summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/file_type.c394
-rw-r--r--src/journal.c5
-rw-r--r--src/magic_block_scan.c211
-rw-r--r--src/util.h1
4 files changed, 525 insertions, 86 deletions
diff --git a/src/file_type.c b/src/file_type.c
index ca823e1..1f880f4 100644
--- a/src/file_type.c
+++ b/src/file_type.c
@@ -42,14 +42,14 @@ int ident_file(struct found_data_t *new, __u32 *scan, char *magic_buf, char *buf
//Please do not modify the following lines.
//they are used for indices to the filestypes
char typestr[] ="application/ audio/ image/ message/ model/ text/ video/ ";
- char imagestr[] ="gif jp2 jpeg png svg+xml tiff vnd.adobe.photoshop vnd.djvu x-coreldraw x-cpi x-ico x-ms-bmp x-niff x-portable-bitmap x-portable-greymap x-portable-pixmap x-psion-sketch x-quicktime x-unknown x-xcursor x-xpmi ";
+ char imagestr[] ="gif jp2 jpeg png svg+xml tiff vnd.adobe.photoshop vnd.djvu x-coreldraw x-cpi x-ico x-ms-bmp x-niff x-portable-bitmap x-portable-greymap x-portable-pixmap x-psion-sketch x-quicktime x-unknown x-xcursor x-xpmi x-tga";
char videostr[] ="3gpp h264 mp2p mp2t mp4 mp4v-es mpeg mpv quicktime x-flc x-fli x-flv x-jng x-mng x-msvideo x-sgi-movie x-unknown ";
char audiostr[] ="basic midi mp4 mpeg x-adpcm x-aiff x-dec-basic x-flac x-hx-aac-adif x-hx-aac-adts x-mod x-mp4a-latm x-pn-realaudio x-unknown x-wav ";
char messagestr[] ="news rfc822 ";
char modelstr[] ="vrml x3d ";
char applistr[] ="dicom mac-binhex40 msword octet-stream ogg pdf pgp pgp-encrypted pgp-keys pgp-signature postscript unknown+zip vnd.google-earth.kml+xml vnd.google-earth.kmz vnd.lotus-wordpro vnd.ms-cab-compressed vnd.ms-excel vnd.ms-tnef vnd.oasis.opendocument.text vnd.rn-realmedia vnd.symbian.install x-123 x-adrift x-archive x-arc x-arj x-bittorrent x-bzip2 x-compress x-coredump x-cpio x-dbf x-dbm x-debian-package x-dosexec x-dvi x-eet x-elc x-executable x-gdbm x-gnucash x-gnumeric x-gnupg-keyring x-gzip x-hdf x-hwp x-ichitaro4 x-ichitaro5 x-ichitaro6 x-iso9660-image x-java-applet x-java-jce-keystore x-java-keystore x-java-pack200 x-kdelnk x-lha x-lharc x-lzip x-mif xml xml-sitemap x-msaccess x-ms-reader x-object x-pgp-keyring x-quark-xpress-3 x-quicktime-player x-rar x-rpm x-sc x-setupscript x-sharedlib x-shockwave-flash x-stuffit x-svr4-package x-tar x-tex-tfm x-tokyocabinet-btree x-tokyocabinet-fixed x-tokyocabinet-hash x-tokyocabinet-table x-xz x-zoo zip ";
- char textstr[] = "html PGP rtf texmacs troff vnd.graphviz x-awk x-diff x-fortran x-gawk x-info x-lisp x-lua x-msdos-batch x-nawk x-perl x-php x-shellscript x-texinfo x-tex x-vcard x-xmcd ";
- char undefstr[] ="MPEG Targa 7-zip cpio CD-ROM DVD 9660 Kernel boot Linux filesystem x86 image Image ";
+ char textstr[] = "html PGP rtf texmacs troff vnd.graphviz x-awk x-diff x-fortran x-gawk x-info x-lisp x-lua x-msdos-batch x-nawk x-perl x-php x-shellscript x-texinfo x-tex x-vcard x-xmcd plain x-pascal x-c++ x-c x-mail x-makefile x-asm text";
+ char undefstr[] ="MPEG Targa 7-zip cpio CD-ROM DVD 9660 Kernel boot Linux filesystem x86 Image CDF SQLite ";
//-----------------------------------------------------------------------------------
char* p_search;
char token[30];
@@ -141,11 +141,13 @@ int file_default(char *buf, int *size, __u32 scan , int flag, struct found_data_
if (*size < (current_fs->blocksize -4))
ret = 3;
else
- if (*size < (current_fs->blocksize -64))
+ break;
+ if (*size < (current_fs->blocksize -64))
ret = 2;
- else
- if (*size < (current_fs->blocksize -256))
- ret=1;
+ else
+ break;
+ if (*size < (current_fs->blocksize -256))
+ ret=1;
}
break;
@@ -192,7 +194,7 @@ int file_gzip(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
switch (flag){
case 0 :
if(*size < (current_fs->blocksize -4)){
- ret = 1 ;
+ ret = 2 ;
*size += 3;
}
break;
@@ -205,7 +207,7 @@ int file_gzip(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
//zip ???????????
-int file_zip(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){ //340d
+int file_zip(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
int ret = 0;
int j,i;
char token[5];
@@ -216,7 +218,7 @@ int file_zip(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f
case 0 :
if((*size) > 22){
j = strlen(token) -1;
- i = (*size -10);
+ i = (*size -12);
while((i > ((*size)-22)) && (buf[i] != token[j])){
i--;
}
@@ -229,6 +231,8 @@ int file_zip(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f
ret =1;
}
}
+ else
+ ret = 2;
break;
case 1 :
return (scan & (M_IS_META | M_IS_FILE | M_TXT | M_BLANK)) ? 0 :1 ;
@@ -248,14 +252,14 @@ int file_iso9660(char *buf, int *size, __u32 scan , int flag , struct found_data
char cd_str[] = "CD001";
switch (flag){
- case 0 :if (f_data->size){
+ case 0 :if ((f_data->size)&&(f_data->size <= (__u64)f_data->inode->i_size | ((__u64)f_data->inode->i_size_high<<32))){
ssize = (f_data->size % current_fs->blocksize);
*size = (ssize)? ssize : current_fs->blocksize;
ret = 1;
}
else {
- *size = current_fs->blocksize;
- ret =2;
+ // *size = current_fs->blocksize;
+ ret =0;
}
break;
case 1 :
@@ -271,7 +275,7 @@ int file_iso9660(char *buf, int *size, __u32 scan , int flag , struct found_data
}
break;
}
-return ret;
+ return ret;
}
@@ -282,15 +286,15 @@ __u32 ssize;
int ret = 0;
switch (flag){
case 0 :
- if (f_data->size){
+ if ((f_data->size) && (f_data->size <= (__u64)f_data->inode->i_size | ((__u64)f_data->inode->i_size_high<<32))){
ssize = (f_data->size % current_fs->blocksize);
if (*size < ssize)
*size = ssize;
ret = 1;
}
else{
- *size +=7;
- ret = 2;
+ // *size +=7;
+ ret = 0;
}
break;
case 1 :
@@ -341,9 +345,46 @@ int file_cpio(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
return (scan & (M_IS_META | M_IS_FILE)) ? 0 :1 ;
break;
}
+ return ret;
}
+
+//pdf
+int file_pdf(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int i,j;
+ int ret = 0;
+ char token[6];
+ sprintf(token,"%c%c%c%c%c",0x25,0x45,0x4f,0x46,0x0a);
+
+ switch (flag){
+ case 0 :
+ if ((*size) < 3)
+ ret =2;
+ else{
+ j = strlen(token) -2;
+ i = (*size) -2;
+ if(buf[i] != (char)0x46)
+ i--;
+
+ while ((i >= 0) && (j >= 0) && (buf[i] == token[j])){
+ i--;
+ j--;
+ }
+ if ((i == -1) || (j == -1)){
+ ret=1;
+ }
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META)) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+
//tar
int file_tar(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
int ret = 0;
@@ -351,20 +392,27 @@ int file_tar(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f
switch (flag){
case 0 :
- if (!(*size))
- *size = current_fs->blocksize;
- else
- *size = ((*size) + 1023) & ~1023 ;
-
- if (f_data->inode->i_block[12]) //FIXME for ext4
- ret = 1;
- else
- ret = 2;
+ if ((((__u64)f_data->inode->i_size |((__u64)f_data->inode->i_size_high<<32)) >= (__u64)0x2800 ) &&
+ ((*size) < (current_fs->blocksize - 0x4ff))){
+ if (!(*size))
+ *size = current_fs->blocksize;
+ else
+ *size = ((*size) + 1023) & ~1023 ;
+
+ if (f_data->inode->i_block[12]) //FIXME for ext4
+ ret = 1;
+ else
+ ret = 2;
+ }
break;
case 1 :
- return (scan & (M_IS_META | M_IS_FILE)) ? 0 :1 ;
+ if (scan & M_TAR)
+ ret = 1;
+ else
+ ret = (scan & (M_IS_META | (M_IS_FILE & (~ M_TXT)))) ? 0 :1 ;
break;
}
+ return ret;
}
@@ -388,6 +436,12 @@ int file_binary(char *buf, int *size, __u32 scan , int flag, struct found_data_t
*size = 7;
ret = 1;
}
+ else{
+ if ((buf[(*size)-1] != (char)0x01)&&(*size < current_fs->blocksize - 128)){
+ *size +=1;
+ ret = 2;
+ }
+ }
}
}
break;
@@ -395,6 +449,7 @@ int file_binary(char *buf, int *size, __u32 scan , int flag, struct found_data_t
return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
break;
}
+ return ret;
}
@@ -422,7 +477,7 @@ int file_object(char *buf, int *size, __u32 scan , int flag, struct found_data_t
return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
break;
}
-
+ return ret;
}
@@ -443,10 +498,54 @@ int file_jpeg(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
break;
}
+ return ret;
}
+//gif
+int file_gif(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if ((*size) && (*size < current_fs->blocksize) && (buf[(*size)-1] == (char)0x3b))
+ ret = 1;
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+
+//bmp
+int file_bmp(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ __u32 *p_32;
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if (f_data->inode->i_size >= f_data->size){
+ *size = f_data->size % current_fs->blocksize;
+ ret =1;
+ }
+ break;
+ case 1 :
+ return (scan & M_IS_META) ? 0 :1 ;
+ break;
+
+ case 2 :
+ p_32 = (__u32*)(buf+2);
+ f_data->size = (__u64)ext2fs_le32_to_cpu(*p_32);
+ ret =1;
+ }
+ return ret;
+}
+
+
//png
int file_png(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
int ret = 0;
@@ -463,6 +562,7 @@ int file_png(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f
return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
break;
}
+ return ret;
}
@@ -482,7 +582,63 @@ int file_mng(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f
return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
break;
}
+ return ret;
}
+
+
+//tga
+int file_tga(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int i,j;
+ int ret = 0;
+ char token[]="-XFILE.";
+
+ switch (flag){
+ case 0 :
+ j = strlen(token) -1;
+ i = (*size) -1;
+ while ((i >= 0) && (j >= 0) && (buf[i] == token[j])){
+ i--;
+ j--;
+ }
+ if ((i == -1) || (j == -1)){
+ *size = (*size) + 1 ;
+ ret=1;
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT )) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+//mpeg
+int file_mpeg(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int i,j;
+ int ret = 0;
+ char token[5];
+ sprintf(token,"%c%c%c%c",0x00,0x00,0x01,0xb9);
+ switch (flag){
+ case 0 :
+ j = 3 ; //strlen(token) -1;
+ i = (*size) -1;
+ while ((i >= 0) && (j >= 0) && (buf[i] == token[j])){
+ i--;
+ j--;
+ }
+ if ((i == -1) || (j == -1)){
+ ret=1;
+ }
+ break;
+ case 1 :
+ return (scan & (M_IS_META | M_TXT )) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
//riff
int file_riff(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
@@ -493,14 +649,13 @@ int file_riff(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
switch (flag){
case 0 :
- if (f_data->size){
+ if ((f_data->size) && (f_data->size <= f_data->inode->i_size)){
ssize = (f_data->size % current_fs->blocksize);
*size = (ssize >= *size)? ssize : (*size) + 2;
ret = 1;
}
else {
- *size = (*size) + 2;
- ret =2;
+ ret =0;
}
break;
case 1 :
@@ -509,11 +664,21 @@ int file_riff(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
case 2 :
p_32 = (__u32*)buf;
p_32++;
- lsize = (__u64) ext2fs_le32_to_cpu(*p_32) + 8 ;
+ switch (buf[3]){
+ case 'F' :
+ lsize = (__u64) ext2fs_le32_to_cpu(*p_32) + 8 ;
+ break;
+ case 'X' :
+ lsize = (__u64) ext2fs_be32_to_cpu(*p_32) + 8 ;
+ break;
+ default :
+ lsize = 0;
+ }
f_data->size = lsize;
ret=1;
break;
}
+ return ret;
}
// tiff
@@ -553,6 +718,7 @@ int file_tiff(char *buf, int *size, __u32 scan , int flag, struct found_data_t*
break;
}
+ return ret;
}
@@ -572,14 +738,72 @@ int file_mod(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f
return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
break;
}
+ return ret;
}
-
+
+
+//CDF FIXME ????????????????
+int file_CDF(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+
+ switch (flag){
+ case 0 :
+ if (*size < (current_fs->blocksize -7) && ((*size ) && buf[(*size)-1] == (char)0xff )){
+ *size = ((*size) +8) ;
+ ret = 3;
+ }
+ break;
+ case 1:
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+ }
+ return ret;
+}
+
+
+
+//SQLite FIXME ????????????????
+int file_SQLite(char *buf, int *size, __u32 scan , int flag, struct found_data_t* f_data){
+ int ret = 0;
+ __u16 *p_16;
+ __u64 lsize;
+ int ssize;
+
+ switch (flag){
+ case 0 :
+ if (f_data->size ) {
+ ssize = (int) f_data->size;
+ if (ssize < current_fs->blocksize){
+ *size += ssize -1;
+ *size &= (~(ssize-1));
+ ret = 2;
+ }
+ else{
+ *size = current_fs->blocksize;
+ ret = 3;
+ }
+ }
+ break;
+ case 1:
+ return (scan & (M_IS_META | M_IS_FILE | M_TXT)) ? 0 :1 ;
+ break;
+
+ case 2:
+ p_16 = (__u16*)(buf+16);
+ lsize = (__u64)ext2fs_be16_to_cpu(*p_16);
+ f_data->size = lsize;
+ ret = 1;
+ break;
+ }
+ return ret;
+}
+
//change this only carefully
//Although the scanner is controlled here, but you can not directly configure whether a file is found or not.
//This function has a strong influence on the accuracy of the result.
void get_file_property(struct found_data_t* this){
-//this->func = file_txt;
+//this->func = file_t
switch (this->type){
//Application
case 0x0101 : //dicom
@@ -608,7 +832,7 @@ void get_file_property(struct found_data_t* this){
break;
case 0x0106 : //pdf
- // this->func = file_pdf ;
+ this->func = file_pdf ;
strncat(this->name,".pdf",7);
break;
@@ -705,8 +929,6 @@ void get_file_property(struct found_data_t* this){
case 0x0119 : //x-arc
// this->func = file_x-arc ;
// strncat(this->name,".x-arc",7);
-
-
break;
case 0x011a : //x-arj
@@ -1078,7 +1300,7 @@ void get_file_property(struct found_data_t* this){
break;
case 0x020f : //x-wav
- // this->func = file_x-wav ;
+ this->func = file_riff ;
strncat(this->name,".wav",7);
break;
@@ -1086,7 +1308,7 @@ void get_file_property(struct found_data_t* this){
//----------------------------------------------------------------
//Images
case 0x0301 : //gif
- // this->func = file_gif ;
+ this->func = file_gif ;
strncat(this->name,".gif",7);
break;
@@ -1126,7 +1348,7 @@ void get_file_property(struct found_data_t* this){
break;
case 0x0309 : //x-coreldraw
- // this->func = file_x-coreldraw ;
+ this->func = file_riff ;
strncat(this->name,".cdr",7);
break;
@@ -1141,7 +1363,7 @@ void get_file_property(struct found_data_t* this){
break;
case 0x030c : //x-ms-bmp
- // this->func = file_x-ms-bmp ;
+ this->func = file_bmp ;
strncat(this->name,".bmp",7);
break;
@@ -1190,17 +1412,21 @@ void get_file_property(struct found_data_t* this){
strncat(this->name,".xpm",7);
break;
+ case 0x0316 : //x-tga
+ this->func = file_tga ;
+ strncat(this->name,".tga",7);
+ break;
//----------------------------------------------------------------
//Messages
case 0x0401 : //news
- // this->func = file_news ;
- strncat(this->name,".news",7);
+ this->func = file_txt ;
+ // strncat(this->name,".news",7);
break;
case 0x0402 : //rfc822
- // this->func = file_rfc822 ;
+ this->func = file_txt ;
// strncat(this->name,".rfc822",7);
break;
@@ -1242,7 +1468,7 @@ void get_file_property(struct found_data_t* this){
case 0x0605 : //troff
this->func = file_txt ;
- strncat(this->name,".troff",7);
+ strncat(this->name,".man",7);
break;
case 0x0606 : //vnd.graphviz
@@ -1260,9 +1486,9 @@ void get_file_property(struct found_data_t* this){
strncat(this->name,".diff",7);
break;
- case 0x0609 : //x-fortran
+ case 0x0609 : //x-fortran (often c files)
this->func = file_txt ;
- // strncat(this->name,".x-fortran",7);
+ strncat(this->name,".f",7);
break;
case 0x060a : //x-gawk
@@ -1271,13 +1497,13 @@ void get_file_property(struct found_data_t* this){
break;
case 0x060b : //x-info
- // this->func = file_txt ;
+ this->func = file_txt ;
strncat(this->name,".info",7);
break;
- case 0x060c : //x-lisp
- // this->func = file_x-lisp ;
- // strncat(this->name,".x-lisp",7);
+ case 0x060c : //x-lisp (often c files)
+ this->func = file_txt ;
+ strncat(this->name,".l",7);
break;
case 0x060d : //x-lua
@@ -1312,7 +1538,7 @@ void get_file_property(struct found_data_t* this){
case 0x0613 : //x-texinfo
this->func = file_txt ;
- strncat(this->name,".tex",7);
+ strncat(this->name,".texi",7);
break;
case 0x0614 : //x-tex
@@ -1321,8 +1547,8 @@ void get_file_property(struct found_data_t* this){
break;
case 0x0615 : //x-vcard
- // this->func = file_x-vcard ;
- // strncat(this->name,".x-vcard",7);
+ this->func = file_txt;
+ strncat(this->name,".vcf",7);
break;
case 0x0616 : //x-xmcd
@@ -1330,6 +1556,45 @@ void get_file_property(struct found_data_t* this){
// strncat(this->name,".x-xmcd",7);
break;
+ case 0x0617 : //plain
+ this->func = file_bin_txt ;
+ strncat(this->name,".txt",7);
+ break;
+
+ case 0x0618 : //x-pascal (often c files)
+ this->func = file_txt ;
+ strncat(this->name,".c",7);
+ break;
+
+ case 0x0619 : //c++
+ this->func = file_txt ;
+ strncat(this->name,".c++",7);
+ break;
+
+ case 0x061a : //c
+ this->func = file_txt ;
+ strncat(this->name,".c",7);
+ break;
+
+ case 0x061b : //x-mail
+ this->func = file_txt ;
+ // strncat(this->name,".x-mail",7);
+ break;
+
+ case 0x061c : //x-makefile
+ this->func = file_txt ;
+ // strncat(this->name,".x-makefile",7);
+ break;
+
+ case 0x061d : //x-asm
+ this->func = file_txt ;
+ strncat(this->name,".S",7);
+ break;
+
+ case 0x061e : //text (for all unknown)
+ this->func = file_txt ;
+ // strncat(this->name,".txt",7);
+ break;
//----------------------------------------------------------------
//Video
@@ -1423,12 +1688,12 @@ void get_file_property(struct found_data_t* this){
//----------------------------------------------------------------
//Reservoir found in application/octet-stream
case 0x0801 : //MPEG
- // this->func = file_MPEG ;
+ this->func = file_mpeg ;
strncat(this->name,".mpeg",7);
break;
case 0x0802 : //Targa
- // this->func = file_Targa ;
+ this->func = file_tga ;
strncat(this->name,".tga",7);
break;
@@ -1482,16 +1747,21 @@ void get_file_property(struct found_data_t* this){
strncat(this->name,".iso",7);
break;
- case 0x080d : //image
- // this->func = file_image ;
- // strncat(this->name,".image",7);
- break;
-
- case 0x080e : //Image
+ case 0x080d : //Image
// this->func = file_Image ;
// strncat(this->name,".Image",7);
break;
+ case 0x080e : //CDF
+ this->func = file_CDF ;
+ // strncat(this->name,".doc",7);
+ break;
+
+ case 0x080f : //SQLite
+ this->func = file_SQLite ;
+ strncat(this->name,".sql",7);
+ break;
+
//----------------------------------------------------------------
default:
this->func = file_default ;
diff --git a/src/journal.c b/src/journal.c
index 035db52..07006fc 100644
--- a/src/journal.c
+++ b/src/journal.c
@@ -870,7 +870,10 @@ return sum;
jbbm.blocksize = current_fs->blocksize;
jbbm.blocklen = current_fs->super->s_blocks_per_group >> 3 ;
jbbm.last_blocklen = (current_fs->super->s_blocks_count >> 3) % jbbm.blocklen;
- jbbm.last_blocklen += (current_fs->super->s_blocks_count % 8) ? 1 : 0 ;
+ if (!jbbm.last_blocklen)
+ jbbm.last_blocklen = jbbm.blocklen;
+ else
+ jbbm.last_blocklen += (current_fs->super->s_blocks_count % 8) ? 1 : 0 ;
}
return jbbm.count;
}
diff --git a/src/magic_block_scan.c b/src/magic_block_scan.c
index 979d7d9..7080bf6 100644
--- a/src/magic_block_scan.c
+++ b/src/magic_block_scan.c
@@ -133,7 +133,7 @@ __u32 add_file_data(struct found_data_t* this, blk_t blk, __u32 scan ,__u32 *f){
if (inode_add_block(this->inode , blk , current_fs->blocksize)){
this->leng++;
this->last = blk;
- *f++ ;
+ (*f)++ ;
}
return *f ;
}
@@ -182,9 +182,11 @@ int check_data_passage(char *a_buf, char *b_buf){
//FIXME obsolete: must switch to FLAG=1 of func() of the filetype
-int check_file_data_possible(struct found_data_t* this, __u32 scan ,char *buf, __u32 follow){
+int check_file_data_possible(struct found_data_t* this, __u32 scan ,char *buf){
int ret = 0;
- switch (this->scan & M_IS_FILE){
+ int size ;
+ ret = this->func(buf, &size ,scan ,1 , this);
+/* switch (this->scan & M_IS_FILE){
// case (M_TXT | M_APPLI) :
case M_TXT :
if (scan & M_TXT) ret = 1;
@@ -198,8 +200,9 @@ int check_file_data_possible(struct found_data_t* this, __u32 scan ,char *buf, _
if (!(scan & M_IS_META)) ret = 1;
break;
}
+
if (!(this->scan & M_IS_FILE))
- ret = 1;
+ ret = 1; */
return ret;
}
@@ -234,25 +237,27 @@ return (next_meta) ? 0 : 1 ;
-blk_t check_indirect_meta3(char *block_buf,blk_t blk, __u32 blocksize){
+int check_indirect_meta3(char *block_buf){
blk_t *pb_block;
blk_t last;
- int i = blocksize/sizeof(blk_t);
+ int i = current_fs->blocksize/sizeof(blk_t);
int count=0;
+ int next =0;
pb_block = (blk_t*)block_buf;
last = ext2fs_le32_to_cpu(*pb_block);
while (i && last ) {
pb_block++;
i--;
+ count++;
if ((ext2fs_le32_to_cpu(*pb_block) -1) == last)
- count++;
+ next++;
if (ext2fs_le32_to_cpu(*pb_block))
last = ext2fs_le32_to_cpu(*pb_block);
else
break;
}
- return (count>3) ? last : blk ;
+ return (next >= (count>>1)) ? 1 : 0;
}
@@ -355,12 +360,13 @@ return flag;
//magic scanner
int magic_check_block(char* buf,magic_t cookie , magic_t cookie_f, char *magic_buf, __u32 size, blk_t blk){
- int count = size-1;
+ //int count = size-1;
+ int count = current_fs->blocksize -1 ;
int *i , len;
- char text[100];
+ char text[100] = "";
char *p_search;
__u32 retval = 0;
- char searchstr[] = "7-zip cpio image Image filesystem CD-ROM MPEG 9660 Targa Kernel boot Linux x86 ";
+ char searchstr[] = "7-zip cpio Image filesystem CD-ROM MPEG 9660 Targa Kernel boot Linux x86 SQLite ";
char token[10];
strncpy(text,magic_buffer(cookie_f,buf , size),99);
@@ -378,7 +384,7 @@ int magic_check_block(char* buf,magic_t cookie , magic_t cookie_f, char *magic_b
}
}
- if((strstr(magic_buf,"text/")) && (strstr(text,"text"))){
+ if((strstr(magic_buf,"text/")) || (strstr(magic_buf,"application/") && (strstr(text,"text")))){
retval |= M_TXT ;
}
@@ -390,7 +396,7 @@ int magic_check_block(char* buf,magic_t cookie , magic_t cookie_f, char *magic_b
retval |= M_DATA;
}
- if ((retval & M_DATA) || (count < 32) || (ext2fs_le32_to_cpu(*(blk_t*)buf) == blk +1)) {
+ if ((retval & M_DATA) || (*(buf+7) < EXT2_FT_MAX) || (count < 32) || (ext2fs_le32_to_cpu(*(blk_t*)buf) == blk +1)) {
if (check_meta3_block(buf, blk, count+1)){
retval = M_EXT3_META ;
goto out;
@@ -446,6 +452,8 @@ int magic_check_block(char* buf,magic_t cookie , magic_t cookie_f, char *magic_b
if (strstr(magic_buf,"application/")){
retval |= M_APPLI;
+ if (strstr(magic_buf,"x-tar"))
+ retval |= M_TAR ;
goto out;
}
@@ -474,6 +482,12 @@ int magic_check_block(char* buf,magic_t cookie , magic_t cookie_f, char *magic_b
goto out;
}
+ if (strstr(magic_buf,"CDF V2 Document")){
+ retval |= (M_APPLI | M_ARCHIV);
+ goto out;
+ }
+
+
out:
printf("BLOCK_SCAN : 0x%08x\n",retval & 0xffffe000);
blockhex(stdout,buf,0,(count < (64)) ? count : 64 );
@@ -530,6 +544,68 @@ return count;
+int get_full_range(blk_t* p_blk ,struct ext2fs_struct_loc_generic_bitmap *ds_bmap, char* buf, blk_t* p_flag){
+ blk_t begin;
+ blk_t end;
+ int count=0;
+ int i;
+ for (begin = *p_blk; begin < ds_bmap->real_end ; begin++){
+ if((!(begin & 0x7)) && skip_block(&begin, ds_bmap))
+ printf("jump to %d \n",begin);
+
+ if (ext2fs_test_block_bitmap ( d_bmap, begin) && (! ext2fs_test_block_bitmap( bmap, begin)))
+ break;
+ }
+ *p_blk = begin;
+ if (begin >= ds_bmap->real_end)
+ return 0;
+
+ i = 0;
+ for (end = begin,count=1 ; ((count <= MAX_RANGE) && (end < ds_bmap->real_end)); ){
+ if (ext2fs_test_block_bitmap(d_bmap, end) && (! ext2fs_test_block_bitmap( bmap, end))){
+ count++;
+ if (!begin)
+ begin = end;
+ *p_flag = end++;
+ p_flag++;
+ i++;
+ }
+ else {
+ if (i){
+ if (io_channel_read_blk ( current_fs->io, begin , i, buf )){
+ fprintf(stderr,"ERROR: while read block %10u + %d\n",begin,count);
+ return 0;
+ }
+ }
+ end++;
+ buf += (current_fs->blocksize *i);
+ begin = 0;
+ i = 0;
+ }
+ }
+ *(p_blk+1) = end;
+ if (io_channel_read_blk ( current_fs->io, begin , i, buf )){
+ fprintf(stderr,"ERROR: while read block %10u + %d\n",begin,count);
+ return 0;
+ }
+return count-1;
+}
+
+
+
+blk_t block_backward(blk_t blk , int count){
+ int i=count;
+ while (i && blk){
+ if (ext2fs_test_block_bitmap(d_bmap, blk) && (! ext2fs_test_block_bitmap( bmap, blk)))
+ i--;
+ blk--;
+ }
+ return (!i) ? blk+1 : 0;
+}
+
+
+
+
//magic_block_scan_main
int magic_block_scan(char* des_dir, __u32 t_after){
magic_t cookie = 0;
@@ -538,11 +614,13 @@ struct ext2fs_struct_loc_generic_bitmap *ds_bmap;
struct found_data_t *file_data = NULL;
blk_t blk[2] ;
blk_t j;
+blk_t flag[MAX_RANGE];
+blk_t fragment_flag;
char *buf = NULL;
char *magic_buf = NULL;
char *tmp_buf = NULL;
-int blocksize, ds_retval,count,i;// step;
-__u32 scan,follow;
+int blocksize, ds_retval,count,i,ret;
+__u32 scan,follow, size;
blocksize = current_fs->blocksize ;
@@ -576,10 +654,12 @@ while (ds_retval){
while (count){
printf(" %d %d %d\n", blk[0],blk[1],count);
for (i = 0; i< ((count>12) ? MAX_RANGE - 12 : count) ;i++){
- scan = magic_check_block(buf+(i*blocksize), cookie, cookie_f , magic_buf , blocksize ,blk[0]+i);
- if(scan & (M_DATA | M_BLANK | M_IS_META))
+ scan = magic_check_block(buf+(i*blocksize), cookie, cookie_f , magic_buf , blocksize * ((count >=9) ? 9 : count) ,blk[0]+i);
+ if(scan & (M_DATA | M_BLANK | M_IS_META)){
+ if (scan & (M_ACL | M_EXT4_META | M_DIR))
+ ext2fs_mark_generic_bitmap(bmap, blk[0]+i);
continue;
-
+ }
printf("SCAN %d : %09x : %s\n",blk[0]+i,scan,magic_buf);
if (((count -i) > 12) && (ext2fs_le32_to_cpu(*(__u32*)(buf +((i+12)*blocksize))) == blk[0] + i +1 + 12)){
follow = 0;
@@ -606,16 +686,101 @@ while (ds_retval){
// printf(" %d not matches %d == %d \n\n\n", blk[0]+i, ext2fs_le32_to_cpu(*(buf +((i+12)*blocksize))), blk[0] + i + 12+1);
}
}
-
-
-
-
blk[0] += (i)?i:1;
count = get_range(blk ,ds_bmap,buf);
+ }
+ count = 0;
+ blk[0] = 0;
+ fragment_flag = 0;
+ count = get_full_range(blk ,ds_bmap, buf,flag);
+ while (count){
+ printf("%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d - %d\n",flag[0],flag[1],flag[2],flag[3],flag[4],flag[5],flag[6],flag[7],flag[8],flag[9],flag[10],flag[11],flag[12],flag[13],flag[14],flag[15],count);
+
+ for (i = 0; i< ((count>12) ? MAX_RANGE - 12 : count) ;i++){
+ follow = 0;
+ scan = magic_check_block(buf+(i*blocksize), cookie, cookie_f , magic_buf , blocksize ,blk[0]+i);
+ if(scan & (M_DATA | M_BLANK | M_IS_META)){
+ continue;
+ }
+ printf("SCAN %d : %09x : %s\n",blk[0]+i,scan,magic_buf);
+ if (((count -i) > 12) && (ext2fs_le32_to_cpu(*(__u32*)(buf +((i+12)*blocksize))) == flag[12+i]+1)){
+ file_data = new_file_data(flag[i],scan,magic_buf,buf+(i*blocksize),&follow);
+ for(j=i; j<(12+i);j++)
+ add_file_data(file_data, flag[j], scan ,&follow);
+ scan = magic_check_block(buf+((i+12)*blocksize), cookie, cookie_f , magic_buf , blocksize ,blk[0]+i+12);
+ if (scan & M_EXT3_META){
+ if (add_ext3_file_meta_data(file_data, buf+((i+12)*blocksize), flag[j])){
+ io_channel_read_blk (current_fs->io, file_data->last, 1, tmp_buf);
+ file_data = soft_border(des_dir, tmp_buf, file_data, &follow, j);
+ break;
+ }
+ else
+ file_data = forget_file_data(file_data, &follow);
+ }
+ else
+ file_data = forget_file_data(file_data, &follow);
+ }
+ else{
+ if (scan & M_IS_FILE){
+
+ for (j=i; j< 12+i; j++){
+ if (!follow){
+ file_data = new_file_data(flag[i],scan,magic_buf,buf+(i*blocksize),&follow);
+ add_file_data(file_data, flag[i], scan ,&follow);
+ }
+ else{
+ scan = magic_check_block(buf+(j*blocksize), cookie, cookie_f , magic_buf , blocksize ,flag[j]);
+ if ( check_file_data_possible(file_data, scan ,buf+(j*blocksize))){
+ add_file_data(file_data, flag[j], scan ,&follow);
+ }
+ else{
+ j--;
+ file_data = soft_border(des_dir,buf+(j*blocksize), file_data, &follow, flag[j]);
+ if ((!fragment_flag) && (scan & M_EXT3_META) && (check_indirect_meta3(buf+((j+1)*blocksize)))){
+ printf("try a fragment recover for metablock %ld\n",flag[j]+1);
+ blk[1] = block_backward(flag[j] , 12);
+ if (blk[1]){
+ blk[0] = blk[1];
+ fragment_flag = flag[j+1];
+ goto load_new;
+ }
+ }
+ break;
+ }
+
+ }
+ size = (scan & M_SIZE ); //get_block_len(buf+(i*blocksize));
+ ret = file_data->func(buf+(j*blocksize), &size ,scan ,0 , file_data);
+ if (ret ==1){
+ if (file_data_correct_size(file_data,size)){
+ file_data = recover_file_data(des_dir, file_data, &follow);
+ }
+ else{
+ file_data = forget_file_data(file_data, &follow);
+ printf("Don't recover this file, current block %d \n",blk);
+ }
+ break;
+ }
+ }
+ if (follow){
+ printf("stop no file-end\n");
+ file_data = soft_border(des_dir,buf+((j-1)*blocksize), file_data, &follow, flag[j-1]);
+ i = j - 11;
+ }
+ else
+ i = j;
+ }
+
+ }
+ }
+ blk[0]+=(i)?i:1;
+ if (fragment_flag && (blk[0] > fragment_flag))
+ fragment_flag = 0;
+load_new :
+ count = get_full_range(blk ,ds_bmap, buf,flag);
}
-
}//operation
} //while transactions
diff --git a/src/util.h b/src/util.h
index 9912b2c..03263c8 100644
--- a/src/util.h
+++ b/src/util.h
@@ -59,6 +59,7 @@
#define M_IS_CHARSET 0x07000000
#define M_ARCHIV 0x08000000
+#define M_TAR 0x00008000
#define M_ACL 0x80000000
#define M_EXT4_META 0x40000000
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-27 04:15:36 +0000