1 /*
2
3 File: file_indd.c
4
5 Copyright (C) 2007 Christophe GRENIER <grenier@cgsecurity.org>
6 Copyright (C) 2007 Peter Turczak <pnospamt@netconsequence.de>
7
8 This software is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License along
19 with this program; if not, write the Free Software Foundation, Inc., 51
20 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21
22 */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27 #ifdef HAVE_STRING_H
28 #include <string.h>
29 #endif
30 #include <stdio.h>
31 #include "types.h"
32 #include "common.h"
33 #include "filegen.h"
34 #include "log.h"
35
36 static void register_header_check_indd(file_stat_t *file_stat);
37 static int header_check_indd(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
38 static void file_check_indd(file_recovery_t *file_recovery);
39
40 const file_hint_t file_hint_indd= {
41 .extension="indd",
42 .description="InDesign File",
43 .max_filesize=PHOTOREC_MAX_FILE_SIZE,
44 .recover=1,
45 .enable_by_default=1,
46 .register_header_check=®ister_header_check_indd
47 };
48
49 /* See http://www.adobe.com/content/dam/Adobe/en/devnet/xmp/pdfs/cs6/XMPSpecificationPart3.pdf
50 * for more information about the file format */
51
52 // Headers are: DE393979-5188-4b6c-8E63-EEF8AEE0DD38
53 // Trailers are: FDCEDB70-F786-4b4f-A4D3-C728B3417106
54 static const unsigned char kINDDContigObjHeaderGUID [16] =
55 { 0xDE, 0x39, 0x39, 0x79, 0x51, 0x88, 0x4B, 0x6C, 0x8E, 0x63, 0xEE, 0xF8, 0xAE, 0xE0, 0xDD, 0x38 };
56
57 struct InDesignMasterPage {
58 uint8_t fGUID [16];
59 uint8_t fMagicBytes [8];
60 uint8_t fObjectStreamEndian;
61 uint8_t fIrrelevant1 [239];
62 uint64_t fSequenceNumber;
63 uint8_t fIrrelevant2 [8];
64 uint32_t fFilePages;
65 uint8_t fIrrelevant3 [3812];
66 } __attribute__ ((gcc_struct, __packed__));
67
68 struct InDesignContigObjMarker {
69 uint8_t fGUID [16];
70 uint32_t fObjectUID;
71 uint32_t fObjectClassID;
72 uint32_t fStreamLength;
73 uint32_t fChecksum;
74 } __attribute__ ((gcc_struct, __packed__));
75
file_check_indd(file_recovery_t * file_recovery)76 static void file_check_indd(file_recovery_t *file_recovery)
77 {
78 const uint64_t file_size_org=file_recovery->file_size;
79 struct InDesignContigObjMarker hdr;
80 uint64_t offset;
81 if(file_recovery->file_size<file_recovery->calculated_file_size)
82 {
83 file_recovery->file_size=0;
84 return ;
85 }
86 offset=file_recovery->calculated_file_size;
87 do
88 {
89 #ifdef DEBUG_INDD
90 log_info("file_check_indd offset=%llu (0x%llx)\n", (long long unsigned)offset, (long long unsigned)offset);
91 #endif
92 if(my_fseek(file_recovery->handle, offset, SEEK_SET) < 0)
93 {
94 file_recovery->file_size=0;
95 return ;
96 }
97 if(fread(&hdr, sizeof(hdr), 1, file_recovery->handle) != 1 ||
98 memcmp(hdr.fGUID, kINDDContigObjHeaderGUID, sizeof(kINDDContigObjHeaderGUID))!=0)
99 {
100 file_recovery->file_size=(offset+4096-1)/4096*4096;
101 if(file_recovery->file_size>file_size_org)
102 file_recovery->file_size=0;
103 return ;
104 }
105 /* header + data + trailer */
106 offset+=(uint64_t)le32(hdr.fStreamLength)+2*sizeof(struct InDesignContigObjMarker);
107 } while(offset < file_size_org);
108 file_recovery->file_size=(offset+4096-1)/4096*4096;
109 if(file_recovery->file_size>file_size_org)
110 file_recovery->file_size=0;
111 return ;
112 }
113
header_check_indd(const unsigned char * buffer,const unsigned int buffer_size,const unsigned int safe_header_only,const file_recovery_t * file_recovery,file_recovery_t * file_recovery_new)114 static int header_check_indd(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
115 {
116 const struct InDesignMasterPage *hdr;
117 const struct InDesignMasterPage *hdr0 = (const struct InDesignMasterPage *)buffer;
118 const struct InDesignMasterPage *hdr1 = (const struct InDesignMasterPage *)&buffer[4096];
119 hdr=(le64(hdr0->fSequenceNumber) > le64(hdr1->fSequenceNumber) ? hdr0 : hdr1);
120 if(hdr->fObjectStreamEndian!=1 && hdr->fObjectStreamEndian!=2)
121 return 0;
122 if(le32(hdr->fFilePages)==0)
123 return 0;
124 if(file_recovery->file_stat!=NULL &&
125 file_recovery->file_stat->file_hint==&file_hint_indd)
126 {
127 if(header_ignored_adv(file_recovery, file_recovery_new)==0)
128 return 0;
129 }
130 reset_file_recovery(file_recovery_new);
131 #ifdef DJGPP
132 file_recovery_new->extension="ind";
133 #else
134 file_recovery_new->extension=file_hint_indd.extension;
135 #endif
136 /* Contiguous object pages may follow, file_check_indd will search for them */
137 file_recovery_new->calculated_file_size=(uint64_t)(le32(hdr->fFilePages))*4096;
138 file_recovery_new->file_check=&file_check_indd;
139 #ifdef DEBUG_INDD
140 log_info("header_check_indd: Guessed length: %llu.\n", (long long unsigned)file_recovery_new->calculated_file_size);
141 #endif
142 return 1;
143 }
144
register_header_check_indd(file_stat_t * file_stat)145 static void register_header_check_indd(file_stat_t *file_stat)
146 {
147 static const unsigned char indd_header[24]={
148 0x06, 0x06, 0xed, 0xf5, 0xd8, 0x1d, 0x46, 0xe5,
149 0xbd, 0x31, 0xef, 0xe7, 0xfe, 0x74, 0xb7, 0x1d,
150 0x44, 0x4f, 0x43, 0x55, 0x4d, 0x45, 0x4e, 0x54 };
151 register_header_check(0, indd_header,sizeof(indd_header), &header_check_indd, file_stat);
152 }
153