From ad2f6767015f6cc9737ebff0c990e945aca0a3ba Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Fri, 25 Mar 2011 19:44:06 +0000
Subject: [PATCH] Fixed some RAW CD issues and added offset of 24 bytes to
 choices

---
 tsk3/fs/fs_io.c                           | 72 ++++++++++++++++++-----
 tsk3/fs/iso9660.c                         |  7 +++
 xcode/sleuthkit.xcodeproj/project.pbxproj |  1 +
 3 files changed, 66 insertions(+), 14 deletions(-)

diff --git a/tsk3/fs/fs_io.c b/tsk3/fs/fs_io.c
index 1a2d3149a..c99dca2e2 100644
--- a/tsk3/fs/fs_io.c
+++ b/tsk3/fs/fs_io.c
@@ -38,7 +38,7 @@
 ssize_t
 tsk_fs_read(TSK_FS_INFO * a_fs, TSK_OFF_T a_off, char *a_buf, size_t a_len)
 {
-    TSK_OFF_T off;
+    TSK_OFF_T off = 0;
 
     // do a sanity check on the read bounds, but only if the block
     // value has been set. 
@@ -61,15 +61,40 @@ tsk_fs_read(TSK_FS_INFO * a_fs, TSK_OFF_T a_off, char *a_buf, size_t a_len)
     }
 
     off = a_off + a_fs->offset; 
+    
     if (((a_fs->block_pre_size) || (a_fs->block_post_size)) && (a_fs->block_size)) {
-        TSK_DADDR_T blk = a_off / a_fs->block_size;
-        if (a_fs->block_pre_size)
-            off += ((blk+1) * a_fs->block_pre_size);
-        if (a_fs->block_post_size) 
-            off += (blk * a_fs->block_post_size);
-    }
+        TSK_OFF_T cur_off = a_off;
+        ssize_t retval = 0;
+        TSK_OFF_T end_addr = a_off + a_len;
 
-    return tsk_img_read(a_fs->img_info, off, a_buf, a_len);
+        // we need to read block by block so that we can skip the needed pre and post bytes
+        while (cur_off < end_addr) {
+            TSK_DADDR_T blk = cur_off / a_fs->block_size;
+            TSK_OFF_T read_off = off;
+            ssize_t retval2 = 0;
+            size_t read_len = a_fs->block_size - cur_off % a_fs->block_size;
+            
+            if (read_len + cur_off > end_addr) 
+                read_len = end_addr - cur_off;
+                        
+            if (a_fs->block_pre_size)
+                read_off += ((blk+1) * a_fs->block_pre_size);
+            if (a_fs->block_post_size) 
+                read_off += (blk * a_fs->block_post_size);
+            
+            retval2 = tsk_img_read(a_fs->img_info, read_off, &a_buf[retval], read_len);
+            if (retval2 == -1) 
+                return -1;
+            else if (retval2 == 0)
+                break;
+            retval += retval2;
+            cur_off += retval2;
+        }
+        return retval;
+    }
+    else {
+        return tsk_img_read(a_fs->img_info, off, a_buf, a_len);
+    }
 }
 
 
@@ -114,12 +139,31 @@ tsk_fs_read_block(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr, char *a_buf,
                 PRIuDADDR ")", a_addr);
         return -1;
     }
+    
+    off = a_fs->offset + (TSK_OFF_T) (a_addr) * a_fs->block_size;
+    if ((a_fs->block_pre_size == 0) && (a_fs->block_post_size == 0)) {
+        return tsk_img_read(a_fs->img_info, off, a_buf, a_len);
+    }
+    else {
+        size_t i;
+        ssize_t retval = 0;
+
+        for (i = 0; i < a_len; i++) {
+            ssize_t retval2;
+            TSK_OFF_T off2 = off + i*a_fs->block_size;
+            off += ((a_addr+1) * a_fs->block_pre_size);
+            off += (a_addr * a_fs->block_post_size);
+            
+            retval2 = tsk_img_read(a_fs->img_info, off2, &a_buf[retval], a_fs->block_size);
+            if (retval2 == -1)
+                return -1;
+            else if (retval2 == 0)
+                break;
+
+            retval += retval2;
+        }
+        return retval;
+    }
 
-    off = a_fs->offset + (TSK_OFF_T) a_addr * a_fs->block_size;
-    if (a_fs->block_pre_size)
-        off += ((a_addr+1) * a_fs->block_pre_size);
-    if (a_fs->block_post_size) 
-        off += (a_addr * a_fs->block_post_size);
 
-    return tsk_img_read(a_fs->img_info, off, a_buf, a_len);
 }
diff --git a/tsk3/fs/iso9660.c b/tsk3/fs/iso9660.c
index 7d81e3ef2..46b431452 100644
--- a/tsk3/fs/iso9660.c
+++ b/tsk3/fs/iso9660.c
@@ -2154,6 +2154,13 @@ load_vol_desc(TSK_FS_INFO * fs)
                     fs->block_post_size = 304 - fs->block_pre_size;
                     goto ISO_RETRY_MAGIC;
                 }
+                else if (fs->block_pre_size == 16) {
+                    if (tsk_verbose) 
+                        tsk_fprintf(stderr, "Trying RAW ISO9660 with 24-byte pre-block size\n");
+                    fs->block_pre_size = 24;
+                    fs->block_post_size = 304 - fs->block_pre_size;
+                    goto ISO_RETRY_MAGIC;
+                }
                 else {
                     fs->block_pre_size = 0;
                     fs->block_post_size = 0;
diff --git a/xcode/sleuthkit.xcodeproj/project.pbxproj b/xcode/sleuthkit.xcodeproj/project.pbxproj
index fce5d774e..e728a1fdd 100644
--- a/xcode/sleuthkit.xcodeproj/project.pbxproj
+++ b/xcode/sleuthkit.xcodeproj/project.pbxproj
@@ -512,6 +512,7 @@
 			isa = PBXProject;
 			buildConfigurationList = 026FB3840D19C831000434C7 /* Build configuration list for PBXProject "sleuthkit" */;
 			compatibilityVersion = "Xcode 2.4";
+			developmentRegion = English;
 			hasScannedForEncodings = 0;
 			knownRegions = (
 				English,
-- 
GitLab