/src/sleuthkit/tsk/base/tsk_endian.c
Line | Count | Source |
1 | | /* |
2 | | * The Sleuth Kit |
3 | | * |
4 | | * Brian Carrier [carrier <at> sleuthkit [dot] org] |
5 | | * Copyright (c) 2003-2011 Brian Carrier. All rights reserved |
6 | | * |
7 | | * Copyright (c) 2002 Brian Carrier, @stake Inc. All rights reserved |
8 | | * |
9 | | * This software is distributed under the Common Public License 1.0 |
10 | | * |
11 | | */ |
12 | | |
13 | | #include "tsk_base_i.h" |
14 | | |
15 | | /** \file tsk_endian.c |
16 | | * Contains the routines to read data in different endian orderings. |
17 | | */ |
18 | | |
19 | | /* A temporary data structure with an endian field */ |
20 | | typedef struct { |
21 | | uint8_t endian; |
22 | | } tmp_ds; |
23 | | |
24 | | /** \internal |
25 | | * Analyze an array of bytes and compare it to a target value to |
26 | | * determine which byte order the array is stored in. |
27 | | * |
28 | | * @param flag Pointer to location where proper endian flag should be stored. |
29 | | * @param x Pointer to array of bytes to analyze. |
30 | | * @param val Target value to compare to |
31 | | * @returns 1 if match cannot be made, 0 if it can. |
32 | | */ |
33 | | uint8_t |
34 | | tsk_guess_end_u16(TSK_ENDIAN_ENUM * flag, uint8_t * x, uint16_t val) |
35 | 100k | { |
36 | | /* try little */ |
37 | 100k | if (tsk_getu16(TSK_LIT_ENDIAN, x) == val) { |
38 | 10.1k | *flag = TSK_LIT_ENDIAN; |
39 | 10.1k | return 0; |
40 | 10.1k | } |
41 | | |
42 | | /* ok, big now */ |
43 | 90.5k | if (tsk_getu16(TSK_BIG_ENDIAN, x) == val) { |
44 | 28.4k | *flag = TSK_BIG_ENDIAN; |
45 | 28.4k | return 0; |
46 | 28.4k | } |
47 | | |
48 | | /* didn't find it */ |
49 | 62.1k | return 1; |
50 | 90.5k | } |
51 | | |
52 | | /** \internal |
53 | | * same idea as tsk_guess_end_u16 except that val is a 32-bit value |
54 | | * |
55 | | * @param flag Pointer to location where proper endian flag should be stored. |
56 | | * @param x Pointer to array of bytes to analyze. |
57 | | * @param val Target value to compare to |
58 | | * @returns 1 if match cannot be made, 0 if it can. |
59 | | */ |
60 | | uint8_t |
61 | | tsk_guess_end_u32(TSK_ENDIAN_ENUM * flag, uint8_t * x, uint32_t val) |
62 | 1.54k | { |
63 | | /* try little */ |
64 | 1.54k | if (tsk_getu32(TSK_LIT_ENDIAN, x) == val) { |
65 | 0 | *flag = TSK_LIT_ENDIAN; |
66 | 0 | return 0; |
67 | 0 | } |
68 | | |
69 | | /* ok, big now */ |
70 | 1.54k | if (tsk_getu32(TSK_BIG_ENDIAN, x) == val) { |
71 | 1.54k | *flag = TSK_BIG_ENDIAN; |
72 | 1.54k | return 0; |
73 | 1.54k | } |
74 | | |
75 | 0 | return 1; |
76 | 1.54k | } |
77 | | |
78 | | /** \internal |
79 | | * same idea as tsk_guess_end_u16 except that val is a 64-bit value |
80 | | * |
81 | | * @param flag Pointer to location where proper endian flag should be stored. |
82 | | * @param x Pointer to array of bytes to analyze. |
83 | | * @param val Target value to compare to |
84 | | * @returns 1 if match cannot be made, 0 if it can. |
85 | | */ |
86 | | uint8_t |
87 | | tsk_guess_end_u64(TSK_ENDIAN_ENUM * flag, uint8_t * x, uint64_t val) |
88 | 25.2k | { |
89 | | /* try little */ |
90 | 25.2k | if (tsk_getu64(TSK_LIT_ENDIAN, x) == val) { |
91 | 5.20k | *flag = TSK_LIT_ENDIAN; |
92 | 5.20k | return 0; |
93 | 5.20k | } |
94 | | |
95 | | /* ok, big now */ |
96 | 20.0k | if (tsk_getu64(TSK_BIG_ENDIAN, x) == val) { |
97 | 17.5k | *flag = TSK_BIG_ENDIAN; |
98 | 17.5k | return 0; |
99 | 17.5k | } |
100 | | |
101 | 2.50k | return 1; |
102 | 20.0k | } |