/src/sleuthkit/tsk/fs/iso9660.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | ** The Sleuth Kit |
3 | | ** |
4 | | ** This software is subject to the IBM Public License ver. 1.0, |
5 | | ** which was displayed prior to download and is included in the readme.txt |
6 | | ** file accompanying the Sleuth Kit files. It may also be requested from: |
7 | | ** Crucial Security Inc. |
8 | | ** 14900 Conference Center Drive |
9 | | ** Chantilly, VA 20151 |
10 | | ** |
11 | | ** Wyatt Banks [wbanks@crucialsecurity.com] |
12 | | ** Copyright (c) 2005 Crucial Security Inc. All rights reserved. |
13 | | ** |
14 | | ** Brian Carrier [carrier <at> sleuthkit [dot] org] |
15 | | ** Copyright (c) 2003-2005 Brian Carrier. All rights reserved |
16 | | ** Copyright (c) 2007-2011 Brian Carrier. All rights reserved |
17 | | ** |
18 | | ** Copyright (c) 1997,1998,1999, International Business Machines |
19 | | ** Corporation and others. All Rights Reserved. |
20 | | */ |
21 | | /* TCT |
22 | | * LICENSE |
23 | | * This software is distributed under the IBM Public License. |
24 | | * AUTHOR(S) |
25 | | * Wietse Venema |
26 | | * IBM T.J. Watson Research |
27 | | * P.O. Box 704 |
28 | | * Yorktown Heights, NY 10598, USA |
29 | | --*/ |
30 | | /* |
31 | | ** You may distribute the Sleuth Kit, or other software that incorporates |
32 | | ** part of all of the Sleuth Kit, in object code form under a license agreement, |
33 | | ** provided that: |
34 | | ** a) you comply with the terms and conditions of the IBM Public License |
35 | | ** ver 1.0; and |
36 | | ** b) the license agreement |
37 | | ** i) effectively disclaims on behalf of all Contributors all warranties |
38 | | ** and conditions, express and implied, including warranties or |
39 | | ** conditions of title and non-infringement, and implied warranties |
40 | | ** or conditions of merchantability and fitness for a particular |
41 | | ** purpose. |
42 | | ** ii) effectively excludes on behalf of all Contributors liability for |
43 | | ** damages, including direct, indirect, special, incidental and |
44 | | ** consequential damages such as lost profits. |
45 | | ** iii) states that any provisions which differ from IBM Public License |
46 | | ** ver. 1.0 are offered by that Contributor alone and not by any |
47 | | ** other party; and |
48 | | ** iv) states that the source code for the program is available from you, |
49 | | ** and informs licensees how to obtain it in a reasonable manner on or |
50 | | ** through a medium customarily used for software exchange. |
51 | | ** |
52 | | ** When the Sleuth Kit or other software that incorporates part or all of |
53 | | ** the Sleuth Kit is made available in source code form: |
54 | | ** a) it must be made available under IBM Public License ver. 1.0; and |
55 | | ** b) a copy of the IBM Public License ver. 1.0 must be included with |
56 | | ** each copy of the program. |
57 | | */ |
58 | | |
59 | | /** |
60 | | * \file iso9660.c |
61 | | * Contains the internal TSK ISO9660 file system code to handle basic file |
62 | | * system processing for opening file system, processing sectors, and directory entries. |
63 | | */ |
64 | | |
65 | | #include "tsk_fs_i.h" |
66 | | #include "tsk_iso9660.h" |
67 | | #include <ctype.h> |
68 | | |
69 | | |
70 | | /* free all memory used by inode linked list */ |
71 | | static void |
72 | | iso9660_inode_list_free(TSK_FS_INFO * fs) |
73 | 0 | { |
74 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
75 | |
|
76 | 0 | while (iso->in_list) { |
77 | 0 | iso9660_inode_node *tmp = iso->in_list; |
78 | 0 | iso->in_list = iso->in_list->next; |
79 | 0 | free(tmp); |
80 | 0 | } |
81 | 0 | iso->in_list = NULL; |
82 | 0 | } |
83 | | |
84 | | |
85 | | /** |
86 | | * Process the System Use Sharing Protocol (SUSP) data. Typically, |
87 | | * rockridge data are stored in this. |
88 | | * |
89 | | * @param fs File system to process |
90 | | * @param buf Buffer of data to process |
91 | | * @param count Length of buffer in bytes. |
92 | | * @param hFile File handle to print details to (or NULL for no printing) |
93 | | * @param recursion_depth Recursion depth to limit the number of self-calls |
94 | | * @returns NULL on error |
95 | | */ |
96 | | static rockridge_ext * |
97 | | parse_susp(TSK_FS_INFO * fs, char *buf, int count, FILE * hFile, int recursion_depth) |
98 | 0 | { |
99 | 0 | rockridge_ext *rr; |
100 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
101 | |
|
102 | 0 | char *end = buf + count - 1; |
103 | |
|
104 | 0 | if (tsk_verbose) |
105 | 0 | tsk_fprintf(stderr, "parse_susp: count is: %d\n", count); |
106 | | |
107 | | // 32 is an arbitrary chosen value. |
108 | 0 | if (recursion_depth > 32) { |
109 | 0 | return NULL; |
110 | 0 | } |
111 | | |
112 | | // allocate the output data structure |
113 | 0 | rr = (rockridge_ext *) tsk_malloc(sizeof(rockridge_ext)); |
114 | 0 | if (rr == NULL) { |
115 | 0 | return NULL; |
116 | 0 | } |
117 | | |
118 | 0 | while ((uintptr_t)buf + sizeof(iso9660_susp_head) <= (uintptr_t)end) { |
119 | 0 | iso9660_susp_head *head = (iso9660_susp_head *) buf; |
120 | |
|
121 | 0 | if (buf + head->len - 1 > end) |
122 | 0 | break; |
123 | | |
124 | | /* Identify the entry type -- listed in the order |
125 | | * that they are listed in the specs */ |
126 | | |
127 | | // SUSP Continuation Entry |
128 | 0 | if ((head->sig[0] == 'C') && (head->sig[1] == 'E')) { |
129 | 0 | iso9660_susp_ce *ce = (iso9660_susp_ce *) buf; |
130 | |
|
131 | 0 | if ((uintptr_t)buf + sizeof(iso9660_susp_ce) - 1 > (uintptr_t)end) { |
132 | 0 | if (tsk_verbose) |
133 | 0 | tsk_fprintf(stderr, "parse_susp: not enough room for CE structure\n"); |
134 | 0 | break; |
135 | 0 | } |
136 | | |
137 | 0 | if (hFile) { |
138 | 0 | fprintf(hFile, "CE Entry\n"); |
139 | 0 | fprintf(hFile, "* Block: %" PRIu32 "\n", |
140 | 0 | tsk_getu32(fs->endian, ce->blk_m)); |
141 | 0 | fprintf(hFile, "* Offset: %" PRIu32 "\n", |
142 | 0 | tsk_getu32(fs->endian, ce->offset_m)); |
143 | 0 | fprintf(hFile, "* Len: %" PRIu32 "\n", |
144 | 0 | tsk_getu32(fs->endian, ce->celen_m)); |
145 | 0 | } |
146 | | |
147 | | // read the continued buffer and parse it |
148 | 0 | if ((tsk_getu32(fs->endian, ce->blk_m) < fs->last_block) && |
149 | 0 | (tsk_getu32(fs->endian, ce->offset_m) < fs->block_size)) { |
150 | 0 | TSK_OFF_T off; |
151 | 0 | char *buf2; |
152 | |
|
153 | 0 | off = |
154 | 0 | tsk_getu32(fs->endian, |
155 | 0 | ce->blk_m) * fs->block_size + tsk_getu32(fs->endian, |
156 | 0 | ce->offset_m); |
157 | 0 | buf2 = |
158 | 0 | (char *) tsk_malloc(tsk_getu32(fs->endian, |
159 | 0 | ce->celen_m)); |
160 | |
|
161 | 0 | if (buf2 != NULL) { |
162 | 0 | ssize_t cnt = |
163 | 0 | tsk_fs_read(fs, off, buf2, |
164 | 0 | tsk_getu32(fs->endian, ce->celen_m)); |
165 | |
|
166 | 0 | if (cnt == tsk_getu32(fs->endian, ce->celen_m)) { |
167 | 0 | rockridge_ext *rr_sub_entry = parse_susp(fs, buf2, (int) cnt, hFile, recursion_depth + 1); |
168 | | |
169 | | // Prevent an infinite loop |
170 | 0 | if (rr_sub_entry == NULL) { |
171 | 0 | free(buf2); |
172 | 0 | free(rr); |
173 | 0 | return NULL; |
174 | 0 | } |
175 | 0 | free(rr_sub_entry); |
176 | 0 | } |
177 | 0 | else if (tsk_verbose) { |
178 | 0 | fprintf(stderr, |
179 | 0 | "parse_susp: error reading CE entry\n"); |
180 | 0 | tsk_error_print(stderr); |
181 | 0 | tsk_error_reset(); |
182 | 0 | } |
183 | 0 | free(buf2); |
184 | 0 | } |
185 | 0 | else { |
186 | 0 | if (tsk_verbose) |
187 | 0 | fprintf(stderr, |
188 | 0 | "parse_susp: error allocating memory to process CE entry\n"); |
189 | 0 | tsk_error_reset(); |
190 | 0 | } |
191 | 0 | } |
192 | 0 | else { |
193 | 0 | if (tsk_verbose) |
194 | 0 | fprintf(stderr, |
195 | 0 | "parse_susp: CE offset or block too large to process\n"); |
196 | 0 | } |
197 | | |
198 | 0 | buf += head->len; |
199 | 0 | } |
200 | | // SUSP Padding Entry |
201 | 0 | else if ((head->sig[0] == 'P') && (head->sig[1] == 'D')) { |
202 | 0 | if (hFile) { |
203 | 0 | fprintf(hFile, "PD Entry\n"); |
204 | 0 | } |
205 | 0 | buf += head->len; |
206 | 0 | } |
207 | | // SUSP Sharing Protocol Entry -- we ignore |
208 | 0 | else if ((head->sig[0] == 'S') && (head->sig[1] == 'P')) { |
209 | 0 | iso9660_susp_sp *sp = (iso9660_susp_sp *) buf; |
210 | 0 | if (hFile) { |
211 | 0 | fprintf(hFile, "SP Entry\n"); |
212 | 0 | fprintf(hFile, "* SKip Len: %d\n", sp->skip); |
213 | 0 | } |
214 | 0 | buf += head->len; |
215 | 0 | } |
216 | | // SUSP System Terminator |
217 | 0 | else if ((head->sig[0] == 'S') && (head->sig[1] == 'T')) { |
218 | 0 | if (hFile) { |
219 | 0 | fprintf(hFile, "ST Entry\n"); |
220 | 0 | } |
221 | 0 | buf += head->len; |
222 | 0 | } |
223 | | // SUSP Extension Registration -- not used |
224 | 0 | else if ((head->sig[0] == 'E') && (head->sig[1] == 'R')) { |
225 | 0 | iso9660_susp_er *er = (iso9660_susp_er *) buf; |
226 | 0 | if (hFile) { |
227 | 0 | char buf[258]; |
228 | 0 | fprintf(hFile, "ER Entry\n"); |
229 | |
|
230 | 0 | memcpy(buf, er->ext_id, er->len_id); |
231 | 0 | buf[er->len_id] = '\0'; |
232 | 0 | fprintf(hFile, "* Extension ID: %s\n", buf); |
233 | |
|
234 | 0 | memcpy(buf, er->ext_id + er->len_id, er->len_des); |
235 | 0 | buf[er->len_des] = '\0'; |
236 | 0 | fprintf(hFile, "* Extension Descriptor: %s\n", buf); |
237 | |
|
238 | 0 | memcpy(buf, er->ext_id + er->len_id + er->len_des, |
239 | 0 | er->len_src); |
240 | 0 | buf[er->len_src] = '\0'; |
241 | 0 | fprintf(hFile, "* Extension Spec Source: %s\n", buf); |
242 | 0 | } |
243 | 0 | buf += head->len; |
244 | 0 | } |
245 | | // SUSP Extension Sigs -- not used |
246 | 0 | else if ((head->sig[0] == 'E') && (head->sig[1] == 'S')) { |
247 | 0 | if (hFile) { |
248 | 0 | fprintf(hFile, "ES Entry\n"); |
249 | 0 | } |
250 | 0 | buf += head->len; |
251 | 0 | } |
252 | | |
253 | | /* |
254 | | * Rock Ridge Extensions |
255 | | */ |
256 | | |
257 | | /* POSIX file attributes */ |
258 | 0 | else if ((head->sig[0] == 'P') && (head->sig[1] == 'X')) { |
259 | 0 | iso9660_rr_px_entry *rr_px; |
260 | |
|
261 | 0 | if ((uintptr_t)buf + sizeof(iso9660_rr_px_entry) - 1> (uintptr_t)end) { |
262 | 0 | if (tsk_verbose) |
263 | 0 | tsk_fprintf(stderr, "parse_susp: not enough room for POSIX structure\n"); |
264 | 0 | break; |
265 | 0 | } |
266 | | |
267 | 0 | rr_px = (iso9660_rr_px_entry *) buf; |
268 | 0 | rr->uid = tsk_getu32(fs->endian, rr_px->uid_m); |
269 | 0 | rr->gid = tsk_getu32(fs->endian, rr_px->gid_m); |
270 | 0 | rr->mode = tsk_getu16(fs->endian, rr_px->mode_m); |
271 | 0 | rr->nlink = tsk_getu32(fs->endian, rr_px->links_m); |
272 | 0 | if (hFile) { |
273 | 0 | fprintf(hFile, "PX Entry\n"); |
274 | 0 | fprintf(hFile, "* UID: %" PRIuUID "\n", rr->uid); |
275 | 0 | fprintf(hFile, "* GID: %" PRIuGID "\n", rr->gid); |
276 | 0 | fprintf(hFile, "* Mode: %d\n", rr->mode); |
277 | 0 | fprintf(hFile, "* Links: %" PRIu32 "\n", rr->nlink); |
278 | 0 | } |
279 | 0 | buf += head->len; |
280 | 0 | } |
281 | | |
282 | | // RR - device information |
283 | 0 | else if ((head->sig[0] == 'P') && (head->sig[1] == 'N')) { |
284 | 0 | iso9660_rr_pn_entry *rr_pn = (iso9660_rr_pn_entry *) buf; |
285 | 0 | if (hFile) { |
286 | 0 | fprintf(hFile, "PN Entry\n"); |
287 | 0 | fprintf(hFile, "* Device ID High: %" PRIu32 "\n", |
288 | 0 | tsk_getu32(fs->endian, rr_pn->dev_h_m)); |
289 | 0 | fprintf(hFile, "* Device ID Low: %" PRIu32 "\n", |
290 | 0 | tsk_getu32(fs->endian, rr_pn->dev_l_m)); |
291 | 0 | } |
292 | 0 | buf += head->len; |
293 | 0 | } |
294 | | |
295 | | // RR - symbolic link |
296 | 0 | else if ((head->sig[0] == 'S') && (head->sig[1] == 'L')) { |
297 | | //iso9660_rr_sl_entry *rr_sl = (iso9660_rr_sl_entry *) buf; |
298 | 0 | if (hFile) { |
299 | 0 | fprintf(hFile, "SL Entry\n"); |
300 | 0 | } |
301 | 0 | buf += head->len; |
302 | 0 | } |
303 | | // RR -- alternative name |
304 | 0 | else if ((head->sig[0] == 'N') && (head->sig[1] == 'M')) { |
305 | 0 | iso9660_rr_nm_entry *rr_nm; |
306 | 0 | int len; |
307 | |
|
308 | 0 | if ((uintptr_t)buf + sizeof(iso9660_rr_nm_entry) - 1> (uintptr_t)end) { |
309 | 0 | if (tsk_verbose) |
310 | 0 | tsk_fprintf(stderr, "parse_susp: not enough room for RR alternative name structure\n"); |
311 | 0 | break; |
312 | 0 | } |
313 | | |
314 | 0 | rr_nm = (iso9660_rr_nm_entry *) buf; |
315 | |
|
316 | 0 | if ((rr_nm->len < 6) || ((uintptr_t)&rr_nm->name[0] + (int) rr_nm->len - 5 - 1> (uintptr_t)end)) { |
317 | 0 | if (tsk_verbose) |
318 | 0 | tsk_fprintf(stderr, "parse_susp: not enough room for RR alternative name\n"); |
319 | 0 | break; |
320 | 0 | } |
321 | | |
322 | | // Make sure the name will fit in the buffer |
323 | 0 | len = rr_nm->len - 5; |
324 | 0 | if (len >= ISO9660_MAXNAMLEN_RR) { |
325 | 0 | len = ISO9660_MAXNAMLEN_RR - 1; |
326 | 0 | } |
327 | |
|
328 | 0 | strncpy(rr->fn, &rr_nm->name[0], len); |
329 | 0 | rr->fn[len] = '\0'; |
330 | 0 | if (hFile) { |
331 | 0 | fprintf(hFile, "NM Entry\n"); |
332 | 0 | fprintf(hFile, "* %s\n", rr->fn); |
333 | 0 | } |
334 | 0 | buf += head->len; |
335 | 0 | } |
336 | | // RR - relocated directory |
337 | 0 | else if ((head->sig[0] == 'C') && (head->sig[1] == 'L')) { |
338 | 0 | if (hFile) { |
339 | 0 | fprintf(hFile, "CL Entry\n"); |
340 | 0 | } |
341 | 0 | buf += head->len; |
342 | 0 | } |
343 | | // RR - parent of relocated directory |
344 | 0 | else if ((head->sig[0] == 'P') && (head->sig[1] == 'L')) { |
345 | 0 | if (hFile) { |
346 | 0 | fprintf(hFile, "PL Entry\n"); |
347 | 0 | } |
348 | 0 | buf += head->len; |
349 | 0 | } |
350 | | // RR - relocation signal |
351 | 0 | else if ((head->sig[0] == 'R') && (head->sig[1] == 'E')) { |
352 | 0 | if (hFile) { |
353 | 0 | fprintf(hFile, "RE Entry\n"); |
354 | 0 | } |
355 | 0 | buf += head->len; |
356 | 0 | } |
357 | | // RR - time stamps |
358 | 0 | else if ((head->sig[0] == 'T') && (head->sig[1] == 'F')) { |
359 | 0 | if (hFile) { |
360 | 0 | fprintf(hFile, "TF Entry\n"); |
361 | 0 | } |
362 | 0 | buf += head->len; |
363 | 0 | } |
364 | | // RR - sparse file |
365 | 0 | else if ((head->sig[0] == 'S') && (head->sig[1] == 'F')) { |
366 | 0 | if (hFile) { |
367 | 0 | fprintf(hFile, "SF Entry\n"); |
368 | 0 | } |
369 | 0 | buf += head->len; |
370 | 0 | } |
371 | | |
372 | | /* RR is a system use field indicating RockRidge, but not part of RockRidge */ |
373 | 0 | else if ((head->sig[0] == 'R') && (head->sig[1] == 'R')) { |
374 | 0 | iso->rr_found = 1; |
375 | 0 | if (hFile) { |
376 | 0 | fprintf(hFile, "RR Entry\n"); |
377 | 0 | } |
378 | 0 | buf += head->len; |
379 | 0 | } |
380 | | |
381 | 0 | else { |
382 | 0 | buf += 2; |
383 | 0 | if ((uintptr_t) buf % 2) |
384 | 0 | buf--; |
385 | 0 | } |
386 | 0 | } |
387 | | |
388 | 0 | return rr; |
389 | 0 | } |
390 | | |
391 | | |
392 | | /////////////////////////////////////////////////////////////////////////// |
393 | | // The following functions are responsible for loading all of the file metadata into memory. |
394 | | // The process is that the Path table is processed first. It contains an entry for each |
395 | | // directory. That info is then used to locate the directory contents and those contents |
396 | | // are then processed. |
397 | | // |
398 | | // Files do not have a corresponding metadata entry, so we assign them based |
399 | | // on the order that they are loaded. |
400 | | /////////////////////////////////////////////////////////////////////////// |
401 | | |
402 | | |
403 | | /* XXX Instead of loading all of the file metadata, we could instead save a mapping |
404 | | * between inode number and the byte offset of the metadata (and any other data |
405 | | * needed for fast lookups). |
406 | | */ |
407 | | |
408 | | /** \internal |
409 | | * Process the contents of a directory and load the |
410 | | * information about files in that directory into ISO_INFO. This is called |
411 | | * by the methods that process the path table (which contains pointers to the |
412 | | * various directories). The results in ISO_INFO are used to identify the |
413 | | * inode address of files found from dent_walk and for file lookups. |
414 | | * |
415 | | * Type: ISO9660_TYPE_PVD for primary volume descriptor, ISO9660_TYPE_SVD for |
416 | | * supplementary volume descriptor (do Joliet utf-8 conversion). |
417 | | * |
418 | | * @param fs File system to analyze |
419 | | * @param a_offs Byte offset of directory start |
420 | | * @param count previous file count |
421 | | * @param ctype Character set used for the names |
422 | | * @param a_fn Name of the directory to use for the "." entry (in UTF-8) |
423 | | * |
424 | | * @returns total number of files or -1 on error |
425 | | */ |
426 | | static int |
427 | | iso9660_load_inodes_dir(TSK_FS_INFO * fs, TSK_OFF_T a_offs, int count, |
428 | | int ctype, const char *a_fn, uint8_t is_first) |
429 | 0 | { |
430 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
431 | 0 | int s_cnt = 1; // count of sectors needed for dir |
432 | 0 | TSK_OFF_T s_offs = a_offs; // offset for sector reads |
433 | 0 | int i; |
434 | |
|
435 | 0 | if (tsk_verbose) |
436 | 0 | tsk_fprintf(stderr, |
437 | 0 | "iso9660_load_inodes_dir: offs: %" PRIdOFF |
438 | 0 | " count: %d ctype: %d fn: %s\n", a_offs, count, ctype, a_fn); |
439 | | |
440 | | // cycle through each sector -- entries will not cross them |
441 | 0 | for (i = 0; i < s_cnt; i++) { |
442 | 0 | ssize_t cnt1; |
443 | 0 | int b_offs; // offset in buffer |
444 | 0 | char buf[ISO9660_SSIZE_B]; |
445 | |
|
446 | 0 | cnt1 = tsk_fs_read(fs, s_offs, buf, ISO9660_SSIZE_B); |
447 | 0 | if (cnt1 != ISO9660_SSIZE_B) { |
448 | 0 | if (cnt1 >= 0) { |
449 | 0 | tsk_error_reset(); |
450 | 0 | tsk_error_set_errno(TSK_ERR_FS_READ); |
451 | 0 | } |
452 | 0 | tsk_error_set_errstr2("iso_get_dentries"); |
453 | 0 | return -1; |
454 | 0 | } |
455 | | |
456 | | /* process the directory entries */ |
457 | 0 | for (b_offs = 0; b_offs < ISO9660_SSIZE_B;) { |
458 | 0 | iso9660_inode_node *in_node = NULL; |
459 | 0 | iso9660_dentry *dentry; |
460 | |
|
461 | 0 | dentry = (iso9660_dentry *) & buf[b_offs]; |
462 | |
|
463 | 0 | if (dentry->entry_len == 0) { |
464 | 0 | b_offs += 2; |
465 | 0 | continue; |
466 | 0 | } |
467 | | // sanity checks on entry_len |
468 | 0 | else if (dentry->entry_len < sizeof(iso9660_dentry)) { |
469 | 0 | if (tsk_verbose) |
470 | 0 | tsk_fprintf(stderr, |
471 | 0 | "iso9660_load_inodes_dir: entry length is shorter than dentry, bailing\n"); |
472 | 0 | break; |
473 | 0 | } |
474 | 0 | else if (b_offs + dentry->entry_len > ISO9660_SSIZE_B) { |
475 | 0 | if (tsk_verbose) |
476 | 0 | tsk_fprintf(stderr, |
477 | 0 | "iso9660_load_inodes_dir: entry is longer than sector, bailing\n"); |
478 | 0 | break; |
479 | 0 | } |
480 | | |
481 | | /* when processing the other volume descriptor directories, we ignore the |
482 | | * directories because we have no way of detecting if it is a duplicate of |
483 | | * a directory from the other volume descriptor (they use different blocks). |
484 | | * We will see the contents of this directory from the path table anyway. */ |
485 | 0 | if ((dentry->flags & ISO9660_FLAG_DIR) && (is_first == 0)) { |
486 | 0 | b_offs += dentry->entry_len; |
487 | 0 | continue; |
488 | 0 | } |
489 | | |
490 | | // allocate a node for this entry |
491 | 0 | in_node = (iso9660_inode_node *) |
492 | 0 | tsk_malloc(sizeof(iso9660_inode_node)); |
493 | 0 | if (in_node == NULL) { |
494 | 0 | return -1; |
495 | 0 | } |
496 | | |
497 | | // the first entry is for the current directory |
498 | 0 | if ((i == 0) && (b_offs == 0)) { |
499 | | // should have no name or '.' |
500 | 0 | if (dentry->fi_len > 1) { |
501 | 0 | if (tsk_verbose) |
502 | 0 | tsk_fprintf(stderr, |
503 | 0 | "iso9660_load_inodes_dir: first entry has name length > 1\n"); |
504 | 0 | free(in_node); |
505 | 0 | in_node = NULL; |
506 | 0 | b_offs += dentry->entry_len; |
507 | 0 | continue; |
508 | 0 | } |
509 | | |
510 | | /* find how many more sectors are in the directory */ |
511 | 0 | s_cnt = |
512 | 0 | tsk_getu32(fs->endian, |
513 | 0 | dentry->data_len_m) / ISO9660_SSIZE_B; |
514 | 0 | if (tsk_verbose) |
515 | 0 | tsk_fprintf(stderr, "iso9660_load_inodes_dir: %d number of additional sectors\n", s_cnt); |
516 | | |
517 | | // @@@ Should have a sanity check here on s_cnt, but I'm not sure what it would be... |
518 | | |
519 | | /* use the specified name instead of "." */ |
520 | 0 | if (strlen(a_fn) > ISO9660_MAXNAMLEN_STD) { |
521 | 0 | tsk_error_reset(); |
522 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
523 | 0 | tsk_error_set_errstr |
524 | 0 | ("iso9660_load_inodes_dir: Name argument specified is too long"); |
525 | 0 | free(in_node); |
526 | 0 | return -1; |
527 | 0 | } |
528 | 0 | strncpy(in_node->inode.fn, a_fn, ISO9660_MAXNAMLEN_STD + 1); |
529 | | |
530 | | /* for all directories except the root, we skip processing the "." and ".." entries because |
531 | | * they duplicate the other entires and the dent_walk code will rely on the offset |
532 | | * for the entry in the parent directory. */ |
533 | 0 | if (count != 0) { |
534 | 0 | free(in_node); |
535 | 0 | in_node = NULL; |
536 | 0 | b_offs += dentry->entry_len; |
537 | 0 | dentry = (iso9660_dentry *) & buf[b_offs]; |
538 | 0 | b_offs += dentry->entry_len; |
539 | 0 | continue; |
540 | 0 | } |
541 | 0 | } |
542 | 0 | else { |
543 | 0 | char *file_ver; |
544 | | |
545 | | // the entry has a UTF-16 name |
546 | 0 | if (ctype == ISO9660_CTYPE_UTF16) { |
547 | 0 | UTF16 *name16; |
548 | 0 | UTF8 *name8; |
549 | 0 | int retVal; |
550 | |
|
551 | 0 | if (dentry->entry_len < sizeof(iso9660_dentry) + dentry->fi_len) { |
552 | 0 | if (tsk_verbose) |
553 | 0 | tsk_fprintf(stderr, |
554 | 0 | "iso9660_load_inodes_dir: UTF-16 name length is too large, bailing\n"); |
555 | 0 | free(in_node); |
556 | 0 | in_node = NULL; |
557 | 0 | break; |
558 | 0 | } |
559 | 0 | if (b_offs >= ISO9660_SSIZE_B - sizeof(iso9660_dentry)) { |
560 | 0 | if (tsk_verbose) |
561 | 0 | tsk_fprintf(stderr, |
562 | 0 | "iso9660_load_inodes_dir: b_offs out of bounds, bailing\n"); |
563 | 0 | free(in_node); |
564 | 0 | in_node = NULL; |
565 | 0 | break; |
566 | 0 | } |
567 | | |
568 | | |
569 | 0 | name16 = |
570 | 0 | (UTF16 *) & buf[b_offs + sizeof(iso9660_dentry)]; |
571 | | // the name is in UTF-16 BE -- convert to LE if needed |
572 | 0 | if (fs->endian & TSK_LIT_ENDIAN) { |
573 | 0 | int a; |
574 | |
|
575 | 0 | for (a = 0; a < dentry->fi_len / 2; a++) { |
576 | 0 | name16[a] = ((name16[a] & 0xff) << 8) + |
577 | 0 | ((name16[a] & 0xff00) >> 8); |
578 | 0 | } |
579 | 0 | } |
580 | 0 | name8 = (UTF8 *) in_node->inode.fn; |
581 | |
|
582 | 0 | if ((dentry->fi_len % 2) != 0 || dentry->fi_len > ISO9660_SSIZE_B - sizeof(iso9660_dentry) - b_offs) { |
583 | 0 | if (tsk_verbose) |
584 | 0 | tsk_fprintf(stderr, |
585 | 0 | "iso9660_load_inodes_dir: UTF-16 name length out of bounds, bailing\n"); |
586 | 0 | free(in_node); |
587 | 0 | in_node = NULL; |
588 | 0 | break; |
589 | 0 | } |
590 | 0 | retVal = |
591 | 0 | tsk_UTF16toUTF8(fs->endian, |
592 | 0 | (const UTF16 **) &name16, (UTF16 *) & buf[b_offs + sizeof(iso9660_dentry) + dentry->fi_len], |
593 | 0 | &name8, (UTF8 *) ((uintptr_t) & in_node->inode.fn[ISO9660_MAXNAMLEN_STD]), |
594 | 0 | TSKlenientConversion); |
595 | 0 | if (retVal != TSKconversionOK) { |
596 | 0 | if (tsk_verbose) |
597 | 0 | tsk_fprintf(stderr, |
598 | 0 | "iso9660_load_inodes_dir: Error converting Joliet name to UTF8: %d", |
599 | 0 | retVal); |
600 | 0 | in_node->inode.fn[0] = '\0'; |
601 | 0 | } |
602 | 0 | *name8 = '\0'; |
603 | 0 | } |
604 | | |
605 | 0 | else if (ctype == ISO9660_CTYPE_ASCII) { |
606 | 0 | int readlen; |
607 | |
|
608 | 0 | readlen = dentry->fi_len; |
609 | 0 | if (readlen > ISO9660_MAXNAMLEN_STD) |
610 | 0 | readlen = ISO9660_MAXNAMLEN_STD; |
611 | | |
612 | 0 | if (dentry->entry_len < sizeof(iso9660_dentry) + dentry->fi_len) { |
613 | 0 | if (tsk_verbose) |
614 | 0 | tsk_fprintf(stderr, |
615 | 0 | "iso9660_load_inodes_dir: ASCII name length is too large, bailing\n"); |
616 | 0 | free(in_node); |
617 | 0 | in_node = NULL; |
618 | 0 | break; |
619 | 0 | } |
620 | | |
621 | | |
622 | 0 | memcpy(in_node->inode.fn, |
623 | 0 | &buf[b_offs + sizeof(iso9660_dentry)], readlen); |
624 | 0 | in_node->inode.fn[readlen] = '\0'; |
625 | 0 | } |
626 | 0 | else { |
627 | 0 | tsk_error_reset(); |
628 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
629 | 0 | tsk_error_set_errstr |
630 | 0 | ("Invalid ctype in iso9660_load_inodes_dir"); |
631 | 0 | free(in_node); |
632 | 0 | in_node = NULL; |
633 | 0 | return -1; |
634 | 0 | } |
635 | | |
636 | | // the version is embedded in the name |
637 | 0 | file_ver = strchr(in_node->inode.fn, ';'); |
638 | 0 | if (file_ver) { |
639 | 0 | in_node->inode.version = atoi(file_ver + 1); |
640 | 0 | *file_ver = '\0'; |
641 | 0 | file_ver = NULL; |
642 | 0 | } |
643 | |
|
644 | 0 | size_t name8_len = strnlen(in_node->inode.fn, ISO9660_MAXNAMLEN); |
645 | 0 | if (name8_len > 0 && in_node->inode.fn[name8_len - 1] == '.') { |
646 | | // if no extension, remove the final '.' |
647 | 0 | in_node->inode.fn[name8_len - 1] = '\0'; |
648 | 0 | name8_len -= 1; |
649 | 0 | } |
650 | 0 | if (name8_len == 0) { |
651 | 0 | if (tsk_verbose) |
652 | 0 | tsk_fprintf(stderr, |
653 | 0 | "iso9660_load_inodes_dir: length of name after processing is 0. bailing\n"); |
654 | 0 | free(in_node); |
655 | 0 | in_node = NULL; |
656 | 0 | break; |
657 | | |
658 | 0 | } |
659 | 0 | } |
660 | | |
661 | | |
662 | | |
663 | | // copy the raw dentry data into the node |
664 | 0 | memcpy(&(in_node->inode.dr), dentry, sizeof(iso9660_dentry)); |
665 | |
|
666 | 0 | in_node->inode.ea = NULL; |
667 | | |
668 | | // sanity checks |
669 | 0 | if (tsk_getu32(fs->endian, dentry->ext_loc_m) > fs->last_block) { |
670 | 0 | if (tsk_verbose) |
671 | 0 | tsk_fprintf(stderr, |
672 | 0 | "iso9660_load_inodes_dir: file starts past end of image (%"PRIu32"). bailing\n", |
673 | 0 | tsk_getu32(fs->endian, dentry->ext_loc_m)); |
674 | 0 | free(in_node); |
675 | 0 | in_node = NULL; |
676 | 0 | break; |
677 | 0 | } |
678 | 0 | in_node->offset = |
679 | 0 | tsk_getu32(fs->endian, dentry->ext_loc_m) * fs->block_size; |
680 | | |
681 | 0 | if (tsk_getu32(fs->endian, in_node->inode.dr.data_len_m) + in_node->offset > (TSK_OFF_T)(fs->block_count * fs->block_size)) { |
682 | 0 | if (tsk_verbose) |
683 | 0 | tsk_fprintf(stderr, |
684 | 0 | "iso9660_load_inodes_dir: file ends past end of image (%"PRIu32" bytes). bailing\n", |
685 | 0 | tsk_getu32(fs->endian, in_node->inode.dr.data_len_m) + in_node->offset); |
686 | 0 | free(in_node); |
687 | 0 | in_node = NULL; |
688 | 0 | break; |
689 | 0 | } |
690 | | /* record size to make sure fifos show up as unique files */ |
691 | 0 | in_node->size = |
692 | 0 | tsk_getu32(fs->endian, in_node->inode.dr.data_len_m); |
693 | | |
694 | | |
695 | 0 | in_node->ea_size = dentry->ext_len; |
696 | 0 | in_node->dentry_offset = s_offs + b_offs; |
697 | |
|
698 | 0 | if (is_first) |
699 | 0 | in_node->inode.is_orphan = 0; |
700 | 0 | else |
701 | 0 | in_node->inode.is_orphan = 1; |
702 | |
|
703 | 0 | in_node->inum = count++; |
704 | | |
705 | | /* RockRidge data is located after the name. See if it is there. */ |
706 | 0 | if ((int) (dentry->entry_len - sizeof(iso9660_dentry) - |
707 | 0 | dentry->fi_len) > 1) { |
708 | 0 | int extra_bytes = |
709 | 0 | dentry->entry_len - sizeof(iso9660_dentry) - |
710 | 0 | dentry->fi_len; |
711 | |
|
712 | 0 | in_node->inode.rr = |
713 | 0 | parse_susp(fs, |
714 | 0 | &buf[b_offs + sizeof(iso9660_dentry) + dentry->fi_len], |
715 | 0 | extra_bytes, NULL, 0); |
716 | 0 | if (in_node->inode.rr == NULL) { |
717 | 0 | if (tsk_verbose) |
718 | 0 | tsk_fprintf(stderr, |
719 | 0 | "iso9660_load_inodes_dir: parse_susp returned error (%s). bailing\n", tsk_error_get()); |
720 | 0 | free(in_node); |
721 | 0 | in_node = NULL; |
722 | 0 | break; |
723 | 0 | } |
724 | | |
725 | 0 | in_node->inode.susp_off = |
726 | 0 | b_offs + sizeof(iso9660_dentry) + dentry->fi_len + |
727 | 0 | s_offs; |
728 | 0 | in_node->inode.susp_len = extra_bytes; |
729 | 0 | } |
730 | 0 | else { |
731 | 0 | in_node->inode.rr = NULL; |
732 | 0 | in_node->inode.susp_off = 0; |
733 | 0 | in_node->inode.susp_len = 0; |
734 | 0 | } |
735 | | |
736 | | /* add inode to the list */ |
737 | 0 | if (iso->in_list) { |
738 | 0 | iso9660_inode_node *tmp, *prev_tmp; |
739 | |
|
740 | 0 | for (tmp = iso->in_list; tmp; tmp = tmp->next) { |
741 | | /* When processing the "first" volume descriptor, all entries get added to the list. |
742 | | * for the later ones, we skip duplicate ones that have content (blocks) that overlaps |
743 | | * with entries from a previous volume descriptor. */ |
744 | 0 | if ((in_node->offset == tmp->offset) |
745 | 0 | && (in_node->size == tmp->size) |
746 | 0 | && (in_node->size) && (is_first == 0)) { |
747 | | |
748 | | // if we found rockridge, then update original if needed. |
749 | 0 | if (in_node->inode.rr) { |
750 | 0 | if (tmp->inode.rr == NULL) { |
751 | 0 | tmp->inode.rr = in_node->inode.rr; |
752 | 0 | tmp->inode.susp_off = |
753 | 0 | in_node->inode.susp_off; |
754 | 0 | tmp->inode.susp_len = |
755 | 0 | in_node->inode.susp_len; |
756 | 0 | in_node->inode.rr = NULL; |
757 | 0 | } |
758 | 0 | else { |
759 | 0 | free(in_node->inode.rr); |
760 | 0 | in_node->inode.rr = NULL; |
761 | 0 | } |
762 | 0 | } |
763 | |
|
764 | 0 | if (tsk_verbose) |
765 | 0 | tsk_fprintf(stderr, |
766 | 0 | "iso9660_load_inodes_dir: Removing duplicate entry for: %s (orig name: %s start: %d size: %d)\n", |
767 | 0 | in_node->inode.fn, tmp->inode.fn, in_node->offset, in_node->size); |
768 | 0 | free(in_node); |
769 | 0 | in_node = NULL; |
770 | 0 | count--; |
771 | 0 | break; |
772 | 0 | } |
773 | 0 | prev_tmp = tmp; |
774 | 0 | } |
775 | | |
776 | | // add it to the end (if we didn't get rid of it above) |
777 | 0 | if (in_node) { |
778 | 0 | prev_tmp->next = in_node; |
779 | 0 | in_node->next = NULL; |
780 | 0 | } |
781 | 0 | } |
782 | 0 | else { |
783 | 0 | iso->in_list = in_node; |
784 | 0 | in_node->next = NULL; |
785 | 0 | } |
786 | | |
787 | | // skip two entries if this was the root directory (the . and ..). |
788 | 0 | if ((i == 0) && (b_offs == 0) && (count == 1)) { |
789 | 0 | b_offs += dentry->entry_len; |
790 | 0 | dentry = (iso9660_dentry *) & buf[b_offs]; |
791 | 0 | } |
792 | 0 | b_offs += dentry->entry_len; |
793 | 0 | } |
794 | 0 | s_offs += cnt1; |
795 | 0 | } |
796 | 0 | return count; |
797 | 0 | } |
798 | | |
799 | | |
800 | | /** |
801 | | * Process the path table for a joliet secondary volume descriptor |
802 | | * and load all of the files pointed to it. |
803 | | * The path table contains an entry for each directory. This code |
804 | | * then locates each of the directories and processes the contents. |
805 | | * |
806 | | * @param fs File system to process |
807 | | * @param svd Pointer to the secondary volume descriptor |
808 | | * @param count Current count of inodes |
809 | | * @returns updated count of inodes or -1 on error |
810 | | */ |
811 | | static int |
812 | | iso9660_load_inodes_pt_joliet(TSK_FS_INFO * fs, iso9660_svd * svd, |
813 | | int count, uint8_t is_first) |
814 | 0 | { |
815 | 0 | TSK_OFF_T pt_offs; /* offset of where we are in path table */ |
816 | 0 | size_t pt_len; /* bytes left in path table */ |
817 | | |
818 | | // get the location of the path table |
819 | 0 | pt_offs = |
820 | 0 | (TSK_OFF_T) (tsk_getu32(fs->endian, |
821 | 0 | svd->pt_loc_m) * fs->block_size); |
822 | 0 | pt_len = tsk_getu32(fs->endian, svd->pt_size_m); |
823 | |
|
824 | 0 | while (pt_len > 0) { |
825 | | // Since further on cnt + 1 is used and cnt can be ISO9660_MAXNAMLEN_JOL |
826 | | // + 2 ensures utf16_buf is sufficiently large. |
827 | 0 | char utf16_buf[ISO9660_MAXNAMLEN_JOL + 2]; // UTF-16 name from img |
828 | 0 | char utf8buf[2 * ISO9660_MAXNAMLEN_JOL + 1]; // UTF-8 version of name |
829 | 0 | int readlen; |
830 | 0 | TSK_OFF_T extent; /* offset of extent for current directory */ |
831 | 0 | path_table_rec dir; |
832 | 0 | int retVal; |
833 | 0 | ssize_t cnt; |
834 | |
|
835 | 0 | UTF16 *name16; |
836 | 0 | UTF8 *name8; |
837 | | |
838 | | // Read the path table entry |
839 | 0 | cnt = tsk_fs_read(fs, pt_offs, (char *) &dir, (int) sizeof(dir)); |
840 | 0 | if (cnt != sizeof(dir)) { |
841 | 0 | if (cnt >= 0) { |
842 | 0 | tsk_error_reset(); |
843 | 0 | tsk_error_set_errno(TSK_ERR_FS_READ); |
844 | 0 | } |
845 | 0 | tsk_error_set_errstr2("iso9660_load_inodes_pt"); |
846 | 0 | return -1; |
847 | 0 | } |
848 | 0 | pt_len -= cnt; |
849 | 0 | pt_offs += (TSK_OFF_T) cnt; |
850 | |
|
851 | 0 | readlen = dir.len_di; |
852 | 0 | if (dir.len_di > ISO9660_MAXNAMLEN_JOL) |
853 | 0 | readlen = ISO9660_MAXNAMLEN_JOL; |
854 | |
|
855 | 0 | memset(utf16_buf, 0, ISO9660_MAXNAMLEN_JOL + 2); |
856 | | /* get UCS-2 filename for the entry */ |
857 | 0 | cnt = tsk_fs_read(fs, pt_offs, (char *) utf16_buf, readlen); |
858 | 0 | if (cnt != dir.len_di) { |
859 | 0 | if (cnt >= 0) { |
860 | 0 | tsk_error_reset(); |
861 | 0 | tsk_error_set_errno(TSK_ERR_FS_READ); |
862 | 0 | } |
863 | 0 | tsk_error_set_errstr2("iso_find_inodes"); |
864 | 0 | return -1; |
865 | 0 | } |
866 | 0 | pt_len -= cnt; |
867 | 0 | pt_offs += (TSK_OFF_T) cnt; |
868 | | |
869 | | // ISO stores UTF-16 in BE -- convert to local if we need to |
870 | 0 | if (fs->endian & TSK_LIT_ENDIAN) { |
871 | 0 | int i; |
872 | 0 | for (i = 0; i < cnt; i += 2) { |
873 | 0 | char t = utf16_buf[i]; |
874 | 0 | utf16_buf[i] = utf16_buf[i + 1]; |
875 | 0 | utf16_buf[i] = t; |
876 | 0 | } |
877 | 0 | } |
878 | |
|
879 | 0 | name16 = (UTF16 *) utf16_buf; |
880 | 0 | name8 = (UTF8 *) utf8buf; |
881 | |
|
882 | 0 | retVal = tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16, |
883 | 0 | (UTF16 *) ((uintptr_t) & utf16_buf[cnt + 1]), &name8, |
884 | 0 | (UTF8 *) ((uintptr_t) & utf8buf[2 * ISO9660_MAXNAMLEN_JOL]), |
885 | 0 | TSKlenientConversion); |
886 | 0 | if (retVal != TSKconversionOK) { |
887 | 0 | if (tsk_verbose) |
888 | 0 | tsk_fprintf(stderr, |
889 | 0 | "fsstat: Error converting Joliet name to UTF8: %d", |
890 | 0 | retVal); |
891 | 0 | utf8buf[0] = '\0'; |
892 | 0 | } |
893 | 0 | *name8 = '\0'; |
894 | | |
895 | | /* padding byte is there if strlen(file name) is odd */ |
896 | 0 | if (dir.len_di % 2) { |
897 | 0 | pt_len--; |
898 | 0 | pt_offs++; |
899 | 0 | } |
900 | |
|
901 | 0 | extent = |
902 | 0 | (TSK_OFF_T) (tsk_getu32(fs->endian, |
903 | 0 | dir.ext_loc) * fs->block_size); |
904 | | |
905 | | // process the directory contents |
906 | 0 | count = |
907 | 0 | iso9660_load_inodes_dir(fs, extent, count, |
908 | 0 | ISO9660_CTYPE_UTF16, utf8buf, is_first); |
909 | |
|
910 | 0 | if (count == -1) { |
911 | 0 | return -1; |
912 | 0 | } |
913 | 0 | } |
914 | 0 | return count; |
915 | 0 | } |
916 | | |
917 | | /** |
918 | | * Proces the path table and the directories that are listed in it. |
919 | | * The files in each directory will be stored in ISO_INFO. |
920 | | * |
921 | | * @param iso File system to analyze and store results in |
922 | | * @returns -1 on error or count of inodes found. |
923 | | */ |
924 | | static int |
925 | | iso9660_load_inodes_pt(ISO_INFO * iso) |
926 | 0 | { |
927 | 0 | TSK_FS_INFO *fs = (TSK_FS_INFO *) & iso->fs_info; |
928 | 0 | int count = 0; |
929 | 0 | iso9660_svd_node *s; |
930 | 0 | iso9660_pvd_node *p; |
931 | 0 | char fn[ISO9660_MAXNAMLEN_STD + 1]; /* store current directory name */ |
932 | 0 | path_table_rec dir; |
933 | 0 | TSK_OFF_T pt_offs; /* offset of where we are in path table */ |
934 | 0 | TSK_OFF_T extent; /* offset of extent for current directory */ |
935 | 0 | ssize_t cnt; |
936 | 0 | uint8_t is_first = 1; |
937 | |
|
938 | 0 | if (tsk_verbose) |
939 | 0 | tsk_fprintf(stderr, "iso9660_load_inodes_pt\n"); |
940 | | |
941 | | /* initialize in case repeatedly called */ |
942 | 0 | iso9660_inode_list_free(fs); |
943 | 0 | iso->in_list = NULL; |
944 | | |
945 | | /* The secondary volume descriptor table will contain the |
946 | | * longer / unicode files, so we process it first to give them |
947 | | * a higher priority */ |
948 | 0 | for (s = iso->svd; s != NULL; s = s->next) { |
949 | | |
950 | | /* Check if this is Joliet -- there are three possible signatures */ |
951 | 0 | if ((s->svd.esc_seq[0] == 0x25) && (s->svd.esc_seq[1] == 0x2F) && |
952 | 0 | ((s->svd.esc_seq[2] == 0x40) || (s->svd.esc_seq[2] == 0x43) |
953 | 0 | || (s->svd.esc_seq[2] == 0x45))) { |
954 | 0 | count = |
955 | 0 | iso9660_load_inodes_pt_joliet(fs, &(s->svd), count, |
956 | 0 | is_first); |
957 | 0 | if (count == -1) { |
958 | 0 | return -1; |
959 | 0 | } |
960 | 0 | is_first = 0; |
961 | 0 | } |
962 | 0 | } |
963 | | |
964 | | |
965 | | /* Now look for unique files in the primary descriptors */ |
966 | 0 | for (p = iso->pvd; p != NULL; p = p->next) { |
967 | 0 | size_t pt_len; /* bytes left in path table */ |
968 | |
|
969 | 0 | pt_offs = |
970 | 0 | (TSK_OFF_T) (tsk_getu32(fs->endian, |
971 | 0 | p->pvd.pt_loc_m) * fs->block_size); |
972 | 0 | pt_len = tsk_getu32(fs->endian, p->pvd.pt_size_m); |
973 | |
|
974 | 0 | while (pt_len > 0) { |
975 | 0 | int readlen; |
976 | | |
977 | | /* get next path table entry... */ |
978 | 0 | cnt = tsk_fs_read(fs, pt_offs, (char *) &dir, sizeof(dir)); |
979 | 0 | if (cnt != sizeof(dir)) { |
980 | 0 | if (cnt >= 0) { |
981 | 0 | tsk_error_reset(); |
982 | 0 | tsk_error_set_errno(TSK_ERR_FS_READ); |
983 | 0 | } |
984 | 0 | tsk_error_set_errstr2("iso_find_inodes"); |
985 | 0 | return -1; |
986 | 0 | } |
987 | 0 | pt_len -= cnt; |
988 | 0 | pt_offs += (TSK_OFF_T) cnt; |
989 | |
|
990 | 0 | readlen = dir.len_di; |
991 | 0 | if (readlen > ISO9660_MAXNAMLEN_STD) |
992 | 0 | readlen = ISO9660_MAXNAMLEN_STD; |
993 | | |
994 | | /* get directory name, this is the only chance */ |
995 | 0 | cnt = tsk_fs_read(fs, pt_offs, fn, readlen); |
996 | 0 | if (cnt != readlen) { |
997 | 0 | if (cnt >= 0) { |
998 | 0 | tsk_error_reset(); |
999 | 0 | tsk_error_set_errno(TSK_ERR_FS_READ); |
1000 | 0 | } |
1001 | 0 | tsk_error_set_errstr2("iso_find_inodes"); |
1002 | 0 | return -1; |
1003 | 0 | } |
1004 | 0 | fn[cnt] = '\0'; |
1005 | |
|
1006 | 0 | pt_len -= cnt; |
1007 | 0 | pt_offs += (TSK_OFF_T) cnt; |
1008 | | |
1009 | | /* padding byte is there if strlen(file name) is odd */ |
1010 | 0 | if (dir.len_di % 2) { |
1011 | 0 | pt_len--; |
1012 | 0 | pt_offs++; |
1013 | 0 | } |
1014 | |
|
1015 | 0 | extent = |
1016 | 0 | (TSK_OFF_T) (tsk_getu32(fs->endian, |
1017 | 0 | dir.ext_loc) * fs->block_size); |
1018 | | |
1019 | | // process the directory contents |
1020 | 0 | count = |
1021 | 0 | iso9660_load_inodes_dir(fs, extent, count, |
1022 | 0 | ISO9660_CTYPE_ASCII, fn, is_first); |
1023 | |
|
1024 | 0 | if (count == -1) { |
1025 | 0 | return -1; |
1026 | 0 | } |
1027 | 0 | } |
1028 | 0 | } |
1029 | 0 | return count; |
1030 | 0 | } |
1031 | | |
1032 | | /** |
1033 | | * Load the raw "inode" into the cached buffer (iso->dinode) |
1034 | | * |
1035 | | * dinode_load (for now) does not check for extended attribute records... |
1036 | | * my issue is I dont have an iso9660 image with extended attr recs, so I |
1037 | | * can't test/debug, etc |
1038 | | * |
1039 | | * @returns 1 if not found and 0 on succuss |
1040 | | */ |
1041 | | uint8_t |
1042 | | iso9660_dinode_load(ISO_INFO * iso, TSK_INUM_T inum, |
1043 | | iso9660_inode * dinode) |
1044 | 0 | { |
1045 | 0 | iso9660_inode_node *n; |
1046 | |
|
1047 | 0 | n = iso->in_list; |
1048 | 0 | while (n && (n->inum != inum)) |
1049 | 0 | n = n->next; |
1050 | |
|
1051 | 0 | if (n) { |
1052 | 0 | memcpy(dinode, &n->inode, sizeof(iso9660_inode)); |
1053 | 0 | return 0; |
1054 | 0 | } |
1055 | 0 | else { |
1056 | 0 | return 1; |
1057 | 0 | } |
1058 | 0 | } |
1059 | | |
1060 | | |
1061 | | static uint16_t |
1062 | | isomode2tskmode(uint16_t a_mode) |
1063 | 0 | { |
1064 | 0 | uint16_t mode = 0; |
1065 | |
|
1066 | 0 | if (a_mode & ISO_EA_IRUSR) |
1067 | 0 | mode |= TSK_FS_META_MODE_IRUSR; |
1068 | 0 | if (a_mode & ISO_EA_IWUSR) |
1069 | 0 | mode |= TSK_FS_META_MODE_IWUSR; |
1070 | 0 | if (a_mode & ISO_EA_IXUSR) |
1071 | 0 | mode |= TSK_FS_META_MODE_IXUSR; |
1072 | |
|
1073 | 0 | if (a_mode & ISO_EA_IRGRP) |
1074 | 0 | mode |= TSK_FS_META_MODE_IRGRP; |
1075 | 0 | if (a_mode & ISO_EA_IWGRP) |
1076 | 0 | mode |= TSK_FS_META_MODE_IWGRP; |
1077 | 0 | if (a_mode & ISO_EA_IXGRP) |
1078 | 0 | mode |= TSK_FS_META_MODE_IXGRP; |
1079 | |
|
1080 | 0 | if (a_mode & ISO_EA_IROTH) |
1081 | 0 | mode |= TSK_FS_META_MODE_IROTH; |
1082 | 0 | if (a_mode & ISO_EA_IWOTH) |
1083 | 0 | mode |= TSK_FS_META_MODE_IWOTH; |
1084 | 0 | if (a_mode & ISO_EA_IXOTH) |
1085 | 0 | mode |= TSK_FS_META_MODE_IXOTH; |
1086 | |
|
1087 | 0 | return mode; |
1088 | 0 | } |
1089 | | |
1090 | | /** |
1091 | | * Copies cached disk inode into generic structure. |
1092 | | * |
1093 | | * @returns 1 on error and 0 on success |
1094 | | */ |
1095 | | static uint8_t |
1096 | | iso9660_dinode_copy(ISO_INFO * iso, TSK_FS_META * fs_meta, TSK_INUM_T inum, |
1097 | | iso9660_inode * dinode) |
1098 | 0 | { |
1099 | 0 | TSK_FS_INFO *fs = (TSK_FS_INFO *) & iso->fs_info; |
1100 | 0 | struct tm t; |
1101 | |
|
1102 | 0 | if (fs_meta == NULL) { |
1103 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
1104 | 0 | tsk_error_set_errstr |
1105 | 0 | ("iso9660_dinode_copy: fs_file or meta is NULL"); |
1106 | 0 | return 1; |
1107 | 0 | } |
1108 | | |
1109 | 0 | fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; |
1110 | 0 | if (fs_meta->attr) { |
1111 | 0 | tsk_fs_attrlist_markunused(fs_meta->attr); |
1112 | 0 | } |
1113 | |
|
1114 | 0 | if (fs_meta->content_len < ISO9660_FILE_CONTENT_LEN) { |
1115 | 0 | if ((fs_meta = |
1116 | 0 | tsk_fs_meta_realloc(fs_meta, |
1117 | 0 | ISO9660_FILE_CONTENT_LEN)) == NULL) { |
1118 | 0 | return 1; |
1119 | 0 | } |
1120 | 0 | } |
1121 | | |
1122 | 0 | fs_meta->addr = inum; |
1123 | 0 | fs_meta->size = tsk_getu32(fs->endian, dinode->dr.data_len_m); |
1124 | |
|
1125 | 0 | memset(&t, 0, sizeof(struct tm)); |
1126 | 0 | t.tm_sec = dinode->dr.rec_time.sec; |
1127 | 0 | t.tm_min = dinode->dr.rec_time.min; |
1128 | 0 | t.tm_hour = dinode->dr.rec_time.hour; |
1129 | 0 | t.tm_mday = dinode->dr.rec_time.day; |
1130 | 0 | t.tm_mon = dinode->dr.rec_time.month - 1; |
1131 | 0 | t.tm_year = dinode->dr.rec_time.year; |
1132 | | //gmt_hrdiff = iso->dinode->dr.rec_time.gmt_off * 15 / 60; |
1133 | |
|
1134 | 0 | fs_meta->crtime = mktime(&t); |
1135 | 0 | fs_meta->mtime = fs_meta->atime = fs_meta->ctime = 0; |
1136 | 0 | fs_meta->crtime_nano = fs_meta->mtime_nano = fs_meta->atime_nano = |
1137 | 0 | fs_meta->ctime_nano = 0; |
1138 | |
|
1139 | 0 | if (dinode->dr.flags & ISO9660_FLAG_DIR) |
1140 | 0 | fs_meta->type = TSK_FS_META_TYPE_DIR; |
1141 | 0 | else |
1142 | 0 | fs_meta->type = TSK_FS_META_TYPE_REG; |
1143 | |
|
1144 | 0 | if (dinode->ea) { |
1145 | 0 | fs_meta->uid = tsk_getu32(fs->endian, dinode->ea->uid); |
1146 | 0 | fs_meta->gid = tsk_getu32(fs->endian, dinode->ea->gid); |
1147 | 0 | fs_meta->mode = |
1148 | 0 | isomode2tskmode(tsk_getu16(fs->endian, dinode->ea->mode)); |
1149 | 0 | fs_meta->nlink = 1; |
1150 | 0 | } |
1151 | 0 | else { |
1152 | 0 | fs_meta->uid = 0; |
1153 | 0 | fs_meta->gid = 0; |
1154 | 0 | fs_meta->mode = 0; |
1155 | 0 | fs_meta->nlink = 1; |
1156 | 0 | } |
1157 | |
|
1158 | 0 | ((TSK_DADDR_T *) fs_meta->content_ptr)[0] = |
1159 | 0 | (TSK_DADDR_T) tsk_getu32(fs->endian, dinode->dr.ext_loc_m); |
1160 | | |
1161 | | // mark files that were found from other volume descriptors as unalloc so that they |
1162 | | // come up as orphan files. |
1163 | 0 | if (dinode->is_orphan) |
1164 | 0 | fs_meta->flags = TSK_FS_META_FLAG_UNALLOC | TSK_FS_META_FLAG_USED; |
1165 | 0 | else |
1166 | 0 | fs_meta->flags = TSK_FS_META_FLAG_ALLOC | TSK_FS_META_FLAG_USED; |
1167 | 0 | return 0; |
1168 | 0 | } |
1169 | | |
1170 | | static void |
1171 | | iso9660_close(TSK_FS_INFO * fs) |
1172 | 0 | { |
1173 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
1174 | |
|
1175 | 0 | fs->tag = 0; |
1176 | |
|
1177 | 0 | while (iso->pvd != NULL) { |
1178 | 0 | iso9660_pvd_node *p = iso->pvd; |
1179 | 0 | iso->pvd = iso->pvd->next; |
1180 | 0 | free(p); |
1181 | 0 | } |
1182 | |
|
1183 | 0 | while (iso->svd != NULL) { |
1184 | 0 | iso9660_svd_node *s = iso->svd; |
1185 | 0 | iso->svd = iso->svd->next; |
1186 | 0 | free(s); |
1187 | 0 | } |
1188 | |
|
1189 | 0 | while (iso->in_list != NULL) { |
1190 | 0 | iso9660_inode_node *in = iso->in_list; |
1191 | 0 | iso->in_list = iso->in_list->next; |
1192 | 0 | if (in->inode.rr != NULL) { |
1193 | 0 | free(in->inode.rr); |
1194 | 0 | } |
1195 | 0 | free(in); |
1196 | 0 | } |
1197 | |
|
1198 | 0 | tsk_fs_free(fs); |
1199 | 0 | } |
1200 | | |
1201 | | |
1202 | | static uint8_t |
1203 | | iso9660_inode_lookup(TSK_FS_INFO * fs, TSK_FS_FILE * a_fs_file, |
1204 | | TSK_INUM_T inum) |
1205 | 0 | { |
1206 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
1207 | 0 | iso9660_inode *dinode; |
1208 | |
|
1209 | 0 | if (tsk_verbose) |
1210 | 0 | tsk_fprintf(stderr, "iso9660_inode_lookup: iso:" |
1211 | 0 | " inum: %" PRIuINUM "\n", inum); |
1212 | |
|
1213 | 0 | if (a_fs_file == NULL) { |
1214 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
1215 | 0 | tsk_error_set_errstr("iso9660_inode_lookup: fs_file is NULL"); |
1216 | 0 | return 1; |
1217 | 0 | } |
1218 | | |
1219 | 0 | if (a_fs_file->meta == NULL) { |
1220 | 0 | if ((a_fs_file->meta = |
1221 | 0 | tsk_fs_meta_alloc(ISO9660_FILE_CONTENT_LEN)) == NULL) |
1222 | 0 | return 1; |
1223 | 0 | } |
1224 | 0 | else { |
1225 | 0 | tsk_fs_meta_reset(a_fs_file->meta); |
1226 | 0 | } |
1227 | | |
1228 | | // see if they are looking for the special "orphans" directory |
1229 | 0 | if (inum == TSK_FS_ORPHANDIR_INUM(fs)) { |
1230 | 0 | if (tsk_fs_dir_make_orphan_dir_meta(fs, a_fs_file->meta)) { |
1231 | 0 | return 1; |
1232 | 0 | } |
1233 | 0 | else { |
1234 | 0 | return 0; |
1235 | 0 | } |
1236 | 0 | } |
1237 | 0 | else { |
1238 | | /* allocate cache buffers */ |
1239 | | /* dinode */ |
1240 | 0 | dinode = (iso9660_inode *) tsk_malloc(sizeof(iso9660_inode)); |
1241 | 0 | if (dinode == NULL) { |
1242 | 0 | fs->tag = 0; |
1243 | 0 | iso9660_close(fs); |
1244 | 0 | return 1; |
1245 | 0 | } |
1246 | | |
1247 | | // load the inode into the ISO buffer |
1248 | 0 | if (iso9660_dinode_load(iso, inum, dinode)) { |
1249 | 0 | free(dinode); |
1250 | 0 | return 1; |
1251 | 0 | } |
1252 | | |
1253 | | // copy into the FS_META structure |
1254 | 0 | if (iso9660_dinode_copy(iso, a_fs_file->meta, inum, dinode)) { |
1255 | 0 | free(dinode); |
1256 | 0 | return 1; |
1257 | 0 | } |
1258 | 0 | } |
1259 | | |
1260 | 0 | free(dinode); |
1261 | 0 | return 0; |
1262 | 0 | } |
1263 | | |
1264 | | static uint8_t |
1265 | | iso9660_inode_walk(TSK_FS_INFO * fs, TSK_INUM_T start, TSK_INUM_T last, |
1266 | | TSK_FS_META_FLAG_ENUM flags, TSK_FS_META_WALK_CB action, void *ptr) |
1267 | 0 | { |
1268 | 0 | char *myname = "iso9660_inode_walk"; |
1269 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
1270 | 0 | TSK_INUM_T inum, end_inum_tmp; |
1271 | 0 | TSK_FS_FILE *fs_file; |
1272 | 0 | unsigned int myflags; |
1273 | 0 | iso9660_inode *dinode; |
1274 | | |
1275 | | // clean up any error messages that are lying around |
1276 | 0 | tsk_error_reset(); |
1277 | |
|
1278 | 0 | if (tsk_verbose) |
1279 | 0 | tsk_fprintf(stderr, "iso9660_inode_walk: " |
1280 | 0 | " start: %" PRIuINUM " last: %" PRIuINUM " flags: %d" |
1281 | 0 | " action: %" PRIu64 " ptr: %" PRIu64 "\n", |
1282 | 0 | start, last, flags, (uint64_t) action, (uint64_t) ptr); |
1283 | |
|
1284 | 0 | myflags = TSK_FS_META_FLAG_ALLOC; |
1285 | | |
1286 | | /* |
1287 | | * Sanity checks. |
1288 | | */ |
1289 | 0 | if (start < fs->first_inum || start > fs->last_inum) { |
1290 | 0 | tsk_error_reset(); |
1291 | 0 | tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); |
1292 | 0 | tsk_error_set_errstr("%s: Start inode: %" PRIuINUM "", myname, |
1293 | 0 | start); |
1294 | 0 | return 1; |
1295 | 0 | } |
1296 | 0 | if (last < fs->first_inum || last > fs->last_inum || last < start) { |
1297 | 0 | tsk_error_reset(); |
1298 | 0 | tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); |
1299 | 0 | tsk_error_set_errstr("%s: End inode: %" PRIuINUM "", myname, last); |
1300 | 0 | return 1; |
1301 | 0 | } |
1302 | | |
1303 | | /* If ORPHAN is wanted, then make sure that the flags are correct */ |
1304 | 0 | if (flags & TSK_FS_META_FLAG_ORPHAN) { |
1305 | 0 | flags |= TSK_FS_META_FLAG_UNALLOC; |
1306 | 0 | flags &= ~TSK_FS_META_FLAG_ALLOC; |
1307 | 0 | flags |= TSK_FS_META_FLAG_USED; |
1308 | 0 | flags &= ~TSK_FS_META_FLAG_UNUSED; |
1309 | 0 | } |
1310 | 0 | else if (((flags & TSK_FS_META_FLAG_ALLOC) == 0) && |
1311 | 0 | ((flags & TSK_FS_META_FLAG_UNALLOC) == 0)) { |
1312 | 0 | flags |= (TSK_FS_META_FLAG_ALLOC | TSK_FS_META_FLAG_UNALLOC); |
1313 | 0 | } |
1314 | | |
1315 | | /* If neither of the USED or UNUSED flags are set, then set them |
1316 | | * both |
1317 | | */ |
1318 | 0 | if (((flags & TSK_FS_META_FLAG_USED) == 0) && |
1319 | 0 | ((flags & TSK_FS_META_FLAG_UNUSED) == 0)) { |
1320 | 0 | flags |= (TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_UNUSED); |
1321 | 0 | } |
1322 | | |
1323 | | /* If we are looking for orphan files and have not yet filled |
1324 | | * in the list of unalloc inodes that are pointed to, then fill |
1325 | | * in the list |
1326 | | * */ |
1327 | 0 | if ((flags & TSK_FS_META_FLAG_ORPHAN)) { |
1328 | 0 | if (tsk_fs_dir_load_inum_named(fs) != TSK_OK) { |
1329 | 0 | tsk_error_errstr2_concat |
1330 | 0 | ("- iso9660_inode_walk: identifying inodes allocated by file names"); |
1331 | 0 | return 1; |
1332 | 0 | } |
1333 | 0 | } |
1334 | | |
1335 | | |
1336 | 0 | if ((fs_file = tsk_fs_file_alloc(fs)) == NULL) |
1337 | 0 | return 1; |
1338 | | |
1339 | 0 | if ((fs_file->meta = |
1340 | 0 | tsk_fs_meta_alloc(ISO9660_FILE_CONTENT_LEN)) == NULL) |
1341 | 0 | return 1; |
1342 | | |
1343 | | // we need to handle fs->last_inum specially because it is for the |
1344 | | // virtual ORPHANS directory. Handle it outside of the loop. |
1345 | 0 | if (last == TSK_FS_ORPHANDIR_INUM(fs)) |
1346 | 0 | end_inum_tmp = last - 1; |
1347 | 0 | else |
1348 | 0 | end_inum_tmp = last; |
1349 | | |
1350 | | /* allocate cache buffers */ |
1351 | | /* dinode */ |
1352 | 0 | dinode = (iso9660_inode *) tsk_malloc(sizeof(iso9660_inode)); |
1353 | 0 | if (dinode == NULL) { |
1354 | 0 | fs->tag = 0; |
1355 | 0 | iso9660_close(fs); |
1356 | 0 | return 1; |
1357 | 0 | } |
1358 | | /* |
1359 | | * Iterate. |
1360 | | */ |
1361 | 0 | for (inum = start; inum <= end_inum_tmp; inum++) { |
1362 | 0 | int retval; |
1363 | 0 | if (iso9660_dinode_load(iso, inum, dinode)) { |
1364 | 0 | tsk_fs_file_close(fs_file); |
1365 | 0 | free(dinode); |
1366 | 0 | return 1; |
1367 | 0 | } |
1368 | | |
1369 | 0 | if (iso9660_dinode_copy(iso, fs_file->meta, inum, dinode)) { |
1370 | 0 | free(dinode); |
1371 | 0 | return 1; |
1372 | 0 | } |
1373 | 0 | myflags = fs_file->meta->flags; |
1374 | |
|
1375 | 0 | if ((flags & myflags) != myflags) |
1376 | 0 | continue; |
1377 | | |
1378 | | /* If we want only orphans, then check if this |
1379 | | * inode is in the seen list |
1380 | | * */ |
1381 | 0 | if ((myflags & TSK_FS_META_FLAG_UNALLOC) && |
1382 | 0 | (flags & TSK_FS_META_FLAG_ORPHAN) && |
1383 | 0 | (tsk_fs_dir_find_inum_named(fs, inum))) { |
1384 | 0 | continue; |
1385 | 0 | } |
1386 | | |
1387 | 0 | retval = action(fs_file, ptr); |
1388 | 0 | if (retval == TSK_WALK_ERROR) { |
1389 | 0 | tsk_fs_file_close(fs_file); |
1390 | 0 | free(dinode); |
1391 | 0 | return 1; |
1392 | 0 | } |
1393 | 0 | else if (retval == TSK_WALK_STOP) { |
1394 | 0 | break; |
1395 | 0 | } |
1396 | 0 | } |
1397 | | |
1398 | | // handle the virtual orphans folder if they asked for it |
1399 | 0 | if ((last == TSK_FS_ORPHANDIR_INUM(fs)) |
1400 | 0 | && (flags & TSK_FS_META_FLAG_ALLOC) |
1401 | 0 | && (flags & TSK_FS_META_FLAG_USED)) { |
1402 | 0 | int retval; |
1403 | |
|
1404 | 0 | if (tsk_fs_dir_make_orphan_dir_meta(fs, fs_file->meta)) { |
1405 | 0 | tsk_fs_file_close(fs_file); |
1406 | 0 | free(dinode); |
1407 | 0 | return 1; |
1408 | 0 | } |
1409 | | /* call action */ |
1410 | 0 | retval = action(fs_file, ptr); |
1411 | 0 | if (retval == TSK_WALK_STOP) { |
1412 | 0 | tsk_fs_file_close(fs_file); |
1413 | 0 | free(dinode); |
1414 | 0 | return 0; |
1415 | 0 | } |
1416 | 0 | else if (retval == TSK_WALK_ERROR) { |
1417 | 0 | tsk_fs_file_close(fs_file); |
1418 | 0 | free(dinode); |
1419 | 0 | return 1; |
1420 | 0 | } |
1421 | 0 | } |
1422 | | |
1423 | | |
1424 | | /* |
1425 | | * Cleanup. |
1426 | | */ |
1427 | 0 | tsk_fs_file_close(fs_file); |
1428 | 0 | free(dinode); |
1429 | 0 | return 0; |
1430 | 0 | } |
1431 | | |
1432 | | // @@@ Doesn' this seem to ignore interleave? |
1433 | | /* return 1 if block is allocated in a file's extent, return 0 otherwise */ |
1434 | | static int |
1435 | | iso9660_is_block_alloc(TSK_FS_INFO * fs, TSK_DADDR_T blk_num) |
1436 | 0 | { |
1437 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
1438 | 0 | iso9660_inode_node *in_node; |
1439 | |
|
1440 | 0 | if (tsk_verbose) |
1441 | 0 | tsk_fprintf(stderr, "iso9660_is_block_alloc: " |
1442 | 0 | " blk_num: %" PRIuDADDR "\n", blk_num); |
1443 | |
|
1444 | 0 | for (in_node = iso->in_list; in_node; in_node = in_node->next) { |
1445 | 0 | TSK_DADDR_T first_block = in_node->offset / fs->block_size; |
1446 | 0 | TSK_DADDR_T file_size = |
1447 | 0 | tsk_getu32(fs->endian, in_node->inode.dr.data_len_m); |
1448 | 0 | TSK_DADDR_T last_block = |
1449 | 0 | first_block + (file_size / fs->block_size); |
1450 | 0 | if (file_size % fs->block_size) |
1451 | 0 | last_block++; |
1452 | |
|
1453 | 0 | if ((blk_num >= first_block) && (blk_num <= last_block)) |
1454 | 0 | return 1; |
1455 | 0 | } |
1456 | | |
1457 | 0 | return 0; |
1458 | 0 | } |
1459 | | |
1460 | | |
1461 | | static TSK_FS_BLOCK_FLAG_ENUM |
1462 | | iso9660_block_getflags(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr) |
1463 | 0 | { |
1464 | 0 | return (iso9660_is_block_alloc(a_fs, a_addr)) ? |
1465 | 0 | TSK_FS_BLOCK_FLAG_ALLOC : TSK_FS_BLOCK_FLAG_UNALLOC; |
1466 | 0 | } |
1467 | | |
1468 | | |
1469 | | /* flags: TSK_FS_BLOCK_FLAG_ALLOC and FS_FLAG_UNALLOC |
1470 | | * ISO9660 has a LOT of very sparse meta, so in this function a block is only |
1471 | | * checked to see if it is part of an inode's extent |
1472 | | */ |
1473 | | static uint8_t |
1474 | | iso9660_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T start, TSK_DADDR_T last, |
1475 | | TSK_FS_BLOCK_WALK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, |
1476 | | void *ptr) |
1477 | 0 | { |
1478 | 0 | char *myname = "iso9660_block_walk"; |
1479 | 0 | TSK_DADDR_T addr; |
1480 | 0 | TSK_FS_BLOCK *fs_block; |
1481 | | |
1482 | | // clean up any error messages that are lying around |
1483 | 0 | tsk_error_reset(); |
1484 | |
|
1485 | 0 | if (tsk_verbose) |
1486 | 0 | tsk_fprintf(stderr, "iso9660_block_walk: " |
1487 | 0 | " start: %" PRIuDADDR " last: %" PRIuDADDR " flags: %d" |
1488 | 0 | " action: %" PRIu64 " ptr: %" PRIu64 "\n", |
1489 | 0 | start, last, flags, (uint64_t) action, (uint64_t) ptr); |
1490 | | |
1491 | | /* |
1492 | | * Sanity checks. |
1493 | | */ |
1494 | 0 | if (start < fs->first_block || start > fs->last_block) { |
1495 | 0 | tsk_error_reset(); |
1496 | 0 | tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); |
1497 | 0 | tsk_error_set_errstr("%s: Start block: %" PRIuDADDR "", myname, |
1498 | 0 | start); |
1499 | 0 | return 1; |
1500 | 0 | } |
1501 | 0 | if (last < fs->first_block || last > fs->last_block) { |
1502 | 0 | tsk_error_reset(); |
1503 | 0 | tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); |
1504 | 0 | tsk_error_set_errstr("%s: End block: %" PRIuDADDR "", myname, |
1505 | 0 | last); |
1506 | 0 | return 1; |
1507 | 0 | } |
1508 | | |
1509 | | /* Sanity check on flags -- make sure at least one ALLOC is set */ |
1510 | 0 | if (((flags & TSK_FS_BLOCK_WALK_FLAG_ALLOC) == 0) && |
1511 | 0 | ((flags & TSK_FS_BLOCK_WALK_FLAG_UNALLOC) == 0)) { |
1512 | 0 | flags |= |
1513 | 0 | (TSK_FS_BLOCK_WALK_FLAG_ALLOC | |
1514 | 0 | TSK_FS_BLOCK_WALK_FLAG_UNALLOC); |
1515 | 0 | } |
1516 | 0 | if (((flags & TSK_FS_BLOCK_WALK_FLAG_META) == 0) && |
1517 | 0 | ((flags & TSK_FS_BLOCK_WALK_FLAG_CONT) == 0)) { |
1518 | 0 | flags |= |
1519 | 0 | (TSK_FS_BLOCK_WALK_FLAG_CONT | TSK_FS_BLOCK_WALK_FLAG_META); |
1520 | 0 | } |
1521 | |
|
1522 | 0 | if ((fs_block = tsk_fs_block_alloc(fs)) == NULL) { |
1523 | 0 | return 1; |
1524 | 0 | } |
1525 | | |
1526 | 0 | if (tsk_verbose) |
1527 | 0 | tsk_fprintf(stderr, |
1528 | 0 | "isofs_block_walk: Block Walking %" PRIuDADDR " to %" PRIuDADDR |
1529 | 0 | "\n", start, last); |
1530 | | |
1531 | | /* cycle through block addresses */ |
1532 | 0 | for (addr = start; addr <= last; addr++) { |
1533 | 0 | int retval; |
1534 | 0 | int myflags = iso9660_block_getflags(fs, addr); |
1535 | | |
1536 | | // test if we should call the callback with this one |
1537 | 0 | if ((myflags & TSK_FS_BLOCK_FLAG_ALLOC) |
1538 | 0 | && (!(flags & TSK_FS_BLOCK_WALK_FLAG_ALLOC))) |
1539 | 0 | continue; |
1540 | 0 | else if ((myflags & TSK_FS_BLOCK_FLAG_UNALLOC) |
1541 | 0 | && (!(flags & TSK_FS_BLOCK_WALK_FLAG_UNALLOC))) |
1542 | 0 | continue; |
1543 | | |
1544 | 0 | if (flags & TSK_FS_BLOCK_WALK_FLAG_AONLY) |
1545 | 0 | myflags |= TSK_FS_BLOCK_FLAG_AONLY; |
1546 | |
|
1547 | 0 | if (tsk_fs_block_get_flag(fs, fs_block, addr, myflags) == NULL) { |
1548 | 0 | tsk_error_set_errstr2("iso_block_walk"); |
1549 | 0 | tsk_fs_block_free(fs_block); |
1550 | 0 | return 1; |
1551 | 0 | } |
1552 | | |
1553 | 0 | retval = action(fs_block, ptr); |
1554 | 0 | if (retval == TSK_WALK_ERROR) { |
1555 | 0 | tsk_fs_block_free(fs_block); |
1556 | 0 | return 1; |
1557 | 0 | } |
1558 | 0 | else if (retval == TSK_WALK_STOP) { |
1559 | 0 | break; |
1560 | 0 | } |
1561 | 0 | } |
1562 | | |
1563 | 0 | tsk_fs_block_free(fs_block); |
1564 | 0 | return 0; |
1565 | 0 | } |
1566 | | |
1567 | | |
1568 | | |
1569 | | static uint8_t |
1570 | | iso9660_make_data_run(TSK_FS_FILE * a_fs_file) |
1571 | 0 | { |
1572 | 0 | ISO_INFO *iso; |
1573 | 0 | iso9660_dentry dd; |
1574 | 0 | TSK_FS_INFO *fs = NULL; |
1575 | 0 | TSK_FS_ATTR *fs_attr = NULL; |
1576 | 0 | TSK_FS_ATTR_RUN *data_run = NULL; |
1577 | 0 | iso9660_inode *dinode; |
1578 | | |
1579 | | // clean up any error messages that are lying around |
1580 | 0 | tsk_error_reset(); |
1581 | |
|
1582 | 0 | if ((a_fs_file == NULL) || (a_fs_file->meta == NULL) |
1583 | 0 | || (a_fs_file->fs_info == NULL)) { |
1584 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
1585 | 0 | tsk_error_set_errstr |
1586 | 0 | ("iso9660_make_data_run: fs_file or meta is NULL"); |
1587 | 0 | return 1; |
1588 | 0 | } |
1589 | 0 | fs = a_fs_file->fs_info; |
1590 | 0 | iso = (ISO_INFO *) fs; |
1591 | | |
1592 | | // see if we have already loaded the runs |
1593 | 0 | if ((a_fs_file->meta->attr != NULL) |
1594 | 0 | && (a_fs_file->meta->attr_state == TSK_FS_META_ATTR_STUDIED)) { |
1595 | 0 | return 0; |
1596 | 0 | } |
1597 | 0 | else if (a_fs_file->meta->attr_state == TSK_FS_META_ATTR_ERROR) { |
1598 | 0 | return 1; |
1599 | 0 | } |
1600 | | |
1601 | | // not sure why this would ever happen, but... |
1602 | 0 | if (a_fs_file->meta->attr != NULL) { |
1603 | 0 | tsk_fs_attrlist_markunused(a_fs_file->meta->attr); |
1604 | 0 | } |
1605 | 0 | else { |
1606 | 0 | a_fs_file->meta->attr = tsk_fs_attrlist_alloc(); |
1607 | 0 | } |
1608 | | |
1609 | | /* allocate cache buffers */ |
1610 | | /* dinode */ |
1611 | 0 | if ((dinode = |
1612 | 0 | (iso9660_inode *) tsk_malloc(sizeof(iso9660_inode))) == NULL) { |
1613 | 0 | fs->tag = 0; |
1614 | 0 | iso9660_close(fs); |
1615 | 0 | return 1; |
1616 | 0 | } |
1617 | | |
1618 | | // copy the raw data |
1619 | 0 | if (iso9660_dinode_load(iso, a_fs_file->meta->addr, dinode)) { |
1620 | 0 | tsk_error_set_errstr2("iso9660_make_data_run"); |
1621 | 0 | a_fs_file->meta->attr_state = TSK_FS_META_ATTR_ERROR; |
1622 | 0 | free(dinode); |
1623 | 0 | return 1; |
1624 | 0 | } |
1625 | 0 | memcpy(&dd, &dinode->dr, sizeof(iso9660_dentry)); |
1626 | 0 | free(dinode); |
1627 | 0 | dinode = NULL; |
1628 | |
|
1629 | 0 | if (dd.gap_sz) { |
1630 | 0 | a_fs_file->meta->attr_state = TSK_FS_META_ATTR_ERROR; |
1631 | 0 | tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); |
1632 | 0 | tsk_error_set_errstr("file %" PRIuINUM |
1633 | 0 | " has an interleave gap -- not supported", |
1634 | 0 | a_fs_file->meta->addr); |
1635 | 0 | return 1; |
1636 | 0 | } |
1637 | | |
1638 | 0 | if ((fs_attr = |
1639 | 0 | tsk_fs_attrlist_getnew(a_fs_file->meta->attr, |
1640 | 0 | TSK_FS_ATTR_NONRES)) == NULL) { |
1641 | 0 | return 1; |
1642 | 0 | } |
1643 | | |
1644 | | // make a non-resident run |
1645 | 0 | data_run = tsk_fs_attr_run_alloc(); |
1646 | 0 | if (data_run == NULL) { |
1647 | 0 | return -1; |
1648 | 0 | } |
1649 | 0 | data_run->addr = ((TSK_DADDR_T *) a_fs_file->meta->content_ptr)[0]; |
1650 | 0 | data_run->len = |
1651 | 0 | (a_fs_file->meta->size + fs->block_size - 1) / fs->block_size; |
1652 | 0 | data_run->offset = 0; |
1653 | | |
1654 | | // initialize the data run |
1655 | 0 | if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run, NULL, |
1656 | 0 | TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, |
1657 | 0 | a_fs_file->meta->size, a_fs_file->meta->size, |
1658 | 0 | roundup(a_fs_file->meta->size + dd.ext_len, |
1659 | 0 | fs->block_size) - dd.ext_len, 0, 0)) { |
1660 | 0 | return 1; |
1661 | 0 | } |
1662 | | |
1663 | | // the first bytes in the run could be allocated for the extended attribute. |
1664 | 0 | fs_attr->nrd.skiplen = dd.ext_len; |
1665 | |
|
1666 | 0 | a_fs_file->meta->attr_state = TSK_FS_META_ATTR_STUDIED; |
1667 | |
|
1668 | 0 | return 0; |
1669 | 0 | } |
1670 | | |
1671 | | |
1672 | | |
1673 | | static uint8_t |
1674 | | iso9660_fscheck(TSK_FS_INFO * fs, FILE * hFile) |
1675 | 0 | { |
1676 | 0 | tsk_error_reset(); |
1677 | 0 | tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); |
1678 | 0 | tsk_error_set_errstr("fscheck not implemented for iso9660 yet"); |
1679 | 0 | return 1; |
1680 | 0 | } |
1681 | | |
1682 | | /** |
1683 | | * Print details about the file system to a file handle. |
1684 | | * |
1685 | | * @param fs File system to print details on |
1686 | | * @param hFile File handle to print text to |
1687 | | * |
1688 | | * @returns 1 on error and 0 on success |
1689 | | */ |
1690 | | static uint8_t |
1691 | | iso9660_fsstat(TSK_FS_INFO * fs, FILE * hFile) |
1692 | 0 | { |
1693 | 0 | char str[129]; /* store name of publisher/preparer/etc */ |
1694 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
1695 | 0 | char *cp; |
1696 | 0 | int i; |
1697 | |
|
1698 | 0 | iso9660_pvd_node *p = iso->pvd; |
1699 | 0 | iso9660_svd_node *s; |
1700 | | |
1701 | | // clean up any error messages that are lying around |
1702 | 0 | tsk_error_reset(); |
1703 | |
|
1704 | 0 | if (tsk_verbose) |
1705 | 0 | tsk_fprintf(stderr, "iso9660_fsstat:\n"); |
1706 | |
|
1707 | 0 | i = 0; |
1708 | |
|
1709 | 0 | for (p = iso->pvd; p != NULL; p = p->next) { |
1710 | 0 | i++; |
1711 | 0 | tsk_fprintf(hFile, "\n=== PRIMARY VOLUME DESCRIPTOR %d ===\n", i); |
1712 | 0 | tsk_fprintf(hFile, "FILE SYSTEM INFORMATION\n"); |
1713 | 0 | tsk_fprintf(hFile, |
1714 | 0 | "--------------------------------------------\n"); |
1715 | 0 | tsk_fprintf(hFile, "File System Type: ISO9660\n"); |
1716 | 0 | tsk_fprintf(hFile, "Volume Name: %s\n", p->pvd.vol_id); |
1717 | 0 | tsk_fprintf(hFile, "Volume Set Size: %d\n", |
1718 | 0 | tsk_getu16(fs->endian, p->pvd.vol_set_m)); |
1719 | 0 | tsk_fprintf(hFile, "Volume Set Sequence: %d\n", |
1720 | 0 | tsk_getu16(fs->endian, p->pvd.vol_seq_m)); |
1721 | | |
1722 | | /* print publisher */ |
1723 | 0 | if (p->pvd.pub_id[0] == 0x5f) |
1724 | | /* publisher is in a file. TODO: handle this properly */ |
1725 | 0 | snprintf(str, 8, "In file\n"); |
1726 | 0 | else |
1727 | 0 | snprintf(str, 128, "%s", p->pvd.pub_id); |
1728 | |
|
1729 | 0 | cp = &str[127]; |
1730 | | /* find last printable non space character */ |
1731 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1732 | 0 | cp--; |
1733 | 0 | *++cp = '\0'; |
1734 | 0 | tsk_fprintf(hFile, "Publisher: %s\n", str); |
1735 | 0 | memset(str, ' ', 128); |
1736 | | |
1737 | | |
1738 | | /* print data preparer */ |
1739 | 0 | if (p->pvd.prep_id[0] == 0x5f) |
1740 | | /* preparer is in a file. TODO: handle this properly */ |
1741 | 0 | snprintf(str, 8, "In file\n"); |
1742 | 0 | else |
1743 | 0 | snprintf(str, 128, "%s", p->pvd.prep_id); |
1744 | |
|
1745 | 0 | cp = &str[127]; |
1746 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1747 | 0 | cp--; |
1748 | 0 | *++cp = '\0'; |
1749 | 0 | tsk_fprintf(hFile, "Data Preparer: %s\n", str); |
1750 | 0 | memset(str, ' ', 128); |
1751 | | |
1752 | | |
1753 | | /* print recording application */ |
1754 | 0 | if (p->pvd.app_id[0] == 0x5f) |
1755 | | /* application is in a file. TODO: handle this properly */ |
1756 | 0 | snprintf(str, 8, "In file\n"); |
1757 | 0 | else |
1758 | 0 | snprintf(str, 128, "%s", p->pvd.app_id); |
1759 | 0 | cp = &str[127]; |
1760 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1761 | 0 | cp--; |
1762 | 0 | *++cp = '\0'; |
1763 | 0 | tsk_fprintf(hFile, "Recording Application: %s\n", str); |
1764 | 0 | memset(str, ' ', 128); |
1765 | | |
1766 | | |
1767 | | /* print copyright */ |
1768 | 0 | if (p->pvd.copy_id[0] == 0x5f) |
1769 | | /* copyright is in a file. TODO: handle this properly */ |
1770 | 0 | snprintf(str, 8, "In file\n"); |
1771 | 0 | else |
1772 | 0 | snprintf(str, 37, "%s", p->pvd.copy_id); |
1773 | 0 | cp = &str[36]; |
1774 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1775 | 0 | cp--; |
1776 | 0 | *++cp = '\0'; |
1777 | 0 | tsk_fprintf(hFile, "Copyright: %s\n", str); |
1778 | 0 | memset(str, ' ', 37); |
1779 | |
|
1780 | 0 | tsk_fprintf(hFile, "\nMETADATA INFORMATION\n"); |
1781 | 0 | tsk_fprintf(hFile, |
1782 | 0 | "--------------------------------------------\n"); |
1783 | 0 | tsk_fprintf(hFile, |
1784 | 0 | "Path Table Location: %" PRIu32 "-%" PRIu32 "\n", |
1785 | 0 | tsk_getu32(fs->endian, p->pvd.pt_loc_m), tsk_getu32(fs->endian, |
1786 | 0 | p->pvd.pt_loc_m) + tsk_getu32(fs->endian, |
1787 | 0 | p->pvd.pt_size_m) / fs->block_size); |
1788 | |
|
1789 | 0 | tsk_fprintf(hFile, "Inode Range: %" PRIuINUM " - %" PRIuINUM "\n", |
1790 | 0 | fs->first_inum, fs->last_inum); |
1791 | 0 | tsk_fprintf(hFile, "Root Directory Block: %" PRIuDADDR "\n", |
1792 | 0 | tsk_getu32(fs->endian, p->pvd.dir_rec.ext_loc_m)); |
1793 | |
|
1794 | 0 | tsk_fprintf(hFile, "\nCONTENT INFORMATION\n"); |
1795 | 0 | tsk_fprintf(hFile, |
1796 | 0 | "--------------------------------------------\n"); |
1797 | 0 | tsk_fprintf(hFile, "Sector Size: %d\n", ISO9660_SSIZE_B); |
1798 | 0 | tsk_fprintf(hFile, "Block Size: %d\n", tsk_getu16(fs->endian, |
1799 | 0 | p->pvd.blk_sz_m)); |
1800 | 0 | if (fs->block_pre_size) { |
1801 | 0 | tsk_fprintf(hFile, "Raw CD pre-block size: %d\n", |
1802 | 0 | fs->block_pre_size); |
1803 | 0 | tsk_fprintf(hFile, "Raw CD post-block size: %d\n", |
1804 | 0 | fs->block_post_size); |
1805 | 0 | } |
1806 | |
|
1807 | 0 | tsk_fprintf(hFile, "Total Sector Range: 0 - %d\n", |
1808 | 0 | (int) ((fs->block_size / ISO9660_SSIZE_B) * |
1809 | 0 | (fs->block_count - 1))); |
1810 | | /* get image slack, ignore how big the image claims itself to be */ |
1811 | 0 | tsk_fprintf(hFile, "Total Block Range: 0 - %d\n", |
1812 | 0 | (int) fs->block_count - 1); |
1813 | 0 | } |
1814 | |
|
1815 | 0 | i = 0; |
1816 | |
|
1817 | 0 | for (s = iso->svd; s != NULL; s = s->next) { |
1818 | 0 | i++; |
1819 | 0 | tsk_fprintf(hFile, |
1820 | 0 | "\n=== SUPPLEMENTARY VOLUME DESCRIPTOR %d ===\n", i); |
1821 | 0 | tsk_fprintf(hFile, "FILE SYSTEM INFORMATION\n"); |
1822 | 0 | tsk_fprintf(hFile, |
1823 | 0 | "--------------------------------------------\n"); |
1824 | 0 | tsk_fprintf(hFile, "File System Type: ISO9660\n"); |
1825 | 0 | tsk_fprintf(hFile, "Volume Name: %s\n", s->svd.vol_id); |
1826 | 0 | tsk_fprintf(hFile, "Volume Set Size: %d\n", |
1827 | 0 | tsk_getu16(fs->endian, s->svd.vol_set_m)); |
1828 | 0 | tsk_fprintf(hFile, "Volume Set Sequence: %d\n", |
1829 | 0 | tsk_getu16(fs->endian, s->svd.vol_seq_m)); |
1830 | | |
1831 | | |
1832 | | |
1833 | | /* print publisher */ |
1834 | 0 | if (s->svd.pub_id[0] == 0x5f) |
1835 | | /* publisher is in a file. TODO: handle this properly */ |
1836 | 0 | snprintf(str, 8, "In file\n"); |
1837 | 0 | else |
1838 | 0 | snprintf(str, 128, "%s", s->svd.pub_id); |
1839 | |
|
1840 | 0 | cp = &str[127]; |
1841 | | /* find last printable non space character */ |
1842 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1843 | 0 | cp--; |
1844 | 0 | *++cp = '\0'; |
1845 | 0 | tsk_fprintf(hFile, "Publisher: %s\n", str); |
1846 | 0 | memset(str, ' ', 128); |
1847 | | |
1848 | | |
1849 | | /* print data preparer */ |
1850 | 0 | if (s->svd.prep_id[0] == 0x5f) |
1851 | | /* preparer is in a file. TODO: handle this properly */ |
1852 | 0 | snprintf(str, 8, "In file\n"); |
1853 | 0 | else |
1854 | 0 | snprintf(str, 128, "%s", s->svd.prep_id); |
1855 | |
|
1856 | 0 | cp = &str[127]; |
1857 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1858 | 0 | cp--; |
1859 | 0 | *++cp = '\0'; |
1860 | 0 | tsk_fprintf(hFile, "Data Preparer: %s\n", str); |
1861 | 0 | memset(str, ' ', 128); |
1862 | | |
1863 | | |
1864 | | /* print recording application */ |
1865 | 0 | if (s->svd.app_id[0] == 0x5f) |
1866 | | /* application is in a file. TODO: handle this properly */ |
1867 | 0 | snprintf(str, 8, "In file\n"); |
1868 | 0 | else |
1869 | 0 | snprintf(str, 128, "%s", s->svd.app_id); |
1870 | 0 | cp = &str[127]; |
1871 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1872 | 0 | cp--; |
1873 | 0 | *++cp = '\0'; |
1874 | 0 | tsk_fprintf(hFile, "Recording Application: %s\n", str); |
1875 | 0 | memset(str, ' ', 128); |
1876 | | |
1877 | | |
1878 | | /* print copyright */ |
1879 | 0 | if (s->svd.copy_id[0] == 0x5f) |
1880 | | /* copyright is in a file. TODO: handle this properly */ |
1881 | 0 | snprintf(str, 8, "In file\n"); |
1882 | 0 | else |
1883 | 0 | snprintf(str, 37, "%s\n", s->svd.copy_id); |
1884 | 0 | cp = &str[36]; |
1885 | 0 | while ((!isprint(*cp) || isspace(*cp)) && (cp != str)) |
1886 | 0 | cp--; |
1887 | 0 | *++cp = '\0'; |
1888 | 0 | tsk_fprintf(hFile, "Copyright: %s\n", str); |
1889 | 0 | memset(str, ' ', 37); |
1890 | |
|
1891 | 0 | tsk_fprintf(hFile, "\nMETADATA INFORMATION\n"); |
1892 | 0 | tsk_fprintf(hFile, |
1893 | 0 | "--------------------------------------------\n"); |
1894 | 0 | tsk_fprintf(hFile, |
1895 | 0 | "Path Table Location: %" PRIu32 "-%" PRIu32 "\n", |
1896 | 0 | tsk_getu32(fs->endian, s->svd.pt_loc_m), tsk_getu32(fs->endian, |
1897 | 0 | s->svd.pt_loc_m) + tsk_getu32(fs->endian, |
1898 | 0 | s->svd.pt_size_m) / fs->block_size); |
1899 | |
|
1900 | 0 | tsk_fprintf(hFile, "Root Directory Block: %" PRIuDADDR "\n", |
1901 | 0 | tsk_getu32(fs->endian, s->svd.dir_rec.ext_loc_m)); |
1902 | | |
1903 | | /* learn joliet level (1-3) */ |
1904 | 0 | if (!strncmp((char *) s->svd.esc_seq, "%/E", 3)) |
1905 | 0 | tsk_fprintf(hFile, "Joliet Name Encoding: UCS-2 Level 3\n"); |
1906 | 0 | if (!strncmp((char *) s->svd.esc_seq, "%/C", 3)) |
1907 | 0 | tsk_fprintf(hFile, "Joliet Name Encoding: UCS-2 Level 2\n"); |
1908 | 0 | if (!strncmp((char *) s->svd.esc_seq, "%/@", 3)) |
1909 | 0 | tsk_fprintf(hFile, "Joliet Name Encoding: UCS-2 Level 1\n"); |
1910 | 0 | if (iso->rr_found) |
1911 | 0 | tsk_fprintf(hFile, "RockRidge Extensions present\n"); |
1912 | | |
1913 | |
|
1914 | 0 | tsk_fprintf(hFile, "\nCONTENT INFORMATION\n"); |
1915 | 0 | tsk_fprintf(hFile, |
1916 | 0 | "--------------------------------------------\n"); |
1917 | 0 | tsk_fprintf(hFile, "Sector Size: %d\n", ISO9660_SSIZE_B); |
1918 | 0 | tsk_fprintf(hFile, "Block Size: %d\n", fs->block_size); |
1919 | |
|
1920 | 0 | tsk_fprintf(hFile, "Total Sector Range: 0 - %d\n", |
1921 | 0 | (int) ((fs->block_size / ISO9660_SSIZE_B) * |
1922 | 0 | (fs->block_count - 1))); |
1923 | | /* get image slack, ignore how big the image claims itself to be */ |
1924 | 0 | tsk_fprintf(hFile, "Total Block Range: 0 - %d\n", |
1925 | 0 | (int) fs->block_count - 1); |
1926 | 0 | } |
1927 | |
|
1928 | 0 | return 0; |
1929 | 0 | } |
1930 | | |
1931 | | |
1932 | | /** |
1933 | | * Make a unix-style permissions string based the flags in dentry and |
1934 | | * the cached inode in fs, storing results in perm. Caller must |
1935 | | * ensure perm can hold 10 chars plus one null char. |
1936 | | */ |
1937 | | static char * |
1938 | | make_unix_perm(TSK_FS_INFO * fs, iso9660_dentry * dd, |
1939 | | iso9660_inode * dinode, char *perm) |
1940 | 0 | { |
1941 | 0 | if (tsk_verbose) |
1942 | 0 | tsk_fprintf(stderr, "make_unix_perm: fs: %" PRIu64 |
1943 | 0 | " dd: %" PRIu64 "\n", (uint64_t) fs, (uint64_t) dd); |
1944 | |
|
1945 | 0 | memset(perm, '-', 10); |
1946 | 0 | perm[10] = '\0'; |
1947 | |
|
1948 | 0 | if (dd->flags & ISO9660_FLAG_DIR) |
1949 | 0 | perm[0] = 'd'; |
1950 | |
|
1951 | 0 | if (dinode->ea) { |
1952 | 0 | if (tsk_getu16(fs->endian, dinode->ea->mode) & ISO9660_BIT_UR) |
1953 | 0 | perm[1] = 'r'; |
1954 | |
|
1955 | 0 | if (tsk_getu16(fs->endian, dinode->ea->mode) & ISO9660_BIT_UX) |
1956 | 0 | perm[3] = 'x'; |
1957 | |
|
1958 | 0 | if (tsk_getu16(fs->endian, dinode->ea->mode) & ISO9660_BIT_GR) |
1959 | 0 | perm[4] = 'r'; |
1960 | |
|
1961 | 0 | if (tsk_getu16(fs->endian, dinode->ea->mode) & ISO9660_BIT_GX) |
1962 | 0 | perm[6] = 'x'; |
1963 | |
|
1964 | 0 | if (tsk_getu16(fs->endian, dinode->ea->mode) & ISO9660_BIT_AR) |
1965 | 0 | perm[7] = 'r'; |
1966 | |
|
1967 | 0 | if (tsk_getu16(fs->endian, dinode->ea->mode) & ISO9660_BIT_AX) |
1968 | 0 | perm[9] = 'x'; |
1969 | 0 | } |
1970 | 0 | else { |
1971 | 0 | strcpy(&perm[1], "r-xr-xr-x"); |
1972 | 0 | } |
1973 | |
|
1974 | 0 | return perm; |
1975 | 0 | } |
1976 | | |
1977 | | #if 0 |
1978 | | static void |
1979 | | iso9660_print_rockridge(FILE * hFile, rockridge_ext * rr) |
1980 | | { |
1981 | | char mode_buf[11]; |
1982 | | |
1983 | | tsk_fprintf(hFile, "\nROCKRIDGE EXTENSIONS\n"); |
1984 | | |
1985 | | tsk_fprintf(hFile, "Owner-ID: "); |
1986 | | tsk_fprintf(hFile, "%d\t", (int) rr->uid); |
1987 | | |
1988 | | tsk_fprintf(hFile, "Group-ID: "); |
1989 | | tsk_fprintf(hFile, "%d\n", (int) rr->gid); |
1990 | | |
1991 | | tsk_fprintf(hFile, "Mode: "); |
1992 | | memset(mode_buf, '-', 11); |
1993 | | mode_buf[10] = '\0'; |
1994 | | |
1995 | | /* file type */ |
1996 | | /* note: socket and symbolic link are multi bit fields */ |
1997 | | if ((rr->mode & MODE_IFSOCK) == MODE_IFSOCK) |
1998 | | mode_buf[0] = 's'; |
1999 | | else if ((rr->mode & MODE_IFLNK) == MODE_IFLNK) |
2000 | | mode_buf[0] = 'l'; |
2001 | | else if (rr->mode & MODE_IFDIR) |
2002 | | mode_buf[0] = 'd'; |
2003 | | else if (rr->mode & MODE_IFIFO) |
2004 | | mode_buf[0] = 'p'; |
2005 | | else if (rr->mode & MODE_IFBLK) |
2006 | | mode_buf[0] = 'b'; |
2007 | | else if (rr->mode & MODE_IFCHR) |
2008 | | mode_buf[0] = 'c'; |
2009 | | |
2010 | | /* owner permissions */ |
2011 | | if (rr->mode & TSK_FS_META_MODE_IRUSR) |
2012 | | mode_buf[1] = 'r'; |
2013 | | if (rr->mode & TSK_FS_META_MODE_IWUSR) |
2014 | | mode_buf[2] = 'w'; |
2015 | | |
2016 | | if ((rr->mode & TSK_FS_META_MODE_IXUSR) |
2017 | | && (rr->mode & TSK_FS_META_MODE_ISUID)) |
2018 | | mode_buf[3] = 's'; |
2019 | | else if (rr->mode & TSK_FS_META_MODE_IXUSR) |
2020 | | mode_buf[3] = 'x'; |
2021 | | else if (rr->mode & TSK_FS_META_MODE_ISUID) |
2022 | | mode_buf[3] = 'S'; |
2023 | | |
2024 | | /* group permissions */ |
2025 | | if (rr->mode & TSK_FS_META_MODE_IRGRP) |
2026 | | mode_buf[4] = 'r'; |
2027 | | if (rr->mode & TSK_FS_META_MODE_IWGRP) |
2028 | | mode_buf[5] = 'w'; |
2029 | | |
2030 | | if ((rr->mode & TSK_FS_META_MODE_IXGRP) |
2031 | | && (rr->mode & TSK_FS_META_MODE_ISGID)) |
2032 | | mode_buf[6] = 's'; |
2033 | | else if (rr->mode & TSK_FS_META_MODE_IXGRP) |
2034 | | mode_buf[6] = 'x'; |
2035 | | else if (rr->mode & TSK_FS_META_MODE_ISGID) |
2036 | | mode_buf[6] = 'S'; |
2037 | | |
2038 | | /* other permissions */ |
2039 | | if (rr->mode & TSK_FS_META_MODE_IROTH) |
2040 | | mode_buf[7] = 'r'; |
2041 | | if (rr->mode & TSK_FS_META_MODE_IWOTH) |
2042 | | mode_buf[8] = 'w'; |
2043 | | |
2044 | | if ((rr->mode & TSK_FS_META_MODE_IXOTH) |
2045 | | && (rr->mode & TSK_FS_META_MODE_ISVTX)) |
2046 | | mode_buf[9] = 't'; |
2047 | | else if (rr->mode & TSK_FS_META_MODE_IXOTH) |
2048 | | mode_buf[9] = 'x'; |
2049 | | else if (rr->mode & TSK_FS_META_MODE_ISVTX) |
2050 | | mode_buf[9] = 'T'; |
2051 | | |
2052 | | tsk_fprintf(hFile, "%s\n", mode_buf); |
2053 | | tsk_fprintf(hFile, "Number links: %" PRIu32 "\n", rr->nlink); |
2054 | | |
2055 | | tsk_fprintf(hFile, "Alternate name: %s\n", rr->fn); |
2056 | | tsk_fprintf(hFile, "\n"); |
2057 | | } |
2058 | | #endif |
2059 | | |
2060 | | /** |
2061 | | * Print details on a specific file to a file handle. |
2062 | | * |
2063 | | * @param fs File system file is located in |
2064 | | * @param hFile File handle to print text to |
2065 | | * @param inum Address of file in file system |
2066 | | * @param numblock The number of blocks in file to force print (can go beyond file size) |
2067 | | * @param sec_skew Clock skew in seconds to also print times in |
2068 | | * |
2069 | | * @returns 1 on error and 0 on success |
2070 | | */ |
2071 | | static uint8_t |
2072 | | iso9660_istat(TSK_FS_INFO * fs, TSK_FS_ISTAT_FLAG_ENUM istat_flags, FILE * hFile, TSK_INUM_T inum, |
2073 | | TSK_DADDR_T numblock, int32_t sec_skew) |
2074 | 0 | { |
2075 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
2076 | 0 | TSK_FS_FILE *fs_file; |
2077 | 0 | iso9660_dentry dd; |
2078 | 0 | iso9660_inode *dinode; |
2079 | 0 | char timeBuf[128]; |
2080 | | |
2081 | | // clean up any error messages that are lying around |
2082 | 0 | tsk_error_reset(); |
2083 | |
|
2084 | 0 | if ((fs_file = tsk_fs_file_open_meta(fs, NULL, inum)) == NULL) |
2085 | 0 | return 1; |
2086 | | |
2087 | 0 | tsk_fprintf(hFile, "Entry: %" PRIuINUM "\n", inum); |
2088 | | |
2089 | | /* allocate cache buffers */ |
2090 | | /* dinode */ |
2091 | 0 | dinode = (iso9660_inode *) tsk_malloc(sizeof(iso9660_inode)); |
2092 | 0 | if (dinode == NULL) { |
2093 | 0 | fs->tag = 0; |
2094 | 0 | iso9660_close(fs); |
2095 | 0 | return 1; |
2096 | 0 | } |
2097 | | |
2098 | 0 | if (iso9660_dinode_load(iso, inum, dinode)) { |
2099 | 0 | tsk_error_set_errstr2("iso9660_istat"); |
2100 | 0 | tsk_fs_file_close(fs_file); |
2101 | 0 | free(dinode); |
2102 | 0 | return 1; |
2103 | 0 | } |
2104 | 0 | memcpy(&dd, &dinode->dr, sizeof(iso9660_dentry)); |
2105 | |
|
2106 | 0 | tsk_fprintf(hFile, "Type: "); |
2107 | 0 | if (dd.flags & ISO9660_FLAG_DIR) |
2108 | 0 | tsk_fprintf(hFile, "Directory\n"); |
2109 | 0 | else |
2110 | 0 | tsk_fprintf(hFile, "File\n"); |
2111 | |
|
2112 | 0 | tsk_fprintf(hFile, "Links: %d\n", fs_file->meta->nlink); |
2113 | |
|
2114 | 0 | if (dd.gap_sz > 0) { |
2115 | 0 | tsk_fprintf(hFile, "Interleave Gap Size: %d\n", dd.gap_sz); |
2116 | 0 | tsk_fprintf(hFile, "Interleave File Unit Size: %d\n", dd.unit_sz); |
2117 | 0 | } |
2118 | |
|
2119 | 0 | tsk_fprintf(hFile, "Flags: "); |
2120 | |
|
2121 | 0 | if (dd.flags & ISO9660_FLAG_HIDE) |
2122 | 0 | tsk_fprintf(hFile, "Hidden, "); |
2123 | |
|
2124 | 0 | if (dd.flags & ISO9660_FLAG_ASSOC) |
2125 | 0 | tsk_fprintf(hFile, "Associated, "); |
2126 | |
|
2127 | 0 | if (dd.flags & ISO9660_FLAG_RECORD) |
2128 | 0 | tsk_fprintf(hFile, "Record Format, "); |
2129 | |
|
2130 | 0 | if (dd.flags & ISO9660_FLAG_PROT) |
2131 | 0 | tsk_fprintf(hFile, "Protected, "); |
2132 | | |
2133 | | /* check if reserved bits are set, be suspicious */ |
2134 | 0 | if (dd.flags & ISO9660_FLAG_RES1) |
2135 | 0 | tsk_fprintf(hFile, "Reserved1, "); |
2136 | |
|
2137 | 0 | if (dd.flags & ISO9660_FLAG_RES2) |
2138 | 0 | tsk_fprintf(hFile, "Reserved2, "); |
2139 | |
|
2140 | 0 | if (dd.flags & ISO9660_FLAG_MULT) |
2141 | 0 | tsk_fprintf(hFile, "Non-final multi-extent entry"); |
2142 | 0 | putchar('\n'); |
2143 | |
|
2144 | 0 | tsk_fprintf(hFile, "Name: %s\n", dinode->fn); |
2145 | 0 | tsk_fprintf(hFile, "Size: %" PRIu32 "\n", tsk_getu32(fs->endian, |
2146 | 0 | dinode->dr.data_len_m)); |
2147 | |
|
2148 | 0 | if (dinode->ea) { |
2149 | 0 | char perm_buf[11]; |
2150 | 0 | tsk_fprintf(hFile, "\nEXTENDED ATTRIBUTE INFO\n"); |
2151 | 0 | tsk_fprintf(hFile, "Owner-ID: %" PRIu32 "\n", |
2152 | 0 | tsk_getu32(fs->endian, dinode->ea->uid)); |
2153 | 0 | tsk_fprintf(hFile, "Group-ID: %" PRIu32 "\n", |
2154 | 0 | tsk_getu32(fs->endian, dinode->ea->gid)); |
2155 | 0 | tsk_fprintf(hFile, "Mode: %s\n", make_unix_perm(fs, &dd, dinode, |
2156 | 0 | perm_buf)); |
2157 | 0 | } |
2158 | 0 | else if (dinode->susp_off) { |
2159 | 0 | char *buf2 = (char *) tsk_malloc((size_t) dinode->susp_len); |
2160 | 0 | if (buf2 != NULL) { |
2161 | 0 | ssize_t cnt; |
2162 | 0 | fprintf(hFile, "\nRock Ridge Extension Data\n"); |
2163 | 0 | cnt = |
2164 | 0 | tsk_fs_read(fs, dinode->susp_off, buf2, |
2165 | 0 | (size_t) dinode->susp_len); |
2166 | |
|
2167 | 0 | rockridge_ext *rr_entry = NULL; |
2168 | 0 | if (cnt == dinode->susp_len) { |
2169 | 0 | rr_entry = parse_susp(fs, buf2, (int) cnt, hFile, 0); |
2170 | 0 | } |
2171 | 0 | if (rr_entry == NULL) { |
2172 | 0 | fprintf(hFile, "Error reading Rock Ridge Location\n"); |
2173 | 0 | if (tsk_verbose) { |
2174 | 0 | fprintf(stderr, |
2175 | 0 | "istat: error reading rock ridge entry\n"); |
2176 | 0 | tsk_error_print(stderr); |
2177 | 0 | } |
2178 | 0 | tsk_error_reset(); |
2179 | 0 | } |
2180 | 0 | free(buf2); |
2181 | 0 | } |
2182 | 0 | else { |
2183 | 0 | if (tsk_verbose) |
2184 | 0 | fprintf(stderr, |
2185 | 0 | "istat: error allocating memory to process rock ridge entry\n"); |
2186 | 0 | tsk_error_reset(); |
2187 | 0 | } |
2188 | 0 | } |
2189 | | //else if (iso->dinode->rr) { |
2190 | | // iso9660_print_rockridge(hFile, iso->dinode->rr); |
2191 | | //} |
2192 | 0 | else { |
2193 | 0 | char perm_buf[11]; |
2194 | 0 | tsk_fprintf(hFile, "Owner-ID: 0\n"); |
2195 | 0 | tsk_fprintf(hFile, "Group-ID: 0\n"); |
2196 | 0 | tsk_fprintf(hFile, "Mode: %s\n", make_unix_perm(fs, &dd, dinode, |
2197 | 0 | perm_buf)); |
2198 | 0 | } |
2199 | |
|
2200 | 0 | if (sec_skew != 0) { |
2201 | 0 | tsk_fprintf(hFile, "\nAdjusted File Times:\n"); |
2202 | 0 | if (fs_file->meta->mtime) |
2203 | 0 | fs_file->meta->mtime -= sec_skew; |
2204 | 0 | if (fs_file->meta->atime) |
2205 | 0 | fs_file->meta->atime -= sec_skew; |
2206 | 0 | if (fs_file->meta->crtime) |
2207 | 0 | fs_file->meta->crtime -= sec_skew; |
2208 | |
|
2209 | 0 | tsk_fprintf(hFile, "Written:\t%s\n", |
2210 | 0 | tsk_fs_time_to_str(fs_file->meta->mtime, timeBuf)); |
2211 | 0 | tsk_fprintf(hFile, "Accessed:\t%s\n", |
2212 | 0 | tsk_fs_time_to_str(fs_file->meta->atime, timeBuf)); |
2213 | 0 | tsk_fprintf(hFile, "Created:\t%s\n", |
2214 | 0 | tsk_fs_time_to_str(fs_file->meta->crtime, timeBuf)); |
2215 | |
|
2216 | 0 | if (fs_file->meta->mtime) |
2217 | 0 | fs_file->meta->mtime += sec_skew; |
2218 | 0 | if (fs_file->meta->atime) |
2219 | 0 | fs_file->meta->atime += sec_skew; |
2220 | 0 | if (fs_file->meta->crtime) |
2221 | 0 | fs_file->meta->crtime += sec_skew; |
2222 | | |
2223 | |
|
2224 | 0 | tsk_fprintf(hFile, "\nOriginal File Times:\n"); |
2225 | 0 | } |
2226 | 0 | else { |
2227 | 0 | tsk_fprintf(hFile, "\nFile Times:\n"); |
2228 | 0 | } |
2229 | |
|
2230 | 0 | tsk_fprintf(hFile, "Created:\t%s\n", |
2231 | 0 | tsk_fs_time_to_str(fs_file->meta->crtime, timeBuf)); |
2232 | 0 | tsk_fprintf(hFile, "File Modified:\t%s\n", |
2233 | 0 | tsk_fs_time_to_str(fs_file->meta->mtime, timeBuf)); |
2234 | 0 | tsk_fprintf(hFile, "Accessed:\t%s\n", |
2235 | 0 | tsk_fs_time_to_str(fs_file->meta->atime, timeBuf)); |
2236 | |
|
2237 | 0 | tsk_fprintf(hFile, "\nSectors:\n"); |
2238 | 0 | if (istat_flags & TSK_FS_ISTAT_RUNLIST) { |
2239 | 0 | const TSK_FS_ATTR *fs_attr_default = |
2240 | 0 | tsk_fs_file_attr_get_type(fs_file, |
2241 | 0 | TSK_FS_ATTR_TYPE_DEFAULT, 0, 0); |
2242 | 0 | if (fs_attr_default && (fs_attr_default->flags & TSK_FS_ATTR_NONRES)) { |
2243 | 0 | if (tsk_fs_attr_print(fs_attr_default, hFile)) { |
2244 | 0 | tsk_fprintf(hFile, "\nError creating run lists\n"); |
2245 | 0 | tsk_error_print(hFile); |
2246 | 0 | tsk_error_reset(); |
2247 | 0 | } |
2248 | 0 | } |
2249 | 0 | } |
2250 | 0 | else { |
2251 | | /* since blocks are all contiguous, print them here to simplify file_walk */ |
2252 | | |
2253 | 0 | int block = tsk_getu32(fs->endian, dinode->dr.ext_loc_m); |
2254 | 0 | TSK_OFF_T size = fs_file->meta->size; |
2255 | 0 | int rowcount = 0; |
2256 | |
|
2257 | 0 | while ((int64_t) size > 0) { |
2258 | 0 | tsk_fprintf(hFile, "%d ", block++); |
2259 | 0 | size -= fs->block_size; |
2260 | 0 | rowcount++; |
2261 | 0 | if (rowcount == 8) { |
2262 | 0 | rowcount = 0; |
2263 | 0 | tsk_fprintf(hFile, "\n"); |
2264 | 0 | } |
2265 | 0 | } |
2266 | 0 | tsk_fprintf(hFile, "\n"); |
2267 | 0 | } |
2268 | |
|
2269 | 0 | tsk_fs_file_close(fs_file); |
2270 | 0 | free(dinode); |
2271 | 0 | return 0; |
2272 | 0 | } |
2273 | | |
2274 | | |
2275 | | |
2276 | | |
2277 | | static uint8_t |
2278 | | iso9660_jopen(TSK_FS_INFO * fs, TSK_INUM_T inum) |
2279 | 0 | { |
2280 | 0 | tsk_error_reset(); |
2281 | 0 | tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); |
2282 | 0 | tsk_error_set_errstr("ISO9660 does not have a journal"); |
2283 | 0 | return 1; |
2284 | 0 | } |
2285 | | |
2286 | | static uint8_t |
2287 | | iso9660_jentry_walk(TSK_FS_INFO * fs, int flags, |
2288 | | TSK_FS_JENTRY_WALK_CB action, void *ptr) |
2289 | 0 | { |
2290 | 0 | tsk_error_reset(); |
2291 | 0 | tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); |
2292 | 0 | tsk_error_set_errstr("ISO9660 does not have a journal"); |
2293 | 0 | return 1; |
2294 | 0 | } |
2295 | | |
2296 | | static uint8_t |
2297 | | iso9660_jblk_walk(TSK_FS_INFO * fs, TSK_DADDR_T start, TSK_DADDR_T end, |
2298 | | int flags, TSK_FS_JBLK_WALK_CB action, void *ptr) |
2299 | 0 | { |
2300 | 0 | tsk_error_reset(); |
2301 | 0 | tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); |
2302 | 0 | tsk_error_set_errstr("ISO9660 does not have a journal"); |
2303 | 0 | return 1; |
2304 | 0 | } |
2305 | | |
2306 | | |
2307 | | static TSK_FS_ATTR_TYPE_ENUM |
2308 | | iso9660_get_default_attr_type(const TSK_FS_FILE * a_file) |
2309 | 0 | { |
2310 | 0 | return TSK_FS_ATTR_TYPE_DEFAULT; |
2311 | 0 | } |
2312 | | |
2313 | | /** Load the volume descriptors into save the raw data structures in |
2314 | | * the file system state structure (fs). Also determines the block size. |
2315 | | * |
2316 | | * This is useful for discs which may have 2 volumes on them (no, not |
2317 | | * multisession CD-R/CD-RW). |
2318 | | * Design note: If path table address is the same, then you have the same image. |
2319 | | * Only store unique image info. |
2320 | | * Uses a linked list even though Ecma-119 says there is only 1 primary vol |
2321 | | * desc, consider possibility of more. |
2322 | | * |
2323 | | * Returns -1 on error and 0 on success |
2324 | | */ |
2325 | | static int |
2326 | | load_vol_desc(TSK_FS_INFO * fs) |
2327 | 0 | { |
2328 | 0 | int count = 0; |
2329 | 0 | ISO_INFO *iso = (ISO_INFO *) fs; |
2330 | 0 | TSK_OFF_T offs; |
2331 | 0 | char *myname = "iso_load_vol_desc"; |
2332 | 0 | ssize_t cnt; |
2333 | 0 | iso9660_pvd_node *p; |
2334 | 0 | iso9660_svd_node *s; |
2335 | 0 | uint8_t magic_seen = 0; |
2336 | |
|
2337 | 0 | iso->pvd = NULL; |
2338 | 0 | iso->svd = NULL; |
2339 | | //fs->block_size = 0; |
2340 | 0 | fs->dev_bsize = fs->img_info->sector_size; |
2341 | |
|
2342 | | #if 0 |
2343 | | b = (iso_bootrec *) tsk_malloc(sizeof(iso_bootrec)); |
2344 | | if (b == NULL) { |
2345 | | return -1; |
2346 | | } |
2347 | | #endif |
2348 | | |
2349 | | // @@@ Technically, we should seek ahea 16 * sector size |
2350 | 0 | for (offs = ISO9660_SBOFF;; offs += sizeof(iso9660_gvd)) { |
2351 | 0 | iso9660_gvd *vd; |
2352 | | |
2353 | | // allocate a buffer the size of the nodes in the linked list |
2354 | | // this will be stored in ISO_INFO, so it is not always freed here |
2355 | 0 | if ((vd = |
2356 | 0 | (iso9660_gvd *) tsk_malloc(sizeof(iso9660_pvd_node))) == |
2357 | 0 | NULL) { |
2358 | 0 | return -1; |
2359 | 0 | } |
2360 | | |
2361 | 0 | ISO_RETRY_MAGIC: |
2362 | | |
2363 | | // read the full descriptor |
2364 | 0 | cnt = tsk_fs_read(fs, offs, (char *) vd, sizeof(iso9660_gvd)); |
2365 | 0 | if (cnt != sizeof(iso9660_gvd)) { |
2366 | 0 | if (cnt >= 0) { |
2367 | 0 | tsk_error_reset(); |
2368 | 0 | tsk_error_set_errno(TSK_ERR_FS_READ); |
2369 | 0 | } |
2370 | 0 | tsk_error_set_errstr2("iso_load_vol_desc: Error reading"); |
2371 | 0 | free(vd); |
2372 | 0 | return -1; |
2373 | 0 | } |
2374 | | |
2375 | | // verify the magic value |
2376 | 0 | if (strncmp(vd->magic, ISO9660_MAGIC, 5)) { |
2377 | 0 | if (tsk_verbose) |
2378 | 0 | tsk_fprintf(stderr, |
2379 | 0 | "%s: Bad volume descriptor: Magic number is not CD001\n", |
2380 | 0 | myname); |
2381 | | |
2382 | | // see if we have a RAW image |
2383 | 0 | if (magic_seen == 0) { |
2384 | 0 | if (fs->block_pre_size == 0) { |
2385 | 0 | if (tsk_verbose) |
2386 | 0 | tsk_fprintf(stderr, |
2387 | 0 | "Trying RAW ISO9660 with 16-byte pre-block size\n"); |
2388 | 0 | fs->block_pre_size = 16; |
2389 | 0 | fs->block_post_size = 288; |
2390 | 0 | goto ISO_RETRY_MAGIC; |
2391 | 0 | } |
2392 | 0 | else if (fs->block_pre_size == 16) { |
2393 | 0 | if (tsk_verbose) |
2394 | 0 | tsk_fprintf(stderr, |
2395 | 0 | "Trying RAW ISO9660 with 24-byte pre-block size\n"); |
2396 | 0 | fs->block_pre_size = 24; |
2397 | 0 | fs->block_post_size = 280; |
2398 | 0 | goto ISO_RETRY_MAGIC; |
2399 | 0 | } |
2400 | 0 | else { |
2401 | 0 | fs->block_pre_size = 0; |
2402 | 0 | fs->block_post_size = 0; |
2403 | 0 | } |
2404 | 0 | } |
2405 | 0 | free(vd); |
2406 | 0 | return -1; |
2407 | 0 | } |
2408 | 0 | magic_seen = 1; |
2409 | | |
2410 | | // see if we are done |
2411 | 0 | if (vd->type == ISO9660_VOL_DESC_SET_TERM) { |
2412 | 0 | free(vd); |
2413 | 0 | break; |
2414 | 0 | } |
2415 | | |
2416 | 0 | switch (vd->type) { |
2417 | | |
2418 | 0 | case ISO9660_PRIM_VOL_DESC: |
2419 | 0 | p = (iso9660_pvd_node *) vd; |
2420 | | |
2421 | | /* list not empty */ |
2422 | 0 | if (iso->pvd) { |
2423 | 0 | iso9660_pvd_node *ptmp = iso->pvd; |
2424 | | /* append to list if path table address not found in list */ |
2425 | 0 | while ((p->pvd.pt_loc_l != ptmp->pvd.pt_loc_l) |
2426 | 0 | && (ptmp->next)) |
2427 | 0 | ptmp = ptmp->next; |
2428 | | |
2429 | | // we already have it |
2430 | 0 | if (p->pvd.pt_loc_l == ptmp->pvd.pt_loc_l) { |
2431 | 0 | free(vd); |
2432 | 0 | p = NULL; |
2433 | 0 | vd = NULL; |
2434 | 0 | } |
2435 | 0 | else { |
2436 | 0 | ptmp->next = p; |
2437 | 0 | p->next = NULL; |
2438 | 0 | count++; |
2439 | 0 | } |
2440 | 0 | } |
2441 | | |
2442 | | /* list empty, insert */ |
2443 | 0 | else { |
2444 | 0 | iso->pvd = p; |
2445 | 0 | p->next = NULL; |
2446 | 0 | count++; |
2447 | 0 | } |
2448 | |
|
2449 | 0 | break; |
2450 | | |
2451 | 0 | case ISO9660_SUPP_VOL_DESC: |
2452 | 0 | s = (iso9660_svd_node *) vd; |
2453 | | |
2454 | | /* list not empty */ |
2455 | 0 | if (iso->svd) { |
2456 | 0 | iso9660_svd_node *stmp = iso->svd; |
2457 | | /* append to list if path table address not found in list */ |
2458 | 0 | while ((s->svd.pt_loc_l != stmp->svd.pt_loc_l) |
2459 | 0 | && (stmp->next)) |
2460 | 0 | stmp = stmp->next; |
2461 | | |
2462 | | // we already have it |
2463 | 0 | if (s->svd.pt_loc_l == stmp->svd.pt_loc_l) { |
2464 | 0 | free(vd); |
2465 | 0 | s = NULL; |
2466 | 0 | vd = NULL; |
2467 | 0 | } |
2468 | 0 | else { |
2469 | 0 | stmp->next = s; |
2470 | 0 | s->next = NULL; |
2471 | 0 | count++; |
2472 | 0 | } |
2473 | 0 | } |
2474 | | |
2475 | | /* list empty, insert */ |
2476 | 0 | else { |
2477 | 0 | iso->svd = s; |
2478 | 0 | s->next = NULL; |
2479 | 0 | count++; |
2480 | 0 | } |
2481 | |
|
2482 | 0 | break; |
2483 | | |
2484 | | /* boot records are just read and discarded for now... */ |
2485 | 0 | case ISO9660_BOOT_RECORD: |
2486 | 0 | free(vd); |
2487 | | #if 0 |
2488 | | cnt = tsk_fs_read(fs, offs, (char *) b, sizeof(iso_bootrec)); |
2489 | | if (cnt != sizeof(iso_bootrec)) { |
2490 | | if (cnt >= 0) { |
2491 | | tsk_error_reset(); |
2492 | | tsk_error_set_errno(TSK_ERR_FS_READ); |
2493 | | } |
2494 | | tsk_error_set_errstr2("iso_load_vol_desc: Error reading"); |
2495 | | return -1; |
2496 | | } |
2497 | | offs += sizeof(iso_bootrec); |
2498 | | #endif |
2499 | 0 | break; |
2500 | | |
2501 | 0 | default: |
2502 | 0 | free(vd); |
2503 | 0 | break; |
2504 | 0 | } |
2505 | 0 | } |
2506 | | |
2507 | | |
2508 | | /* now that we have all primary and supplementary volume descs, we should cull the list of */ |
2509 | | /* primary that match up with supplems, since supplem has all info primary has plus more. */ |
2510 | | /* this will make jobs such as searching all volumes easier later */ |
2511 | 0 | for (s = iso->svd; s != NULL; s = s->next) { |
2512 | 0 | for (p = iso->pvd; p != NULL; p = p->next) { |
2513 | | // see if they have the same starting address |
2514 | 0 | if (tsk_getu32(fs->endian, |
2515 | 0 | p->pvd.pt_loc_m) == tsk_getu32(fs->endian, |
2516 | 0 | s->svd.pt_loc_m)) { |
2517 | | // see if it is the head of the list |
2518 | 0 | if (p == iso->pvd) { |
2519 | 0 | iso->pvd = p->next; |
2520 | 0 | } |
2521 | 0 | else { |
2522 | 0 | iso9660_pvd_node *ptmp = iso->pvd; |
2523 | 0 | while (ptmp->next != p) |
2524 | 0 | ptmp = ptmp->next; |
2525 | 0 | ptmp->next = p->next; |
2526 | 0 | } |
2527 | 0 | p->next = NULL; |
2528 | 0 | free(p); |
2529 | 0 | p = NULL; |
2530 | 0 | count--; |
2531 | 0 | break; |
2532 | 0 | } |
2533 | 0 | } |
2534 | 0 | } |
2535 | |
|
2536 | 0 | if ((iso->pvd == NULL) && (iso->svd == NULL)) { |
2537 | 0 | tsk_error_reset(); |
2538 | 0 | tsk_error_set_errno(TSK_ERR_FS_MAGIC); |
2539 | 0 | tsk_error_set_errstr |
2540 | 0 | ("load_vol_desc: primary and secondary volume descriptors null"); |
2541 | 0 | return -1; |
2542 | 0 | } |
2543 | | |
2544 | | |
2545 | 0 | return 0; |
2546 | 0 | } |
2547 | | |
2548 | | |
2549 | | /* iso9660_open - |
2550 | | * opens an iso9660 filesystem. |
2551 | | * Design note: This function doesn't read a superblock, since iso9660 doesnt |
2552 | | * really have one. Volume info is read in with a call to load_vol_descs(). |
2553 | | */ |
2554 | | TSK_FS_INFO * |
2555 | | iso9660_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset, |
2556 | | TSK_FS_TYPE_ENUM ftype, uint8_t test) |
2557 | 0 | { |
2558 | 0 | ISO_INFO *iso; |
2559 | 0 | TSK_FS_INFO *fs; |
2560 | 0 | uint8_t tmpguess[4]; |
2561 | |
|
2562 | 0 | if (TSK_FS_TYPE_ISISO9660(ftype) == 0) { |
2563 | 0 | tsk_error_reset(); |
2564 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
2565 | 0 | tsk_error_set_errstr("Invalid FS type in iso9660_open"); |
2566 | 0 | return NULL; |
2567 | 0 | } |
2568 | | |
2569 | 0 | if (img_info->sector_size == 0) { |
2570 | 0 | tsk_error_reset(); |
2571 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
2572 | 0 | tsk_error_set_errstr("iso9660_open: sector size is 0"); |
2573 | 0 | return NULL; |
2574 | 0 | } |
2575 | | |
2576 | 0 | if (tsk_verbose) { |
2577 | 0 | tsk_fprintf(stderr, "iso9660_open img_info: %" PRIu64 |
2578 | 0 | " ftype: %" PRIu8 " test: %" PRIu8 "\n", (uint64_t) img_info, |
2579 | 0 | ftype, test); |
2580 | 0 | } |
2581 | |
|
2582 | 0 | if ((iso = (ISO_INFO *) tsk_fs_malloc(sizeof(ISO_INFO))) == NULL) { |
2583 | 0 | return NULL; |
2584 | 0 | } |
2585 | 0 | fs = &(iso->fs_info); |
2586 | |
|
2587 | 0 | iso->rr_found = 0; |
2588 | 0 | iso->in_list = NULL; |
2589 | |
|
2590 | 0 | fs->ftype = TSK_FS_TYPE_ISO9660; |
2591 | 0 | fs->duname = "Block"; |
2592 | 0 | fs->flags = 0; |
2593 | 0 | fs->tag = TSK_FS_INFO_TAG; |
2594 | 0 | fs->img_info = img_info; |
2595 | 0 | fs->offset = offset; |
2596 | | |
2597 | | |
2598 | | /* ISO has no magic to calibrate the endian ordering on and it |
2599 | | * stores all numbers in big and small endian. We will use the big |
2600 | | * endian order so load up a 4-byte array and flags. We could hardwire |
2601 | | * the definition, but I would rather use guessu32 in case I later add |
2602 | | * other initialization data to that function (since all other FSs use |
2603 | | * it) */ |
2604 | 0 | tmpguess[0] = 0; |
2605 | 0 | tmpguess[1] = 0; |
2606 | 0 | tmpguess[2] = 0; |
2607 | 0 | tmpguess[3] = 1; |
2608 | 0 | tsk_fs_guessu32(fs, tmpguess, 1); |
2609 | | |
2610 | | // we need a value here to test for RAW images. So, start with 2048 |
2611 | 0 | fs->block_size = 2048; |
2612 | | |
2613 | | /* load_vol_descs checks magic value */ |
2614 | 0 | if (load_vol_desc(fs) == -1) { |
2615 | 0 | fs->tag = 0; |
2616 | 0 | iso9660_close(fs); |
2617 | 0 | if (tsk_verbose) |
2618 | 0 | fprintf(stderr, |
2619 | 0 | "iso9660_open: Error loading volume descriptor\n"); |
2620 | 0 | if (test) |
2621 | 0 | return NULL; |
2622 | 0 | else { |
2623 | 0 | tsk_error_reset(); |
2624 | 0 | tsk_error_set_errno(TSK_ERR_FS_MAGIC); |
2625 | 0 | tsk_error_set_errstr("Invalid FS type in iso9660_open"); |
2626 | 0 | return NULL; |
2627 | 0 | } |
2628 | 0 | } |
2629 | | |
2630 | 0 | if (iso->pvd) { |
2631 | 0 | fs->block_size = tsk_getu16(fs->endian, iso->pvd->pvd.blk_sz_m); |
2632 | 0 | fs->block_count = tsk_getu32(fs->endian, iso->pvd->pvd.vs_sz_m); |
2633 | | |
2634 | | /* Volume ID */ |
2635 | 0 | for (fs->fs_id_used = 0; fs->fs_id_used < 32; fs->fs_id_used++) { |
2636 | 0 | fs->fs_id[fs->fs_id_used] = |
2637 | 0 | iso->pvd->pvd.vol_id[fs->fs_id_used]; |
2638 | 0 | } |
2639 | |
|
2640 | 0 | } |
2641 | 0 | else { |
2642 | 0 | fs->block_size = tsk_getu16(fs->endian, iso->svd->svd.blk_sz_m); |
2643 | 0 | fs->block_count = tsk_getu32(fs->endian, iso->svd->svd.vs_sz_m); |
2644 | | |
2645 | | /* Volume ID */ |
2646 | 0 | for (fs->fs_id_used = 0; fs->fs_id_used < 32; fs->fs_id_used++) { |
2647 | 0 | fs->fs_id[fs->fs_id_used] = |
2648 | 0 | iso->svd->svd.vol_id[fs->fs_id_used]; |
2649 | 0 | } |
2650 | 0 | } |
2651 | | |
2652 | | /* We have seen this case on an image that seemed to be only |
2653 | | * setting blk_siz_l instead of both blk_sz_m and _l. We should |
2654 | | * support both in the future, but this prevents a crash later |
2655 | | * on when we divide by block_size. */ |
2656 | 0 | if (fs->block_size == 0) { |
2657 | 0 | fs->tag = 0; |
2658 | 0 | iso9660_close(fs); |
2659 | 0 | if (tsk_verbose) |
2660 | 0 | fprintf(stderr, "iso9660_open: Block size is 0\n"); |
2661 | 0 | if (test) |
2662 | 0 | return NULL; |
2663 | 0 | else { |
2664 | 0 | tsk_error_reset(); |
2665 | 0 | tsk_error_set_errno(TSK_ERR_FS_MAGIC); |
2666 | 0 | tsk_error_set_errstr("Block size is 0"); |
2667 | 0 | return NULL; |
2668 | 0 | } |
2669 | 0 | } |
2670 | | |
2671 | 0 | fs->first_block = 0; |
2672 | 0 | fs->last_block = fs->last_block_act = fs->block_count - 1; |
2673 | | |
2674 | | // determine the last block we have in this image |
2675 | 0 | if ((TSK_DADDR_T) ((img_info->size - offset) / fs->block_size) < |
2676 | 0 | fs->block_count) |
2677 | 0 | fs->last_block_act = |
2678 | 0 | (img_info->size - offset) / fs->block_size - 1; |
2679 | |
|
2680 | 0 | fs->inum_count = iso9660_load_inodes_pt(iso); |
2681 | 0 | if ((int) fs->inum_count == -1) { |
2682 | 0 | fs->tag = 0; |
2683 | 0 | iso9660_close(fs); |
2684 | 0 | if (tsk_verbose) |
2685 | 0 | fprintf(stderr, "iso9660_open: Error loading primary table\n"); |
2686 | 0 | return NULL; |
2687 | 0 | } |
2688 | 0 | fs->inum_count++; // account for the orphan directory |
2689 | |
|
2690 | 0 | fs->last_inum = fs->inum_count - 1; |
2691 | 0 | fs->first_inum = ISO9660_FIRSTINO; |
2692 | 0 | fs->root_inum = ISO9660_ROOTINO; |
2693 | | |
2694 | |
|
2695 | 0 | fs->inode_walk = iso9660_inode_walk; |
2696 | 0 | fs->block_walk = iso9660_block_walk; |
2697 | 0 | fs->block_getflags = iso9660_block_getflags; |
2698 | |
|
2699 | 0 | fs->get_default_attr_type = iso9660_get_default_attr_type; |
2700 | 0 | fs->load_attrs = iso9660_make_data_run; |
2701 | |
|
2702 | 0 | fs->file_add_meta = iso9660_inode_lookup; |
2703 | 0 | fs->dir_open_meta = iso9660_dir_open_meta; |
2704 | 0 | fs->fsstat = iso9660_fsstat; |
2705 | 0 | fs->fscheck = iso9660_fscheck; |
2706 | 0 | fs->istat = iso9660_istat; |
2707 | 0 | fs->close = iso9660_close; |
2708 | 0 | fs->name_cmp = iso9660_name_cmp; |
2709 | |
|
2710 | 0 | fs->jblk_walk = iso9660_jblk_walk; |
2711 | 0 | fs->jentry_walk = iso9660_jentry_walk; |
2712 | 0 | fs->jopen = iso9660_jopen; |
2713 | |
|
2714 | 0 | return fs; |
2715 | 0 | } |