Skip to content
Snippets Groups Projects
Commit dcca5734 authored by Eugene Livis's avatar Eugene Livis
Browse files

Added open/close/read methods for vhd format

parent 033e689a
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
tsk/img/tsk_img.h
+ 3
− 2
View file @ dcca5734
......@@ -64,8 +64,9 @@ extern "C" {
TSK_IMG_TYPE_AFF_AFM = 0x0010, ///< AFM AFF Format
TSK_IMG_TYPE_AFF_ANY = 0x0020, ///< Any format supported by AFFLIB (including beta ones)
TSK_IMG_TYPE_EWF_EWF = 0x0040, ///< EWF version
TSK_IMG_TYPE_VMDK_VMDK = 0x0080, ///< VMDK version
TSK_IMG_TYPE_EWF_EWF = 0x0040, ///< EWF version
TSK_IMG_TYPE_VMDK_VMDK = 0x0080, ///< VMDK version
TSK_IMG_TYPE_VHD_VHD = 0x0100, ///< VHD version
TSK_IMG_TYPE_EXTERNAL = 0x1000, ///< external defined format which at least implements TSK_IMG_INFO, used by pytsk
TSK_IMG_TYPE_UNSUPP = 0xffff, ///< Unsupported disk image type
......
tsk/img/vhd.c
+ 91
− 93
View file @ dcca5734
/*
* The Sleuth Kit - Add on for VMDK (Virtual Machine Disk) image support
* The Sleuth Kit - Add on for Virtual Hard Disk (VHD) image support
*
* Copyright (c) 2006, 2011 Joachim Metz <jbmetz@users.sourceforge.net>
*
......@@ -20,19 +20,18 @@
#define TSK_VHDI_ERROR_STRING_SIZE 512
#if 0
/**
* Get error string from libvmdk and make buffer emtpy if that didn't work.
* Get error string from libvhdi and make buffer emtpy if that didn't work.
* @returns 1 if error message was not set
*/
static uint8_t
getError(libvmdk_error_t * vmdk_error,
char error_string[TSK_VMDK_ERROR_STRING_SIZE])
getError(libvhdi_error_t * vhdi_error,
char error_string[TSK_VHDI_ERROR_STRING_SIZE])
{
int retval;
error_string[0] = '\0';
retval = libvmdk_error_backtrace_sprint(vmdk_error,
error_string, TSK_VMDK_ERROR_STRING_SIZE);
retval = libvhdi_error_backtrace_sprint(vhdi_error,
error_string, TSK_VHDI_ERROR_STRING_SIZE);
if (retval)
return 1;
return 0;
......@@ -40,59 +39,59 @@ getError(libvmdk_error_t * vmdk_error,
static ssize_t
vmdk_image_read(TSK_IMG_INFO * img_info, TSK_OFF_T offset, char *buf,
vhdi_image_read(TSK_IMG_INFO * img_info, TSK_OFF_T offset, char *buf,
size_t len)
{
char error_string[TSK_VMDK_ERROR_STRING_SIZE];
libvmdk_error_t *vmdk_error = NULL;
char error_string[TSK_VHDI_ERROR_STRING_SIZE];
libvhdi_error_t *vhdi_error = NULL;
ssize_t cnt;
IMG_VMDK_INFO *vmdk_info = (IMG_VMDK_INFO *) img_info;
IMG_VHDI_INFO *vhdi_info = (IMG_VHDI_INFO *) img_info;
if (tsk_verbose)
tsk_fprintf(stderr,
"vmdk_image_read: byte offset: %" PRIuOFF " len: %" PRIuSIZE
"vhdi_image_read: byte offset: %" PRIuOFF " len: %" PRIuSIZE
"\n", offset, len);
if (offset > img_info->size) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_IMG_READ_OFF);
tsk_error_set_errstr("vmdk_image_read - %" PRIuOFF, offset);
tsk_error_set_errstr("vhdi_image_read - %" PRIuOFF, offset);
return -1;
}
tsk_take_lock(&(vmdk_info->read_lock));
tsk_take_lock(&(vhdi_info->read_lock));
cnt = libvmdk_handle_read_buffer_at_offset(vmdk_info->handle,
buf, len, offset, &vmdk_error);
cnt = libvhdi_file_read_buffer_at_offset(vhdi_info->handle,
buf, len, offset, &vhdi_error);
if (cnt < 0) {
char *errmsg = NULL;
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_IMG_READ);
if (getError(vmdk_error, error_string))
if (getError(vhdi_error, error_string))
errmsg = strerror(errno);
else
errmsg = error_string;
tsk_error_set_errstr("vmdk_image_read - offset: %" PRIuOFF
tsk_error_set_errstr("vhdi_image_read - offset: %" PRIuOFF
" - len: %" PRIuSIZE " - %s", offset, len, errmsg);
tsk_release_lock(&(vmdk_info->read_lock));
tsk_release_lock(&(vhdi_info->read_lock));
return -1;
}
tsk_release_lock(&(vmdk_info->read_lock));
tsk_release_lock(&(vhdi_info->read_lock));
return cnt;
}
static void
vmdk_image_imgstat(TSK_IMG_INFO * img_info, FILE * hFile)
vhdi_image_imgstat(TSK_IMG_INFO * img_info, FILE * hFile)
{
IMG_VMDK_INFO *vmdk_info = (IMG_VMDK_INFO *) img_info;
IMG_VHDI_INFO *vhdi_info = (IMG_VHDI_INFO *) img_info;
tsk_fprintf(hFile, "IMAGE FILE INFORMATION\n");
tsk_fprintf(hFile, "--------------------------------------------\n");
tsk_fprintf(hFile, "Image Type:\t\tvmdk\n");
tsk_fprintf(hFile, "Image Type:\t\tvhdi\n");
tsk_fprintf(hFile, "\nSize of data in bytes:\t%" PRIuOFF "\n",
img_info->size);
......@@ -101,165 +100,166 @@ vmdk_image_imgstat(TSK_IMG_INFO * img_info, FILE * hFile)
static void
vmdk_image_close(TSK_IMG_INFO * img_info)
vhdi_image_close(TSK_IMG_INFO * img_info)
{
int i;
char error_string[TSK_VMDK_ERROR_STRING_SIZE];
libvmdk_error_t *vmdk_error = NULL;
char error_string[TSK_VHDI_ERROR_STRING_SIZE];
libvhdi_error_t *vhdi_error = NULL;
char *errmsg = NULL;
IMG_VMDK_INFO *vmdk_info = (IMG_VMDK_INFO *) img_info;
IMG_VHDI_INFO *vhdi_info = (IMG_VHDI_INFO *) img_info;
if( libvmdk_handle_close(vmdk_info->handle, &vmdk_error ) != 0 )
if( libvhdi_file_close(vhdi_info->handle, &vhdi_error ) != 0 )
{
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_AUX_GENERIC);
if (getError(vmdk_error, error_string))
if (getError(vhdi_error, error_string))
errmsg = strerror(errno);
else
errmsg = error_string;
tsk_error_set_errstr("vmdk_image_close: unable to close handle - %s", errmsg);
tsk_error_set_errstr("vhdi_image_close: unable to close handle - %s", errmsg);
}
libvmdk_handle_free(&(vmdk_info->handle), NULL);
if( libvmdk_handle_free(&(vmdk_info->handle), &vmdk_error ) != 1 )
libvhdi_file_free(&(vhdi_info->handle), NULL);
if( libvhdi_file_free(&(vhdi_info->handle), &vhdi_error ) != 1 )
{
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_AUX_GENERIC);
if (getError(vmdk_error, error_string))
if (getError(vhdi_error, error_string))
errmsg = strerror(errno);
else
errmsg = error_string;
tsk_error_set_errstr("vmdk_image_close: unable to free handle - %s", errmsg);
tsk_error_set_errstr("vhdi_image_close: unable to free handle - %s", errmsg);
}
for (i = 0; i < vmdk_info->num_imgs; i++) {
free(vmdk_info->images[i]);
for (i = 0; i < vhdi_info->num_imgs; i++) {
free(vhdi_info->images[i]);
}
free(vmdk_info->images);
free(vhdi_info->images);
tsk_deinit_lock(&(vmdk_info->read_lock));
tsk_deinit_lock(&(vhdi_info->read_lock));
tsk_img_free(img_info);
}
TSK_IMG_INFO *
vmdk_open(int a_num_img,
vhdi_open(int a_num_img,
const TSK_TCHAR * const a_images[], unsigned int a_ssize)
{
char error_string[TSK_VMDK_ERROR_STRING_SIZE];
libvmdk_error_t *vmdk_error = NULL;
char error_string[TSK_VHDI_ERROR_STRING_SIZE];
libvhdi_error_t *vhdi_error = NULL;
int result = 0;
int i;
IMG_VMDK_INFO *vmdk_info = NULL;
IMG_VHDI_INFO *vhdi_info = NULL;
TSK_IMG_INFO *img_info = NULL;
if (tsk_verbose) {
libvmdk_notify_set_verbose(1);
libvmdk_notify_set_stream(stderr, NULL);
libvhdi_notify_set_verbose(1);
libvhdi_notify_set_stream(stderr, NULL);
}
if ((vmdk_info =
(IMG_VMDK_INFO *) tsk_img_malloc(sizeof(IMG_VMDK_INFO))) ==
if ((vhdi_info =
(IMG_VHDI_INFO *) tsk_img_malloc(sizeof(IMG_VHDI_INFO))) ==
NULL) {
return NULL;
}
vmdk_info->handle = NULL;
img_info = (TSK_IMG_INFO *) vmdk_info;
vhdi_info->handle = NULL;
img_info = (TSK_IMG_INFO *) vhdi_info;
vmdk_info->num_imgs = a_num_img;
if ((vmdk_info->images =
vhdi_info->num_imgs = a_num_img;
if ((vhdi_info->images =
(TSK_TCHAR **) tsk_malloc(a_num_img *
sizeof(TSK_TCHAR *))) == NULL) {
tsk_img_free(vmdk_info);
tsk_img_free(vhdi_info);
return NULL;
}
for (i = 0; i < a_num_img; i++) {
if ((vmdk_info->images[i] =
if ((vhdi_info->images[i] =
(TSK_TCHAR *) tsk_malloc((TSTRLEN(a_images[i]) +
1) * sizeof(TSK_TCHAR))) == NULL) {
tsk_img_free(vmdk_info);
tsk_img_free(vhdi_info);
return NULL;
}
TSTRNCPY(vmdk_info->images[i], a_images[i],
TSTRNCPY(vhdi_info->images[i], a_images[i],
TSTRLEN(a_images[i]) + 1);
}
if (libvmdk_handle_initialize(&(vmdk_info->handle), &vmdk_error) != 1) {
if (libvhdi_file_initialize(&(vhdi_info->handle), &vhdi_error) != 1) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_IMG_OPEN);
getError(vmdk_error, error_string);
tsk_error_set_errstr("vmdk_open file: %" PRIttocTSK
getError(vhdi_error, error_string);
tsk_error_set_errstr("vhdi_open file: %" PRIttocTSK
": Error initializing handle (%s)", a_images[0], error_string);
libvmdk_error_free(&vmdk_error);
libvhdi_error_free(&vhdi_error);
tsk_img_free(vmdk_info);
tsk_img_free(vhdi_info);
if (tsk_verbose != 0) {
tsk_fprintf(stderr, "Unable to create vmdk handle\n");
tsk_fprintf(stderr, "Unable to create vhdi handle\n");
}
return (NULL);
}
#if defined( TSK_WIN32 )
if (libvmdk_handle_open_wide(vmdk_info->handle,
(const wchar_t *) vmdk_info->images[0],
LIBVMDK_OPEN_READ, &vmdk_error) != 1)
if (libvhdi_file_open_wide(vhdi_info->handle,
(const wchar_t *) vhdi_info->images[0],
LIBVHDI_OPEN_READ, &vhdi_error) != 1)
#else
if (libvmdk_handle_open(vmdk_info->handle,
(const char *) vmdk_info->images,
LIBVMDK_OPEN_READ, &vmdk_error) != 1)
if (libvhdi_file_open(vhdi_info->handle,
(const char *) vhdi_info->images,
LIBVHDI_OPEN_READ, &vhdi_error) != 1)
#endif
{
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_IMG_OPEN);
getError(vmdk_error, error_string);
tsk_error_set_errstr("vmdk_open file: %" PRIttocTSK
getError(vhdi_error, error_string);
tsk_error_set_errstr("vhdi_open file: %" PRIttocTSK
": Error opening (%s)", a_images[0], error_string);
libvmdk_error_free(&vmdk_error);
libvhdi_error_free(&vhdi_error);
tsk_img_free(vmdk_info);
tsk_img_free(vhdi_info);
if (tsk_verbose != 0) {
tsk_fprintf(stderr, "Error opening vmdk file\n");
tsk_fprintf(stderr, "Error opening vhdi file\n");
}
return (NULL);
}
if( libvmdk_handle_open_extent_data_files(vmdk_info->handle, &vmdk_error ) != 1 )
// ELTODO: if this works, add #if defined( TSK_WIN32 )
if( libvhdi_check_file_signature_wide((const wchar_t *) vhdi_info->images[0], &vhdi_error ) != 1 )
{
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_IMG_OPEN);
getError(vmdk_error, error_string);
tsk_error_set_errstr("vmdk_open file: %" PRIttocTSK
": Error opening extent data files for image (%s)", a_images[0],
getError(vhdi_error, error_string);
tsk_error_set_errstr("vhdi_open file: %" PRIttocTSK
": Error checking file signature for image (%s)", a_images[0],
error_string);
libvmdk_error_free(&vmdk_error);
libvhdi_error_free(&vhdi_error);
tsk_img_free(vmdk_info);
tsk_img_free(vhdi_info);
if (tsk_verbose != 0) {
tsk_fprintf(stderr, "Error opening vmdk extent data files\n");
tsk_fprintf(stderr, "Error checking file signature for vhd file\n");
}
return (NULL);
}
if (libvmdk_handle_get_media_size(vmdk_info->handle,
(size64_t *) & (img_info->size), &vmdk_error) != 1) {
if (libvhdi_file_get_media_size(vhdi_info->handle,
(size64_t *) & (img_info->size), &vhdi_error) != 1) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_IMG_OPEN);
getError(vmdk_error, error_string);
tsk_error_set_errstr("vmdk_open file: %" PRIttocTSK
getError(vhdi_error, error_string);
tsk_error_set_errstr("vhdi_open file: %" PRIttocTSK
": Error getting size of image (%s)", a_images[0],
error_string);
libvmdk_error_free(&vmdk_error);
libvhdi_error_free(&vhdi_error);
tsk_img_free(vmdk_info);
tsk_img_free(vhdi_info);
if (tsk_verbose != 0) {
tsk_fprintf(stderr, "Error getting size of vmdk file\n");
tsk_fprintf(stderr, "Error getting size of vhdi file\n");
}
return (NULL);
}
......@@ -270,17 +270,15 @@ vmdk_open(int a_num_img,
else {
img_info->sector_size = 512;
}
img_info->itype = TSK_IMG_TYPE_VMDK_VMDK;
img_info->read = &vmdk_image_read;
img_info->close = &vmdk_image_close;
img_info->imgstat = &vmdk_image_imgstat;
img_info->itype = TSK_IMG_TYPE_VHD_VHD;
img_info->read = &vhdi_image_read;
img_info->close = &vhdi_image_close;
img_info->imgstat = &vhdi_image_imgstat;
// initialize the read lock
tsk_init_lock(&(vmdk_info->read_lock));
tsk_init_lock(&(vhdi_info->read_lock));
return (img_info);
}
#endif //0
#endif /* HAVE_LIBVMDK */
#endif /* HAVE_LIBVHDI */
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment