diff options
Diffstat (limited to 'src/magic_block_scan.c')
| -rw-r--r-- | src/magic_block_scan.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/src/magic_block_scan.c b/src/magic_block_scan.c index 5e75905..3613ede 100644 --- a/src/magic_block_scan.c +++ b/src/magic_block_scan.c @@ -509,6 +509,15 @@ return flag; } +static int is_ecryptfs(unsigned char* buf){ + int ret = 0; + if ((!buf[0]) && (!buf[20]) && (!buf[21]) && (buf[22]) && (!buf[23]) && (!buf[24]) && + ((buf[8] ^ buf[12]) == 0x3c) && ((buf[9] ^ buf[13]) == 0x81) && ((buf[10] ^ buf[14]) == 0xb7) && ((buf[11] ^ buf[15]) == 0xf5)) + ret =1; + return ret; +} + + //magic scanner //FIXME static int magic_check_block(unsigned char* buf,magic_t cookie , magic_t cookie_f, char *magic_buf, __u32 size, blk_t blk, int deep){ @@ -647,7 +656,10 @@ static int magic_check_block(unsigned char* buf,magic_t cookie , magic_t cookie_ } else{ if ((strstr(magic_buf,"application/octet-stream")) && (!(strncmp(text,"data",4)))){ - retval |= M_DATA; + if (is_ecryptfs (buf)) + strncpy(text,"ecryptfs ",9); + else + retval |= M_DATA; } } @@ -693,7 +705,7 @@ static int magic_check_block(unsigned char* buf,magic_t cookie , magic_t cookie_ } if (strstr(magic_buf,"application/octet-stream")){ - char searchstr[] = "7-zip cpio CD-ROM MPEG 9660 Targa Kernel boot SQLite OpenOffice.org VMWare3 VMware4 JPEG ART PCX IFF DIF RIFF ATSC ScreamTracker matroska LZMA Audio=Visual Sample=Vision ISO=Media ext2 ext3 ext4 LUKS python ESRI=Shape "; + char searchstr[] = "7-zip cpio CD-ROM MPEG 9660 Targa Kernel boot SQLite OpenOffice.org VMWare3 VMware4 JPEG ART PCX IFF DIF RIFF ATSC ScreamTracker matroska LZMA Audio=Visual Sample=Vision ISO=Media ext2 ext3 ext4 LUKS python ESRI=Shape ecryptfs "; p_search = searchstr; while (*p_search){ len=0; |