Skip to content
Snippets Groups Projects
Commit 819ffc90 authored by Brian Carrier's avatar Brian Carrier
Browse files

updated Mac read to be in block-sized chunks

parent 14bf880b
No related branches found
No related tags found
No related merge requests found
...@@ -25,7 +25,8 @@ ...@@ -25,7 +25,8 @@
static uint8_t static uint8_t
mac_load_table(TSK_VS_INFO * vs) mac_load_table(TSK_VS_INFO * vs)
{ {
mac_part part; char *part_buf;
mac_part *part;
char *table_str; char *table_str;
uint32_t idx, max_part; uint32_t idx, max_part;
TSK_DADDR_T taddr = vs->offset / vs->block_size + MAC_PART_SOFFSET; TSK_DADDR_T taddr = vs->offset / vs->block_size + MAC_PART_SOFFSET;
...@@ -37,8 +38,11 @@ mac_load_table(TSK_VS_INFO * vs) ...@@ -37,8 +38,11 @@ mac_load_table(TSK_VS_INFO * vs)
/* The table can be variable length, so we loop on it /* The table can be variable length, so we loop on it
* The idx variable shows which round it is * The idx variable shows which round it is
* Each structure is 512-bytes each * Each structure is a block size
*/ */
if ((part_buf = tsk_malloc(vs->block_size)) == NULL)
return 1;
part = (mac_part *)part_buf;
max_part = 1; /* set it to 1 and it will be set in the first loop */ max_part = 1; /* set it to 1 and it will be set in the first loop */
for (idx = 0; idx < max_part; idx++) { for (idx = 0; idx < max_part; idx++) {
...@@ -50,16 +54,17 @@ mac_load_table(TSK_VS_INFO * vs) ...@@ -50,16 +54,17 @@ mac_load_table(TSK_VS_INFO * vs)
/* Read the entry */ /* Read the entry */
cnt = tsk_vs_read_block cnt = tsk_vs_read_block
(vs, MAC_PART_SOFFSET + idx, (char *) &part, sizeof(part)); (vs, MAC_PART_SOFFSET + idx, part_buf, vs->block_size);
/* If -1, then tsk_errno is already set */ /* If -1, then tsk_errno is already set */
if (cnt != sizeof(part)) { if (cnt != vs->block_size) {
if (cnt >= 0) { if (cnt >= 0) {
tsk_error_reset(); tsk_error_reset();
tsk_errno = TSK_ERR_VS_READ; tsk_errno = TSK_ERR_VS_READ;
} }
snprintf(tsk_errstr2, TSK_ERRSTR_L, snprintf(tsk_errstr2, TSK_ERRSTR_L,
"MAC Partition entry %" PRIuDADDR, taddr + idx); "MAC Partition entry %" PRIuDADDR, taddr + idx);
free(part_buf);
return 1; return 1;
} }
...@@ -67,43 +72,45 @@ mac_load_table(TSK_VS_INFO * vs) ...@@ -67,43 +72,45 @@ mac_load_table(TSK_VS_INFO * vs)
/* Sanity Check */ /* Sanity Check */
if (idx == 0) { if (idx == 0) {
/* Set the endian ordering the first time around */ /* Set the endian ordering the first time around */
if (tsk_vs_guessu16(vs, part.magic, MAC_MAGIC)) { if (tsk_vs_guessu16(vs, part->magic, MAC_MAGIC)) {
tsk_error_reset(); tsk_error_reset();
tsk_errno = TSK_ERR_VS_MAGIC; tsk_errno = TSK_ERR_VS_MAGIC;
snprintf(tsk_errstr, TSK_ERRSTR_L, snprintf(tsk_errstr, TSK_ERRSTR_L,
"Mac partition table entry (Sector: %" "Mac partition table entry (Sector: %"
PRIuDADDR ") %" PRIx16, PRIuDADDR ") %" PRIx16,
(taddr + idx), tsk_getu16(vs->endian, part.magic)); (taddr + idx), tsk_getu16(vs->endian, part->magic));
if (tsk_verbose) if (tsk_verbose)
tsk_fprintf(stderr, "mac_load: Missing initial magic value\n"); tsk_fprintf(stderr, "mac_load: Missing initial magic value\n");
free(part_buf);
return 1; return 1;
} }
/* Get the number of partitions */ /* Get the number of partitions */
max_part = tsk_getu32(vs->endian, part.pmap_size); max_part = tsk_getu32(vs->endian, part->pmap_size);
} }
else if (tsk_getu16(vs->endian, part.magic) != MAC_MAGIC) { else if (tsk_getu16(vs->endian, part->magic) != MAC_MAGIC) {
tsk_error_reset(); tsk_error_reset();
tsk_errno = TSK_ERR_VS_MAGIC; tsk_errno = TSK_ERR_VS_MAGIC;
snprintf(tsk_errstr, TSK_ERRSTR_L, snprintf(tsk_errstr, TSK_ERRSTR_L,
"Mac partition table entry (Sector: %" "Mac partition table entry (Sector: %"
PRIuDADDR ") %" PRIx16, (taddr + idx), PRIuDADDR ") %" PRIx16, (taddr + idx),
tsk_getu16(vs->endian, part.magic)); tsk_getu16(vs->endian, part->magic));
if (tsk_verbose) if (tsk_verbose)
tsk_fprintf(stderr, "mac_load: Missing magic value in entry %"PRIu32"\n", tsk_fprintf(stderr, "mac_load: Missing magic value in entry %"PRIu32"\n",
idx); idx);
free(part_buf);
return 1; return 1;
} }
part_start = tsk_getu32(vs->endian, part.start_sec); part_start = tsk_getu32(vs->endian, part->start_sec);
part_size = tsk_getu32(vs->endian, part.size_sec); part_size = tsk_getu32(vs->endian, part->size_sec);
if (tsk_verbose) if (tsk_verbose)
tsk_fprintf(stderr, tsk_fprintf(stderr,
"mac_load: %" PRIu32 " Starting Sector: %" PRIu32 "mac_load: %" PRIu32 " Starting Sector: %" PRIu32
" Size: %" PRIu32 " Type: %s\n", idx, part_start, " Size: %" PRIu32 " Type: %s\n", idx, part_start,
part_size, part.type); part_size, part->type);
if (part_size == 0) if (part_size == 0)
continue; continue;
...@@ -116,29 +123,36 @@ mac_load_table(TSK_VS_INFO * vs) ...@@ -116,29 +123,36 @@ mac_load_table(TSK_VS_INFO * vs)
if (tsk_verbose) if (tsk_verbose)
tsk_fprintf(stderr, "mac_load: Starting sector too large for image (%"PRIu32" vs %"PRIu32")\n", tsk_fprintf(stderr, "mac_load: Starting sector too large for image (%"PRIu32" vs %"PRIu32")\n",
part_start, max_addr); part_start, max_addr);
free(part_buf);
return 1; return 1;
} }
if ((str = tsk_malloc(sizeof(part.name))) == NULL) if ((str = tsk_malloc(sizeof(part->name))) == NULL) {
free(part_buf);
return 1; return 1;
}
strncpy(str, (char *) part.type, sizeof(part.name)); strncpy(str, (char *) part->type, sizeof(part->name));
if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) part_start, if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) part_start,
(TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_ALLOC, str, -1, (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_ALLOC, str, -1,
idx)) idx))
return 1; return 1;
} }
free(part_buf);
part_buf = NULL;
/* Add an entry for the table length */ /* Add an entry for the table length */
if ((table_str = tsk_malloc(16)) == NULL) if ((table_str = tsk_malloc(16)) == NULL) {
return 1; return 1;
}
snprintf(table_str, 16, "Table"); snprintf(table_str, 16, "Table");
if (NULL == tsk_vs_part_add(vs, taddr, max_part, TSK_VS_PART_FLAG_META, if (NULL == tsk_vs_part_add(vs, taddr, max_part, TSK_VS_PART_FLAG_META,
table_str, -1, -1)) table_str, -1, -1)) {
return 1; return 1;
}
return 0; return 0;
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment