00001
00002
00003
00004
00005
00006 #ifndef _AUX_LIB_H
00007 #define _AUX_LIB_H
00008
00009 #include <stdio.h>
00010 #include <stdlib.h>
00011
00012 #include "tsk_os.h"
00013
00014 #if !defined (TSK_WIN32)
00015 #include <sys/param.h>
00016 #endif
00017
00018 #ifdef __cplusplus
00019 extern "C" {
00020 #endif
00021
00022
00023 extern char *tsk_malloc(size_t);
00024 extern char *tsk_realloc(char *, size_t);
00025 extern char *tsk_strdup(const char *);
00026
00027 extern char *tsk_split_at(char *, int);
00028 extern char *tsk_split_at_right(char *, int);
00029
00030
00031
00032 #ifndef PRIx64
00033 #define PRIx64 "llx"
00034 #endif
00035
00036 #ifndef PRIX64
00037 #define PRIX64 "llX"
00038 #endif
00039
00040 #ifndef PRIu64
00041 #define PRIu64 "llu"
00042 #endif
00043
00044 #ifndef PRId64
00045 #define PRId64 "lld"
00046 #endif
00047
00048 #ifndef PRIo64
00049 #define PRIo64 "llo"
00050 #endif
00051
00052 #ifndef PRIx32
00053 #define PRIx32 "x"
00054 #endif
00055
00056 #ifndef PRIX32
00057 #define PRIX32 "X"
00058 #endif
00059
00060 #ifndef PRIu32
00061 #define PRIu32 "u"
00062 #endif
00063
00064 #ifndef PRId32
00065 #define PRId32 "d"
00066 #endif
00067
00068 #ifndef PRIx16
00069 #define PRIx16 "hx"
00070 #endif
00071
00072 #ifndef PRIX16
00073 #define PRIX16 "hX"
00074 #endif
00075
00076 #ifndef PRIu16
00077 #define PRIu16 "hu"
00078 #endif
00079
00080 #ifndef PRIu8
00081 #define PRIu8 "hhu"
00082 #endif
00083
00084 #ifndef PRIx8
00085 #define PRIx8 "hhx"
00086 #endif
00087
00088
00089
00090 typedef unsigned long ULONG;
00091 typedef unsigned long long ULLONG;
00092 typedef unsigned char UCHAR;
00093
00094 #ifndef rounddown
00095 #define rounddown(x, y) \
00096 ((((x) % (y)) == 0) ? (x) : \
00097 (roundup((x),(y)) - (y)))
00098 #endif
00099
00100
00101
00102
00103
00104 typedef uint64_t INUM_T;
00105 #define PRIuINUM PRIu64
00106 #define PRIxINUM PRIx64
00107 #define PRIdINUM PRId64
00108
00109
00110 typedef uint64_t DADDR_T;
00111 #define PRIuDADDR PRIu64
00112 #define PRIxDADDR PRIx64
00113 #define PRIdDADDR PRId64
00114
00115
00116 typedef uint64_t OFF_T;
00117 #define PRIuOFF PRIu64
00118 #define PRIxOFF PRIx64
00119 #define PRIdOFF PRId64
00120
00121 #if !defined (_WIN32) && !defined(__WIN32__)
00122 typedef int64_t SSIZE_T;
00123 #endif
00124
00125 #define PRIuSSIZE PRIu64
00126 #define PRIxSSIZE PRIx64
00127 #define PRIdSSIZE PRId64
00128
00129
00130 typedef uint32_t PNUM_T;
00131 #define PRIuPNUM PRIu32
00132 #define PRIxPNUM PRIx32
00133 #define PRIdPNUM PRId32
00134
00135
00136 extern void tsk_print_version(FILE *);
00137 extern char *tskGetVersion();
00138 extern SSIZE_T tsk_parse_offset(TSK_TCHAR *);
00139 extern int tsk_parse_inum(const TSK_TCHAR * str, INUM_T *, uint32_t *,
00140 uint16_t *, int *);
00141
00142
00143
00144
00145
00146
00147 #define TSK_LIT_ENDIAN 0x01
00148 #define TSK_BIG_ENDIAN 0x02
00149
00150
00151
00152
00153 extern uint8_t tsk_guess_end_u16(uint8_t *, uint8_t *, uint16_t);
00154 extern uint8_t tsk_guess_end_u32(uint8_t *, uint8_t *, uint32_t);
00155
00156
00157 #define tsk_getu16(flag, x) \
00158 (uint16_t)(((flag) & TSK_LIT_ENDIAN) ? \
00159 (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \
00160 (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) )
00161
00162 #define tsk_gets16(flag, x) \
00163 ((int16_t)tsk_getu16(flag, x))
00164
00165
00166 #define tsk_getu32(flag, x) \
00167 (uint32_t)( ((flag) & TSK_LIT_ENDIAN) ? \
00168 ((((uint8_t *)(x))[0] << 0) + \
00169 (((uint8_t *)(x))[1] << 8) + \
00170 (((uint8_t *)(x))[2] << 16) + \
00171 (((uint8_t *)(x))[3] << 24) ) \
00172 : \
00173 ((((uint8_t *)(x))[3] << 0) + \
00174 (((uint8_t *)(x))[2] << 8) + \
00175 (((uint8_t *)(x))[1] << 16) + \
00176 (((uint8_t *)(x))[0] << 24) ) )
00177
00178 #define tsk_gets32(flag, x) \
00179 ((int32_t)tsk_getu32(flag, x))
00180
00181 #define tsk_getu48(flag, x) \
00182 (uint64_t)( ((flag) & TSK_LIT_ENDIAN) ? \
00183 ((uint64_t) \
00184 ((uint64_t)((uint8_t *)(x))[0] << 0)+ \
00185 ((uint64_t)((uint8_t *)(x))[1] << 8) + \
00186 ((uint64_t)((uint8_t *)(x))[2] << 16) + \
00187 ((uint64_t)((uint8_t *)(x))[3] << 24) + \
00188 ((uint64_t)((uint8_t *)(x))[4] << 32) + \
00189 ((uint64_t)((uint8_t *)(x))[5] << 40)) \
00190 : \
00191 ((uint64_t) \
00192 ((uint64_t)((uint8_t *)(x))[5] << 0)+ \
00193 ((uint64_t)((uint8_t *)(x))[4] << 8) + \
00194 ((uint64_t)((uint8_t *)(x))[3] << 16) + \
00195 ((uint64_t)((uint8_t *)(x))[2] << 24) + \
00196 ((uint64_t)((uint8_t *)(x))[1] << 32) + \
00197 ((uint64_t)((uint8_t *)(x))[0] << 40)) )
00198
00199
00200 #define tsk_getu64(flag, x) \
00201 (uint64_t)( ((flag) & TSK_LIT_ENDIAN) ? \
00202 ((uint64_t) \
00203 ((uint64_t)((uint8_t *)(x))[0] << 0) + \
00204 ((uint64_t)((uint8_t *)(x))[1] << 8) + \
00205 ((uint64_t)((uint8_t *)(x))[2] << 16) + \
00206 ((uint64_t)((uint8_t *)(x))[3] << 24) + \
00207 ((uint64_t)((uint8_t *)(x))[4] << 32) + \
00208 ((uint64_t)((uint8_t *)(x))[5] << 40) + \
00209 ((uint64_t)((uint8_t *)(x))[6] << 48) + \
00210 ((uint64_t)((uint8_t *)(x))[7] << 56)) \
00211 : \
00212 ((uint64_t) \
00213 ((uint64_t)((uint8_t *)(x))[7] << 0) + \
00214 ((uint64_t)((uint8_t *)(x))[6] << 8) + \
00215 ((uint64_t)((uint8_t *)(x))[5] << 16) + \
00216 ((uint64_t)((uint8_t *)(x))[4] << 24) + \
00217 ((uint64_t)((uint8_t *)(x))[3] << 32) + \
00218 ((uint64_t)((uint8_t *)(x))[2] << 40) + \
00219 ((uint64_t)((uint8_t *)(x))[1] << 48) + \
00220 ((uint64_t)((uint8_t *)(x))[0] << 56)) )
00221
00222 #define tsk_gets64(flag, x) \
00223 ((int64_t)tsk_getu64(flag, x))
00224
00225
00226
00227
00228
00229
00230
00231
00232 #define TSK_WALK_CONT 0x0
00233 #define TSK_WALK_STOP 0x1
00234 #define TSK_WALK_ERROR 0x2
00235
00236
00237
00238
00239 extern int tsk_verbose;
00240
00241 #define TSK_ERRSTR_L 512
00242 #define TSK_ERRSTR_PR_L (TSK_ERRSTR_L << 2)
00243
00244 extern uint32_t tsk_errno;
00245 extern char tsk_errstr[TSK_ERRSTR_L];
00246 extern char tsk_errstr2[TSK_ERRSTR_L];
00247 extern char tsk_errstr_print[TSK_ERRSTR_PR_L];
00248
00249 extern char *tsk_error_get();
00250 extern void tsk_error_print(FILE *);
00251 extern void tsk_error_reset();
00252
00253 #define TSK_ERR_AUX 0x01000000
00254 #define TSK_ERR_IMG 0x02000000
00255 #define TSK_ERR_MM 0x04000000
00256 #define TSK_ERR_FS 0x08000000
00257 #define TSK_ERR_HDB 0x10000000
00258 #define TSK_ERR_MASK 0x00ffffff
00259
00260 #define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0)
00261 #define TSK_ERR_AUX_MAX 2
00262
00263 #define TSK_ERR_IMG_NOFILE (TSK_ERR_IMG | 0)
00264 #define TSK_ERR_IMG_OFFSET (TSK_ERR_IMG | 1)
00265 #define TSK_ERR_IMG_UNKTYPE (TSK_ERR_IMG | 2)
00266 #define TSK_ERR_IMG_UNSUPTYPE (TSK_ERR_IMG | 3)
00267 #define TSK_ERR_IMG_OPEN (TSK_ERR_IMG | 4)
00268 #define TSK_ERR_IMG_STAT (TSK_ERR_IMG | 5)
00269 #define TSK_ERR_IMG_SEEK (TSK_ERR_IMG | 6)
00270 #define TSK_ERR_IMG_READ (TSK_ERR_IMG | 7)
00271 #define TSK_ERR_IMG_READ_OFF (TSK_ERR_IMG | 8)
00272 #define TSK_ERR_IMG_LAYERS (TSK_ERR_IMG | 9)
00273 #define TSK_ERR_IMG_MAGIC (TSK_ERR_IMG | 10)
00274 #define TSK_ERR_IMG_WRITE (TSK_ERR_IMG | 11)
00275 #define TSK_ERR_IMG_MAX 12
00276
00277 #define TSK_ERR_MM_UNKTYPE (TSK_ERR_MM | 0)
00278 #define TSK_ERR_MM_UNSUPTYPE (TSK_ERR_MM | 1)
00279 #define TSK_ERR_MM_READ (TSK_ERR_MM | 2)
00280 #define TSK_ERR_MM_MAGIC (TSK_ERR_MM | 3)
00281 #define TSK_ERR_MM_WALK_RNG (TSK_ERR_MM | 4)
00282 #define TSK_ERR_MM_BUF (TSK_ERR_MM | 5)
00283 #define TSK_ERR_MM_BLK_NUM (TSK_ERR_MM | 6)
00284 #define TSK_ERR_MM_MAX 7
00285
00286 #define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0)
00287 #define TSK_ERR_FS_UNSUPTYPE (TSK_ERR_FS | 1)
00288 #define TSK_ERR_FS_FUNC (TSK_ERR_FS | 2)
00289 #define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3)
00290 #define TSK_ERR_FS_READ (TSK_ERR_FS | 4)
00291 #define TSK_ERR_FS_ARG (TSK_ERR_FS | 5)
00292 #define TSK_ERR_FS_BLK_NUM (TSK_ERR_FS | 6)
00293 #define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 7)
00294 #define TSK_ERR_FS_INODE_INT (TSK_ERR_FS | 8)
00295 #define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 9)
00296 #define TSK_ERR_FS_FWALK (TSK_ERR_FS | 10)
00297 #define TSK_ERR_FS_WRITE (TSK_ERR_FS | 11)
00298 #define TSK_ERR_FS_UNICODE (TSK_ERR_FS | 12)
00299 #define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 13)
00300 #define TSK_ERR_FS_GENFS (TSK_ERR_FS | 14)
00301 #define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 15)
00302 #define TSK_ERR_FS_MAX 16
00303
00304
00305 #define TSK_ERR_HDB_UNKTYPE (TSK_ERR_HDB | 0)
00306 #define TSK_ERR_HDB_UNSUPTYPE (TSK_ERR_HDB | 1)
00307 #define TSK_ERR_HDB_READDB (TSK_ERR_HDB | 2)
00308 #define TSK_ERR_HDB_READIDX (TSK_ERR_HDB | 3)
00309 #define TSK_ERR_HDB_ARG (TSK_ERR_HDB | 4)
00310 #define TSK_ERR_HDB_WRITE (TSK_ERR_HDB | 5)
00311 #define TSK_ERR_HDB_CREATE (TSK_ERR_HDB | 6)
00312 #define TSK_ERR_HDB_DELETE (TSK_ERR_HDB | 7)
00313 #define TSK_ERR_HDB_MISSING (TSK_ERR_HDB | 8)
00314 #define TSK_ERR_HDB_PROC (TSK_ERR_HDB | 9)
00315 #define TSK_ERR_HDB_OPEN (TSK_ERR_HDB | 10)
00316 #define TSK_ERR_HDB_CORRUPT (TSK_ERR_HDB | 11)
00317 #define TSK_ERR_HDB_MAX 12
00318
00319
00320
00321 typedef enum {
00322 TSK_OK,
00323 TSK_ERR,
00324 TSK_COR
00325 } TSK_RETVAL_ENUM;
00326
00327
00328 typedef struct TSK_DATA_BUF TSK_DATA_BUF;
00329
00330 struct TSK_DATA_BUF {
00331 char *data;
00332 size_t size;
00333 size_t used;
00334 DADDR_T addr;
00335 };
00336
00337 extern TSK_DATA_BUF *tsk_data_buf_alloc(size_t);
00338 extern void tsk_data_buf_free(TSK_DATA_BUF *);
00339
00340
00341
00342
00343 #ifndef TSK_UNI_REPLACEMENT_CHAR
00344
00345
00346
00347
00348
00349
00350
00351
00352
00353
00354
00355
00356
00357
00358
00359
00360
00361
00362
00363
00364
00365
00366
00367
00368
00369
00370
00371
00372
00373
00374
00375
00376
00377
00378
00379
00380
00381
00382
00383
00384
00385
00386
00387
00388
00389
00390
00391
00392
00393
00394
00395
00396
00397
00398
00399
00400
00401
00402
00403
00404
00405
00406
00407
00408
00409
00410
00411
00412
00413
00414
00415
00416
00417
00418
00419
00420
00421
00422
00423
00424
00425
00426
00427
00428
00429
00430
00431
00432
00433
00434
00435 #define TSK_IS_CNTRL(x) \
00436 (((x) < 0x20) && ((x) >= 0x00))
00437
00438 typedef unsigned long UTF32;
00439 typedef unsigned short UTF16;
00440 typedef unsigned char UTF8;
00441 typedef unsigned char Boolean;
00442
00443
00444 #define TSK_UNI_REPLACEMENT_CHAR (UTF32)0x0000FFFD
00445 #define TSK_UNI_MAX_BMP (UTF32)0x0000FFFF
00446 #define TSK_UNI_MAX_UTF16 (UTF32)0x0010FFFF
00447 #define TSK_UNI_MAX_UTF32 (UTF32)0x7FFFFFFF
00448 #define TSK_UNI_MAX_LEGAL_UTF32 (UTF32)0x0010FFFF
00449
00450 typedef enum {
00451 TSKconversionOK,
00452 TSKsourceExhausted,
00453 TSKtargetExhausted,
00454 TSKsourceIllegal
00455 } TSKConversionResult;
00456
00457 typedef enum {
00458 TSKstrictConversion = 0,
00459 TSKlenientConversion
00460 } TSKConversionFlags;
00461
00462 TSKConversionResult tsk_UTF8toUTF16(const UTF8 ** sourceStart,
00463 const UTF8 * sourceEnd,
00464 UTF16 ** targetStart, UTF16 * targetEnd, TSKConversionFlags flags);
00465
00466 TSKConversionResult tsk_UTF16toUTF8(uint16_t,
00467 const UTF16 ** sourceStart, const UTF16 * sourceEnd,
00468 UTF8 ** targetStart, UTF8 * targetEnd, TSKConversionFlags flags);
00469
00470 Boolean tsk_isLegalUTF8Sequence(const UTF8 * source,
00471 const UTF8 * sourceEnd);
00472
00473 #endif
00474
00475
00476 #ifdef TSK_WIN32
00477 extern int optind, opterr;
00478 extern TSK_TCHAR *optarg;
00479 int getopt(int argc, TSK_TCHAR * argv[], TSK_TCHAR * optstring);
00480 #endif
00481
00482
00483 extern void tsk_fprintf(FILE * fd, char *msg, ...);
00484
00485 extern void tsk_printf(char *msg, ...);
00486
00487
00488 typedef struct TSK_LIST TSK_LIST;
00489 struct TSK_LIST {
00490 TSK_LIST *next;
00491 uint64_t key;
00492 uint64_t len;
00493 };
00494
00495 extern uint8_t tsk_list_add(TSK_LIST ** list, uint64_t key);
00496 extern uint8_t tsk_list_find(TSK_LIST * list, uint64_t key);
00497 extern void tsk_list_free(TSK_LIST * list);
00498
00499
00500
00501
00502
00503
00504
00505
00506
00507
00508
00509
00510
00511
00512
00513
00514
00515
00516
00517
00518
00519
00520
00521
00522
00523
00524
00525
00526
00527
00528 typedef unsigned char *POINTER;
00529
00530
00531
00532 typedef uint16_t UINT2;
00533
00534
00535 typedef uint32_t UINT4;
00536
00537
00538
00539
00540
00541
00542
00543
00544
00545
00546
00547
00548 typedef uint8_t BYTE;
00549
00550 #ifndef TRUE
00551 #define FALSE 0
00552 #define TRUE ( !FALSE )
00553 #endif
00554
00555
00556
00557
00558 typedef struct {
00559 UINT4 state[4];
00560 UINT4 count[2];
00561 unsigned char buffer[64];
00562 } TSK_MD5_CTX;
00563
00564 void TSK_MD5_Init(TSK_MD5_CTX *);
00565 void TSK_MD5_Update(TSK_MD5_CTX *, unsigned char *, unsigned int);
00566 void TSK_MD5_Final(unsigned char[16], TSK_MD5_CTX *);
00567
00568
00569
00570
00571
00572
00573
00574 typedef struct {
00575 UINT4 digest[5];
00576 UINT4 countLo, countHi;
00577 UINT4 data[16];
00578 int Endianness;
00579 } TSK_SHA_CTX;
00580
00581
00582
00583 void TSK_SHA_Init(TSK_SHA_CTX *);
00584 void TSK_SHA_Update(TSK_SHA_CTX *, BYTE * buffer, int count);
00585 void TSK_SHA_Final(BYTE * output, TSK_SHA_CTX *);
00586
00587
00588
00589 #ifdef __cplusplus
00590 }
00591 #endif
00592 #endif