diff --git a/tsk/base/tsk_base_i.h b/tsk/base/tsk_base_i.h index 4506b93e3902189ae746893131681110d3c4712f..d797872970258687defd25d9930089de7fa60a1e 100644 --- a/tsk/base/tsk_base_i.h +++ b/tsk/base/tsk_base_i.h @@ -67,6 +67,9 @@ extern "C" { uint16_t); extern uint8_t tsk_guess_end_u32(TSK_ENDIAN_ENUM *, uint8_t *, uint32_t); + extern uint8_t tsk_guess_end_u64(TSK_ENDIAN_ENUM *, uint8_t *, + uint64_t); + /** \internal * Read a 16-bit unsigned value. diff --git a/tsk/base/tsk_endian.c b/tsk/base/tsk_endian.c index fb75250e6e66948858d6c955fbbcdccd9ca8f84c..a69bdcbf265aa35b05eda5842ba790e71116da20 100644 --- a/tsk/base/tsk_endian.c +++ b/tsk/base/tsk_endian.c @@ -74,3 +74,29 @@ tsk_guess_end_u32(TSK_ENDIAN_ENUM * flag, uint8_t * x, uint32_t val) return 1; } + +/** \internal + * same idea as tsk_guess_end_u16 except that val is a 64-bit value + * +* @param flag Pointer to location where proper endian flag should be stored. +* @param x Pointer to array of bytes to analyze. +* @param val Target value to compare to +* @returns 1 if match cannot be made, 0 if it can. + */ +uint8_t +tsk_guess_end_u64(TSK_ENDIAN_ENUM * flag, uint8_t * x, uint64_t val) +{ + /* try little */ + if (tsk_getu64(TSK_LIT_ENDIAN, x) == val) { + *flag = TSK_LIT_ENDIAN; + return 0; + } + + /* ok, big now */ + if (tsk_getu64(TSK_BIG_ENDIAN, x) == val) { + *flag = TSK_BIG_ENDIAN; + return 0; + } + + return 1; +} diff --git a/tsk/fs/tsk_fs_i.h b/tsk/fs/tsk_fs_i.h index 58df7e96f478c8b5c6c105b2124abf1f3acb46e7..ee15e2734e60ab63bf4695f1cf4ddee4e972fc70 100644 --- a/tsk/fs/tsk_fs_i.h +++ b/tsk/fs/tsk_fs_i.h @@ -239,6 +239,8 @@ extern "C" { tsk_guess_end_u16(&(fs->endian), (x), (mag)) #define tsk_fs_guessu32(fs, x, mag) \ tsk_guess_end_u32(&(fs->endian), (x), (mag)) +#define tsk_fs_guessu64(fs, x, mag) \ + tsk_guess_end_u64(&(fs->endian), (x), (mag)) #ifdef __cplusplus } #endif /* */ diff --git a/tsk/vs/gpt.c b/tsk/vs/gpt.c index d14bd1bb41d42aa6814ccb45f933f463a5134e31..9ff999089b7becf5aa8071a3ab04fb300282370a 100644 --- a/tsk/vs/gpt.c +++ b/tsk/vs/gpt.c @@ -22,7 +22,7 @@ * It is loaded into the internal sorted list */ static uint8_t -gpt_load_table(TSK_VS_INFO * vs, GPT_TYPE_ENUM gpt_type) +gpt_load_table(TSK_VS_INFO * vs, GPT_LOCATION_ENUM gpt_type) { gpt_head *head; gpt_entry *ent; @@ -35,12 +35,8 @@ gpt_load_table(TSK_VS_INFO * vs, GPT_TYPE_ENUM gpt_type) TSK_DADDR_T max_addr = (vs->img_info->size - vs->offset) / vs->block_size; // max sector TSK_DADDR_T gpt_relative_addr; TSK_DADDR_T gpt_absolute_addr; - TSK_DADDR_T dos_sect_relative_addr; - TSK_DADDR_T dos_sect_absolute_addr; if(gpt_type == PRIMARY_TABLE){ - dos_sect_relative_addr = GPT_PART_SOFFSET; - dos_sect_absolute_addr = vs->offset / vs->block_size + GPT_PART_SOFFSET; gpt_relative_addr = GPT_PART_SOFFSET + 1; gpt_absolute_addr = vs->offset / vs->block_size + GPT_PART_SOFFSET + 1; } else { @@ -48,7 +44,6 @@ gpt_load_table(TSK_VS_INFO * vs, GPT_TYPE_ENUM gpt_type) gpt_absolute_addr = (vs->img_info->size / vs->block_size) - 1; } - if (tsk_verbose) tsk_fprintf(stderr, "gpt_load_table: Sector: %" PRIuDADDR "\n", gpt_absolute_addr); @@ -57,6 +52,8 @@ gpt_load_table(TSK_VS_INFO * vs, GPT_TYPE_ENUM gpt_type) return 1; if(gpt_type == PRIMARY_TABLE){ + TSK_DADDR_T dos_sect_relative_addr = GPT_PART_SOFFSET; + TSK_DADDR_T dos_sect_absolute_addr = vs->offset / vs->block_size + GPT_PART_SOFFSET; dos_part = (dos_sect *) sect_buf; cnt = tsk_vs_read_block @@ -113,10 +110,13 @@ gpt_load_table(TSK_VS_INFO * vs, GPT_TYPE_ENUM gpt_type) /* Do the endianness test for the secondary table since the test in the dos safety table was skipped */ if(gpt_type == SECONDARY_TABLE){ - if(tsk_getu64(TSK_BIG_ENDIAN, head->head_lba) == gpt_relative_addr){ - vs->endian = TSK_BIG_ENDIAN; - } else { - vs->endian = TSK_LIT_ENDIAN; + if (tsk_vs_guessu64(vs, head->signature, GPT_HEAD_SIG)) { + tsk_error_reset(); + tsk_error_set_errno(TSK_ERR_VS_MAGIC); + tsk_error_set_errstr("GPT Header: %" PRIx64, tsk_getu64(vs->endian, + &head->signature)); + free(sect_buf); + return 1; } } diff --git a/tsk/vs/tsk_gpt.h b/tsk/vs/tsk_gpt.h index d74a4fef45a721d80bf37bae2fecf29729125906..81a09b0474a28086b0a32b01e1326cbeb84b9501 100644 --- a/tsk/vs/tsk_gpt.h +++ b/tsk/vs/tsk_gpt.h @@ -60,7 +60,7 @@ extern "C" { typedef enum { PRIMARY_TABLE, SECONDARY_TABLE, - } GPT_TYPE_ENUM; + } GPT_LOCATION_ENUM; #ifdef __cplusplus diff --git a/tsk/vs/tsk_vs_i.h b/tsk/vs/tsk_vs_i.h index cb2c5aeeb818b0ac8d17eb70a311f5bcfb9733ad..910657692c41e160bda965603742d1ce663d8e7e 100644 --- a/tsk/vs/tsk_vs_i.h +++ b/tsk/vs/tsk_vs_i.h @@ -41,4 +41,8 @@ extern void tsk_vs_part_free(TSK_VS_INFO *); #define tsk_vs_guessu32(vs, x, mag) \ tsk_guess_end_u32(&(vs->endian), (x), (mag)) + +#define tsk_vs_guessu64(vs, x, mag) \ + tsk_guess_end_u64(&(vs->endian), (x), (mag)) + #endif