summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/Makefile.am6
-rw-r--r--src/Makefile.in22
-rw-r--r--src/block.c15
-rw-r--r--src/block.h1
-rw-r--r--src/file_type.c1507
-rw-r--r--src/inode.c107
-rw-r--r--src/inode.h3
-rw-r--r--src/journal.c10
-rw-r--r--src/magic_block_scan.c632
-rw-r--r--src/util.c112
-rw-r--r--src/util.h46
11 files changed, 2388 insertions, 73 deletions
diff --git a/src/Makefile.am b/src/Makefile.am
index 60cd839..b0bbf5a 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,7 +1,7 @@
sbin_PROGRAMS = ext4magic
-ext4magic_SOURCES = block.c dir_list.c ext4magic.c hard_link_stack.c \
- imap_search.c inode.c journal.c lookup_local.c magic_block_scan.c recover.c \
- ring_buf.c util.c
+ext4magic_SOURCES = block.c dir_list.c ext4magic.c file_type.c \
+ hard_link_stack.c imap_search.c inode.c journal.c lookup_local.c magic_block_scan.c \
+ recover.c ring_buf.c util.c
# set the include path found by configure
INCLUDES= $(all_includes)
diff --git a/src/Makefile.in b/src/Makefile.in
index 082720a..3b4622c 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -51,6 +51,7 @@ am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)"
PROGRAMS = $(sbin_PROGRAMS)
am_ext4magic_OBJECTS = ext4magic-block.$(OBJEXT) \
ext4magic-dir_list.$(OBJEXT) ext4magic-ext4magic.$(OBJEXT) \
+ ext4magic-file_type.$(OBJEXT) \
ext4magic-hard_link_stack.$(OBJEXT) \
ext4magic-imap_search.$(OBJEXT) ext4magic-inode.$(OBJEXT) \
ext4magic-journal.$(OBJEXT) ext4magic-lookup_local.$(OBJEXT) \
@@ -215,9 +216,9 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
-ext4magic_SOURCES = block.c dir_list.c ext4magic.c hard_link_stack.c \
- imap_search.c inode.c journal.c lookup_local.c magic_block_scan.c recover.c \
- ring_buf.c util.c
+ext4magic_SOURCES = block.c dir_list.c ext4magic.c file_type.c \
+ hard_link_stack.c imap_search.c inode.c journal.c lookup_local.c magic_block_scan.c \
+ recover.c ring_buf.c util.c
# set the include path found by configure
@@ -321,6 +322,7 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-block.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-dir_list.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-ext4magic.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-file_type.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-hard_link_stack.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-imap_search.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-inode.Po@am__quote@
@@ -394,6 +396,20 @@ ext4magic-ext4magic.obj: ext4magic.c
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -c -o ext4magic-ext4magic.obj `if test -f 'ext4magic.c'; then $(CYGPATH_W) 'ext4magic.c'; else $(CYGPATH_W) '$(srcdir)/ext4magic.c'; fi`
+ext4magic-file_type.o: file_type.c
+@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -MT ext4magic-file_type.o -MD -MP -MF $(DEPDIR)/ext4magic-file_type.Tpo -c -o ext4magic-file_type.o `test -f 'file_type.c' || echo '$(srcdir)/'`file_type.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ext4magic-file_type.Tpo $(DEPDIR)/ext4magic-file_type.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='file_type.c' object='ext4magic-file_type.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -c -o ext4magic-file_type.o `test -f 'file_type.c' || echo '$(srcdir)/'`file_type.c
+
+ext4magic-file_type.obj: file_type.c
+@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -MT ext4magic-file_type.obj -MD -MP -MF $(DEPDIR)/ext4magic-file_type.Tpo -c -o ext4magic-file_type.obj `if test -f 'file_type.c'; then $(CYGPATH_W) 'file_type.c'; else $(CYGPATH_W) '$(srcdir)/file_type.c'; fi`
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ext4magic-file_type.Tpo $(DEPDIR)/ext4magic-file_type.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='file_type.c' object='ext4magic-file_type.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -c -o ext4magic-file_type.obj `if test -f 'file_type.c'; then $(CYGPATH_W) 'file_type.c'; else $(CYGPATH_W) '$(srcdir)/file_type.c'; fi`
+
ext4magic-hard_link_stack.o: hard_link_stack.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -MT ext4magic-hard_link_stack.o -MD -MP -MF $(DEPDIR)/ext4magic-hard_link_stack.Tpo -c -o ext4magic-hard_link_stack.o `test -f 'hard_link_stack.c' || echo '$(srcdir)/'`hard_link_stack.c
@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ext4magic-hard_link_stack.Tpo $(DEPDIR)/ext4magic-hard_link_stack.Po
diff --git a/src/block.c b/src/block.c
index b80c1d2..b1db943 100644
--- a/src/block.c
+++ b/src/block.c
@@ -31,6 +31,7 @@
#include "ext2fsP.h"
#include "block.h"
#include "journal.h"
+#include "util.h"
extern ext2fs_block_bitmap bmap ;
@@ -693,16 +694,4 @@ errout:
}
//___________________________________________________________________________________________________
-#include "magic.h"
-//FIXME in work
-int magic_check_block(char* buf,magic_t cookie, __u32 size, blk_t blk){
- char msg_buf[200];
- int count = size;
-
- strncpy(msg_buf,magic_buffer(cookie,buf,size),199);
- while (*(buf+count) == 0) count-- ;
- printf("Scan Result : %s %d\n", msg_buf , count+1) ;
-
- blockhex(stdout,buf,0,(count < (size -5)) ? count + 5 : size );
- return count+1;
-} \ No newline at end of file
+
diff --git a/src/block.h b/src/block.h
index 1e89608..9145664 100644
--- a/src/block.h
+++ b/src/block.h
@@ -6,7 +6,6 @@
-
errcode_t local_block_iterate3(ext2_filsys fs,
struct ext2_inode inode,
int flags,
diff --git a/src/file_type.c b/src/file_type.c
new file mode 100644
index 0000000..ca823e1
--- /dev/null
+++ b/src/file_type.c
@@ -0,0 +1,1507 @@
+/***************************************************************************
+ * Copyright (C) 2010 by Roberto Maar *
+ * robi@users.berlios.de *
+ * *
+ * This program is free software; you can redistribute it and/or modify *
+ * it under the terms of the GNU General Public License as published by *
+ * the Free Software Foundation; either version 2 of the License, or *
+ * (at your option) any later version. *
+ * *
+ * This program is distributed in the hope that it will be useful, *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
+ * GNU General Public License for more details. *
+ * *
+ * You should have received a copy of the GNU General Public License *
+ * along with this program; if not, write to the *
+ * Free Software Foundation, Inc., *
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
+ * *
+ * C Implementation: file_type *
+ ***************************************************************************/
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <string.h>
+
+#include "util.h"
+#include "inode.h"
+
+#ifdef WORDS_BIGENDIAN
+#define ext4magic_be64_to_cpu(x) ((__u64)(x))
+#else
+#define ext4magic_be64_to_cpu(x) ext2fs_swab64((x))
+#endif
+
+extern ext2_filsys current_fs ;
+
+
+int ident_file(struct found_data_t *new, __u32 *scan, char *magic_buf, char *buf){
+
+//Please do not modify the following lines.
+//they are used for indices to the filestypes
+ char typestr[] ="application/ audio/ image/ message/ model/ text/ video/ ";
+ char imagestr[] ="gif jp2 jpeg png svg+xml tiff vnd.adobe.photoshop vnd.djvu x-coreldraw x-cpi x-ico x-ms-bmp x-niff x-portable-bitmap x-portable-greymap x-portable-pixmap x-psion-sketch x-quicktime x-unknown x-xcursor x-xpmi ";
+ char videostr[] ="3gpp h264 mp2p mp2t mp4 mp4v-es mpeg mpv quicktime x-flc x-fli x-flv x-jng x-mng x-msvideo x-sgi-movie x-unknown ";
+ char audiostr[] ="basic midi mp4 mpeg x-adpcm x-aiff x-dec-basic x-flac x-hx-aac-adif x-hx-aac-adts x-mod x-mp4a-latm x-pn-realaudio x-unknown x-wav ";
+ char messagestr[] ="news rfc822 ";
+ char modelstr[] ="vrml x3d ";
+ char applistr[] ="dicom mac-binhex40 msword octet-stream ogg pdf pgp pgp-encrypted pgp-keys pgp-signature postscript unknown+zip vnd.google-earth.kml+xml vnd.google-earth.kmz vnd.lotus-wordpro vnd.ms-cab-compressed vnd.ms-excel vnd.ms-tnef vnd.oasis.opendocument.text vnd.rn-realmedia vnd.symbian.install x-123 x-adrift x-archive x-arc x-arj x-bittorrent x-bzip2 x-compress x-coredump x-cpio x-dbf x-dbm x-debian-package x-dosexec x-dvi x-eet x-elc x-executable x-gdbm x-gnucash x-gnumeric x-gnupg-keyring x-gzip x-hdf x-hwp x-ichitaro4 x-ichitaro5 x-ichitaro6 x-iso9660-image x-java-applet x-java-jce-keystore x-java-keystore x-java-pack200 x-kdelnk x-lha x-lharc x-lzip x-mif xml xml-sitemap x-msaccess x-ms-reader x-object x-pgp-keyring x-quark-xpress-3 x-quicktime-player x-rar x-rpm x-sc x-setupscript x-sharedlib x-shockwave-flash x-stuffit x-svr4-package x-tar x-tex-tfm x-tokyocabinet-btree x-tokyocabinet-fixed x-tokyocabinet-hash x-tokyocabinet-table x-xz x-zoo zip ";
+ char textstr[] = "html PGP rtf texmacs troff vnd.graphviz x-awk x-diff x-fortran x-gawk x-info x-lisp x-lua x-msdos-batch x-nawk x-perl x-php x-shellscript x-texinfo x-tex x-vcard x-xmcd ";
+ char undefstr[] ="MPEG Targa 7-zip cpio CD-ROM DVD 9660 Kernel boot Linux filesystem x86 image Image ";
+//-----------------------------------------------------------------------------------
+ char* p_search;
+ char token[30];
+ int len, flag;
+ int major = 0;
+ int minor = 0;
+ flag = 0;
+ p_search = typestr;
+ while (*p_search){
+ len=0;
+ while((*p_search) != 0x20){
+ token[len] = *p_search;
+ p_search++;
+ len++;
+ }
+ token[len] = 0;
+ major++;
+ if (!strncmp(magic_buf,token,strlen(token))){
+ flag = 1;
+ switch (major){
+ case 1:
+ p_search = applistr;
+ break;
+ case 2:
+ p_search = audiostr;
+ break;
+ case 3:
+ p_search = imagestr;
+ break;
+ case 4:
+ p_search = messagestr;
+ break;
+ case 5:
+ p_search = modelstr;
+ break;
+ case 6:
+ p_search = textstr;
+ break;
+ case 7:
+ p_search = videostr;
+ break;
+ default:
+ p_search = undefstr;
+ major = 8;
+ }
+ break;
+ }
+ p_search++;
+ }
+ if (!flag){
+ p_search = undefstr;
+ major = 8;
+ }
+ flag = 0;
+ minor = 0;
+ while (*p_search){
+ len=0;
+ while((*p_search) != 0x20){
+ token[len] = *p_search;
+ p_search++;
+ len++;
+ }
+ token[len] = 0;
+ minor++;
+ if (strstr(magic_buf,token)){
+ flag = 1;
+ break;
+ }
+ p_search++;
+ }
+ if(!flag) minor=255;
+ printf("major : %d minor : %d\n", major,minor);
+ *scan = (major <<8)| minor;
+return 1;
+}
+
+
+
+//default
+int file_default(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+ switch (flag){
+ case 0 :
+ if(f_data->inode->i_block[12]){ //FIXME for ext4
+ ret = 1;
+ break;
+ }
+ else{
+ if (*size < (current_fs->blocksize -4))
+ ret = 3;
+ else
+ if (*size < (current_fs->blocksize -64))
+ ret = 2;
+ else
+ if (*size < (current_fs->blocksize -256))
+ ret=1;
+ }
+
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE)) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+
+//Textfiles
+int file_txt(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ switch (flag){
+ case 0 :
+ return (buf[(*size)-1] == (char)0x0a);
+ break;
+ case 1 :
+ return (scan & M_TXT);
+ break;
+ }
+}
+
+
+
+//Textfiles binary
+int file_bin_txt(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ switch (flag){
+ case 0 :
+ return (*size < current_fs->blocksize);
+ break;
+ case 1 :
+ return (scan & M_TXT);
+ break;
+ }
+}
+
+
+//gzip
+int file_gzip(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if(*size < (current_fs->blocksize -4)){
+ ret = 1 ;
+ *size += 3;
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT | M_BLANK)) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+//zip ???????????
+int file_zip(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){ //340d
+ int ret = 0;
+ int j,i;
+ char token[5];
+
+ sprintf(token,"%c%c%c%c",0x50,0x4b,0x05,0x06);
+
+ switch (flag){
+ case 0 :
+ if((*size) > 22){
+ j = strlen(token) -1;
+ i = (*size -10);
+ while((i > ((*size)-22)) && (buf[i] != token[j])){
+ i--;
+ }
+ while ((i> ((*size)-22)) && (j >= 0) && (buf[i] == token[j])){
+ j--;
+ i--;
+ }
+ if ( j<0){
+ *size = i+22+1;
+ ret =1;
+ }
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT | M_BLANK)) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+//iso9660 CD-ROM
+int file_iso9660(char *buf, int *size, __u32 scan , int flag , struct found_data_t* f_data){
+ __u64 lsize;
+ __u32 *p_32;
+ __u16 *p_16;
+ int ssize;
+ int ret = 0;
+ char cd_str[] = "CD001";
+
+ switch (flag){
+ case 0 :if (f_data->size){
+ ssize = (f_data->size % current_fs->blocksize);
+ *size = (ssize)? ssize : current_fs->blocksize;
+ ret = 1;
+ }
+ else {
+ *size = current_fs->blocksize;
+ ret =2;
+ }
+ break;
+ case 1 :
+ return 1;
+ break;
+ case 2 :
+ p_32 = (__u32*)(buf + 0x8050);
+ p_16 = (__u16*)(buf + 0x8080);
+ if ((!strncmp((buf+0x8001),cd_str,5)) && (ext2fs_le32_to_cpu(*(p_32 +1)) == ext2fs_be32_to_cpu(*p_32))){
+ lsize = (__u64)(ext2fs_le32_to_cpu(*p_32)) * ext2fs_le16_to_cpu(*p_16);
+ f_data->size = lsize;
+ ret =1;
+ }
+ break;
+ }
+return ret;
+}
+
+
+// 7-zip
+int file_7z(char *buf, int *size, __u32 scan , int flag , struct found_data_t* f_data){
+__u64 lsize,*p;
+__u32 ssize;
+int ret = 0;
+ switch (flag){
+ case 0 :
+ if (f_data->size){
+ ssize = (f_data->size % current_fs->blocksize);
+ if (*size < ssize)
+ *size = ssize;
+ ret = 1;
+ }
+ else{
+ *size +=7;
+ ret = 2;
+ }
+ break;
+ case 1 :
+ return ( scan & (M_IS_META | M_IS_FILE | M_TXT | M_BLANK)) ? 0 :1 ;
+ break;
+ case 2 :
+ p = (__u64*)(buf+12);
+ lsize = ext2fs_le64_to_cpu(*p) + 32;
+ p++;
+ lsize += (ext2fs_le64_to_cpu(*p));
+ f_data->size = lsize ;
+ ret = 1;
+ break;
+ }
+ return ret;
+}
+
+
+
+//cpio
+int file_cpio(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int i,j;
+ int ret = 0;
+ char token[]="TRAILER!!!";
+
+ switch (flag){
+ case 0 :
+ /* if (*size>10) {
+ if (strstr(buf+(*size)-10,token)){
+ *size = ((*size) + 0x01FF) & 0xfe00 ;
+ ret=1;
+ }
+ }
+ else{*/
+ j = strlen(token) -1;
+ i = (*size) -1;
+ while ((i >= 0) && (j >= 0) && (buf[i] == token[j])){
+ i--;
+ j--;
+ }
+ if ((i == -1) || (j == -1)){
+ *size = ((*size) + 0x01FF) & 0xfe00 ;
+ ret=1;
+ }
+ //}
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE)) ? 0 :1 ;
+ break;
+ }
+}
+
+
+//tar
+int file_tar(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+
+ switch (flag){
+ case 0 :
+ if (!(*size))
+ *size = current_fs->blocksize;
+ else
+ *size = ((*size) + 1023) & ~1023 ;
+
+ if (f_data->inode->i_block[12]) //FIXME for ext4
+ ret = 1;
+ else
+ ret = 2;
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE)) ? 0 :1 ;
+ break;
+ }
+}
+
+
+//binary
+int file_binary(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if (*size && ((*size) < current_fs->blocksize - 7)&&(buf[(*size)-1] == (char)0x01)){
+ *size +=7;
+ ret = 1;
+ }
+ else {
+ if ((*size < current_fs->blocksize) && ((*size) > current_fs->blocksize - 7) && (buf[(*size)-1] == (char)0x01)){
+ *size = current_fs->blocksize;
+ ret = 2;
+ }
+ else{
+ if (!(*size)){
+ *size = 7;
+ ret = 1;
+ }
+ }
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+}
+
+
+//object
+int file_object(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ __u32 len;
+ __u32 *p_help;
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if ((buf[(*size)-1] == (char)0x0a)){
+ ret=1;
+ }
+ else{
+ len = ((*size) +3) & ~3;
+ p_help = (int*) (buf +len -4);
+ if ((*p_help < 0x400) && (len < current_fs->blocksize )){
+ ret = 1;
+ *size = len;
+ }
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+
+}
+
+
+//jpeg
+int file_jpeg(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if ((*size>1) && (buf[(*size)-1] == (char)0xd9) && (buf[(*size)-2] == (char)0xff))
+ ret = 1;
+ else
+ if ((*size == 1) && (buf[(*size)-1] == (char)0xd9))
+ ret = 1;
+ break;
+
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+}
+
+
+
+//png
+int file_png(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if ((*size > 8) && (strstr(buf + (*size) -8,"END")))
+ ret=1;
+ else
+ if (*size < current_fs->blocksize)
+ ret=2;
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+}
+
+
+//mng
+int file_mng(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if ((*size>1) && (buf[(*size)-1] == (char)0xd5) && (buf[(*size)-2] == (char)0xf7))
+ ret = 1;
+ else
+ if ((*size == 1) && (buf[(*size)-1] == (char)0xd5))
+ ret = 1;
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+}
+
+//riff
+int file_riff(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ __u32 *p_32 ;
+ __u64 lsize ;
+ __u32 ssize ;
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if (f_data->size){
+ ssize = (f_data->size % current_fs->blocksize);
+ *size = (ssize >= *size)? ssize : (*size) + 2;
+ ret = 1;
+ }
+ else {
+ *size = (*size) + 2;
+ ret =2;
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ case 2 :
+ p_32 = (__u32*)buf;
+ p_32++;
+ lsize = (__u64) ext2fs_le32_to_cpu(*p_32) + 8 ;
+ f_data->size = lsize;
+ ret=1;
+ break;
+ }
+}
+
+// tiff
+int file_tiff(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ __u32 *p_32 ;
+ __u64 lsize = 0;
+ __u32 ssize ;
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if (f_data->size ){
+ lsize = (((unsigned long long)f_data->inode->i_size_high << 32)| f_data->inode->i_size);
+ if (lsize > f_data->size){ //FIXME
+ *size +=1;
+ ret =1;
+ }
+ }
+ else
+ if (f_data->inode->i_block[12]) //FIXME for ext4
+ ret = 2;
+
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ case 2 :
+ p_32 = (__u32*)buf;
+ p_32++;
+ if ((*buf == (char) 0x49) && (*(buf+1) == (char) 0x49))
+ lsize = (__u64)ext2fs_le32_to_cpu(*p_32);
+ if ((*buf == (char) 0x4d) && (*(buf+1) == (char) 0x4d))
+ lsize = (__u64)ext2fs_be32_to_cpu(*p_32);
+
+ f_data->size = lsize;
+ ret = 1;
+
+ break;
+ }
+}
+
+
+
+//mod
+int file_mod(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if (*size < (current_fs->blocksize -2)){
+ *size = ((*size) +3) & 0xfffc ;
+ ret = 1;
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+}
+
+
+//change this only carefully
+//Although the scanner is controlled here, but you can not directly configure whether a file is found or not.
+//This function has a strong influence on the accuracy of the result.
+void get_file_property(struct found_data_t* this){
+//this->func = file_txt;
+ switch (this->type){
+ //Application
+ case 0x0101 : //dicom
+ // this->func = file_dicom ;
+ // strncat(this->name,".dicom",7);
+ break;
+
+ case 0x0102 : //mac-binhex40
+ // this->func = file_mac-binhex40 ;
+ strncat(this->name,".hqx",7);
+ break;
+
+ case 0x0103 : //msword
+ // this->func = file_msword ;
+ strncat(this->name,".doc",7);
+ break;
+
+ case 0x0104 : //octet-stream
+ // this->func = file_octet-stream;
+ strncat(this->name,".unknow",7);
+ break;
+
+ case 0x0105 : //ogg
+ // this->func = file_ogg ;
+ strncat(this->name,".ogg",7);
+ break;
+
+ case 0x0106 : //pdf
+ // this->func = file_pdf ;
+ strncat(this->name,".pdf",7);
+ break;
+
+ case 0x0107 : //pgp
+ // this->func = file_pgp ;
+ strncat(this->name,".pgp",7);
+ break;
+
+ case 0x0108 : //pgp-encrypted
+ // this->func = file_pgp-encrypted ;
+ strncat(this->name,".pgp-encrypted",7);
+ break;
+
+ case 0x0109 : //pgp-keys
+ // this->func = file_pgp-keys ;
+ strncat(this->name,".key",7);
+ break;
+
+ case 0x010a : //pgp-signature
+ // this->func = file_pgp-signature ;
+ strncat(this->name,".pgp-sig",7);
+ break;
+
+ case 0x010b : //postscript
+ // this->func = file_postscript ;
+ strncat(this->name,".ps",7);
+ break;
+
+ case 0x010c : //unknown+zip
+ this->func = file_zip ;
+ strncat(this->name,".zip",7);
+ break;
+
+ case 0x010d : //vnd.google-earth.kml+xml
+ // this->func = file_vnd.google-earth.kml+xml ;
+ // strncat(this->name,".vnd.google-earth.kml+xml",7);
+ break;
+
+ case 0x010e : //vnd.google-earth.kmz
+ // this->func = file_vnd.google-earth.kmz ;
+ // strncat(this->name,".vnd.google-earth.kmz",7);
+ break;
+
+ case 0x010f : //vnd.lotus-wordpro
+ // this->func = file_vnd.lotus-wordpro ;
+ // strncat(this->name,".vnd.lotus-wordpro",7);
+ break;
+
+ case 0x0110 : //vnd.ms-cab-compressed
+ // this->func = file_vnd.ms-cab-compressed ;
+ strncat(this->name,".cab",7);
+ break;
+
+ case 0x0111 : //vnd.ms-excel
+ // this->func = file_vnd.ms-excel ;
+ strncat(this->name,".xls",7);
+ break;
+
+ case 0x0112 : //vnd.ms-tnef
+ // this->func = file_vnd.ms-tnef ;
+ // strncat(this->name,".vnd.ms-tnef",7);
+ break;
+
+ case 0x0113 : //vnd.oasis.opendocument.text
+ // this->func = file_vnd.oasis.opendocument.text ;
+ // strncat(this->name,".vnd.oasis.opendocument.text",7);
+ break;
+
+ case 0x0114 : //vnd.rn-realmedia
+ // this->func = file_vnd.rn-realmedia ;
+ // strncat(this->name,".vnd.rn-realmedia",7);
+ break;
+
+ case 0x0115 : //vnd.symbian.install
+ // this->func = file_vnd.symbian.install ;
+ // strncat(this->name,".vnd.symbian.install",7);
+ break;
+
+ case 0x0116 : //x-123
+ // this->func = file_x-123 ;
+ // strncat(this->name,".x-123",7);
+ break;
+
+ case 0x0117 : //x-adrift
+ // this->func = file_x-adrift ;
+ // strncat(this->name,".x-adrift",7);
+ break;
+
+ case 0x0118 : //x-archive
+ this->func = file_object ;
+ strncat(this->name,".a",7);
+ break;
+
+ case 0x0119 : //x-arc
+ // this->func = file_x-arc ;
+ // strncat(this->name,".x-arc",7);
+
+
+ break;
+
+ case 0x011a : //x-arj
+ // this->func = file_x-arj ;
+ // strncat(this->name,".x-arj",7);
+ break;
+
+ case 0x011b : //x-bittorrent
+ // this->func = file_x-bittorrent ;
+ // strncat(this->name,".x-bittorrent",7);
+ break;
+
+ case 0x011c : //x-bzip2
+ this->func = file_gzip ; //FIXME
+ strncat(this->name,".bzip2",7);
+ break;
+
+ case 0x011d : //x-compress
+ // this->func = file_x-compress ;
+ // strncat(this->name,".z",7);
+ break;
+
+ case 0x011e : //x-coredump
+ // this->func = file_x-coredump ;
+ strncat(this->name,".core",7);
+ break;
+
+ case 0x011f : //x-cpio
+ this->func = file_cpio ;
+ strncat(this->name,".cpio",7);
+ break;
+
+ case 0x0120 : //x-dbf
+ // this->func = file_x-dbf ;
+ // strncat(this->name,".x-dbf",7);
+ break;
+
+ case 0x0121 : //x-dbm
+ // this->func = file_x-dbm ;
+ // strncat(this->name,".x-dbm",7);
+ break;
+
+ case 0x0122 : //x-debian-package
+ // this->func = file_x-debian-package ;
+ // strncat(this->name,".x-debian-package",7);
+ break;
+
+ case 0x0123 : //x-dosexec
+ // this->func = file_x-dosexec ;
+ strncat(this->name,".exe",7);
+ break;
+
+ case 0x0124 : //x-dvi
+ // this->func = file_x-dvi ;
+ strncat(this->name,".dvi",7);
+ break;
+
+ case 0x0125 : //x-eet
+ // this->func = file_x-eet ;
+ // strncat(this->name,".x-eet",7);
+ break;
+
+ case 0x0126 : //x-elc
+ // this->func = file_x-elc ;
+ // strncat(this->name,".x-elc",7);
+ break;
+
+ case 0x0127 : //x-executable
+ this->func = file_binary ;
+ strncat(this->name,".bin",7);
+ break;
+
+ case 0x0128 : //x-gdbm
+ // this->func = file_x-gdbm ;
+ // strncat(this->name,".x-gdbm",7);
+ break;
+
+ case 0x0129 : //x-gnucash
+ // this->func = file_x-gnucash ;
+ // strncat(this->name,".x-gnucash",7);
+ break;
+
+ case 0x012a : //x-gnumeric
+ // this->func = file_x-gnumeric ;
+ // strncat(this->name,".x-gnumeric",7);
+ break;
+
+ case 0x012b : //x-gnupg-keyring
+ // this->func = file_x-gnupg-keyring ;
+ // strncat(this->name,".x-gnupg-keyring",7);
+ break;
+
+ case 0x012c : //x-gzip
+ this->func = file_gzip ;
+ strncat(this->name,".gz",7);
+ break;
+
+ case 0x012d : //x-hdf
+ // this->func = file_x-hdf ;
+ strncat(this->name,".hdf",7);
+ break;
+
+ case 0x012e : //x-hwp
+ // this->func = file_x-hwp ;
+ // strncat(this->name,".x-hwp",7);
+ break;
+
+ case 0x012f : //x-ichitaro4
+ // this->func = file_x-ichitaro4 ;
+ // strncat(this->name,".x-ichitaro4",7);
+ break;
+
+ case 0x0130 : //x-ichitaro5
+ // this->func = file_x-ichitaro5 ;
+ // strncat(this->name,".x-ichitaro5",7);
+ break;
+
+ case 0x0131 : //x-ichitaro6
+ // this->func = file_x-ichitaro6 ;
+ // strncat(this->name,".x-ichitaro6",7);
+ break;
+
+ case 0x0132 : //x-iso9660-image
+ this->func = file_iso9660 ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x0133 : //x-java-applet
+ // this->func = file_x-java-applet ;
+ strncat(this->name,".java",7);
+ break;
+
+ case 0x0134 : //x-java-jce-keystore
+ // this->func = file_x-java-jce-keystore ;
+ // strncat(this->name,".x-java-jce-keystore",7);
+ break;
+
+ case 0x0135 : //x-java-keystore
+ // this->func = file_x-java-keystore ;
+ // strncat(this->name,".x-java-keystore",7);
+ break;
+
+ case 0x0136 : //x-java-pack200
+ // this->func = file_x-java-pack200 ;
+ // strncat(this->name,".x-java-pack200",7);
+ break;
+
+ case 0x0137 : //x-kdelnk
+ // this->func = file_x-kdelnk ;
+ // strncat(this->name,".x-kdelnk",7);
+ break;
+
+ case 0x0138 : //x-lha
+ // this->func = file_x-lha ;
+ strncat(this->name,".lha",7);
+ break;
+
+ case 0x0139 : //x-lharc
+ // this->func = file_x-lharc ;
+ // strncat(this->name,".x-lharc",7);
+ break;
+
+ case 0x013a : //x-lzip
+ // this->func = file_x-lzip ;
+ // strncat(this->name,".x-lzip",7);
+ break;
+
+ case 0x013b : //x-mif
+ // this->func = file_x-mif ;
+ strncat(this->name,".mif",7);
+ break;
+
+ case 0x013c : //xml
+ this->func = file_txt;
+ strncat(this->name,".xml",7);
+ break;
+
+ case 0x013d : //xml-sitemap
+ this->func = file_txt ;
+ strncat(this->name,".xml",7);
+ break;
+
+ case 0x013e : //x-msaccess
+ // this->func = file_x-msaccess ;
+ strncat(this->name,".mdb",7);
+ break;
+
+ case 0x013f : //x-ms-reader
+ // this->func = file_x-ms-reader ;
+ // strncat(this->name,".x-ms-reader",7);
+ break;
+
+ case 0x0140 : //x-object
+ this->func = file_object ;
+ strncat(this->name,".o",7);
+ break;
+
+ case 0x0141 : //x-pgp-keyring
+ // this->func = file_x-pgp-keyring ;
+ // strncat(this->name,".x-pgp-keyring",7);
+ break;
+
+ case 0x0142 : //x-quark-xpress-3
+ // this->func = file_x-quark-xpress-3 ;
+ // strncat(this->name,".x-quark-xpress-3",7);
+ break;
+
+ case 0x0143 : //x-quicktime-player
+ // this->func = file_x-quicktime-player ;
+ // strncat(this->name,".x-quicktime-player",7);
+ break;
+
+ case 0x0144 : //x-rar
+ // this->func = file_x-rar ;
+ strncat(this->name,".rar",7);
+ break;
+
+ case 0x0145 : //x-rpm
+ // this->func = file_x-rpm ;
+ strncat(this->name,".rpm",7);
+ break;
+
+ case 0x0146 : //x-sc
+ // this->func = file_x-sc ;
+ // strncat(this->name,".x-sc",7);
+ break;
+
+ case 0x0147 : //x-setupscript
+ // this->func = file_x-setupscript ;
+ // strncat(this->name,".x-setupscript",7);
+ break;
+
+ case 0x0148 : //x-sharedlib
+ this->func = file_binary ;
+ strncat(this->name,".so",7);
+ break;
+
+ case 0x0149 : //x-shockwave-flash
+ // this->func = file_x-shockwave-flash ;
+ strncat(this->name,".swf",7);
+ break;
+
+ case 0x014a : //x-stuffit
+ // this->func = file_x-stuffit ;
+ // strncat(this->name,".x-stuffit",7);
+ break;
+
+ case 0x014b : //x-svr4-package
+ // this->func = file_x-svr4-package ;
+ // strncat(this->name,".x-svr4-package",7);
+ break;
+
+ case 0x014c : //x-tar
+ this->func = file_tar ;
+ strncat(this->name,".tar",7);
+ break;
+
+ case 0x014d : //x-tex-tfm
+ // this->func = file_x-tex-tfm ;
+ // strncat(this->name,".x-tex-tfm",7);
+ break;
+
+ case 0x014e : //x-tokyocabinet-btree
+ // this->func = file_x-tokyocabinet-btree ;
+ // strncat(this->name,".x-tokyocabinet-btree",7);
+ break;
+
+ case 0x014f : //x-tokyocabinet-fixed
+ // this->func = file_x-tokyocabinet-fixed ;
+ // strncat(this->name,".x-tokyocabinet-fixed",7);
+ break;
+
+ case 0x0150 : //x-tokyocabinet-hash
+ // this->func = file_x-tokyocabinet-hash ;
+ // strncat(this->name,".x-tokyocabinet-hash",7);
+ break;
+
+ case 0x0151 : //x-tokyocabinet-table
+ // this->func = file_x-tokyocabinet-table ;
+ // strncat(this->name,".x-tokyocabinet-table",7);
+ break;
+
+ case 0x0152 : //x-xz
+ // this->func = file_x-xz ;
+ // strncat(this->name,".x-xz",7);
+ break;
+
+ case 0x0153 : //x-zoo
+ // this->func = file_x-zoo ;
+ // strncat(this->name,".x-zoo",7);
+ break;
+
+ case 0x0154 : //zip
+ this->func = file_zip ;
+ strncat(this->name,".zip",7);
+ break;
+
+
+ //----------------------------------------------------------------
+ //Audio
+ case 0x0201 : //basic
+ // this->func = file_basic ;
+ strncat(this->name,".au",7);
+ break;
+
+ case 0x0202 : //midi
+ // this->func = file_midi ;
+ strncat(this->name,".mid",7);
+ break;
+
+ case 0x0203 : //mp4
+ // this->func = file_mp4 ;
+ strncat(this->name,".mp4",7);
+ break;
+
+ case 0x0204 : //mpeg
+ // this->func = file_mpeg ;
+ strncat(this->name,".mp3",7);
+ break;
+
+ case 0x0205 : //x-adpcm
+ // this->func = file_x-adpcm ;
+ // strncat(this->name,".x-adpcm",7);
+ break;
+
+ case 0x0206 : //x-aiff
+ // this->func = file_x-aiff ;
+ strncat(this->name,".aif",7);
+ break;
+
+ case 0x0207 : //x-dec-basic
+ // this->func = file_x-dec-basic ;
+ // strncat(this->name,".x-dec-basic",7);
+ break;
+
+ case 0x0208 : //x-flac
+ // this->func = file_x-flac ;
+ // strncat(this->name,".x-flac",7);
+ break;
+
+ case 0x0209 : //x-hx-aac-adif
+ // this->func = file_x-hx-aac-adif ;
+ strncat(this->name,".aac",7);
+ break;
+
+ case 0x020a : //x-hx-aac-adts
+ // this->func = file_x-hx-aac-adts ;
+ strncat(this->name,".aac",7);
+ break;
+
+ case 0x020b : //x-mod
+ this->func = file_mod ;
+ strncat(this->name,".mod",7);
+ break;
+
+ case 0x020c : //x-mp4a-latm
+ // this->func = file_x-mp4a-latm ;
+ // strncat(this->name,".x-mp4a-latm",7);
+ break;
+
+ case 0x020d : //x-pn-realaudio
+ // this->func = file_x-pn-realaudio ;
+ strncat(this->name,".ra",7);
+ break;
+
+ case 0x020e : //x-unknown
+ // this->func = file_x-unknown ;
+ // strncat(this->name,".x-unknown",7);
+ break;
+
+ case 0x020f : //x-wav
+ // this->func = file_x-wav ;
+ strncat(this->name,".wav",7);
+ break;
+
+
+ //----------------------------------------------------------------
+ //Images
+ case 0x0301 : //gif
+ // this->func = file_gif ;
+ strncat(this->name,".gif",7);
+ break;
+
+ case 0x0302 : //jp2
+ // this->func = file_jp2 ;
+ strncat(this->name,".jp2",7);
+ break;
+
+ case 0x0303 : //jpeg
+ this->func = file_jpeg ;
+ strncat(this->name,".jpeg",7);
+ break;
+
+ case 0x0304 : //png
+ this->func = file_png ;
+ strncat(this->name,".png",7);
+ break;
+
+ case 0x0305 : //svg+xml
+ this->func = file_txt ;
+ strncat(this->name,".svg",7);
+ break;
+
+ case 0x0306 : //tiff
+ this->func = file_tiff ;
+ strncat(this->name,".tiff",7);
+ break;
+
+ case 0x0307 : //vnd.adobe.photoshop
+ // this->func = file_vnd.adobe.photoshop ;
+ strncat(this->name,".psd",7);
+ break;
+
+ case 0x0308 : //vnd.djvu
+ // this->func = file_vnd.djvu ;
+ strncat(this->name,".djv",7);
+ break;
+
+ case 0x0309 : //x-coreldraw
+ // this->func = file_x-coreldraw ;
+ strncat(this->name,".cdr",7);
+ break;
+
+ case 0x030a : //x-cpi
+ // this->func = file_x-cpi ;
+ // strncat(this->name,".x-cpi",7);
+ break;
+
+ case 0x030b : //x-ico
+ // this->func = file_x-ico ;
+ strncat(this->name,".ico",7);
+ break;
+
+ case 0x030c : //x-ms-bmp
+ // this->func = file_x-ms-bmp ;
+ strncat(this->name,".bmp",7);
+ break;
+
+ case 0x030d : //x-niff
+ this->func = file_riff ;
+ strncat(this->name,".niff",7);
+ break;
+
+ case 0x030e : //x-portable-bitmap
+ // this->func = file_x-portable-bitmap ;
+ strncat(this->name,".pbm",7);
+ break;
+
+ case 0x030f : //x-portable-greymap
+ // this->func = file_x-portable-greymap ;
+ strncat(this->name,".pgm",7);
+ break;
+
+ case 0x0310 : //x-portable-pixmap
+ // this->func = file_x-portable-pixmap ;
+ strncat(this->name,".ppm",7);
+ break;
+
+ case 0x0311 : //x-psion-sketch
+ // this->func = file_x-psion-sketch ;
+ // strncat(this->name,".x-psion-sketch",7);
+ break;
+
+ case 0x0312 : //x-quicktime
+ // this->func = file_x-quicktime ;
+ strncat(this->name,".qti",7);
+ break;
+
+ case 0x0313 : //x-unknown
+ // this->func = file_x-unknown ;
+ // strncat(this->name,".x-unknown",7);
+ break;
+
+ case 0x0314 : //x-xcursor
+ // this->func = file_x-xcursor ;
+ strncat(this->name,".cur",7);
+ break;
+
+ case 0x0315 : //x-xpmi
+ // this->func = file_x-xpmi ;
+ strncat(this->name,".xpm",7);
+ break;
+
+
+
+ //----------------------------------------------------------------
+ //Messages
+ case 0x0401 : //news
+ // this->func = file_news ;
+ strncat(this->name,".news",7);
+ break;
+
+ case 0x0402 : //rfc822
+ // this->func = file_rfc822 ;
+ // strncat(this->name,".rfc822",7);
+ break;
+
+
+ //----------------------------------------------------------------
+ //Model
+ case 0x0501 : //vrml
+ // this->func = file_vrml ;
+ // strncat(this->name,".vrml",7);
+ break;
+
+ case 0x0502 : //x3d
+ // this->func = file_x3d ;
+ // strncat(this->name,".x3d",7);
+ break;
+
+
+ //----------------------------------------------------------------
+ //Text
+ case 0x0601 : //html
+ this->func = file_txt ;
+ strncat(this->name,".html",7);
+ break;
+
+ case 0x0602 : //PGP
+ this->func = file_txt ;
+ // strncat(this->name,".PGP",7);
+ break;
+
+ case 0x0603 : //rtf
+ this->func = file_txt ;
+ strncat(this->name,".rtf",7);
+ break;
+
+ case 0x0604 : //texmacs
+ // this->func = file_texmacs ;
+ // strncat(this->name,".texmacs",7);
+ break;
+
+ case 0x0605 : //troff
+ this->func = file_txt ;
+ strncat(this->name,".troff",7);
+ break;
+
+ case 0x0606 : //vnd.graphviz
+ // this->func = file_vnd.graphviz ;
+ // strncat(this->name,".vnd.graphviz",7);
+ break;
+
+ case 0x0607 : //x-awk
+ this->func = file_txt ;
+ strncat(this->name,".awk",7);
+ break;
+
+ case 0x0608 : //x-diff
+ this->func = file_txt ;
+ strncat(this->name,".diff",7);
+ break;
+
+ case 0x0609 : //x-fortran
+ this->func = file_txt ;
+ // strncat(this->name,".x-fortran",7);
+ break;
+
+ case 0x060a : //x-gawk
+ this->func = file_txt ;
+ strncat(this->name,".awk",7);
+ break;
+
+ case 0x060b : //x-info
+ // this->func = file_txt ;
+ strncat(this->name,".info",7);
+ break;
+
+ case 0x060c : //x-lisp
+ // this->func = file_x-lisp ;
+ // strncat(this->name,".x-lisp",7);
+ break;
+
+ case 0x060d : //x-lua
+ // this->func = file_x-lua ;
+ // strncat(this->name,".x-lua",7);
+ break;
+
+ case 0x060e : //x-msdos-batch
+ this->func = file_txt ;
+ strncat(this->name,".bat",7);
+ break;
+
+ case 0x060f : //x-nawk
+ this->func = file_txt ;
+ strncat(this->name,".awk",7);
+ break;
+
+ case 0x0610 : //x-perl
+ this->func = file_txt ;
+ strncat(this->name,".pl",7);
+ break;
+
+ case 0x0611 : //x-php
+ this->func = file_txt ;
+ strncat(this->name,".php",7);
+ break;
+
+ case 0x0612 : //x-shellscript
+ this->func = file_txt ;
+ strncat(this->name,".sh",7);
+ break;
+
+ case 0x0613 : //x-texinfo
+ this->func = file_txt ;
+ strncat(this->name,".tex",7);
+ break;
+
+ case 0x0614 : //x-tex
+ this->func = file_txt ;
+ strncat(this->name,".tex",7);
+ break;
+
+ case 0x0615 : //x-vcard
+ // this->func = file_x-vcard ;
+ // strncat(this->name,".x-vcard",7);
+ break;
+
+ case 0x0616 : //x-xmcd
+ // this->func = file_x-xmcd ;
+ // strncat(this->name,".x-xmcd",7);
+ break;
+
+
+ //----------------------------------------------------------------
+ //Video
+ case 0x0701 : //3gpp
+ // this->func = file_3gpp ;
+ strncat(this->name,".gpp",7);
+ break;
+
+ case 0x0702 : //h264
+ // this->func = file_h264 ;
+ strncat(this->name,".mp4",7);
+ break;
+
+ case 0x0703 : //mp2p
+ // this->func = file_mp2p ;
+ strncat(this->name,".ps",7);
+ break;
+
+ case 0x0704 : //mp2t
+ // this->func = file_mp2t ;
+ strncat(this->name,".ts",7);
+ break;
+
+ case 0x0705 : //mp4
+ // this->func = file_mp4 ;
+ strncat(this->name,".mp4",7);
+ break;
+
+ case 0x0706 : //mp4v-es
+ // this->func = file_mp4v-es ;
+ strncat(this->name,".mp4",7);
+ break;
+
+ case 0x0707 : //mpeg
+ // this->func = file_mpeg ;
+ strncat(this->name,".mpeg",7);
+ break;
+
+ case 0x0708 : //mpv
+ // this->func = file_mpv ;
+ strncat(this->name,".mpv",7);
+ break;
+
+ case 0x0709 : //quicktime
+ // this->func = file_quicktime ;
+ strncat(this->name,".qt",7);
+ break;
+
+ case 0x070a : //x-flc
+ // this->func = file_x-flc ;
+ strncat(this->name,".flc",7);
+ break;
+
+ case 0x070b : //x-fli
+ // this->func = file_x-fli ;
+ strncat(this->name,".fli",7);
+ break;
+
+ case 0x070c : //x-flv
+ // this->func = file_x-flv ;
+ strncat(this->name,".flv",7);
+ break;
+
+ case 0x070d : //x-jng
+ // this->func = file_x-jng ;
+ strncat(this->name,".jng",7);
+ break;
+
+ case 0x070e : //x-mng
+ this->func = file_mng ;
+ strncat(this->name,".mng",7);
+ break;
+
+ case 0x070f : //x-msvideo
+ this->func = file_riff ;
+ strncat(this->name,".avi",7);
+ break;
+
+ case 0x0710 : //x-sgi-movie
+ // this->func = file_x-sgi-movie ;
+ strncat(this->name,".movie",7);
+ break;
+
+ case 0x0711 : //x-unknown
+ // this->func = file_x-unknown ;
+ // strncat(this->name,".x-unknown",7);
+ break;
+
+
+
+ //----------------------------------------------------------------
+ //Reservoir found in application/octet-stream
+ case 0x0801 : //MPEG
+ // this->func = file_MPEG ;
+ strncat(this->name,".mpeg",7);
+ break;
+
+ case 0x0802 : //Targa
+ // this->func = file_Targa ;
+ strncat(this->name,".tga",7);
+ break;
+
+ case 0x0803 : //7-zip
+ this->func = file_7z ;
+ strncat(this->name,".7z",7);
+ break;
+
+ case 0x0804 : //cpio
+ this->func = file_cpio ;
+ strncat(this->name,".cpio",7);
+ break;
+
+ case 0x0805 : //CD-ROM
+ this->func = file_iso9660 ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x0806 : //DVD
+ // this->func = file_DVD ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x0807 : //9660
+ this->func = file_iso9660 ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x0808 : //Kernel
+ // this->func = file_Kernel ;
+ // strncat(this->name,".Kernel",7);
+ break;
+
+ case 0x0809 : //boot
+ // this->func = file_boot ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x080a : //Linux
+ // this->func = file_Linux ;
+ // strncat(this->name,".Linux",7);
+ break;
+
+ case 0x080b : //filesystem
+ // this->func = file_filesystem ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x080c : //x86
+ // this->func = file_x86 ;
+ strncat(this->name,".iso",7);
+ break;
+
+ case 0x080d : //image
+ // this->func = file_image ;
+ // strncat(this->name,".image",7);
+ break;
+
+ case 0x080e : //Image
+ // this->func = file_Image ;
+ // strncat(this->name,".Image",7);
+ break;
+
+ //----------------------------------------------------------------
+ default:
+ this->func = file_default ;
+
+ }
+ if (!this->func)
+ this->func = file_default ;
+}
+
+
+
+
+
diff --git a/src/inode.c b/src/inode.c
index d25e9ad..87c07ba 100644
--- a/src/inode.c
+++ b/src/inode.c
@@ -22,6 +22,7 @@
#include <stdlib.h>
#include <ctype.h>
#include <string.h>
+#include <time.h>
#ifdef HAVE_ERRNO_H
#include <errno.h>
@@ -892,3 +893,109 @@ int read_journal_inode( ext2_ino_t inode_nr, struct ext2_inode* inode_buf, __u32
}
return retval;
}
+
+
+
+
+struct ext2_inode_large* new_inode(){
+ struct ext2_inode_large *inode;
+ __u32 a_time;
+ time_t help_time;
+
+ time( &help_time );
+ a_time = (__u32) help_time;
+ inode = malloc(EXT2_INODE_SIZE(current_fs->super));
+ if (! inode )
+ return NULL;
+
+ memset(inode, 0 , EXT2_INODE_SIZE(current_fs->super));
+ inode->i_mode = LINUX_S_IFREG | LINUX_S_IRUSR | LINUX_S_IWUSR | LINUX_S_IRGRP | LINUX_S_IROTH ;
+ inode->i_ctime = inode->i_mtime = inode->i_atime = a_time;
+ inode->i_links_count = 1 ;
+ if (current_fs->super->s_feature_incompat & EXT3_FEATURE_INCOMPAT_EXTENTS) {
+ inode->i_flags = EXT4_EXTENTS_FL ;
+ }
+return inode;
+}
+
+
+
+int inode_add_block(struct ext2_inode_large* inode , blk_t blk , __u32 size) {
+ int i = 0 ;
+ unsigned long long i_size;
+
+ if (! (inode->i_flags & EXT4_EXTENTS_FL)){
+ //ext3
+ while ((i < EXT2_N_BLOCKS) && inode->i_block[i] )
+ i++;
+ if ( i >= EXT2_NDIR_BLOCKS){
+// printf("faulty Block %u as i_block %d \n", i,blk);
+ //indirect blocks
+ return 0;
+ }
+
+ inode->i_block[i] = blk;
+ i_size = (unsigned long long)(inode->i_size | ((unsigned long long)inode->i_size_high << 32));
+ i_size += size;
+ inode->i_size = i_size & 0xffffffff ;
+ inode->i_size_high = i_size >> 32 ;
+ inode->i_blocks += (current_fs->blocksize / 512);
+ }
+ else{
+// printf("ERROR: ext3 block %u : but is a ext4_inode\n", blk);
+ //FIXME ext4
+ }
+return 1;
+}
+
+
+
+blk_t inode_add_meta_block(struct ext2_inode_large* inode , blk_t blk, blk_t *last, char *buf ){
+ blk_t b_blk,block_count, next;
+ blk_t count=0;
+ int i;
+ unsigned long long i_size = 0;
+
+ i = 0;
+ block_count = 0;
+ next = 0;
+ if (! (inode->i_flags & EXT4_EXTENTS_FL)){
+
+ while ((i < EXT2_N_BLOCKS) && inode->i_block[i] )
+ i++;
+
+ switch (i){
+ case EXT2_IND_BLOCK :
+ i_size = get_ind_block_len(buf, &block_count, last, &next);
+ break;
+ case EXT2_DIND_BLOCK :
+ i_size = get_dind_block_len(buf, &block_count, last, &next);
+ break;
+ case EXT2_TIND_BLOCK :
+ i_size = get_tind_block_len(buf, &block_count, last, &next);
+ break;
+ default:
+// printf("faulty Block %u as indirekter_block %d \n", i,blk);
+ return 0;
+ break;
+ }
+
+ if (i_size){
+ i_size += (((unsigned long long)inode->i_size_high << 32)| inode->i_size);
+ inode->i_size = i_size & 0xffffffff ;
+ inode->i_size_high = i_size >> 32 ;
+ inode->i_blocks += (block_count * (current_fs->blocksize / 512));
+ inode->i_block[ i ] = blk;
+ }
+ else
+ next = 0;
+
+ return next;
+ }
+ else{
+// printf("ERROR: ext3 indirect block %u ; but is a ext4_inode\n", blk);
+ //FIXME ext4
+ }
+
+ return 1;
+} \ No newline at end of file
diff --git a/src/inode.h b/src/inode.h
index a09c574..e3406f4 100644
--- a/src/inode.h
+++ b/src/inode.h
@@ -66,5 +66,8 @@ int read_journal_inode( ext2_ino_t, struct ext2_inode*, __u32);// get the first
int read_time_match_inode( ext2_ino_t, struct ext2_inode*, __u32);// get the first Journal Inode by time_stamp
struct ring_buf* get_j_inode_list(struct ext2_super_block*, ext2_ino_t);//fill all inode found in the Journal in the inode-ringbuffer
+struct ext2_inode_large* new_inode();
+int inode_add_block(struct ext2_inode_large* , blk_t , __u32);
+
#endif
diff --git a/src/journal.c b/src/journal.c
index 1d4330e..035db52 100644
--- a/src/journal.c
+++ b/src/journal.c
@@ -896,8 +896,8 @@ int next_block_bitmap(ext2fs_block_bitmap d_bmap){
struct ext2fs_struct_loc_generic_bitmap *fs_bitmap, *df_bitmap;
journal_bitmap_tag_t *p1;
journal_bitmap_tag_t *p2;
- __u32 blockg, skip,i;
- int got,retval,len;
+ __u32 blockg, skip,i,len;
+ int got,retval;
char *diff_buf;
if (jbbm.pointer->transaction < jbbm.first_trans)
@@ -971,8 +971,10 @@ int next_block_bitmap(ext2fs_block_bitmap d_bmap){
}
i = 0;
-while (! *((df_bitmap->bitmap)+i)) i++;
-return ( i <= (fs_bitmap->real_end >> 3)) ? 1 : 2 ;
+len = fs_bitmap->real_end >> 3;
+while ((i < len) && (!(*(df_bitmap->bitmap +i))))
+ i++;
+return ( i == len) ? 2 : 1 ;
errout:
return 0;
diff --git a/src/magic_block_scan.c b/src/magic_block_scan.c
index 76792e7..979d7d9 100644
--- a/src/magic_block_scan.c
+++ b/src/magic_block_scan.c
@@ -27,70 +27,606 @@
#include <string.h>
#include "util.h"
+#include "inode.h"
#include "magic.h"
-extern ext2_filsys current_fs ;
+#define MAX_RANGE 16
+extern ext2_filsys current_fs ;
ext2fs_block_bitmap d_bmap = NULL ;
-void magic_block_scan(char* des_dir, __u32 t_after){
- int retval;
- blk_t blk, o_blk;
- int ret, load_db;
- struct ext2fs_struct_loc_generic_bitmap *ds_bmap;
- char *block_buf = NULL;
- magic_t cookie;
- int m_result;
+__u32 get_block_len(char *buf){
+ int len = current_fs->blocksize -1;
- cookie = magic_open(MAGIC_NO_CHECK_COMPRESS | MAGIC_NO_CHECK_ELF | MAGIC_NO_CHECK_TAR);
- if ((cookie) && (! magic_load(cookie, NULL))){
+ while ((len >= 0) && (!(*(buf + len))))
+ len--;
+ return ++len;
+}
- retval = init_block_bitmap_list(&d_bmap, t_after);
- while (retval){
- retval = next_block_bitmap(d_bmap);
- if (retval == 2 )
- continue;
- if (d_bmap && retval ){
-
- ds_bmap = (struct ext2fs_struct_loc_generic_bitmap *) d_bmap;
- block_buf = malloc(current_fs->blocksize);
- if (block_buf){
- for (blk = ds_bmap->start; blk <ds_bmap->real_end; blk++){
- if (! (blk & 0x7)){
- o_blk = blk >> 3;
- while ((! *(ds_bmap->bitmap + o_blk)) && (o_blk <= (ds_bmap->real_end >> 3)))
- o_blk ++;
- blk = o_blk << 3;
- }
- if (blk >= ds_bmap->real_end)
- break;
-//FIXME in work
- if (ext2fs_test_block_bitmap ( d_bmap, blk) && (! ext2fs_test_block_bitmap( bmap, blk))){
- printf(" read block : %u\n",blk);
- ret = io_channel_read_blk ( current_fs->io, blk, 1, block_buf );
- if (ret){
- fprintf(stderr,"ERROR: while read block %10u\n",blk);
- }
- m_result = magic_check_block(block_buf,cookie,current_fs->blocksize,blk);
- }
- }
- free(block_buf);
+struct found_data_t* free_file_data(struct found_data_t* old){
+ if(old->inode) free(old->inode);
+ if(old->scan_result) free(old->scan_result);
+ if(old->name) free(old->name);
+ free(old);
+ old = NULL;
+ return old;
+}
+
+
+
+struct found_data_t* new_file_data(blk_t blk,__u32 scan,char *magic_buf, char* buf, __u32 *f){
+ struct found_data_t *new;
+ int str_len;
+ __u32 name_len;
+ char *c;
+ int def_len = 20;
+
+ new = malloc(sizeof(struct found_data_t));
+ if (!new) return NULL;
+
+ new->first = blk;
+ new->last = blk;
+ new->leng = 0;
+ new->scan = scan;
+ new->size = 0;
+ new->func = NULL;
+ if ( ident_file(new,&scan,magic_buf,buf)){
+ new->type = scan;
+ str_len = strlen(magic_buf) + 1;
+ c = strpbrk(magic_buf,";:, ");
+ if (c)
+ name_len = c - magic_buf + def_len;
+ else
+ name_len = str_len + def_len;
+
+ new->scan_result = malloc(str_len);
+ new->name = malloc(name_len);
+ new->inode = new_inode();
+ if((!new->scan_result) || (!new->name) || (!new->inode)){
+ new = free_file_data(new);
+ fprintf(stderr,"ERROR; while allocate memory for found file struct\n");
+ }
+ else{
+ strcpy(new->scan_result,magic_buf);
+ strncpy(new->name, magic_buf , name_len - 20);
+ sprintf(new->name + name_len - 20,"/%010u",blk);
+ get_file_property(new);
+ new->func(buf,&name_len,scan,2,new);
+ }
+}
+ *f++;
+return new;
+}
+
+
+
+
+struct found_data_t* recover_file_data(char *des_dir, struct found_data_t* this, __u32 *follow){
+ recover_file(des_dir,"MAGIC_3",this->name,(struct ext2_inode*)this->inode, 0 , 1);
+ free_file_data(this);
+ *follow = 0;
+ return NULL;
+}
+
+
+
+
+struct found_data_t* forget_file_data(struct found_data_t* this, __u32 *p_follow){
+ printf("TRASH : %s : leng %lu : begin %lu\n", this->name, this->inode->i_size , this->first);
+ free_file_data(this);
+ *p_follow = 0;
+ return NULL;
+}
+
+
+
+
+__u32 add_file_data(struct found_data_t* this, blk_t blk, __u32 scan ,__u32 *f){
+ __u32 retval = 0;
+
+ if (inode_add_block(this->inode , blk , current_fs->blocksize)){
+ this->leng++;
+ this->last = blk;
+ *f++ ;
+ }
+return *f ;
+}
+
+
+
+int file_data_correct_size(struct found_data_t* this, int size){
+ unsigned long long i_size;
+ int flag=0;
+
+ if (size <= current_fs->blocksize){
+ flag = 1;
+ i_size = (((unsigned long long)this->inode->i_size_high) << 32) + this->inode->i_size;
+ i_size -= (current_fs->blocksize - size);
+ this->inode->i_size = i_size & 0xffffffff ;
+ this->inode->i_size_high = i_size >> 32 ;
+ }
+ return flag;
+}
+
+
+
+int check_file_data_end(struct found_data_t* this,char *buf){
+ int size;
+ int ret = 0;
+
+ size = get_block_len(buf);
+ ret = this->func(buf, &size ,this->scan ,0 , this);
+
+ if (ret)
+ ret = file_data_correct_size(this,size);
+ return ret;
+}
+
+
+
+
+//?????
+int check_data_passage(char *a_buf, char *b_buf){
+ int i, blocksize;
+ int sum[4][2];
+
+
+
+}
+
+
+//FIXME obsolete: must switch to FLAG=1 of func() of the filetype
+int check_file_data_possible(struct found_data_t* this, __u32 scan ,char *buf, __u32 follow){
+ int ret = 0;
+ switch (this->scan & M_IS_FILE){
+// case (M_TXT | M_APPLI) :
+ case M_TXT :
+ if (scan & M_TXT) ret = 1;
+ break;
+ case M_VIDEO :
+ case M_AUDIO :
+ case M_IMAGE :
+ if (!(scan & M_IS_META)) ret = 1;
+ break;
+ case M_APPLI :
+ if (!(scan & M_IS_META)) ret = 1;
+ break;
+ }
+ if (!(this->scan & M_IS_FILE))
+ ret = 1;
+ return ret;
+}
+
+
+
+
+int add_ext3_file_meta_data(struct found_data_t* this, char *buf, blk_t blk){
+ blk_t next_meta;
+ blk_t last_data = 0;
+ next_meta = inode_add_meta_block(this->inode , blk, &last_data, buf );
+ this->last = last_data;
+
+ if (next_meta > 10 && (ext2fs_test_block_bitmap ( d_bmap, next_meta) && (! ext2fs_test_block_bitmap( bmap, next_meta)))){
+ io_channel_read_blk ( current_fs->io, next_meta, 1, buf );
+
+ if (check_meta3_block(buf, blk, get_block_len(buf))){
+ next_meta = inode_add_meta_block(this->inode , next_meta , &last_data, buf );
+ this->last = last_data;
+
+ if (next_meta > 10 && (ext2fs_test_block_bitmap ( d_bmap, next_meta) && (! ext2fs_test_block_bitmap( bmap, next_meta)))){
+ io_channel_read_blk ( current_fs->io, next_meta, 1, buf );
+
+ if (check_meta3_block(buf, blk, get_block_len(buf))){
+ next_meta = inode_add_meta_block(this->inode , next_meta , &last_data, buf );
+ this->last = last_data;
}
- else
- printf("can't allocate memory for blocksearch\n");
+ }
+ }
+ }
+return (next_meta) ? 0 : 1 ;
+}
+
+
+
+blk_t check_indirect_meta3(char *block_buf,blk_t blk, __u32 blocksize){
+ blk_t *pb_block;
+ blk_t last;
+ int i = blocksize/sizeof(blk_t);
+ int count=0;
+
+ pb_block = (blk_t*)block_buf;
+ last = ext2fs_le32_to_cpu(*pb_block);
+ while (i && last ) {
+ pb_block++;
+ i--;
+ if ((ext2fs_le32_to_cpu(*pb_block) -1) == last)
+ count++;
+ if (ext2fs_le32_to_cpu(*pb_block))
+ last = ext2fs_le32_to_cpu(*pb_block);
+ else
+ break;
+ }
+ return (count>3) ? last : blk ;
+}
+
+
+
+int check_meta3_block(char *block_buf, blk_t blk, __u32 size){
+ blk_t block, *pb_block;
+ int i,j ;
+
+ size = (size + 3) & 0xFFFFFC ;
+ if (! size ) return 0;
+
+ for (i = size-4 ; i>=0 ; i -= 4){
+ pb_block = (blk_t*)(block_buf+i);
+ block = ext2fs_le32_to_cpu(*pb_block);
+ if( block && (block < current_fs->super->s_blocks_count) &&
+ (ext2fs_test_block_bitmap( d_bmap, block)) && (!ext2fs_test_block_bitmap(bmap,block))){
+ if (i) {
+ for (j = i - 4 ; j >= 0 ;j -= 4){
+ if (block == ext2fs_le32_to_cpu(*((blk_t*)(block_buf+j))))
+ return 0;
+ }
+ }
+ else {
+ if (block == blk+1)
+ return 1;
}
- clear_block_bitmap_list(d_bmap);
+
}
- if(cookie) magic_close(cookie);
+ else
+ return 0;
}
-//FIXME only if needed
-if(d_bmap)
- ext2fs_free_block_bitmap(d_bmap);
+}
+
+
+int check_meta4_block(char *block_buf, blk_t blk, __u32 size){
+ __u16 *p_h16;
+ __u16 h16;
+
+ if(!((block_buf[0] == (char)0x0a) && (block_buf[1] == (char)0xf3)))
+ return 0;
+ p_h16 = (__u16*)block_buf+2;
+ h16 = ext2fs_le16_to_cpu(*p_h16);
+ p_h16 = (__u16*)block_buf+4;
+ if (ext2fs_le16_to_cpu(*p_h16) != (__u16)((current_fs->blocksize -12)/ 12))
+ return 0;
+ if ((!h16) || (h16 > ext2fs_le16_to_cpu(*p_h16)))
+ return 0;
+
+ return 1 ;
}
+
+
+
+
+int check_dir_block(char *block_buf, blk_t blk, __u32 size){
+ struct ext2_dir_entry_2 *dir_entry;
+ ext2_ino_t inode_nr;
+ __u16 len;
+
+ dir_entry = (struct ext2_dir_entry_2*)block_buf;
+
+ inode_nr = ext2fs_le32_to_cpu(dir_entry->inode);
+ if ((inode_nr && (inode_nr < EXT2_GOOD_OLD_FIRST_INO)) || (inode_nr > current_fs->super->s_inodes_count))
+ return 0;
+ len = ext2fs_le16_to_cpu(dir_entry->rec_len);
+ if ((len < 8) || (len % 4) || (len > current_fs->blocksize) ||(len < (((unsigned)dir_entry->name_len + 11) & ~3 )))
+ return 0;
+ if ((dir_entry->name_len & 0x01) && dir_entry->name[(unsigned)dir_entry->name_len])
+ return 0;
+ if (len < current_fs->blocksize - 12){
+ dir_entry = (struct ext2_dir_entry_2*) (block_buf + len);
+ len = ext2fs_le16_to_cpu(dir_entry->rec_len);
+ if ((len < 8) || (len % 4) || (len > current_fs->blocksize) ||(len < (((unsigned)dir_entry->name_len + 11) & ~3 )))
+ return 0;
+ if ((dir_entry->name_len & 0x01) && dir_entry->name[(unsigned)dir_entry->name_len])
+ return 0;
+ }
+ return 1;
+}
+
+
+// skip not of interest blocks : return 1 if skiped
+static int skip_block(blk_t *p_blk ,struct ext2fs_struct_loc_generic_bitmap *ds_bmap ){
+ struct ext2fs_struct_loc_generic_bitmap *p_bmap;
+ blk_t o_blk;
+ int flag = 0;
+
+ o_blk = (*p_blk) >> 3;
+ p_bmap = (struct ext2fs_struct_loc_generic_bitmap *) bmap;
+ while (((! *(ds_bmap->bitmap + o_blk)) || (*(ds_bmap->bitmap + o_blk) == 0xff)) && (o_blk < (ds_bmap->real_end >> 3))){
+ o_blk ++;
+ flag = 1;
+ }
+ *p_blk = o_blk << 3 ;
+
+return flag;
+}
+
+
+//magic scanner
+int magic_check_block(char* buf,magic_t cookie , magic_t cookie_f, char *magic_buf, __u32 size, blk_t blk){
+ int count = size-1;
+ int *i , len;
+ char text[100];
+ char *p_search;
+ __u32 retval = 0;
+ char searchstr[] = "7-zip cpio image Image filesystem CD-ROM MPEG 9660 Targa Kernel boot Linux x86 ";
+ char token[10];
+
+ strncpy(text,magic_buffer(cookie_f,buf , size),99);
+ strncpy(magic_buf, magic_buffer(cookie , buf , size),99);
+ while (count >= 0 && (*(buf+count) == 0)) count-- ;
+
+ printf("Scan Result : %s %d\n", magic_buf , count+1) ;
+ printf("RESULT : %s \n",text);
+
+
+ if (!strncmp(text,"data",4)){
+ if (count == -1) {
+ retval |= M_BLANK;
+ goto out;
+ }
+ }
+
+ if((strstr(magic_buf,"text/")) && (strstr(text,"text"))){
+ retval |= M_TXT ;
+ }
+
+ if (strstr(magic_buf,"charset=binary")){
+ retval |= M_BINARY ;
+ }
+
+ if (!(retval & M_TXT) && (strstr(magic_buf,"application/octet-stream")) && (!(strncmp(text,"data",4)))){
+ retval |= M_DATA;
+ }
+
+ if ((retval & M_DATA) || (count < 32) || (ext2fs_le32_to_cpu(*(blk_t*)buf) == blk +1)) {
+ if (check_meta3_block(buf, blk, count+1)){
+ retval = M_EXT3_META ;
+ goto out;
+ }
+ if (check_meta4_block(buf, blk, count+1)){
+ retval = M_EXT4_META ;
+ goto out;
+ }
+ if (check_dir_block(buf, blk, count+1)){
+ retval = M_DIR ;
+ goto out;
+ }
+ }
+
+ if (retval & M_DATA)
+ goto out;
+
+ if (retval & M_TXT){
+ if (strstr(magic_buf,"ascii")){
+ retval |= M_ASCII ;
+ }
+
+ if(strstr(magic_buf,"iso")){
+ retval |= M_ASCII ;
+ }
+
+ if(strstr(magic_buf,"utf")){
+ retval |= M_UTF ;
+ }
+ goto out;
+ }
+
+
+ if (strstr(magic_buf,"application/octet-stream")){
+ p_search = searchstr;
+ while (*p_search){
+ len=0;
+ while((*p_search) != 0x20){
+ token[len] = *p_search;
+ p_search++;
+ len++;
+ }
+ token[len] = 0;
+ if (strstr(text,token)){
+ strncpy(magic_buf,text,99);
+ retval |= (M_APPLI | M_ARCHIV);
+ break;
+ }
+ p_search++;
+ }
+ goto out;
+ }
+
+ if (strstr(magic_buf,"application/")){
+ retval |= M_APPLI;
+ goto out;
+ }
+
+ if (strstr(magic_buf,"image/")){
+ retval |= M_IMAGE;
+ goto out;
+ }
+
+ if (strstr(magic_buf,"audio/")){
+ retval |= M_AUDIO;
+ goto out;
+ }
+
+ if (strstr(magic_buf,"video/")){
+ retval |= M_VIDEO;
+ goto out;
+ }
+
+ if (strstr(magic_buf,"message/")){
+ retval |= M_MESSAGE;
+ goto out;
+ }
+
+ if (strstr(magic_buf,"model/")){
+ retval |= M_MODEL;
+ goto out;
+ }
+
+out:
+ printf("BLOCK_SCAN : 0x%08x\n",retval & 0xffffe000);
+ blockhex(stdout,buf,0,(count < (64)) ? count : 64 );
+
+ retval |= (count+1);
+
+ return retval;
+}
+
+
+
+
+struct found_data_t* soft_border(char *des_dir, char *buf, struct found_data_t* file_data, __u32* follow, blk_t blk){
+ if ( check_file_data_end(file_data, buf ))
+ file_data = recover_file_data(des_dir, file_data, follow);
+ else{
+ file_data = forget_file_data(file_data, follow);
+// printf("Don't recover this file, current block %d \n",blk);
+ }
+return file_data;
+}
+
+
+int get_range(blk_t* p_blk ,struct ext2fs_struct_loc_generic_bitmap *ds_bmap, char* buf){
+ blk_t begin;
+ blk_t end;
+ int count=1;
+ for (begin = *p_blk; begin < ds_bmap->real_end ; begin++){
+ if((!(begin & 0x7)) && skip_block(&begin, ds_bmap))
+ printf("jump to %d \n",begin);
+
+ if (ext2fs_test_block_bitmap ( d_bmap, begin) && (! ext2fs_test_block_bitmap( bmap, begin)))
+ break;
+ }
+ *p_blk = begin;
+ if (begin >= ds_bmap->real_end)
+ return 0;
+
+ for (end = begin,count=1 ; count < MAX_RANGE ; ){
+ if (ext2fs_test_block_bitmap(d_bmap, end+1) && (! ext2fs_test_block_bitmap( bmap, end+1))){
+ end++;
+ count++;
+ }
+ else break;
+
+ }
+ *(p_blk+1) = end;
+ if (io_channel_read_blk ( current_fs->io, begin , count, buf )){
+ fprintf(stderr,"ERROR: while read block %10u + %d\n",begin,count);
+ return 0;
+ }
+return count;
+}
+
+
+
+//magic_block_scan_main
+int magic_block_scan(char* des_dir, __u32 t_after){
+magic_t cookie = 0;
+magic_t cookie_f = 0;
+struct ext2fs_struct_loc_generic_bitmap *ds_bmap;
+struct found_data_t *file_data = NULL;
+blk_t blk[2] ;
+blk_t j;
+char *buf = NULL;
+char *magic_buf = NULL;
+char *tmp_buf = NULL;
+int blocksize, ds_retval,count,i;// step;
+__u32 scan,follow;
+
+
+blocksize = current_fs->blocksize ;
+count = 0;
+blk[0] = 0;
+cookie = magic_open(MAGIC_MIME | MAGIC_NO_CHECK_COMPRESS | MAGIC_NO_CHECK_ELF );
+cookie_f = magic_open(MAGIC_NO_CHECK_COMPRESS | MAGIC_NO_CHECK_ELF );
+if ((! cookie) || magic_load(cookie, NULL) || (! cookie_f) || magic_load(cookie_f, NULL)){
+ fprintf(stderr,"ERROR: can't find libmagic\n");
+ goto errout;
+}
+buf = malloc(blocksize * MAX_RANGE);
+tmp_buf = malloc(blocksize);
+magic_buf = malloc(200);
+if ((! buf) || (! magic_buf) || (! tmp_buf)){
+ fprintf(stderr,"ERROR: can't allocate memory\n");
+ goto errout;
+}
+
+ds_retval = init_block_bitmap_list(&d_bmap, t_after);
+while (ds_retval){
+ ds_retval = next_block_bitmap(d_bmap);
+ if (ds_retval == 2 )
+ continue;
+
+ if (d_bmap && ds_retval ){
+ ds_bmap = (struct ext2fs_struct_loc_generic_bitmap *) d_bmap;
+
+ count = get_range(blk ,ds_bmap, buf);
+
+ while (count){
+ printf(" %d %d %d\n", blk[0],blk[1],count);
+ for (i = 0; i< ((count>12) ? MAX_RANGE - 12 : count) ;i++){
+ scan = magic_check_block(buf+(i*blocksize), cookie, cookie_f , magic_buf , blocksize ,blk[0]+i);
+ if(scan & (M_DATA | M_BLANK | M_IS_META))
+ continue;
+
+ printf("SCAN %d : %09x : %s\n",blk[0]+i,scan,magic_buf);
+ if (((count -i) > 12) && (ext2fs_le32_to_cpu(*(__u32*)(buf +((i+12)*blocksize))) == blk[0] + i +1 + 12)){
+ follow = 0;
+ file_data = new_file_data(blk[0]+i,scan,magic_buf,buf+(i*blocksize),&follow);
+ for(j=blk[0]+i; j<(blk[0]+i+12);j++)
+ add_file_data(file_data, j, scan ,&follow);
+ scan = magic_check_block(buf+((i+12)*blocksize), cookie, cookie_f , magic_buf , blocksize ,blk[0]+i+12);
+ if (scan & M_EXT3_META){
+ if (add_ext3_file_meta_data(file_data, buf+((i+12)*blocksize), j)){
+ io_channel_read_blk (current_fs->io, file_data->last, 1, tmp_buf);
+ file_data = soft_border(des_dir, tmp_buf, file_data, &follow, j);
+ break;
+ }
+ else
+ file_data = forget_file_data(file_data, &follow);
+ }
+ else
+ file_data = forget_file_data(file_data, &follow);
+ }
+ else{
+ // no matches
+ // In the first step we are taking nothing
+
+// printf(" %d not matches %d == %d \n\n\n", blk[0]+i, ext2fs_le32_to_cpu(*(buf +((i+12)*blocksize))), blk[0] + i + 12+1);
+ }
+ }
+
+
+
+
+ blk[0] += (i)?i:1;
+ count = get_range(blk ,ds_bmap,buf);
+
+ }
+
+
+ }//operation
+} //while transactions
+
+
+errout:
+clear_block_bitmap_list(d_bmap);
+if (file_data) free_file_data(file_data);
+if (buf) free(buf);
+if (tmp_buf) free(tmp_buf);
+if (magic_buf) free(magic_buf);
+if (cookie) magic_close(cookie);
+if (cookie_f) magic_close(cookie_f);
+} //end
+
diff --git a/src/util.c b/src/util.c
index 16c349e..95e5045 100644
--- a/src/util.c
+++ b/src/util.c
@@ -441,3 +441,115 @@ unsigned long parse_ulong(const char *str, const char *cmd,
return 0;
}
+
+unsigned long long get_nblock_len(char *buf, blk_t *blk){
+ (*blk)++;
+ return current_fs->blocksize ;
+}
+
+
+unsigned long long get_ind_block_len(char *buf, blk_t *blk, blk_t *last ,blk_t *next){
+ unsigned long long len;
+ int i = (current_fs->blocksize >> 2)- 1;
+ char *priv_buf = NULL;
+ blk_t block, *p_block;
+ int flag = 0;
+
+ priv_buf = malloc(current_fs->blocksize);
+ if (! priv_buf){
+ fprintf(stderr,"can not allocate memory\n");
+ return 0;
+ }
+ p_block = (blk_t*)buf;
+ p_block += i;
+ while ( i >=0 ){
+ block = ext2fs_le32_to_cpu(*p_block);
+ if (! block){
+ i--;
+ p_block-- ;
+ flag++;
+ }
+ else break;
+ }
+ if (io_channel_read_blk ( current_fs->io, block, 1, priv_buf )){
+ fprintf(stderr,"ERROR: while read block %10u\n",block);
+ return 0;
+ }
+ *next = (flag) ? 0 : block+1 ;
+ *last = block;
+ len = get_nblock_len(priv_buf, blk) + (i * (current_fs->blocksize)) ;
+ *blk += (i + 1) ;
+ free(priv_buf);
+return len;
+}
+
+
+
+unsigned long long get_dind_block_len(char *buf, blk_t *blk, blk_t *last, blk_t *next){
+ unsigned long long len;
+ int i = (current_fs->blocksize >> 2)- 1;
+ char *priv_buf = NULL;
+ blk_t block, *p_block;
+
+ priv_buf = malloc(current_fs->blocksize);
+ if (! priv_buf){
+ fprintf(stderr,"can not allocate memory\n");
+ return 0;
+ }
+ p_block = (blk_t*)buf;
+ p_block += i;
+ while ( i >=0 ){
+ block = ext2fs_le32_to_cpu(*p_block);
+ if (! block){
+ i--;
+ p_block-- ;
+ }
+ else break;
+ }
+ if (io_channel_read_blk ( current_fs->io, block, 1, priv_buf )){
+ fprintf(stderr,"ERROR: while read ind-block %10u\n",block);
+ return 0;
+ }
+
+ len = get_ind_block_len(priv_buf, blk, last, next) + (i * current_fs->blocksize * (current_fs->blocksize >>2) ) ;
+ *next = ( i == ((current_fs->blocksize >> 2)- 1)) ? *last : 0 ;
+ *blk += ((i * ((current_fs->blocksize >>2) + 1)) + 1) ;
+ free(priv_buf);
+return len;
+}
+
+
+
+unsigned long long get_tind_block_len(char *buf, blk_t *blk, blk_t *last, blk_t *next){
+ unsigned long long len;
+ int i = (current_fs->blocksize >> 2)- 1;
+ char *priv_buf = NULL;
+ blk_t block, *p_block;
+
+ priv_buf = malloc(current_fs->blocksize);
+ if (! priv_buf){
+ fprintf(stderr,"can not allocate memory\n");
+ return 0;
+ }
+ p_block = (blk_t*)buf;
+ p_block += i;
+ while ( i >=0 ){
+ block = ext2fs_le32_to_cpu(*p_block);
+ if (! block){
+ i--;
+ p_block-- ;
+ }
+ else break;
+ }
+ if (io_channel_read_blk ( current_fs->io, block, 1, priv_buf )){
+ fprintf(stderr,"ERROR: while read dind-block %10u\n",block);
+ return 0;
+ }
+
+ len = get_dind_block_len(priv_buf, blk, last, next) + (i * current_fs->blocksize * (current_fs->blocksize >>2) * (current_fs->blocksize >>2) ) ;
+ *blk += ((i * ((current_fs->blocksize >>2) + 1) * (current_fs->blocksize >>2)) + 1) ;
+ *next = 0;
+ free(priv_buf);
+return len;
+}
+
diff --git a/src/util.h b/src/util.h
index 02216bf..9912b2c 100644
--- a/src/util.h
+++ b/src/util.h
@@ -39,6 +39,33 @@
#define REC_FILTER 0xF800
#define REC_DIR_NEEDED RECOV_ALL | RECOV_DEL
+//Definitions to magic scan functions
+#define M_SIZE 0x00003FFF
+#define M_BLANK 0x00010000
+#define M_DATA 0x00020000
+#define M_TXT 0x00040000
+#define M_IMAGE 0x00080000
+#define M_AUDIO 0x00100000
+#define M_VIDEO 0x00200000
+#define M_APPLI 0x00400000
+#define M_MESSAGE 0x00800000
+#define M_MODEL 0x00004000
+#define M_IS_FILE 0x00FC4000
+#define M_IS_DATA 0x00060000
+
+#define M_BINARY 0x01000000
+#define M_ASCII 0x02000000
+#define M_UTF 0x04000000
+#define M_IS_CHARSET 0x07000000
+
+#define M_ARCHIV 0x08000000
+
+#define M_ACL 0x80000000
+#define M_EXT4_META 0x40000000
+#define M_EXT3_META 0x20000000
+#define M_DIR 0x10000000
+#define M_IS_META 0xF0000000
+
/* Definitions to allow ext4magic compilation with old e2fsprogs */
#ifndef EXT4_EXTENTS_FL
@@ -89,6 +116,23 @@ struct ext2fs_struct_loc_generic_bitmap {
};
+
+//struct for collect data for magic_scan recover
+struct found_data_t{
+blk_t first;
+blk_t last;
+blk_t leng;
+unsigned long long size;
+int (*func)(char*, int*, __u32, int, struct found_data_t*);
+__u32 scan;
+__u32 type;
+char *scan_result;
+char *name;
+struct ext2_inode_large *inode;
+};
+
+
+
#define ALLOC_SIZE 1024
extern ext2fs_inode_bitmap imap ;
extern ext2fs_block_bitmap bmap ;
@@ -129,6 +173,6 @@ int check_find_dir(char*, ext2_ino_t, char*, char*); //check if the directory al
//public functions magic_block_scan.c
-void magic_block_scan(char* , __u32);
+//void magic_block_scan(char* , __u32);
#endif
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-27 01:31:13 +0000