1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376
|
/**
** AFF/libewf glue
**
** (C) 2006 by Simson L. Garfinkel
**
**
**/
#include "affconfig.h"
#include "afflib.h"
#include "afflib_i.h"
#ifdef USE_LIBEWF
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "vnode_ewf.h"
#ifdef HAVE_CSTRING
#include <cstring>
#endif
/* We're gonna include libewf.h now, which causes problems, because libewf.h currently
* includes an autoconf-generated affconfig.h file
*/
#undef PACKAGE
#undef PACKAGE_BUGREPORT
#undef PACKAGE_NAME
#undef PACKAGE_STRING
#undef PACKAGE_TARNAME
#undef PACKAGE_VERSION
#undef VERSION
#ifdef HAVE_LIBEWF_H
#include "libewf.h"
#else
#error EWF support requires libewf, but HAVE_LIBEWF_H is not defined
#endif
/****************************************************************
*** Service routines
****************************************************************/
#define EWF_HANDLE(af) ((libewf_handle_t *)af->vnodeprivate)
/****************************************************************
*** AFFLIB Glue Follows
****************************************************************/
/* Return 1 if a file is a ewf file... */
static int ewf_identify_file(const char *filename,int exists)
{
return libewf_check_file_signature(filename)==1 ? 1 : 0;
}
static int ewf_open(AFFILE *af)
{
if(strchr(af->fname,'.')==0) return -1; // need a '.' in the filename
/* Find all of the EWF files to open*/
char **files = (char **)malloc(sizeof(char *));
int nfiles = 1;
files[0] = strdup(af->fname);
char fname[MAXPATHLEN+1];
strlcpy(fname,af->fname,sizeof(fname));
char *ext = strrchr(fname,'.')+1;
if(ext-fname > MAXPATHLEN-4){
warn("ewf_open: %s: filename too long",af->fname);
return -1;
}
/* Now open .E02 through .E99 and then .AAA through .ZZZ if they exist... */
for(int i=2;i<=99;i++){
sprintf(ext+1,"%02d",i);
if(access(fname,R_OK)!=0) break;
files = (char **)realloc(files,(nfiles+1) * sizeof(char *));
files[nfiles] = strdup(fname);
nfiles++;
}
for(int i=4*26*26;i<=26*26*26;i++){
sprintf(ext, "%c%c%c", i/26/26%26+'A', i/26%26+'A', i%26+'A');
if(access(fname,R_OK)!=0) break; // file can't be read
files = (char **)realloc(files,(nfiles+1) * sizeof(char *));
files[nfiles] = strdup(fname);
nfiles++;
}
LIBEWF_HANDLE *handle = libewf_open( files, nfiles, LIBEWF_OPEN_READ );
if(!handle){
warn("Unable to open EWF image file");
for(int i=0;i<nfiles;i++) free(files[i]);
free(files);
return -1;
}
#if defined( HAVE_LIBEWF_GET_MEDIA_SIZE_ARGUMENT_VALUE ) || (LIBEWF_VERSION>=20080501)
int r = libewf_get_media_size(handle,&af->image_size);
if(r < 0){
warn("EFW error: image size==0?");
for(int i=0;i<nfiles;i++) free(files[i]);
free(files);
return -1;
}
#else
af->image_size = libewf_get_media_size(handle);
if( af->image_size == 0 ){
warn("EFW error: image size==0?");
for(int i=0;i<nfiles;i++) free(files[i]);
free(files);
return -1;
}
#endif
af->vnodeprivate = (void *)handle;
#if defined( HAVE_LIBEWF_GET_CHUNK_SIZE_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
libewf_get_chunk_size(handle,(size32_t *)&af->image_pagesize);
#else
af->image_pagesize = libewf_get_chunk_size(handle);
#endif
for(int i=0;i<nfiles;i++) free(files[i]);
free(files);
return 0;
}
static int ewf_vstat(AFFILE *af,struct af_vnode_info *vni)
{
LIBEWF_HANDLE *handle = EWF_HANDLE(af);
#if defined( HAVE_LIBEWF_GET_MEDIA_SIZE_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
libewf_get_media_size(handle,(size64_t *)&vni->imagesize);
#else
vni->imagesize = (int64_t) libewf_get_media_size(handle);
#endif
vni->pagesize = 0;
#if defined( HAVE_LIBEWF_GET_CHUNK_SIZE_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
libewf_get_chunk_size(handle,(size32_t *)&vni->pagesize);
#else
vni->pagesize = libewf_get_chunk_size(handle);
#endif
vni->supports_metadata = 1;
vni->changable_pagesize = 0;
vni->changable_sectorsize = 0;
vni->supports_compression = 1;
vni->has_pages = 1; // debatable
return 0;
}
static int ewf_read(AFFILE *af, unsigned char *buf, uint64_t pos,size_t count)
{
LIBEWF_HANDLE *handle = EWF_HANDLE(af);
return libewf_read_random(handle,buf,(uint64_t)count,pos);
}
static int ewf_write(AFFILE *af, unsigned char *buf, uint64_t pos,size_t count)
{
LIBEWF_HANDLE *handle = EWF_HANDLE(af);
return libewf_write_random(handle,buf,(uint64_t)count,pos);
}
static int ewf_close(AFFILE *af)
{
LIBEWF_HANDLE *handle = EWF_HANDLE(af);
if(libewf_close(handle)<0) return -1;
return 0;
}
static int ewf_rewind_seg(AFFILE *af)
{
af->cur_page = -1; // starts at the metadata
return 0;
}
/* return the length of a string up to a max */
static int strlenp(const unsigned char *data,int max)
{
for(int i=0;i<max;i++){
if(data[i]==0) return i;
}
return max;
}
static uint32_t ewf_bytes_per_sector(LIBEWF_HANDLE *handle)
{
uint32_t bps = 0;
#if defined( HAVE_LIBEWF_GET_BYTES_PER_SECTOR_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
libewf_get_bytes_per_sector(handle,&bps);
#else
bps=libewf_get_bytes_per_sector(handle);
#endif
return bps;
}
static int ewf_get_seg(AFFILE *af,const char *name, unsigned long *arg,
unsigned char *data,size_t *datalen)
{
LIBEWF_HANDLE *handle = EWF_HANDLE(af);
/* Is the user asking for a page? */
int64_t segnum = af_segname_page_number(name);
if(segnum>=0){
/* Get the segment number */
if(data==0){
/* Need to make sure that the segment exists */
if(segnum*af->image_pagesize+af->image_pagesize > af->image_size ) return -1; // this segment does not exist
if(datalen) *datalen = af->image_pagesize; // just return the chunk size
return 0;
}
size_t r = libewf_read_random(handle,data,*datalen,segnum * af->image_pagesize);
return r>0 ? 0 : -1; // should probably put in some error checking
}
/* See if it is a page name we understand */
if(strcmp(name,AF_PAGESIZE)==0){
if(arg) *arg = af->image_pagesize;
return 0;
}
if(strcmp(name,AF_IMAGESIZE)==0){
if(arg) *arg = 0;
if(datalen==0) return 0;
if(*datalen==0){
*datalen = 8; // the structure is 8 bytes long
return 0;
}
if(*datalen<8) return -2;
struct aff_quad q;
q.low = htonl((unsigned long)(af->image_size & 0xffffffff));
q.high = htonl((unsigned long)(af->image_size >> 32));
memcpy(data,&q,8);
return 0;
}
if(strcmp(name,AF_SECTORSIZE)==0){
if(arg) *arg=(unsigned long)ewf_bytes_per_sector(handle);
if(datalen) *datalen = 0;
return 0;
}
if(strcmp(name,AF_DEVICE_SECTORS)==0){
/* Is this in flag or a quad word? */
uint32_t bps = ewf_bytes_per_sector(handle);
if(arg && bps>0) *arg = af->image_size / bps;
if(datalen) *datalen = 0;
return 0;
}
/* They are asking for a metdata segment. If we have wide character type
* compiled in for libewf, just ignore it, because afflib doesn't do wide characters
* at the moment...
*/
#if !defined(LIBEWF_WIDE_CHARACTER_TYPE) && defined(LIBEWF_VERSION) && (LIBEWF_VERSION >= 20080322)
/* Can't guarentee character type in older versions of libewf */
if(strcmp(name,AF_CASE_NUM)==0){
if(data && datalen){
libewf_get_header_value_case_number(handle,(char *)data,*datalen);
*datalen = strlenp(data,*datalen);
if(arg) *arg = 0;
}
return 0;
}
if(strcmp(name,AF_IMAGE_GID)==0){
if(data && datalen){
libewf_get_guid(handle,data,*datalen);
if(arg) *arg = 0;
}
return 0;
}
if(strcmp(name,AF_ACQUISITION_NOTES)==0){
if(data && datalen){
libewf_get_header_value_notes(handle,(char *)data,*datalen);
*datalen = strlenp(data,*datalen);
}
if(data==0 && datalen){
/* Caller wants to learn size of the notes */
unsigned char tmp[128];
memset(tmp,0,sizeof(tmp));
*datalen = sizeof(tmp);
libewf_get_header_value_notes(handle,(char *)tmp,*datalen);
*datalen = strlenp(tmp,*datalen);
}
if(arg) *arg = 0;
return 0;
}
#endif
return -1; // don't know this header
}
static const char *emap[] = {
AF_PAGESIZE,
AF_IMAGESIZE,
AF_SECTORSIZE,
AF_DEVICE_SECTORS,
AF_CASE_NUM,
AF_IMAGE_GID,
AF_ACQUISITION_NOTES,
0
};
static int ewf_get_next_seg(AFFILE *af,char *segname,size_t segname_len,unsigned long *arg,
unsigned char *data,size_t *datalen)
{
/* Figure out what the next segment would be, then get it */
/* Metadata first */
if(af->cur_page<0){
/* Find out how many mapped segments there are */
int mapped=0;
for(mapped=0;emap[mapped];mapped++){
}
if(-af->cur_page >= mapped ){
af->cur_page = 0;
goto get_next_data_seg;
}
int which = 0 - af->cur_page; // which one to get
af->cur_page--; // go to the next one
if(segname_len < strlen(emap[which])) return -2; // not enough room for segname
strlcpy(segname,emap[which],segname_len); // give caller the name of the mapped segment.
return ewf_get_seg(af,segname,arg,data,datalen);
}
get_next_data_seg:
if(af->cur_page * af->image_pagesize >= af->image_size) return -1; // end of list
/* Make the segment name */
char pagename[AF_MAX_NAME_LEN]; //
memset(pagename,0,sizeof(pagename));
snprintf(pagename,sizeof(pagename),AF_PAGE,af->cur_page++);
int r = 0;
/* Get the segment, if it is wanted */
if(data) r = ewf_get_seg(af,pagename,arg,data,datalen);
/* If r==0 and there is room for copying in the segment name, return it */
if(r==0){
if(strlen(pagename)+1 < segname_len){
strlcpy(segname,pagename,segname_len);
return 0;
}
/* segname wasn't big enough */
return -2;
}
return r; // some other error
}
struct af_vnode vnode_ewf = {
AF_IDENTIFY_EWF,
AF_VNODE_TYPE_PRIMITIVE|AF_VNODE_NO_SIGNING|AF_VNODE_NO_SEALING,
"LIBEWF",
ewf_identify_file,
ewf_open,
ewf_close,
ewf_vstat,
ewf_get_seg, // get seg
ewf_get_next_seg, // get_next_seg
ewf_rewind_seg, // rewind_seg
0, // update_seg
0, // del_seg
ewf_read, // read
ewf_write // write
};
#endif
|