diff --git a/.gitignore b/.gitignore index ec36fca6ef11652f80fa9664739b9589e6b6cdfc..878e12c33b52a54f235f173cf923395fa7dbbe95 100755 --- a/.gitignore +++ b/.gitignore @@ -144,6 +144,7 @@ tests/fs_thread_test tests/read_apis tools/autotools/tsk_comparedir tools/autotools/tsk_gettimes +tools/autotools/tsk_imageinfo tools/autotools/tsk_loaddb tools/autotools/tsk_recover tools/fiwalk/plugins/jpeg_extract diff --git a/tsk/auto/db_sqlite.cpp b/tsk/auto/db_sqlite.cpp index 4a402ee37f4f51899645b8786ff6f74f44d23b74..373c9440a3833fde25d007a933e22b43341ee8da 100644 --- a/tsk/auto/db_sqlite.cpp +++ b/tsk/auto/db_sqlite.cpp @@ -701,7 +701,7 @@ int TskDbSqlite::addImageInfo(int type, TSK_OFF_T ssize, int64_t & objId, const { // Use a GUID as the default. GuidGenerator generator; - Guid guid = generator.newGuid(); + TSKGuid guid = generator.newGuid(); deviceIdStr << guid; } else diff --git a/tsk/auto/guid.cpp b/tsk/auto/guid.cpp index efdc98a2e5a31ada378085737ac72fde17bc1747..015233793f887872f222a682e56b6eaf47cf1dbc 100755 --- a/tsk/auto/guid.cpp +++ b/tsk/auto/guid.cpp @@ -43,7 +43,7 @@ THE SOFTWARE. using namespace std; // overload << so that it's easy to convert to a string -ostream &operator<<(ostream &s, const Guid &guid) +ostream &operator<<(ostream &s, const TSKGuid &guid) { return s << hex << setfill('0') << setw(2) << (int)guid._bytes[0] @@ -69,13 +69,13 @@ ostream &operator<<(ostream &s, const Guid &guid) } // create a guid from vector of bytes -Guid::Guid(const vector<unsigned char> &bytes) +TSKGuid::TSKGuid(const vector<unsigned char> &bytes) { _bytes = bytes; } // create a guid from array of bytes -Guid::Guid(const unsigned char *bytes) +TSKGuid::TSKGuid(const unsigned char *bytes) { _bytes.assign(bytes, bytes + 16); } @@ -102,7 +102,7 @@ unsigned char hexPairToChar(char a, char b) } // create a guid from string -Guid::Guid(const string &fromString) +TSKGuid::TSKGuid(const string &fromString) { _bytes.clear(); @@ -133,18 +133,18 @@ Guid::Guid(const string &fromString) } // create empty guid -Guid::Guid() +TSKGuid::TSKGuid() { _bytes = vector<unsigned char>(16, 0); } // copy constructor -Guid::Guid(const Guid &other) +TSKGuid::TSKGuid(const TSKGuid &other) { _bytes = other._bytes; } -std::string Guid::str() const { +std::string TSKGuid::str() const { std::stringstream ss; ss << (*this); @@ -152,20 +152,20 @@ std::string Guid::str() const { } // overload assignment operator -Guid &Guid::operator=(const Guid &other) +TSKGuid &TSKGuid::operator=(const TSKGuid &other) { _bytes = other._bytes; return *this; } // overload equality operator -bool Guid::operator==(const Guid &other) const +bool TSKGuid::operator==(const TSKGuid &other) const { return _bytes == other._bytes; } // overload inequality operator -bool Guid::operator!=(const Guid &other) const +bool TSKGuid::operator!=(const TSKGuid &other) const { return !((*this) == other); } @@ -173,7 +173,7 @@ bool Guid::operator!=(const Guid &other) const // This is the linux friendly implementation, but it could work on other // systems that have libuuid available #ifdef GUID_LIBUUID -Guid GuidGenerator::newGuid() +TSKGuid GuidGenerator::newGuid() { uuid_t id; uuid_generate(id); @@ -183,7 +183,7 @@ Guid GuidGenerator::newGuid() // this is the mac and ios version #ifdef GUID_CFUUID -Guid GuidGenerator::newGuid() +TSKGuid GuidGenerator::newGuid() { CFUUIDRef newId = CFUUIDCreate(NULL); CFUUIDBytes bytes = CFUUIDGetUUIDBytes(newId); @@ -214,7 +214,7 @@ Guid GuidGenerator::newGuid() // obviously this is the windows version #ifdef GUID_WINDOWS -Guid GuidGenerator::newGuid() +TSKGuid GuidGenerator::newGuid() { GUID newId; CoCreateGuid(&newId); @@ -257,7 +257,7 @@ GuidGenerator::GuidGenerator(JNIEnv *env) _leastSignificantBitsMethod = env->GetMethodID(_uuidClass, "getLeastSignificantBits", "()J"); } -Guid GuidGenerator::newGuid() +TSKGuid GuidGenerator::newGuid() { jobject javaUuid = _env->CallStaticObjectMethod(_uuidClass, _newGuidMethod); jlong mostSignificant = _env->CallLongMethod(javaUuid, _mostSignificantBitsMethod); diff --git a/tsk/auto/guid.h b/tsk/auto/guid.h index fd0780d1b2233a7df8bcc85c6398b9c7ceaed4bd..642a44efa9d1539d172999d0bcd823cab42461d9 100755 --- a/tsk/auto/guid.h +++ b/tsk/auto/guid.h @@ -38,34 +38,34 @@ THE SOFTWARE. // 16 byte value that can be passed around by value. It also supports // conversion to string (via the stream operator <<) and conversion from a // string via constructor. -class Guid +class TSKGuid { public: // create a guid from vector of bytes - Guid(const std::vector<unsigned char> &bytes); + TSKGuid(const std::vector<unsigned char> &bytes); // create a guid from array of bytes - Guid(const unsigned char *bytes); + TSKGuid(const unsigned char *bytes); // create a guid from string - Guid(const std::string &fromString); + TSKGuid(const std::string &fromString); // create empty guid - Guid(); + TSKGuid(); - Guid(Guid &&) = default; + TSKGuid(TSKGuid &&) = default; // copy constructor - Guid(const Guid &other); + TSKGuid(const TSKGuid &other); // overload assignment operator - Guid &operator=(const Guid &other); - Guid &operator=(Guid &&) = default; + TSKGuid &operator=(const TSKGuid &other); + TSKGuid &operator=(TSKGuid &&) = default; // overload equality and inequality operator - bool operator==(const Guid &other) const; - bool operator!=(const Guid &other) const; + bool operator==(const TSKGuid &other) const; + bool operator!=(const TSKGuid &other) const; std::string str() const; @@ -79,7 +79,7 @@ class Guid std::vector<unsigned char> _bytes; // make the << operator a friend so it can access _bytes - friend std::ostream &operator<<(std::ostream &s, const Guid &guid); + friend std::ostream &operator<<(std::ostream &s, const TSKGuid &guid); }; // Class that can create new guids. The only reason this exists instead of @@ -98,7 +98,7 @@ class GuidGenerator GuidGenerator() { } #endif - Guid newGuid(); + TSKGuid newGuid(); #ifdef GUID_ANDROID private: diff --git a/tsk/fs/apfs.cpp b/tsk/fs/apfs.cpp index 137e1d95b39934fb746b67f22e1306a8af7fdad3..229a04447f488c7c4f10eb33d9b224d10f8a3277 100644 --- a/tsk/fs/apfs.cpp +++ b/tsk/fs/apfs.cpp @@ -345,9 +345,9 @@ APFSFileSystem::APFSFileSystem(const APFSPool& pool, } } -APFSFileSystem::wrapped_kek::wrapped_kek(Guid&& id, +APFSFileSystem::wrapped_kek::wrapped_kek(TSKGuid&& id, const std::unique_ptr<uint8_t[]>& kp) - : uuid{std::forward<Guid>(id)} { + : uuid{std::forward<TSKGuid>(id)} { // Parse KEK wrapped_key_parser wp{kp.get()}; @@ -384,11 +384,11 @@ APFSFileSystem::APFSFileSystem(const APFSPool& pool, // These are the known special recovery UUIDs. The ones that are commented out // are currently supported. static const auto unsupported_recovery_keys = { - Guid{"c064ebc6-0000-11aa-aa11-00306543ecac"}, // Institutional Recovery - Guid{"2fa31400-baff-4de7-ae2a-c3aa6e1fd340"}, // Institutional User - // Guid{"ebc6C064-0000-11aa-aa11-00306543ecac"}, // Personal Recovery - Guid{"64c0c6eb-0000-11aa-aa11-00306543ecac"}, // iCould Recovery - Guid{"ec1c2ad9-b618-4ed6-bd8d-50f361c27507"}, // iCloud User + TSKGuid{"c064ebc6-0000-11aa-aa11-00306543ecac"}, // Institutional Recovery + TSKGuid{"2fa31400-baff-4de7-ae2a-c3aa6e1fd340"}, // Institutional User + // TSKGuid{"ebc6C064-0000-11aa-aa11-00306543ecac"}, // Personal Recovery + TSKGuid{"64c0c6eb-0000-11aa-aa11-00306543ecac"}, // iCould Recovery + TSKGuid{"ec1c2ad9-b618-4ed6-bd8d-50f361c27507"}, // iCloud User }; void APFSFileSystem::init_crypto_info() { @@ -1000,7 +1000,7 @@ APFSKeybag::APFSKeybag(const APFSPool& pool, const apfs_block_num block_num, } } -std::unique_ptr<uint8_t[]> APFSKeybag::get_key(const Guid& uuid, +std::unique_ptr<uint8_t[]> APFSKeybag::get_key(const TSKGuid& uuid, uint16_t type) const { if (kb()->num_entries == 0) { return nullptr; diff --git a/tsk/fs/tsk_apfs.hpp b/tsk/fs/tsk_apfs.hpp index ab549ce43a7055fd0e9a06a48375363c0b832304..fc0bd169580b7b76895d69784f34b2fa3c7d48b3 100755 --- a/tsk/fs/tsk_apfs.hpp +++ b/tsk/fs/tsk_apfs.hpp @@ -828,7 +828,7 @@ class APFSKeybag : public APFSObject { } using key = struct { - Guid uuid; + TSKGuid uuid; std::unique_ptr<uint8_t[]> data; uint16_t type; }; @@ -837,7 +837,7 @@ class APFSKeybag : public APFSObject { APFSKeybag(const APFSPool &pool, const apfs_block_num block_num, const uint8_t *key, const uint8_t *key2 = nullptr); - std::unique_ptr<uint8_t[]> get_key(const Guid &uuid, uint16_t type) const; + std::unique_ptr<uint8_t[]> get_key(const TSKGuid &uuid, uint16_t type) const; std::vector<key> get_keys() const; }; @@ -876,7 +876,7 @@ class APFSSuperblock : public APFSObject { return spaceman().num_free_blocks(); } - inline Guid uuid() const { return {sb()->uuid}; } + inline TSKGuid uuid() const { return {sb()->uuid}; } const std::vector<apfs_block_num> volume_blocks() const; const std::vector<apfs_block_num> sm_bitmap_blocks() const; @@ -961,12 +961,12 @@ class APFSFileSystem : public APFSObject { }; struct wrapped_kek { - Guid uuid; + TSKGuid uuid; uint8_t data[0x28]; uint64_t iterations; uint64_t flags; uint8_t salt[0x10]; - wrapped_kek(Guid &&uuid, const std::unique_ptr<uint8_t[]> &); + wrapped_kek(TSKGuid &&uuid, const std::unique_ptr<uint8_t[]> &); inline bool hw_crypt() const noexcept { // If this bit is set, some sort of hardware encryption is used. @@ -1032,7 +1032,7 @@ class APFSFileSystem : public APFSObject { bool unlock(const std::string &password) noexcept; - inline Guid uuid() const noexcept { return {fs()->uuid}; } + inline TSKGuid uuid() const noexcept { return {fs()->uuid}; } inline std::string name() const { return {fs()->name}; } diff --git a/tsk/pool/tsk_pool.hpp b/tsk/pool/tsk_pool.hpp index 26f30fbc959e30db988bf3d1e87a61eff4e0cbc4..05986541591bc179cce9526e942ec2b9e62d0e21 100644 --- a/tsk/pool/tsk_pool.hpp +++ b/tsk/pool/tsk_pool.hpp @@ -38,7 +38,7 @@ class TSKPool { virtual ~TSKPool() = default; - inline const Guid &uuid() const { return _uuid; } + inline const TSKGuid &uuid() const { return _uuid; } inline uint32_t block_size() const noexcept { return _block_size; } inline uint32_t dev_block_size() const noexcept { return _dev_block_size; } @@ -67,7 +67,7 @@ class TSKPool { TSKPool(std::vector<img_t> &&imgs) noexcept : _members{std::move(imgs)} {} std::vector<img_t> _members{}; - Guid _uuid{}; + TSKGuid _uuid{}; uint64_t _num_blocks; int _num_vols; uint32_t _block_size{};