_Z8mem_openPKhm: 55| 3|TSK_IMG_INFO *mem_open(const uint8_t *data, size_t size) { 56| 3| IMG_MEM_INFO *inmemory_img = 57| 3| reinterpret_cast(malloc(sizeof(IMG_MEM_INFO))); 58| 3| TSK_IMG_INFO *img; 59| 3| if (inmemory_img == nullptr) { ------------------ | Branch (59:7): [True: 0, False: 3] ------------------ 60| 0| return nullptr; 61| 0| } 62| 3| img = reinterpret_cast(inmemory_img); 63| 3| img->itype = TSK_IMG_TYPE_RAW; 64| 3| img->read = mem_read; 65| 3| img->close = mem_close; 66| 3| img->imgstat = mem_imgstat; 67| 3| img->size = size; 68| 3| img->sector_size = 512; 69| 3| tsk_init_lock(&(img->cache_lock)); 70| 3| inmemory_img->data = data; 71| 3| inmemory_img->size = size; 72| 3| return img; 73| 3|} sleuthkit_fls_fuzzer.cc:_ZL8mem_readP12TSK_IMG_INFOlPcm: 30| 2| size_t len) { 31| 2| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 32| | // Bounds-checking exists in the real drivers. 33| 2| if (offset > mem_info->size) { ------------------ | Branch (33:7): [True: 0, False: 2] ------------------ 34| 0| return -1; 35| 0| } 36| 2| ssize_t read_len = len; 37| 2| if (offset + len > mem_info->size) { ------------------ | Branch (37:7): [True: 0, False: 2] ------------------ 38| 0| read_len = mem_info->size - offset; 39| 0| } 40| 2| if (memcpy(buf, mem_info->data + offset, read_len) == nullptr) { ------------------ | Branch (40:7): [True: 0, False: 2] ------------------ 41| 0| return -1; 42| 2| } else { 43| 2| return read_len; 44| 2| } 45| 2|} sleuthkit_fls_fuzzer.cc:_ZL9mem_closeP12TSK_IMG_INFO: 47| 3|static void mem_close(TSK_IMG_INFO *img_info) { 48| 3| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 49| 3| tsk_deinit_lock(&(img_info->cache_lock)); 50| 3| free(mem_info); 51| 3|} _Z14hexDigitToCharc: 85| 256|{ 86| 256| if (ch > 47 && ch < 58) ------------------ | Branch (86:7): [True: 256, False: 0] | Branch (86:18): [True: 148, False: 108] ------------------ 87| 148| return ch - 48; 88| | 89| 108| if (ch > 96 && ch < 103) ------------------ | Branch (89:7): [True: 108, False: 0] | Branch (89:18): [True: 108, False: 0] ------------------ 90| 108| return ch - 87; 91| | 92| 0| if (ch > 64 && ch < 71) ------------------ | Branch (92:7): [True: 0, False: 0] | Branch (92:18): [True: 0, False: 0] ------------------ 93| 0| return ch - 55; 94| | 95| 0| return 0; 96| 0|} _Z13hexPairToCharcc: 100| 128|{ 101| 128| return hexDigitToChar(a) * 16 + hexDigitToChar(b); 102| 128|} _ZN7TSKGuidC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE: 106| 8|{ 107| 8| _bytes.clear(); 108| | 109| 8| char charOne, charTwo; 110| 8| bool lookingForFirstChar = true; 111| | 112| | // for (const char &ch : fromString) C++ 11 CODE CHANGED FOR TSK 113| 296| for (std::string::const_iterator it = fromString.begin(); it != fromString.end(); ++it) ------------------ | Branch (113:61): [True: 288, False: 8] ------------------ 114| 288| { 115| 288| char ch = *it; 116| 288| if (ch == '-') ------------------ | Branch (116:9): [True: 32, False: 256] ------------------ 117| 32| continue; 118| | 119| 256| if (lookingForFirstChar) ------------------ | Branch (119:9): [True: 128, False: 128] ------------------ 120| 128| { 121| 128| charOne = ch; 122| 128| lookingForFirstChar = false; 123| 128| } 124| 128| else 125| 128| { 126| 128| charTwo = ch; 127| 128| unsigned char byte = hexPairToChar(charOne, charTwo); 128| 128| _bytes.push_back(byte); 129| 128| lookingForFirstChar = true; 130| 128| } 131| 256| } 132| | 133| 8|} tsk_malloc: 29| 106|{ 30| 106| void *ptr; 31| | 32| 106| if ((ptr = calloc(len, 1)) == 0) { ------------------ | Branch (32:9): [True: 0, False: 106] ------------------ 33| 0| tsk_error_reset(); 34| 0| tsk_error_set_errno(TSK_ERR_AUX_MALLOC); ------------------ | | 307| 0|#define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0) | | ------------------ | | | | 298| 0|#define TSK_ERR_AUX 0x01000000 | | ------------------ ------------------ 35| 0| tsk_error_set_errstr("tsk_malloc: %s (%" PRIuSIZE" requested)", strerror(errno), len); 36| 0| } 37| | 38| 106| return ptr; 39| 106|} tsk_guess_end_u16: 35| 3|{ 36| | /* try little */ 37| 3| if (tsk_getu16(TSK_LIT_ENDIAN, x) == val) { ------------------ | | 86| 3|#define tsk_getu16(endian, x) \ | | 87| 3|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 3| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (37:9): [True: 1, False: 2] ------------------ 38| 1| *flag = TSK_LIT_ENDIAN; 39| 1| return 0; 40| 1| } 41| | 42| | /* ok, big now */ 43| 2| if (tsk_getu16(TSK_BIG_ENDIAN, x) == val) { ------------------ | | 86| 2|#define tsk_getu16(endian, x) \ | | 87| 2|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 2| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 2| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (43:9): [True: 0, False: 2] ------------------ 44| 0| *flag = TSK_BIG_ENDIAN; 45| 0| return 0; 46| 0| } 47| | 48| | /* didn't find it */ 49| 2| return 1; 50| 2|} tsk_error_get_info: 148| 32|{ 149| 32| TSK_ERROR_INFO *ptr = NULL; 150| 32| (void) pthread_once(&pt_tls_key_once, make_pt_tls_key); 151| 32| if ((ptr = (TSK_ERROR_INFO *) pthread_getspecific(pt_tls_key)) == 0) { ------------------ | Branch (151:9): [True: 1, False: 31] ------------------ 152| | // Under high memory pressure malloc will return NULL. 153| 1| ptr = (TSK_ERROR_INFO *) malloc(sizeof(TSK_ERROR_INFO)); 154| | 155| 1| if( ptr != NULL ) { ------------------ | Branch (155:13): [True: 1, False: 0] ------------------ 156| 1| ptr->t_errno = 0; 157| 1| ptr->errstr[0] = 0; 158| 1| ptr->errstr2[0] = 0; 159| 1| } 160| 1| (void) pthread_setspecific(pt_tls_key, ptr); 161| 1| } 162| 32| return ptr; 163| 32|} tsk_error_set_errno: 308| 9|{ 309| 9| tsk_error_get_info()->t_errno = t_errno; 310| 9|} tsk_error_set_errstr: 332| 9|{ 333| 9| va_list args; 334| 9| va_start(args, format); 335| 9| vsnprintf(tsk_error_get_info()->errstr, TSK_ERROR_STRING_MAX_LENGTH, ------------------ | | 67| 9|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 336| 9| format, args); 337| 9| va_end(args); 338| 9|} tsk_error_set_errstr2: 373| 1|{ 374| 1| va_list args; 375| 1| va_start(args, format); 376| 1| vsnprintf(tsk_error_get_info()->errstr2, TSK_ERROR_STRING_MAX_LENGTH, ------------------ | | 67| 1|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 377| 1| format, args); 378| 1| va_end(args); 379| 1|} tsk_error_errstr2_concat: 401| 1|{ 402| 1| char *errstr2 = tsk_error_get_info()->errstr2; 403| 1| int current_length = (int) (strlen(errstr2) + 1); // +1 for a space 404| 1| if (current_length > 0) { ------------------ | Branch (404:9): [True: 1, False: 0] ------------------ 405| 1| va_list args; 406| 1| int remaining = TSK_ERROR_STRING_MAX_LENGTH - current_length; ------------------ | | 67| 1|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 407| 1| errstr2[current_length - 1] = ' '; 408| 1| va_start(args, format); 409| 1| vsnprintf(&errstr2[current_length], remaining, format, args); 410| 1| va_end(args); 411| 1| } 412| 1|} tsk_error_reset: 444| 12|{ 445| 12| TSK_ERROR_INFO *info = tsk_error_get_info(); 446| | 447| 12| if( info != NULL ) { ------------------ | Branch (447:9): [True: 12, False: 0] ------------------ 448| 12| info->t_errno = 0; 449| 12| info->errstr[0] = 0; 450| 12| info->errstr2[0] = 0; 451| 12| info->errstr_print[0] = 0; 452| 12| } 453| 12|} tsk_error.c:make_pt_tls_key: 142| 1|{ 143| 1| (void) pthread_key_create(&pt_tls_key, free_error_info); 144| 1|} tsk_list_free: 196| 1|{ 197| 1| TSK_LIST *tmp; 198| | 199| 1| while (a_tsk_list_head) { ------------------ | Branch (199:12): [True: 0, False: 1] ------------------ 200| 0| tmp = a_tsk_list_head->next; 201| 0| free(a_tsk_list_head); 202| 0| a_tsk_list_head = tmp; 203| 0| } 204| 1|} tsk_init_lock: 46| 12|{ 47| 12| pthread_mutexattr_t attr; 48| 12| pthread_mutexattr_init(&attr); 49| | 50| | // Locks on Linux are not recursive (unlike on Windows), so things 51| | // will hang if the current thread tries to take the lock again. 52| | // While debugging, it's sometimes useful to call 53| | // 54| | // pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK_NP); 55| | // 56| | // which will provoke an immediate error rather than a hang. 57| | // 58| | // PTHREAD_MUTEX_ERRORCHECK is not defined by default on Linux, 59| | // but it is portable if you have the right_XOPEN_SOURCE settings. 60| | // However, that macro affects the availability of other features 61| | // like BSD-style u_int types used in afflib. 62| | // PTHREAD_MUTEX_ERRORCHECK -is- available by default on Mac. 63| | // 64| | // PTHREAD_MUTEX_ERRORCHECK_NP is the Linux/gcc non-portable 65| | // equivalent which does not require _XOPEN_SOURCE. 66| | // 67| | // Other interesting attributes are PTHREAD_MUTEX_RECURSIVE (and 68| | // PTHREAD_MUTEX_RECURSIVE_NP). We avoided those out of portability 69| | // concerns with the _XOPEN_SOURCE settings. 70| | 71| 12| int e = pthread_mutex_init(&lock->mutex, &attr); 72| 12| pthread_mutexattr_destroy(&attr); 73| 12| if (e != 0) { ------------------ | Branch (73:9): [True: 0, False: 12] ------------------ 74| 0| fprintf(stderr, "tsk_init_lock: thread_mutex_init failed %d\n", e); 75| 0| assert(0); 76| 0| } 77| 12|} tsk_deinit_lock: 81| 18|{ 82| 18| pthread_mutex_destroy(&lock->mutex); 83| 18|} tsk_take_lock: 87| 10|{ 88| 10| int e = pthread_mutex_lock(&lock->mutex); 89| 10| if (e != 0) { ------------------ | Branch (89:9): [True: 0, False: 10] ------------------ 90| 0| fprintf(stderr, "tsk_take_lock: thread_mutex_lock failed %d\n", e); 91| 0| assert(0); 92| 0| } 93| 10|} tsk_release_lock: 97| 10|{ 98| 10| int e = pthread_mutex_unlock(&lock->mutex); 99| 10| if (e != 0) { ------------------ | Branch (99:9): [True: 0, False: 10] ------------------ 100| 0| fprintf(stderr, 101| 0| "tsk_release_lock: thread_mutex_unlock failed %d\n", e); 102| 0| assert(0); 103| 0| } 104| 10|} tsk_stack_create: 24| 1|{ 25| 1| TSK_STACK *tsk_stack; 26| 1| if ((tsk_stack = (TSK_STACK *) tsk_malloc(sizeof(TSK_STACK))) == NULL) { ------------------ | Branch (26:9): [True: 0, False: 1] ------------------ 27| 0| return NULL; 28| 0| } 29| | 30| 1| tsk_stack->len = 64; 31| 1| tsk_stack->top = 0; 32| 1| if ((tsk_stack->vals = ------------------ | Branch (32:9): [True: 0, False: 1] ------------------ 33| 1| (uint64_t *) tsk_malloc(tsk_stack->len * sizeof(uint64_t))) == 34| 1| NULL) { 35| 0| free(tsk_stack); 36| 0| return NULL; 37| 0| } 38| 1| return tsk_stack; 39| 1|} tsk_stack_free: 100| 1|{ 101| 1| free(a_tsk_stack->vals); 102| 1| free(a_tsk_stack); 103| 1|} tsk_UTF16toUTF8: 150| 10|{ 151| 10| TSKConversionResult result = TSKconversionOK; 152| 10| const UTF16 *source = *sourceStart; 153| 10| UTF8 *target = *targetStart; 154| | 155| 53| while (source < sourceEnd) { ------------------ | Branch (155:12): [True: 43, False: 10] ------------------ 156| 43| UTF32 ch; 157| 43| unsigned short bytesToWrite = 0; 158| 43| const UTF32 byteMask = 0xBF; 159| 43| const UTF32 byteMark = 0x80; 160| 43| const UTF16 *oldSource = source; /* In case we have to back up because of target overflow. */ 161| | 162| | // Need at least 2 bytes 163| 43| ch = tsk_getu16(endian, (uint8_t *) source); ------------------ | | 86| 43|#define tsk_getu16(endian, x) \ | | 87| 43|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 43, False: 0] | | ------------------ | | 88| 43| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 43| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 164| 43| source++; 165| | 166| | /* If we have a surrogate pair, convert to UTF32 first. */ 167| 43| if (ch >= UNI_SUR_HIGH_START && ch <= UNI_SUR_HIGH_END) { ------------------ | | 62| 86|#define UNI_SUR_HIGH_START (UTF32)0xD800 ------------------ if (ch >= UNI_SUR_HIGH_START && ch <= UNI_SUR_HIGH_END) { ------------------ | | 63| 0|#define UNI_SUR_HIGH_END (UTF32)0xDBFF ------------------ | Branch (167:13): [True: 0, False: 43] | Branch (167:41): [True: 0, False: 0] ------------------ 168| | /* If the 16 bits following the high surrogate are in the source buffer... */ 169| 0| if (source < sourceEnd) { ------------------ | Branch (169:17): [True: 0, False: 0] ------------------ 170| | // Need at least 2 bytes 171| 0| UTF32 ch2 = tsk_getu16(endian, (uint8_t *) source); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 172| 0| ++source; 173| | 174| | /* If it's a low surrogate, convert to UTF32. */ 175| 0| if (ch2 >= UNI_SUR_LOW_START && ch2 <= UNI_SUR_LOW_END) { ------------------ | | 64| 0|#define UNI_SUR_LOW_START (UTF32)0xDC00 ------------------ if (ch2 >= UNI_SUR_LOW_START && ch2 <= UNI_SUR_LOW_END) { ------------------ | | 65| 0|#define UNI_SUR_LOW_END (UTF32)0xDFFF ------------------ | Branch (175:21): [True: 0, False: 0] | Branch (175:49): [True: 0, False: 0] ------------------ 176| 0| ch = ((ch - UNI_SUR_HIGH_START) << halfShift) ------------------ | | 62| 0|#define UNI_SUR_HIGH_START (UTF32)0xD800 ------------------ 177| 0| + (ch2 - UNI_SUR_LOW_START) + halfBase; ------------------ | | 64| 0|#define UNI_SUR_LOW_START (UTF32)0xDC00 ------------------ 178| 0| } 179| 0| else if (flags == TSKstrictConversion) { /* it's an unpaired high surrogate */ ------------------ | Branch (179:26): [True: 0, False: 0] ------------------ 180| 0| result = TSKsourceIllegal; 181| 0| break; 182| 0| } 183| | // replace with another character 184| 0| else { 185| 0| ch = '^'; 186| 0| } 187| 0| } 188| 0| else { /* We don't have the 16 bits following the high surrogate. */ 189| 0| --source; /* return to the high surrogate */ 190| 0| result = TSKsourceExhausted; 191| 0| break; 192| 0| } 193| 0| } 194| | /* UTF-16 surrogate values are illegal in UTF-32 */ 195| 43| else if (ch >= UNI_SUR_LOW_START && ch <= UNI_SUR_LOW_END) { ------------------ | | 64| 86|#define UNI_SUR_LOW_START (UTF32)0xDC00 ------------------ else if (ch >= UNI_SUR_LOW_START && ch <= UNI_SUR_LOW_END) { ------------------ | | 65| 0|#define UNI_SUR_LOW_END (UTF32)0xDFFF ------------------ | Branch (195:18): [True: 0, False: 43] | Branch (195:45): [True: 0, False: 0] ------------------ 196| 0| if (flags == TSKstrictConversion) { ------------------ | Branch (196:17): [True: 0, False: 0] ------------------ 197| 0| --source; /* return to the illegal value itself */ 198| 0| result = TSKsourceIllegal; 199| 0| break; 200| 0| } 201| | // replace with another character 202| 0| else { 203| 0| ch = '^'; 204| 0| } 205| 0| } 206| | 207| | /* Figure out how many bytes the result will require */ 208| 43| if (ch < (UTF32) 0x80) { ------------------ | Branch (208:13): [True: 43, False: 0] ------------------ 209| 43| bytesToWrite = 1; 210| 43| } 211| 0| else if (ch < (UTF32) 0x800) { ------------------ | Branch (211:18): [True: 0, False: 0] ------------------ 212| 0| bytesToWrite = 2; 213| 0| } 214| 0| else if (ch < (UTF32) 0x10000) { ------------------ | Branch (214:18): [True: 0, False: 0] ------------------ 215| 0| bytesToWrite = 3; 216| 0| } 217| 0| else if (ch < (UTF32) 0x110000) { ------------------ | Branch (217:18): [True: 0, False: 0] ------------------ 218| 0| bytesToWrite = 4; 219| 0| } 220| 0| else { 221| 0| bytesToWrite = 3; 222| 0| ch = TSK_UNI_REPLACEMENT_CHAR; ------------------ | | 50| 0|#define TSK_UNI_REPLACEMENT_CHAR (UTF32)0x0000FFFD ------------------ 223| 0| } 224| | 225| 43| target += bytesToWrite; 226| 43| if (target > targetEnd) { ------------------ | Branch (226:13): [True: 0, False: 43] ------------------ 227| 0| source = oldSource; /* Back up source pointer! */ 228| 0| target -= bytesToWrite; 229| 0| result = TSKtargetExhausted; 230| 0| break; 231| 0| } 232| 43| switch (bytesToWrite) { /* note: everything falls through. */ ------------------ | Branch (232:17): [True: 0, False: 43] ------------------ 233| 0| case 4: ------------------ | Branch (233:9): [True: 0, False: 43] ------------------ 234| 0| *--target = (UTF8) ((ch | byteMark) & byteMask); 235| 0| ch >>= 6; 236| 0| case 3: ------------------ | Branch (236:9): [True: 0, False: 43] ------------------ 237| 0| *--target = (UTF8) ((ch | byteMark) & byteMask); 238| 0| ch >>= 6; 239| 0| case 2: ------------------ | Branch (239:9): [True: 0, False: 43] ------------------ 240| 0| *--target = (UTF8) ((ch | byteMark) & byteMask); 241| 0| ch >>= 6; 242| 43| case 1: ------------------ | Branch (242:9): [True: 43, False: 0] ------------------ 243| 43| *--target = (UTF8) (ch | firstByteMark[bytesToWrite]); 244| 43| } 245| 43| target += bytesToWrite; 246| 43| } 247| 10| *sourceStart = source; 248| 10| *targetStart = target; 249| 10| return result; 250| 10|} tsk_fs_fls: 212| 1|{ 213| 1| FLS_DATA data; 214| | 215| 1| data.flags = lclflags; 216| 1| data.sec_skew = skew; 217| | 218| |#ifdef TSK_WIN32 219| | { 220| | UTF8 *ptr8; 221| | UTF16 *ptr16; 222| | int retval; 223| | 224| | if ((tpre != NULL) && (TSTRLEN(tpre) > 0)) { 225| | size_t clen = TSTRLEN(tpre) * 4; 226| | data.macpre = (char *) tsk_malloc(clen); 227| | if (data.macpre == NULL) { 228| | return 1; 229| | } 230| | ptr8 = (UTF8 *) data.macpre; 231| | ptr16 = (UTF16 *) tpre; 232| | 233| | retval = 234| | tsk_UTF16toUTF8_lclorder((const UTF16 **) &ptr16, (UTF16 *) 235| | & ptr16[TSTRLEN(tpre) + 1], &ptr8, 236| | (UTF8 *) ((uintptr_t) ptr8 + clen), TSKlenientConversion); 237| | if (retval != TSKconversionOK) { 238| | tsk_error_reset(); 239| | tsk_error_set_errno(TSK_ERR_FS_UNICODE); 240| | tsk_error_set_errstr 241| | ("Error converting fls mactime pre-text to UTF-8 %d\n", 242| | retval); 243| | return 1; 244| | } 245| | } 246| | else { 247| | data.macpre = (char *) tsk_malloc(1); 248| | if (data.macpre == NULL) { 249| | return 1; 250| | } 251| | data.macpre[0] = '\0'; 252| | } 253| | 254| | retval = tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data); 255| | 256| | free(data.macpre); 257| | data.macpre = NULL; 258| | return retval; 259| | } 260| |#else 261| 1| data.macpre = tpre; 262| 1| return tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data); 263| 1|#endif 264| 1|} tsk_fs_attr_run_alloc: 47| 6|{ 48| 6| TSK_FS_ATTR_RUN *fs_attr_run = 49| 6| (TSK_FS_ATTR_RUN *) tsk_malloc(sizeof(TSK_FS_ATTR_RUN)); 50| 6| if (fs_attr_run == NULL) ------------------ | Branch (50:9): [True: 0, False: 6] ------------------ 51| 0| return NULL; 52| | 53| 6| return fs_attr_run; 54| 6|} tsk_fs_attr_run_free: 64| 8|{ 65| 14| while (fs_attr_run) { ------------------ | Branch (65:12): [True: 6, False: 8] ------------------ 66| 6| TSK_FS_ATTR_RUN *fs_attr_run_prev = fs_attr_run; 67| 6| fs_attr_run = fs_attr_run->next; 68| 6| fs_attr_run_prev->next = NULL; 69| 6| free(fs_attr_run_prev); 70| 6| } 71| 8|} tsk_fs_attr_alloc: 85| 21|{ 86| 21| TSK_FS_ATTR *fs_attr = (TSK_FS_ATTR *) tsk_malloc(sizeof(TSK_FS_ATTR)); 87| 21| if (fs_attr == NULL) { ------------------ | Branch (87:9): [True: 0, False: 21] ------------------ 88| 0| return NULL; 89| 0| } 90| | 91| 21| fs_attr->name_size = 128; 92| 21| if ((fs_attr->name = (char *) tsk_malloc(fs_attr->name_size)) == NULL) { ------------------ | Branch (92:9): [True: 0, False: 21] ------------------ 93| 0| free(fs_attr); 94| 0| return NULL; 95| 0| } 96| | 97| 21| if (type == TSK_FS_ATTR_NONRES) { ------------------ | Branch (97:9): [True: 0, False: 21] ------------------ 98| 0| fs_attr->flags = (TSK_FS_ATTR_NONRES | TSK_FS_ATTR_INUSE); 99| 0| } 100| 21| else if (type == TSK_FS_ATTR_RES) { ------------------ | Branch (100:14): [True: 21, False: 0] ------------------ 101| 21| fs_attr->rd.buf_size = 1024; 102| 21| fs_attr->rd.buf = (uint8_t *) tsk_malloc(fs_attr->rd.buf_size); 103| 21| if (fs_attr->rd.buf == NULL) { ------------------ | Branch (103:13): [True: 0, False: 21] ------------------ 104| 0| free(fs_attr->name); 105| 0| return NULL; 106| 0| } 107| 21| fs_attr->flags = (TSK_FS_ATTR_RES | TSK_FS_ATTR_INUSE); 108| 21| } 109| 0| else { 110| 0| tsk_error_reset(); 111| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 112| 0| tsk_error_set_errstr("tsk_fs_attr_alloc: Invalid Type: %d\n", 113| 0| type); 114| 0| return NULL; 115| 0| } 116| | 117| 21| return fs_attr; 118| 21|} tsk_fs_attr_free: 129| 21|{ 130| 21| if (a_fs_attr == NULL) ------------------ | Branch (130:9): [True: 0, False: 21] ------------------ 131| 0| return; 132| | 133| 21| if (a_fs_attr->nrd.run) ------------------ | Branch (133:9): [True: 5, False: 16] ------------------ 134| 5| tsk_fs_attr_run_free(a_fs_attr->nrd.run); 135| 21| a_fs_attr->nrd.run = NULL; 136| | 137| 21| free(a_fs_attr->rd.buf); 138| 21| a_fs_attr->rd.buf = NULL; 139| | 140| 21| free(a_fs_attr->name); 141| 21| a_fs_attr->name = NULL; 142| | 143| 21| free(a_fs_attr); 144| 21|} tsk_fs_attr_set_str: 218| 16|{ 219| 16| if (a_fs_attr == NULL) { ------------------ | Branch (219:9): [True: 0, False: 16] ------------------ 220| 0| tsk_error_reset(); 221| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 222| 0| tsk_error_set_errstr("Null fs_attr in tsk_fs_attr_set_str"); 223| 0| return 1; 224| 0| } 225| | 226| 16| a_fs_attr->fs_file = a_fs_file; 227| 16| a_fs_attr->flags = (TSK_FS_ATTR_INUSE | TSK_FS_ATTR_RES); 228| 16| a_fs_attr->type = type; 229| 16| a_fs_attr->id = id; 230| 16| a_fs_attr->nrd.compsize = 0; 231| | 232| 16| if (fs_attr_put_name(a_fs_attr, name)) { ------------------ | Branch (232:9): [True: 0, False: 16] ------------------ 233| 0| return 1; 234| 0| } 235| | 236| 16| if (a_fs_attr->rd.buf_size < len) { ------------------ | Branch (236:9): [True: 0, False: 16] ------------------ 237| 0| a_fs_attr->rd.buf = 238| 0| (uint8_t *) tsk_realloc((char *) a_fs_attr->rd.buf, len); 239| 0| if (a_fs_attr->rd.buf == NULL) ------------------ | Branch (239:13): [True: 0, False: 0] ------------------ 240| 0| return 1; 241| 0| a_fs_attr->rd.buf_size = len; 242| 0| } 243| | 244| 16| memset(a_fs_attr->rd.buf, 0, a_fs_attr->rd.buf_size); 245| 16| memcpy(a_fs_attr->rd.buf, res_data, len); 246| 16| a_fs_attr->size = len; 247| | 248| 16| return 0; 249| 16|} tsk_fs_attr_set_run: 279| 5|{ 280| 5| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)) { ------------------ | Branch (280:9): [True: 0, False: 5] | Branch (280:32): [True: 0, False: 5] ------------------ 281| 0| tsk_error_reset(); 282| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 283| 0| tsk_error_set_errstr("Null fs_file in tsk_fs_attr_set_run"); 284| 0| return 1; 285| 0| } 286| 5| if (a_fs_attr == NULL) { ------------------ | Branch (286:9): [True: 0, False: 5] ------------------ 287| 0| tsk_error_reset(); 288| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 289| 0| tsk_error_set_errstr("Null fs_attr in tsk_fs_attr_set_run"); 290| 0| return 1; 291| 0| } 292| | 293| 5| if (alloc_size < size) { ------------------ | Branch (293:9): [True: 0, False: 5] ------------------ 294| 0| tsk_error_reset(); 295| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 296| 0| tsk_error_set_errstr("tsk_fs_attr_set_run: alloc_size (%" PRIdOFF 297| 0| ") is less than size (%" PRIdOFF ")", alloc_size, size); 298| 0| return 1; 299| 0| } 300| | 301| 5| a_fs_attr->fs_file = a_fs_file; 302| 5| a_fs_attr->flags = (TSK_FS_ATTR_INUSE | TSK_FS_ATTR_NONRES | flags); 303| 5| a_fs_attr->type = type; 304| 5| a_fs_attr->id = id; 305| 5| a_fs_attr->size = size; 306| 5| a_fs_attr->nrd.allocsize = alloc_size; 307| 5| a_fs_attr->nrd.initsize = init_size; 308| 5| a_fs_attr->nrd.compsize = compsize; 309| | 310| 5| if (fs_attr_put_name(a_fs_attr, name)) { ------------------ | Branch (310:9): [True: 0, False: 5] ------------------ 311| 0| return 1; 312| 0| } 313| | 314| | /* Add the a_data_run_new to the attribute. */ 315| | 316| | /* We support the ODD case where the run is NULL. In this case, 317| | * we set the attribute size info, but set everything else to NULL. 318| | */ 319| 5| if (a_data_run_new == NULL) { ------------------ | Branch (319:9): [True: 0, False: 5] ------------------ 320| 0| a_fs_attr->nrd.run = NULL; 321| 0| a_fs_attr->nrd.run_end = NULL; 322| 0| return 0; 323| 0| } 324| | 325| | /* 326| | * If this is not in the beginning, then we need to make a filler 327| | * to account for the cluster numbers we haven't seen yet 328| | * 329| | * This commonly happens when we process an MFT entry that 330| | * is not a base entry and it is referenced in an $ATTR_LIST 331| | * 332| | * The $DATA attribute in the non-base have a non-zero 333| | * a_data_run_new->offset. 334| | */ 335| 5| if (a_data_run_new->offset != 0) { ------------------ | Branch (335:9): [True: 0, False: 5] ------------------ 336| 0| TSK_FS_ATTR_RUN *fill_run = tsk_fs_attr_run_alloc(); 337| 0| fill_run->flags = TSK_FS_ATTR_RUN_FLAG_FILLER; 338| 0| fill_run->offset = 0; 339| 0| fill_run->addr = 0; 340| 0| fill_run->len = a_data_run_new->offset; 341| 0| fill_run->next = a_data_run_new; 342| 0| a_data_run_new = fill_run; 343| 0| } 344| | 345| 5| a_fs_attr->nrd.run = a_data_run_new; 346| | 347| | // update the pointer to the end of the list 348| 5| a_fs_attr->nrd.run_end = a_data_run_new; 349| 5| while (a_fs_attr->nrd.run_end->next) { ------------------ | Branch (349:12): [True: 0, False: 5] ------------------ 350| 0| a_fs_attr->nrd.run_end = a_fs_attr->nrd.run_end->next; 351| 0| } 352| | 353| 5| return 0; 354| 5|} tsk_fs_attr_walk: 1037| 1|{ 1038| 1| TSK_FS_INFO *fs; 1039| | 1040| | // clean up any error messages that are lying around 1041| 1| tsk_error_reset(); 1042| | 1043| | // check the FS_INFO, FS_FILE structures 1044| 1| if ((a_fs_attr == NULL) || (a_fs_attr->fs_file == NULL) ------------------ | Branch (1044:9): [True: 0, False: 1] | Branch (1044:32): [True: 0, False: 1] ------------------ 1045| 1| || (a_fs_attr->fs_file->meta == NULL) ------------------ | Branch (1045:12): [True: 0, False: 1] ------------------ 1046| 1| || (a_fs_attr->fs_file->fs_info == NULL)) { ------------------ | Branch (1046:12): [True: 0, False: 1] ------------------ 1047| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1048| 0| tsk_error_set_errstr 1049| 0| ("tsk_fs_attr_walk: called with NULL pointers"); 1050| 0| return 1; 1051| 0| } 1052| 1| fs = a_fs_attr->fs_file->fs_info; 1053| | 1054| 1| if (fs->tag != TSK_FS_INFO_TAG) { ------------------ | | 933| 1|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (1054:9): [True: 0, False: 1] ------------------ 1055| |// || (a_fs_attr->id != TSK_FS_ATTR_ID)) { 1056| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1057| 0| tsk_error_set_errstr 1058| 0| ("tsk_fs_attr_walk: called with unallocated structures"); 1059| 0| return 1; 1060| 0| } 1061| 1| if (a_fs_attr->flags & TSK_FS_ATTR_COMP) { ------------------ | Branch (1061:9): [True: 0, False: 1] ------------------ 1062| 0| if (a_fs_attr->w == NULL) { ------------------ | Branch (1062:13): [True: 0, False: 0] ------------------ 1063| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1064| 0| tsk_error_set_errstr 1065| 0| ("tsk_fs_attr_walk: compressed attribute found, but special function not defined"); 1066| 0| return 1; 1067| 0| } 1068| 0| return a_fs_attr->w(a_fs_attr, a_flags, a_action, a_ptr); 1069| 0| } 1070| | // resident data 1071| 1| if (a_fs_attr->flags & TSK_FS_ATTR_RES) { ------------------ | Branch (1071:9): [True: 0, False: 1] ------------------ 1072| 0| fflush(stderr); 1073| 0| return tsk_fs_attr_walk_res(a_fs_attr, a_flags, a_action, a_ptr); 1074| 0| } 1075| | // non-resident data 1076| 1| else if (a_fs_attr->flags & TSK_FS_ATTR_NONRES) { ------------------ | Branch (1076:14): [True: 1, False: 0] ------------------ 1077| 1| return tsk_fs_attr_walk_nonres(a_fs_attr, a_flags, a_action, 1078| 1| a_ptr); 1079| 1| } 1080| | 1081| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1082| 0| tsk_error_set_errstr 1083| 0| ("tsk_fs_attr_walk: called with unknown attribute type: %x", 1084| 0| a_fs_attr->flags); 1085| 0| return 1; 1086| 1|} fs_attr.c:fs_attr_put_name: 181| 21|{ 182| 21| if ((name == NULL) || (strlen(name) == 0)) { ------------------ | Branch (182:9): [True: 0, False: 21] | Branch (182:27): [True: 15, False: 6] ------------------ 183| 15| if (fs_attr->name_size > 0) { ------------------ | Branch (183:13): [True: 15, False: 0] ------------------ 184| 15| free(fs_attr->name); 185| 15| fs_attr->name_size = 0; 186| 15| } 187| 15| fs_attr->name = NULL; 188| 15| return 0; 189| 15| } 190| | 191| 6| if (fs_attr->name_size < (strlen(name) + 1)) { ------------------ | Branch (191:9): [True: 0, False: 6] ------------------ 192| 0| fs_attr->name = tsk_realloc(fs_attr->name, strlen(name) + 1); 193| 0| if (fs_attr->name == NULL) ------------------ | Branch (193:13): [True: 0, False: 0] ------------------ 194| 0| return 1; 195| 0| fs_attr->name_size = strlen(name) + 1; 196| 0| } 197| 6| strncpy(fs_attr->name, name, fs_attr->name_size); 198| 6| return 0; 199| 6|} fs_attr.c:tsk_fs_attr_walk_nonres: 843| 1|{ 844| 1| char *buf = NULL; 845| 1| TSK_OFF_T tot_size; 846| 1| TSK_OFF_T off = 0; 847| 1| TSK_FS_ATTR_RUN *fs_attr_run; 848| 1| int retval; 849| 1| uint32_t skip_remain; 850| 1| TSK_FS_INFO *fs = fs_attr->fs_file->fs_info; 851| 1| uint8_t stop_loop = 0; 852| | 853| 1| if ((fs_attr->flags & TSK_FS_ATTR_NONRES) == 0) { ------------------ | Branch (853:9): [True: 0, False: 1] ------------------ 854| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 855| 0| tsk_error_set_errstr 856| 0| ("tsk_fs_file_walk_nonres: called with non-non-resident data"); 857| 0| return 1; 858| 0| } 859| | 860| | /* if we want the slack space too, then use the allocsize */ 861| 1| if (a_flags & TSK_FS_FILE_WALK_FLAG_SLACK) ------------------ | Branch (861:9): [True: 1, False: 0] ------------------ 862| 1| tot_size = fs_attr->nrd.allocsize; 863| 0| else 864| 0| tot_size = fs_attr->size; 865| | 866| 1| skip_remain = fs_attr->nrd.skiplen; 867| | 868| 1| if ((a_flags & TSK_FS_FILE_WALK_FLAG_AONLY) == 0) { ------------------ | Branch (868:9): [True: 1, False: 0] ------------------ 869| 1| if ((buf = (char *) tsk_malloc(fs->block_size)) == NULL) { ------------------ | Branch (869:13): [True: 0, False: 1] ------------------ 870| 0| return 1; 871| 0| } 872| 1| } 873| | 874| | /* cycle through the number of runs we have */ 875| 1| retval = TSK_WALK_CONT; 876| 1| for (fs_attr_run = fs_attr->nrd.run; fs_attr_run; ------------------ | Branch (876:42): [True: 1, False: 0] ------------------ 877| 1| fs_attr_run = fs_attr_run->next) { 878| 1| TSK_DADDR_T addr, len_idx; 879| | 880| 1| addr = fs_attr_run->addr; 881| | 882| | /* cycle through each block in the run */ 883| 1| for (len_idx = 0; len_idx < fs_attr_run->len; len_idx++) { ------------------ | Branch (883:27): [True: 1, False: 0] ------------------ 884| | 885| 1| TSK_FS_BLOCK_FLAG_ENUM myflags; 886| | 887| | /* If the address is too large then give an error */ 888| 1| if (addr + len_idx > fs->last_block) { ------------------ | Branch (888:17): [True: 0, False: 1] ------------------ 889| 0| if (fs_attr->fs_file-> ------------------ | Branch (889:21): [True: 0, False: 0] ------------------ 890| 0| meta->flags & TSK_FS_META_FLAG_UNALLOC) 891| 0| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 0|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 892| 0| else 893| 0| tsk_error_set_errno(TSK_ERR_FS_BLK_NUM); ------------------ | | 352| 0|#define TSK_ERR_FS_BLK_NUM (TSK_ERR_FS | 7) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 894| 0| tsk_error_set_errstr 895| 0| ("Invalid address in run (too large): %" PRIuDADDR "", 896| 0| addr + len_idx); 897| 0| free(buf); 898| 0| return 1; 899| 0| } 900| | 901| | // load the buffer if they want more than just the address 902| 1| if ((a_flags & TSK_FS_FILE_WALK_FLAG_AONLY) == 0) { ------------------ | Branch (902:17): [True: 1, False: 0] ------------------ 903| | 904| | /* sparse files just get 0s */ 905| 1| if (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) { ------------------ | Branch (905:21): [True: 0, False: 1] ------------------ 906| 0| memset(buf, 0, fs->block_size); 907| 0| } 908| | /* FILLER entries exist when the source file system can store run 909| | * info out of order and we did not get all of the run info. We 910| | * return 0s if data is read from this type of run. */ 911| 1| else if (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) { ------------------ | Branch (911:26): [True: 0, False: 1] ------------------ 912| 0| memset(buf, 0, fs->block_size); 913| 0| if (tsk_verbose) ------------------ | Branch (913:25): [True: 0, False: 0] ------------------ 914| 0| fprintf(stderr, 915| 0| "tsk_fs_attr_walk_nonres: File %" PRIuINUM 916| 0| " has FILLER entry, using 0s\n", 917| 0| fs_attr->fs_file->meta->addr); 918| 0| } 919| | 920| | // we return 0s for reads past the initsize 921| 1| else if ((off >= fs_attr->nrd.initsize) ------------------ | Branch (921:26): [True: 0, False: 1] ------------------ 922| 1| && ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) { ------------------ | Branch (922:24): [True: 0, False: 0] ------------------ 923| 0| memset(buf, 0, fs->block_size); 924| 0| } 925| 1| else { 926| 1| ssize_t cnt; 927| 1| if (fs->ftype == TSK_FS_TYPE_LOGICAL) { ------------------ | Branch (927:10): [True: 0, False: 1] ------------------ 928| | // We can't read logical files directly from the image. 929| 0| cnt = logicalfs_read_block(fs, fs_attr->fs_file, addr + len_idx, buf); 930| 0| } 931| 1| else { 932| 1| cnt = tsk_fs_read_block_decrypt 933| 1| (fs, addr + len_idx, buf, fs->block_size, fs_attr_run->crypto_id + len_idx); 934| 1| } 935| 1| if (cnt != fs->block_size) { ------------------ | Branch (935:25): [True: 1, False: 0] ------------------ 936| 1| if (cnt >= 0) { ------------------ | Branch (936:29): [True: 0, False: 1] ------------------ 937| 0| tsk_error_reset(); 938| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 939| 0| } 940| 1| tsk_error_set_errstr2 941| 1| ("tsk_fs_file_walk: Error reading block at %" 942| 1| PRIuDADDR, addr + len_idx); ------------------ | | 264| 1|#define PRIuDADDR PRIu64 ------------------ 943| 1| free(buf); 944| 1| return 1; 945| 1| } 946| 0| if ((off + fs->block_size > fs_attr->nrd.initsize) ------------------ | Branch (946:25): [True: 0, False: 0] ------------------ 947| 0| && ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) { ------------------ | Branch (947:28): [True: 0, False: 0] ------------------ 948| 0| memset(&buf[fs_attr->nrd.initsize - off], 0, 949| 0| fs->block_size - 950| 0| (size_t) (fs_attr->nrd.initsize - off)); 951| 0| } 952| 0| } 953| 1| } 954| | 955| | /* Need to account for the skip length, which is the number of bytes 956| | * in the start of the attribute that are skipped and that are not 957| | * included in the overall length. We will seek past those and not 958| | * return those in the action. We just read a block size so check 959| | * if there is data to be returned in this buffer. */ 960| 0| if (skip_remain >= fs->block_size) { ------------------ | Branch (960:17): [True: 0, False: 0] ------------------ 961| 0| skip_remain -= fs->block_size; 962| 0| } 963| 0| else { 964| 0| size_t ret_len; 965| | 966| | /* Do we want to return a full block, or just the end? */ 967| 0| if ((TSK_OFF_T) fs->block_size - skip_remain < ------------------ | Branch (967:21): [True: 0, False: 0] ------------------ 968| 0| tot_size - off) 969| 0| ret_len = fs->block_size - skip_remain; 970| 0| else 971| 0| ret_len = (size_t) (tot_size - off); 972| | 973| | /* Only do sparse or FILLER clusters if NOSPARSE is not set */ 974| 0| if ((fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) || ------------------ | Branch (974:21): [True: 0, False: 0] ------------------ 975| 0| (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) || ------------------ | Branch (975:21): [True: 0, False: 0] ------------------ 976| 0| (off > fs_attr->nrd.initsize)) { ------------------ | Branch (976:21): [True: 0, False: 0] ------------------ 977| 0| myflags = fs->block_getflags(fs, 0); 978| 0| myflags |= TSK_FS_BLOCK_FLAG_SPARSE; 979| 0| if ((a_flags & TSK_FS_FILE_WALK_FLAG_NOSPARSE) == 0) { ------------------ | Branch (979:25): [True: 0, False: 0] ------------------ 980| 0| retval = 981| 0| a_action(fs_attr->fs_file, off, 0, 982| 0| &buf[skip_remain], ret_len, myflags, a_ptr); 983| 0| } 984| 0| } 985| 0| else { 986| 0| myflags = fs->block_getflags(fs, addr + len_idx); 987| 0| myflags |= TSK_FS_BLOCK_FLAG_RAW; 988| | 989| 0| retval = 990| 0| a_action(fs_attr->fs_file, off, addr + len_idx, 991| 0| &buf[skip_remain], ret_len, myflags, a_ptr); 992| 0| } 993| 0| off += ret_len; 994| 0| skip_remain = 0; 995| | 996| 0| if (retval != TSK_WALK_CONT) { ------------------ | Branch (996:21): [True: 0, False: 0] ------------------ 997| 0| stop_loop = 1; 998| 0| break; 999| 0| } 1000| | 1001| 0| if (off >= tot_size) { ------------------ | Branch (1001:21): [True: 0, False: 0] ------------------ 1002| 0| stop_loop = 1; 1003| 0| break; 1004| 0| } 1005| 0| } 1006| 0| } 1007| 0| if (stop_loop) ------------------ | Branch (1007:13): [True: 0, False: 0] ------------------ 1008| 0| break; 1009| 0| } 1010| | 1011| 0| free(buf); 1012| | 1013| 0| if (retval == TSK_WALK_ERROR) ------------------ | Branch (1013:9): [True: 0, False: 0] ------------------ 1014| 0| return 1; 1015| 0| else 1016| 0| return 0; 1017| 0|} tsk_fs_attrlist_alloc: 26| 4|{ 27| 4| TSK_FS_ATTRLIST *fs_attrlist; 28| | 29| 4| if ((fs_attrlist = ------------------ | Branch (29:9): [True: 0, False: 4] ------------------ 30| 4| (TSK_FS_ATTRLIST *) tsk_malloc(sizeof(TSK_FS_ATTRLIST))) == 31| 4| NULL) 32| 0| return NULL; 33| 4| return fs_attrlist; 34| 4|} tsk_fs_attrlist_free: 41| 4|{ 42| 4| TSK_FS_ATTR *fs_attr_cur, *fs_attr_tmp; 43| 4| if (a_fs_attrlist == NULL) ------------------ | Branch (43:9): [True: 0, False: 4] ------------------ 44| 0| return; 45| | 46| 4| fs_attr_cur = a_fs_attrlist->head; 47| 25| while (fs_attr_cur) { ------------------ | Branch (47:12): [True: 21, False: 4] ------------------ 48| 21| fs_attr_tmp = fs_attr_cur->next; 49| 21| tsk_fs_attr_free(fs_attr_cur); 50| 21| fs_attr_cur = fs_attr_tmp; 51| 21| } 52| 4| free(a_fs_attrlist); 53| 4|} tsk_fs_attrlist_add: 65| 21|{ 66| 21| if (a_fs_attrlist == NULL) { ------------------ | Branch (66:9): [True: 0, False: 21] ------------------ 67| 0| tsk_error_reset(); 68| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 69| 0| tsk_error_set_errstr("Null list in tsk_fs_attrlist_add"); 70| 0| return 1; 71| 0| } 72| | 73| | // verify INUSE is set 74| 21| a_fs_attr->flags |= TSK_FS_ATTR_INUSE; 75| | 76| 21| if (a_fs_attrlist->head == NULL) { ------------------ | Branch (76:9): [True: 4, False: 17] ------------------ 77| 4| a_fs_attrlist->head = a_fs_attr; 78| 4| } 79| 17| else { 80| 17| TSK_FS_ATTR *fs_attr_cur; 81| 17| fs_attr_cur = a_fs_attrlist->head; 82| 46| while (fs_attr_cur) { ------------------ | Branch (82:16): [True: 46, False: 0] ------------------ 83| | // check if it already exists 84| 46| if ((fs_attr_cur->type == a_fs_attr->type) ------------------ | Branch (84:17): [True: 0, False: 46] ------------------ 85| 46| && (fs_attr_cur->id == a_fs_attr->id)) { ------------------ | Branch (85:20): [True: 0, False: 0] ------------------ 86| 0| tsk_error_reset(); 87| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 88| 0| tsk_error_set_errstr 89| 0| ("datalist_add: Type %d and Id %d already in list", 90| 0| a_fs_attr->type, a_fs_attr->id); 91| 0| return 1; 92| 0| } 93| 46| if (fs_attr_cur->next == NULL) { ------------------ | Branch (93:17): [True: 17, False: 29] ------------------ 94| 17| fs_attr_cur->next = a_fs_attr; 95| 17| break; 96| 17| } 97| 29| fs_attr_cur = fs_attr_cur->next; 98| 29| } 99| 17| } 100| 21| return 0; 101| 21|} tsk_fs_attrlist_getnew: 120| 21|{ 121| 21| TSK_FS_ATTR *fs_attr_cur; 122| 21| TSK_FS_ATTR *fs_attr_ok = NULL; 123| | 124| 21| if (a_fs_attrlist == NULL) { ------------------ | Branch (124:9): [True: 0, False: 21] ------------------ 125| 0| tsk_error_reset(); 126| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 127| 0| tsk_error_set_errstr("Null list in tsk_fs_attrlist_getnew()"); 128| 0| return NULL; 129| 0| } 130| | 131| 21| if ((a_atype != TSK_FS_ATTR_NONRES) && (a_atype != TSK_FS_ATTR_RES)) { ------------------ | Branch (131:9): [True: 21, False: 0] | Branch (131:44): [True: 0, False: 21] ------------------ 132| 0| tsk_error_reset(); 133| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 134| 0| tsk_error_set_errstr("Invalid Type in tsk_fs_attrlist_getnew()"); 135| 0| return NULL; 136| 0| } 137| | 138| 67| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (138:45): [True: 46, False: 21] ------------------ 139| 46| fs_attr_cur = fs_attr_cur->next) { 140| 46| if (fs_attr_cur->flags == 0) { ------------------ | Branch (140:13): [True: 0, False: 46] ------------------ 141| 0| if (a_atype == TSK_FS_ATTR_NONRES) { ------------------ | Branch (141:17): [True: 0, False: 0] ------------------ 142| 0| if (fs_attr_cur->nrd.run) ------------------ | Branch (142:21): [True: 0, False: 0] ------------------ 143| 0| break; 144| 0| else if (!fs_attr_ok) ------------------ | Branch (144:26): [True: 0, False: 0] ------------------ 145| 0| fs_attr_ok = fs_attr_cur; 146| 0| } 147| | /* we want one with an allocated buf */ 148| 0| else { 149| 0| if (fs_attr_cur->rd.buf_size) ------------------ | Branch (149:21): [True: 0, False: 0] ------------------ 150| 0| break; 151| 0| else if (!fs_attr_ok) ------------------ | Branch (151:26): [True: 0, False: 0] ------------------ 152| 0| fs_attr_ok = fs_attr_cur; 153| 0| } 154| 0| } 155| 46| } 156| | 157| | /* if we fell out then check fs_attr_tmp */ 158| 21| if (!fs_attr_cur) { ------------------ | Branch (158:9): [True: 21, False: 0] ------------------ 159| 21| if (fs_attr_ok) ------------------ | Branch (159:13): [True: 0, False: 21] ------------------ 160| 0| fs_attr_cur = fs_attr_ok; 161| 21| else { 162| | /* make a new one */ 163| 21| if ((fs_attr_cur = tsk_fs_attr_alloc(a_atype)) == NULL) ------------------ | Branch (163:17): [True: 0, False: 21] ------------------ 164| 0| return NULL; 165| | 166| | // add it to the list 167| 21| if (tsk_fs_attrlist_add(a_fs_attrlist, fs_attr_cur)) { ------------------ | Branch (167:17): [True: 0, False: 21] ------------------ 168| 0| tsk_fs_attr_free(fs_attr_cur); 169| 0| return NULL; 170| 0| } 171| 21| } 172| 21| } 173| | 174| 21| fs_attr_cur->flags = (TSK_FS_ATTR_INUSE | a_atype); 175| 21| return fs_attr_cur; 176| 21|} tsk_fs_attrlist_get: 212| 4|{ 213| 4| TSK_FS_ATTR *fs_attr_cur; 214| 4| TSK_FS_ATTR *fs_attr_ok = NULL; 215| | 216| 4| if (!a_fs_attrlist) { ------------------ | Branch (216:9): [True: 0, False: 4] ------------------ 217| 0| tsk_error_reset(); 218| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 219| 0| tsk_error_set_errstr("tsk_fs_attrlist_get: Null list pointer"); 220| 0| return NULL; 221| 0| } 222| | 223| 24| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (223:45): [True: 21, False: 3] ------------------ 224| 21| fs_attr_cur = fs_attr_cur->next) { 225| 21| if ((fs_attr_cur->flags & TSK_FS_ATTR_INUSE) ------------------ | Branch (225:13): [True: 21, False: 0] ------------------ 226| 21| && (fs_attr_cur->type == a_type)) { ------------------ | Branch (226:16): [True: 4, False: 17] ------------------ 227| | 228| | /* If we are looking for NTFS $Data, 229| | * then return default when we see it */ 230| 4| if ((fs_attr_cur->type == TSK_FS_ATTR_TYPE_NTFS_DATA) && ------------------ | Branch (230:17): [True: 1, False: 3] ------------------ 231| 4| (fs_attr_cur->name == NULL)) { ------------------ | Branch (231:17): [True: 1, False: 0] ------------------ 232| 1| return fs_attr_cur; 233| 1| } 234| | 235| | // make sure we return the lowest if multiple exist 236| 3| if ((fs_attr_ok == NULL) || (fs_attr_ok->id > fs_attr_cur->id)) ------------------ | Branch (236:17): [True: 3, False: 0] | Branch (236:41): [True: 0, False: 0] ------------------ 237| 3| fs_attr_ok = fs_attr_cur; 238| 3| } 239| 21| } 240| | 241| 3| if (!fs_attr_ok) { ------------------ | Branch (241:9): [True: 0, False: 3] ------------------ 242| 0| tsk_error_set_errno(TSK_ERR_FS_ATTR_NOTFOUND); ------------------ | | 362| 0|#define TSK_ERR_FS_ATTR_NOTFOUND (TSK_ERR_FS | 17) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| tsk_error_set_errstr("tsk_fs_attrlist_get: Attribute %d not found", 244| 0| a_type); 245| 0| return NULL; 246| 0| } 247| 3| else { 248| 3| return fs_attr_ok; 249| 3| } 250| 3|} tsk_fs_attrlist_get_id: 267| 5|{ 268| 5| TSK_FS_ATTR *fs_attr_cur; 269| | 270| 5| if (!a_fs_attrlist) { ------------------ | Branch (270:9): [True: 0, False: 5] ------------------ 271| 0| tsk_error_reset(); 272| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 273| 0| tsk_error_set_errstr("tsk_fs_attrlist_get_id: Null list pointer"); 274| 0| return NULL; 275| 0| } 276| | 277| 18| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (277:45): [True: 13, False: 5] ------------------ 278| 13| fs_attr_cur = fs_attr_cur->next) { 279| 13| if ((fs_attr_cur->flags & TSK_FS_ATTR_INUSE) ------------------ | Branch (279:13): [True: 13, False: 0] ------------------ 280| 13| && (fs_attr_cur->type == a_type) && (fs_attr_cur->id == a_id)) ------------------ | Branch (280:16): [True: 0, False: 13] | Branch (280:49): [True: 0, False: 0] ------------------ 281| 0| return fs_attr_cur; 282| 13| } 283| | 284| 5| tsk_error_set_errno(TSK_ERR_FS_ATTR_NOTFOUND); ------------------ | | 362| 5|#define TSK_ERR_FS_ATTR_NOTFOUND (TSK_ERR_FS | 17) | | ------------------ | | | | 301| 5|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 285| 5| tsk_error_set_errstr 286| 5| ("tsk_fs_attrlist_get_id: Attribute %d-%d not found", a_type, 287| 5| a_id); 288| 5| return NULL; 289| 5|} tsk_fs_attrlist_get_name_type: 311| 1|{ 312| 1| TSK_FS_ATTR *fs_attr_cur; 313| 1| TSK_FS_ATTR *fs_attr_ok = NULL; 314| | 315| 1| if (!a_fs_attrlist) { ------------------ | Branch (315:9): [True: 0, False: 1] ------------------ 316| 0| tsk_error_reset(); 317| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 318| 0| tsk_error_set_errstr 319| 0| ("tsk_fs_attrlist_get_name_type: Null list pointer"); 320| 0| return NULL; 321| 0| } 322| | 323| 6| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; fs_attr_cur = ------------------ | Branch (323:45): [True: 5, False: 1] ------------------ 324| 5| fs_attr_cur->next) { 325| 5| if ((fs_attr_cur->flags & TSK_FS_ATTR_INUSE) && ------------------ | Branch (325:13): [True: 5, False: 0] ------------------ 326| 5| (fs_attr_cur->type == a_type)) { ------------------ | Branch (326:13): [True: 0, False: 5] ------------------ 327| | 328| 0| if (((name == NULL) && (fs_attr_cur->name == NULL)) || ------------------ | Branch (328:18): [True: 0, False: 0] | Branch (328:36): [True: 0, False: 0] ------------------ 329| 0| ((name) && (fs_attr_cur->name) ------------------ | Branch (329:18): [True: 0, False: 0] | Branch (329:28): [True: 0, False: 0] ------------------ 330| 0| && (!strcmp(fs_attr_cur->name, name)))) { ------------------ | Branch (330:24): [True: 0, False: 0] ------------------ 331| | 332| | /* If we are looking for NTFS $Data, 333| | * then return default when we see it */ 334| 0| if ((fs_attr_cur->type == TSK_FS_ATTR_TYPE_NTFS_DATA) && ------------------ | Branch (334:21): [True: 0, False: 0] ------------------ 335| 0| (fs_attr_cur->name == NULL)) { ------------------ | Branch (335:21): [True: 0, False: 0] ------------------ 336| 0| return fs_attr_cur; 337| 0| } 338| | 339| | // make sure we return the lowest if multiple exist 340| 0| if ((fs_attr_ok == NULL) ------------------ | Branch (340:21): [True: 0, False: 0] ------------------ 341| 0| || (fs_attr_ok->id > fs_attr_cur->id)) ------------------ | Branch (341:24): [True: 0, False: 0] ------------------ 342| 0| fs_attr_ok = fs_attr_cur; 343| 0| } 344| | 345| 0| else if ((name) && (fs_attr_cur->name) && fs_attr_cur->type == TSK_FS_ATTR_TYPE_NTFS_DATA && !strcasecmp(fs_attr_cur->name, name)) { ------------------ | Branch (345:22): [True: 0, False: 0] | Branch (345:32): [True: 0, False: 0] | Branch (345:55): [True: 0, False: 0] | Branch (345:106): [True: 0, False: 0] ------------------ 346| | // NTFS data streams should do case insensitive compare 347| | // make sure we return the lowest if multiple exist 348| 0| if ((fs_attr_ok == NULL) || (fs_attr_ok->id > fs_attr_cur->id)) ------------------ | Branch (348:21): [True: 0, False: 0] | Branch (348:45): [True: 0, False: 0] ------------------ 349| 0| fs_attr_ok = fs_attr_cur; 350| 0| } 351| 0| } 352| 5| } 353| | 354| 1| if (!fs_attr_ok) { ------------------ | Branch (354:9): [True: 1, False: 0] ------------------ 355| 1| tsk_error_set_errno(TSK_ERR_FS_ATTR_NOTFOUND); ------------------ | | 362| 1|#define TSK_ERR_FS_ATTR_NOTFOUND (TSK_ERR_FS | 17) | | ------------------ | | | | 301| 1|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 356| 1| tsk_error_set_errstr("tsk_fs_attrlist_get: Attribute %d not found", 357| 1| a_type); 358| 1| return NULL; 359| 1| } 360| 0| else { 361| 0| return fs_attr_ok; 362| 0| } 363| 1|} tsk_fs_attrlist_get_idx: 378| 3|{ 379| 3| TSK_FS_ATTR *fs_attr_cur; 380| 3| int i = 0; 381| | 382| 3| if (!a_fs_attrlist) { ------------------ | Branch (382:9): [True: 0, False: 3] ------------------ 383| 0| tsk_error_reset(); 384| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 385| 0| tsk_error_set_errstr("tsk_fs_attrlist_get_idx: Null list pointer"); 386| 0| return NULL; 387| 0| } 388| | 389| 6| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (389:45): [True: 6, False: 0] ------------------ 390| 6| fs_attr_cur = fs_attr_cur->next) { 391| 6| if (fs_attr_cur->flags & TSK_FS_ATTR_INUSE) { ------------------ | Branch (391:13): [True: 6, False: 0] ------------------ 392| 6| if (i == a_idx) { ------------------ | Branch (392:17): [True: 3, False: 3] ------------------ 393| 3| return fs_attr_cur; 394| 3| } 395| 3| i++; 396| 3| } 397| 6| } 398| | 399| 0| tsk_error_set_errno(TSK_ERR_FS_ATTR_NOTFOUND); ------------------ | | 362| 0|#define TSK_ERR_FS_ATTR_NOTFOUND (TSK_ERR_FS | 17) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 400| 0| tsk_error_set_errstr 401| 0| ("tsk_fs_attrlist_get_idx: Attribute index %d not found", a_idx); 402| 0| return NULL; 403| 3|} tsk_fs_attrlist_get_len: 416| 1|{ 417| 1| TSK_FS_ATTR *fs_attr_cur; 418| 1| int len = 0; 419| | 420| 1| if (!a_fs_attrlist) { ------------------ | Branch (420:9): [True: 0, False: 1] ------------------ 421| 0| tsk_error_reset(); 422| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 423| 0| tsk_error_set_errstr("tsk_fs_attrlist_get_len: Null list pointer"); 424| 0| return 0; 425| 0| } 426| | 427| 5| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (427:45): [True: 4, False: 1] ------------------ 428| 4| fs_attr_cur = fs_attr_cur->next) { 429| 4| if (fs_attr_cur->flags & TSK_FS_ATTR_INUSE) ------------------ | Branch (429:13): [True: 4, False: 0] ------------------ 430| 4| len++; 431| 4| } 432| 1| return len; 433| 1|} tsk_fs_dir_alloc: 29| 1|{ 30| 1| TSK_FS_DIR *fs_dir; 31| 1| size_t i; 32| | 33| | // allocate and initialize the structure 34| 1| if ((fs_dir = (TSK_FS_DIR *) tsk_malloc(sizeof(TSK_FS_DIR))) == NULL) { ------------------ | Branch (34:9): [True: 0, False: 1] ------------------ 35| 0| return NULL; 36| 0| } 37| | 38| 1| fs_dir->names_alloc = a_cnt; 39| 1| fs_dir->names_used = 0; 40| 1| if ((fs_dir->names = ------------------ | Branch (40:9): [True: 0, False: 1] ------------------ 41| 1| (TSK_FS_NAME *) tsk_malloc(sizeof(TSK_FS_NAME) * 42| 1| fs_dir->names_alloc)) == NULL) { 43| 0| free(fs_dir); 44| 0| return NULL; 45| 0| } 46| 1| fs_dir->fs_info = a_fs; 47| 1| fs_dir->addr = a_addr; 48| 1| fs_dir->tag = TSK_FS_DIR_TAG; ------------------ | | 633| 1|#define TSK_FS_DIR_TAG 0x57531246 ------------------ 49| 129| for (i = 0; i < a_cnt; i++) { ------------------ | Branch (49:17): [True: 128, False: 1] ------------------ 50| 128| fs_dir->names[i].tag = TSK_FS_NAME_TAG; ------------------ | | 594| 128|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 51| 128| } 52| | 53| 1| return fs_dir; 54| 1|} tsk_fs_dir_close: 387| 1|{ 388| 1| size_t i; 389| 1| if ((a_fs_dir == NULL) || (a_fs_dir->tag != TSK_FS_DIR_TAG)) { ------------------ | | 633| 1|#define TSK_FS_DIR_TAG 0x57531246 ------------------ | Branch (389:9): [True: 0, False: 1] | Branch (389:31): [True: 0, False: 1] ------------------ 390| 0| return; 391| 0| } 392| | 393| 1| if (a_fs_dir->names != NULL) { ------------------ | Branch (393:9): [True: 1, False: 0] ------------------ 394| 1| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (394:21): [True: 0, False: 1] ------------------ 395| 0| tsk_fs_dir_free_name_internal(&a_fs_dir->names[i]); 396| 0| } 397| 1| free(a_fs_dir->names); 398| 1| } 399| | 400| 1| if (a_fs_dir->fs_file) { ------------------ | Branch (400:9): [True: 1, False: 0] ------------------ 401| 1| tsk_fs_file_close(a_fs_dir->fs_file); 402| 1| a_fs_dir->fs_file = NULL; 403| 1| } 404| | 405| 1| a_fs_dir->tag = 0; 406| 1| free(a_fs_dir); 407| 1|} tsk_fs_dir_walk_internal: 958| 1|{ 959| 1| DENT_DINFO dinfo; 960| 1| TSK_WALK_RET_ENUM retval; 961| | 962| 1| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) { ------------------ | | 933| 1|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (962:9): [True: 0, False: 1] | Branch (962:27): [True: 0, False: 1] ------------------ 963| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 964| 0| tsk_error_set_errstr 965| 0| ("tsk_fs_dir_walk_internal: called with NULL or unallocated structures"); 966| 0| return 1; 967| 0| } 968| | 969| | // 128 is a somewhat arbitrary value. 970| | // https://github.com/sleuthkit/sleuthkit/issues/1859 identified 971| | // an overflow with 240 levels of recursion with FAT 972| 1| if (macro_recursion_depth > 128) { ------------------ | Branch (972:9): [True: 0, False: 1] ------------------ 973| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 974| 0| tsk_error_set_errstr 975| 0| ("tsk_fs_dir_walk_internal: recursion depth exceeds maximum (%d)", macro_recursion_depth); 976| 0| return 1; 977| 0| } 978| | 979| 1| memset(&dinfo, 0, sizeof(DENT_DINFO)); 980| 1| if ((dinfo.stack_seen = tsk_stack_create()) == NULL) ------------------ | Branch (980:9): [True: 0, False: 1] ------------------ 981| 0| return 1; 982| | 983| | /* Sanity check on flags -- make sure at least one ALLOC is set */ 984| 1| if (((a_flags & TSK_FS_DIR_WALK_FLAG_ALLOC) == 0) && ------------------ | Branch (984:9): [True: 1, False: 0] ------------------ 985| 1| ((a_flags & TSK_FS_DIR_WALK_FLAG_UNALLOC) == 0)) { ------------------ | Branch (985:9): [True: 1, False: 0] ------------------ 986| 1| a_flags |= 987| 1| (TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC); 988| 1| } 989| | 990| | /* if the flags are right, we can collect info that may be needed 991| | * for an orphan walk. If the walk fails or stops, the code that 992| | * calls the action will clear this stuff. 993| | */ 994| 1| tsk_take_lock(&a_fs->list_inum_named_lock); 995| 1| if ((a_fs->list_inum_named == NULL) && (a_addr == a_fs->root_inum) ------------------ | Branch (995:9): [True: 1, False: 0] | Branch (995:44): [True: 1, False: 0] ------------------ 996| 1| && (a_flags & TSK_FS_DIR_WALK_FLAG_RECURSE)) { ------------------ | Branch (996:12): [True: 1, False: 0] ------------------ 997| 1| dinfo.save_inum_named = 1; 998| 1| } 999| 1| tsk_release_lock(&a_fs->list_inum_named_lock); 1000| | 1001| 1| retval = tsk_fs_dir_walk_recursive(a_fs, &dinfo, a_addr, a_flags, 1002| 1| a_action, a_ptr, macro_recursion_depth); 1003| | 1004| | // if we were saving the list of named files in the temp list, 1005| | // then now save them to FS_INFO 1006| 1| if (dinfo.save_inum_named == 1) { ------------------ | Branch (1006:9): [True: 1, False: 0] ------------------ 1007| 1| if (retval != TSK_WALK_CONT) { ------------------ | Branch (1007:13): [True: 1, False: 0] ------------------ 1008| | /* There was an error and we stopped early, so we should get 1009| | * rid of the partial list we were making. 1010| | */ 1011| 1| tsk_list_free(dinfo.list_inum_named); 1012| 1| dinfo.list_inum_named = NULL; 1013| 1| } 1014| 0| else { 1015| 0| save_inum_named(a_fs, &dinfo); 1016| 0| } 1017| 1| } 1018| | 1019| 1| tsk_stack_free(dinfo.stack_seen); 1020| | 1021| 1| if (retval == TSK_WALK_ERROR) ------------------ | Branch (1021:9): [True: 1, False: 0] ------------------ 1022| 1| return 1; 1023| 0| else 1024| 0| return 0; 1025| 1|} tsk_fs_dir_walk: 1042| 1|{ 1043| 1| return tsk_fs_dir_walk_internal(a_fs, a_addr, a_flags, a_action, a_ptr, 0); 1044| 1|} fs_dir.c:tsk_fs_dir_open_meta_internal: 296| 1|{ 297| 1| TSK_FS_DIR *fs_dir = NULL; 298| 1| TSK_RETVAL_ENUM retval; 299| | 300| 1| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG) ------------------ | | 933| 1|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (300:9): [True: 0, False: 1] | Branch (300:27): [True: 0, False: 1] ------------------ 301| 1| || (a_fs->dir_open_meta == NULL)) { ------------------ | Branch (301:12): [True: 0, False: 1] ------------------ 302| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 303| 0| tsk_error_set_errstr 304| 0| ("tsk_fs_dir_open_meta_internal: called with NULL or unallocated structures"); 305| 0| return NULL; 306| 0| } 307| | 308| 1| retval = a_fs->dir_open_meta(a_fs, &fs_dir, a_addr, macro_recursion_depth); 309| 1| if (retval != TSK_OK) { ------------------ | Branch (309:9): [True: 1, False: 0] ------------------ 310| 1| tsk_fs_dir_close(fs_dir); 311| 1| return NULL; 312| 1| } 313| | 314| 0| return fs_dir; 315| 1|} fs_dir.c:tsk_fs_dir_walk_recursive: 654| 1|{ 655| 1| TSK_FS_DIR *fs_dir; 656| 1| TSK_FS_FILE *fs_file; 657| 1| size_t i; 658| 1| int* indexToOrderedIndex = NULL; 659| | 660| | // get the list of entries in the directory 661| 1| if ((fs_dir = tsk_fs_dir_open_meta_internal(a_fs, a_addr, macro_recursion_depth + 1)) == NULL) { ------------------ | Branch (661:9): [True: 1, False: 0] ------------------ 662| 1| return TSK_WALK_ERROR; 663| 1| } 664| | 665| | // If we're in the root folder, sort the files/folders to prioritize user content 666| 0| if (a_addr == a_fs->root_inum) { ------------------ | Branch (666:9): [True: 0, False: 0] ------------------ 667| 0| indexToOrderedIndex = (int *)tsk_malloc(fs_dir->names_used * sizeof(int)); 668| 0| if (indexToOrderedIndex == NULL) { ------------------ | Branch (668:13): [True: 0, False: 0] ------------------ 669| 0| tsk_fs_dir_close(fs_dir); 670| 0| return TSK_WALK_ERROR; 671| 0| } 672| 0| if (TSK_OK != prioritizeDirNames(fs_dir->names, fs_dir->names_used, indexToOrderedIndex)) { ------------------ | Branch (672:13): [True: 0, False: 0] ------------------ 673| 0| tsk_fs_dir_close(fs_dir); 674| 0| return TSK_WALK_ERROR; 675| 0| } 676| 0| } 677| | 678| | /* Allocate a file structure for the callbacks. We 679| | * will allocate fs_meta structures as needed and 680| | * point into the fs_dir structure for the names. */ 681| 0| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) { ------------------ | Branch (681:9): [True: 0, False: 0] ------------------ 682| 0| tsk_fs_dir_close(fs_dir); 683| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (683:13): [True: 0, False: 0] ------------------ 684| 0| free(indexToOrderedIndex); 685| 0| } 686| 0| return TSK_WALK_ERROR; 687| 0| } 688| | 689| 0| for (i = 0; i < fs_dir->names_used; i++) { ------------------ | Branch (689:17): [True: 0, False: 0] ------------------ 690| 0| TSK_WALK_RET_ENUM retval; 691| | 692| | /* Point name to the buffer of names. We need to be 693| | * careful about resetting this before we free fs_file */ 694| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (694:13): [True: 0, False: 0] ------------------ 695| | // If we have a priortized list, use it 696| 0| fs_file->name = (TSK_FS_NAME *)& fs_dir->names[indexToOrderedIndex[i]]; 697| 0| } 698| 0| else { 699| 0| fs_file->name = (TSK_FS_NAME *)& fs_dir->names[i]; 700| 0| } 701| | 702| | /* load the fs_meta structure if possible. 703| | * Must have non-zero inode addr or have allocated name (if inode is 0) */ 704| 0| if (((fs_file->name->meta_addr) ------------------ | Branch (704:14): [True: 0, False: 0] ------------------ 705| 0| || (fs_file->name->flags & TSK_FS_NAME_FLAG_ALLOC))) { ------------------ | Branch (705:20): [True: 0, False: 0] ------------------ 706| | 707| | /* Note that the NTFS code behind here has a slight hack to use the 708| | * correct sequence number based on the data in fs_file->name */ 709| 0| if (a_fs->file_add_meta(a_fs, fs_file, ------------------ | Branch (709:17): [True: 0, False: 0] ------------------ 710| 0| fs_file->name->meta_addr)) { 711| 0| if (tsk_verbose) ------------------ | Branch (711:21): [True: 0, False: 0] ------------------ 712| 0| tsk_error_print(stderr); 713| 0| tsk_error_reset(); 714| 0| } 715| 0| } 716| | 717| | // call the action if we have the right flags. 718| 0| if ((fs_file->name->flags & a_flags) == fs_file->name->flags) { ------------------ | Branch (718:13): [True: 0, False: 0] ------------------ 719| | 720| 0| retval = a_action(fs_file, a_dinfo->dirs, a_ptr); 721| 0| if (retval == TSK_WALK_STOP) { ------------------ | Branch (721:17): [True: 0, False: 0] ------------------ 722| 0| tsk_fs_dir_close(fs_dir); 723| 0| fs_file->name = NULL; 724| 0| tsk_fs_file_close(fs_file); 725| | 726| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (726:21): [True: 0, False: 0] ------------------ 727| 0| free(indexToOrderedIndex); 728| 0| } 729| | 730| | /* free the list -- fs_dir_walk has no way 731| | * of knowing that we stopped early w/out error. 732| | */ 733| 0| if (a_dinfo->save_inum_named) { ------------------ | Branch (733:21): [True: 0, False: 0] ------------------ 734| 0| tsk_list_free(a_dinfo->list_inum_named); 735| 0| a_dinfo->list_inum_named = NULL; 736| 0| a_dinfo->save_inum_named = 0; 737| 0| } 738| 0| return TSK_WALK_STOP; 739| 0| } 740| 0| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (740:22): [True: 0, False: 0] ------------------ 741| 0| tsk_fs_dir_close(fs_dir); 742| 0| fs_file->name = NULL; 743| 0| tsk_fs_file_close(fs_file); 744| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (744:21): [True: 0, False: 0] ------------------ 745| 0| free(indexToOrderedIndex); 746| 0| } 747| 0| return TSK_WALK_ERROR; 748| 0| } 749| 0| } 750| | 751| | // save the inode info for orphan finding - if requested 752| 0| if ((a_dinfo->save_inum_named) && (fs_file->meta) ------------------ | Branch (752:13): [True: 0, False: 0] | Branch (752:43): [True: 0, False: 0] ------------------ 753| 0| && (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)) { ------------------ | Branch (753:16): [True: 0, False: 0] ------------------ 754| | 755| 0| if (tsk_list_add(&a_dinfo->list_inum_named, ------------------ | Branch (755:17): [True: 0, False: 0] ------------------ 756| 0| fs_file->meta->addr)) { 757| | 758| | // if there is an error, then clear the list 759| 0| tsk_list_free(a_dinfo->list_inum_named); 760| 0| a_dinfo->list_inum_named = NULL; 761| 0| a_dinfo->save_inum_named = 0; 762| 0| } 763| 0| } 764| | 765| | 766| | /* Optimization. If we are about to recurse into the 767| | * orphan directory and we are the last item in the 768| | * directory and the flag has been set to save inum_named, 769| | * then save inum_named now to FS_INFO so that we can use 770| | * it for the orphan folder. Otherwise, we do a full 771| | * inode walk again for nothing. */ 772| 0| if ((fs_file->name->meta_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) && ------------------ | | 530| 0| (fs_info->last_inum) ------------------ | Branch (772:13): [True: 0, False: 0] ------------------ 773| 0| (i == fs_dir->names_used-1) && ------------------ | Branch (773:13): [True: 0, False: 0] ------------------ 774| 0| (a_dinfo->save_inum_named == 1)) { ------------------ | Branch (774:13): [True: 0, False: 0] ------------------ 775| 0| save_inum_named(a_fs, a_dinfo); 776| 0| a_dinfo->save_inum_named = 0; 777| 0| } 778| | 779| | /* Recurse into a directory if: 780| | * - Both dir entry and inode have DIR type (or name is undefined) 781| | * - Recurse flag is set 782| | * - dir entry is allocated OR both are unallocated 783| | * - not one of the '.' or '..' entries 784| | * - A Non-Orphan Dir or the Orphan Dir with the NOORPHAN flag not set. 785| | */ 786| 0| if ((TSK_FS_IS_DIR_NAME(fs_file->name->type) ------------------ | | 592| 0| ((x == TSK_FS_NAME_TYPE_DIR) || (x == TSK_FS_NAME_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (592:6): [True: 0, False: 0] | | | Branch (592:37): [True: 0, False: 0] | | ------------------ ------------------ 787| 0| || (fs_file->name->type == TSK_FS_NAME_TYPE_UNDEF)) ------------------ | Branch (787:20): [True: 0, False: 0] ------------------ 788| 0| && (fs_file->meta) ------------------ | Branch (788:16): [True: 0, False: 0] ------------------ 789| 0| && (TSK_FS_IS_DIR_META(fs_file->meta->type)) ------------------ | | 414| 0|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 0] | | | Branch (414:63): [True: 0, False: 0] | | ------------------ ------------------ 790| 0| && (a_flags & TSK_FS_DIR_WALK_FLAG_RECURSE) ------------------ | Branch (790:16): [True: 0, False: 0] ------------------ 791| 0| && ((fs_file->name->flags & TSK_FS_NAME_FLAG_ALLOC) ------------------ | Branch (791:17): [True: 0, False: 0] ------------------ 792| 0| || ((fs_file->name->flags & TSK_FS_NAME_FLAG_UNALLOC) ------------------ | Branch (792:21): [True: 0, False: 0] ------------------ 793| 0| && (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)) ------------------ | Branch (793:24): [True: 0, False: 0] ------------------ 794| 0| ) 795| 0| && (!TSK_FS_ISDOT(fs_file->name->name)) ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (795:16): [True: 0, False: 0] ------------------ 796| 0| && ((fs_file->name->meta_addr != TSK_FS_ORPHANDIR_INUM(a_fs)) ------------------ | | 530| 0| (fs_info->last_inum) ------------------ | Branch (796:17): [True: 0, False: 0] ------------------ 797| 0| || ((a_flags & TSK_FS_DIR_WALK_FLAG_NOORPHAN) == 0)) ------------------ | Branch (797:20): [True: 0, False: 0] ------------------ 798| 0| ) { 799| | 800| | /* Make sure we do not get into an infinite loop */ 801| 0| if (0 == tsk_stack_find(a_dinfo->stack_seen, ------------------ | Branch (801:17): [True: 0, False: 0] ------------------ 802| 0| fs_file->name->meta_addr)) { 803| 0| int depth_added = 0; 804| 0| uint8_t save_bak = 0; 805| | 806| 0| if (tsk_stack_push(a_dinfo->stack_seen, ------------------ | Branch (806:21): [True: 0, False: 0] ------------------ 807| 0| fs_file->name->meta_addr)) { 808| 0| tsk_fs_dir_close(fs_dir); 809| 0| fs_file->name = NULL; 810| 0| tsk_fs_file_close(fs_file); 811| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (811:25): [True: 0, False: 0] ------------------ 812| 0| free(indexToOrderedIndex); 813| 0| } 814| 0| return TSK_WALK_ERROR; 815| 0| } 816| | 817| | /* If we've exceeded the max depth or max length, don't 818| | * recurse any further into this directory 819| | * NOTE: We have two concepts of recursion detection in 820| | * here. This one is based on within a top-level call 821| | * to dir_walk. The macro_recursion_depth value allows 822| | * us to detect when file systems need to call dir_walk 823| | * to resolve things and they get into an infinite loop. 824| | * Perhaps they can be unified some day. 825| | */ 826| 0| if ((a_dinfo->depth >= MAX_DEPTH) || ------------------ | | 521| 0|#define MAX_DEPTH 128 ------------------ | Branch (826:21): [True: 0, False: 0] ------------------ 827| 0| (DIR_STRSZ <= ------------------ | | 522| 0|#define DIR_STRSZ 4096 ------------------ | Branch (827:21): [True: 0, False: 0] ------------------ 828| 0| strlen(a_dinfo->dirs) + 829| 0| strlen(fs_file->name->name))) { 830| 0| if (tsk_verbose) { ------------------ | Branch (830:25): [True: 0, False: 0] ------------------ 831| 0| tsk_fprintf(stdout, 832| 0| "tsk_fs_dir_walk_recursive: directory : %" 833| 0| PRIuINUM " exceeded max length / depth\n", fs_file->name->meta_addr); 834| 0| } 835| | 836| 0| tsk_fs_dir_close(fs_dir); 837| 0| fs_file->name = NULL; 838| 0| tsk_fs_file_close(fs_file); 839| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (839:25): [True: 0, False: 0] ------------------ 840| 0| free(indexToOrderedIndex); 841| 0| } 842| 0| return TSK_WALK_ERROR; 843| 0| } 844| | 845| 0| a_dinfo->didx[a_dinfo->depth] = 846| 0| &a_dinfo->dirs[strlen(a_dinfo->dirs)]; 847| 0| strncpy(a_dinfo->didx[a_dinfo->depth], 848| 0| fs_file->name->name, 849| 0| DIR_STRSZ - strlen(a_dinfo->dirs)); ------------------ | | 522| 0|#define DIR_STRSZ 4096 ------------------ 850| 0| strncat(a_dinfo->dirs, "/", DIR_STRSZ - strlen(a_dinfo->dirs) - 1); ------------------ | | 522| 0|#define DIR_STRSZ 4096 ------------------ 851| 0| depth_added = 1; 852| 0| a_dinfo->depth++; 853| | 854| | /* We do not want to save info about named unalloc files 855| | * when we go into the Orphan directory (because then we have 856| | * no orphans). So, disable it for this recursion. 857| | */ 858| 0| if (fs_file->name->meta_addr == ------------------ | Branch (858:21): [True: 0, False: 0] ------------------ 859| 0| TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 0| (fs_info->last_inum) ------------------ 860| 0| save_bak = a_dinfo->save_inum_named; 861| 0| a_dinfo->save_inum_named = 0; 862| 0| } 863| 0| retval = tsk_fs_dir_walk_recursive(a_fs, 864| 0| a_dinfo, fs_file->name->meta_addr, a_flags, 865| 0| a_action, a_ptr, macro_recursion_depth + 1); 866| 0| if (retval == TSK_WALK_ERROR) { ------------------ | Branch (866:21): [True: 0, False: 0] ------------------ 867| | /* In most cases we want to continue if a directory 868| | * did not load, but if we ran out 869| | * of memory we should stop */ 870| 0| if (tsk_error_get_errno() & TSK_ERR_AUX) { ------------------ | | 298| 0|#define TSK_ERR_AUX 0x01000000 ------------------ | Branch (870:25): [True: 0, False: 0] ------------------ 871| 0| tsk_fs_dir_close(fs_dir); 872| 0| fs_file->name = NULL; 873| 0| tsk_fs_file_close(fs_file); 874| | 875| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (875:29): [True: 0, False: 0] ------------------ 876| 0| free(indexToOrderedIndex); 877| 0| } 878| 0| return TSK_WALK_ERROR; 879| 0| } 880| | 881| 0| if (tsk_verbose) { ------------------ | Branch (881:25): [True: 0, False: 0] ------------------ 882| 0| tsk_fprintf(stderr, 883| 0| "tsk_fs_dir_walk_recursive: error reading directory: %" 884| 0| PRIuINUM "\n", fs_file->name->meta_addr); 885| 0| tsk_error_print(stderr); 886| 0| } 887| | 888| 0| tsk_error_reset(); 889| 0| } 890| 0| else if (retval == TSK_WALK_STOP) { ------------------ | Branch (890:26): [True: 0, False: 0] ------------------ 891| 0| tsk_fs_dir_close(fs_dir); 892| 0| fs_file->name = NULL; 893| 0| tsk_fs_file_close(fs_file); 894| | 895| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (895:25): [True: 0, False: 0] ------------------ 896| 0| free(indexToOrderedIndex); 897| 0| } 898| 0| return TSK_WALK_STOP; 899| 0| } 900| | 901| | // reset the save status 902| 0| if (fs_file->name->meta_addr == ------------------ | Branch (902:21): [True: 0, False: 0] ------------------ 903| 0| TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 0| (fs_info->last_inum) ------------------ 904| 0| a_dinfo->save_inum_named = save_bak; 905| 0| } 906| | 907| 0| tsk_stack_pop(a_dinfo->stack_seen); 908| 0| a_dinfo->depth--; 909| 0| if (depth_added) ------------------ | Branch (909:21): [True: 0, False: 0] ------------------ 910| 0| *a_dinfo->didx[a_dinfo->depth] = '\0'; 911| 0| } 912| 0| else { 913| 0| if (tsk_verbose) ------------------ | Branch (913:21): [True: 0, False: 0] ------------------ 914| 0| fprintf(stderr, 915| 0| "tsk_fs_dir_walk_recursive: Loop detected with address %" 916| 0| PRIuINUM, fs_file->name->meta_addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 917| 0| } 918| 0| } 919| | 920| | // remove the pointer to name buffer 921| 0| fs_file->name = NULL; 922| | 923| | // free the metadata if we allocated it 924| 0| if (fs_file->meta) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| tsk_fs_meta_close(fs_file->meta); 926| 0| fs_file->meta = NULL; 927| 0| } 928| 0| } 929| | 930| 0| tsk_fs_dir_close(fs_dir); 931| 0| fs_file->name = NULL; 932| 0| tsk_fs_file_close(fs_file); 933| | 934| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (934:9): [True: 0, False: 0] ------------------ 935| 0| free(indexToOrderedIndex); 936| 0| } 937| 0| return TSK_WALK_CONT; 938| 0|} tsk_fs_file_alloc: 28| 4|{ 29| 4| TSK_FS_FILE *fs_file; 30| | 31| 4| fs_file = (TSK_FS_FILE *) tsk_malloc(sizeof(TSK_FS_FILE)); 32| 4| if (fs_file == NULL) ------------------ | Branch (32:9): [True: 0, False: 4] ------------------ 33| 0| return NULL; 34| 4| fs_file->fs_info = a_fs; 35| 4| fs_file->tag = TSK_FS_FILE_TAG; ------------------ | | 687| 4|#define TSK_FS_FILE_TAG 0x11212212 ------------------ 36| 4| return fs_file; 37| 4|} tsk_fs_file_close: 61| 6|{ 62| 6| if ((a_fs_file == NULL) || (a_fs_file->tag != TSK_FS_FILE_TAG)) ------------------ | | 687| 4|#define TSK_FS_FILE_TAG 0x11212212 ------------------ | Branch (62:9): [True: 2, False: 4] | Branch (62:32): [True: 0, False: 4] ------------------ 63| 2| return; 64| | 65| 4| a_fs_file->tag = 0; 66| | 67| 4| if (a_fs_file->meta) { ------------------ | Branch (67:9): [True: 4, False: 0] ------------------ 68| 4| tsk_fs_meta_close(a_fs_file->meta); 69| 4| a_fs_file->meta = NULL; 70| 4| } 71| 4| if (a_fs_file->name) { ------------------ | Branch (71:9): [True: 0, False: 4] ------------------ 72| 0| tsk_fs_name_free(a_fs_file->name); 73| 0| a_fs_file->name = NULL; 74| 0| } 75| | 76| 4| free(a_fs_file); 77| 4|} tsk_fs_file_open_meta: 101| 4|{ 102| 4| TSK_FS_FILE *fs_file; 103| | 104| 4| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) { ------------------ | | 933| 4|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (104:9): [True: 0, False: 4] | Branch (104:27): [True: 0, False: 4] ------------------ 105| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 106| 0| tsk_error_set_errstr 107| 0| ("tsk_fs_file_open_meta: called with NULL or unallocated structures"); 108| 0| return NULL; 109| 0| } 110| | 111| 4| fs_file = a_fs_file; 112| 4| if (fs_file == NULL) { ------------------ | Branch (112:9): [True: 4, False: 0] ------------------ 113| 4| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) ------------------ | Branch (113:13): [True: 0, False: 4] ------------------ 114| 0| return NULL; 115| 4| } 116| 0| else { 117| | /* if the structure passed has a name structure, free it 118| | * because we won't use it. */ 119| 0| if (fs_file->name) { ------------------ | Branch (119:13): [True: 0, False: 0] ------------------ 120| 0| tsk_fs_name_free(fs_file->name); 121| 0| fs_file->name = NULL; 122| 0| } 123| | 124| | // reset the rest of it 125| 0| tsk_fs_file_reset(fs_file); 126| 0| } 127| | 128| 4| if (a_fs->file_add_meta(a_fs, fs_file, a_addr)) { ------------------ | Branch (128:9): [True: 0, False: 4] ------------------ 129| 0| if (a_fs_file == NULL) ------------------ | Branch (129:13): [True: 0, False: 0] ------------------ 130| 0| tsk_fs_file_close(fs_file); 131| 0| return NULL; 132| 0| } 133| | 134| 4| return fs_file; 135| 4|} tsk_fs_file_attr_getsize: 250| 1|{ 251| 1| if (tsk_fs_file_attr_check(a_fs_file, "tsk_fs_file_attr_getsize")) { ------------------ | Branch (251:9): [True: 0, False: 1] ------------------ 252| | // @@@ Not sure if we should be ignoring this error or not... 253| | // Just added the reset because we were returning 0 with error codes set 254| 0| tsk_error_reset(); 255| 0| return 0; 256| 0| } 257| | 258| 1| return tsk_fs_attrlist_get_len(a_fs_file->meta->attr); 259| 1|} tsk_fs_file_attr_get_idx: 269| 3|{ 270| 3| if (tsk_fs_file_attr_check(a_fs_file, "tsk_fs_file_attr_get_idx")) ------------------ | Branch (270:9): [True: 0, False: 3] ------------------ 271| 0| return NULL; 272| | 273| 3| return tsk_fs_attrlist_get_idx(a_fs_file->meta->attr, a_idx); 274| 3|} fs_file.c:tsk_fs_file_attr_check: 209| 4|{ 210| 4| TSK_FS_INFO *fs; 211| | // check the FS_INFO, FS_FILE structures 212| 4| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL) ------------------ | Branch (212:9): [True: 0, False: 4] | Branch (212:32): [True: 0, False: 4] ------------------ 213| 4| || (a_fs_file->fs_info == NULL)) { ------------------ | Branch (213:12): [True: 0, False: 4] ------------------ 214| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 215| 0| tsk_error_set_errstr("%s: called with NULL pointers", a_func); 216| 0| return 1; 217| 0| } 218| 4| else if (a_fs_file->meta->tag != TSK_FS_META_TAG) { ------------------ | | 445| 4|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (218:14): [True: 0, False: 4] ------------------ 219| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 220| 0| tsk_error_set_errstr("%s: called with unallocated structures", 221| 0| a_func); 222| 0| return 1; 223| 0| } 224| 4| fs = a_fs_file->fs_info; 225| | 226| | // If the attributes haven't been loaded, then load them. 227| 4| if (a_fs_file->meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (227:9): [True: 0, False: 4] ------------------ 228| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 229| 0| tsk_error_set_errstr("%s: called for file with corrupt data", 230| 0| a_func); 231| 0| return 1; 232| 0| } 233| 4| else if ((a_fs_file->meta->attr_state != TSK_FS_META_ATTR_STUDIED) ------------------ | Branch (233:14): [True: 4, False: 0] ------------------ 234| 4| || (a_fs_file->meta->attr == NULL)) { ------------------ | Branch (234:12): [True: 0, False: 0] ------------------ 235| 4| if (fs->load_attrs(a_fs_file)) { ------------------ | Branch (235:13): [True: 0, False: 4] ------------------ 236| 0| return 1; 237| 0| } 238| 4| } 239| 4| return 0; 240| 4|} tsk_fs_meta_alloc: 38| 4|{ 39| 4| TSK_FS_META *fs_meta; 40| | 41| 4| if ((fs_meta = ------------------ | Branch (41:9): [True: 0, False: 4] ------------------ 42| 4| (TSK_FS_META *) tsk_malloc(sizeof(TSK_FS_META))) == NULL) 43| 0| return NULL; 44| | 45| 4| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 46| | 47| 4| if (a_buf_len > 0) { ------------------ | Branch (47:9): [True: 0, False: 4] ------------------ 48| 0| if ((fs_meta->content_ptr = tsk_malloc(a_buf_len)) == NULL) { ------------------ | Branch (48:13): [True: 0, False: 0] ------------------ 49| 0| free(fs_meta); 50| 0| return NULL; 51| 0| } 52| 0| fs_meta->content_len = a_buf_len; 53| 0| fs_meta->reset_content = NULL; 54| 0| } 55| | 56| | // assign the id so we know the structure is still alloc 57| 4| fs_meta->tag = TSK_FS_META_TAG; ------------------ | | 445| 4|#define TSK_FS_META_TAG 0x13524635 ------------------ 58| | 59| 4| return fs_meta; 60| 4|} tsk_fs_meta_close: 99| 4|{ 100| 4| TSK_FS_META_NAME_LIST *fs_name, *fs_name2; 101| | 102| 4| if ((!fs_meta) || (fs_meta->tag != TSK_FS_META_TAG)) ------------------ | | 445| 4|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (102:9): [True: 0, False: 4] | Branch (102:23): [True: 0, False: 4] ------------------ 103| 0| return; 104| | 105| | // clear the tag so we know the structure isn't alloc 106| 4| fs_meta->tag = 0; 107| | 108| 4| if (fs_meta->content_ptr) { ------------------ | Branch (108:9): [True: 0, False: 4] ------------------ 109| 0| if (fs_meta->reset_content) { ------------------ | Branch (109:13): [True: 0, False: 0] ------------------ 110| 0| fs_meta->reset_content(fs_meta->content_ptr); 111| 0| } 112| | 113| 0| free((char *) fs_meta->content_ptr); 114| 0| } 115| | 116| 4| fs_meta->content_ptr = NULL; 117| 4| fs_meta->content_len = 0; 118| | 119| 4| if (fs_meta->attr) ------------------ | Branch (119:9): [True: 4, False: 0] ------------------ 120| 4| tsk_fs_attrlist_free(fs_meta->attr); 121| 4| fs_meta->attr = NULL; 122| | 123| 4| free(fs_meta->link); 124| 4| fs_meta->link = NULL; 125| | 126| 4| fs_name = fs_meta->name2; 127| 8| while (fs_name) { ------------------ | Branch (127:12): [True: 4, False: 4] ------------------ 128| 4| fs_name2 = fs_name->next; 129| 4| fs_name->next = NULL; 130| 4| free(fs_name); 131| 4| fs_name = fs_name2; 132| 4| } 133| | 134| 4| free(fs_meta); 135| 4|} tsk_fs_read: 91| 8|{ 92| 8| return tsk_fs_read_decrypt(a_fs, a_off, a_buf, a_len, 0); 93| 8|} tsk_fs_read_decrypt: 107| 8|{ 108| | // do a sanity check on the read bounds, but only if the block 109| | // value has been set. 110| | // note that this could prevent us from viewing the FS slack... 111| 8| if ((a_fs->last_block_act > 0) ------------------ | Branch (111:9): [True: 5, False: 3] ------------------ 112| 8| && ((TSK_DADDR_T) a_off >= ------------------ | Branch (112:12): [True: 0, False: 5] ------------------ 113| 5| ((a_fs->last_block_act + 1) * a_fs->block_size))) { 114| 0| tsk_error_reset(); 115| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 116| 0| if ((TSK_DADDR_T) a_off < ------------------ | Branch (116:13): [True: 0, False: 0] ------------------ 117| 0| ((a_fs->last_block + 1) * a_fs->block_size)) 118| 0| tsk_error_set_errstr 119| 0| ("tsk_fs_read: Offset missing in partial image: %" 120| 0| PRIuDADDR ")", a_off); 121| 0| else 122| 0| tsk_error_set_errstr 123| 0| ("tsk_fs_read: Offset is too large for image: %" PRIuDADDR 124| 0| ")", a_off); 125| 0| return -1; 126| 0| } 127| | 128| | // We need different logic for encrypted file systems 129| 8| if ((a_fs->flags & TSK_FS_INFO_FLAG_ENCRYPTED) && a_fs->block_size) { ------------------ | Branch (129:9): [True: 0, False: 8] | Branch (129:55): [True: 0, False: 0] ------------------ 130| | // If we're reading on block boundaries and a multiple of block 131| | // sizes, we can just decrypt directly to the buffer. 132| 0| if ((a_off % a_fs->block_size == 0) && (a_len % a_fs->block_size == 0)) { ------------------ | Branch (132:13): [True: 0, False: 0] | Branch (132:48): [True: 0, False: 0] ------------------ 133| 0| return tsk_fs_read_block_decrypt(a_fs, a_off / a_fs->block_size, a_buf, a_len, crypto_id); 134| 0| } 135| | 136| | // Since we can only decrypt on block boundaries, we'll need to 137| | // decrypt the blocks and then copy to the output buffer. 138| | 139| | // Starting address needs to be aligned by block size; 140| 0| TSK_OFF_T bit_magic = a_fs->block_size - 1; 141| 0| TSK_OFF_T start = a_off & ~bit_magic; 142| | 143| | // Ending address needs to be rounded up to the nearest 144| | // block boundary. 145| 0| TSK_OFF_T end = (a_off + a_len + bit_magic) & ~bit_magic; 146| 0| TSK_OFF_T len = end - start; 147| | 148| | // Decrypt the blocks to a temp buffer 149| 0| char * temp_buffer = tsk_malloc(len); 150| 0| if (temp_buffer == NULL) { ------------------ | Branch (150:13): [True: 0, False: 0] ------------------ 151| 0| return -1; 152| 0| } 153| | 154| 0| if (tsk_fs_read_block_decrypt(a_fs, start / a_fs->block_size, temp_buffer, ------------------ | Branch (154:13): [True: 0, False: 0] ------------------ 155| 0| len, crypto_id) != len) { 156| 0| free(temp_buffer); 157| 0| return -1; 158| 0| } 159| | 160| | // Copy the decrypted data 161| 0| memcpy(a_buf, temp_buffer + a_off - start, a_len); 162| | 163| 0| free(temp_buffer); 164| | 165| 0| return a_len; 166| 0| } 167| | 168| 8| if (((a_fs->block_pre_size) || (a_fs->block_post_size)) ------------------ | Branch (168:10): [True: 0, False: 8] | Branch (168:36): [True: 0, False: 8] ------------------ 169| 8| && (a_fs->block_size)) { ------------------ | Branch (169:12): [True: 0, False: 0] ------------------ 170| 0| return fs_prepost_read(a_fs, a_off, a_buf, a_len); 171| 0| } 172| 8| else { 173| 8| return tsk_img_read(a_fs->img_info, a_off + a_fs->offset, a_buf, 174| 8| a_len); 175| 8| } 176| 8|} tsk_fs_read_block: 193| 1|{ 194| 1| return tsk_fs_read_block_decrypt(a_fs, a_addr, a_buf, a_len, 0); 195| 1|} tsk_fs_read_block_decrypt: 213| 2|{ 214| 2| if (a_len % a_fs->block_size) { ------------------ | Branch (214:9): [True: 0, False: 2] ------------------ 215| 0| tsk_error_reset(); 216| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 217| 0| tsk_error_set_errstr("tsk_fs_read_block: length %" PRIuSIZE "" 218| 0| " not a multiple of %d", a_len, a_fs->block_size); 219| 0| return -1; 220| 0| } 221| | 222| 2| if (a_addr > a_fs->last_block_act) { ------------------ | Branch (222:9): [True: 1, False: 1] ------------------ 223| 1| tsk_error_reset(); 224| 1| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 1|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 1|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 225| 1| if (a_addr <= a_fs->last_block) ------------------ | Branch (225:13): [True: 1, False: 0] ------------------ 226| 1| tsk_error_set_errstr 227| 1| ("tsk_fs_read_block: Address missing in partial image: %" 228| 1| PRIuDADDR ")", a_addr); 229| 0| else 230| 0| tsk_error_set_errstr 231| 0| ("tsk_fs_read_block: Address is too large for image: %" 232| 0| PRIuDADDR ")", a_addr); 233| 1| return -1; 234| 1| } 235| | 236| 1| ssize_t ret_len; 237| | 238| 1| if ((a_fs->block_pre_size == 0) && (a_fs->block_post_size == 0)) { ------------------ | Branch (238:9): [True: 1, False: 0] | Branch (238:40): [True: 1, False: 0] ------------------ 239| 1| TSK_OFF_T off = 240| 1| a_fs->offset + (TSK_OFF_T) (a_addr) * a_fs->block_size; 241| 1| ret_len = tsk_img_read(a_fs->img_info, off, a_buf, a_len); 242| 1| } 243| 0| else { 244| 0| TSK_OFF_T off = (TSK_OFF_T) (a_addr) * a_fs->block_size; 245| 0| ret_len = fs_prepost_read(a_fs, off, a_buf, a_len); 246| 0| } 247| | 248| 1| if ((a_fs->flags & TSK_FS_INFO_FLAG_ENCRYPTED) ------------------ | Branch (248:9): [True: 0, False: 1] ------------------ 249| 1| && ret_len > 0 ------------------ | Branch (249:12): [True: 0, False: 0] ------------------ 250| 1| && a_fs->decrypt_block) { ------------------ | Branch (250:12): [True: 0, False: 0] ------------------ 251| 0| TSK_DADDR_T i; 252| 0| for (i = 0; i < a_len / a_fs->block_size; i++) { ------------------ | Branch (252:21): [True: 0, False: 0] ------------------ 253| 0| a_fs->decrypt_block(a_fs, crypto_id + i, 254| 0| a_buf + (a_fs->block_size * i)); 255| 0| } 256| 0| } 257| | 258| 1| return ret_len; 259| 2|} tsk_fs_name_alloc: 44| 1|{ 45| 1| TSK_FS_NAME *fs_name; 46| 1| fs_name = (TSK_FS_NAME *) tsk_malloc(sizeof(*fs_name)); 47| 1| if (fs_name == NULL) ------------------ | Branch (47:9): [True: 0, False: 1] ------------------ 48| 0| return NULL; 49| | 50| 1| fs_name->name = (char *) tsk_malloc(norm_namelen + 1); 51| 1| if (fs_name->name == NULL) { ------------------ | Branch (51:9): [True: 0, False: 1] ------------------ 52| 0| free(fs_name); 53| 0| return NULL; 54| 0| } 55| 1| fs_name->name_size = norm_namelen; 56| | 57| 1| fs_name->flags = 0; 58| | 59| 1| fs_name->shrt_name_size = shrt_namelen; 60| 1| if (shrt_namelen == 0) { ------------------ | Branch (60:9): [True: 0, False: 1] ------------------ 61| 0| fs_name->shrt_name = NULL; 62| 0| } 63| 1| else { 64| 1| fs_name->shrt_name = (char *) tsk_malloc(shrt_namelen + 1); 65| 1| if (fs_name->shrt_name == NULL) { ------------------ | Branch (65:13): [True: 0, False: 1] ------------------ 66| 0| free(fs_name->name); 67| 0| free(fs_name); 68| 0| return NULL; 69| 0| } 70| 1| } 71| | 72| 1| fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 73| 1| fs_name->tag = TSK_FS_NAME_TAG; ------------------ | | 594| 1|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 74| 1| return fs_name; 75| 1|} tsk_fs_name_free: 130| 1|{ 131| 1| if ((!fs_name) || (fs_name->tag != TSK_FS_NAME_TAG)) ------------------ | | 594| 1|#define TSK_FS_NAME_TAG 0x23147869 ------------------ | Branch (131:9): [True: 0, False: 1] | Branch (131:23): [True: 0, False: 1] ------------------ 132| 0| return; 133| | 134| 1| free(fs_name->name); 135| 1| fs_name->name = NULL; 136| | 137| 1| free(fs_name->shrt_name); 138| 1| fs_name->shrt_name = NULL; 139| | 140| 1| free(fs_name); 141| 1|} tsk_fs_open_img: 108| 3|{ 109| 3| return tsk_fs_open_img_decrypt(a_img_info, a_offset, a_ftype, ""); 110| 3|} tsk_fs_open_img_decrypt: 128| 3|{ 129| 3| TSK_FS_INFO *fs_info; 130| | 131| 3| const struct { 132| 3| char* name; 133| 3| TSK_FS_INFO* (*open)(TSK_IMG_INFO*, TSK_OFF_T, 134| 3| TSK_FS_TYPE_ENUM, uint8_t); 135| | // This type should be the _DETECT version because it used 136| | // during autodetection 137| 3| TSK_FS_TYPE_ENUM type; 138| 3| } FS_OPENERS[] = { 139| 3| { "NTFS", ntfs_open, TSK_FS_TYPE_NTFS_DETECT }, 140| 3| { "FAT", fatfs_open, TSK_FS_TYPE_FAT_DETECT }, 141| 3| { "EXT2/3/4", ext2fs_open, TSK_FS_TYPE_EXT_DETECT }, 142| 3| { "UFS", ffs_open, TSK_FS_TYPE_FFS_DETECT }, 143| 3| { "YAFFS2", yaffs2_open, TSK_FS_TYPE_YAFFS2_DETECT }, 144| 3|#if TSK_USE_HFS 145| 3| { "HFS", hfs_open, TSK_FS_TYPE_HFS_DETECT }, 146| 3|#endif 147| 3| { "ISO9660", iso9660_open, TSK_FS_TYPE_ISO9660_DETECT }, 148| 3| { "APFS", apfs_open_auto_detect, TSK_FS_TYPE_APFS_DETECT } 149| 3| }; 150| 3| if (a_img_info == NULL) { ------------------ | Branch (150:9): [True: 0, False: 3] ------------------ 151| 0| tsk_error_reset(); 152| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 153| 0| tsk_error_set_errstr("tsk_fs_open_img: Null image handle"); 154| 0| return NULL; 155| 0| } 156| | 157| | /* If the image is type IMG_DIR_INFO, then the file system is 158| | * automatically the logical directory file system type. It is an 159| | * error to try to use any other file system type in that case. 160| | */ 161| 3| if (a_img_info->itype == TSK_IMG_TYPE_LOGICAL) { ------------------ | Branch (161:6): [True: 0, False: 3] ------------------ 162| 0| if (!(a_ftype == TSK_FS_TYPE_DETECT || a_ftype == TSK_FS_TYPE_LOGICAL)) { ------------------ | Branch (162:9): [True: 0, False: 0] | Branch (162:42): [True: 0, False: 0] ------------------ 163| 0| tsk_error_reset(); 164| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 165| 0| tsk_error_set_errstr("tsk_fs_open_img: Incompatable file system type given for logical file image"); 166| 0| return NULL; 167| 0| } 168| | 169| 0| return logical_fs_open(a_img_info); 170| 0| } 171| | 172| | /* We will try different file systems ... 173| | * We need to try all of them in case more than one matches 174| | */ 175| 3| if (a_ftype == TSK_FS_TYPE_DETECT) { ------------------ | Branch (175:9): [True: 0, False: 3] ------------------ 176| 0| unsigned long i; 177| 0| const char *name_first = ""; 178| 0| TSK_FS_INFO *fs_first = NULL; 179| | 180| 0| if (tsk_verbose) ------------------ | Branch (180:13): [True: 0, False: 0] ------------------ 181| 0| tsk_fprintf(stderr, 182| 0| "fsopen: Auto detection mode at offset %" PRIdOFF "\n", 183| 0| a_offset); 184| | 185| 0| for (i = 0; i < sizeof(FS_OPENERS)/sizeof(FS_OPENERS[0]); ++i) { ------------------ | Branch (185:21): [True: 0, False: 0] ------------------ 186| 0| if ((fs_info = FS_OPENERS[i].open( ------------------ | Branch (186:17): [True: 0, False: 0] ------------------ 187| 0| a_img_info, a_offset, FS_OPENERS[i].type, 1)) != NULL) { 188| | // fs opens as type i 189| 0| if (fs_first == NULL) { ------------------ | Branch (189:21): [True: 0, False: 0] ------------------ 190| | // first success opening fs 191| 0| name_first = FS_OPENERS[i].name; 192| 0| fs_first = fs_info; 193| 0| } 194| 0| else { 195| | // second success opening fs, which means we 196| | // cannot autodetect the fs type and must give up 197| 0| fs_first->close(fs_first); 198| 0| fs_info->close(fs_info); 199| 0| tsk_error_reset(); 200| 0| tsk_error_set_errno(TSK_ERR_FS_MULTTYPE); ------------------ | | 365| 0|#define TSK_ERR_FS_MULTTYPE (TSK_ERR_FS | 20) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 201| 0| tsk_error_set_errstr( 202| 0| "%s or %s", FS_OPENERS[i].name, name_first); 203| 0| return NULL; 204| 0| } 205| 0| } 206| 0| else { 207| | // fs does not open as type i 208| 0| tsk_error_reset(); 209| 0| } 210| 0| } 211| | 212| 0| if (fs_first == NULL) { ------------------ | Branch (212:13): [True: 0, False: 0] ------------------ 213| 0| tsk_error_reset(); 214| | 215| | // If we're still at the start of the image and haven't identified any volume systems or file 216| | // systems, check if the image type is a known unsupported type. 217| 0| int unsupportedSignatureFound = 0; 218| 0| if (a_offset == 0) { ------------------ | Branch (218:17): [True: 0, False: 0] ------------------ 219| 0| char * imageType = detectUnsupportedImageType(a_img_info); 220| 0| if (imageType != NULL) { ------------------ | Branch (220:21): [True: 0, False: 0] ------------------ 221| 0| unsupportedSignatureFound = 1; 222| 0| tsk_error_reset(); 223| 0| tsk_error_set_errno(TSK_ERR_IMG_UNSUPTYPE); ------------------ | | 314| 0|#define TSK_ERR_IMG_UNSUPTYPE (TSK_ERR_IMG | 3) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 224| 0| tsk_error_set_errstr("%s", imageType); 225| 0| free(imageType); 226| 0| } 227| 0| } 228| | 229| 0| if (!unsupportedSignatureFound) { ------------------ | Branch (229:17): [True: 0, False: 0] ------------------ 230| | // Check if the file system appears to be encrypted 231| 0| encryption_detected_result* result = detectVolumeEncryption(a_img_info, a_offset); 232| 0| if (result != NULL) { ------------------ | Branch (232:21): [True: 0, False: 0] ------------------ 233| 0| if (result->encryptionType == ENCRYPTION_DETECTED_SIGNATURE) { ------------------ | Branch (233:25): [True: 0, False: 0] ------------------ 234| 0| tsk_error_set_errno(TSK_ERR_FS_ENCRYPTED); ------------------ | | 363| 0|#define TSK_ERR_FS_ENCRYPTED (TSK_ERR_FS | 18) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 235| 0| tsk_error_set_errstr("%s", result->desc); 236| 0| } 237| 0| else if (result->encryptionType == ENCRYPTION_DETECTED_ENTROPY) { ------------------ | Branch (237:30): [True: 0, False: 0] ------------------ 238| 0| tsk_error_set_errno(TSK_ERR_FS_POSSIBLY_ENCRYPTED); ------------------ | | 364| 0|#define TSK_ERR_FS_POSSIBLY_ENCRYPTED (TSK_ERR_FS | 19) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 239| 0| tsk_error_set_errstr("%s", result->desc); 240| 0| } 241| 0| else { 242| 0| tsk_error_set_errno(TSK_ERR_FS_UNKTYPE); ------------------ | | 345| 0|#define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| } 244| 0| free(result); 245| 0| result = NULL; 246| 0| } 247| 0| else { 248| 0| tsk_error_set_errno(TSK_ERR_FS_UNKTYPE); ------------------ | | 345| 0|#define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 249| 0| } 250| 0| } 251| 0| } 252| 0| return fs_first; 253| 0| } 254| 3| else if (TSK_FS_TYPE_ISNTFS(a_ftype)) { ------------------ | | 836| 3| (((ftype) & TSK_FS_TYPE_NTFS_DETECT)?1:0) | | ------------------ | | | Branch (836:5): [True: 3, False: 0] | | | Branch (836:6): [True: 3, False: 0] | | ------------------ ------------------ 255| 3| return ntfs_open(a_img_info, a_offset, a_ftype, 0); 256| 3| } 257| 0| else if (TSK_FS_TYPE_ISFAT(a_ftype)) { ------------------ | | 843| 0| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:5): [True: 0, False: 0] | | | Branch (843:6): [True: 0, False: 0] | | ------------------ ------------------ 258| 0| return fatfs_open(a_img_info, a_offset, a_ftype, 0); 259| 0| } 260| 0| else if (TSK_FS_TYPE_ISFFS(a_ftype)) { ------------------ | | 850| 0| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:5): [True: 0, False: 0] | | | Branch (850:6): [True: 0, False: 0] | | ------------------ ------------------ 261| 0| return ffs_open(a_img_info, a_offset, a_ftype, 0); 262| 0| } 263| 0| else if (TSK_FS_TYPE_ISEXT(a_ftype)) { ------------------ | | 857| 0| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:5): [True: 0, False: 0] | | | Branch (857:6): [True: 0, False: 0] | | ------------------ ------------------ 264| 0| return ext2fs_open(a_img_info, a_offset, a_ftype, 0); 265| 0| } 266| 0| else if (TSK_FS_TYPE_ISHFS(a_ftype)) { ------------------ | | 871| 0| (((ftype) & TSK_FS_TYPE_HFS_DETECT)?1:0) | | ------------------ | | | Branch (871:5): [True: 0, False: 0] | | | Branch (871:6): [True: 0, False: 0] | | ------------------ ------------------ 267| 0| return hfs_open(a_img_info, a_offset, a_ftype, 0); 268| 0| } 269| 0| else if (TSK_FS_TYPE_ISISO9660(a_ftype)) { ------------------ | | 864| 0| (((ftype) & TSK_FS_TYPE_ISO9660_DETECT)?1:0) | | ------------------ | | | Branch (864:5): [True: 0, False: 0] | | | Branch (864:6): [True: 0, False: 0] | | ------------------ ------------------ 270| 0| return iso9660_open(a_img_info, a_offset, a_ftype, 0); 271| 0| } 272| 0| else if (TSK_FS_TYPE_ISRAW(a_ftype)) { ------------------ | | 899| 0| (((ftype) & TSK_FS_TYPE_RAW_DETECT)?1:0) | | ------------------ | | | Branch (899:5): [True: 0, False: 0] | | | Branch (899:6): [True: 0, False: 0] | | ------------------ ------------------ 273| 0| return rawfs_open(a_img_info, a_offset); 274| 0| } 275| 0| else if (TSK_FS_TYPE_ISSWAP(a_ftype)) { ------------------ | | 878| 0| (((ftype) & TSK_FS_TYPE_SWAP_DETECT)?1:0) | | ------------------ | | | Branch (878:5): [True: 0, False: 0] | | | Branch (878:6): [True: 0, False: 0] | | ------------------ ------------------ 276| 0| return swapfs_open(a_img_info, a_offset); 277| 0| } 278| 0| else if (TSK_FS_TYPE_ISYAFFS2(a_ftype)) { ------------------ | | 885| 0| (((ftype) & TSK_FS_TYPE_YAFFS2_DETECT)?1:0) | | ------------------ | | | Branch (885:5): [True: 0, False: 0] | | | Branch (885:6): [True: 0, False: 0] | | ------------------ ------------------ 279| 0| return yaffs2_open(a_img_info, a_offset, a_ftype, 0); 280| 0| } 281| 0| else if (TSK_FS_TYPE_ISAPFS(a_ftype)) { ------------------ | | 906| 0| (((ftype) & TSK_FS_TYPE_APFS_DETECT)?1:0) | | ------------------ | | | Branch (906:5): [True: 0, False: 0] | | | Branch (906:6): [True: 0, False: 0] | | ------------------ ------------------ 282| 0| return apfs_open(a_img_info, a_offset, a_ftype, a_pass); 283| 0| } 284| 0| tsk_error_reset(); 285| 0| tsk_error_set_errno(TSK_ERR_FS_UNSUPTYPE); ------------------ | | 346| 0|#define TSK_ERR_FS_UNSUPTYPE (TSK_ERR_FS | 1) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 286| 0| tsk_error_set_errstr("%X", (int) a_ftype); 287| 0| return NULL; 288| 3|} tsk_fs_malloc: 311| 3|{ 312| 3| TSK_FS_INFO *fs_info; 313| 3| if ((fs_info = (TSK_FS_INFO *) tsk_malloc(a_len)) == NULL) ------------------ | Branch (313:9): [True: 0, False: 3] ------------------ 314| 0| return NULL; 315| 3| tsk_init_lock(&fs_info->list_inum_named_lock); 316| 3| tsk_init_lock(&fs_info->orphan_dir_lock); 317| | 318| 3| fs_info->list_inum_named = NULL; 319| | 320| 3| return fs_info; 321| 3|} tsk_fs_free: 328| 3|{ 329| 3| if (a_fs_info->list_inum_named) { ------------------ | Branch (329:9): [True: 0, False: 3] ------------------ 330| 0| tsk_list_free(a_fs_info->list_inum_named); 331| 0| a_fs_info->list_inum_named = NULL; 332| 0| } 333| | 334| | /* we should probably get the lock, but we're 335| | * about to kill the entire object so there are 336| | * bigger problems if another thread is still 337| | * using the fs */ 338| 3| if (a_fs_info->orphan_dir) { ------------------ | Branch (338:9): [True: 0, False: 3] ------------------ 339| 0| tsk_fs_dir_close(a_fs_info->orphan_dir); 340| 0| a_fs_info->orphan_dir = NULL; 341| 0| } 342| | 343| | 344| 3| tsk_deinit_lock(&a_fs_info->list_inum_named_lock); 345| 3| tsk_deinit_lock(&a_fs_info->orphan_dir_lock); 346| | 347| 3| free(a_fs_info); 348| 3|} nt2unixtime: 92| 32|{ 93| |// (369*365 + 89) * 24 * 3600 * 10000000 94| 32|#define NSEC_BTWN_1601_1970 (uint64_t)(116444736000000000ULL) 95| | 96| | // return 0 if before 1970 97| 32| if (ntdate < NSEC_BTWN_1601_1970) ------------------ | | 94| 32|#define NSEC_BTWN_1601_1970 (uint64_t)(116444736000000000ULL) ------------------ | Branch (97:9): [True: 4, False: 28] ------------------ 98| 4| return 0; 99| | 100| 28| ntdate -= (uint64_t) NSEC_BTWN_1601_1970; ------------------ | | 94| 28|#define NSEC_BTWN_1601_1970 (uint64_t)(116444736000000000ULL) ------------------ 101| 28| ntdate /= (uint64_t) 10000000; 102| | 103| | // return if beyond 32-bit epoch range 104| 28| if (ntdate > 0xffffffffULL) ------------------ | Branch (104:9): [True: 0, False: 28] ------------------ 105| 0| return 0; 106| | 107| 28| return (uint32_t) ntdate; 108| 28|} nt2nano: 116| 32|{ 117| 32| return (uint32_t) (ntdate % 10000000)*100; 118| 32|} ntfs_dinode_lookup: 143| 5|{ 144| 5| TSK_OFF_T mftaddr_b, mftaddr2_b, offset; 145| 5| size_t mftaddr_len = 0; 146| 5| int i; 147| 5| TSK_FS_INFO *fs = (TSK_FS_INFO *) & a_ntfs->fs_info; 148| 5| TSK_FS_ATTR_RUN *data_run; 149| 5| ntfs_upd *upd; 150| 5| uint16_t sig_seq; 151| 5| ntfs_mft *mft; 152| | 153| | 154| | /* sanity checks */ 155| 5| if (!a_buf) { ------------------ | Branch (155:9): [True: 0, False: 5] ------------------ 156| 0| tsk_error_reset(); 157| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 158| 0| tsk_error_set_errstr("mft_lookup: null mft buffer"); 159| 0| return TSK_ERR; 160| 0| } 161| | 162| 5| if (a_mftnum < fs->first_inum) { ------------------ | Branch (162:9): [True: 0, False: 5] ------------------ 163| 0| tsk_error_reset(); 164| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 165| 0| tsk_error_set_errstr("mft_lookup: inode number is too small (%" 166| 0| PRIuINUM ")", a_mftnum); 167| 0| return TSK_ERR; 168| 0| } 169| | 170| | /* Because this code reads teh actual MFT, we need to make sure we 171| | * decrement the last_inum because the last value is a special value 172| | * for the ORPHANS directory */ 173| 5| if (a_mftnum > fs->last_inum - 1) { ------------------ | Branch (173:9): [True: 0, False: 5] ------------------ 174| 0| tsk_error_reset(); 175| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 176| 0| tsk_error_set_errstr("mft_lookup: inode number is too large (%" 177| 0| PRIuINUM ")", a_mftnum); 178| 0| return TSK_ERR; 179| 0| } 180| | 181| | 182| 5| if (tsk_verbose) ------------------ | Branch (182:9): [True: 0, False: 5] ------------------ 183| 0| tsk_fprintf(stderr, 184| 0| "ntfs_dinode_lookup: Processing MFT %" PRIuINUM "\n", 185| 0| a_mftnum); 186| | 187| | /* If mft_data (the cached $Data attribute of $MFT) is not there yet, 188| | * then we have not started to load $MFT yet. In that case, we will 189| | * 'cheat' and calculate where it goes. This should only be for 190| | * $MFT itself, in which case the calculation is easy 191| | */ 192| 5| if (!a_ntfs->mft_data) { ------------------ | Branch (192:9): [True: 1, False: 4] ------------------ 193| | 194| | /* This is just a random check with the assumption being that 195| | * we don't want to just do a guess calculation for a very large 196| | * MFT entry 197| | */ 198| 1| if (a_mftnum > NTFS_LAST_DEFAULT_INO) { ------------------ | | 39| 1|#define NTFS_LAST_DEFAULT_INO 16 /* A guess for right now */ ------------------ | Branch (198:13): [True: 0, False: 1] ------------------ 199| 0| tsk_error_reset(); 200| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 201| 0| tsk_error_set_errstr 202| 0| ("Error trying to load a high MFT entry when the MFT itself has not been loaded (%" 203| 0| PRIuINUM ")", a_mftnum); 204| 0| return TSK_ERR; 205| 0| } 206| | 207| 1| mftaddr_b = a_ntfs->root_mft_addr + a_mftnum * a_ntfs->mft_rsize_b; 208| 1| mftaddr2_b = 0; 209| 1| } 210| 4| else { 211| | /* The MFT may not be in consecutive clusters, so we need to use its 212| | * data attribute run list to find out what address to read 213| | * 214| | * This is why we cached it 215| | */ 216| | 217| | // will be set to the address of the MFT entry 218| 4| mftaddr_b = mftaddr2_b = 0; 219| | 220| | /* The byte offset within the $Data stream */ 221| 4| offset = a_mftnum * a_ntfs->mft_rsize_b; 222| | 223| | /* NOTE: data_run values are in clusters 224| | * 225| | * cycle through the runs in $Data and identify which 226| | * has the MFT entry that we want 227| | */ 228| 4| for (data_run = a_ntfs->mft_data->nrd.run; 229| 4| data_run != NULL; data_run = data_run->next) { ------------------ | Branch (229:13): [True: 4, False: 0] ------------------ 230| | 231| | /* Test for possible overflows / error conditions */ 232| 4| if ((offset < 0) || (data_run->len >= (TSK_DADDR_T)(LLONG_MAX / a_ntfs->csize_b))){ ------------------ | Branch (232:17): [True: 0, False: 4] | Branch (232:33): [True: 0, False: 4] ------------------ 233| 0| tsk_error_reset(); 234| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 235| 0| tsk_error_set_errstr 236| 0| ("ntfs_dinode_lookup: Overflow when calculating run length"); 237| 0| return TSK_COR; 238| 0| } 239| | 240| | /* The length of this specific run */ 241| 4| TSK_OFF_T run_len = data_run->len * a_ntfs->csize_b; 242| | 243| | /* Is our MFT entry is in this run somewhere ? */ 244| 4| if (offset < run_len) { ------------------ | Branch (244:17): [True: 4, False: 0] ------------------ 245| | 246| 4| if (tsk_verbose) ------------------ | Branch (246:21): [True: 0, False: 4] ------------------ 247| 0| tsk_fprintf(stderr, 248| 0| "ntfs_dinode_lookup: Found in offset: %" 249| 0| PRIuDADDR " size: %" PRIuDADDR " at offset: %" 250| 0| PRIdOFF "\n", data_run->addr, data_run->len, 251| 0| offset); 252| | 253| | /* special case where the MFT entry crosses 254| | * a run (only happens when cluster size is 512-bytes 255| | * and there are an odd number of clusters in the run) 256| | */ 257| 4| if (run_len < offset + a_ntfs->mft_rsize_b) { ------------------ | Branch (257:21): [True: 0, False: 4] ------------------ 258| | 259| 0| if (tsk_verbose) ------------------ | Branch (259:25): [True: 0, False: 0] ------------------ 260| 0| tsk_fprintf(stderr, 261| 0| "ntfs_dinode_lookup: Entry crosses run border\n"); 262| | 263| 0| if (data_run->next == NULL) { ------------------ | Branch (263:25): [True: 0, False: 0] ------------------ 264| 0| tsk_error_reset(); 265| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 266| 0| tsk_error_set_errstr 267| 0| ("mft_lookup: MFT entry crosses a cluster and there are no more clusters!"); 268| 0| return TSK_COR; 269| 0| } 270| | 271| | /* Assign address where the remainder of the entry is */ 272| 0| mftaddr2_b = data_run->next->addr * a_ntfs->csize_b; 273| | /* this should always be 512, but just in case */ 274| 0| mftaddr_len = (size_t) (run_len - offset); 275| 0| } 276| | 277| | /* Assign address of where the MFT entry starts */ 278| 4| mftaddr_b = data_run->addr * a_ntfs->csize_b + offset; 279| 4| if (tsk_verbose) ------------------ | Branch (279:21): [True: 0, False: 4] ------------------ 280| 0| tsk_fprintf(stderr, 281| 0| "ntfs_dinode_lookup: Entry address at: %" 282| 0| PRIdOFF "\n", mftaddr_b); 283| 4| break; 284| 4| } 285| | 286| | /* decrement the offset we are looking for */ 287| 0| offset -= run_len; 288| 0| } 289| | 290| | /* Did we find it? */ 291| 4| if (!mftaddr_b) { ------------------ | Branch (291:13): [True: 0, False: 4] ------------------ 292| 0| tsk_error_reset(); 293| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_NUM); ------------------ | | 353| 0|#define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 8) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 294| 0| tsk_error_set_errstr("mft_lookup: Error finding MFT entry %" 295| 0| PRIuINUM " in $MFT", a_mftnum); 296| 0| return TSK_ERR; 297| 0| } 298| 4| } 299| | 300| | 301| | /* can we do just one read or do we need multiple? */ 302| 5| if (mftaddr2_b) { ------------------ | Branch (302:9): [True: 0, False: 5] ------------------ 303| 0| ssize_t cnt; 304| | /* read the first part into mft */ 305| 0| cnt = tsk_fs_read(&a_ntfs->fs_info, mftaddr_b, a_buf, mftaddr_len); 306| 0| if (cnt != (ssize_t)mftaddr_len) { ------------------ | Branch (306:13): [True: 0, False: 0] ------------------ 307| 0| if (cnt >= 0) { ------------------ | Branch (307:17): [True: 0, False: 0] ------------------ 308| 0| tsk_error_reset(); 309| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 310| 0| } 311| 0| tsk_error_set_errstr2 312| 0| ("ntfs_dinode_lookup: Error reading MFT Entry (part 1) at %" 313| 0| PRIdOFF, mftaddr_b); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 314| 0| return TSK_ERR; 315| 0| } 316| | 317| | /* read the second part into mft */ 318| 0| cnt = tsk_fs_read 319| 0| (&a_ntfs->fs_info, mftaddr2_b, 320| 0| (char *) ((uintptr_t) a_buf + (uintptr_t) mftaddr_len), 321| 0| a_ntfs->mft_rsize_b - mftaddr_len); 322| 0| if (cnt != (ssize_t)(a_ntfs->mft_rsize_b - mftaddr_len)) { ------------------ | Branch (322:13): [True: 0, False: 0] ------------------ 323| 0| if (cnt >= 0) { ------------------ | Branch (323:17): [True: 0, False: 0] ------------------ 324| 0| tsk_error_reset(); 325| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 326| 0| } 327| 0| tsk_error_set_errstr2 328| 0| ("ntfs_dinode_lookup: Error reading MFT Entry (part 2) at %" 329| 0| PRIdOFF, mftaddr2_b); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 330| 0| return TSK_ERR; 331| 0| } 332| 0| } 333| 5| else { 334| 5| ssize_t cnt; 335| | /* read the raw entry into mft */ 336| 5| cnt = 337| 5| tsk_fs_read(&a_ntfs->fs_info, mftaddr_b, a_buf, 338| 5| a_ntfs->mft_rsize_b); 339| 5| if (cnt != a_ntfs->mft_rsize_b) { ------------------ | Branch (339:13): [True: 0, False: 5] ------------------ 340| 0| if (cnt >= 0) { ------------------ | Branch (340:17): [True: 0, False: 0] ------------------ 341| 0| tsk_error_reset(); 342| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 343| 0| } 344| 0| tsk_error_set_errstr2 345| 0| ("ntfs_dinode_lookup: Error reading MFT Entry at %" 346| 0| PRIdOFF, mftaddr_b); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 347| 0| return TSK_ERR; 348| 0| } 349| 5| } 350| | 351| | /* Sanity Check */ 352| |#if 0 353| | /* This is no longer applied because it caused too many problems 354| | * with images that had 0 and 1 etc. as values. Testing shows that 355| | * even Windows XP doesn't care if entries have an invalid entry, so 356| | * this is no longer checked. The update sequence check should find 357| | * corrupt entries 358| | * */ 359| | if ((tsk_getu32(fs->endian, mft->magic) != NTFS_MFT_MAGIC) 360| | && (tsk_getu32(fs->endian, mft->magic) != NTFS_MFT_MAGIC_BAAD) 361| | && (tsk_getu32(fs->endian, mft->magic) != NTFS_MFT_MAGIC_ZERO)) { 362| | tsk_error_set_errno(TSK_ERR_FS_INODE_COR); 363| | tsk_error_set_errstr("entry %d has an invalid MFT magic: %x", 364| | mftnum, tsk_getu32(fs->endian, mft->magic)); 365| | return 1; 366| | } 367| |#endif 368| | /* The MFT entries have error and integrity checks in them 369| | * called update sequences. They must be checked and removed 370| | * so that later functions can process the data as normal. 371| | * They are located in the last 2 bytes of each 512-bytes of data. 372| | * 373| | * We first verify that the the 2-byte value is a give value and 374| | * then replace it with what should be there 375| | */ 376| | /* sanity check so we don't run over in the next loop */ 377| 5| mft = (ntfs_mft *) a_buf; 378| 5| if ((tsk_getu16(fs->endian, mft->upd_cnt) > 0) && ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (378:9): [True: 5, False: 0] ------------------ 379| 5| (((uint32_t) (tsk_getu16(fs->endian, ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (379:9): [True: 0, False: 5] ------------------ 380| 5| mft->upd_cnt) - 1) * NTFS_UPDATE_SEQ_STRIDE) > ------------------ | | 50| 5|#define NTFS_UPDATE_SEQ_STRIDE 512 ------------------ 381| 5| a_ntfs->mft_rsize_b)) { 382| 0| tsk_error_reset(); 383| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 384| 0| tsk_error_set_errstr 385| 0| ("dinode_lookup: More Update Sequence Entries than MFT size"); 386| 0| return TSK_COR; 387| 0| } 388| 5| uint16_t upd_cnt = tsk_getu16(fs->endian, mft->upd_cnt); ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 389| 5| uint16_t upd_off = tsk_getu16(fs->endian, mft->upd_off); ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 390| | 391| | // Make sure upd_cnt > 0 to prevent an integer wrap around. 392| | // NOTE: There is a bug here because upd_cnt can be for unused entries. 393| | // They are now skipped (as of July 2021). We shoudl refactor this code 394| | // to allow upd_cnt = 0. 395| 5| if ((upd_cnt == 0) || (upd_cnt > (((a_ntfs->mft_rsize_b) / 2) + 1))) { ------------------ | Branch (395:9): [True: 0, False: 5] | Branch (395:27): [True: 0, False: 5] ------------------ 396| 0| tsk_error_reset(); 397| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 398| 0| tsk_error_set_errstr 399| 0| ("dinode_lookup: Invalid update count value out of bounds"); 400| 0| return TSK_COR; 401| 0| } 402| 5| size_t mft_rsize_b = ((size_t) upd_cnt - 1) * 2; 403| | 404| 5| if ((size_t) upd_off + sizeof(ntfs_upd) > (a_ntfs->mft_rsize_b - mft_rsize_b)) { ------------------ | Branch (404:9): [True: 0, False: 5] ------------------ 405| 0| tsk_error_reset(); 406| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 407| 0| tsk_error_set_errstr 408| 0| ("dinode_lookup: Update sequence would read past MFT size"); 409| 0| return TSK_COR; 410| 0| } 411| | 412| | /* Apply the update sequence structure template */ 413| | 414| 5| upd = (ntfs_upd *) ((uintptr_t) a_buf + upd_off); 415| | /* Get the sequence value that each 16-bit value should be */ 416| 5| sig_seq = tsk_getu16(fs->endian, upd->upd_val); ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 417| | /* cycle through each sector */ 418| 15| for (i = 1; i < tsk_getu16(fs->endian, mft->upd_cnt); i++) { ------------------ | | 86| 15|#define tsk_getu16(endian, x) \ | | 87| 15|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 15, False: 0] | | ------------------ | | 88| 15| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 15| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (418:17): [True: 10, False: 5] ------------------ 419| 10| uint8_t *new_val, *old_val; 420| | /* The offset into the buffer of the value to analyze */ 421| 10| size_t offset = i * NTFS_UPDATE_SEQ_STRIDE - 2; ------------------ | | 50| 10|#define NTFS_UPDATE_SEQ_STRIDE 512 ------------------ 422| | 423| | /* Check that there is room in the buffer to read the current sequence value */ 424| 10| if (offset + 2 > a_ntfs->mft_rsize_b) { ------------------ | Branch (424:13): [True: 0, False: 10] ------------------ 425| 0| tsk_error_reset(); 426| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 427| 0| tsk_error_set_errstr 428| 0| ("dinode_lookup: Ran out of data while parsing update sequence values"); 429| 0| return TSK_COR; 430| 0| } 431| | 432| | /* get the current sequence value */ 433| 10| uint16_t cur_seq = 434| 10| tsk_getu16(fs->endian, (uintptr_t) a_buf + offset); ------------------ | | 86| 10|#define tsk_getu16(endian, x) \ | | 87| 10|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 10, False: 0] | | ------------------ | | 88| 10| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 10| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 435| 10| if (cur_seq != sig_seq) { ------------------ | Branch (435:13): [True: 0, False: 10] ------------------ 436| | /* get the replacement value */ 437| 0| uint16_t cur_repl = 438| 0| tsk_getu16(fs->endian, &upd->upd_seq + (i - 1) * 2); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 439| 0| tsk_error_reset(); 440| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 441| | 442| 0| tsk_error_set_errstr 443| 0| ("Incorrect update sequence value in MFT entry\nSignature Value: 0x%" 444| 0| PRIx16 " Actual Value: 0x%" PRIx16 445| 0| " Replacement Value: 0x%" PRIx16 446| 0| "\nThis is typically because of a corrupted entry", 447| 0| sig_seq, cur_seq, cur_repl); 448| 0| return TSK_COR; 449| 0| } 450| | 451| 10| new_val = &upd->upd_seq + (i - 1) * 2; 452| 10| old_val = (uint8_t *) ((uintptr_t) a_buf + offset); 453| | /* 454| | if (tsk_verbose) 455| | tsk_fprintf(stderr, 456| | "ntfs_dinode_lookup: upd_seq %i Replacing: %.4" 457| | PRIx16 " With: %.4" PRIx16 "\n", i, 458| | tsk_getu16(fs->endian, old_val), tsk_getu16(fs->endian, 459| | new_val)); 460| | */ 461| 10| *old_val++ = *new_val++; 462| 10| *old_val = *new_val; 463| 10| } 464| | 465| 5| return TSK_OK; 466| 5|} ntfs_open: 5228| 3|{ 5229| 3| char *myname = "ntfs_open"; 5230| 3| NTFS_INFO *ntfs = NULL; 5231| 3| TSK_FS_INFO *fs = NULL; 5232| 3| unsigned int len = 0; 5233| 3| ssize_t cnt = 0; 5234| | 5235| | // clean up any error messages that are lying around 5236| 3| tsk_error_reset(); 5237| | 5238| 3| if (TSK_FS_TYPE_ISNTFS(ftype) == 0) { ------------------ | | 836| 3| (((ftype) & TSK_FS_TYPE_NTFS_DETECT)?1:0) | | ------------------ | | | Branch (836:6): [True: 3, False: 0] | | ------------------ ------------------ | Branch (5238:9): [True: 0, False: 3] ------------------ 5239| 0| tsk_error_reset(); 5240| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5241| 0| tsk_error_set_errstr("Invalid FS type in ntfs_open"); 5242| 0| return NULL; 5243| 0| } 5244| | 5245| 3| if (img_info->sector_size == 0) { ------------------ | Branch (5245:9): [True: 0, False: 3] ------------------ 5246| 0| tsk_error_reset(); 5247| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5248| 0| tsk_error_set_errstr("ntfs_open: sector size is 0"); 5249| 0| return NULL; 5250| 0| } 5251| | 5252| 3| if ((ntfs = (NTFS_INFO *) tsk_fs_malloc(sizeof(*ntfs))) == NULL) { ------------------ | Branch (5252:9): [True: 0, False: 3] ------------------ 5253| 0| goto on_error; 5254| 0| } 5255| 3| fs = &(ntfs->fs_info); 5256| | 5257| 3| fs->ftype = TSK_FS_TYPE_NTFS; 5258| 3| fs->duname = "Cluster"; 5259| 3| fs->flags = TSK_FS_INFO_FLAG_HAVE_SEQ; 5260| 3| fs->tag = TSK_FS_INFO_TAG; ------------------ | | 933| 3|#define TSK_FS_INFO_TAG 0x10101010 ------------------ 5261| | 5262| 3| fs->img_info = img_info; 5263| 3| fs->offset = offset; 5264| | 5265| 3| ntfs->loading_the_MFT = 0; 5266| 3| ntfs->bmap = NULL; 5267| 3| ntfs->bmap_buf = NULL; 5268| | 5269| | /* Read the boot sector */ 5270| 3| len = roundup(sizeof(ntfs_sb), img_info->sector_size); 5271| 3| ntfs->fs = (ntfs_sb *) tsk_malloc(len); 5272| 3| if (ntfs->fs == NULL) { ------------------ | Branch (5272:9): [True: 0, False: 3] ------------------ 5273| 0| goto on_error; 5274| 0| } 5275| | 5276| 3| cnt = tsk_fs_read(fs, (TSK_OFF_T) 0, (char *) ntfs->fs, len); 5277| 3| if (cnt != len) { ------------------ | Branch (5277:9): [True: 0, False: 3] ------------------ 5278| 0| if (cnt >= 0) { ------------------ | Branch (5278:13): [True: 0, False: 0] ------------------ 5279| 0| tsk_error_reset(); 5280| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5281| 0| } 5282| 0| tsk_error_set_errstr2("%s: Error reading boot sector.", myname); 5283| 0| goto on_error; 5284| 0| } 5285| | 5286| | /* Check the magic value */ 5287| 3| if (tsk_fs_guessu16(fs, ntfs->fs->magic, NTFS_FS_MAGIC)) { ------------------ | | 296| 3| tsk_guess_end_u16(&(fs->endian), (x), (mag)) | | ------------------ | | | Branch (296:6): [True: 2, False: 1] | | ------------------ ------------------ 5288| 2| if (process_kape_boot_format(ntfs)) { ------------------ | Branch (5288:13): [True: 2, False: 0] ------------------ 5289| 2| tsk_error_reset(); 5290| 2| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 2|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 2|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5291| 2| tsk_error_set_errstr("Not a NTFS file system (magic)"); 5292| 2| if (tsk_verbose) ------------------ | Branch (5292:17): [True: 0, False: 2] ------------------ 5293| 0| fprintf(stderr, "ntfs_open: Incorrect NTFS magic\n"); 5294| 2| goto on_error; 5295| 2| } 5296| 2| } 5297| | 5298| | 5299| | /* 5300| | * block calculations : although there are no blocks in ntfs, 5301| | * we are using a cluster as a "block" 5302| | */ 5303| | 5304| 1| ntfs->ssize_b = tsk_getu16(fs->endian, ntfs->fs->ssize); ------------------ | | 86| 1|#define tsk_getu16(endian, x) \ | | 87| 1|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 1, False: 0] | | ------------------ | | 88| 1| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 1| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 5305| 1| if ((ntfs->ssize_b == 0) || (ntfs->ssize_b % 512)) { ------------------ | Branch (5305:9): [True: 0, False: 1] | Branch (5305:33): [True: 0, False: 1] ------------------ 5306| 0| tsk_error_reset(); 5307| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5308| 0| tsk_error_set_errstr 5309| 0| ("Not a NTFS file system (invalid sector size %d))", 5310| 0| ntfs->ssize_b); 5311| 0| if (tsk_verbose) ------------------ | Branch (5311:13): [True: 0, False: 0] ------------------ 5312| 0| fprintf(stderr, "ntfs_open: invalid sector size: %d\n", 5313| 0| ntfs->ssize_b); 5314| 0| goto on_error; 5315| 0| } 5316| | 5317| 1| if ((ntfs->fs->csize != 0x01) && ------------------ | Branch (5317:9): [True: 1, False: 0] ------------------ 5318| 1| (ntfs->fs->csize != 0x02) && ------------------ | Branch (5318:9): [True: 1, False: 0] ------------------ 5319| 1| (ntfs->fs->csize != 0x04) && ------------------ | Branch (5319:9): [True: 1, False: 0] ------------------ 5320| 1| (ntfs->fs->csize != 0x08) && ------------------ | Branch (5320:9): [True: 0, False: 1] ------------------ 5321| 1| (ntfs->fs->csize != 0x10) && ------------------ | Branch (5321:9): [True: 0, False: 0] ------------------ 5322| 1| (ntfs->fs->csize != 0x20) && (ntfs->fs->csize != 0x40) ------------------ | Branch (5322:9): [True: 0, False: 0] | Branch (5322:38): [True: 0, False: 0] ------------------ 5323| 1| && (ntfs->fs->csize != 0x80)) { ------------------ | Branch (5323:12): [True: 0, False: 0] ------------------ 5324| 0| tsk_error_reset(); 5325| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5326| 0| tsk_error_set_errstr 5327| 0| ("Not a NTFS file system (invalid cluster size %d)", 5328| 0| ntfs->fs->csize); 5329| 0| if (tsk_verbose) ------------------ | Branch (5329:13): [True: 0, False: 0] ------------------ 5330| 0| fprintf(stderr, "ntfs_open: invalid cluster size: %d\n", 5331| 0| ntfs->fs->csize); 5332| 0| goto on_error; 5333| 0| } 5334| | 5335| 1| ntfs->csize_b = ntfs->fs->csize * ntfs->ssize_b; 5336| 1| fs->first_block = 0; 5337| | /* This field is defined as 64-bits but according to the 5338| | * NTFS drivers in Linux, old Windows versions used only 32-bits 5339| | */ 5340| 1| fs->block_count = 5341| 1| (TSK_DADDR_T) tsk_getu64(fs->endian, ------------------ | | 171| 1|#define tsk_getu64(endian, x) \ | | 172| 1|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1, False: 0] | | ------------------ | | 173| 1| ((uint64_t) \ | | 174| 1| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1| : \ | | 183| 1| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 5342| 1| ntfs->fs->vol_size_s) / ntfs->fs->csize; 5343| 1| if (fs->block_count == 0) { ------------------ | Branch (5343:9): [True: 0, False: 1] ------------------ 5344| 0| tsk_error_reset(); 5345| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5346| 0| tsk_error_set_errstr("Not a NTFS file system (volume size is 0)"); 5347| 0| if (tsk_verbose) ------------------ | Branch (5347:13): [True: 0, False: 0] ------------------ 5348| 0| fprintf(stderr, "ntfs_open: invalid volume size: 0\n"); 5349| 0| goto on_error; 5350| 0| } 5351| | 5352| 1| fs->last_block = fs->last_block_act = fs->block_count - 1; 5353| 1| fs->block_size = ntfs->csize_b; 5354| 1| fs->dev_bsize = img_info->sector_size; 5355| | 5356| | // determine the last block we have in this image 5357| 1| if ((TSK_DADDR_T) ((img_info->size - offset) / fs->block_size) < ------------------ | Branch (5357:9): [True: 1, False: 0] ------------------ 5358| 1| fs->block_count) 5359| 1| fs->last_block_act = 5360| 1| (img_info->size - offset) / fs->block_size - 1; 5361| | 5362| 1| ntfs->mft_rsize_b = 0; 5363| 1| if (ntfs->fs->mft_rsize_c > 0) { ------------------ | Branch (5363:9): [True: 0, False: 1] ------------------ 5364| 0| ntfs->mft_rsize_b = ntfs->fs->mft_rsize_c * ntfs->csize_b; 5365| 0| } 5366| 1| else if (ntfs->fs->mft_rsize_c > -32) { ------------------ | Branch (5366:14): [True: 1, False: 0] ------------------ 5367| | /* if the mft_rsize_c is not > 0, then it is -log2(rsize_b) */ 5368| 1| ntfs->mft_rsize_b = 1 << -ntfs->fs->mft_rsize_c; 5369| 1| } 5370| | 5371| 1| if ((ntfs->mft_rsize_b == 0) || (ntfs->mft_rsize_b % 512)) { ------------------ | Branch (5371:9): [True: 0, False: 1] | Branch (5371:37): [True: 0, False: 1] ------------------ 5372| 0| tsk_error_reset(); 5373| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5374| 0| tsk_error_set_errstr 5375| 0| ("Not a NTFS file system (invalid MFT entry size)"); 5376| 0| if (tsk_verbose) ------------------ | Branch (5376:13): [True: 0, False: 0] ------------------ 5377| 0| fprintf(stderr, "ntfs_open: invalid MFT entry size\n"); 5378| 0| goto on_error; 5379| 0| } 5380| | 5381| 1| ntfs->idx_rsize_b = 0; 5382| 1| if (ntfs->fs->idx_rsize_c > 0) { ------------------ | Branch (5382:9): [True: 1, False: 0] ------------------ 5383| 1| ntfs->idx_rsize_b = ntfs->fs->idx_rsize_c * ntfs->csize_b; 5384| 1| } 5385| 0| else if (ntfs->fs->idx_rsize_c > -32) { ------------------ | Branch (5385:14): [True: 0, False: 0] ------------------ 5386| | /* if the idx_rsize_c is not > 0, then it is -log2(rsize_b) */ 5387| 0| ntfs->idx_rsize_b = 1 << -ntfs->fs->idx_rsize_c; 5388| 0| } 5389| | 5390| 1| if ((ntfs->idx_rsize_b == 0) || (ntfs->idx_rsize_b % 512)) { ------------------ | Branch (5390:9): [True: 0, False: 1] | Branch (5390:37): [True: 0, False: 1] ------------------ 5391| 0| tsk_error_reset(); 5392| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5393| 0| tsk_error_set_errstr 5394| 0| ("Not a NTFS file system (invalid idx record size %d)", 5395| 0| ntfs->idx_rsize_b); 5396| 0| if (tsk_verbose) ------------------ | Branch (5396:13): [True: 0, False: 0] ------------------ 5397| 0| fprintf(stderr, "ntfs_open: invalid idx record size %d\n", 5398| 0| ntfs->idx_rsize_b); 5399| 0| goto on_error; 5400| 0| } 5401| | 5402| 1| ntfs->root_mft_addr = 5403| 1| tsk_getu64(fs->endian, ntfs->fs->mft_clust) * ntfs->csize_b; ------------------ | | 171| 1|#define tsk_getu64(endian, x) \ | | 172| 1|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1, False: 0] | | ------------------ | | 173| 1| ((uint64_t) \ | | 174| 1| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1| : \ | | 183| 1| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 5404| 1| if (tsk_getu64(fs->endian, ntfs->fs->mft_clust) > fs->last_block) { ------------------ | | 171| 1|#define tsk_getu64(endian, x) \ | | 172| 1|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1, False: 0] | | ------------------ | | 173| 1| ((uint64_t) \ | | 174| 1| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1| : \ | | 183| 1| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (5404:9): [True: 0, False: 1] ------------------ 5405| 0| tsk_error_reset(); 5406| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 5407| 0| tsk_error_set_errstr 5408| 0| ("Not a NTFS file system (invalid starting MFT clust)"); 5409| 0| if (tsk_verbose) ------------------ | Branch (5409:13): [True: 0, False: 0] ------------------ 5410| 0| fprintf(stderr, "ntfs_open: invalid starting MFT cluster\n"); 5411| 0| goto on_error; 5412| 0| } 5413| | 5414| | /* 5415| | * Set the function pointers (before we start calling internal functions) 5416| | */ 5417| 1| fs->inode_walk = ntfs_inode_walk; 5418| 1| fs->block_walk = ntfs_block_walk; 5419| 1| fs->block_getflags = ntfs_block_getflags; 5420| | 5421| 1| fs->get_default_attr_type = ntfs_get_default_attr_type; 5422| 1| fs->load_attrs = ntfs_load_attrs; 5423| | 5424| 1| fs->file_add_meta = ntfs_inode_lookup; 5425| 1| fs->dir_open_meta = ntfs_dir_open_meta; 5426| 1| fs->fsstat = ntfs_fsstat; 5427| 1| fs->fscheck = ntfs_fscheck; 5428| 1| fs->istat = ntfs_istat; 5429| 1| fs->close = ntfs_close; 5430| 1| fs->name_cmp = ntfs_name_cmp; 5431| | 5432| 1| fs->fread_owner_sid = ntfs_file_get_sidstr; 5433| 1| fs->jblk_walk = ntfs_jblk_walk; 5434| 1| fs->jentry_walk = ntfs_jentry_walk; 5435| 1| fs->jopen = ntfs_jopen; 5436| 1| fs->journ_inum = 0; 5437| | 5438| | 5439| | 5440| | // set up locks 5441| 1| tsk_init_lock(&ntfs->lock); 5442| 1| tsk_init_lock(&ntfs->orphan_map_lock); 5443| 1|#if TSK_USE_SID 5444| 1| tsk_init_lock(&ntfs->sid_lock); 5445| 1|#endif 5446| | 5447| | /* 5448| | * inode 5449| | */ 5450| | 5451| 1| fs->root_inum = NTFS_ROOTINO; ------------------ | | 37| 1|#define NTFS_ROOTINO NTFS_MFT_ROOT | | ------------------ | | | | 132| 1|#define NTFS_MFT_ROOT 0x5 | | ------------------ ------------------ 5452| 1| fs->first_inum = NTFS_FIRSTINO; ------------------ | | 38| 1|#define NTFS_FIRSTINO 0 /* location of the $Mft Record */ ------------------ 5453| 1| fs->last_inum = NTFS_LAST_DEFAULT_INO; ------------------ | | 39| 1|#define NTFS_LAST_DEFAULT_INO 16 /* A guess for right now */ ------------------ 5454| 1| ntfs->mft_data = NULL; 5455| | 5456| | /* load the data run for the MFT table into ntfs->mft */ 5457| 1| ntfs->loading_the_MFT = 1; 5458| 1| if ((ntfs->mft_file = ------------------ | Branch (5458:9): [True: 0, False: 1] ------------------ 5459| 1| tsk_fs_file_open_meta(fs, NULL, NTFS_MFT_MFT)) == NULL) { ------------------ | | 127| 1|#define NTFS_MFT_MFT 0x0 ------------------ 5460| 0| if (tsk_verbose) ------------------ | Branch (5460:13): [True: 0, False: 0] ------------------ 5461| 0| fprintf(stderr, 5462| 0| "ntfs_open: Error opening $MFT (%s)\n", tsk_error_get()); 5463| 0| goto on_error; 5464| 0| } 5465| | 5466| | /* cache the data attribute 5467| | * 5468| | * This will likely be done already by proc_attrseq, but this 5469| | * should be quick 5470| | */ 5471| 1| ntfs->mft_data = 5472| 1| tsk_fs_attrlist_get(ntfs->mft_file->meta->attr, NTFS_ATYPE_DATA); ------------------ | | 199| 1|#define NTFS_ATYPE_DATA 0x80 // 128 ------------------ 5473| 1| if (!ntfs->mft_data) { ------------------ | Branch (5473:9): [True: 0, False: 1] ------------------ 5474| 0| tsk_error_errstr2_concat(" - Data Attribute not found in $MFT"); 5475| 0| if (tsk_verbose) ------------------ | Branch (5475:13): [True: 0, False: 0] ------------------ 5476| 0| fprintf(stderr, 5477| 0| "ntfs_open: Data attribute not found in $MFT (%s)\n", 5478| 0| tsk_error_get()); 5479| 0| goto on_error; 5480| 0| } 5481| | 5482| | /* Get the inode count based on the table size */ 5483| 1| fs->inum_count = ntfs->mft_data->size / ntfs->mft_rsize_b + 1; // we are adding 1 in this calc to account for Orphans directory 5484| 1| fs->last_inum = fs->inum_count - 1; 5485| | 5486| | /* reset the flag that we are no longer loading $MFT */ 5487| 1| ntfs->loading_the_MFT = 0; 5488| | 5489| | /* Volume ID */ 5490| 9| for (fs->fs_id_used = 0; fs->fs_id_used < 8; fs->fs_id_used++) { ------------------ | Branch (5490:30): [True: 8, False: 1] ------------------ 5491| 8| fs->fs_id[fs->fs_id_used] = ntfs->fs->serial[fs->fs_id_used]; 5492| 8| } 5493| | 5494| | /* load the version of the file system */ 5495| 1| if (ntfs_load_ver(ntfs)) { ------------------ | Branch (5495:9): [True: 0, False: 1] ------------------ 5496| 0| if (tsk_verbose) ------------------ | Branch (5496:13): [True: 0, False: 0] ------------------ 5497| 0| fprintf(stderr, 5498| 0| "ntfs_open: Error loading file system version ((%s)\n", 5499| 0| tsk_error_get()); 5500| 0| goto on_error; 5501| 0| } 5502| | 5503| | /* load the data block bitmap data run into ntfs_info */ 5504| 1| if (ntfs_load_bmap(ntfs)) { ------------------ | Branch (5504:9): [True: 0, False: 1] ------------------ 5505| 0| if (tsk_verbose) ------------------ | Branch (5505:13): [True: 0, False: 0] ------------------ 5506| 0| fprintf(stderr, "ntfs_open: Error loading block bitmap (%s)\n", 5507| 0| tsk_error_get()); 5508| 0| goto on_error; 5509| 0| } 5510| | 5511| | /* load the SID data into ntfs_info ($Secure - $SDS, $SDH, $SII */ 5512| | 5513| | 5514| 1|#if TSK_USE_SID 5515| 1| if (ntfs_load_secure(ntfs)) { ------------------ | Branch (5515:9): [True: 0, False: 1] ------------------ 5516| 0| if (tsk_verbose) ------------------ | Branch (5516:13): [True: 0, False: 0] ------------------ 5517| 0| fprintf(stderr, "ntfs_open: Error loading Secure Info (%s)\n", 5518| 0| tsk_error_get()); 5519| 0| goto on_error; 5520| 0| } 5521| 1|#endif 5522| | 5523| | // initialize the caches 5524| 1| ntfs->attrdef = NULL; 5525| 1| ntfs->orphan_map = NULL; 5526| | 5527| | // initialize the number of allocated files 5528| 1| ntfs->alloc_file_count = 0; 5529| | 5530| 1| if (tsk_verbose) { ------------------ | Branch (5530:9): [True: 0, False: 1] ------------------ 5531| 0| tsk_fprintf(stderr, 5532| 0| "ssize: %" PRIu16 5533| 0| " csize: %d serial: %" PRIx64 "\n", 5534| 0| tsk_getu16(fs->endian, ntfs->fs->ssize), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 5535| 0| ntfs->fs->csize, tsk_getu64(fs->endian, ntfs->fs->serial)); ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 5536| 0| tsk_fprintf(stderr, 5537| 0| "mft_rsize: %d idx_rsize: %d vol: %d mft: %" 5538| 0| PRIu64 " mft_mir: %" PRIu64 "\n", 5539| 0| ntfs->mft_rsize_b, ntfs->idx_rsize_b, 5540| 0| (int) fs->block_count, tsk_getu64(fs->endian, ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 5541| 0| ntfs->fs->mft_clust), tsk_getu64(fs->endian, ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 5542| 0| ntfs->fs->mftm_clust)); 5543| 0| } 5544| 1| return fs; 5545| | 5546| 2|on_error: 5547| 2| ntfs_close(fs); 5548| 2| return NULL; 5549| 1|} ntfs.c:process_kape_boot_format: 5189| 2|process_kape_boot_format(NTFS_INFO* ntfs_info) { 5190| | 5191| | // Check that we have a VHD 5192| 2| if (ntfs_info->fs_info.img_info->itype != TSK_IMG_TYPE_VHD_VHD) { ------------------ | Branch (5192:9): [True: 2, False: 0] ------------------ 5193| 2| return 1; 5194| 2| } 5195| | 5196| | // Check that expected name is present 5197| 0| if (strncmp(ntfs_info->fs->oemname, "NTFS ", 8) != 0) { ------------------ | Branch (5197:9): [True: 0, False: 0] ------------------ 5198| 0| return 1; 5199| 0| } 5200| | 5201| | // Check endianness using the sector size 5202| 0| uint16_t ssize = tsk_getu16(TSK_LIT_ENDIAN, ntfs_info->fs->ssize); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 5203| 0| if ((ssize != 0) && (ssize % 512 == 0)) { ------------------ | Branch (5203:9): [True: 0, False: 0] | Branch (5203:25): [True: 0, False: 0] ------------------ 5204| 0| ntfs_info->fs_info.endian = TSK_LIT_ENDIAN; 5205| 0| return 0; 5206| 0| } 5207| 0| ssize = tsk_getu16(TSK_BIG_ENDIAN, ntfs_info->fs->ssize); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 5208| 0| if ((ssize != 0) && (ssize % 512 == 0)) { ------------------ | Branch (5208:9): [True: 0, False: 0] | Branch (5208:25): [True: 0, False: 0] ------------------ 5209| 0| ntfs_info->fs_info.endian = TSK_BIG_ENDIAN; 5210| 0| return 0; 5211| 0| } 5212| | 5213| 0| return 1; 5214| 0|} ntfs.c:ntfs_dinode_copy: 2882| 4|{ 2883| 4| ntfs_attr *attr; 2884| 4| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ntfs->fs_info; 2885| 4| TSK_RETVAL_ENUM retval; 2886| 4| ntfs_mft *mft = (ntfs_mft *) a_buf; 2887| | 2888| 4| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)) { ------------------ | Branch (2888:9): [True: 0, False: 4] | Branch (2888:32): [True: 0, False: 4] ------------------ 2889| 0| tsk_error_reset(); 2890| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2891| 0| tsk_error_set_errstr("ntfs_dinode_copy: NULL fs_file given"); 2892| 0| return TSK_ERR; 2893| 0| } 2894| | 2895| | /* if the attributes list has been used previously, then make sure the 2896| | * flags are cleared 2897| | */ 2898| 4| if (a_fs_file->meta->attr) { ------------------ | Branch (2898:9): [True: 0, False: 4] ------------------ 2899| 0| tsk_fs_attrlist_markunused(a_fs_file->meta->attr); 2900| 0| } 2901| 4| else { 2902| 4| a_fs_file->meta->attr = tsk_fs_attrlist_alloc(); 2903| 4| if (a_fs_file->meta->attr == NULL) ------------------ | Branch (2903:13): [True: 0, False: 4] ------------------ 2904| 0| return TSK_ERR; 2905| 4| } 2906| 4| a_fs_file->meta->attr_state = TSK_FS_META_ATTR_EMPTY; 2907| | 2908| | /* If there are any name structures allocated, then free 'em */ 2909| 4| if (a_fs_file->meta->name2) { ------------------ | Branch (2909:9): [True: 0, False: 4] ------------------ 2910| 0| TSK_FS_META_NAME_LIST *fs_name1, *fs_name2; 2911| 0| fs_name1 = a_fs_file->meta->name2; 2912| | 2913| 0| while (fs_name1) { ------------------ | Branch (2913:16): [True: 0, False: 0] ------------------ 2914| 0| fs_name2 = fs_name1->next; 2915| 0| free(fs_name1); 2916| 0| fs_name1 = fs_name2; 2917| 0| } 2918| 0| a_fs_file->meta->name2 = NULL; 2919| 0| } 2920| | 2921| | /* Set the a_fs_file->meta values from mft */ 2922| 4| a_fs_file->meta->nlink = tsk_getu16(fs->endian, mft->link); ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2923| 4| a_fs_file->meta->seq = tsk_getu16(fs->endian, mft->seq); ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2924| 4| a_fs_file->meta->addr = a_mnum; 2925| | 2926| | /* Set the mode for file or directory */ 2927| 4| if (tsk_getu16(fs->endian, mft->flags) & NTFS_MFT_DIR) ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, mft->flags) & NTFS_MFT_DIR) ------------------ | | 119| 4|#define NTFS_MFT_DIR 0x0002 ------------------ | Branch (2927:9): [True: 1, False: 3] ------------------ 2928| 1| a_fs_file->meta->type = TSK_FS_META_TYPE_DIR; 2929| 3| else 2930| 3| a_fs_file->meta->type = TSK_FS_META_TYPE_REG; 2931| 4| a_fs_file->meta->mode = 0; // will be set by proc_attrseq 2932| | 2933| | /* the following will be changed once we find the correct attribute, 2934| | * but initialize them now just in case 2935| | */ 2936| 4| a_fs_file->meta->uid = 0; 2937| 4| a_fs_file->meta->gid = 0; 2938| 4| a_fs_file->meta->size = 0; 2939| 4| a_fs_file->meta->mtime = 0; 2940| 4| a_fs_file->meta->mtime_nano = 0; 2941| 4| a_fs_file->meta->atime = 0; 2942| 4| a_fs_file->meta->atime_nano = 0; 2943| 4| a_fs_file->meta->ctime = 0; 2944| 4| a_fs_file->meta->ctime_nano = 0; 2945| 4| a_fs_file->meta->crtime = 0; 2946| 4| a_fs_file->meta->crtime_nano = 0; 2947| 4| a_fs_file->meta->time2.ntfs.fn_mtime = 0; 2948| 4| a_fs_file->meta->time2.ntfs.fn_mtime_nano = 0; 2949| 4| a_fs_file->meta->time2.ntfs.fn_atime = 0; 2950| 4| a_fs_file->meta->time2.ntfs.fn_atime_nano = 0; 2951| 4| a_fs_file->meta->time2.ntfs.fn_ctime = 0; 2952| 4| a_fs_file->meta->time2.ntfs.fn_ctime_nano = 0; 2953| 4| a_fs_file->meta->time2.ntfs.fn_crtime = 0; 2954| 4| a_fs_file->meta->time2.ntfs.fn_crtime_nano = 0; 2955| 4| a_fs_file->meta->time2.ntfs.fn_id = 0; 2956| | 2957| | /* add the flags */ 2958| 4| a_fs_file->meta->flags = 2959| 4| ((tsk_getu16(fs->endian, mft->flags) & ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (2959:10): [True: 4, False: 0] ------------------ 2960| 4| NTFS_MFT_INUSE) ? TSK_FS_META_FLAG_ALLOC : ------------------ | | 118| 4|#define NTFS_MFT_INUSE 0x0001 ------------------ 2961| 4| TSK_FS_META_FLAG_UNALLOC); 2962| | 2963| | 2964| | /* Process the attribute sequence to fill in the fs_meta->attr 2965| | * list and the other info such as size and times 2966| | */ 2967| 4| if (tsk_getu16(fs->endian, mft->attr_off) > ntfs->mft_rsize_b) { ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (2967:9): [True: 0, False: 4] ------------------ 2968| 0| tsk_error_reset(); 2969| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2970| 0| tsk_error_set_errstr("ntfs_dinode_copy: corrupt MFT entry attribute offsets"); 2971| 0| return TSK_ERR; 2972| 0| } 2973| | 2974| 4| attr = 2975| 4| (ntfs_attr *) ((uintptr_t) mft + tsk_getu16(fs->endian, ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2976| 4| mft->attr_off)); 2977| 4| if ((retval = ntfs_proc_attrseq(ntfs, a_fs_file, attr, ------------------ | Branch (2977:9): [True: 0, False: 4] ------------------ 2978| 4| ntfs->mft_rsize_b - tsk_getu16(fs->endian, ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2979| 4| mft->attr_off), a_fs_file->meta->addr, 2980| 4| NULL, NULL)) != TSK_OK) { 2981| 0| return retval; 2982| 0| } 2983| | 2984| | /* The entry has been 'used' if it has attributes */ 2985| | 2986| 4| if ((a_fs_file->meta->attr == NULL) ------------------ | Branch (2986:9): [True: 0, False: 4] ------------------ 2987| 4| || (a_fs_file->meta->attr->head == NULL) ------------------ | Branch (2987:12): [True: 0, False: 4] ------------------ 2988| 4| || ((a_fs_file->meta->attr->head->flags & TSK_FS_ATTR_INUSE) == 0)) ------------------ | Branch (2988:12): [True: 0, False: 4] ------------------ 2989| 0| a_fs_file->meta->flags |= TSK_FS_META_FLAG_UNUSED; 2990| 4| else 2991| 4| a_fs_file->meta->flags |= TSK_FS_META_FLAG_USED; 2992| | 2993| 4| return TSK_OK; 2994| 4|} ntfs.c:ntfs_proc_attrseq: 1848| 4|{ 1849| 4| const ntfs_attr *attr; 1850| 4| const TSK_FS_ATTR *fs_attr_attrl = NULL; 1851| 4| char name[NTFS_MAXNAMLEN_UTF8 + 1]; 1852| 4| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ntfs->fs_info; 1853| | 1854| 4| if (tsk_verbose) ------------------ | Branch (1854:9): [True: 0, False: 4] ------------------ 1855| 0| tsk_fprintf(stderr, 1856| 0| "ntfs_proc_attrseq: Processing extended entry for primary entry %" 1857| 0| PRIuINUM "\n", fs_file->meta->addr); 1858| | 1859| 4| if (fs_file->meta->attr == NULL) { ------------------ | Branch (1859:9): [True: 0, False: 4] ------------------ 1860| 0| tsk_error_reset(); 1861| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1862| 0| tsk_error_set_errstr("Null attribute list in ntfs_proc_attrseq"); 1863| 0| return TSK_ERR; 1864| 0| } 1865| | 1866| 4| if (len > ntfs->mft_rsize_b) { ------------------ | Branch (1866:9): [True: 0, False: 4] ------------------ 1867| 0| tsk_error_reset(); 1868| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1869| 0| tsk_error_set_errstr("invalid length in ntfs_proc_attrseq"); 1870| 0| return TSK_ERR; 1871| 0| } 1872| | 1873| | 1874| | /* Cycle through the list of attributes 1875| | * There are 16 bytes in the non-union part of 1876| | * an ntfs_attr, so make sure there is at least room for that */ 1877| 25| for (attr = a_attrseq; ((uintptr_t) attr >= (uintptr_t) a_attrseq) ------------------ | Branch (1877:28): [True: 25, False: 0] ------------------ 1878| 25| && ((uintptr_t) attr + 16 <= ((uintptr_t) a_attrseq + len)) ------------------ | Branch (1878:12): [True: 25, False: 0] ------------------ 1879| 25| && (tsk_getu32(fs->endian, attr->len) > 0 ------------------ | | 119| 25|#define tsk_getu32(endian, x) \ | | 120| 25|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 25, False: 0] | | ------------------ | | 121| 25| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 25| (((uint8_t *)(x))[1] << 8) + \ | | 123| 25| (((uint8_t *)(x))[2] << 16) + \ | | 124| 25| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 25| : \ | | 126| 25| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1879:13): [True: 21, False: 4] ------------------ 1880| 25| && (tsk_getu32(fs->endian, attr->type) != ------------------ | | 119| 21|#define tsk_getu32(endian, x) \ | | 120| 21|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 21, False: 0] | | ------------------ | | 121| 21| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 21| (((uint8_t *)(x))[1] << 8) + \ | | 123| 21| (((uint8_t *)(x))[2] << 16) + \ | | 124| 21| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 21| : \ | | 126| 21| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1880:16): [True: 21, False: 0] ------------------ 1881| 21| 0xffffffff)); 1882| 21| attr = 1883| 21| (ntfs_attr *) ((uintptr_t) attr + tsk_getu32(fs->endian, ------------------ | | 119| 21|#define tsk_getu32(endian, x) \ | | 120| 21|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 21, False: 0] | | ------------------ | | 121| 21| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 21| (((uint8_t *)(x))[1] << 8) + \ | | 123| 21| (((uint8_t *)(x))[2] << 16) + \ | | 124| 21| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 21| : \ | | 126| 21| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1884| 21| attr->len))) { 1885| | 1886| 21| int retVal, i; 1887| 21| uint32_t type; 1888| 21| uint16_t id, id_new; 1889| | 1890| | // sanity check on bounds of attribute. Prevents other 1891| | // issues later on that use attr->len for bounds checks. 1892| 21| if (((uintptr_t) attr + tsk_getu32(fs->endian, ------------------ | | 119| 21|#define tsk_getu32(endian, x) \ | | 120| 21|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 21, False: 0] | | ------------------ | | 121| 21| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 21| (((uint8_t *)(x))[1] << 8) + \ | | 123| 21| (((uint8_t *)(x))[2] << 16) + \ | | 124| 21| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 21| : \ | | 126| 21| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1892:13): [True: 0, False: 21] ------------------ 1893| 21| attr->len)) > (uintptr_t)a_attrseq + len) { 1894| 0| break; 1895| 0| } 1896| | 1897| | // Ensure that the name offset doesn't refer to a location beyond 1898| | // the attribute. 1899| 21| if (((uintptr_t)attr + tsk_getu16(fs->endian, attr->name_off)) > ------------------ | | 86| 21|#define tsk_getu16(endian, x) \ | | 87| 21|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 21, False: 0] | | ------------------ | | 88| 21| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 21| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1899:13): [True: 0, False: 21] ------------------ 1900| 21| ((uintptr_t)attr + tsk_getu32(fs->endian, attr->len))) { ------------------ | | 119| 21|#define tsk_getu32(endian, x) \ | | 120| 21|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 21, False: 0] | | ------------------ | | 121| 21| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 21| (((uint8_t *)(x))[1] << 8) + \ | | 123| 21| (((uint8_t *)(x))[2] << 16) + \ | | 124| 21| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 21| : \ | | 126| 21| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1901| 0| break; 1902| 0| } 1903| | 1904| | /* Get the type of this attribute */ 1905| 21| type = tsk_getu32(fs->endian, attr->type); ------------------ | | 119| 21|#define tsk_getu32(endian, x) \ | | 120| 21|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 21, False: 0] | | ------------------ | | 121| 21| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 21| (((uint8_t *)(x))[1] << 8) + \ | | 123| 21| (((uint8_t *)(x))[2] << 16) + \ | | 124| 21| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 21| : \ | | 126| 21| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1906| 21| id = tsk_getu16(fs->endian, attr->id); ------------------ | | 86| 21|#define tsk_getu16(endian, x) \ | | 87| 21|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 21, False: 0] | | ------------------ | | 88| 21| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 21| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1907| 21| id_new = id; 1908| | 1909| | /* If the map was supplied, search through it to see if this 1910| | * entry is in there. Use that ID instead so that we always have 1911| | * unique IDs for each attribute -- even if it spans multiple MFT entries. */ 1912| 21| if (a_attr_map) { ------------------ | Branch (1912:13): [True: 0, False: 21] ------------------ 1913| 0| for (i = 0; i < a_attr_map->num_used; i++) { ------------------ | Branch (1913:25): [True: 0, False: 0] ------------------ 1914| 0| if ((a_attr_map->type[i] == type) && ------------------ | Branch (1914:21): [True: 0, False: 0] ------------------ 1915| 0| (memcmp(a_attr_map->name[i], ------------------ | Branch (1915:21): [True: 0, False: 0] ------------------ 1916| 0| (void *) ((uintptr_t) attr + 1917| 0| tsk_getu16(fs->endian, attr->name_off)), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1918| 0| attr->nlen * 2) == 0)) { 1919| 0| id_new = a_attr_map->newId[i]; 1920| 0| break; 1921| 0| } 1922| 0| } 1923| 0| } 1924| | 1925| | /* Copy the name and convert it to UTF8 */ 1926| 21| const uint16_t nameoff = tsk_getu16(fs->endian, attr->name_off); ------------------ | | 86| 21|#define tsk_getu16(endian, x) \ | | 87| 21|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 21, False: 0] | | ------------------ | | 88| 21| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 21| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1927| 21| if (attr->nlen && nameoff + (uint32_t) attr->nlen * 2 < tsk_getu32(fs->endian, attr->len)) { ------------------ | | 119| 6|#define tsk_getu32(endian, x) \ | | 120| 6|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6, False: 0] | | ------------------ | | 121| 6| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 6| : \ | | 126| 6| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1927:13): [True: 6, False: 15] | Branch (1927:27): [True: 6, False: 0] ------------------ 1928| 6| int i; 1929| 6| UTF8 *name8; 1930| 6| UTF16 *name16; 1931| | 1932| 6| name8 = (UTF8 *) name; 1933| 6| name16 = (UTF16 *) ((uintptr_t) attr + nameoff); 1934| | 1935| 6| retVal = 1936| 6| tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16, 1937| 6| (UTF16 *) ((uintptr_t) name16 + 1938| 6| attr->nlen * 2), 1939| 6| &name8, 1940| 6| (UTF8 *) ((uintptr_t) name8 + 1941| 6| sizeof(name)), TSKlenientConversion); 1942| | 1943| 6| if (retVal != TSKconversionOK) { ------------------ | Branch (1943:17): [True: 0, False: 6] ------------------ 1944| 0| if (tsk_verbose) ------------------ | Branch (1944:21): [True: 0, False: 0] ------------------ 1945| 0| tsk_fprintf(stderr, 1946| 0| "ntfs_proc_attrseq: Error converting NTFS attribute name to UTF8: %d %" 1947| 0| PRIuINUM, retVal, fs_file->meta->addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 1948| 0| *name = '\0'; 1949| 0| } 1950| | 1951| | /* Make sure it is NULL Terminated */ 1952| 6| else if ((uintptr_t) name8 >= (uintptr_t) name + sizeof(name)) ------------------ | Branch (1952:22): [True: 0, False: 6] ------------------ 1953| 0| name[sizeof(name) - 1] = '\0'; 1954| 6| else 1955| 6| *name8 = '\0'; 1956| | 1957| | /* Clean up name */ 1958| 6| i = 0; 1959| 30| while (name[i] != '\0') { ------------------ | Branch (1959:20): [True: 24, False: 6] ------------------ 1960| 24| if (TSK_IS_CNTRL(name[i])) ------------------ | | 203| 24|#define TSK_IS_CNTRL(x) \ | | 204| 24|(((x) < 0x20) && ((x) >= 0x00)) | | ------------------ | | | Branch (204:2): [True: 0, False: 24] | | | Branch (204:18): [True: 0, False: 0] | | ------------------ ------------------ 1961| 0| name[i] = '^'; 1962| 24| i++; 1963| 24| } 1964| 6| } 1965| 15| else { 1966| 15| name[0] = '\0'; 1967| 15| } 1968| | 1969| | /* For resident attributes, we will copy the buffer into 1970| | * a TSK_FS_ATTR buffer, which is stored in the TSK_FS_META 1971| | * structure 1972| | */ 1973| 21| if (attr->res == NTFS_MFT_RES) { ------------------ | | 176| 21|#define NTFS_MFT_RES 0 /* resident */ ------------------ | Branch (1973:13): [True: 16, False: 5] ------------------ 1974| 16| TSK_FS_ATTR *fs_attr; 1975| | 1976| 16| if (tsk_verbose) ------------------ | Branch (1976:17): [True: 0, False: 16] ------------------ 1977| 0| tsk_fprintf(stderr, 1978| 0| "ntfs_proc_attrseq: Resident Attribute in Type: %" 1979| 0| PRIu32 " Id: %" PRIu16 " IdNew: %" PRIu16 1980| 0| " Name: %s\n", type, id, id_new, name); 1981| | 1982| | /* Check that there is room for the data. 1983| | * Resident data needs 24 bytes total */ 1984| 16| if (((uintptr_t)attr + 24) > ((uintptr_t)a_attrseq + len)) { ------------------ | Branch (1984:17): [True: 0, False: 16] ------------------ 1985| 0| tsk_error_reset(); 1986| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1987| 0| tsk_error_set_errstr("ntfs_attr_walk: Resident attribute %" 1988| 0| PRIuINUM "-%" PRIu32 1989| 0| " starting offset and length too large", 1990| 0| fs_file->meta->addr, type); 1991| 0| return TSK_COR; 1992| 0| } 1993| | 1994| | /* Validate the offset lengths */ 1995| 16| if (((tsk_getu16(fs->endian, ------------------ | | 86| 16|#define tsk_getu16(endian, x) \ | | 87| 16|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 16, False: 0] | | ------------------ | | 88| 16| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 16| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1995:17): [True: 0, False: 16] ------------------ 1996| 16| attr->c.r.soff) + (uintptr_t) attr) > 1997| 16| ((uintptr_t) a_attrseq + len)) 1998| 16| || (((size_t)tsk_getu16(fs->endian, ------------------ | | 86| 16|#define tsk_getu16(endian, x) \ | | 87| 16|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 16, False: 0] | | ------------------ | | 88| 16| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 16| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1998:20): [True: 0, False: 16] ------------------ 1999| 16| attr->c.r.soff) + tsk_getu32(fs->endian, ------------------ | | 119| 16|#define tsk_getu32(endian, x) \ | | 120| 16|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 16, False: 0] | | ------------------ | | 121| 16| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 16| (((uint8_t *)(x))[1] << 8) + \ | | 123| 16| (((uint8_t *)(x))[2] << 16) + \ | | 124| 16| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 16| : \ | | 126| 16| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2000| 16| attr->c.r.ssize) + (uintptr_t) attr) > 2001| 16| ((uintptr_t) a_attrseq + len))) { 2002| 0| tsk_error_reset(); 2003| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2004| 0| tsk_error_set_errstr("ntfs_attr_walk: Resident attribute %" 2005| 0| PRIuINUM "-%" PRIu32 2006| 0| " starting offset and length too large", 2007| 0| fs_file->meta->addr, type); 2008| 0| return TSK_COR; 2009| 0| } 2010| | 2011| | // Get a free fs_attr structure 2012| 16| if ((fs_attr = ------------------ | Branch (2012:17): [True: 0, False: 16] ------------------ 2013| 16| tsk_fs_attrlist_getnew(fs_file->meta->attr, 2014| 16| TSK_FS_ATTR_RES)) == NULL) { 2015| 0| tsk_error_errstr2_concat(" - proc_attrseq"); 2016| 0| return TSK_ERR; 2017| 0| } 2018| | 2019| | // set the details in the fs_attr structure 2020| 16| if (tsk_fs_attr_set_str(fs_file, fs_attr, name, type, ------------------ | Branch (2020:17): [True: 0, False: 16] ------------------ 2021| 16| id_new, (void *) ((uintptr_t) attr + 2022| 16| tsk_getu16(fs->endian, ------------------ | | 86| 16|#define tsk_getu16(endian, x) \ | | 87| 16|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 16, False: 0] | | ------------------ | | 88| 16| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 16| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2023| 16| attr->c.r.soff)), tsk_getu32(fs->endian, ------------------ | | 119| 16|#define tsk_getu32(endian, x) \ | | 120| 16|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 16, False: 0] | | ------------------ | | 121| 16| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 16| (((uint8_t *)(x))[1] << 8) + \ | | 123| 16| (((uint8_t *)(x))[2] << 16) + \ | | 124| 16| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 16| : \ | | 126| 16| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2024| 16| attr->c.r.ssize))) { 2025| 0| tsk_error_errstr2_concat("- proc_attrseq"); 2026| 0| return TSK_ERR; 2027| 0| } 2028| | 2029| | // set the meta size if we find the relevant attribute 2030| 16| if (TSK_FS_IS_DIR_META(fs_file->meta->type) ------------------ | | 414| 32|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 4, False: 12] | | | Branch (414:63): [True: 0, False: 12] | | ------------------ ------------------ 2031| 16| && (type == NTFS_ATYPE_IDXROOT)) { ------------------ | | 200| 4|#define NTFS_ATYPE_IDXROOT 0x90 // 144 ------------------ | Branch (2031:20): [True: 1, False: 3] ------------------ 2032| 1| fs_file->meta->size = 2033| 1| tsk_getu32(fs->endian, attr->c.r.ssize); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2034| 1| } 2035| 15| else if ((fs_file->meta->type == TSK_FS_META_TYPE_REG) ------------------ | Branch (2035:22): [True: 12, False: 3] ------------------ 2036| 15| && (type == NTFS_ATYPE_DATA) && (name[0] == '\0')) { ------------------ | | 199| 12|#define NTFS_ATYPE_DATA 0x80 // 128 ------------------ | Branch (2036:20): [True: 1, False: 11] | Branch (2036:49): [True: 1, False: 0] ------------------ 2037| 1| fs_file->meta->size = 2038| 1| tsk_getu32(fs->endian, attr->c.r.ssize); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2039| 1| } 2040| 16| } 2041| | 2042| | /* For non-resident attributes, we will copy the runlist 2043| | * to the generic form and then save it in the TSK_FS_META->attr 2044| | * list 2045| | */ 2046| 5| else { 2047| 5| TSK_FS_ATTR *fs_attr = NULL; 2048| 5| TSK_FS_ATTR_RUN *fs_attr_run = NULL; 2049| 5| uint8_t data_flag = 0; 2050| 5| uint32_t compsize = 0; 2051| 5| TSK_RETVAL_ENUM retval; 2052| | 2053| 5| if (tsk_verbose) ------------------ | Branch (2053:17): [True: 0, False: 5] ------------------ 2054| 0| tsk_fprintf(stderr, 2055| 0| "ntfs_proc_attrseq: Non-Resident Attribute Type: %" 2056| 0| PRIu32 " Id: %" PRIu16 " IdNew: %" PRIu16 2057| 0| " Name: %s Start VCN: %" PRIu64 "\n", type, id, 2058| 0| id_new, name, tsk_getu64(fs->endian, ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2059| 0| attr->c.nr.start_vcn)); 2060| | 2061| | /* Check that there is room for the data. 2062| | * Non-resident data needs 64 bytes total */ 2063| 5| if (((uintptr_t)attr + 64) > ((uintptr_t)a_attrseq + len)) { ------------------ | Branch (2063:17): [True: 0, False: 5] ------------------ 2064| 0| tsk_error_reset(); 2065| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2066| 0| tsk_error_set_errstr("ntfs_attr_walk: Non-Resident attribute %" 2067| 0| PRIuINUM "-%" PRIu32 2068| 0| " starting offset and length too large", 2069| 0| fs_file->meta->addr, type); 2070| 0| return TSK_COR; 2071| 0| } 2072| | 2073| 5| uint32_t attr_len = tsk_getu32(fs->endian, attr->len); ------------------ | | 119| 5|#define tsk_getu32(endian, x) \ | | 120| 5|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 5, False: 0] | | ------------------ | | 121| 5| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 5| (((uint8_t *)(x))[1] << 8) + \ | | 123| 5| (((uint8_t *)(x))[2] << 16) + \ | | 124| 5| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 5| : \ | | 126| 5| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2074| 5| uint64_t run_start_vcn = tsk_getu64(fs->endian, attr->c.nr.start_vcn); ------------------ | | 171| 5|#define tsk_getu64(endian, x) \ | | 172| 5|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 5, False: 0] | | ------------------ | | 173| 5| ((uint64_t) \ | | 174| 5| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 5| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 5| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 5| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 5| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 5| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 5| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 5| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 5| : \ | | 183| 5| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2075| 5| uint16_t run_off = tsk_getu16(fs->endian, attr->c.nr.run_off); ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2076| | 2077| | // sanity check 2078| 5| if ((run_off < 48) || (run_off >= attr_len)) { ------------------ | Branch (2078:17): [True: 0, False: 5] | Branch (2078:35): [True: 0, False: 5] ------------------ 2079| 0| if (tsk_verbose) ------------------ | Branch (2079:21): [True: 0, False: 0] ------------------ 2080| 0| tsk_fprintf(stderr, "ntfs_proc_attrseq: run offset out of bounds\n"); 2081| 0| break; 2082| 0| } 2083| | 2084| | /* convert the run to generic form */ 2085| 5| retval = ntfs_make_data_run(ntfs, 2086| 5| run_start_vcn, 2087| 5| (ntfs_runlist *) ((uintptr_t) attr + run_off), 2088| 5| attr_len - run_off, 2089| 5| &fs_attr_run, NULL, 2090| 5| a_attrinum); 2091| 5| if (retval != TSK_OK) { ------------------ | Branch (2091:17): [True: 0, False: 5] ------------------ 2092| 0| tsk_error_errstr2_concat(" - proc_attrseq"); 2093| 0| return retval; 2094| 0| } 2095| | 2096| | /* Determine the flags based on compression and stuff */ 2097| 5| data_flag = 0; 2098| 5| if (tsk_getu16(fs->endian, attr->flags) & NTFS_ATTR_FLAG_COMP) { ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, attr->flags) & NTFS_ATTR_FLAG_COMP) { ------------------ | | 182| 5|#define NTFS_ATTR_FLAG_COMP 0x0001 /* compressed */ ------------------ | Branch (2098:17): [True: 0, False: 5] ------------------ 2099| 0| data_flag |= TSK_FS_ATTR_COMP; 2100| 0| fs_file->meta->flags |= TSK_FS_META_FLAG_COMP; 2101| 0| } 2102| | 2103| 5| if (tsk_getu16(fs->endian, attr->flags) & NTFS_ATTR_FLAG_ENC) ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, attr->flags) & NTFS_ATTR_FLAG_ENC) ------------------ | | 183| 5|#define NTFS_ATTR_FLAG_ENC 0x4000 /* encrypted */ ------------------ | Branch (2103:17): [True: 0, False: 5] ------------------ 2104| 0| data_flag |= TSK_FS_ATTR_ENC; 2105| | 2106| 5| if (tsk_getu16(fs->endian, attr->flags) & NTFS_ATTR_FLAG_SPAR) ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, attr->flags) & NTFS_ATTR_FLAG_SPAR) ------------------ | | 184| 5|#define NTFS_ATTR_FLAG_SPAR 0x8000 /* sparse */ ------------------ | Branch (2106:17): [True: 0, False: 5] ------------------ 2107| 0| data_flag |= TSK_FS_ATTR_SPARSE; 2108| | 2109| | /* SPECIAL CASE 2110| | * We are in non-res section, so we know this 2111| | * isn't $STD_INFO and $FNAME 2112| | * 2113| | * When we are processing a non-base entry, we may 2114| | * find an attribute with an id of 0 and it is an 2115| | * extension of a previous run (i.e. non-zero start VCN) 2116| | * 2117| | * We will lookup if we already have such an attribute 2118| | * and get its ID 2119| | * 2120| | * We could also check for a start_vcn if this does 2121| | * not fix the problem. 2122| | * 2123| | * NOTE: This should not be needed now that TSK assigns 2124| | * unique ID values to the extended attributes. 2125| | */ 2126| 5| if (id_new == 0) { ------------------ | Branch (2126:17): [True: 0, False: 5] ------------------ 2127| 0| int cnt, i; 2128| | 2129| | // cycle through the attributes 2130| 0| cnt = tsk_fs_file_attr_getsize(fs_file); 2131| 0| for (i = 0; i < cnt; i++) { ------------------ | Branch (2131:29): [True: 0, False: 0] ------------------ 2132| | 2133| 0| const TSK_FS_ATTR *fs_attr2 = 2134| 0| tsk_fs_file_attr_get_idx(fs_file, i); 2135| 0| if (!fs_attr2) ------------------ | Branch (2135:25): [True: 0, False: 0] ------------------ 2136| 0| continue; 2137| | 2138| | /* We found an attribute with the same name and type */ 2139| 0| if (fs_attr2->type == type) { ------------------ | Branch (2139:25): [True: 0, False: 0] ------------------ 2140| 0| if (((name[0] == '\0') && (fs_attr2->name == NULL)) ------------------ | Branch (2140:30): [True: 0, False: 0] | Branch (2140:51): [True: 0, False: 0] ------------------ 2141| 0| || ((fs_attr2->name) ------------------ | Branch (2141:33): [True: 0, False: 0] ------------------ 2142| 0| && (strcmp(fs_attr2->name, name) == 0))) { ------------------ | Branch (2142:36): [True: 0, False: 0] ------------------ 2143| 0| id_new = fs_attr2->id; 2144| 0| if (tsk_verbose) ------------------ | Branch (2144:33): [True: 0, False: 0] ------------------ 2145| 0| tsk_fprintf(stderr, 2146| 0| "ntfs_proc_attrseq: Updating id from 0 to %" 2147| 0| PRIu16 "\n", id_new); 2148| 0| break; 2149| 0| } 2150| 0| } 2151| 0| } 2152| 0| } 2153| | 2154| | /* the compression unit size is stored in the header 2155| | * it is stored as the power of 2 (if it is not 0) 2156| | */ 2157| 5| if (tsk_getu16(fs->endian, attr->c.nr.compusize) > 16) { ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (2157:17): [True: 0, False: 5] ------------------ 2158| | /* 64k is the maximum compression unit size */ 2159| 0| tsk_error_reset(); 2160| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2161| 0| tsk_error_set_errstr("ntfs_proc_attrseq: Compression unit size 2^%d too large", 2162| 0| tsk_getu16(fs->endian, attr->c.nr.compusize)); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2163| 0| if (fs_attr_run) { ------------------ | Branch (2163:21): [True: 0, False: 0] ------------------ 2164| 0| tsk_fs_attr_run_free(fs_attr_run); 2165| 0| fs_attr_run = NULL; 2166| 0| } 2167| 0| return TSK_COR; 2168| 0| } 2169| | 2170| 5| if (tsk_getu16(fs->endian, attr->c.nr.compusize) > 0) { ------------------ | | 86| 5|#define tsk_getu16(endian, x) \ | | 87| 5|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 5, False: 0] | | ------------------ | | 88| 5| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 5| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (2170:17): [True: 0, False: 5] ------------------ 2171| 0| compsize = 2172| 0| 1 << (tsk_getu16(fs->endian, attr->c.nr.compusize)); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2173| 0| } 2174| 5| else { 2175| 5| compsize = 0; 2176| | /* if this is 0, be sure to cancel out the COMP flag. 2177| | * This occurs when we process an extended attribute 2178| | * that has compressed data -- the attributes in the 2179| | * latter MFT entries do not have compsize set. 2180| | */ 2181| 5| if (data_flag & TSK_FS_ATTR_COMP) { ------------------ | Branch (2181:21): [True: 0, False: 5] ------------------ 2182| 0| if (tsk_verbose) ------------------ | Branch (2182:25): [True: 0, False: 0] ------------------ 2183| 0| fprintf(stderr, 2184| 0| "ntfs_proc_attrseq: Clearing compression setting for attribute %" 2185| 0| PRIuINUM "-%d because compsize is 0\n", 2186| 0| fs_file->meta->addr, type); 2187| 0| data_flag &= ~TSK_FS_ATTR_COMP; 2188| 0| } 2189| 5| } 2190| | 2191| | /* Add the run to the list */ 2192| | // see if this attribute has already been partially defined 2193| | // @@@ This is bad design, we are casting away the const... 2194| 5| fs_attr = 2195| 5| (TSK_FS_ATTR *) tsk_fs_attrlist_get_id(fs_file->meta->attr, 2196| 5| type, id_new); 2197| 5| if (fs_attr == NULL) { ------------------ | Branch (2197:17): [True: 5, False: 0] ------------------ 2198| 5| uint64_t ssize; // size 2199| 5| uint64_t alen; // allocated length 2200| | 2201| 5| if ((fs_attr = ------------------ | Branch (2201:21): [True: 0, False: 5] ------------------ 2202| 5| tsk_fs_attrlist_getnew(fs_file->meta->attr, 2203| 5| TSK_FS_ATTR_RES)) == NULL) { 2204| 0| tsk_error_errstr2_concat(" - proc_attrseq: getnew"); 2205| | // JRB: Coverity found leak. 2206| 0| if (fs_attr_run) { ------------------ | Branch (2206:25): [True: 0, False: 0] ------------------ 2207| 0| tsk_fs_attr_run_free(fs_attr_run); 2208| 0| fs_attr_run = NULL; 2209| 0| } 2210| 0| return TSK_ERR; 2211| 0| } 2212| | 2213| 5| ssize = tsk_getu64(fs->endian, attr->c.nr.ssize); ------------------ | | 171| 5|#define tsk_getu64(endian, x) \ | | 172| 5|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 5, False: 0] | | ------------------ | | 173| 5| ((uint64_t) \ | | 174| 5| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 5| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 5| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 5| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 5| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 5| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 5| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 5| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 5| : \ | | 183| 5| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2214| | /* This can happen with extended attributes, so 2215| | * we set it based on what we currently have. 2216| | * fs_attr_run can be NULL for $BadClust file. */ 2217| 5| if ((ssize == 0) && (fs_attr_run)) { ------------------ | Branch (2217:21): [True: 0, False: 5] | Branch (2217:37): [True: 0, False: 0] ------------------ 2218| 0| TSK_FS_ATTR_RUN *fs_attr_run_tmp; 2219| | 2220| 0| ssize = fs_attr_run->offset * fs->block_size; 2221| 0| fs_attr_run_tmp = fs_attr_run; 2222| 0| while (fs_attr_run_tmp) { ------------------ | Branch (2222:28): [True: 0, False: 0] ------------------ 2223| 0| ssize += (fs_attr_run_tmp->len * fs->block_size); 2224| 0| fs_attr_run_tmp = fs_attr_run_tmp->next; 2225| 0| } 2226| 0| } 2227| | 2228| | // update the meta->size value if this is the default $Data attribute 2229| 5| if ((fs_file->meta->type == TSK_FS_META_TYPE_REG) ------------------ | Branch (2229:21): [True: 3, False: 2] ------------------ 2230| 5| && (type == NTFS_ATYPE_DATA) && (name[0] == '\0')) { ------------------ | | 199| 3|#define NTFS_ATYPE_DATA 0x80 // 128 ------------------ | Branch (2230:24): [True: 2, False: 1] | Branch (2230:53): [True: 1, False: 1] ------------------ 2231| 1| fs_file->meta->size = ssize; 2232| 1| } 2233| | 2234| 5| alen = tsk_getu64(fs->endian, attr->c.nr.alen); ------------------ | | 171| 5|#define tsk_getu64(endian, x) \ | | 172| 5|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 5, False: 0] | | ------------------ | | 173| 5| ((uint64_t) \ | | 174| 5| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 5| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 5| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 5| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 5| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 5| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 5| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 5| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 5| : \ | | 183| 5| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2235| | /* This can also happen with extended attributes. 2236| | * set it to what we know about */ 2237| 5| if (alen == 0) { ------------------ | Branch (2237:21): [True: 0, False: 5] ------------------ 2238| 0| alen = ssize; 2239| 0| } 2240| | 2241| 5| if (tsk_fs_attr_set_run(fs_file, fs_attr, ------------------ | Branch (2241:21): [True: 0, False: 5] ------------------ 2242| 5| fs_attr_run, name, 2243| 5| type, id_new, ssize, 2244| 5| tsk_getu64(fs->endian, attr->c.nr.initsize), ------------------ | | 171| 5|#define tsk_getu64(endian, x) \ | | 172| 5|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 5, False: 0] | | ------------------ | | 173| 5| ((uint64_t) \ | | 174| 5| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 5| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 5| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 5| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 5| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 5| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 5| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 5| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 5| : \ | | 183| 5| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2245| 5| alen, data_flag, compsize)) { 2246| 0| tsk_error_errstr2_concat("- proc_attrseq: set run"); 2247| | 2248| | // If the run wasn't saved to the attribute, free it now 2249| 0| if (fs_attr_run && (fs_attr->nrd.run == NULL)) { ------------------ | Branch (2249:25): [True: 0, False: 0] | Branch (2249:40): [True: 0, False: 0] ------------------ 2250| 0| tsk_fs_attr_run_free(fs_attr_run); 2251| 0| fs_attr_run = NULL; 2252| 0| } 2253| 0| return TSK_COR; 2254| 0| } 2255| | // fs_file has taken over management of fs_attr_run 2256| 5| fs_attr_run = NULL; 2257| | 2258| | // set the special functions 2259| 5| if (fs_file->meta->flags & TSK_FS_META_FLAG_COMP) { ------------------ | Branch (2259:21): [True: 0, False: 5] ------------------ 2260| 0| fs_attr->w = ntfs_attr_walk_special; 2261| 0| fs_attr->r = ntfs_file_read_special; 2262| 0| } 2263| | 2264| 5| } 2265| 0| else { 2266| 0| if (tsk_fs_attr_add_run(fs, fs_attr, fs_attr_run)) { ------------------ | Branch (2266:21): [True: 0, False: 0] ------------------ 2267| 0| tsk_error_errstr2_concat(" - proc_attrseq: put run"); 2268| 0| if (fs_attr_run) { ------------------ | Branch (2268:25): [True: 0, False: 0] ------------------ 2269| 0| tsk_fs_attr_run_free(fs_attr_run); 2270| 0| fs_attr_run = NULL; 2271| 0| } 2272| 0| return TSK_COR; 2273| 0| } 2274| 0| } 2275| 5| } 2276| | 2277| | /* 2278| | * Special Cases, where we grab additional information 2279| | * regardless if they are resident or not 2280| | */ 2281| | 2282| | /* Standard Information (is always resident) */ 2283| 21| if (type == NTFS_ATYPE_SI) { ------------------ | | 191| 21|#define NTFS_ATYPE_SI 0x10 // 16 ------------------ | Branch (2283:13): [True: 4, False: 17] ------------------ 2284| 4| uint32_t attr_len = tsk_getu32(fs->endian, attr->len); ------------------ | | 119| 4|#define tsk_getu32(endian, x) \ | | 120| 4|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 4, False: 0] | | ------------------ | | 121| 4| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 4| (((uint8_t *)(x))[1] << 8) + \ | | 123| 4| (((uint8_t *)(x))[2] << 16) + \ | | 124| 4| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 4| : \ | | 126| 4| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2285| 4| uint16_t attr_off = tsk_getu16(fs->endian, attr->c.r.soff); ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2286| | 2287| 4| if (attr->res != NTFS_MFT_RES) { ------------------ | | 176| 4|#define NTFS_MFT_RES 0 /* resident */ ------------------ | Branch (2287:17): [True: 0, False: 4] ------------------ 2288| 0| tsk_error_reset(); 2289| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2290| 0| tsk_error_set_errstr 2291| 0| ("proc_attrseq: Standard Information Attribute is not resident!"); 2292| 0| return TSK_COR; 2293| 0| } 2294| 4| if ((attr_off < 16) || (attr_off >= attr_len)) { ------------------ | Branch (2294:17): [True: 0, False: 4] | Branch (2294:36): [True: 0, False: 4] ------------------ 2295| 0| tsk_error_reset(); 2296| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2297| 0| tsk_error_set_errstr 2298| 0| ("proc_attrseq: resident data offset of Standard Information Attribute is out of bounds!"); 2299| 0| return TSK_COR; 2300| 0| } 2301| | // A Standard Information Attribute can be 48 or 72 bytes in size (ntfs_attr_si is 72) 2302| 4| if ((attr_len < 48) || (attr_off > attr_len - 48)) { ------------------ | Branch (2302:17): [True: 0, False: 4] | Branch (2302:36): [True: 0, False: 4] ------------------ 2303| 0| tsk_error_reset(); 2304| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2305| 0| tsk_error_set_errstr 2306| 0| ("proc_attrseq: resident data of Standard Information Attribute is too small!"); 2307| 0| return TSK_COR; 2308| 0| } 2309| 4| ntfs_attr_si *si = (ntfs_attr_si *) ((uintptr_t) attr + attr_off); 2310| | 2311| 4| fs_file->meta->mtime = 2312| 4| nt2unixtime(tsk_getu64(fs->endian, si->mtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2313| 4| fs_file->meta->mtime_nano = 2314| 4| nt2nano(tsk_getu64(fs->endian, si->mtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2315| | 2316| 4| fs_file->meta->atime = 2317| 4| nt2unixtime(tsk_getu64(fs->endian, si->atime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2318| 4| fs_file->meta->atime_nano = 2319| 4| nt2nano(tsk_getu64(fs->endian, si->atime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2320| | 2321| 4| fs_file->meta->ctime = 2322| 4| nt2unixtime(tsk_getu64(fs->endian, si->ctime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2323| 4| fs_file->meta->ctime_nano = 2324| 4| nt2nano(tsk_getu64(fs->endian, si->ctime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2325| | 2326| 4| fs_file->meta->crtime = 2327| 4| nt2unixtime(tsk_getu64(fs->endian, si->crtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2328| 4| fs_file->meta->crtime_nano = 2329| 4| nt2nano(tsk_getu64(fs->endian, si->crtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2330| | 2331| 4| fs_file->meta->uid = tsk_getu32(fs->endian, si->own_id); ------------------ | | 119| 4|#define tsk_getu32(endian, x) \ | | 120| 4|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 4, False: 0] | | ------------------ | | 121| 4| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 4| (((uint8_t *)(x))[1] << 8) + \ | | 123| 4| (((uint8_t *)(x))[2] << 16) + \ | | 124| 4| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 4| : \ | | 126| 4| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2332| 4| fs_file->meta->mode |= 2333| 4| (TSK_FS_META_MODE_IXUSR | TSK_FS_META_MODE_IXGRP | 2334| 4| TSK_FS_META_MODE_IXOTH); 2335| 4| if ((tsk_getu32(fs->endian, si->dos) & NTFS_SI_RO) == 0) ------------------ | | 119| 4|#define tsk_getu32(endian, x) \ | | 120| 4|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 4, False: 0] | | ------------------ | | 121| 4| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 4| (((uint8_t *)(x))[1] << 8) + \ | | 123| 4| (((uint8_t *)(x))[2] << 16) + \ | | 124| 4| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 4| : \ | | 126| 4| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ if ((tsk_getu32(fs->endian, si->dos) & NTFS_SI_RO) == 0) ------------------ | | 278| 4|#define NTFS_SI_RO 0x0001 ------------------ | Branch (2335:17): [True: 4, False: 0] ------------------ 2336| 4| fs_file->meta->mode |= 2337| 4| (TSK_FS_META_MODE_IRUSR | TSK_FS_META_MODE_IRGRP | 2338| 4| TSK_FS_META_MODE_IROTH); 2339| 4| if ((tsk_getu32(fs->endian, si->dos) & NTFS_SI_HID) == 0) ------------------ | | 119| 4|#define tsk_getu32(endian, x) \ | | 120| 4|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 4, False: 0] | | ------------------ | | 121| 4| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 4| (((uint8_t *)(x))[1] << 8) + \ | | 123| 4| (((uint8_t *)(x))[2] << 16) + \ | | 124| 4| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 4| : \ | | 126| 4| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ if ((tsk_getu32(fs->endian, si->dos) & NTFS_SI_HID) == 0) ------------------ | | 279| 4|#define NTFS_SI_HID 0x0002 ------------------ | Branch (2339:17): [True: 0, False: 4] ------------------ 2340| 0| fs_file->meta->mode |= 2341| 0| (TSK_FS_META_MODE_IWUSR | TSK_FS_META_MODE_IWGRP | 2342| 0| TSK_FS_META_MODE_IWOTH); 2343| 4| } 2344| | 2345| | /* File Name (always resident) */ 2346| 17| else if (type == NTFS_ATYPE_FNAME) { ------------------ | | 193| 17|#define NTFS_ATYPE_FNAME 0x30 // 48 ------------------ | Branch (2346:18): [True: 4, False: 13] ------------------ 2347| 4| uint32_t attr_len = tsk_getu32(fs->endian, attr->len); ------------------ | | 119| 4|#define tsk_getu32(endian, x) \ | | 120| 4|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 4, False: 0] | | ------------------ | | 121| 4| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 4| (((uint8_t *)(x))[1] << 8) + \ | | 123| 4| (((uint8_t *)(x))[2] << 16) + \ | | 124| 4| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 4| : \ | | 126| 4| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 2348| 4| uint16_t attr_off = tsk_getu16(fs->endian, attr->c.r.soff); ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2349| | 2350| 4| if (attr->res != NTFS_MFT_RES) { ------------------ | | 176| 4|#define NTFS_MFT_RES 0 /* resident */ ------------------ | Branch (2350:17): [True: 0, False: 4] ------------------ 2351| 0| tsk_error_reset(); 2352| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2353| 0| tsk_error_set_errstr 2354| 0| ("proc_attr_seq: File Name Attribute is not resident!"); 2355| 0| return TSK_COR; 2356| 0| } 2357| 4| if ((attr_off < 16) || (attr_off >= attr_len)) { ------------------ | Branch (2357:17): [True: 0, False: 4] | Branch (2357:36): [True: 0, False: 4] ------------------ 2358| 0| tsk_error_reset(); 2359| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2360| 0| tsk_error_set_errstr 2361| 0| ("proc_attrseq: resident data offset of File Name Attribute is out of bounds!"); 2362| 0| return TSK_COR; 2363| 0| } 2364| | // A File Name Attribute should be at least 66 bytes in size 2365| 4| if ((attr_len < 66) || (attr_off > attr_len - 66)) { ------------------ | Branch (2365:17): [True: 0, False: 4] | Branch (2365:36): [True: 0, False: 4] ------------------ 2366| 0| tsk_error_reset(); 2367| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2368| 0| tsk_error_set_errstr 2369| 0| ("proc_attrseq: resident data of File Name Attribute is too small!"); 2370| 0| return TSK_COR; 2371| 0| } 2372| 4| ntfs_attr_fname *fname = (ntfs_attr_fname *) ((uintptr_t) attr + attr_off); 2373| 4| if (fname->nspace == NTFS_FNAME_DOS) { ------------------ | | 252| 4|#define NTFS_FNAME_DOS 2 // 8.3 format of 8-bit chars in uppercase ------------------ | Branch (2373:17): [True: 0, False: 4] ------------------ 2374| 0| continue; 2375| 0| } 2376| | 2377| 4| fs_file->meta->time2.ntfs.fn_mtime = 2378| 4| nt2unixtime(tsk_getu64(fs->endian, fname->mtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2379| 4| fs_file->meta->time2.ntfs.fn_mtime_nano = 2380| 4| nt2nano(tsk_getu64(fs->endian, fname->mtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2381| | 2382| 4| fs_file->meta->time2.ntfs.fn_atime = 2383| 4| nt2unixtime(tsk_getu64(fs->endian, fname->atime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2384| 4| fs_file->meta->time2.ntfs.fn_atime_nano = 2385| 4| nt2nano(tsk_getu64(fs->endian, fname->atime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2386| | 2387| 4| fs_file->meta->time2.ntfs.fn_ctime = 2388| 4| nt2unixtime(tsk_getu64(fs->endian, fname->ctime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2389| 4| fs_file->meta->time2.ntfs.fn_ctime_nano = 2390| 4| nt2nano(tsk_getu64(fs->endian, fname->ctime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2391| | 2392| 4| fs_file->meta->time2.ntfs.fn_crtime = 2393| 4| nt2unixtime(tsk_getu64(fs->endian, fname->crtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2394| 4| fs_file->meta->time2.ntfs.fn_crtime_nano = 2395| 4| nt2nano(tsk_getu64(fs->endian, fname->crtime)); ------------------ | | 171| 4|#define tsk_getu64(endian, x) \ | | 172| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 4, False: 0] | | ------------------ | | 173| 4| ((uint64_t) \ | | 174| 4| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 4| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 4| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 4| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 4| : \ | | 183| 4| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 2396| | 2397| 4| fs_file->meta->time2.ntfs.fn_id = id; 2398| | 2399| 4| TSK_FS_META_NAME_LIST *fs_name; 2400| | 2401| | /* Seek to the end of the fs_name structures in TSK_FS_META */ 2402| 4| if (fs_file->meta->name2) { ------------------ | Branch (2402:17): [True: 0, False: 4] ------------------ 2403| 0| for (fs_name = fs_file->meta->name2; 2404| 0| (fs_name) && (fs_name->next != NULL); ------------------ | Branch (2404:21): [True: 0, False: 0] | Branch (2404:34): [True: 0, False: 0] ------------------ 2405| 0| fs_name = fs_name->next) { 2406| 0| } 2407| | 2408| | /* add to the end of the existing list */ 2409| 0| fs_name->next = (TSK_FS_META_NAME_LIST *) 2410| 0| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST)); 2411| 0| if (fs_name->next == NULL) { ------------------ | Branch (2411:21): [True: 0, False: 0] ------------------ 2412| 0| return TSK_ERR; 2413| 0| } 2414| 0| fs_name = fs_name->next; 2415| 0| fs_name->next = NULL; 2416| 0| } 2417| 4| else { 2418| | /* First name, so we start a list */ 2419| 4| fs_file->meta->name2 = fs_name = (TSK_FS_META_NAME_LIST *) 2420| 4| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST)); 2421| 4| if (fs_name == NULL) { ------------------ | Branch (2421:21): [True: 0, False: 4] ------------------ 2422| 0| return TSK_ERR; 2423| 0| } 2424| 4| fs_name->next = NULL; 2425| 4| } 2426| 4| if (fname->nlen > attr_len - 66) { ------------------ | Branch (2426:17): [True: 0, False: 4] ------------------ 2427| 0| tsk_error_reset(); 2428| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2429| 0| tsk_error_set_errstr 2430| 0| ("proc_attrseq: invalid name value size out of bounds!"); 2431| 0| return TSK_COR; 2432| 0| } 2433| 4| UTF16 *name16 = (UTF16 *) & fname->name; 2434| 4| UTF8 *name8 = (UTF8 *) fs_name->name; 2435| | 2436| 4| retVal = 2437| 4| tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16, 2438| 4| (UTF16 *) ((uintptr_t) name16 + 2439| 4| fname->nlen * 2), 2440| 4| &name8, 2441| 4| (UTF8 *) ((uintptr_t) name8 + 2442| 4| sizeof(fs_name->name)), TSKlenientConversion); 2443| 4| if (retVal != TSKconversionOK) { ------------------ | Branch (2443:17): [True: 0, False: 4] ------------------ 2444| 0| if (tsk_verbose) ------------------ | Branch (2444:21): [True: 0, False: 0] ------------------ 2445| 0| tsk_fprintf(stderr, 2446| 0| "proc_attr_seq: Error converting NTFS name in $FNAME to UTF8: %d", 2447| 0| retVal); 2448| 0| *name8 = '\0'; 2449| 0| } 2450| | /* Make sure it is NULL Terminated */ 2451| 4| else if ((uintptr_t) name8 >= ------------------ | Branch (2451:22): [True: 0, False: 4] ------------------ 2452| 4| (uintptr_t) fs_name->name + sizeof(fs_name->name)) 2453| 0| fs_name->name[sizeof(fs_name->name) - 1] = '\0'; 2454| 4| else 2455| 4| *name8 = '\0'; 2456| | 2457| 4| fs_name->par_inode = tsk_getu48(fs->endian, fname->par_ref); ------------------ | | 146| 4|#define tsk_getu48(endian, x) \ | | 147| 4|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (147:13): [True: 4, False: 0] | | ------------------ | | 148| 4| ((uint64_t) \ | | 149| 4| ((uint64_t)((uint8_t *)(x))[0] << 0)+ \ | | 150| 4| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 151| 4| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 152| 4| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 153| 4| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 154| 4| ((uint64_t)((uint8_t *)(x))[5] << 40)) \ | | 155| 4| : \ | | 156| 4| ((uint64_t) \ | | 157| 0| ((uint64_t)((uint8_t *)(x))[5] << 0)+ \ | | 158| 0| ((uint64_t)((uint8_t *)(x))[4] << 8) + \ | | 159| 0| ((uint64_t)((uint8_t *)(x))[3] << 16) + \ | | 160| 0| ((uint64_t)((uint8_t *)(x))[2] << 24) + \ | | 161| 0| ((uint64_t)((uint8_t *)(x))[1] << 32) + \ | | 162| 0| ((uint64_t)((uint8_t *)(x))[0] << 40)) ) ------------------ 2458| 4| fs_name->par_seq = tsk_getu16(fs->endian, fname->par_seq); ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 2459| 4| } 2460| | 2461| | /* If this is an attribute list than we need to process 2462| | * it to get the list of other entries to read. But, because 2463| | * of the wierd scenario of the $MFT having an attribute list 2464| | * and not knowing where the other MFT entires are yet, we wait 2465| | * until the end of the attrseq to processes the list and then 2466| | * we should have the $Data attribute loaded 2467| | */ 2468| 13| else if (type == NTFS_ATYPE_ATTRLIST) { ------------------ | | 192| 13|#define NTFS_ATYPE_ATTRLIST 0x20 // 32 ------------------ | Branch (2468:18): [True: 0, False: 13] ------------------ 2469| 0| if (fs_attr_attrl) { ------------------ | Branch (2469:17): [True: 0, False: 0] ------------------ 2470| 0| tsk_error_reset(); 2471| 0| tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); ------------------ | | 347| 0|#define TSK_ERR_FS_UNSUPFUNC (TSK_ERR_FS | 2) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2472| 0| tsk_error_set_errstr 2473| 0| ("Multiple instances of attribute lists in the same MFT\n" 2474| 0| "I didn't realize that could happen, contact the developers"); 2475| 0| return TSK_ERR; 2476| 0| } 2477| 0| fs_attr_attrl = tsk_fs_attrlist_get_id(fs_file->meta->attr, 2478| 0| NTFS_ATYPE_ATTRLIST, id_new); ------------------ | | 192| 0|#define NTFS_ATYPE_ATTRLIST 0x20 // 32 ------------------ 2479| 0| if (fs_attr_attrl == NULL) { ------------------ | Branch (2479:17): [True: 0, False: 0] ------------------ 2480| 0| tsk_error_errstr2_concat 2481| 0| ("- proc_attrseq: getting attribute list"); 2482| 0| return TSK_ERR; 2483| 0| } 2484| 0| } 2485| 21| } 2486| | 2487| | 2488| | /* Are we currently in the process of loading $MFT? */ 2489| 4| if (ntfs->loading_the_MFT == 1) { ------------------ | Branch (2489:9): [True: 1, False: 3] ------------------ 2490| | 2491| | /* If we don't even have a mini cached version, get it now 2492| | * Even if we are not done because of attribute lists, then we 2493| | * should at least have the head of the list 2494| | */ 2495| 1| if (!ntfs->mft_data) { ------------------ | Branch (2495:13): [True: 1, False: 0] ------------------ 2496| 1| int cnt, i; 2497| | 2498| | // cycle through the attributes 2499| 1| cnt = tsk_fs_file_attr_getsize(fs_file); 2500| 3| for (i = 0; i < cnt; i++) { ------------------ | Branch (2500:25): [True: 3, False: 0] ------------------ 2501| 3| const TSK_FS_ATTR *fs_attr = 2502| 3| tsk_fs_file_attr_get_idx(fs_file, i); 2503| 3| if (!fs_attr) ------------------ | Branch (2503:21): [True: 0, False: 3] ------------------ 2504| 0| continue; 2505| | 2506| | // get the default attribute 2507| 3| if ((fs_attr->type == NTFS_ATYPE_DATA) && ------------------ | | 199| 3|#define NTFS_ATYPE_DATA 0x80 // 128 ------------------ | Branch (2507:21): [True: 1, False: 2] ------------------ 2508| 3| (fs_attr->name == NULL)) { ------------------ | Branch (2508:21): [True: 1, False: 0] ------------------ 2509| 1| ntfs->mft_data = fs_attr; 2510| 1| break; 2511| 1| } 2512| 3| } 2513| | 2514| | // @@@ Is this needed here -- maybe it should be only in _open 2515| 1| if (!ntfs->mft_data) { ------------------ | Branch (2515:17): [True: 0, False: 1] ------------------ 2516| 0| tsk_error_reset(); 2517| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 2518| 0| tsk_error_set_errstr 2519| 0| ("$Data not found while loading the MFT"); 2520| 0| return TSK_ERR; 2521| 0| } 2522| 1| } 2523| | 2524| | /* Update the inode count based on the current size 2525| | * IF $MFT has an attribute list, this value will increase each 2526| | * time 2527| | */ 2528| 1| fs->inum_count = ntfs->mft_data->size / ntfs->mft_rsize_b; 2529| 1| fs->last_inum = fs->inum_count - 1; 2530| 1| } 2531| | 2532| | /* If there was an attribute list, process it now, we wait because 2533| | * the list can contain MFT entries that are described in $Data 2534| | * of this MFT entry. For example, part of the $DATA attribute 2535| | * could follow the ATTRLIST entry, so we read it first and then 2536| | * process the attribute list 2537| | */ 2538| 4| if (fs_attr_attrl) { ------------------ | Branch (2538:9): [True: 0, False: 4] ------------------ 2539| 0| TSK_RETVAL_ENUM retval; 2540| 0| if (a_seen_inum_list != NULL) { ------------------ | Branch (2540:13): [True: 0, False: 0] ------------------ 2541| 0| tsk_stack_push(a_seen_inum_list, a_attrinum); 2542| 0| } 2543| 0| if ((retval = ntfs_proc_attrlist(ntfs, fs_file, fs_attr_attrl, a_seen_inum_list)) != TSK_OK) { ------------------ | Branch (2543:13): [True: 0, False: 0] ------------------ 2544| 0| return retval; 2545| 0| } 2546| 0| } 2547| | 2548| 4| fs_file->meta->attr_state = TSK_FS_META_ATTR_STUDIED; 2549| 4| return TSK_OK; 2550| 4|} ntfs.c:ntfs_make_data_run: 598| 6|{ 599| 6| TSK_FS_INFO *fs = (TSK_FS_INFO *) ntfs; 600| 6| ntfs_runlist *run; 601| 6| TSK_FS_ATTR_RUN *data_run, *data_run_prev = NULL; 602| 6| unsigned int i, idx; 603| 6| TSK_DADDR_T prev_addr = 0; 604| 6| TSK_OFF_T file_offset = start_vcn; 605| 6| uint32_t runlist_offset = 0; 606| | 607| 6| run = runlist_head; 608| 6| *a_data_run_head = NULL; 609| | 610| | /* initialize if non-NULL */ 611| 6| if (totlen) ------------------ | Branch (611:9): [True: 0, False: 6] ------------------ 612| 0| *totlen = 0; 613| | 614| 6| if (runlist_size < 1) { ------------------ | Branch (614:9): [True: 0, False: 6] ------------------ 615| 0| return TSK_ERR; 616| 0| } 617| | 618| | /* Cycle through each run in the runlist 619| | * We go until we find an entry with no length 620| | * An entry with offset of 0 is for a sparse run 621| | */ 622| 12| while ((runlist_offset < runlist_size) && NTFS_RUNL_LENSZ(run) != 0) { ------------------ | | 362| 12| (uint8_t)(runl->len & 0x0f) ------------------ | Branch (622:12): [True: 12, False: 0] | Branch (622:47): [True: 6, False: 6] ------------------ 623| 6| int64_t addr_offset = 0; 624| | 625| | /* allocate a new tsk_fs_attr_run */ 626| 6| data_run = tsk_fs_attr_run_alloc(); 627| 6| if (data_run == NULL) { ------------------ | Branch (627:13): [True: 0, False: 6] ------------------ 628| 0| tsk_fs_attr_run_free(*a_data_run_head); 629| 0| *a_data_run_head = NULL; 630| 0| return TSK_ERR; 631| 0| } 632| | 633| | /* make the list, unless its the first pass & then we set the head */ 634| 6| if (data_run_prev) ------------------ | Branch (634:13): [True: 0, False: 6] ------------------ 635| 0| data_run_prev->next = data_run; 636| 6| else 637| 6| *a_data_run_head = data_run; 638| 6| data_run_prev = data_run; 639| | 640| | /* These fields are a variable number of bytes long 641| | * these for loops are the equivalent of the getuX macros 642| | */ 643| 6| idx = 0; 644| | 645| | /* Get the length of this run. 646| | * A length of more than eight bytes will not fit in the 647| | * 64-bit length field (and is likely corrupt) 648| | */ 649| 6| if (NTFS_RUNL_LENSZ(run) > 8 || NTFS_RUNL_LENSZ(run) > runlist_size - runlist_offset - 1) { ------------------ | | 362| 6| (uint8_t)(runl->len & 0x0f) ------------------ if (NTFS_RUNL_LENSZ(run) > 8 || NTFS_RUNL_LENSZ(run) > runlist_size - runlist_offset - 1) { ------------------ | | 362| 6| (uint8_t)(runl->len & 0x0f) ------------------ | Branch (649:13): [True: 0, False: 6] | Branch (649:41): [True: 0, False: 6] ------------------ 650| 0| tsk_error_reset(); 651| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 652| 0| tsk_error_set_errstr 653| 0| ("ntfs_make_run: Run length is too large to process"); 654| 0| tsk_fs_attr_run_free(*a_data_run_head); 655| 0| *a_data_run_head = NULL; 656| 0| return TSK_COR; 657| 0| } 658| 12| for (i = 0, data_run->len = 0; i < NTFS_RUNL_LENSZ(run); i++) { ------------------ | | 362| 12| (uint8_t)(runl->len & 0x0f) ------------------ | Branch (658:40): [True: 6, False: 6] ------------------ 659| 6| data_run->len |= ((uint64_t)(run->buf[idx++]) << (i * 8)); 660| 6| if (tsk_verbose) ------------------ | Branch (660:17): [True: 0, False: 6] ------------------ 661| 0| tsk_fprintf(stderr, 662| 0| "ntfs_make_data_run: Len idx: %i cur: %" 663| 0| PRIu8 " (%" PRIx8 ") tot: %" PRIuDADDR 664| 0| " (%" PRIxDADDR ")\n", i, 665| 0| run->buf[idx - 1], run->buf[idx - 1], 666| 0| data_run->len, data_run->len); 667| 6| } 668| | 669| | /* Sanity check on length */ 670| 6| if (data_run->len > fs->block_count) { ------------------ | Branch (670:13): [True: 0, False: 6] ------------------ 671| 0| tsk_error_reset(); 672| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 673| 0| tsk_error_set_errstr 674| 0| ("ntfs_make_run: Run length is larger than file system"); 675| 0| tsk_fs_attr_run_free(*a_data_run_head); 676| 0| *a_data_run_head = NULL; 677| 0| return TSK_COR; 678| 0| } 679| | 680| 6| data_run->offset = file_offset; 681| 6| file_offset += data_run->len; 682| | 683| | /* Update the length if we were passed a value */ 684| 6| if (totlen) ------------------ | Branch (684:13): [True: 0, False: 6] ------------------ 685| 0| *totlen += (data_run->len * ntfs->csize_b); 686| | 687| | /* Get the address offset of this run. 688| | * An address offset of more than eight bytes will not fit in the 689| | * 64-bit addr_offset field (and is likely corrupt) 690| | */ 691| 6| if (NTFS_RUNL_OFFSZ(run) > 8) { ------------------ | | 365| 6| (uint8_t)((runl->len & 0xf0) >> 4) ------------------ | Branch (691:13): [True: 0, False: 6] ------------------ 692| 0| tsk_error_reset(); 693| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 694| 0| tsk_error_set_errstr 695| 0| ("ntfs_make_run: Run address offset is too large to process"); 696| 0| tsk_fs_attr_run_free(*a_data_run_head); 697| 0| *a_data_run_head = NULL; 698| 0| return TSK_COR; 699| 0| } 700| 16| for (i = 0, data_run->addr = 0; i < NTFS_RUNL_OFFSZ(run); i++) { ------------------ | | 365| 16| (uint8_t)((runl->len & 0xf0) >> 4) ------------------ | Branch (700:41): [True: 10, False: 6] ------------------ 701| | //data_run->addr |= (run->buf[idx++] << (i * 8)); 702| 10| addr_offset |= ((int64_t)(run->buf[idx++]) << (i * 8)); 703| 10| if (tsk_verbose) ------------------ | Branch (703:17): [True: 0, False: 10] ------------------ 704| 0| tsk_fprintf(stderr, 705| 0| "ntfs_make_data_run: Off idx: %i cur: %" 706| 0| PRIu8 " (%" PRIx8 ") tot: %" PRIuDADDR 707| 0| " (%" PRIxDADDR ")\n", i, 708| 0| run->buf[idx - 1], run->buf[idx - 1], addr_offset, 709| 0| addr_offset); 710| 10| } 711| | 712| | /* addr_offset value is signed so extend it to 64-bits */ 713| 6| if ((int8_t) run->buf[idx - 1] < 0) { ------------------ | Branch (713:13): [True: 0, False: 6] ------------------ 714| 0| for (; i < sizeof(addr_offset); i++) ------------------ | Branch (714:20): [True: 0, False: 0] ------------------ 715| 0| addr_offset |= (int64_t) ((int64_t) 0xff << (i * 8)); 716| 0| } 717| | 718| 6| if (tsk_verbose) ------------------ | Branch (718:13): [True: 0, False: 6] ------------------ 719| 0| tsk_fprintf(stderr, 720| 0| "ntfs_make_data_run: Signed addr_offset: %" 721| 0| PRId64 " Previous address: %" 722| 0| PRIuDADDR "\n", addr_offset, prev_addr); 723| | 724| | /* The NT 4.0 version of NTFS uses an offset of -1 to represent 725| | * a hole, so add the sparse flag and make it look like the 2K 726| | * version with a offset of 0 727| | * 728| | * A user reported an issue where the $Bad file started with 729| | * its offset as -1 and it was not NT (maybe a conversion) 730| | * Change the check now to not limit to NT, but make sure 731| | * that it is the first run 732| | */ 733| 6| if (((addr_offset == -1) && (prev_addr == 0)) ------------------ | Branch (733:14): [True: 0, False: 6] | Branch (733:37): [True: 0, False: 0] ------------------ 734| 6| || ((addr_offset == -1) ------------------ | Branch (734:17): [True: 0, False: 6] ------------------ 735| 6| && (ntfs->ver == NTFS_VINFO_NT))) { ------------------ | | 319| 0|#define NTFS_VINFO_NT 0x21 ------------------ | Branch (735:20): [True: 0, False: 0] ------------------ 736| 0| data_run->flags |= TSK_FS_ATTR_RUN_FLAG_SPARSE; 737| 0| data_run->addr = 0; 738| 0| if (tsk_verbose) ------------------ | Branch (738:17): [True: 0, False: 0] ------------------ 739| 0| tsk_fprintf(stderr, "ntfs_make_data_run: Sparse Run\n"); 740| 0| } 741| | 742| | /* A Sparse file has a run with an offset of 0 743| | * there is a special case though of the BOOT MFT entry which 744| | * is the super block and has a legit offset of 0. 745| | * 746| | * The value given is a delta of the previous offset, so add 747| | * them for non-sparse files 748| | * 749| | * For sparse files the next run will have its offset relative 750| | * to the current "prev_addr" so skip that code 751| | */ 752| | // @@@ BC: we'll need to pass in an inode value for this check 753| 6| else if ((addr_offset) || (mnum == NTFS_MFT_BOOT)) { ------------------ | | 134| 0|#define NTFS_MFT_BOOT 0x7 ------------------ | Branch (753:18): [True: 6, False: 0] | Branch (753:35): [True: 0, False: 0] ------------------ 754| | 755| 6| data_run->addr = prev_addr + addr_offset; 756| 6| prev_addr = data_run->addr; 757| | 758| | /* Sanity check on length and offset */ 759| 6| if (data_run->addr + data_run->len > fs->block_count) { ------------------ | Branch (759:17): [True: 0, False: 6] ------------------ 760| 0| tsk_error_reset(); 761| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 762| 0| tsk_error_set_errstr 763| 0| ("ntfs_make_run: Run offset and length is larger than file system"); 764| 0| tsk_fs_attr_run_free(*a_data_run_head); 765| 0| *a_data_run_head = NULL; 766| 0| return TSK_COR; 767| 0| } 768| | 769| 6| } 770| 0| else { 771| 0| data_run->flags |= TSK_FS_ATTR_RUN_FLAG_SPARSE; 772| 0| if (tsk_verbose) ------------------ | Branch (772:17): [True: 0, False: 0] ------------------ 773| 0| tsk_fprintf(stderr, "ntfs_make_data_run: Sparse Run\n"); 774| 0| } 775| | 776| | /* Advance run */ 777| 6| uint32_t run_size = 1 + NTFS_RUNL_LENSZ(run) + NTFS_RUNL_OFFSZ(run); ------------------ | | 362| 6| (uint8_t)(runl->len & 0x0f) ------------------ uint32_t run_size = 1 + NTFS_RUNL_LENSZ(run) + NTFS_RUNL_OFFSZ(run); ------------------ | | 365| 6| (uint8_t)((runl->len & 0xf0) >> 4) ------------------ 778| 6| run = (ntfs_runlist *) ((uintptr_t) run + run_size); 779| | 780| | // Abritrary limit runlist_offset at INT32_MAX ((1 << 31) - 1) 781| 6| if (run_size > (((uint32_t) 1UL << 31 ) -1) - runlist_offset) { ------------------ | Branch (781:13): [True: 0, False: 6] ------------------ 782| 0| return TSK_ERR; 783| 0| } 784| 6| runlist_offset += run_size; 785| 6| } 786| | 787| | /* special case for $BADCLUST, which is a sparse file whose size is 788| | * the entire file system. 789| | * 790| | * If there is only one run entry and it is sparse, then there are no 791| | * bad blocks, so get rid of it. 792| | */ 793| 6| if ((*a_data_run_head != NULL) ------------------ | Branch (793:9): [True: 6, False: 0] ------------------ 794| 6| && ((*a_data_run_head)->next == NULL) ------------------ | Branch (794:12): [True: 6, False: 0] ------------------ 795| 6| && ((*a_data_run_head)->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) ------------------ | Branch (795:12): [True: 0, False: 6] ------------------ 796| 6| && ((*a_data_run_head)->len == fs->last_block + 1)) { ------------------ | Branch (796:12): [True: 0, False: 0] ------------------ 797| 0| tsk_fs_attr_run_free(*a_data_run_head); 798| 0| *a_data_run_head = NULL; 799| 0| } 800| | 801| 6| return TSK_OK; 802| 6|} ntfs.c:ntfs_load_attrs: 3006| 4|{ 3007| 4| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)) { ------------------ | Branch (3007:9): [True: 0, False: 4] | Branch (3007:32): [True: 0, False: 4] ------------------ 3008| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3009| 0| tsk_error_set_errstr("ntfs_load_attrs: called with NULL pointers"); 3010| 0| return 1; 3011| 0| } 3012| | 3013| | /* Verify the file has attributes */ 3014| 4| if (a_fs_file->meta->attr == NULL) { ------------------ | Branch (3014:9): [True: 0, False: 4] ------------------ 3015| 0| if (a_fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC) ------------------ | Branch (3015:13): [True: 0, False: 0] ------------------ 3016| 0| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 0|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3017| 0| else 3018| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3019| 0| tsk_error_set_errstr("ntfs_load_attrs: attributes are NULL"); 3020| 0| return 1; 3021| 0| } 3022| 4| return 0; 3023| 4|} ntfs.c:ntfs_inode_lookup: 3035| 4|{ 3036| 4| NTFS_INFO *ntfs = (NTFS_INFO *) fs; 3037| 4| char *mft; 3038| 4| uint8_t allocedMeta = 0; 3039| | 3040| | // clean up any error messages that are lying around 3041| 4| tsk_error_reset(); 3042| | 3043| 4| if (a_fs_file == NULL) { ------------------ | Branch (3043:9): [True: 0, False: 4] ------------------ 3044| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3045| 0| tsk_error_set_errstr("ntfs_inode_lookup: fs_file is NULL"); 3046| 0| return 1; 3047| 0| } 3048| | 3049| 4| if (a_fs_file->meta == NULL) { ------------------ | Branch (3049:9): [True: 4, False: 0] ------------------ 3050| 4| a_fs_file->meta = tsk_fs_meta_alloc(NTFS_FILE_CONTENT_LEN); ------------------ | | 41| 4|#define NTFS_FILE_CONTENT_LEN 0 ------------------ 3051| 4| if (a_fs_file->meta == NULL) ------------------ | Branch (3051:13): [True: 0, False: 4] ------------------ 3052| 0| return 1; 3053| 4| allocedMeta = 1; 3054| 4| } 3055| 0| else { 3056| 0| tsk_fs_meta_reset(a_fs_file->meta); 3057| 0| } 3058| | 3059| | // see if they are looking for the special "orphans" directory 3060| 4| if (mftnum == TSK_FS_ORPHANDIR_INUM(fs)) { ------------------ | | 530| 4| (fs_info->last_inum) ------------------ | Branch (3060:9): [True: 0, False: 4] ------------------ 3061| 0| if (tsk_fs_dir_make_orphan_dir_meta(fs, a_fs_file->meta)) ------------------ | Branch (3061:13): [True: 0, False: 0] ------------------ 3062| 0| return 1; 3063| 0| else 3064| 0| return 0; 3065| 0| } 3066| | 3067| 4| if ((mft = (char *) tsk_malloc(ntfs->mft_rsize_b)) == NULL) { ------------------ | Branch (3067:9): [True: 0, False: 4] ------------------ 3068| 0| return 1; 3069| 0| } 3070| | 3071| | /* Lookup inode and store it in the ntfs structure */ 3072| 4| if (ntfs_dinode_lookup(ntfs, mft, mftnum) != TSK_OK) { ------------------ | Branch (3072:9): [True: 0, False: 4] ------------------ 3073| 0| free(mft); 3074| 0| return 1; 3075| 0| } 3076| | 3077| | /* Copy the structure in ntfs to generic a_fs_file->meta */ 3078| 4| if (ntfs_dinode_copy(ntfs, a_fs_file, mft, mftnum) != TSK_OK) { ------------------ | Branch (3078:9): [True: 0, False: 4] ------------------ 3079| 0| free(mft); 3080| 0| return 1; 3081| 0| } 3082| | 3083| | /* Check if the metadata is the same sequence as the name - if it was already set. 3084| | * Note that this is not as efficient and elegant as desired, but works for now. 3085| | * Better design would be to pass sequence into dinode_lookup and have a more 3086| | * obvious way to pass the desired sequence in. fs_dir_walk_lcl sets the name 3087| | * before calling this, which motivated this quick fix. */ 3088| 4| if ((a_fs_file->name != NULL) && (a_fs_file->name->meta_addr == mftnum)) { ------------------ | Branch (3088:9): [True: 0, False: 4] | Branch (3088:38): [True: 0, False: 0] ------------------ 3089| | 3090| | /* NTFS Updates the sequence when an entry is deleted and not when 3091| | * it is allocated. So, if we have a deleted MFT entry, then use 3092| | * its previous sequence number to compare with the name so that we 3093| | * still match them up (until the entry is allocated again). */ 3094| 0| uint16_t seqToCmp = a_fs_file->meta->seq; 3095| 0| if (a_fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC) { ------------------ | Branch (3095:13): [True: 0, False: 0] ------------------ 3096| 0| if (a_fs_file->meta->seq > 0) ------------------ | Branch (3096:17): [True: 0, False: 0] ------------------ 3097| 0| seqToCmp--; 3098| 0| } 3099| | 3100| 0| if (a_fs_file->name->meta_seq != seqToCmp) { ------------------ | Branch (3100:13): [True: 0, False: 0] ------------------ 3101| 0| if (allocedMeta) { ------------------ | Branch (3101:17): [True: 0, False: 0] ------------------ 3102| 0| tsk_fs_meta_close(a_fs_file->meta); 3103| 0| a_fs_file->meta = NULL; 3104| 0| } 3105| 0| else { 3106| 0| tsk_fs_meta_reset(a_fs_file->meta); 3107| 0| } 3108| 0| } 3109| 0| } 3110| | 3111| 4| free(mft); 3112| 4| return 0; 3113| 4|} ntfs.c:ntfs_close: 5147| 3|{ 5148| 3| NTFS_INFO *ntfs = (NTFS_INFO *) fs; 5149| | 5150| 3| if (fs == NULL) ------------------ | Branch (5150:9): [True: 0, False: 3] ------------------ 5151| 0| return; 5152| | 5153| 3|#if TSK_USE_SID 5154| 3| free(ntfs->sii_data.buffer); 5155| 3| ntfs->sii_data.buffer = NULL; 5156| | 5157| 3| free(ntfs->sds_data.buffer); 5158| 3| ntfs->sds_data.buffer = NULL; 5159| | 5160| 3|#endif 5161| | 5162| 3| fs->tag = 0; 5163| 3| free(ntfs->fs); 5164| 3| tsk_fs_attr_run_free(ntfs->bmap); 5165| 3| free(ntfs->bmap_buf); 5166| 3| tsk_fs_file_close(ntfs->mft_file); 5167| | 5168| 3| if (ntfs->orphan_map) ------------------ | Branch (5168:9): [True: 0, False: 3] ------------------ 5169| 0| ntfs_orphan_map_free(ntfs); 5170| | 5171| 3| tsk_deinit_lock(&ntfs->lock); 5172| 3| tsk_deinit_lock(&ntfs->orphan_map_lock); 5173| 3|#if TSK_USE_SID 5174| 3| tsk_deinit_lock(&ntfs->sid_lock); 5175| 3|#endif 5176| | 5177| 3| tsk_fs_free(fs); 5178| 3|} ntfs.c:ntfs_load_ver: 3381| 1|{ 3382| 1| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ntfs->fs_info; 3383| 1| TSK_FS_FILE *fs_file; 3384| 1| const TSK_FS_ATTR *fs_attr; 3385| | 3386| 1| if ((fs_file = tsk_fs_file_open_meta(fs, NULL, NTFS_MFT_VOL)) == NULL) { ------------------ | | 130| 1|#define NTFS_MFT_VOL 0x3 ------------------ | Branch (3386:9): [True: 0, False: 1] ------------------ 3387| 0| return 1; 3388| 0| } 3389| | 3390| | /* cache the data attribute */ 3391| 1| fs_attr = tsk_fs_attrlist_get(fs_file->meta->attr, NTFS_ATYPE_VINFO); ------------------ | | 198| 1|#define NTFS_ATYPE_VINFO 0x70 // 112 ------------------ 3392| 1| if (!fs_attr) { ------------------ | Branch (3392:9): [True: 0, False: 1] ------------------ 3393| 0| tsk_error_reset(); 3394| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3395| 0| tsk_error_set_errstr("Volume Info attribute not found in $Volume"); 3396| 0| tsk_fs_file_close(fs_file); 3397| 0| return 1; 3398| 0| } 3399| | 3400| 1| if ((fs_attr->flags & TSK_FS_ATTR_RES) ------------------ | Branch (3400:9): [True: 1, False: 0] ------------------ 3401| 1| && (fs_attr->size)) { ------------------ | Branch (3401:12): [True: 1, False: 0] ------------------ 3402| 1| ntfs_attr_vinfo *vinfo = (ntfs_attr_vinfo *) fs_attr->rd.buf; 3403| | 3404| 1| if ((vinfo->maj_ver == 1) ------------------ | Branch (3404:13): [True: 0, False: 1] ------------------ 3405| 1| && (vinfo->min_ver == 2)) { ------------------ | Branch (3405:16): [True: 0, False: 0] ------------------ 3406| 0| ntfs->ver = NTFS_VINFO_NT; ------------------ | | 319| 0|#define NTFS_VINFO_NT 0x21 ------------------ 3407| 0| } 3408| 1| else if ((vinfo->maj_ver == 3) ------------------ | Branch (3408:18): [True: 1, False: 0] ------------------ 3409| 1| && (vinfo->min_ver == 0)) { ------------------ | Branch (3409:16): [True: 0, False: 1] ------------------ 3410| 0| ntfs->ver = NTFS_VINFO_2K; ------------------ | | 320| 0|#define NTFS_VINFO_2K 0x03 ------------------ 3411| 0| } 3412| 1| else if ((vinfo->maj_ver == 3) ------------------ | Branch (3412:18): [True: 1, False: 0] ------------------ 3413| 1| && (vinfo->min_ver == 1)) { ------------------ | Branch (3413:16): [True: 1, False: 0] ------------------ 3414| 1| ntfs->ver = NTFS_VINFO_XP; ------------------ | | 321| 1|#define NTFS_VINFO_XP 0x13 ------------------ 3415| 1| } 3416| 0| else { 3417| 0| tsk_error_reset(); 3418| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3419| 0| tsk_error_set_errstr("unknown version: %d.%d\n", 3420| 0| vinfo->maj_ver, vinfo->min_ver); 3421| 0| tsk_fs_file_close(fs_file); 3422| 0| return 1; 3423| 0| } 3424| 1| } 3425| 0| else { 3426| 0| tsk_error_reset(); 3427| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3428| 0| tsk_error_set_errstr 3429| 0| ("load_version: VINFO is a non-resident attribute"); 3430| 0| return 1; 3431| 0| } 3432| | 3433| 1| tsk_fs_file_close(fs_file); 3434| 1| return 0; 3435| 1|} ntfs.c:ntfs_load_bmap: 3251| 1|{ 3252| 1| ssize_t cnt = 0; 3253| 1| ntfs_attr *attr = NULL; 3254| 1| ntfs_attr *data_attr = NULL; 3255| 1| TSK_FS_INFO *fs = NULL; 3256| 1| ntfs_mft *mft = NULL; 3257| | 3258| 1| if (ntfs == NULL) { ------------------ | Branch (3258:9): [True: 0, False: 1] ------------------ 3259| 0| goto on_error; 3260| 0| } 3261| 1| fs = &ntfs->fs_info; 3262| | 3263| 1| if ((mft = (ntfs_mft *) tsk_malloc(ntfs->mft_rsize_b)) == NULL) { ------------------ | Branch (3263:9): [True: 0, False: 1] ------------------ 3264| 0| goto on_error; 3265| 0| } 3266| | 3267| | /* Get data on the bitmap */ 3268| 1| if (ntfs_dinode_lookup(ntfs, (char *) mft, NTFS_MFT_BMAP) != TSK_OK) { ------------------ | | 133| 1|#define NTFS_MFT_BMAP 0x6 ------------------ | Branch (3268:9): [True: 0, False: 1] ------------------ 3269| 0| goto on_error; 3270| 0| } 3271| | 3272| 1| attr = (ntfs_attr *) ((uintptr_t) mft + 3273| 1| tsk_getu16(fs->endian, mft->attr_off)); ------------------ | | 86| 1|#define tsk_getu16(endian, x) \ | | 87| 1|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 1, False: 0] | | ------------------ | | 88| 1| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 1| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 3274| 1| data_attr = NULL; 3275| | 3276| 1| uint32_t attr_len = 0; 3277| 1| uint32_t attr_type = 0; 3278| | 3279| | /* cycle through them */ 3280| 3| while ((uintptr_t) attr + sizeof (ntfs_attr) <= ------------------ | Branch (3280:12): [True: 3, False: 0] ------------------ 3281| 3| ((uintptr_t) mft + (uintptr_t) ntfs->mft_rsize_b)) { 3282| | 3283| 3| attr_len = tsk_getu32(fs->endian, attr->len); ------------------ | | 119| 3|#define tsk_getu32(endian, x) \ | | 120| 3|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 3, False: 0] | | ------------------ | | 121| 3| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 3| (((uint8_t *)(x))[1] << 8) + \ | | 123| 3| (((uint8_t *)(x))[2] << 16) + \ | | 124| 3| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3| : \ | | 126| 3| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3284| 3| attr_type = tsk_getu32(fs->endian, attr->type); ------------------ | | 119| 3|#define tsk_getu32(endian, x) \ | | 120| 3|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 3, False: 0] | | ------------------ | | 121| 3| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 3| (((uint8_t *)(x))[1] << 8) + \ | | 123| 3| (((uint8_t *)(x))[2] << 16) + \ | | 124| 3| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3| : \ | | 126| 3| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3285| | 3286| 3| if ((attr_len == 0) || (attr_type == 0xffffffff)) { ------------------ | Branch (3286:13): [True: 0, False: 3] | Branch (3286:32): [True: 0, False: 3] ------------------ 3287| 0| break; 3288| 0| } 3289| | 3290| 3| if (attr_type == NTFS_ATYPE_DATA) { ------------------ | | 199| 3|#define NTFS_ATYPE_DATA 0x80 // 128 ------------------ | Branch (3290:13): [True: 1, False: 2] ------------------ 3291| 1| data_attr = attr; 3292| 1| break; 3293| 1| } 3294| | 3295| 2| attr = (ntfs_attr *) ((uintptr_t) attr + attr_len); 3296| 2| } 3297| | 3298| | /* did we get it? */ 3299| 1| if (data_attr == NULL) { ------------------ | Branch (3299:9): [True: 0, False: 1] ------------------ 3300| 0| tsk_error_reset(); 3301| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3302| 0| tsk_error_set_errstr("Error Finding Bitmap Data Attribute"); 3303| 0| goto on_error; 3304| 0| } 3305| 1| attr_len = tsk_getu32(fs->endian, data_attr->len); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3306| 1| if (attr_len > ntfs->mft_rsize_b) { ------------------ | Branch (3306:9): [True: 0, False: 1] ------------------ 3307| 0| goto on_error; 3308| 0| } 3309| | 3310| 1| uint64_t run_start_vcn = tsk_getu64(fs->endian, data_attr->c.nr.start_vcn); ------------------ | | 171| 1|#define tsk_getu64(endian, x) \ | | 172| 1|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1, False: 0] | | ------------------ | | 173| 1| ((uint64_t) \ | | 174| 1| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1| : \ | | 183| 1| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 3311| 1| uint16_t run_off = tsk_getu16(fs->endian, data_attr->c.nr.run_off); ------------------ | | 86| 1|#define tsk_getu16(endian, x) \ | | 87| 1|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 1, False: 0] | | ------------------ | | 88| 1| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 1| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 3312| | 3313| 1| if ((run_off < 48) || ------------------ | Branch (3313:9): [True: 0, False: 1] ------------------ 3314| 1| (run_off >= attr_len) || ------------------ | Branch (3314:9): [True: 0, False: 1] ------------------ 3315| 1| ((uintptr_t) data_attr + run_off) > ((uintptr_t) mft + (uintptr_t) ntfs->mft_rsize_b)) { ------------------ | Branch (3315:9): [True: 0, False: 1] ------------------ 3316| 0| tsk_error_reset(); 3317| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3318| 0| tsk_error_set_errstr("Invalid run_off of Bitmap Data Attribute - value out of bounds"); 3319| 0| goto on_error; 3320| 0| } 3321| | /* convert data run to generic form */ 3322| 1| if ((ntfs_make_data_run(ntfs, ------------------ | Branch (3322:9): [True: 0, False: 1] ------------------ 3323| 1| run_start_vcn, 3324| 1| (ntfs_runlist *) ((uintptr_t) data_attr + run_off), 3325| 1| attr_len - run_off, 3326| 1| &(ntfs->bmap), NULL, NTFS_MFT_BMAP)) != TSK_OK) { ------------------ | | 133| 1|#define NTFS_MFT_BMAP 0x6 ------------------ 3327| 0| goto on_error; 3328| 0| } 3329| 1| ntfs->bmap_buf = (char *) tsk_malloc(fs->block_size); 3330| 1| if (ntfs->bmap_buf == NULL) { ------------------ | Branch (3330:9): [True: 0, False: 1] ------------------ 3331| 0| goto on_error; 3332| 0| } 3333| | 3334| | /* Load the first cluster so that we have something there */ 3335| 1| ntfs->bmap_buf_off = 0; 3336| | 3337| | // Check ntfs->bmap before it is accessed. 3338| 1| if (ntfs->bmap == NULL) { ------------------ | Branch (3338:9): [True: 0, False: 1] ------------------ 3339| 0| goto on_error; 3340| 0| } 3341| 1| if (ntfs->bmap->addr > fs->last_block) { ------------------ | Branch (3341:9): [True: 0, False: 1] ------------------ 3342| 0| tsk_error_reset(); 3343| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3344| 0| tsk_error_set_errstr 3345| 0| ("ntfs_load_bmap: Bitmap too large for image size: %" PRIuDADDR 3346| 0| "", ntfs->bmap->addr); 3347| 0| goto on_error; 3348| 0| } 3349| 1| cnt = 3350| 1| tsk_fs_read_block(fs, 3351| 1| ntfs->bmap->addr, ntfs->bmap_buf, fs->block_size); 3352| 1| if (cnt != fs->block_size) { ------------------ | Branch (3352:9): [True: 0, False: 1] ------------------ 3353| 0| if (cnt >= 0) { ------------------ | Branch (3353:13): [True: 0, False: 0] ------------------ 3354| 0| tsk_error_reset(); 3355| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3356| 0| } 3357| 0| tsk_error_set_errstr2("ntfs_load_bmap: Error reading block at %" 3358| 0| PRIuDADDR, ntfs->bmap->addr); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 3359| 0| goto on_error; 3360| 0| } 3361| | 3362| 1| free (mft); 3363| 1| return 0; 3364| | 3365| 0|on_error: 3366| 0| if (mft != NULL) { ------------------ | Branch (3366:9): [True: 0, False: 0] ------------------ 3367| 0| free (mft); 3368| 0| } 3369| 0| return 1; 3370| 1|} ntfs.c:ntfs_load_secure: 3839| 1|{ 3840| 1| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ntfs->fs_info; 3841| 1| TSK_FS_META *fs_meta = NULL; 3842| 1| const TSK_FS_ATTR *fs_attr_sds = NULL; 3843| 1| const TSK_FS_ATTR *fs_attr_sii = NULL; 3844| 1| NTFS_SXX_BUFFER sii_buffer; 3845| 1| TSK_FS_FILE *secure = NULL; 3846| 1| ssize_t cnt; 3847| | 3848| 1| ntfs->sii_data.buffer = NULL; 3849| 1| ntfs->sii_data.size = 0; 3850| 1| ntfs->sii_data.used = 0; 3851| 1| ntfs->sds_data.buffer = NULL; 3852| 1| ntfs->sds_data.size = 0; 3853| 1| ntfs->sds_data.used = 0; 3854| | 3855| | 3856| | // Open $Secure. The $SDS stream contains all the security descriptors 3857| | // and is indexed by $SII and $SDH. 3858| 1| secure = tsk_fs_file_open_meta(fs, NULL, NTFS_MFT_SECURE); ------------------ | | 137| 1|#define NTFS_MFT_SECURE 0x9 ------------------ 3859| 1| if (!secure) { ------------------ | Branch (3859:9): [True: 0, False: 1] ------------------ 3860| 0| if (tsk_verbose) ------------------ | Branch (3860:13): [True: 0, False: 0] ------------------ 3861| 0| tsk_fprintf(stderr, 3862| 0| "ntfs_load_secure: error opening $Secure file: %s\n", 3863| 0| tsk_error_get_errstr()); 3864| 0| tsk_error_reset(); 3865| 0| return 0; 3866| 0| } 3867| | 3868| | // Make sure the TSK_FS_META is not NULL. We need it to get the 3869| | // $SII and $SDH attributes. 3870| 1| fs_meta = secure->meta; 3871| 1| if (!fs_meta) { ------------------ | Branch (3871:9): [True: 0, False: 1] ------------------ 3872| 0| if (tsk_verbose) ------------------ | Branch (3872:13): [True: 0, False: 0] ------------------ 3873| 0| tsk_fprintf(stderr, 3874| 0| "ntfs_load_secure: $Secure file has no attributes\n"); 3875| 0| tsk_error_reset(); 3876| 0| tsk_fs_file_close(secure); 3877| 0| return 0; 3878| 0| } 3879| | 3880| | // Get the $SII attribute. 3881| 1| fs_attr_sii = 3882| 1| tsk_fs_attrlist_get_name_type(fs_meta->attr, NTFS_ATYPE_IDXALLOC, ------------------ | | 201| 1|#define NTFS_ATYPE_IDXALLOC 0xA0 // 160 ------------------ 3883| 1| "$SII\0"); 3884| 1| if (!fs_attr_sii) { ------------------ | Branch (3884:9): [True: 1, False: 0] ------------------ 3885| 1| if (tsk_verbose) ------------------ | Branch (3885:13): [True: 0, False: 1] ------------------ 3886| 0| tsk_fprintf(stderr, 3887| 0| "ntfs_load_secure: error getting $Secure:$SII IDX_ALLOC attribute\n"); 3888| 1| tsk_error_reset(); 3889| 1| tsk_fs_file_close(secure); 3890| 1| return 0; 3891| | 3892| 1| } 3893| | 3894| | // Get the $SDS attribute. 3895| 0| fs_attr_sds = tsk_fs_attrlist_get(fs_meta->attr, NTFS_ATYPE_DATA); ------------------ | | 199| 0|#define NTFS_ATYPE_DATA 0x80 // 128 ------------------ 3896| 0| if (!fs_attr_sds) { ------------------ | Branch (3896:9): [True: 0, False: 0] ------------------ 3897| 0| if (tsk_verbose) ------------------ | Branch (3897:13): [True: 0, False: 0] ------------------ 3898| 0| tsk_fprintf(stderr, 3899| 0| "ntfs_load_secure: error getting $Secure:$SDS $Data attribute\n"); 3900| 0| tsk_error_reset(); 3901| 0| tsk_fs_file_close(secure); 3902| 0| return 0; 3903| 0| } 3904| | 3905| | /* First we read in $SII to a local buffer adn then process it into NTFS_INFO */ 3906| | 3907| | // Allocate local space for the entire $SII stream. 3908| 0| sii_buffer.size = (size_t) roundup(fs_attr_sii->size, fs->block_size); 3909| 0| sii_buffer.used = 0; 3910| | 3911| | // arbitrary check because we had problems before with alloc too much memory 3912| 0| if (sii_buffer.size > 64000000) { ------------------ | Branch (3912:9): [True: 0, False: 0] ------------------ 3913| 0| if (tsk_verbose) ------------------ | Branch (3913:13): [True: 0, False: 0] ------------------ 3914| 0| tsk_fprintf(stderr, 3915| 0| "ntfs_load_secure: sii_buffer.size is too large: %z\n", 3916| 0| sii_buffer.size); 3917| 0| return 0; 3918| 0| } 3919| 0| if ((sii_buffer.buffer = tsk_malloc(sii_buffer.size)) == NULL) { ------------------ | Branch (3919:9): [True: 0, False: 0] ------------------ 3920| 0| return 1; 3921| 0| } 3922| | 3923| | // Read in the raw $SII stream. 3924| 0| cnt = 3925| 0| tsk_fs_attr_read(fs_attr_sii, 0, sii_buffer.buffer, 3926| 0| sii_buffer.size, TSK_FS_FILE_READ_FLAG_NONE); 3927| 0| if (cnt != (ssize_t)sii_buffer.size) { ------------------ | Branch (3927:9): [True: 0, False: 0] ------------------ 3928| 0| if (tsk_verbose) ------------------ | Branch (3928:13): [True: 0, False: 0] ------------------ 3929| 0| tsk_fprintf(stderr, 3930| 0| "ntfs_load_secure: error reading $Secure:$SII attribute: %s\n", 3931| 0| tsk_error_get_errstr()); 3932| 0| tsk_error_reset(); 3933| | 3934| 0| free(sii_buffer.buffer); 3935| 0| tsk_fs_file_close(secure); 3936| 0| return 0; 3937| 0| } 3938| | 3939| | // allocate the structure for the processed version of the data 3940| 0| ntfs->sii_data.used = 0; // use this to count the number of $SII entries 3941| 0| if ((ntfs->sii_data.buffer = ------------------ | Branch (3941:9): [True: 0, False: 0] ------------------ 3942| 0| (char *) tsk_malloc(sii_buffer.size)) == NULL) { 3943| 0| free(sii_buffer.buffer); 3944| 0| tsk_fs_file_close(secure); 3945| 0| return 1; 3946| 0| } 3947| 0| ntfs->sii_data.size = sii_buffer.size; 3948| | 3949| | // parse sii_buffer into ntfs->sii_data. 3950| 0| ntfs_proc_sii(fs, &sii_buffer); 3951| 0| free(sii_buffer.buffer); 3952| | 3953| | 3954| | /* Now we copy $SDS into NTFS_INFO. We do not do any processing in this step. */ 3955| | 3956| | // Allocate space for the entire $SDS stream with all the security 3957| | // descriptors. We should be able to use the $SII offset to index 3958| | // into the $SDS stream. 3959| 0| ntfs->sds_data.size = (size_t) fs_attr_sds->size; 3960| | // arbitrary check because we had problems before with alloc too much memory 3961| 0| if (ntfs->sds_data.size > 64000000) { ------------------ | Branch (3961:9): [True: 0, False: 0] ------------------ 3962| 0| if (tsk_verbose) ------------------ | Branch (3962:13): [True: 0, False: 0] ------------------ 3963| 0| tsk_fprintf(stderr, 3964| 0| "ntfs_load_secure: ntfs->sds_data.size is too large: %z\n", 3965| 0| ntfs->sds_data.size); 3966| 0| free(ntfs->sii_data.buffer); 3967| 0| ntfs->sii_data.buffer = NULL; 3968| 0| ntfs->sii_data.used = 0; 3969| 0| ntfs->sii_data.size = 0; 3970| 0| tsk_fs_file_close(secure); 3971| | 3972| 0| return 0; 3973| 0| } 3974| 0| ntfs->sds_data.used = 0; 3975| 0| if ((ntfs->sds_data.buffer = ------------------ | Branch (3975:9): [True: 0, False: 0] ------------------ 3976| 0| (char *) tsk_malloc(ntfs->sds_data.size)) == NULL) { 3977| 0| free(ntfs->sii_data.buffer); 3978| 0| ntfs->sii_data.buffer = NULL; 3979| 0| ntfs->sii_data.used = 0; 3980| 0| ntfs->sii_data.size = 0; 3981| 0| tsk_fs_file_close(secure); 3982| 0| return 1; 3983| 0| } 3984| | 3985| | // Read in the raw $SDS ($DATA) stream. 3986| 0| cnt = 3987| 0| tsk_fs_attr_read(fs_attr_sds, 0, 3988| 0| ntfs->sds_data.buffer, ntfs->sds_data.size, 3989| 0| TSK_FS_FILE_READ_FLAG_NONE); 3990| 0| if (cnt != (ssize_t)ntfs->sds_data.size) { ------------------ | Branch (3990:9): [True: 0, False: 0] ------------------ 3991| 0| if (tsk_verbose) ------------------ | Branch (3991:13): [True: 0, False: 0] ------------------ 3992| 0| tsk_fprintf(stderr, 3993| 0| "ntfs_load_secure: error reading $Secure:$SDS attribute: %s\n", 3994| 0| tsk_error_get_errstr()); 3995| 0| tsk_error_reset(); 3996| | 3997| 0| free(ntfs->sii_data.buffer); 3998| 0| ntfs->sii_data.buffer = NULL; 3999| 0| ntfs->sii_data.used = 0; 4000| 0| ntfs->sii_data.size = 0; 4001| 0| free(ntfs->sds_data.buffer); 4002| 0| ntfs->sds_data.buffer = NULL; 4003| 0| ntfs->sds_data.used = 0; 4004| 0| ntfs->sds_data.size = 0; 4005| 0| tsk_fs_file_close(secure); 4006| 0| return 0; 4007| 0| } 4008| | 4009| 0| tsk_fs_file_close(secure); 4010| 0| return 0; 4011| 0|} ntfs_dir_open_meta: 763| 1|{ 764| 1| NTFS_INFO *ntfs = (NTFS_INFO *) a_fs; 765| 1| TSK_FS_DIR *fs_dir; 766| 1| const TSK_FS_ATTR *fs_attr_root = NULL; 767| 1| const TSK_FS_ATTR *fs_attr_idx; 768| 1| char *idxalloc; 769| 1| ntfs_idxentry *idxe; 770| 1| ntfs_idxroot *idxroot; 771| 1| ntfs_idxelist *idxelist; 772| 1| ntfs_idxrec *idxrec_p, *idxrec; 773| 1| TSK_OFF_T idxalloc_len; 774| 1| TSK_FS_LOAD_FILE load_file; 775| | 776| | /* In this function, we will return immediately if we get an error. 777| | * If we get corruption though, we will record that in 'retval_final' 778| | * and continue processing. 779| | */ 780| 1| TSK_RETVAL_ENUM retval_final = TSK_OK; 781| 1| TSK_RETVAL_ENUM retval_tmp; 782| | 783| | /* sanity check */ 784| 1| if (a_addr < a_fs->first_inum || a_addr > a_fs->last_inum) { ------------------ | Branch (784:9): [True: 0, False: 1] | Branch (784:38): [True: 0, False: 1] ------------------ 785| 0| tsk_error_reset(); 786| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 787| 0| tsk_error_set_errstr("ntfs_dir_open_meta: inode value: %" PRIuINUM 788| 0| "\n", a_addr); 789| 0| return TSK_ERR; 790| 0| } 791| 1| else if (a_fs_dir == NULL) { ------------------ | Branch (791:14): [True: 0, False: 1] ------------------ 792| 0| tsk_error_reset(); 793| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 794| 0| tsk_error_set_errstr 795| 0| ("ntfs_dir_open_meta: NULL fs_attr argument given"); 796| 0| return TSK_ERR; 797| 0| } 798| | 799| 1| if (tsk_verbose) ------------------ | Branch (799:9): [True: 0, False: 1] ------------------ 800| 0| tsk_fprintf(stderr, 801| 0| "ntfs_open_dir: Processing directory %" PRIuINUM "\n", a_addr); 802| | 803| | 804| 1| fs_dir = *a_fs_dir; 805| 1| if (fs_dir) { ------------------ | Branch (805:9): [True: 0, False: 1] ------------------ 806| 0| tsk_fs_dir_reset(fs_dir); 807| 0| fs_dir->addr = a_addr; 808| 0| } 809| 1| else { 810| 1| if ((*a_fs_dir = fs_dir = ------------------ | Branch (810:13): [True: 0, False: 1] ------------------ 811| 1| tsk_fs_dir_alloc(a_fs, a_addr, 128)) == NULL) { 812| 0| return TSK_ERR; 813| 0| } 814| 1| } 815| | 816| | // handle the orphan directory if its contents were requested 817| 1| if (a_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 1| (fs_info->last_inum) ------------------ | Branch (817:9): [True: 0, False: 1] ------------------ 818| 0| return tsk_fs_dir_find_orphans(a_fs, fs_dir); 819| 0| } 820| | 821| | /* Get the inode and verify it has attributes */ 822| 1| if ((fs_dir->fs_file = ------------------ | Branch (822:9): [True: 0, False: 1] ------------------ 823| 1| tsk_fs_file_open_meta(a_fs, NULL, a_addr)) == NULL) { 824| 0| tsk_error_errstr2_concat("- ntfs_dir_open_meta"); 825| 0| return TSK_COR; 826| 0| } 827| | 828| 1| if (!(fs_dir->fs_file->meta->attr)) { ------------------ | Branch (828:9): [True: 0, False: 1] ------------------ 829| 0| tsk_error_reset(); 830| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 831| 0| tsk_error_set_errstr("dent_walk: Error: Directory address %" 832| 0| PRIuINUM " has no attributes", a_addr); 833| 0| return TSK_COR; 834| 0| } 835| | 836| | // Update with the sequence number 837| 1| fs_dir->seq = fs_dir->fs_file->meta->seq; 838| | 839| | /* 840| | * Read the Index Root Attribute -- we do some sanity checking here 841| | * to report errors before we start to make up data for the "." and ".." 842| | * entries 843| | */ 844| 1| fs_attr_root = 845| 1| tsk_fs_attrlist_get(fs_dir->fs_file->meta->attr, 846| 1| TSK_FS_ATTR_TYPE_NTFS_IDXROOT); 847| 1| if (!fs_attr_root) { ------------------ | Branch (847:9): [True: 0, False: 1] ------------------ 848| 0| tsk_error_errstr2_concat(" - dent_walk: $IDX_ROOT not found"); 849| 0| return TSK_COR; 850| 0| } 851| | 852| 1| if (fs_attr_root->flags & TSK_FS_ATTR_NONRES) { ------------------ | Branch (852:9): [True: 0, False: 1] ------------------ 853| 0| tsk_error_reset(); 854| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 855| 0| tsk_error_set_errstr 856| 0| ("dent_walk: $IDX_ROOT is not resident - it should be"); 857| 0| return TSK_COR; 858| 0| } 859| 1| idxroot = (ntfs_idxroot *) fs_attr_root->rd.buf; 860| | 861| | /* Verify that the attribute type is $FILE_NAME */ 862| 1| if (tsk_getu32(a_fs->endian, idxroot->type) == 0) { ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (862:9): [True: 0, False: 1] ------------------ 863| 0| tsk_error_reset(); 864| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 865| 0| tsk_error_set_errstr 866| 0| ("dent_walk: Attribute type in index root is 0"); 867| 0| return TSK_COR; 868| 0| } 869| 1| else if (tsk_getu32(a_fs->endian, idxroot->type) != NTFS_ATYPE_FNAME) { ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ else if (tsk_getu32(a_fs->endian, idxroot->type) != NTFS_ATYPE_FNAME) { ------------------ | | 193| 1|#define NTFS_ATYPE_FNAME 0x30 // 48 ------------------ | Branch (869:14): [True: 0, False: 1] ------------------ 870| 0| tsk_error_reset(); 871| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 872| 0| tsk_error_set_errstr("ERROR: Directory index is sorted by type: %" 873| 0| PRIu32 ".\nOnly $FNAME is currently supported", 874| 0| tsk_getu32(a_fs->endian, idxroot->type)); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 875| 0| return TSK_COR; 876| 0| } 877| | 878| | 879| | 880| | /* 881| | * NTFS does not have "." and ".." entries in the index trees 882| | * (except for a "." entry in the root directory) 883| | * 884| | * So, we'll make 'em up by making a TSK_FS_NAME structure for 885| | * a '.' and '..' entry and call the action 886| | */ 887| 1| if (a_addr != a_fs->root_inum) { // && (flags & TSK_FS_NAME_FLAG_ALLOC)) { ------------------ | Branch (887:9): [True: 0, False: 1] ------------------ 888| 0| TSK_FS_NAME *fs_name; 889| 0| TSK_FS_META_NAME_LIST *fs_name_list; 890| | 891| 0| if (tsk_verbose) ------------------ | Branch (891:13): [True: 0, False: 0] ------------------ 892| 0| tsk_fprintf(stderr, 893| 0| "ntfs_dir_open_meta: Creating . and .. entries\n"); 894| | 895| 0| if ((fs_name = tsk_fs_name_alloc(16, 0)) == NULL) { ------------------ | Branch (895:13): [True: 0, False: 0] ------------------ 896| 0| return TSK_ERR; 897| 0| } 898| | /* 899| | * "." 900| | */ 901| | 902| 0| fs_name->type = TSK_FS_NAME_TYPE_DIR; 903| 0| strcpy(fs_name->name, "."); 904| | 905| 0| fs_name->meta_addr = a_addr; 906| 0| if (fs_dir->fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC) { ------------------ | Branch (906:13): [True: 0, False: 0] ------------------ 907| 0| fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 908| | /* If the folder was deleted, the MFT entry sequence will have been incremented. 909| | * File name entries are not incremented on delete, so make it one less to 910| | * be consistent. */ 911| 0| fs_name->meta_seq = fs_dir->fs_file->meta->seq - 1; 912| 0| } 913| 0| else { 914| 0| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 915| 0| fs_name->meta_seq = fs_dir->fs_file->meta->seq; 916| 0| } 917| 0| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (917:13): [True: 0, False: 0] ------------------ 918| 0| tsk_fs_name_free(fs_name); 919| 0| return TSK_ERR; 920| 0| } 921| | 922| | 923| | /* 924| | * ".." 925| | */ 926| 0| strcpy(fs_name->name, ".."); 927| 0| fs_name->type = TSK_FS_NAME_TYPE_DIR; 928| | 929| | /* The fs_name structure holds the parent inode value, so we 930| | * just cycle using those 931| | */ 932| 0| for (fs_name_list = fs_dir->fs_file->meta->name2; 933| 0| fs_name_list != NULL; fs_name_list = fs_name_list->next) { ------------------ | Branch (933:13): [True: 0, False: 0] ------------------ 934| 0| fs_name->meta_addr = fs_name_list->par_inode; 935| 0| fs_name->meta_seq = fs_name_list->par_seq; 936| 0| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (936:17): [True: 0, False: 0] ------------------ 937| 0| tsk_fs_name_free(fs_name); 938| 0| return TSK_ERR; 939| 0| } 940| 0| } 941| | 942| 0| tsk_fs_name_free(fs_name); 943| 0| fs_name = NULL; 944| 0| } 945| | 946| | 947| | /* Now we return to processing the Index Root Attribute */ 948| 1| if (tsk_verbose) ------------------ | Branch (948:9): [True: 0, False: 1] ------------------ 949| 0| tsk_fprintf(stderr, 950| 0| "ntfs_dir_open_meta: Processing $IDX_ROOT of inum %" PRIuINUM 951| 0| "\n", a_addr); 952| | 953| | /* Get the header of the index entry list */ 954| 1| idxelist = &idxroot->list; 955| | 956| | /* Verify the offset pointers */ 957| 1| if ((tsk_getu32(a_fs->endian, idxelist->seqend_off) < ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (957:9): [True: 0, False: 1] ------------------ 958| 1| tsk_getu32(a_fs->endian, idxelist->begin_off)) || ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 959| 1| (tsk_getu32(a_fs->endian, idxelist->bufend_off) < ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (959:9): [True: 0, False: 1] ------------------ 960| 1| tsk_getu32(a_fs->endian, idxelist->seqend_off)) || ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 961| 1| (((uintptr_t) idxelist + tsk_getu32(a_fs->endian, ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (961:9): [True: 0, False: 1] ------------------ 962| 1| idxelist->bufend_off)) > 963| 1| ((uintptr_t) fs_attr_root->rd.buf + 964| 1| fs_attr_root->rd.buf_size))) { 965| 0| tsk_error_reset(); 966| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 967| 0| tsk_error_set_errstr 968| 0| ("Error: Index list offsets are invalid on entry: %" PRIuINUM, ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 969| 0| fs_dir->fs_file->meta->addr); 970| 0| return TSK_COR; 971| 0| } 972| | 973| | /* Get the offset to the start of the index entry list */ 974| 1| idxe = (ntfs_idxentry *) ((uintptr_t) idxelist + 975| 1| tsk_getu32(a_fs->endian, idxelist->begin_off)); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 976| | 977| 1| retval_tmp = ntfs_proc_idxentry(ntfs, fs_dir, 978| 1| (fs_dir->fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0, ------------------ | Branch (978:9): [True: 0, False: 1] ------------------ 979| 1| idxe, 980| 1| tsk_getu32(a_fs->endian, idxelist->bufend_off) - ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 981| 1| tsk_getu32(a_fs->endian, idxelist->begin_off), ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 982| 1| tsk_getu32(a_fs->endian, idxelist->seqend_off) - ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 983| 1| tsk_getu32(a_fs->endian, idxelist->begin_off)); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 984| | 985| | // stop if we get an error, continue if we got corruption 986| 1| if (retval_tmp == TSK_ERR) { ------------------ | Branch (986:9): [True: 0, False: 1] ------------------ 987| 0| return TSK_ERR; 988| 0| } 989| 1| else if (retval_tmp == TSK_COR) { ------------------ | Branch (989:14): [True: 0, False: 1] ------------------ 990| 0| retval_final = TSK_COR; 991| 0| } 992| | 993| | /* 994| | * get the index allocation attribute if it exists (it doesn't for 995| | * small directories 996| | */ 997| 1| fs_attr_idx = 998| 1| tsk_fs_attrlist_get(fs_dir->fs_file->meta->attr, 999| 1| TSK_FS_ATTR_TYPE_NTFS_IDXALLOC); 1000| | 1001| | 1002| | /* if we don't have an index alloc then return, we have processed 1003| | * all of the entries 1004| | */ 1005| 1| if (!fs_attr_idx) { ------------------ | Branch (1005:9): [True: 0, False: 1] ------------------ 1006| 0| if (tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1006:13): [True: 0, False: 0] ------------------ 1007| 0| idxelist->flags) & NTFS_IDXELIST_CHILD) { ------------------ | | 389| 0|#define NTFS_IDXELIST_CHILD 0x1 /* children exist below this node */ ------------------ 1008| 0| tsk_error_reset(); 1009| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1010| 0| tsk_error_set_errstr 1011| 0| ("Error: $IDX_ROOT says there should be children, but there isn't"); 1012| 0| return TSK_COR; 1013| 0| } 1014| 0| } 1015| 1| else { 1016| 1| unsigned int off; 1017| | 1018| 1| if (fs_attr_idx->flags & TSK_FS_ATTR_RES) { ------------------ | Branch (1018:13): [True: 0, False: 1] ------------------ 1019| 0| tsk_error_reset(); 1020| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1021| 0| tsk_error_set_errstr 1022| 0| ("$IDX_ALLOC is Resident - it shouldn't be"); 1023| 0| return TSK_COR; 1024| 0| } 1025| | 1026| | // Taking 128 MiB as an arbitrary upper bound 1027| 1| if (fs_attr_idx->nrd.allocsize > (128 * 1024 * 1024)) { ------------------ | Branch (1027:13): [True: 0, False: 1] ------------------ 1028| 0| tsk_error_reset(); 1029| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1030| 0| tsk_error_set_errstr 1031| 0| ("fs_attr_idx->nrd.allocsize value out of bounds"); 1032| 0| return TSK_COR; 1033| 0| } 1034| | 1035| | /* 1036| | * Copy the index allocation run into a big buffer 1037| | */ 1038| 1| idxalloc_len = fs_attr_idx->nrd.allocsize; 1039| | // default to null unless length is greater than 0 1040| 1| idxalloc = NULL; 1041| 1| if ((idxalloc_len > 0) && ((idxalloc = (char *)tsk_malloc((size_t)idxalloc_len)) == NULL)) { ------------------ | Branch (1041:13): [True: 1, False: 0] | Branch (1041:35): [True: 0, False: 1] ------------------ 1042| 0| return TSK_ERR; 1043| 0| } 1044| | 1045| | /* Fill in the loading data structure */ 1046| 1| load_file.total = load_file.left = (size_t) idxalloc_len; 1047| 1| load_file.cur = load_file.base = idxalloc; 1048| | 1049| 1| if (tsk_verbose) ------------------ | Branch (1049:13): [True: 0, False: 1] ------------------ 1050| 0| tsk_fprintf(stderr, 1051| 0| "ntfs_dir_open_meta: Copying $IDX_ALLOC into buffer\n"); 1052| | 1053| 1| if (tsk_fs_attr_walk(fs_attr_idx, ------------------ | Branch (1053:13): [True: 1, False: 0] ------------------ 1054| 1| TSK_FS_FILE_WALK_FLAG_SLACK, tsk_fs_load_file_action, 1055| 1| (void *) &load_file)) { 1056| 1| free(idxalloc); 1057| 1| tsk_error_errstr2_concat(" - ntfs_dir_open_meta"); 1058| 1| return TSK_COR; // this could be an error though 1059| 1| } 1060| | 1061| | /* Not all of the directory was copied, so we exit */ 1062| 0| if (load_file.left > 0) { ------------------ | Branch (1062:13): [True: 0, False: 0] ------------------ 1063| 0| free(idxalloc); 1064| | 1065| 0| tsk_error_reset(); 1066| 0| tsk_error_set_errno(TSK_ERR_FS_FWALK); ------------------ | | 356| 0|#define TSK_ERR_FS_FWALK (TSK_ERR_FS | 11) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1067| 0| tsk_error_set_errstr("Error reading directory contents: %" 1068| 0| PRIuINUM "\n", a_addr); 1069| 0| return TSK_COR; 1070| 0| } 1071| | 1072| | /* 1073| | * The idxalloc is a big buffer that contains one or more 1074| | * idx buffer structures. Each idxrec is a node in the B-Tree. 1075| | * We do not process the tree as a tree because then we could 1076| | * not find the deleted file names. 1077| | * 1078| | * Therefore, we scan the big buffer looking for the index record 1079| | * structures. We save a pointer to the known beginning (idxrec_p). 1080| | * Then we scan for the beginning of the next one (idxrec) and process 1081| | * everything in the middle as an ntfs_idxrec. We can't use the 1082| | * size given because then we wouldn't see the deleted names 1083| | */ 1084| | 1085| | /* Set the previous pointer to NULL */ 1086| 0| idxrec_p = idxrec = NULL; 1087| | 1088| | /* Loop by cluster size */ 1089| 0| for (off = 0; off < idxalloc_len; off += ntfs->csize_b) { ------------------ | Branch (1089:23): [True: 0, False: 0] ------------------ 1090| 0| uint32_t list_len, rec_len; 1091| | 1092| | // Ensure that there is enough data for an idxrec 1093| 0| if ((idxalloc_len < sizeof(ntfs_idxrec)) || (off > idxalloc_len - sizeof(ntfs_idxrec))) { ------------------ | Branch (1093:17): [True: 0, False: 0] | Branch (1093:57): [True: 0, False: 0] ------------------ 1094| 0| tsk_error_reset(); 1095| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1096| 0| tsk_error_set_errstr 1097| 0| ("ntfs_dir_open_meta: Not enough data in idxalloc buffer for an idxrec."); 1098| 0| free(idxalloc); 1099| 0| return TSK_COR; 1100| 0| } 1101| | 1102| 0| idxrec = (ntfs_idxrec *) & idxalloc[off]; 1103| | 1104| 0| if (tsk_verbose) ------------------ | Branch (1104:17): [True: 0, False: 0] ------------------ 1105| 0| tsk_fprintf(stderr, 1106| 0| "ntfs_dir_open_meta: Index Buffer Offset: %d Magic: %" 1107| 0| PRIx32 "\n", off, tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1108| 0| idxrec->magic)); 1109| | 1110| | /* Is this the beginning of an index record? */ 1111| 0| if (tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1111:17): [True: 0, False: 0] ------------------ 1112| 0| idxrec->magic) != NTFS_IDXREC_MAGIC) ------------------ | | 425| 0|#define NTFS_IDXREC_MAGIC 0x58444e49 /* INDX */ ------------------ 1113| 0| continue; 1114| | 1115| | 1116| | /* idxrec_p is only NULL for the first time 1117| | * Set it and start again to find the next one */ 1118| 0| if (idxrec_p == NULL) { ------------------ | Branch (1118:17): [True: 0, False: 0] ------------------ 1119| 0| idxrec_p = idxrec; 1120| 0| continue; 1121| 0| } 1122| | 1123| | /* Process the previous structure */ 1124| | 1125| | /* idxrec points to the next idxrec structure, idxrec_p 1126| | * points to the one we are going to process 1127| | */ 1128| 0| rec_len = 1129| 0| (uint32_t) ((uintptr_t) idxrec - (uintptr_t) idxrec_p); 1130| | 1131| 0| if (tsk_verbose) ------------------ | Branch (1131:17): [True: 0, False: 0] ------------------ 1132| 0| tsk_fprintf(stderr, 1133| 0| "ntfs_dir_open_meta: Processing previous index record (len: %" 1134| 0| PRIu32 ")\n", rec_len); 1135| | 1136| | /* remove the update sequence in the index record */ 1137| 0| if (ntfs_fix_idxrec(ntfs, idxrec_p, rec_len)) { ------------------ | Branch (1137:17): [True: 0, False: 0] ------------------ 1138| 0| free(idxalloc); 1139| 0| return TSK_COR; 1140| 0| } 1141| | 1142| | /* Locate the start of the index entry list */ 1143| 0| idxelist = &idxrec_p->list; 1144| 0| idxe = (ntfs_idxentry *) ((uintptr_t) idxelist + 1145| 0| tsk_getu32(a_fs->endian, idxelist->begin_off)); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1146| | 1147| | /* the length from the start of the next record to where our 1148| | * list starts. 1149| | * This should be the same as bufend_off in idxelist, but we don't 1150| | * trust it. 1151| | */ 1152| 0| list_len = (uint32_t) ((uintptr_t) idxrec - (uintptr_t) idxe); 1153| | 1154| | /* Verify the offset pointers */ 1155| 0| if (((uintptr_t) idxe > (uintptr_t) idxrec) || ------------------ | Branch (1155:17): [True: 0, False: 0] ------------------ 1156| 0| ((uintptr_t) idxelist + ------------------ | Branch (1156:17): [True: 0, False: 0] ------------------ 1157| 0| tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1158| 0| idxelist->seqend_off) > (uintptr_t) idxrec)) { 1159| 0| tsk_error_reset(); 1160| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1161| 0| tsk_error_set_errstr 1162| 0| ("Error: Index list offsets are invalid on entry: %" 1163| 0| PRIuINUM, fs_dir->fs_file->meta->addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 1164| 0| free(idxalloc); 1165| 0| return TSK_COR; 1166| 0| } 1167| | 1168| | 1169| | /* process the list of index entries */ 1170| 0| retval_tmp = ntfs_proc_idxentry(ntfs, fs_dir, 1171| 0| (fs_dir->fs_file->meta-> ------------------ | Branch (1171:17): [True: 0, False: 0] ------------------ 1172| 0| flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0, idxe, 1173| 0| list_len, tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1174| 0| idxelist->seqend_off) - tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1175| 0| idxelist->begin_off)); 1176| | // stop if we get an error, record if we get corruption 1177| 0| if (retval_tmp == TSK_ERR) { ------------------ | Branch (1177:17): [True: 0, False: 0] ------------------ 1178| 0| free(idxalloc); 1179| 0| return TSK_ERR; 1180| 0| } 1181| 0| else if (retval_tmp == TSK_COR) { ------------------ | Branch (1181:22): [True: 0, False: 0] ------------------ 1182| 0| retval_final = TSK_COR; 1183| 0| } 1184| | 1185| | /* reset the pointer to the next record */ 1186| 0| idxrec_p = idxrec; 1187| | 1188| 0| } /* end of cluster loop */ 1189| | 1190| | 1191| | /* Process the final record */ 1192| 0| if (idxrec_p) { ------------------ | Branch (1192:13): [True: 0, False: 0] ------------------ 1193| 0| uint32_t list_len, rec_len; 1194| | 1195| | /* Length from end of attribute to start of this */ 1196| 0| rec_len = 1197| 0| (uint32_t) (idxalloc_len - ((uintptr_t) idxrec_p - 1198| 0| (uintptr_t) idxalloc)); 1199| | 1200| 0| if (tsk_verbose) ------------------ | Branch (1200:17): [True: 0, False: 0] ------------------ 1201| 0| tsk_fprintf(stderr, 1202| 0| "ntfs_dir_open_meta: Processing final index record (len: %" 1203| 0| PRIu32 ")\n", rec_len); 1204| | 1205| | /* remove the update sequence */ 1206| 0| if (ntfs_fix_idxrec(ntfs, idxrec_p, rec_len)) { ------------------ | Branch (1206:17): [True: 0, False: 0] ------------------ 1207| 0| free(idxalloc); 1208| 0| return TSK_COR; 1209| 0| } 1210| | 1211| 0| idxelist = &idxrec_p->list; 1212| 0| if (tsk_getu32(a_fs->endian, idxelist->begin_off) > rec_len) { ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (1212:17): [True: 0, False: 0] ------------------ 1213| 0| tsk_error_reset(); 1214| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1215| 0| tsk_error_set_errstr 1216| 0| ("Error: Index list offsets are invalid on entry: %" 1217| 0| PRIuINUM, fs_dir->fs_file->meta->addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 1218| 0| free(idxalloc); 1219| 0| return TSK_COR; 1220| 0| } 1221| | 1222| 0| idxe = (ntfs_idxentry *) ((uintptr_t) idxelist + 1223| 0| tsk_getu32(a_fs->endian, idxelist->begin_off)); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1224| | 1225| | /* This is the length of the idx entries */ 1226| 0| list_len = 1227| 0| (uint32_t) (((uintptr_t) idxalloc + idxalloc_len) - 1228| 0| (uintptr_t) idxe); 1229| | 1230| | /* Verify the offset pointers */ 1231| 0| if ((list_len > rec_len) || ------------------ | Branch (1231:17): [True: 0, False: 0] ------------------ 1232| 0| ((uintptr_t) idxelist + ------------------ | Branch (1232:17): [True: 0, False: 0] ------------------ 1233| 0| tsk_getu32(a_fs->endian, idxelist->seqend_off) > ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1234| 0| (uintptr_t) idxalloc + idxalloc_len)) { 1235| 0| tsk_error_reset(); 1236| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1237| 0| tsk_error_set_errstr 1238| 0| ("Error: Index list offsets are invalid on entry: %" 1239| 0| PRIuINUM, fs_dir->fs_file->meta->addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 1240| 0| free(idxalloc); 1241| 0| return TSK_COR; 1242| 0| } 1243| | 1244| | /* process the list of index entries */ 1245| 0| retval_tmp = ntfs_proc_idxentry(ntfs, fs_dir, 1246| 0| (fs_dir->fs_file->meta-> ------------------ | Branch (1246:17): [True: 0, False: 0] ------------------ 1247| 0| flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0, idxe, 1248| 0| list_len, tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1249| 0| idxelist->seqend_off) - tsk_getu32(a_fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1250| 0| idxelist->begin_off)); 1251| | // stop if we get an error, record if we get corruption 1252| 0| if (retval_tmp == TSK_ERR) { ------------------ | Branch (1252:17): [True: 0, False: 0] ------------------ 1253| 0| free(idxalloc); 1254| 0| return TSK_ERR; 1255| 0| } 1256| 0| else if (retval_tmp == TSK_COR) { ------------------ | Branch (1256:22): [True: 0, False: 0] ------------------ 1257| 0| retval_final = TSK_COR; 1258| 0| } 1259| 0| } 1260| | 1261| 0| free(idxalloc); 1262| 0| } 1263| | 1264| | 1265| | // get the orphan files 1266| | // load and cache the map if it has not already been done 1267| 0| tsk_take_lock(&ntfs->orphan_map_lock); 1268| 0| if (ntfs->orphan_map == NULL) { ------------------ | Branch (1268:9): [True: 0, False: 0] ------------------ 1269| | // we do this to make it non-NULL. WE had some images that 1270| | // had no orphan files and it repeatedly did inode_walks 1271| | // because orphan_map was always NULL 1272| 0| getParentMap(ntfs); 1273| | 1274| 0| if (a_fs->inode_walk(a_fs, a_fs->first_inum, a_fs->last_inum, ------------------ | Branch (1274:13): [True: 0, False: 0] ------------------ 1275| 0| (TSK_FS_META_FLAG_ENUM)(TSK_FS_META_FLAG_UNALLOC | TSK_FS_META_FLAG_ALLOC), ntfs_parent_act, NULL)) { 1276| 0| tsk_release_lock(&ntfs->orphan_map_lock); 1277| 0| return TSK_ERR; 1278| 0| } 1279| 0| } 1280| | 1281| | 1282| | /* see if there are any entries in MFT for this dir that we didn't see. 1283| | * Need to make sure it is for this version (sequence) though. 1284| | * NTFS Updates the sequence when a directory is deleted and not when 1285| | * it is allocated. So, if we have a deleted directory, then use 1286| | * its previous sequence number to find the files that were in it when 1287| | * it was allocated. 1288| | */ 1289| 0| uint16_t seqToSrch = fs_dir->fs_file->meta->seq; 1290| 0| if (fs_dir->fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC) { ------------------ | Branch (1290:9): [True: 0, False: 0] ------------------ 1291| 0| if (seqToSrch > 0) ------------------ | Branch (1291:13): [True: 0, False: 0] ------------------ 1292| 0| seqToSrch--; 1293| 0| else 1294| | // I can't imagine how we get here or what we should do except maybe not do the search. 1295| 0| seqToSrch = 0; 1296| 0| } 1297| | 1298| 0| if (ntfs_parent_map_exists(ntfs, a_addr, seqToSrch)) { ------------------ | Branch (1298:9): [True: 0, False: 0] ------------------ 1299| 0| TSK_FS_NAME *fs_name; 1300| | 1301| 0| std::vector &childFiles = ntfs_parent_map_get(ntfs, a_addr, seqToSrch); 1302| | 1303| 0| if ((fs_name = tsk_fs_name_alloc(256, 0)) == NULL){ ------------------ | Branch (1303:13): [True: 0, False: 0] ------------------ 1304| 0| tsk_release_lock(&ntfs->orphan_map_lock); 1305| 0| return TSK_ERR; 1306| 0| } 1307| | 1308| 0| fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 1309| 0| fs_name->par_addr = a_addr; 1310| 0| fs_name->par_seq = fs_dir->fs_file->meta->seq; 1311| | 1312| 0| for (size_t a = 0; a < childFiles.size(); a++) { ------------------ | Branch (1312:28): [True: 0, False: 0] ------------------ 1313| 0| TSK_FS_FILE *fs_file_orp = NULL; 1314| | 1315| | /* Check if fs_dir already has an allocated entry for this 1316| | * file. If so, ignore it. We used to rely on fs_dir_add 1317| | * to get rid of this, but it wasted a lot of lookups. If 1318| | * We have only unalloc for this same entry (from idx entries), 1319| | * then try to add it. If we got an allocated entry from 1320| | * the idx entries, then assume we have everything. */ 1321| 0| if (tsk_fs_dir_contains(fs_dir, childFiles[a].getAddr(), childFiles[a].getHash()) == TSK_FS_NAME_FLAG_ALLOC) { ------------------ | Branch (1321:17): [True: 0, False: 0] ------------------ 1322| 0| continue; 1323| 0| } 1324| | 1325| | /* Fill in the basics of the fs_name entry 1326| | * so we can print in the fls formats */ 1327| 0| fs_name->meta_addr = childFiles[a].getAddr(); 1328| 0| fs_name->meta_seq = childFiles[a].getSeq(); 1329| | 1330| | // lookup the file to get more info (we did not cache that) 1331| 0| fs_file_orp = 1332| 0| tsk_fs_file_open_meta(a_fs, fs_file_orp, fs_name->meta_addr); 1333| 0| if (fs_file_orp) { ------------------ | Branch (1333:17): [True: 0, False: 0] ------------------ 1334| 0| if (fs_file_orp->meta) { ------------------ | Branch (1334:21): [True: 0, False: 0] ------------------ 1335| 0| if (fs_file_orp->meta->flags & TSK_FS_META_FLAG_ALLOC) { ------------------ | Branch (1335:25): [True: 0, False: 0] ------------------ 1336| 0| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 1337| 0| } 1338| 0| else { 1339| 0| fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 1340| | /* This sequence is the MFT entry, which gets 1341| | * incremented when it is unallocated. So, 1342| | * decrement it back down so that it is more 1343| | * similar to the usual situation, where the 1344| | * name sequence is 1 smaller than the meta 1345| | * sequence. */ 1346| 0| fs_name->meta_seq--; 1347| 0| } 1348| | 1349| 0| if (fs_file_orp->meta->name2) { ------------------ | Branch (1349:25): [True: 0, False: 0] ------------------ 1350| 0| TSK_FS_META_NAME_LIST *n2 = fs_file_orp->meta->name2; 1351| | 1352| 0| while (n2) { ------------------ | Branch (1352:32): [True: 0, False: 0] ------------------ 1353| 0| if (n2->par_inode == a_addr) { ------------------ | Branch (1353:33): [True: 0, False: 0] ------------------ 1354| 0| strncpy(fs_name->name, n2->name, fs_name->name_size); 1355| 0| tsk_fs_dir_add(fs_dir, fs_name); 1356| 0| } 1357| 0| n2 = n2->next; 1358| 0| } 1359| 0| } 1360| 0| } 1361| 0| tsk_fs_file_close(fs_file_orp); 1362| 0| } 1363| 0| } 1364| 0| tsk_fs_name_free(fs_name); 1365| 0| } 1366| 0| tsk_release_lock(&ntfs->orphan_map_lock); 1367| | 1368| | // if we are listing the root directory, add the Orphan directory entry 1369| 0| if (a_addr == a_fs->root_inum) { ------------------ | Branch (1369:9): [True: 0, False: 0] ------------------ 1370| 0| TSK_FS_NAME *fs_name; 1371| | 1372| 0| if ((fs_name = tsk_fs_name_alloc(256, 0)) == NULL) ------------------ | Branch (1372:13): [True: 0, False: 0] ------------------ 1373| 0| return TSK_ERR; 1374| | 1375| 0| if (tsk_fs_dir_make_orphan_dir_name(a_fs, fs_name)) { ------------------ | Branch (1375:13): [True: 0, False: 0] ------------------ 1376| 0| tsk_fs_name_free(fs_name); 1377| 0| return TSK_ERR; 1378| 0| } 1379| | 1380| 0| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (1380:13): [True: 0, False: 0] ------------------ 1381| 0| tsk_fs_name_free(fs_name); 1382| 0| return TSK_ERR; 1383| 0| } 1384| 0| tsk_fs_name_free(fs_name); 1385| 0| } 1386| | 1387| | 1388| 0| return retval_final; 1389| 0|} ntfs_dent.cpp:_ZL18ntfs_proc_idxentryP9NTFS_INFOP10TSK_FS_DIRhP13ntfs_idxentryjj: 384| 1|{ 385| 1| uintptr_t endaddr, endaddr_alloc; 386| 1| TSK_FS_NAME *fs_name; 387| 1| TSK_FS_NAME *fs_name_preventry = NULL; 388| 1| TSK_FS_INFO *fs = (TSK_FS_INFO *) & a_ntfs->fs_info; 389| | 390| 1| if ((fs_name = tsk_fs_name_alloc(NTFS_MAXNAMLEN_UTF8, 16)) == NULL) { ------------------ | | 34| 1|#define NTFS_MAXNAMLEN_UTF8 4 * NTFS_MAXNAMLEN | | ------------------ | | | | 33| 1|#define NTFS_MAXNAMLEN 256 | | ------------------ ------------------ | Branch (390:9): [True: 0, False: 1] ------------------ 391| 0| return TSK_ERR; 392| 0| } 393| | 394| 1| if (tsk_verbose) ------------------ | Branch (394:9): [True: 0, False: 1] ------------------ 395| 0| tsk_fprintf(stderr, 396| 0| "ntfs_proc_idxentry: Processing index entry: %" PRIu64 397| 0| " Size: %" PRIu32 " Len: %" PRIu32 "\n", 398| 0| (uint64_t) ((uintptr_t) a_idxe), a_idxe_len, a_used_len); 399| | 400| | /* Sanity check */ 401| 1| if (a_idxe_len < a_used_len) { ------------------ | Branch (401:9): [True: 0, False: 1] ------------------ 402| 0| tsk_error_reset(); 403| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 404| 0| tsk_error_set_errstr 405| 0| ("ntfs_proc_idxentry: Allocated length of index entries is larger than buffer length"); 406| 0| return TSK_ERR; 407| 0| } 408| | 409| | /* where is the end of the buffer */ 410| 1| endaddr = ((uintptr_t) a_idxe + a_idxe_len); 411| | 412| | /* where is the end of the allocated data */ 413| 1| endaddr_alloc = ((uintptr_t) a_idxe + a_used_len); 414| | 415| | /* cycle through the index entries, based on provided size */ 416| 1| while (((uintptr_t) & (a_idxe->stream) + sizeof(ntfs_attr_fname)) < ------------------ | Branch (416:12): [True: 0, False: 1] ------------------ 417| 1| endaddr) { 418| | 419| 0| ntfs_attr_fname *fname = (ntfs_attr_fname *) & a_idxe->stream; 420| | 421| | 422| 0| if (tsk_verbose) ------------------ | Branch (422:13): [True: 0, False: 0] ------------------ 423| 0| tsk_fprintf(stderr, 424| 0| "ntfs_proc_idxentry: New IdxEnt: %" PRIu64 425| 0| " $FILE_NAME Entry: %" PRIu64 " File Ref: %" PRIu64 426| 0| " IdxEnt Len: %" PRIu16 " StrLen: %" PRIu16 "\n", 427| 0| (uint64_t) ((uintptr_t) a_idxe), 428| 0| (uint64_t) ((uintptr_t) fname), 429| 0| (uint64_t) tsk_getu48(fs->endian, a_idxe->file_ref), ------------------ | | 146| 0|#define tsk_getu48(endian, x) \ | | 147| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (147:13): [True: 0, False: 0] | | ------------------ | | 148| 0| ((uint64_t) \ | | 149| 0| ((uint64_t)((uint8_t *)(x))[0] << 0)+ \ | | 150| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 151| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 152| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 153| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 154| 0| ((uint64_t)((uint8_t *)(x))[5] << 40)) \ | | 155| 0| : \ | | 156| 0| ((uint64_t) \ | | 157| 0| ((uint64_t)((uint8_t *)(x))[5] << 0)+ \ | | 158| 0| ((uint64_t)((uint8_t *)(x))[4] << 8) + \ | | 159| 0| ((uint64_t)((uint8_t *)(x))[3] << 16) + \ | | 160| 0| ((uint64_t)((uint8_t *)(x))[2] << 24) + \ | | 161| 0| ((uint64_t)((uint8_t *)(x))[1] << 32) + \ | | 162| 0| ((uint64_t)((uint8_t *)(x))[0] << 40)) ) ------------------ 430| 0| tsk_getu16(fs->endian, a_idxe->idxlen), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 431| 0| tsk_getu16(fs->endian, a_idxe->strlen)); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 432| | 433| | /* perform some sanity checks on index buffer head 434| | * and advance by 4-bytes if invalid 435| | */ 436| 0| if ((tsk_getu48(fs->endian, a_idxe->file_ref) > fs->last_inum) || ------------------ | | 146| 0|#define tsk_getu48(endian, x) \ | | 147| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (147:13): [True: 0, False: 0] | | ------------------ | | 148| 0| ((uint64_t) \ | | 149| 0| ((uint64_t)((uint8_t *)(x))[0] << 0)+ \ | | 150| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 151| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 152| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 153| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 154| 0| ((uint64_t)((uint8_t *)(x))[5] << 40)) \ | | 155| 0| : \ | | 156| 0| ((uint64_t) \ | | 157| 0| ((uint64_t)((uint8_t *)(x))[5] << 0)+ \ | | 158| 0| ((uint64_t)((uint8_t *)(x))[4] << 8) + \ | | 159| 0| ((uint64_t)((uint8_t *)(x))[3] << 16) + \ | | 160| 0| ((uint64_t)((uint8_t *)(x))[2] << 24) + \ | | 161| 0| ((uint64_t)((uint8_t *)(x))[1] << 32) + \ | | 162| 0| ((uint64_t)((uint8_t *)(x))[0] << 40)) ) ------------------ | Branch (436:13): [True: 0, False: 0] ------------------ 437| 0| (tsk_getu48(fs->endian, a_idxe->file_ref) < fs->first_inum) || ------------------ | | 146| 0|#define tsk_getu48(endian, x) \ | | 147| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (147:13): [True: 0, False: 0] | | ------------------ | | 148| 0| ((uint64_t) \ | | 149| 0| ((uint64_t)((uint8_t *)(x))[0] << 0)+ \ | | 150| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 151| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 152| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 153| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 154| 0| ((uint64_t)((uint8_t *)(x))[5] << 40)) \ | | 155| 0| : \ | | 156| 0| ((uint64_t) \ | | 157| 0| ((uint64_t)((uint8_t *)(x))[5] << 0)+ \ | | 158| 0| ((uint64_t)((uint8_t *)(x))[4] << 8) + \ | | 159| 0| ((uint64_t)((uint8_t *)(x))[3] << 16) + \ | | 160| 0| ((uint64_t)((uint8_t *)(x))[2] << 24) + \ | | 161| 0| ((uint64_t)((uint8_t *)(x))[1] << 32) + \ | | 162| 0| ((uint64_t)((uint8_t *)(x))[0] << 40)) ) ------------------ | Branch (437:13): [True: 0, False: 0] ------------------ 438| 0| (tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (438:13): [True: 0, False: 0] ------------------ 439| 0| a_idxe->idxlen) <= tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 440| 0| a_idxe->strlen)) 441| 0| || (tsk_getu16(fs->endian, a_idxe->idxlen) % 4) ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (441:16): [True: 0, False: 0] ------------------ 442| 0| || (tsk_getu16(fs->endian, a_idxe->idxlen) > a_idxe_len)) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (442:16): [True: 0, False: 0] ------------------ 443| 0| a_idxe = (ntfs_idxentry *) ((uintptr_t) a_idxe + 4); 444| 0| continue; 445| 0| } 446| | 447| |#if 0 448| | // @@@ BC: This hid a lot of entries in test images. They were 449| | // only partial images, but they were not junk and the idea was 450| | // that this check would strip out chunk. Commented it out and 451| | // keeping it here as a reminder in case I think about doing it 452| | // again. 453| | 454| | // verify name length would fit in stream 455| | if (fname->nlen > tsk_getu16(fs->endian, a_idxe->strlen)) { 456| | a_idxe = (ntfs_idxentry *) ((uintptr_t) a_idxe + 4); 457| | if (tsk_verbose) 458| | tsk_fprintf(stderr, 459| | "ntfs_proc_idxentry: Skipping because name is longer than stream\n"); 460| | continue; 461| | } 462| |#endif 463| | 464| | // verify it has the correct parent address 465| 0| if (tsk_getu48(fs->endian, fname->par_ref) != a_fs_dir->addr) { ------------------ | | 146| 0|#define tsk_getu48(endian, x) \ | | 147| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (147:13): [True: 0, False: 0] | | ------------------ | | 148| 0| ((uint64_t) \ | | 149| 0| ((uint64_t)((uint8_t *)(x))[0] << 0)+ \ | | 150| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 151| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 152| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 153| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 154| 0| ((uint64_t)((uint8_t *)(x))[5] << 40)) \ | | 155| 0| : \ | | 156| 0| ((uint64_t) \ | | 157| 0| ((uint64_t)((uint8_t *)(x))[5] << 0)+ \ | | 158| 0| ((uint64_t)((uint8_t *)(x))[4] << 8) + \ | | 159| 0| ((uint64_t)((uint8_t *)(x))[3] << 16) + \ | | 160| 0| ((uint64_t)((uint8_t *)(x))[2] << 24) + \ | | 161| 0| ((uint64_t)((uint8_t *)(x))[1] << 32) + \ | | 162| 0| ((uint64_t)((uint8_t *)(x))[0] << 40)) ) ------------------ | Branch (465:13): [True: 0, False: 0] ------------------ 466| 0| a_idxe = (ntfs_idxentry *) ((uintptr_t) a_idxe + 4); 467| 0| if (tsk_verbose) ------------------ | Branch (467:17): [True: 0, False: 0] ------------------ 468| 0| tsk_fprintf(stderr, 469| 0| "ntfs_proc_idxentry: Skipping because of wrong parent address\n"); 470| 0| continue; 471| 0| } 472| | 473| | 474| | /* do some sanity checks on the deleted entries 475| | */ 476| 0| if ((tsk_getu16(fs->endian, a_idxe->strlen) == 0) || ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (476:13): [True: 0, False: 0] ------------------ 477| 0| (((uintptr_t) a_idxe + tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (477:13): [True: 0, False: 0] ------------------ 478| 0| a_idxe->idxlen)) > endaddr_alloc)) { 479| | 480| | /* name space checks */ 481| 0| if ((fname->nspace != NTFS_FNAME_POSIX) && ------------------ | | 250| 0|#define NTFS_FNAME_POSIX 0 /* case sensitive and any but NULL and \ */ ------------------ | Branch (481:17): [True: 0, False: 0] ------------------ 482| 0| (fname->nspace != NTFS_FNAME_WIN32) && ------------------ | | 251| 0|#define NTFS_FNAME_WIN32 1 // insensitive and restricted ------------------ | Branch (482:17): [True: 0, False: 0] ------------------ 483| 0| (fname->nspace != NTFS_FNAME_DOS) && ------------------ | | 252| 0|#define NTFS_FNAME_DOS 2 // 8.3 format of 8-bit chars in uppercase ------------------ | Branch (483:17): [True: 0, False: 0] ------------------ 484| 0| (fname->nspace != NTFS_FNAME_WINDOS)) { ------------------ | | 253| 0|#define NTFS_FNAME_WINDOS 3 // name in WIN32 space that is already DOS ------------------ | Branch (484:17): [True: 0, False: 0] ------------------ 485| 0| a_idxe = (ntfs_idxentry *) ((uintptr_t) a_idxe + 4); 486| 0| if (tsk_verbose) ------------------ | Branch (486:21): [True: 0, False: 0] ------------------ 487| 0| tsk_fprintf(stderr, 488| 0| "ntfs_proc_idxentry: Skipping because of invalid name space\n"); 489| 0| continue; 490| 0| } 491| | 492| 0| if ((tsk_getu64(fs->endian, fname->alloc_fsize) < ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (492:17): [True: 0, False: 0] ------------------ 493| 0| tsk_getu64(fs->endian, fname->real_fsize)) ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 494| 0| || (fname->nlen == 0) ------------------ | Branch (494:20): [True: 0, False: 0] ------------------ 495| 0| || (*(uint8_t *) & fname->name == 0)) { ------------------ | Branch (495:20): [True: 0, False: 0] ------------------ 496| | 497| 0| a_idxe = (ntfs_idxentry *) ((uintptr_t) a_idxe + 4); 498| 0| if (tsk_verbose) ------------------ | Branch (498:21): [True: 0, False: 0] ------------------ 499| 0| tsk_fprintf(stderr, 500| 0| "ntfs_proc_idxentry: Skipping because of reported file sizes, name length, or NULL name\n"); 501| 0| continue; 502| 0| } 503| | 504| 0| if ((is_time(tsk_getu64(fs->endian, fname->crtime)) == 0) || ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (504:17): [True: 0, False: 0] ------------------ 505| 0| (is_time(tsk_getu64(fs->endian, fname->atime)) == 0) || ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (505:17): [True: 0, False: 0] ------------------ 506| 0| (is_time(tsk_getu64(fs->endian, fname->mtime)) == 0)) { ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (506:17): [True: 0, False: 0] ------------------ 507| | 508| 0| a_idxe = (ntfs_idxentry *) ((uintptr_t) a_idxe + 4); 509| 0| if (tsk_verbose) ------------------ | Branch (509:21): [True: 0, False: 0] ------------------ 510| 0| tsk_fprintf(stderr, 511| 0| "ntfs_proc_idxentry: Skipping because of invalid times\n"); 512| 0| continue; 513| 0| } 514| 0| } 515| | 516| | 517| | /* For all fname entries, there will exist a DOS style 8.3 518| | * entry. 519| | * If the original name is 8.3 compliant, it will be in 520| | * a WINDOS type. If it is not compliant, then it will 521| | * exist in a POSIX or WIN32 type and the 8.3 compliant 522| | * one will be in DOS. The DOS entry typically follows 523| | * the WIN32 or POSIX. 524| | * 525| | * Our approach is to stash away the non-compliant names 526| | * for one more entry to see if the next try is its 527| | * corresponding 8.3 entry. 528| | * 529| | * If the 8.3 entry is not for the previous entry, we 530| | * skip it on the theory that it corresponds to a previous 531| | * WIN32 or POSIX entry. Note that we could be missing some info from deleted files 532| | * if the windows version was deleted and the DOS wasn't... 533| | */ 534| | 535| 0| if (fname->nspace == NTFS_FNAME_DOS) { ------------------ | | 252| 0|#define NTFS_FNAME_DOS 2 // 8.3 format of 8-bit chars in uppercase ------------------ | Branch (535:13): [True: 0, False: 0] ------------------ 536| | // Was the previous entry not 8.3 compliant? 537| 0| if (fs_name_preventry) { ------------------ | Branch (537:17): [True: 0, False: 0] ------------------ 538| | // check its the same entry and if so, add short name 539| 0| if (fs_name_preventry->meta_addr == tsk_getu48(fs->endian, a_idxe->file_ref)) { ------------------ | | 146| 0|#define tsk_getu48(endian, x) \ | | 147| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (147:13): [True: 0, False: 0] | | ------------------ | | 148| 0| ((uint64_t) \ | | 149| 0| ((uint64_t)((uint8_t *)(x))[0] << 0)+ \ | | 150| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 151| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 152| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 153| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 154| 0| ((uint64_t)((uint8_t *)(x))[5] << 40)) \ | | 155| 0| : \ | | 156| 0| ((uint64_t) \ | | 157| 0| ((uint64_t)((uint8_t *)(x))[5] << 0)+ \ | | 158| 0| ((uint64_t)((uint8_t *)(x))[4] << 8) + \ | | 159| 0| ((uint64_t)((uint8_t *)(x))[3] << 16) + \ | | 160| 0| ((uint64_t)((uint8_t *)(x))[2] << 24) + \ | | 161| 0| ((uint64_t)((uint8_t *)(x))[1] << 32) + \ | | 162| 0| ((uint64_t)((uint8_t *)(x))[0] << 40)) ) ------------------ | Branch (539:21): [True: 0, False: 0] ------------------ 540| 0| ntfs_dent_copy_short_only(a_ntfs, a_idxe, fs_name_preventry); 541| 0| } 542| | 543| | // regardless, add preventry to dir and move on to next entry. 544| 0| if (tsk_fs_dir_add(a_fs_dir, fs_name_preventry)) { ------------------ | Branch (544:21): [True: 0, False: 0] ------------------ 545| 0| tsk_fs_name_free(fs_name); 546| 0| return TSK_ERR; 547| 0| } 548| 0| fs_name_preventry = NULL; 549| 0| } 550| | 551| 0| goto incr_entry; 552| 0| } 553| | // if we stashed the previous entry and the next wasn't a DOS entry, add it to the list 554| 0| else if (fs_name_preventry) { ------------------ | Branch (554:18): [True: 0, False: 0] ------------------ 555| 0| if (tsk_fs_dir_add(a_fs_dir, fs_name_preventry)) { ------------------ | Branch (555:17): [True: 0, False: 0] ------------------ 556| 0| tsk_fs_name_free(fs_name); 557| 0| return TSK_ERR; 558| 0| } 559| 0| fs_name_preventry = NULL; 560| 0| } 561| | 562| | /* Copy it into the generic form */ 563| 0| if (ntfs_dent_copy(a_ntfs, a_idxe, endaddr, fs_name)) { ------------------ | Branch (563:13): [True: 0, False: 0] ------------------ 564| 0| if (tsk_verbose) ------------------ | Branch (564:17): [True: 0, False: 0] ------------------ 565| 0| tsk_fprintf(stderr, 566| 0| "ntfs_proc_idxentry: Skipping because error copying dent_entry\n"); 567| 0| goto incr_entry; 568| 0| } 569| | 570| | /* 571| | * Check if this entry is deleted 572| | * 573| | * The final check is to see if the end of this entry is 574| | * within the space that the idxallocbuf claimed was valid OR 575| | * if the parent directory is deleted 576| | */ 577| 0| if ((a_is_del == 1) || ------------------ | Branch (577:13): [True: 0, False: 0] ------------------ 578| 0| (tsk_getu16(fs->endian, a_idxe->strlen) == 0) || ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (578:13): [True: 0, False: 0] ------------------ 579| 0| (((uintptr_t) a_idxe + tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (579:13): [True: 0, False: 0] ------------------ 580| 0| a_idxe->idxlen)) > endaddr_alloc)) { 581| 0| fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 582| 0| } 583| 0| else { 584| 0| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 585| 0| } 586| | 587| 0| if (tsk_verbose) ------------------ | Branch (587:13): [True: 0, False: 0] ------------------ 588| 0| tsk_fprintf(stderr, 589| 0| "ntfs_proc_idxentry: Entry Details of %s: Str Len: %" 590| 0| PRIu16 " Len to end after current: %" PRIu64 591| 0| " flags: %x\n", fs_name->name, tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 592| 0| a_idxe->strlen), 593| 0| (uint64_t) (endaddr_alloc - (uintptr_t) a_idxe - 594| 0| tsk_getu16(fs->endian, a_idxe->idxlen)), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 595| 0| fs_name->flags); 596| | 597| | // WINDOS entries will not have a short 8.3 version, so add them now. 598| | // otherwise, we stash the name to see if we get the 8.3 next. 599| 0| if (fname->nspace == NTFS_FNAME_WINDOS) { ------------------ | | 253| 0|#define NTFS_FNAME_WINDOS 3 // name in WIN32 space that is already DOS ------------------ | Branch (599:13): [True: 0, False: 0] ------------------ 600| 0| if (tsk_fs_dir_add(a_fs_dir, fs_name)) { ------------------ | Branch (600:17): [True: 0, False: 0] ------------------ 601| 0| tsk_fs_name_free(fs_name); 602| 0| return TSK_ERR; 603| 0| } 604| 0| fs_name_preventry = NULL; 605| 0| } 606| 0| else { 607| 0| fs_name_preventry = fs_name; 608| 0| } 609| | 610| 0| incr_entry: 611| | 612| | /* the theory here is that deleted entries have strlen == 0 and 613| | * have been found to have idxlen == 16 614| | * 615| | * if the strlen is 0, then guess how much the indexlen was 616| | * before it was deleted 617| | */ 618| | 619| | /* 16: size of idxentry before stream 620| | * 66: size of fname before name 621| | * 2*nlen: size of name (in unicode) 622| | */ 623| 0| if (tsk_getu16(fs->endian, a_idxe->strlen) == 0) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (623:13): [True: 0, False: 0] ------------------ 624| 0| a_idxe = 625| 0| (ntfs_idxentry 626| 0| *) ((((uintptr_t) a_idxe + 16 + 66 + 2 * fname->nlen + 627| 0| 3) / 4) * 4); 628| 0| } 629| 0| else { 630| 0| a_idxe = 631| 0| (ntfs_idxentry *) ((uintptr_t) a_idxe + 632| 0| tsk_getu16(fs->endian, a_idxe->idxlen)); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 633| 0| } 634| | 635| 0| } /* end of loop of index entries */ 636| | 637| | // final check in case we were looking for the short name, we never saw 638| 1| if (fs_name_preventry) { ------------------ | Branch (638:9): [True: 0, False: 1] ------------------ 639| 0| if (tsk_fs_dir_add(a_fs_dir, fs_name_preventry)) { ------------------ | Branch (639:13): [True: 0, False: 0] ------------------ 640| 0| tsk_fs_name_free(fs_name); 641| 0| return TSK_ERR; 642| 0| } 643| 0| fs_name_preventry = NULL; 644| 0| } 645| | 646| 1| tsk_fs_name_free(fs_name); 647| 1| return TSK_OK; 648| 1|} tsk_img_read: 60| 9|{ 61| 9|#define CACHE_AGE 1000 62| 9| ssize_t read_count = 0; 63| 9| int cache_index = 0; 64| 9| int cache_next = 0; // index to lowest age cache (to use next) 65| 9| size_t len2 = 0; 66| | 67| 9| if (a_img_info == NULL) { ------------------ | Branch (67:9): [True: 0, False: 9] ------------------ 68| 0| tsk_error_reset(); 69| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 70| 0| tsk_error_set_errstr("tsk_img_read: a_img_info: NULL"); 71| 0| return -1; 72| 0| } 73| | 74| | // Do not allow a_buf to be NULL. 75| 9| if (a_buf == NULL) { ------------------ | Branch (75:9): [True: 0, False: 9] ------------------ 76| 0| tsk_error_reset(); 77| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 78| 0| tsk_error_set_errstr("tsk_img_read: a_buf: NULL"); 79| 0| return -1; 80| 0| } 81| | 82| | // The function cannot handle negative offsets. 83| 9| if (a_off < 0) { ------------------ | Branch (83:9): [True: 0, False: 9] ------------------ 84| 0| tsk_error_reset(); 85| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 86| 0| tsk_error_set_errstr("tsk_img_read: a_off: %" PRIdOFF, a_off); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 87| 0| return -1; 88| 0| } 89| | 90| | // Protect a_off against overflowing when a_len is added since TSK_OFF_T 91| | // maps to an int64 we prefer it over size_t although likely checking 92| | // for ( a_len > SSIZE_MAX ) is better but the code does not seem to 93| | // use that approach. 94| | 95| 9| if ((TSK_OFF_T) a_len < 0) { ------------------ | Branch (95:9): [True: 0, False: 9] ------------------ 96| 0| tsk_error_reset(); 97| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 98| 0| tsk_error_set_errstr("tsk_img_read: a_len: %zd", a_len); 99| 0| return -1; 100| 0| } 101| | 102| | /* cache_lock is used for both the cache in IMG_INFO and 103| | * the shared variables in the img type specific INFO structs. 104| | * grab it now so that it is held before any reads. 105| | */ 106| 9| tsk_take_lock(&(a_img_info->cache_lock)); 107| | 108| | // if they ask for more than the cache length, skip the cache 109| 9| if ((a_len + (a_off % 512)) > TSK_IMG_INFO_CACHE_LEN) { ------------------ | | 85| 9|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ | Branch (109:9): [True: 0, False: 9] ------------------ 110| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 111| 0| tsk_release_lock(&(a_img_info->cache_lock)); 112| 0| return read_count; 113| 0| } 114| | 115| | // TODO: why not just return 0 here (and be POSIX compliant)? 116| | // and why not check earlier for this condition? 117| 9| if (a_off >= a_img_info->size) { ------------------ | Branch (117:9): [True: 0, False: 9] ------------------ 118| 0| tsk_release_lock(&(a_img_info->cache_lock)); 119| 0| tsk_error_reset(); 120| 0| tsk_error_set_errno(TSK_ERR_IMG_READ_OFF); ------------------ | | 319| 0|#define TSK_ERR_IMG_READ_OFF (TSK_ERR_IMG | 8) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 121| 0| tsk_error_set_errstr("tsk_img_read - %" PRIdOFF, a_off); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 122| 0| return -1; 123| 0| } 124| | 125| | /* See if the requested length is going to be too long. 126| | * we'll use this length when checking the cache. */ 127| 9| len2 = a_len; 128| | 129| | // Protect against INT64_MAX + INT64_MAX > value 130| 9| if (((TSK_OFF_T) len2 > a_img_info->size) ------------------ | Branch (130:9): [True: 0, False: 9] ------------------ 131| 9| || (a_off >= (a_img_info->size - (TSK_OFF_T)len2))) { ------------------ | Branch (131:12): [True: 0, False: 9] ------------------ 132| 0| len2 = (size_t) (a_img_info->size - a_off); 133| 0| } 134| | 135| | // check if it is in the cache 136| 9| for (cache_index = 0; 137| 297| cache_index < TSK_IMG_INFO_CACHE_NUM; cache_index++) { ------------------ | | 84| 297|#define TSK_IMG_INFO_CACHE_NUM 32 ------------------ | Branch (137:9): [True: 288, False: 9] ------------------ 138| | 139| | // Look into the in-use cache entries 140| 288| if (a_img_info->cache_len[cache_index] > 0) { ------------------ | Branch (140:13): [True: 66, False: 222] ------------------ 141| | 142| | // the read_count check makes sure we don't go back in after data was read 143| 66| if ((read_count == 0) ------------------ | Branch (143:17): [True: 10, False: 56] ------------------ 144| 66| && (a_img_info->cache_off[cache_index] <= a_off) ------------------ | Branch (144:20): [True: 8, False: 2] ------------------ 145| 66| && (a_img_info->cache_off[cache_index] + ------------------ | Branch (145:20): [True: 7, False: 1] ------------------ 146| 8| a_img_info->cache_len[cache_index] >= a_off + len2)) { 147| | 148| | /* 149| | if (tsk_verbose) 150| | fprintf(stderr, 151| | "tsk_img_read: Read found in cache %d\n", cache_index ); 152| | */ 153| | 154| | // We found it... 155| 7| memcpy(a_buf, 156| 7| &a_img_info->cache[cache_index][a_off - 157| 7| a_img_info->cache_off[cache_index]], len2); 158| 7| read_count = (ssize_t) len2; 159| | 160| | // reset its "age" since it was useful 161| 7| a_img_info->cache_age[cache_index] = CACHE_AGE; ------------------ | | 61| 7|#define CACHE_AGE 1000 ------------------ 162| | 163| | // we don't break out of the loop so that we update all ages 164| 7| } 165| 59| else { 166| | /* decrease its "age" since it was not useful. 167| | * We don't let used ones go below 1 so that they are not 168| | * confused with entries that have never been used. */ 169| 59| a_img_info->cache_age[cache_index]--; 170| | 171| | // see if this is the most eligible replacement 172| 59| if ((a_img_info->cache_len[cache_next] > 0) ------------------ | Branch (172:21): [True: 31, False: 28] ------------------ 173| 59| && (a_img_info->cache_age[cache_index] < ------------------ | Branch (173:24): [True: 1, False: 30] ------------------ 174| 31| a_img_info->cache_age[cache_next])) 175| 1| cache_next = cache_index; 176| 59| } 177| 66| } 178| 222| else { 179| 222| cache_next = cache_index; 180| 222| } 181| 288| } 182| | 183| | // if we didn't find it, then load it into the cache_next entry 184| 9| if (read_count == 0) { ------------------ | Branch (184:9): [True: 2, False: 7] ------------------ 185| 2| size_t read_size = 0; 186| | 187| | // round the offset down to a sector boundary 188| 2| a_img_info->cache_off[cache_next] = (a_off / 512) * 512; 189| | 190| | /* 191| | if (tsk_verbose) 192| | fprintf(stderr, 193| | "tsk_img_read: Loading data into cache %d (%" PRIdOFF 194| | ")\n", cache_next, a_img_info->cache_off[cache_next]); 195| | */ 196| | 197| | // Read a full cache block or the remaining data. 198| 2| read_size = TSK_IMG_INFO_CACHE_LEN; ------------------ | | 85| 2|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ 199| | 200| 2| if ((a_img_info->cache_off[cache_next] + (TSK_OFF_T)read_size) > ------------------ | Branch (200:13): [True: 0, False: 2] ------------------ 201| 2| a_img_info->size) { 202| 0| read_size = 203| 0| (size_t) (a_img_info->size - 204| 0| a_img_info->cache_off[cache_next]); 205| 0| } 206| | 207| 2| read_count = a_img_info->read(a_img_info, 208| 2| a_img_info->cache_off[cache_next], 209| 2| a_img_info->cache[cache_next], read_size); 210| | 211| | // if no error, then set the variables and copy the data 212| | // Although a read_count of -1 indicates an error, 213| | // since read_count is used in the calculation it may not be negative. 214| | // Also it does not make sense to copy data when the read_count is 0. 215| 2| if (read_count > 0) { ------------------ | Branch (215:13): [True: 2, False: 0] ------------------ 216| | 217| 2| TSK_OFF_T rel_off = 0; 218| 2| a_img_info->cache_age[cache_next] = CACHE_AGE; ------------------ | | 61| 2|#define CACHE_AGE 1000 ------------------ 219| 2| a_img_info->cache_len[cache_next] = read_count; 220| | 221| | // Determine the offset relative to the start of the cached data. 222| 2| rel_off = a_off - a_img_info->cache_off[cache_next]; 223| | 224| | // Make sure we were able to read sufficient data into the cache. 225| 2| if (rel_off > (TSK_OFF_T) read_count) { ------------------ | Branch (225:17): [True: 0, False: 2] ------------------ 226| 0| len2 = 0; 227| 0| } 228| | // Make sure not to copy more than is available in the cache. 229| 2| else if ((rel_off + (TSK_OFF_T) len2) > (TSK_OFF_T) read_count) { ------------------ | Branch (229:22): [True: 0, False: 2] ------------------ 230| 0| len2 = (size_t) (read_count - rel_off); 231| 0| } 232| | // Only copy data when we have something to copy. 233| 2| if (len2 > 0) { ------------------ | Branch (233:17): [True: 2, False: 0] ------------------ 234| 2| memcpy(a_buf, &(a_img_info->cache[cache_next][rel_off]), len2); 235| 2| } 236| 2| read_count = (ssize_t) len2; 237| 2| } 238| 0| else { 239| 0| a_img_info->cache_len[cache_next] = 0; 240| 0| a_img_info->cache_age[cache_next] = 0; 241| 0| a_img_info->cache_off[cache_next] = 0; 242| | 243| | // Something went wrong so let's try skipping the cache 244| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 245| 0| } 246| 2| } 247| | 248| 9| tsk_release_lock(&(a_img_info->cache_lock)); 249| 9| return read_count; 250| 9|} LLVMFuzzerTestOneInput: 25| 3|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 26| 3| TSK_IMG_INFO *img; 27| 3| TSK_FS_INFO *fs; 28| | 29| 3| img = mem_open(data, size); 30| 3| if (img == nullptr) ------------------ | Branch (30:7): [True: 0, False: 3] ------------------ 31| 0| return 0; 32| | 33| 3| fs = tsk_fs_open_img(img, 0, FSTYPE); 34| 3| if (fs != nullptr) { ------------------ | Branch (34:7): [True: 1, False: 2] ------------------ 35| 1| tsk_fs_fls(fs, TSK_FS_FLS_FULL, fs->root_inum, TSK_FS_DIR_WALK_FLAG_RECURSE, 36| 1| nullptr, 0); 37| | 38| 1| fs->close(fs); 39| 1| } 40| | 41| 3| img->close(img); 42| 3| return 0; 43| 3|}