Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
Sleuthkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Sleuthkit
Commits
ecfbc6ef
Commit
ecfbc6ef
authored
13 years ago
by
Brian Carrier
Browse files
Options
Downloads
Patches
Plain Diff
Revered back logic to use both split and raw until split gets more platform-specific logic
parent
a95727b3
No related branches found
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
tsk3/img/img_open.c
+218
-196
218 additions, 196 deletions
tsk3/img/img_open.c
with
218 additions
and
196 deletions
tsk3/img/img_open.c
+
218
−
196
View file @
ecfbc6ef
...
...
@@ -168,90 +168,116 @@ tsk_img_open(int num_img,
if
(
img_set
!=
NULL
)
return
img_set
;
/* We'll use the (possibly split) raw format. If the user
* specifies only one file and does not want subsequent
* segments automatically detected, they'll need to specify
* TSK_IMG_TYPE_RAW_SING. */
if
((
img_info
=
split_open
(
num_img
,
images
,
a_ssize
))
!=
NULL
)
{
return
img_info
;
// @@@ NEED to modify this so that we find addtl. split images.
// REMOVE NOTION of sing / split RAW. Just a single object.
/* We'll use the raw format */
if
(
num_img
==
1
)
{
if
((
img_info
=
raw_open
(
images
[
0
],
a_ssize
))
!=
NULL
)
{
return
img_info
;
}
else
if
(
tsk_error_get_errno
()
!=
0
)
{
return
NULL
;
}
}
else
if
(
tsk_error_get_errno
()
!=
0
)
{
return
NULL
;
else
{
if
((
img_info
=
split_open
(
num_img
,
images
,
a_ssize
))
!=
NULL
)
{
return
img_info
;
}
else
if
(
tsk_error_get_errno
()
!=
0
)
{
return
NULL
;
}
}
#if 0
// Commented out until split_open has all of the
// platform-specific file size and opening routines
/* We'll use the (possibly split) raw format. If the user
* specifies only one file and does not want subsequent
* segments automatically detected, they'll need to specify
* TSK_IMG_TYPE_RAW_SING. */
if ((img_info = split_open(num_img, images, a_ssize)) != NULL) {
return img_info;
}
else if (tsk_error_get_errno() != 0) {
return NULL;
}
#endif
/* To improve the error message, verify the file can be read. */
if
(
TSTAT
(
images
[
0
],
&
stat_buf
)
<
0
)
{
// special case to handle windows objects
/* To improve the error message, verify the file can be read. */
if
(
TSTAT
(
images
[
0
],
&
stat_buf
)
<
0
)
{
// special case to handle windows objects
#if defined(TSK_WIN32) || defined(__CYGWIN__)
if
(
TSTRNCMP
(
_TSK_T
(
"
\\\\
.
\\
"
),
images
[
0
],
4
)
==
0
)
{
if
(
tsk_verbose
)
TFPRINTF
(
stderr
,
_TSK_T
(
"tsk_img_open: Ignoring stat error because of windows object: %s
\n
"
),
images
[
0
]);
}
else
{
if
(
TSTRNCMP
(
_TSK_T
(
"
\\\\
.
\\
"
),
images
[
0
],
4
)
==
0
)
{
if
(
tsk_verbose
)
TFPRINTF
(
stderr
,
_TSK_T
(
"tsk_img_open: Ignoring stat error because of windows object: %s
\n
"
),
images
[
0
]);
}
else
{
#endif
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_IMG_STAT
);
tsk_error_set_errstr
(
"%"
PRIttocTSK
" : %s"
,
images
[
0
],
strerror
(
errno
));
return
NULL
;
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_IMG_STAT
);
tsk_error_set_errstr
(
"%"
PRIttocTSK
" : %s"
,
images
[
0
],
strerror
(
errno
));
return
NULL
;
#if defined(TSK_WIN32) || defined(__CYGWIN__)
}
}
#endif
}
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_IMG_UNKTYPE
);
return
NULL
;
}
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_IMG_UNKTYPE
);
return
NULL
;
}
/*
* Type values
*/
/*
* Type values
*/
switch
(
type
)
{
case
TSK_IMG_TYPE_RAW_SING
:
switch
(
type
)
{
case
TSK_IMG_TYPE_RAW_SING
:
/* If we have more than one image name, and raw was the only
* type given, then use split */
if
(
num_img
>
1
)
img_info
=
split_open
(
num_img
,
images
,
a_ssize
);
else
img_info
=
raw_open
(
images
[
0
],
a_ssize
);
break
;
/* If we have more than one image name, and raw was the only
* type given, then use split */
if
(
num_img
>
1
)
img_info
=
split_open
(
num_img
,
images
,
a_ssize
);
else
img_info
=
raw_open
(
images
[
0
],
a_ssize
);
break
;
case
TSK_IMG_TYPE_RAW_SPLIT
:
case
TSK_IMG_TYPE_RAW_SPLIT
:
/* Even if only one image file is given, assume we should
* look for more segments */
img_info
=
split_open
(
num_img
,
images
,
a_ssize
);
break
;
/* Even if only one image file is given, assume we should
* look for more segments */
img_info
=
split_open
(
num_img
,
images
,
a_ssize
);
break
;
#if HAVE_LIBAFFLIB
case
TSK_IMG_TYPE_AFF_AFF
:
case
TSK_IMG_TYPE_AFF_AFD
:
case
TSK_IMG_TYPE_AFF_AFM
:
case
TSK_IMG_TYPE_AFF_ANY
:
img_info
=
aff_open
(
images
,
a_ssize
);
break
;
case
TSK_IMG_TYPE_AFF_AFF
:
case
TSK_IMG_TYPE_AFF_AFD
:
case
TSK_IMG_TYPE_AFF_AFM
:
case
TSK_IMG_TYPE_AFF_ANY
:
img_info
=
aff_open
(
images
,
a_ssize
);
break
;
#endif
#if HAVE_LIBEWF
case
TSK_IMG_TYPE_EWF_EWF
:
img_info
=
ewf_open
(
num_img
,
images
,
a_ssize
);
break
;
case
TSK_IMG_TYPE_EWF_EWF
:
img_info
=
ewf_open
(
num_img
,
images
,
a_ssize
);
break
;
#endif
default:
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_IMG_UNSUPTYPE
);
tsk_error_set_errstr
(
"%d"
,
type
);
return
NULL
;
}
default:
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_IMG_UNSUPTYPE
);
tsk_error_set_errstr
(
"%d"
,
type
);
return
NULL
;
}
return
img_info
;
}
return
img_info
;
}
/**
...
...
@@ -267,13 +293,11 @@ tsk_img_open(int num_img,
*
* @return Pointer to TSK_IMG_INFO or NULL on error
*/
TSK_IMG_INFO
*
tsk_img_open_utf8_sing
(
const
char
*
a_image
,
TSK_IMG_TYPE_ENUM
type
,
unsigned
int
a_ssize
)
{
const
char
*
const
a
=
a_image
;
return
tsk_img_open_utf8
(
1
,
&
a
,
type
,
a_ssize
);
}
TSK_IMG_INFO
*
tsk_img_open_utf8_sing
(
const
char
*
a_image
,
TSK_IMG_TYPE_ENUM
type
,
unsigned
int
a_ssize
)
{
const
char
*
const
a
=
a_image
;
return
tsk_img_open_utf8
(
1
,
&
a
,
type
,
a_ssize
);
}
/**
...
...
@@ -290,72 +314,71 @@ tsk_img_open_utf8_sing(const char *a_image, TSK_IMG_TYPE_ENUM type,
*
* @return Pointer to TSK_IMG_INFO or NULL on error
*/
TSK_IMG_INFO
*
tsk_img_open_utf8
(
int
num_img
,
const
char
*
const
images
[],
TSK_IMG_TYPE_ENUM
type
,
unsigned
int
a_ssize
)
{
TSK_IMG_INFO
*
tsk_img_open_utf8
(
int
num_img
,
const
char
*
const
images
[],
TSK_IMG_TYPE_ENUM
type
,
unsigned
int
a_ssize
)
{
#ifdef TSK_WIN32
{
/* Note that there is an assumption in this code that wchar_t is 2-bytes.
* this is a correct assumption for Windows, but not for all systems... */
TSK_IMG_INFO
*
retval
=
NULL
;
wchar_t
**
images16
;
int
i
;
// allocate a buffer to store the UTF-16 version of the images.
if
((
images16
=
(
wchar_t
**
)
tsk_malloc
(
sizeof
(
wchar_t
*
)
*
num_img
))
==
NULL
)
{
return
NULL
;
}
for
(
i
=
0
;
i
<
num_img
;
i
++
)
{
size_t
ilen
;
UTF16
*
utf16
;
UTF8
*
utf8
;
TSKConversionResult
retval2
;
// we allocate the buffer with the same number of chars as the UTF-8 length
ilen
=
strlen
(
images
[
i
]);
if
((
images16
[
i
]
=
(
wchar_t
*
)
tsk_malloc
((
ilen
+
1
)
*
sizeof
(
wchar_t
)))
==
NULL
)
{
goto
tsk_utf8_cleanup
;
{
/* Note that there is an assumption in this code that wchar_t is 2-bytes.
* this is a correct assumption for Windows, but not for all systems... */
TSK_IMG_INFO
*
retval
=
NULL
;
wchar_t
**
images16
;
int
i
;
// allocate a buffer to store the UTF-16 version of the images.
if
((
images16
=
(
wchar_t
**
)
tsk_malloc
(
sizeof
(
wchar_t
*
)
*
num_img
))
==
NULL
)
{
return
NULL
;
}
utf8
=
(
UTF8
*
)
images
[
i
];
utf16
=
(
UTF16
*
)
images16
[
i
];
retval2
=
tsk_UTF8toUTF16
((
const
UTF8
**
)
&
utf8
,
&
utf8
[
ilen
],
&
utf16
,
&
utf16
[
ilen
],
TSKlenientConversion
);
if
(
retval2
!=
TSKconversionOK
)
{
tsk_error_set_errno
(
TSK_ERR_IMG_CONVERT
);
tsk_error_set_errstr
(
"tsk_img_open_utf8: Error converting image %s %d"
,
images
[
i
],
retval2
);
goto
tsk_utf8_cleanup
;
for
(
i
=
0
;
i
<
num_img
;
i
++
)
{
size_t
ilen
;
UTF16
*
utf16
;
UTF8
*
utf8
;
TSKConversionResult
retval2
;
// we allocate the buffer with the same number of chars as the UTF-8 length
ilen
=
strlen
(
images
[
i
]);
if
((
images16
[
i
]
=
(
wchar_t
*
)
tsk_malloc
((
ilen
+
1
)
*
sizeof
(
wchar_t
)))
==
NULL
)
{
goto
tsk_utf8_cleanup
;
}
utf8
=
(
UTF8
*
)
images
[
i
];
utf16
=
(
UTF16
*
)
images16
[
i
];
retval2
=
tsk_UTF8toUTF16
((
const
UTF8
**
)
&
utf8
,
&
utf8
[
ilen
],
&
utf16
,
&
utf16
[
ilen
],
TSKlenientConversion
);
if
(
retval2
!=
TSKconversionOK
)
{
tsk_error_set_errno
(
TSK_ERR_IMG_CONVERT
);
tsk_error_set_errstr
(
"tsk_img_open_utf8: Error converting image %s %d"
,
images
[
i
],
retval2
);
goto
tsk_utf8_cleanup
;
}
*
utf16
=
'\0'
;
}
*
utf16
=
'\0'
;
}
retval
=
tsk_img_open
(
num_img
,
images16
,
type
,
a_ssize
);
retval
=
tsk_img_open
(
num_img
,
images16
,
type
,
a_ssize
);
// free up the memory
tsk_utf8_cleanup:
for
(
i
=
0
;
i
<
num_img
;
i
++
)
{
if
(
images16
[
i
])
free
(
images16
[
i
]);
}
free
(
images16
);
// free up the memory
tsk_utf8_cleanup:
for
(
i
=
0
;
i
<
num_img
;
i
++
)
{
if
(
images16
[
i
])
free
(
images16
[
i
]);
}
free
(
images16
);
return
retval
;
}
return
retval
;
}
#else
return
tsk_img_open
(
num_img
,
images
,
type
,
a_ssize
);
return
tsk_img_open
(
num_img
,
images
,
type
,
a_ssize
);
#endif
}
}
#if 0
...
...
@@ -364,80 +387,80 @@ tsk_img_open_utf8(int num_img, const char *const images[],
* UTF-32 to UTF-8 support as well. If the goal is to provide a standard UTF-16
* interface, we should use another type besiddes wchar_t.
*/
TSK_IMG_INFO *
tsk_img_open_utf16(int num_img,
wchar_t * const images[], TSK_IMG_TYPE_ENUM type)
{
TSK_IMG_INFO *tsk_img_open_utf16(int num_img,
wchar_t * const images[], TSK_IMG_TYPE_ENUM type) {
#if TSK_WIN32
return tsk_img_open(num_img, images, type);
return tsk_img_open(num_img, images, type);
#else
{
TSK_IMG_INFO *retval;
int i;
char **images8;
TSK_ENDIAN_ENUM endian;
uint16_t tmp1;
/* The unicode conversio routines are primarily to convert Unicode
* in file and volume system images, which means they could be in
* an endian ordering different from the local one. We need to figure
* out our local ordering so we can give it the right flag */
tmp1 = 1;
if (tsk_guess_end_u16(&endian, (uint8_t *) & tmp1, 1)) {
// @@@@
return NULL;
}
// convert UTF16 to UTF8
if ((images8 =
(char **) tsk_malloc(sizeof(char *) * num_img)) == NULL) {
return NULL;
}
for (i = 0; i < num_img; i++) {
size_t ilen;
UTF16 *utf16;
UTF8 *utf8;
TSKConversionResult retval2;
{
TSK_IMG_INFO *retval;
int i;
char **images8;
TSK_ENDIAN_ENUM endian;
uint16_t tmp1;
/* The unicode conversio routines are primarily to convert Unicode
* in file and volume system images, which means they could be in
* an endian ordering different from the local one. We need to figure
* out our local ordering so we can give it the right flag */
tmp1 = 1;
if (tsk_guess_end_u16(&endian, (uint8_t *) & tmp1, 1)) {
// @@@@
return NULL;
}
// we allocate the buffer to be four times the utf-16 length.
ilen = wcslen(images[i]);
ilen <<= 2;
if ((images8[i] = (char *) tsk_malloc(ilen)) == NULL) {
// convert UTF16 to UTF8
if ((images8 =
(char **) tsk_malloc(sizeof(char *) * num_img)) ==
NULL) {
return NULL;
}
utf16 = (UTF16 *) images[i];
utf8 = (UTF8 *) images8[i];
retval2 =
tsk_UTF16toUTF8_lclorder((const UTF16 **) &utf16,
&utf16[wcslen(images[i]) + 1], &utf8,
&utf8[ilen + 1], TSKlenientConversion);
if (retval2 != TSKconversionOK) {
tsk_error_set_errno(TSK_ERR_IMG_CONVERT);
tsk_error_set_errstr
("tsk_img_open_utf16: Error converting image %d %d", i,
retval2);
return NULL;
for (i = 0; i < num_img; i++) {
size_t ilen;
UTF16 *utf16;
UTF8 *utf8;
TSKConversionResult retval2;
// we allocate the buffer to be four times the utf-16 length.
ilen = wcslen(images[i]);
ilen <<= 2;
if ((images8[i] = (char *) tsk_malloc(ilen)) == NULL) {
return NULL;
}
utf16 = (UTF16 *) images[i];
utf8 = (UTF8 *) images8[i];
retval2 =
tsk_UTF16toUTF8_lclorder((const UTF16 **) &utf16,
&utf16[wcslen(images[i]) + 1], &utf8,
&utf8[ilen + 1], TSKlenientConversion);
if (retval2 != TSKconversionOK) {
tsk_error_set_errno(TSK_ERR_IMG_CONVERT);
tsk_error_set_errstr
("tsk_img_open_utf16: Error converting image %d %d",
i, retval2);
return NULL;
}
*utf8 = '\0';
}
*utf8 = '\0';
}
retval = tsk_img_open(num_img, (const TSK_TCHAR **) images8, type);
retval =
tsk_img_open(num_img, (const TSK_TCHAR **) images8, type);
for (i = 0; i < num_img; i++) {
free(images8[i]);
}
free(images8);
for (i = 0; i < num_img; i++) {
free(images8[i]);
}
free(images8);
return retval;
}
return retval;
}
#endif
}
}
#endif
...
...
@@ -448,11 +471,10 @@ tsk_img_open_utf16(int num_img,
* Closes an open disk image.
* @param a_img_info Pointer to the open disk image structure.
*/
void
tsk_img_close
(
TSK_IMG_INFO
*
a_img_info
)
{
if
(
a_img_info
==
NULL
)
{
return
;
void
tsk_img_close
(
TSK_IMG_INFO
*
a_img_info
)
{
if
(
a_img_info
==
NULL
)
{
return
;
}
a_img_info
->
close
(
a_img_info
);
}
a_img_info
->
close
(
a_img_info
);
}
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment