1 /*
2 
3     File: ext2.c
4 
5     Copyright (C) 1998-2008 Christophe GRENIER <grenier@cgsecurity.org>
6 
7     This software is free software; you can redistribute it and/or modify
8     it under the terms of the GNU General Public License as published by
9     the Free Software Foundation; either version 2 of the License, or
10     (at your option) any later version.
11 
12     This program is distributed in the hope that it will be useful,
13     but WITHOUT ANY WARRANTY; without even the implied warranty of
14     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15     GNU General Public License for more details.
16 
17     You should have received a copy of the GNU General Public License along
18     with this program; if not, write the Free Software Foundation, Inc., 51
19     Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20 
21  */
22 #ifdef HAVE_CONFIG_H
23 #include <config.h>
24 #endif
25 
26 #include <stdio.h>
27 #ifdef HAVE_STDLIB_H
28 #include <stdlib.h>
29 #endif
30 #ifdef HAVE_STRING_H
31 #include <string.h>
32 #endif
33 #include <time.h>
34 #include "types.h"
35 #include "common.h"
36 #include "ext2.h"
37 #include "ext2_common.h"
38 #include "fnctdsk.h"
39 #include "log.h"
40 #include "guid_cpy.h"
41 
42 static void set_EXT2_info(const struct ext2_super_block *sb, partition_t *partition, const int verbose);
43 
check_EXT2(disk_t * disk_car,partition_t * partition,const int verbose)44 int check_EXT2(disk_t *disk_car,partition_t *partition,const int verbose)
45 {
46   unsigned char *buffer=(unsigned char*)MALLOC(EXT2_SUPERBLOCK_SIZE);
47   if(disk_car->pread(disk_car, buffer, EXT2_SUPERBLOCK_SIZE, partition->part_offset + 0x400) != EXT2_SUPERBLOCK_SIZE)
48   {
49     free(buffer);
50     return 1;
51   }
52   if(test_EXT2((struct ext2_super_block*)buffer, partition)!=0)
53   {
54     free(buffer);
55     return 1;
56   }
57   set_EXT2_info((struct ext2_super_block*)buffer, partition, verbose);
58   free(buffer);
59   return 0;
60 }
61 
set_EXT2_info(const struct ext2_super_block * sb,partition_t * partition,const int verbose)62 static void set_EXT2_info(const struct ext2_super_block *sb, partition_t *partition, const int verbose)
63 {
64   if(EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_HUGE_FILE)!=0 ||
65       EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_GDT_CSUM)!=0 ||
66       EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_DIR_NLINK)!=0 ||
67       EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE)!=0 ||
68       EXT2_HAS_INCOMPAT_FEATURE(sb,EXT4_FEATURE_INCOMPAT_64BIT)!=0 ||
69       EXT2_HAS_INCOMPAT_FEATURE(sb,EXT4_FEATURE_INCOMPAT_MMP)!=0)
70     partition->upart_type=UP_EXT4;
71   else if(EXT2_HAS_COMPAT_FEATURE(sb,EXT3_FEATURE_COMPAT_HAS_JOURNAL)!=0)
72     partition->upart_type=UP_EXT3;
73   else
74     partition->upart_type=UP_EXT2;
75   partition->blocksize=EXT2_MIN_BLOCK_SIZE<<le32(sb->s_log_block_size);
76   set_part_name(partition,sb->s_volume_name,16);
77   /* sb->s_last_mounted seems to be unemployed in kernel 2.2.16 */
78   if(EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_HUGE_FILE)!=0 ||
79       EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_GDT_CSUM)!=0 ||
80       EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_DIR_NLINK)!=0 ||
81       EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE)!=0 ||
82       EXT2_HAS_INCOMPAT_FEATURE(sb,EXT4_FEATURE_INCOMPAT_64BIT)!=0 ||
83       EXT2_HAS_INCOMPAT_FEATURE(sb,EXT4_FEATURE_INCOMPAT_MMP)!=0)
84     snprintf(partition->info, sizeof(partition->info), "ext4 blocksize=%u", partition->blocksize);
85   else if(EXT2_HAS_COMPAT_FEATURE(sb,EXT3_FEATURE_COMPAT_HAS_JOURNAL)!=0)
86     snprintf(partition->info, sizeof(partition->info), "ext3 blocksize=%u", partition->blocksize);
87   else
88     snprintf(partition->info, sizeof(partition->info), "ext2 blocksize=%u", partition->blocksize);
89   if(EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT2_FEATURE_RO_COMPAT_LARGE_FILE)!=0)
90     strcat(partition->info," Large_file");
91   if(EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT2_FEATURE_RO_COMPAT_SPARSE_SUPER)!=0)
92     strcat(partition->info," Sparse_SB");
93   if(EXT2_HAS_INCOMPAT_FEATURE(sb,EXT3_FEATURE_INCOMPAT_RECOVER)!=0)
94     strcat(partition->info," Recover");
95   if(EXT2_HAS_INCOMPAT_FEATURE(sb,EXT3_FEATURE_INCOMPAT_JOURNAL_DEV)!=0)
96     strcat(partition->info," Journal_dev");
97   if(le16(sb->s_block_group_nr)!=0)
98   {
99     strcat(partition->info," Backup_SB");
100     if(verbose>0)
101     {
102       log_warning("\nblock_group_nr %u\n",le16(sb->s_block_group_nr));
103     }
104   }
105   /* last mounted => date */
106 }
107 
108 /*
109 Primary superblock is at 1024 (SUPERBLOCK_OFFSET)
110 Group 0 begin at s_first_data_block
111 */
recover_EXT2(disk_t * disk,const struct ext2_super_block * sb,partition_t * partition,const int verbose,const int dump_ind)112 int recover_EXT2(disk_t *disk, const struct ext2_super_block *sb,partition_t *partition,const int verbose, const int dump_ind)
113 {
114   if(test_EXT2(sb, partition)!=0)
115     return 1;
116   if(dump_ind!=0)
117   {
118     if(partition!=NULL && disk!=NULL)
119       log_info("\nEXT2/EXT3 magic value at %u/%u/%u\n",
120 	  offset2cylinder(disk,partition->part_offset),
121 	  offset2head(disk,partition->part_offset),
122 	  offset2sector(disk,partition->part_offset));
123     /* There is a little offset ... */
124     dump_log(sb,DEFAULT_SECTOR_SIZE);
125   }
126   if(partition==NULL)
127     return 0;
128   set_EXT2_info(sb, partition, verbose);
129   partition->part_type_i386=P_LINUX;
130   partition->part_type_mac=PMAC_LINUX;
131   partition->part_type_sun=PSUN_LINUX;
132   partition->part_type_gpt=GPT_ENT_TYPE_LINUX_DATA;
133   partition->part_size=td_ext2fs_blocks_count(sb) * EXT2_MIN_BLOCK_SIZE<<le32(sb->s_log_block_size);
134   guid_cpy(&partition->part_uuid, (const efi_guid_t *)&sb->s_uuid);
135   if(verbose>0)
136   {
137     log_info("\n");
138   }
139   partition->sborg_offset=0x400;
140   partition->sb_size=EXT2_SUPERBLOCK_SIZE;
141   if(le16(sb->s_block_group_nr)>0)
142   {
143     const unsigned long int block_nr=(le32(sb->s_first_data_block)+le16(sb->s_block_group_nr)*le32(sb->s_blocks_per_group));
144     if(partition->part_offset< (uint64_t)block_nr * (EXT2_MIN_BLOCK_SIZE<<le32(sb->s_log_block_size)))
145     {
146       log_error("recover_EXT2: part_offset problem\n");
147       return 1;
148     }
149     partition->sb_offset=(uint64_t)block_nr * (EXT2_MIN_BLOCK_SIZE<<le32(sb->s_log_block_size));
150     partition->part_offset-=partition->sb_offset;
151     log_warning("recover_EXT2: \"e2fsck -b %lu -B %u device\" may be needed\n",
152         block_nr, partition->blocksize);
153   }
154   else
155   {
156     partition->sb_offset=0;
157   }
158   if(verbose>0)
159   {
160     log_info("recover_EXT2: s_block_group_nr=%u/%u, s_mnt_count=%u/%u, s_blocks_per_group=%u, s_inodes_per_group=%u\n",
161         le16(sb->s_block_group_nr),
162         (unsigned int)(td_ext2fs_blocks_count(sb) /le32(sb->s_blocks_per_group)),
163         le16(sb->s_mnt_count), le16(sb->s_max_mnt_count),
164         (unsigned int)le32(sb->s_blocks_per_group),
165         (unsigned int)le32(sb->s_inodes_per_group));
166     log_info("recover_EXT2: s_blocksize=%u\n", partition->blocksize);
167     log_info("recover_EXT2: s_blocks_count %lu\n", (long unsigned int)td_ext2fs_blocks_count(sb));
168     if(disk==NULL)
169       log_info("recover_EXT2: part_size %lu\n", (long unsigned)(partition->part_size / DEFAULT_SECTOR_SIZE));
170     else
171       log_info("recover_EXT2: part_size %lu\n", (long unsigned)(partition->part_size / disk->sector_size));
172   }
173   if(sb->s_mkfs_time>0)
174   {
175     const time_t tm=le32(sb->s_mkfs_time);
176     log_info("Filesystem created: %s", ctime(&tm));
177   }
178   if(sb->s_mtime>0)
179   {
180     const time_t tm=le32(sb->s_mtime);
181     log_info("Last mount time:    %s", ctime(&tm));
182   }
183   return 0;
184 }
185