return( -1 ); |
797 | 657 | } |
798 | 12.5k | return( 1 ); |
799 | 13.2k | } |
800 | | |