Date: Thu, 12 Jan 2017 18:14:31 -0800 From: Conrad Meyer <cem@freebsd.org> To: svn-src-head@freebsd.org Cc: src-committers <src-committers@freebsd.org>, svn-src-all@freebsd.org Subject: Re: svn commit: r312003 - head/usr.sbin/fstyp Message-ID: <CAG6CVpVhQ7Jg4StBYPWJT8zy8ryMqQVeqajE8dSsqCgnf_H=KQ@mail.gmail.com> In-Reply-To: <201701130212.v0D2Cw0j092852@repo.freebsd.org> References: <201701130212.v0D2Cw0j092852@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Forgot to mention: Documentation: https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274 Images for testing: http://www.cfreds.nist.gov/dfr-test-images.html (raw disk images, include partition tables) On Thu, Jan 12, 2017 at 6:12 PM, Conrad E. Meyer <cem@freebsd.org> wrote: > Author: cem > Date: Fri Jan 13 02:12:58 2017 > New Revision: 312003 > URL: https://svnweb.freebsd.org/changeset/base/312003 > > Log: > fstyp(8): Detect exFAT filesystems > > Simply detect the exFAT filesystem name in the Volume Boot Record > (superblock). > > PR: 214908 > Reported by: <vermaden at interia.pl> > > Added: > head/usr.sbin/fstyp/exfat.c (contents, props changed) > Modified: > head/usr.sbin/fstyp/Makefile > head/usr.sbin/fstyp/fstyp.8 > head/usr.sbin/fstyp/fstyp.c > head/usr.sbin/fstyp/fstyp.h > > Modified: head/usr.sbin/fstyp/Makefile > ============================================================================== > --- head/usr.sbin/fstyp/Makefile Fri Jan 13 02:11:16 2017 (r312002) > +++ head/usr.sbin/fstyp/Makefile Fri Jan 13 02:12:58 2017 (r312003) > @@ -3,7 +3,7 @@ > .include <src.opts.mk> > > PROG= fstyp > -SRCS= cd9660.c ext2fs.c fstyp.c geli.c msdosfs.c ntfs.c ufs.c > +SRCS= cd9660.c exfat.c ext2fs.c fstyp.c geli.c msdosfs.c ntfs.c ufs.c > > .if ${MK_ZFS} != "no" > SRCS += zfs.c > > Added: head/usr.sbin/fstyp/exfat.c > ============================================================================== > --- /dev/null 00:00:00 1970 (empty, because file is newly added) > +++ head/usr.sbin/fstyp/exfat.c Fri Jan 13 02:12:58 2017 (r312003) > @@ -0,0 +1,77 @@ > +/* > + * Copyright (c) 2017 Conrad Meyer <cem@FreeBSD.org> > + * All rights reserved. > + * > + * Redistribution and use in source and binary forms, with or without > + * modification, are permitted provided that the following conditions > + * are met: > + * 1. Redistributions of source code must retain the above copyright > + * notice, this list of conditions and the following disclaimer. > + * 2. Redistributions in binary form must reproduce the above copyright > + * notice, this list of conditions and the following disclaimer in the > + * documentation and/or other materials provided with the distribution. > + * > + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND > + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE > + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE > + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE > + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL > + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS > + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) > + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT > + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY > + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF > + * SUCH DAMAGE. > + */ > + > +#include <sys/cdefs.h> > +__FBSDID("$FreeBSD$"); > + > +#include <stdint.h> > +#include <stdio.h> > +#include <stdlib.h> > +#include <string.h> > + > +#include "fstyp.h" > + > +struct exfat_vbr { > + char ev_jmp[3]; > + char ev_fsname[8]; > + char ev_zeros[53]; > + uint64_t ev_part_offset; > + uint64_t ev_vol_length; > + uint32_t ev_fat_offset; > + uint32_t ev_fat_length; > + uint32_t ev_cluster_offset; > + uint32_t ev_cluster_count; > + uint32_t ev_rootdir_cluster; > + uint32_t ev_vol_serial; > + uint16_t ev_fs_revision; > + uint16_t ev_vol_flags; > + uint8_t ev_log_bytes_per_sect; > + uint8_t ev_log_sect_per_clust; > + uint8_t ev_num_fats; > + uint8_t ev_drive_sel; > + uint8_t ev_percent_used; > +} __packed; > + > +int > +fstyp_exfat(FILE *fp, char *label, size_t size) > +{ > + struct exfat_vbr *ev; > + > + ev = (struct exfat_vbr *)read_buf(fp, 0, 512); > + if (ev == NULL || strncmp(ev->ev_fsname, "EXFAT ", 8) != 0) > + goto fail; > + > + /* > + * Reading the volume label requires walking the root directory to look > + * for a special label file. Left as an exercise for the reader. > + */ > + free(ev); > + return (0); > + > +fail: > + free(ev); > + return (1); > +} > > Modified: head/usr.sbin/fstyp/fstyp.8 > ============================================================================== > --- head/usr.sbin/fstyp/fstyp.8 Fri Jan 13 02:11:16 2017 (r312002) > +++ head/usr.sbin/fstyp/fstyp.8 Fri Jan 13 02:12:58 2017 (r312003) > @@ -27,7 +27,7 @@ > .\" > .\" $FreeBSD$ > .\" > -.Dd February 28, 2016 > +.Dd January 12, 2017 > .Dt FSTYP 8 > .Os > .Sh NAME > @@ -43,7 +43,7 @@ > The > .Nm > utility is used to determine the filesystem type on a given device. > -It can recognize ISO-9660, Ext2, FAT, NTFS, and UFS filesystems. > +It can recognize ISO-9660, exFAT, Ext2, FAT, NTFS, and UFS filesystems. > When the > .Fl u > flag is specified, > @@ -61,6 +61,8 @@ as, respectively: > .It > cd9660 > .It > +exfat > +.It > ext2fs > .It > geli > > Modified: head/usr.sbin/fstyp/fstyp.c > ============================================================================== > --- head/usr.sbin/fstyp/fstyp.c Fri Jan 13 02:11:16 2017 (r312002) > +++ head/usr.sbin/fstyp/fstyp.c Fri Jan 13 02:12:58 2017 (r312003) > @@ -57,6 +57,7 @@ static struct { > bool unmountable; > } fstypes[] = { > { "cd9660", &fstyp_cd9660, false }, > + { "exfat", &fstyp_exfat, true }, > { "ext2fs", &fstyp_ext2fs, false }, > { "geli", &fstyp_geli, true }, > { "msdosfs", &fstyp_msdosfs, false }, > > Modified: head/usr.sbin/fstyp/fstyp.h > ============================================================================== > --- head/usr.sbin/fstyp/fstyp.h Fri Jan 13 02:11:16 2017 (r312002) > +++ head/usr.sbin/fstyp/fstyp.h Fri Jan 13 02:12:58 2017 (r312003) > @@ -39,6 +39,7 @@ char *checked_strdup(const char *s); > void rtrim(char *label, size_t size); > > int fstyp_cd9660(FILE *fp, char *label, size_t size); > +int fstyp_exfat(FILE *fp, char *label, size_t size); > int fstyp_ext2fs(FILE *fp, char *label, size_t size); > int fstyp_geli(FILE *fp, char *label, size_t size); > int fstyp_msdosfs(FILE *fp, char *label, size_t size); >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAG6CVpVhQ7Jg4StBYPWJT8zy8ryMqQVeqajE8dSsqCgnf_H=KQ>