From ad2f6767015f6cc9737ebff0c990e945aca0a3ba Mon Sep 17 00:00:00 2001 From: Brian Carrier <carrier@sleuthkit.org> Date: Fri, 25 Mar 2011 19:44:06 +0000 Subject: [PATCH] Fixed some RAW CD issues and added offset of 24 bytes to choices --- tsk3/fs/fs_io.c | 72 ++++++++++++++++++----- tsk3/fs/iso9660.c | 7 +++ xcode/sleuthkit.xcodeproj/project.pbxproj | 1 + 3 files changed, 66 insertions(+), 14 deletions(-) diff --git a/tsk3/fs/fs_io.c b/tsk3/fs/fs_io.c index 1a2d3149a..c99dca2e2 100644 --- a/tsk3/fs/fs_io.c +++ b/tsk3/fs/fs_io.c @@ -38,7 +38,7 @@ ssize_t tsk_fs_read(TSK_FS_INFO * a_fs, TSK_OFF_T a_off, char *a_buf, size_t a_len) { - TSK_OFF_T off; + TSK_OFF_T off = 0; // do a sanity check on the read bounds, but only if the block // value has been set. @@ -61,15 +61,40 @@ tsk_fs_read(TSK_FS_INFO * a_fs, TSK_OFF_T a_off, char *a_buf, size_t a_len) } off = a_off + a_fs->offset; + if (((a_fs->block_pre_size) || (a_fs->block_post_size)) && (a_fs->block_size)) { - TSK_DADDR_T blk = a_off / a_fs->block_size; - if (a_fs->block_pre_size) - off += ((blk+1) * a_fs->block_pre_size); - if (a_fs->block_post_size) - off += (blk * a_fs->block_post_size); - } + TSK_OFF_T cur_off = a_off; + ssize_t retval = 0; + TSK_OFF_T end_addr = a_off + a_len; - return tsk_img_read(a_fs->img_info, off, a_buf, a_len); + // we need to read block by block so that we can skip the needed pre and post bytes + while (cur_off < end_addr) { + TSK_DADDR_T blk = cur_off / a_fs->block_size; + TSK_OFF_T read_off = off; + ssize_t retval2 = 0; + size_t read_len = a_fs->block_size - cur_off % a_fs->block_size; + + if (read_len + cur_off > end_addr) + read_len = end_addr - cur_off; + + if (a_fs->block_pre_size) + read_off += ((blk+1) * a_fs->block_pre_size); + if (a_fs->block_post_size) + read_off += (blk * a_fs->block_post_size); + + retval2 = tsk_img_read(a_fs->img_info, read_off, &a_buf[retval], read_len); + if (retval2 == -1) + return -1; + else if (retval2 == 0) + break; + retval += retval2; + cur_off += retval2; + } + return retval; + } + else { + return tsk_img_read(a_fs->img_info, off, a_buf, a_len); + } } @@ -114,12 +139,31 @@ tsk_fs_read_block(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr, char *a_buf, PRIuDADDR ")", a_addr); return -1; } + + off = a_fs->offset + (TSK_OFF_T) (a_addr) * a_fs->block_size; + if ((a_fs->block_pre_size == 0) && (a_fs->block_post_size == 0)) { + return tsk_img_read(a_fs->img_info, off, a_buf, a_len); + } + else { + size_t i; + ssize_t retval = 0; + + for (i = 0; i < a_len; i++) { + ssize_t retval2; + TSK_OFF_T off2 = off + i*a_fs->block_size; + off += ((a_addr+1) * a_fs->block_pre_size); + off += (a_addr * a_fs->block_post_size); + + retval2 = tsk_img_read(a_fs->img_info, off2, &a_buf[retval], a_fs->block_size); + if (retval2 == -1) + return -1; + else if (retval2 == 0) + break; + + retval += retval2; + } + return retval; + } - off = a_fs->offset + (TSK_OFF_T) a_addr * a_fs->block_size; - if (a_fs->block_pre_size) - off += ((a_addr+1) * a_fs->block_pre_size); - if (a_fs->block_post_size) - off += (a_addr * a_fs->block_post_size); - return tsk_img_read(a_fs->img_info, off, a_buf, a_len); } diff --git a/tsk3/fs/iso9660.c b/tsk3/fs/iso9660.c index 7d81e3ef2..46b431452 100644 --- a/tsk3/fs/iso9660.c +++ b/tsk3/fs/iso9660.c @@ -2154,6 +2154,13 @@ load_vol_desc(TSK_FS_INFO * fs) fs->block_post_size = 304 - fs->block_pre_size; goto ISO_RETRY_MAGIC; } + else if (fs->block_pre_size == 16) { + if (tsk_verbose) + tsk_fprintf(stderr, "Trying RAW ISO9660 with 24-byte pre-block size\n"); + fs->block_pre_size = 24; + fs->block_post_size = 304 - fs->block_pre_size; + goto ISO_RETRY_MAGIC; + } else { fs->block_pre_size = 0; fs->block_post_size = 0; diff --git a/xcode/sleuthkit.xcodeproj/project.pbxproj b/xcode/sleuthkit.xcodeproj/project.pbxproj index fce5d774e..e728a1fdd 100644 --- a/xcode/sleuthkit.xcodeproj/project.pbxproj +++ b/xcode/sleuthkit.xcodeproj/project.pbxproj @@ -512,6 +512,7 @@ isa = PBXProject; buildConfigurationList = 026FB3840D19C831000434C7 /* Build configuration list for PBXProject "sleuthkit" */; compatibilityVersion = "Xcode 2.4"; + developmentRegion = English; hasScannedForEncodings = 0; knownRegions = ( English, -- GitLab