luisgulo/testdisk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Move string/mem search in a separate file

Browse source
This commit is contained in:
Christophe Grenier 2007-12-06 00:36:39 +01:00
parent 54de8ce209
commit d3ebfd9ede
7 changed files with 70 additions and 113 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/Makefile.am
View file

@ -19,7 +19,7 @@ fs_H = analyse.h bfs.h bsd.h cramfs.h fat.h fatx.h ext2.h jfs_superblock.h jfs
testdisk_SOURCES = testdisk.c $(base_C) $(base_H) $(fs_C) $(fs_H) testdisk.h adv.c adv.h dir.c dir.h dirpart.c dirpart.h edit.c edit.h ext2_dir.c ext2_dir.h ext2_inc.h fat_adv.c fat_dir.c fat_dir.h geometry.c godmode.c godmode.h intrface.c intrface.h ntfs_adv.c ntfs_dir.c ntfs_dir.h ntfs_fix.c ntfs_inc.h rfs_dir.c rfs_dir.h $(ICON_TESTDISK) next.c next.h
#ntfs_udl.c ntfs_udl.h
photorec_SOURCES = photorec.c photorec.h phrecn.c phrecn.h dir.c dir.h ext2p.c ext2p.h ext2_dir.c ext2_dir.h ext2_inc.h fat_dir.c fat_dir.h fatp.c fatp.h filegen.c filegen.h file_7z.c file_a.c file_ab.c file_ace.c file_aif.c file_all.c file_asf.c file_au.c file_bkf.c file_bld.c file_bmp.c file_bz2.c file_cab.c file_cam.c file_cm.c file_crw.c file_ctg.c file_cwk.c file_dat.c file_dbf.c file_dir.c file_djv.c file_doc.c file_dpx.c file_dsc.c file_dta.c file_dv.c file_dwg.c file_elf.c file_evt.c file_exe.c pe.h file_ext.c file_fh10.c file_fh5.c file_flac.c file_flv.c file_fs.c file_gif.c file_gz.c file_imb.c file_indd.c file_dump.c file_itu.c file_jpg.c file_jpg.h file_kdb.c file_max.c file_mdb.c file_mdf.c file_mid.c file_mkv.c file_mov.c file_mp3.c file_mpg.c file_mrw.c file_mus.c file_mysql.c file_njx.c file_ogg.c file_one.c file_orf.c file_pap.c file_pcx.c file_pdf.c file_png.c file_prc.c file_ps.c file_psd.c file_pst.c file_ptb.c file_qbb.c file_qdf.c file_qxd.c file_ra.c file_raf.c file_rar.c file_raw.c file_rdc.c file_reg.c file_riff.c file_rm.c file_rns.c file_rpm.c file_sit.c file_skp.c file_spe.c file_spss.c file_stu.c file_swf.c file_tar.c file_tib.c file_tiff.c file_txt.c file_vmdk.c file_wpd.c file_wmf.c file_x3f.c file_xcf.c file_xm.c file_zip.c geometry.c list.c list.h ole.h ntfs_dir.c ntfs_dir.h ntfsp.c ntfsp.h ntfs_inc.h sessionp.c sessionp.h $(base_C) $(base_H) $(fs_C) $(fs_H) $(ICON_PHOTOREC)
photorec_SOURCES = photorec.c photorec.h phrecn.c phrecn.h dir.c dir.h ext2p.c ext2p.h ext2_dir.c ext2_dir.h ext2_inc.h fat_dir.c fat_dir.h fatp.c fatp.h filegen.c filegen.h file_7z.c file_a.c file_ab.c file_ace.c file_aif.c file_all.c file_asf.c file_au.c file_bkf.c file_bld.c file_bmp.c file_bz2.c file_cab.c file_cam.c file_cm.c file_crw.c file_ctg.c file_cwk.c file_dat.c file_dbf.c file_dir.c file_djv.c file_doc.c file_dpx.c file_dsc.c file_dta.c file_dv.c file_dwg.c file_elf.c file_evt.c file_exe.c pe.h file_ext.c file_fh10.c file_fh5.c file_flac.c file_flv.c file_fs.c file_gif.c file_gz.c file_imb.c file_indd.c file_dump.c file_itu.c file_jpg.c file_jpg.h file_kdb.c file_max.c file_mdb.c file_mdf.c file_mid.c file_mkv.c file_mov.c file_mp3.c file_mpg.c file_mrw.c file_mus.c file_mysql.c file_njx.c file_ogg.c file_one.c file_orf.c file_pap.c file_pcx.c file_pdf.c file_png.c file_prc.c file_ps.c file_psd.c file_pst.c file_ptb.c file_qbb.c file_qdf.c file_qxd.c file_ra.c file_raf.c file_rar.c file_raw.c file_rdc.c file_reg.c file_riff.c file_rm.c file_rns.c file_rpm.c file_sit.c file_skp.c file_spe.c file_spss.c file_stu.c file_swf.c file_tar.c file_tib.c file_tiff.c file_txt.c file_vmdk.c file_wpd.c file_wmf.c file_x3f.c file_xcf.c file_xm.c file_zip.c fnd_mem.h geometry.c list.c list.h ole.h ntfs_dir.c ntfs_dir.h ntfsp.c ntfsp.h ntfs_inc.h sessionp.c sessionp.h $(base_C) $(base_H) $(fs_C) $(fs_H) $(ICON_PHOTOREC)
#diskcp_SOURCES = diskcp.c types.h

11
src/file_doc.c
View file

@ -35,11 +35,11 @@
#include "filegen.h"
#include "ole.h"
#include "log.h"
#include "fnd_mem.h"
static void register_header_check_doc(file_stat_t *file_stat);
static void file_check_doc(file_recovery_t *file_recovery);
static int header_check_doc(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
static const unsigned char * find_in_mem(const unsigned char *haystack, const unsigned int haystack_size, const unsigned char *needle, const unsigned int needle_size);
static uint64_t test_OLE(FILE *file);
const file_hint_t file_hint_doc= {
@ -59,15 +59,6 @@ static void register_header_check_doc(file_stat_t *file_stat)
register_header_check(0, doc_header,sizeof(doc_header), &header_check_doc, file_stat);
}
static const unsigned char * find_in_mem(const unsigned char *haystack, const unsigned int haystack_size, const unsigned char *needle, const unsigned int needle_size)
{
unsigned int i;
for(i=0;i<haystack_size-needle_size;i++)
if(memcmp(&haystack[i],needle,needle_size)==0)
return &haystack[i];
return NULL;
}
static void file_check_doc(file_recovery_t *file_recovery)
{
uint64_t doc_file_size=test_OLE(file_recovery->handle);

12
src/file_mov.c
View file

@ -31,6 +31,7 @@
#include "filegen.h"
#include "common.h"
#include "log.h"
#include "fnd_mem.h"
static void register_header_check_mov(file_stat_t *file_stat);
static int header_check_mov(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
@ -51,17 +52,6 @@ static void register_header_check_mov(file_stat_t *file_stat)
register_header_check(0, NULL,0, &header_check_mov, file_stat);
}
static const unsigned char * find_in_mem(const unsigned char *haystack, const unsigned int haystack_size, const unsigned char *needle, const unsigned int needle_size);
static const unsigned char * find_in_mem(const unsigned char *haystack, const unsigned int haystack_size, const unsigned char *needle, const unsigned int needle_size)
{
unsigned int i;
for(i=0;i<haystack_size-needle_size;i++)
if(memcmp(&haystack[i],needle,needle_size)==0)
return &haystack[i];
return NULL;
}
static int header_check_mov(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
unsigned int i=0;

26
src/file_pdf.c
View file

@ -29,9 +29,7 @@
#include <stdio.h>
#include "types.h"
#include "filegen.h"
static inline const unsigned char *find_in_mem(const unsigned char *haystack, const unsigned char * haystack_end,
const unsigned char *needle, const unsigned int needle_length);
#include "fnd_mem.h"
static void register_header_check_pdf(file_stat_t *file_stat);
static int header_check_pdf(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
@ -55,24 +53,6 @@ static void register_header_check_pdf(file_stat_t *file_stat)
register_header_check(0, pdf_header,sizeof(pdf_header), &header_check_pdf, file_stat);
}
static inline const unsigned char *find_in_mem(const unsigned char *haystack, const unsigned char * haystack_end,
const unsigned char *needle, const unsigned int needle_length)
{
while(haystack!=NULL)
{
haystack=memchr(haystack,needle[0],haystack_end-haystack);
if(haystack!=NULL && haystack<=(haystack_end-needle_length))
{
if(memcmp(haystack,needle,needle_length)==0)
return haystack;
haystack++;
}
else
haystack=NULL;
};
return NULL;
}
static int header_check_pdf(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
if(memcmp(buffer,pdf_header,sizeof(pdf_header))==0)
@ -81,11 +61,11 @@ static int header_check_pdf(const unsigned char *buffer, const unsigned int buff
const unsigned char sig_linearized[10]={'L','i','n','e','a','r','i','z','e','d'};
const unsigned char *linearized;
reset_file_recovery(file_recovery_new);
if(find_in_mem(buffer, buffer+512, sig_illustrator,sizeof(sig_illustrator)) != NULL)
if(find_in_mem(buffer, 512, sig_illustrator,sizeof(sig_illustrator)) != NULL)
file_recovery_new->extension="ai";
else
file_recovery_new->extension=file_hint_pdf.extension;
if((linearized=find_in_mem(buffer, buffer+512, sig_linearized,sizeof(sig_linearized))) != NULL)
if((linearized=find_in_mem(buffer, 512, sig_linearized,sizeof(sig_linearized))) != NULL)
{
linearized+=sizeof(sig_linearized);
while(*linearized!='>' && linearized<=buffer+512)

25
src/file_tiff.c
View file

@ -29,6 +29,7 @@
#include <stdio.h>
#include "types.h"
#include "filegen.h"
#include "fnd_mem.h"
static void register_header_check_tiff(file_stat_t *file_stat);
static int header_check_tiff(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
@ -56,22 +57,6 @@ static void register_header_check_tiff(file_stat_t *file_stat)
register_header_check(0, tiff_header_le,sizeof(tiff_header_le), &header_check_tiff, file_stat);
}
static inline const unsigned char *find_in_mem(const unsigned char *haystack, const unsigned char * haystack_end,
const unsigned char *needle, const unsigned int needle_length)
{
while(haystack!=NULL && haystack<haystack_end)
{
haystack=memchr(haystack,needle[0],haystack_end-haystack);
if(haystack!=NULL)
{
if(memcmp(haystack,needle,needle_length)==0)
return haystack;
haystack++;
}
};
return NULL;
}
static int header_check_tiff(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
const unsigned char pentax_sig[18]= { 'P', 'E', 'N', 'T', 'A', 'X', ' ', 'C', 'o', 'r', 'p', 'o', 'r', 'a', 't', 'i', 'o', 'n'};
@ -86,16 +71,16 @@ static int header_check_tiff(const unsigned char *buffer, const unsigned int buf
if(buffer[8]=='C' && buffer[9]=='R' && buffer[10]==2)
file_recovery_new->extension="cr2";
/* Pentax RAW */
else if(find_in_mem(buffer,buffer+buffer_size,pentax_sig,sizeof(pentax_sig))!=NULL)
else if(find_in_mem(buffer, buffer_size, pentax_sig, sizeof(pentax_sig))!=NULL)
file_recovery_new->extension="pef";
/* Nikon RAW */
else if(find_in_mem(buffer,buffer+buffer_size,nikon_sig,sizeof(nikon_sig))!=NULL)
else if(find_in_mem(buffer, buffer_size, nikon_sig, sizeof(nikon_sig))!=NULL)
file_recovery_new->extension="nef";
/* Kodak RAW */
else if(find_in_mem(buffer,buffer+buffer_size,dcr_sig,sizeof(dcr_sig))!=NULL)
else if(find_in_mem(buffer, buffer_size, dcr_sig, sizeof(dcr_sig))!=NULL)
file_recovery_new->extension="dcr";
/* Sony RAW */
else if(find_in_mem(buffer,buffer+buffer_size,sony_sig,sizeof(sony_sig))!=NULL)
else if(find_in_mem(buffer, buffer_size, sony_sig, sizeof(sony_sig))!=NULL)
file_recovery_new->extension="sr2";
else
file_recovery_new->extension=file_hint_tiff.extension;

70
src/file_txt.c
View file

@ -35,9 +35,7 @@
#include "common.h"
#include "filegen.h"
#include "log.h"
/* Allow a small memory leak */
#define OPT_MALLOC
#include "fnd_mem.h"
extern const file_hint_t file_hint_doc;
extern const file_hint_t file_hint_jpg;
@ -52,8 +50,6 @@ static void register_header_check_fasttxt(file_stat_t *file_stat);
static int header_check_fasttxt(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
static int data_check_txt(const unsigned char *buffer, const unsigned int buffer_size, file_recovery_t *file_recovery);
static inline const unsigned char *find_in_mem(const unsigned char *haystack, const unsigned char * haystack_end,
const unsigned char *needle, const unsigned int needle_length);
static void file_check_html(file_recovery_t *file_recovery);
static void file_check_emlx(file_recovery_t *file_recovery);
static void file_check_xml(file_recovery_t *file_recovery);
@ -282,24 +278,6 @@ static int UTF2Lat(unsigned char *buffer_lower, const unsigned char *buffer, int
return(p-buffer);
}
static inline const unsigned char *find_in_mem(const unsigned char *haystack, const unsigned char * haystack_end,
const unsigned char *needle, const unsigned int needle_length)
{
while(haystack!=NULL)
{
haystack=memchr(haystack,needle[0],haystack_end-haystack);
if(haystack!=NULL && haystack<=(haystack_end-needle_length))
{
if(memcmp(haystack,needle,needle_length)==0)
return haystack;
haystack++;
}
else
haystack=NULL;
};
return NULL;
}
static int header_check_fasttxt(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
const char sign_grisbi[] = "Version_grisbi";
@ -371,11 +349,11 @@ static int header_check_fasttxt(const unsigned char *buffer, const unsigned int
{
reset_file_recovery(file_recovery_new);
file_recovery_new->data_check=&data_check_txt;
if(strstr(buffer,sign_grisbi)!=NULL)
if(find_in_mem(buffer, buffer_size, sign_grisbi, sizeof(sign_grisbi))!=NULL)
file_recovery_new->extension="gsb";
else if(strstr(buffer,sign_fst)!=NULL)
else if(find_in_mem(buffer, buffer_size, sign_fst, sizeof(sign_fst))!=NULL)
file_recovery_new->extension="fst";
else if(strstr(buffer,sign_html)!=NULL)
else if(find_in_mem(buffer, buffer_size, sign_html, sizeof(sign_html))!=NULL)
{
file_recovery_new->extension="html";
file_recovery_new->file_check=&file_check_html;
@ -406,7 +384,6 @@ static int header_check_txt(const unsigned char *buffer, const unsigned int buff
const char sign_jsp2[] = "<%=";
const char sign_php[] = "<?php";
const char sign_tex[] = "\\begin{";
const unsigned char *haystack_end;
{
unsigned int tmp=0;
for(i=0;i<10 && isdigit(buffer[i]);i++)
@ -435,7 +412,6 @@ static int header_check_txt(const unsigned char *buffer, const unsigned int buff
buffer_lower_size=buffer_size+16;
buffer_lower=MALLOC(buffer_lower_size);
}
haystack_end=buffer_lower+buffer_size;
i=UTF2Lat(buffer_lower,buffer,buffer_size);
/* strncasecmp */
if(memcmp(buffer_lower,header_bat,sizeof(header_bat))==0)
@ -464,14 +440,13 @@ static int header_check_txt(const unsigned char *buffer, const unsigned int buff
}
if(buffer[0]=='#' && buffer[1]=='!')
{
unsigned int haystack_size;
unsigned int l=buffer_size;
const unsigned char *haystack=buffer_lower+2;
const unsigned char *res;
haystack_size=buffer_size-2;
res=memchr(haystack,'\n',haystack_size);
res=memchr(haystack,'\n',l);
if(res!=NULL)
haystack_end=res;
if(find_in_mem(haystack,haystack_end,header_sig_perl,sizeof(header_sig_perl)) != NULL)
l=res-haystack;
if(find_in_mem(haystack, l, header_sig_perl, sizeof(header_sig_perl)) != NULL)
{
reset_file_recovery(file_recovery_new);
file_recovery_new->data_check=&data_check_txt;
@ -479,7 +454,7 @@ static int header_check_txt(const unsigned char *buffer, const unsigned int buff
file_recovery_new->extension="pl";
return 1;
}
if(find_in_mem(haystack,haystack_end,header_sig_python,sizeof(header_sig_python)) != NULL)
if(find_in_mem(haystack, l, header_sig_python, sizeof(header_sig_python)) != NULL)
{
reset_file_recovery(file_recovery_new);
file_recovery_new->data_check=&data_check_txt;
@ -487,7 +462,7 @@ static int header_check_txt(const unsigned char *buffer, const unsigned int buff
file_recovery_new->extension="py";
return 1;
}
if(find_in_mem(haystack,haystack_end,header_sig_ruby,sizeof(header_sig_ruby)) != NULL)
if(find_in_mem(haystack, l, header_sig_ruby, sizeof(header_sig_ruby)) != NULL)
{
reset_file_recovery(file_recovery_new);
file_recovery_new->data_check=&data_check_txt;
@ -532,8 +507,7 @@ static int header_check_txt(const unsigned char *buffer, const unsigned int buff
unsigned int stats[256];
unsigned int j;
double ind=0;
for(j=0;j<256;j++)
stats[j]=0;
memset(&stats, 0, sizeof(stats));
for(j=0;j<i;j++)
stats[buffer[j]]++;
for(j=0;j<256;j++)
@ -595,10 +569,10 @@ Doc: \r (0xD)
strstr(file_recovery->filename,".html")!=NULL) ||
/* Text should not be found in JPEG */
(file_recovery->file_stat->file_hint==&file_hint_jpg &&
find_in_mem(buffer,buffer+buffer_size,"8BIM",4)==NULL &&
find_in_mem(buffer,buffer+buffer_size,"adobe",5)==NULL) ||
find_in_mem(buffer, buffer_size, "8BIM", 4)==NULL &&
find_in_mem(buffer, buffer_size, "adobe", 5)==NULL) ||
/* Text should not be found in zip because of compression */
(file_recovery->file_stat->file_hint==&file_hint_zip && find_in_mem(buffer,buffer+buffer_size,zip_header,4)==NULL))
(file_recovery->file_stat->file_hint==&file_hint_zip && find_in_mem(buffer, buffer_size, zip_header, 4)==NULL))
{
reset_file_recovery(file_recovery_new);
file_recovery_new->data_check=&data_check_txt;
@ -655,27 +629,27 @@ static void file_check_html(file_recovery_t *file_recovery)
{
const int read_size=1024;
int taille;
char *buffer;
char *buffer_lower;
int i;
if(fseek(file_recovery->handle,0,SEEK_SET)<0)
return;
buffer=MALLOC(read_size);
taille=fread(buffer,1,read_size,file_recovery->handle);
buffer_lower=MALLOC(read_size);
taille=fread(buffer_lower,1,read_size,file_recovery->handle);
if(taille<0)
{
free(buffer);
free(buffer_lower);
return;
}
buffer[taille<read_size?taille:read_size-1]='\0';
buffer_lower[taille<read_size?taille:read_size-1]='\0';
/* TODO: use strcasestr if available */
for(i=0;i<taille;i++)
buffer[i]=tolower(buffer[i]);
if(strstr(buffer, sign_html)==NULL)
buffer_lower[i]=tolower(buffer_lower[i]);
if(strstr(buffer_lower, sign_html)==NULL)
{
log_warning("%s: no header\n",file_recovery->filename);
file_recovery->file_size=0;
}
free(buffer);
free(buffer_lower);
}
}

37
src/fnd_mem.h Normal file
View file

@ -0,0 +1,37 @@
/*
File: fnd_mem.h
Copyright (C) 2005-2007 Christophe GRENIER <grenier@cgsecurity.org>
This software is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write the Free Software Foundation, Inc., 51
Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
static inline const unsigned char *find_in_mem(const unsigned char *haystack, const unsigned int haystack_size,
const unsigned char *needle, const unsigned int needle_length)
{
const unsigned char *haystack_end=haystack+haystack_size;
while(haystack_end-haystack>=needle_length)
{
haystack=memchr(haystack,needle[0],haystack_end-haystack);
if(haystack==NULL)
return NULL;
if(memcmp(haystack,needle,needle_length)==0)
return haystack;
haystack++;
};
return NULL;
}