File: vnode_ewf.cpp

package info (click to toggle)
afflib 3.5.12-2
  • links: PTS, VCS
  • area: main
  • in suites: squeeze
  • size: 4,168 kB
  • ctags: 4,723
  • sloc: cpp: 21,800; ansic: 14,696; sh: 9,697; makefile: 531; python: 95
file content (376 lines) | stat: -rw-r--r-- 10,227 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
/**
 ** AFF/libewf glue
 **
 ** (C) 2006 by Simson L. Garfinkel
 **
 **
 **/



#include "affconfig.h"
#include "afflib.h"
#include "afflib_i.h"

#ifdef USE_LIBEWF

#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "vnode_ewf.h"

#ifdef HAVE_CSTRING
#include <cstring>
#endif

/* We're gonna include libewf.h now, which causes problems, because libewf.h currently
 * includes an autoconf-generated affconfig.h file
 */

#undef PACKAGE
#undef PACKAGE_BUGREPORT
#undef PACKAGE_NAME
#undef PACKAGE_STRING
#undef PACKAGE_TARNAME
#undef PACKAGE_VERSION
#undef VERSION

#ifdef HAVE_LIBEWF_H
#include "libewf.h"
#else
#error EWF support requires libewf, but HAVE_LIBEWF_H is not defined
#endif



/****************************************************************
 *** Service routines
 ****************************************************************/

#define EWF_HANDLE(af) ((libewf_handle_t *)af->vnodeprivate)

/****************************************************************
 *** AFFLIB Glue Follows
 ****************************************************************/


/* Return 1 if a file is a ewf file... */
static int ewf_identify_file(const char *filename,int exists)
{
    return libewf_check_file_signature(filename)==1 ? 1 : 0;
}

static int ewf_open(AFFILE *af)
{

    if(strchr(af->fname,'.')==0) return -1; // need a '.' in the filename

    /* Find all of the EWF files to open*/
    char **files = (char **)malloc(sizeof(char *));
    int nfiles = 1;
    files[0] = strdup(af->fname);

    char fname[MAXPATHLEN+1];
    strlcpy(fname,af->fname,sizeof(fname));
    char *ext = strrchr(fname,'.')+1;
    if(ext-fname > MAXPATHLEN-4){
	warn("ewf_open: %s: filename too long",af->fname);
	return -1;
    }

    /* Now open .E02 through .E99 and then .AAA through .ZZZ if they exist... */
    for(int i=2;i<=99;i++){
	sprintf(ext+1,"%02d",i);
	if(access(fname,R_OK)!=0) break;
	files = (char **)realloc(files,(nfiles+1) * sizeof(char *));
	files[nfiles] = strdup(fname);
	nfiles++;
    }
    for(int i=4*26*26;i<=26*26*26;i++){
        sprintf(ext, "%c%c%c", i/26/26%26+'A', i/26%26+'A', i%26+'A');
        if(access(fname,R_OK)!=0) break;  // file can't be read                                             
	files = (char **)realloc(files,(nfiles+1) * sizeof(char *));
	files[nfiles] = strdup(fname);
	nfiles++;
    }
    

    LIBEWF_HANDLE *handle = libewf_open( files, nfiles, LIBEWF_OPEN_READ );

    if(!handle){
	warn("Unable to open EWF image file");
	for(int i=0;i<nfiles;i++) free(files[i]);
	free(files);
	return -1;
    }
#if defined( HAVE_LIBEWF_GET_MEDIA_SIZE_ARGUMENT_VALUE ) || (LIBEWF_VERSION>=20080501)
    int r = libewf_get_media_size(handle,&af->image_size);
    if(r < 0){
	warn("EFW error: image size==0?");
	for(int i=0;i<nfiles;i++) free(files[i]);
	free(files);
	return -1;
    }
#else
     af->image_size = libewf_get_media_size(handle);
 
     if( af->image_size == 0 ){
 	warn("EFW error: image size==0?");
 	for(int i=0;i<nfiles;i++) free(files[i]);
 	free(files);
 	return -1;
     }
#endif

    af->vnodeprivate = (void *)handle;
#if defined( HAVE_LIBEWF_GET_CHUNK_SIZE_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
    libewf_get_chunk_size(handle,(size32_t *)&af->image_pagesize);
#else
     af->image_pagesize = libewf_get_chunk_size(handle);
#endif
    for(int i=0;i<nfiles;i++) free(files[i]);
    free(files);
    return 0;
}


static int ewf_vstat(AFFILE *af,struct af_vnode_info *vni)
{
    LIBEWF_HANDLE *handle = EWF_HANDLE(af);
#if defined( HAVE_LIBEWF_GET_MEDIA_SIZE_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
    libewf_get_media_size(handle,(size64_t *)&vni->imagesize);
#else
    vni->imagesize = (int64_t) libewf_get_media_size(handle);
#endif

    vni->pagesize = 0;
#if defined( HAVE_LIBEWF_GET_CHUNK_SIZE_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
    libewf_get_chunk_size(handle,(size32_t *)&vni->pagesize);
#else
    vni->pagesize = libewf_get_chunk_size(handle);
#endif
    vni->supports_metadata = 1;
    vni->changable_pagesize = 0;
    vni->changable_sectorsize = 0;
    vni->supports_compression = 1;
    vni->has_pages = 1;			// debatable
    return 0;
}

static int ewf_read(AFFILE *af, unsigned char *buf, uint64_t pos,size_t count)
{
    LIBEWF_HANDLE *handle = EWF_HANDLE(af);
    return libewf_read_random(handle,buf,(uint64_t)count,pos);
}

static int ewf_write(AFFILE *af, unsigned char *buf, uint64_t pos,size_t count)
{
    LIBEWF_HANDLE *handle = EWF_HANDLE(af);
    return libewf_write_random(handle,buf,(uint64_t)count,pos);
}

static int ewf_close(AFFILE *af)
{
    LIBEWF_HANDLE *handle = EWF_HANDLE(af);
    if(libewf_close(handle)<0) return -1;
    return 0;
}


static int ewf_rewind_seg(AFFILE *af)
{
    af->cur_page = -1;			// starts at the metadata
    return 0;
}


/* return the length of a string up to a max */
static int strlenp(const unsigned char *data,int max)
{
    for(int i=0;i<max;i++){
	if(data[i]==0) return i;
    }
    return max;
}

static uint32_t ewf_bytes_per_sector(LIBEWF_HANDLE *handle)
{
    uint32_t bps = 0;
#if defined( HAVE_LIBEWF_GET_BYTES_PER_SECTOR_ARGUMENT_VALUE ) || LIBEWF_VERSION>=20080501
    libewf_get_bytes_per_sector(handle,&bps);
#else
    bps=libewf_get_bytes_per_sector(handle);
#endif
    return bps;
}

static int ewf_get_seg(AFFILE *af,const char *name, unsigned long *arg,
		       unsigned char *data,size_t *datalen)
{
    LIBEWF_HANDLE *handle = EWF_HANDLE(af);

    /* Is the user asking for a page? */
    int64_t segnum = af_segname_page_number(name);
    if(segnum>=0){
	/* Get the segment number */
	if(data==0){
	    /* Need to make sure that the segment exists */
	    if(segnum*af->image_pagesize+af->image_pagesize > af->image_size ) return -1; // this segment does not exist
	    if(datalen) *datalen = af->image_pagesize;	// just return the chunk size
	    return 0;
	}
	size_t r = libewf_read_random(handle,data,*datalen,segnum * af->image_pagesize);
	return r>0 ? 0 : -1;				// should probably put in some error checking
    }

    /* See if it is a page name we understand */
    if(strcmp(name,AF_PAGESIZE)==0){
	if(arg) *arg = af->image_pagesize;
	return 0;
    }
    if(strcmp(name,AF_IMAGESIZE)==0){
	if(arg) *arg = 0;
	if(datalen==0) return 0;
        if(*datalen==0){
	    *datalen = 8;  // the structure is 8 bytes long 
	    return 0;
	}
	if(*datalen<8) return -2;
	
	struct aff_quad  q;
	q.low  = htonl((unsigned long)(af->image_size & 0xffffffff));
	q.high = htonl((unsigned long)(af->image_size >> 32));
	memcpy(data,&q,8);
	return 0;
    }
    if(strcmp(name,AF_SECTORSIZE)==0){
	if(arg) *arg=(unsigned long)ewf_bytes_per_sector(handle);
	if(datalen) *datalen = 0;
	return 0;
    }
    if(strcmp(name,AF_DEVICE_SECTORS)==0){
	/* Is this in flag or a quad word? */
	uint32_t bps = ewf_bytes_per_sector(handle);
	if(arg && bps>0) *arg = af->image_size / bps;
	if(datalen) *datalen = 0;
	return 0;
    }


    /* They are asking for a metdata segment. If we have wide character type
     * compiled in for libewf, just ignore it, because afflib doesn't do wide characters
     * at the moment...
     */

#if !defined(LIBEWF_WIDE_CHARACTER_TYPE) && defined(LIBEWF_VERSION) && (LIBEWF_VERSION >= 20080322)
    /* Can't guarentee character type in older versions of libewf */
    if(strcmp(name,AF_CASE_NUM)==0){
	if(data && datalen){
	    libewf_get_header_value_case_number(handle,(char *)data,*datalen); 
	    *datalen = strlenp(data,*datalen);
	    if(arg) *arg = 0;
	}
	return 0;
    }
    if(strcmp(name,AF_IMAGE_GID)==0){
	if(data && datalen){
	    libewf_get_guid(handle,data,*datalen);
	    if(arg) *arg = 0;
	}
	return 0;
    }
    if(strcmp(name,AF_ACQUISITION_NOTES)==0){
	if(data && datalen){
	    libewf_get_header_value_notes(handle,(char *)data,*datalen);
	    *datalen = strlenp(data,*datalen);
	}
	if(data==0 && datalen){
	    /* Caller wants to learn size of the notes */
	    unsigned char tmp[128];
	    memset(tmp,0,sizeof(tmp));
	    *datalen = sizeof(tmp);
	    libewf_get_header_value_notes(handle,(char *)tmp,*datalen);
	    *datalen = strlenp(tmp,*datalen);
	}
	if(arg) *arg = 0;
	return 0;
    }
#endif
    return -1;			// don't know this header
}

static const char *emap[] = {
    AF_PAGESIZE,
    AF_IMAGESIZE,
    AF_SECTORSIZE,
    AF_DEVICE_SECTORS,
    AF_CASE_NUM,
    AF_IMAGE_GID,
    AF_ACQUISITION_NOTES,
    0
};


static int ewf_get_next_seg(AFFILE *af,char *segname,size_t segname_len,unsigned long *arg,
			unsigned char *data,size_t *datalen)
{
    /* Figure out what the next segment would be, then get it */
    /* Metadata first */
    if(af->cur_page<0){
	/* Find out how many mapped segments there are */
	int mapped=0;
	for(mapped=0;emap[mapped];mapped++){
	}
	if(-af->cur_page >= mapped ){
	    af->cur_page = 0;
	    goto get_next_data_seg;
	}
	int which = 0 - af->cur_page;	// which one to get
	af->cur_page--;			// go to the next one
	if(segname_len < strlen(emap[which])) return -2; // not enough room for segname
	strlcpy(segname,emap[which],segname_len);	// give caller the name of the mapped segment.
	return ewf_get_seg(af,segname,arg,data,datalen);
    }

 get_next_data_seg:
    if(af->cur_page * af->image_pagesize >= af->image_size) return -1; // end of list
    /* Make the segment name */
    char pagename[AF_MAX_NAME_LEN];		//
    memset(pagename,0,sizeof(pagename));
    snprintf(pagename,sizeof(pagename),AF_PAGE,af->cur_page++);
    
    int r = 0;
    /* Get the segment, if it is wanted */
    if(data) r = ewf_get_seg(af,pagename,arg,data,datalen);
    
    /* If r==0 and there is room for copying in the segment name, return it */
    if(r==0){
	if(strlen(pagename)+1 < segname_len){
	    strlcpy(segname,pagename,segname_len);
	    return 0;
	}
	/* segname wasn't big enough */
	return -2;
    }
    return r;			// some other error
}

struct af_vnode vnode_ewf = {
    AF_IDENTIFY_EWF,
    AF_VNODE_TYPE_PRIMITIVE|AF_VNODE_NO_SIGNING|AF_VNODE_NO_SEALING,
    "LIBEWF",
    ewf_identify_file,
    ewf_open,
    ewf_close,
    ewf_vstat,
    ewf_get_seg,			// get seg
    ewf_get_next_seg,			// get_next_seg
    ewf_rewind_seg,			// rewind_seg
    0,					// update_seg
    0,					// del_seg
    ewf_read,				// read
    ewf_write				// write
};

#endif