00001
00002
00003
00004
00005
00006 #ifndef _AUX_LIB_H
00007 #define _AUX_LIB_H
00008
00009 #include <stdio.h>
00010 #include <stdlib.h>
00011
00012 #include "tsk_os.h"
00013
00014 #ifdef __cplusplus
00015 extern "C" {
00016 #endif
00017
00018
00019 extern char *tsk_malloc(size_t);
00020 extern char *tsk_realloc(char *, size_t);
00021 extern char *tsk_strdup(const char *);
00022
00023 extern char *tsk_split_at(char *, int);
00024 extern char *tsk_split_at_right(char *, int);
00025
00026
00027
00028 #ifndef PRIx64
00029 #define PRIx64 "llx"
00030 #endif
00031
00032 #ifndef PRIX64
00033 #define PRIX64 "llX"
00034 #endif
00035
00036 #ifndef PRIu64
00037 #define PRIu64 "llu"
00038 #endif
00039
00040 #ifndef PRId64
00041 #define PRId64 "lld"
00042 #endif
00043
00044 #ifndef PRIo64
00045 #define PRIo64 "llo"
00046 #endif
00047
00048 #ifndef PRIx32
00049 #define PRIx32 "x"
00050 #endif
00051
00052 #ifndef PRIX32
00053 #define PRIX32 "X"
00054 #endif
00055
00056 #ifndef PRIu32
00057 #define PRIu32 "u"
00058 #endif
00059
00060 #ifndef PRId32
00061 #define PRId32 "d"
00062 #endif
00063
00064 #ifndef PRIx16
00065 #define PRIx16 "hx"
00066 #endif
00067
00068 #ifndef PRIX16
00069 #define PRIX16 "hX"
00070 #endif
00071
00072 #ifndef PRIu16
00073 #define PRIu16 "hu"
00074 #endif
00075
00076 #ifndef PRIu8
00077 #define PRIu8 "hhu"
00078 #endif
00079
00080 #ifndef PRIx8
00081 #define PRIx8 "hhx"
00082 #endif
00083
00084
00085
00086 typedef unsigned long ULONG;
00087 typedef unsigned long long ULLONG;
00088 typedef unsigned char UCHAR;
00089
00090
00091
00092
00093
00094
00095 typedef uint64_t INUM_T;
00096 #define PRIuINUM PRIu64
00097 #define PRIxINUM PRIx64
00098 #define PRIdINUM PRId64
00099
00100
00101 typedef uint64_t DADDR_T;
00102 #define PRIuDADDR PRIu64
00103 #define PRIxDADDR PRIx64
00104 #define PRIdDADDR PRId64
00105
00106
00107 typedef uint64_t OFF_T;
00108 #define PRIuOFF PRIu64
00109 #define PRIxOFF PRIx64
00110 #define PRIdOFF PRId64
00111
00112 #if !defined (_WIN32) && !defined(__WIN32__)
00113 typedef int64_t SSIZE_T;
00114 #endif
00115
00116 #define PRIuSSIZE PRIu64
00117 #define PRIxSSIZE PRIx64
00118 #define PRIdSSIZE PRId64
00119
00120
00121 typedef uint32_t PNUM_T;
00122 #define PRIuPNUM PRIu32
00123 #define PRIxPNUM PRIx32
00124 #define PRIdPNUM PRId32
00125
00126
00127 extern void tsk_print_version(FILE *);
00128 extern char *tskGetVersion();
00129 extern SSIZE_T tsk_parse_offset(TSK_TCHAR *);
00130 extern int tsk_parse_inum(const TSK_TCHAR * str, INUM_T *, uint32_t *,
00131 uint16_t *, int *);
00132
00133
00134
00135
00136
00137
00138 #define TSK_LIT_ENDIAN 0x01
00139 #define TSK_BIG_ENDIAN 0x02
00140
00141
00142
00143
00144 extern uint8_t tsk_guess_end_u16(uint8_t *, uint8_t *, uint16_t);
00145 extern uint8_t tsk_guess_end_u32(uint8_t *, uint8_t *, uint32_t);
00146
00147
00148 #define tsk_getu16(flag, x) \
00149 (uint16_t)(((flag) & TSK_LIT_ENDIAN) ? \
00150 (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \
00151 (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) )
00152
00153 #define tsk_gets16(flag, x) \
00154 ((int16_t)tsk_getu16(flag, x))
00155
00156
00157 #define tsk_getu32(flag, x) \
00158 (uint32_t)( ((flag) & TSK_LIT_ENDIAN) ? \
00159 ((((uint8_t *)(x))[0] << 0) + \
00160 (((uint8_t *)(x))[1] << 8) + \
00161 (((uint8_t *)(x))[2] << 16) + \
00162 (((uint8_t *)(x))[3] << 24) ) \
00163 : \
00164 ((((uint8_t *)(x))[3] << 0) + \
00165 (((uint8_t *)(x))[2] << 8) + \
00166 (((uint8_t *)(x))[1] << 16) + \
00167 (((uint8_t *)(x))[0] << 24) ) )
00168
00169 #define tsk_gets32(flag, x) \
00170 ((int32_t)tsk_getu32(flag, x))
00171
00172 #define tsk_getu48(flag, x) \
00173 (uint64_t)( ((flag) & TSK_LIT_ENDIAN) ? \
00174 ((uint64_t) \
00175 ((uint64_t)((uint8_t *)(x))[0] << 0)+ \
00176 ((uint64_t)((uint8_t *)(x))[1] << 8) + \
00177 ((uint64_t)((uint8_t *)(x))[2] << 16) + \
00178 ((uint64_t)((uint8_t *)(x))[3] << 24) + \
00179 ((uint64_t)((uint8_t *)(x))[4] << 32) + \
00180 ((uint64_t)((uint8_t *)(x))[5] << 40)) \
00181 : \
00182 ((uint64_t) \
00183 ((uint64_t)((uint8_t *)(x))[5] << 0)+ \
00184 ((uint64_t)((uint8_t *)(x))[4] << 8) + \
00185 ((uint64_t)((uint8_t *)(x))[3] << 16) + \
00186 ((uint64_t)((uint8_t *)(x))[2] << 24) + \
00187 ((uint64_t)((uint8_t *)(x))[1] << 32) + \
00188 ((uint64_t)((uint8_t *)(x))[0] << 40)) )
00189
00190
00191 #define tsk_getu64(flag, x) \
00192 (uint64_t)( ((flag) & TSK_LIT_ENDIAN) ? \
00193 ((uint64_t) \
00194 ((uint64_t)((uint8_t *)(x))[0] << 0) + \
00195 ((uint64_t)((uint8_t *)(x))[1] << 8) + \
00196 ((uint64_t)((uint8_t *)(x))[2] << 16) + \
00197 ((uint64_t)((uint8_t *)(x))[3] << 24) + \
00198 ((uint64_t)((uint8_t *)(x))[4] << 32) + \
00199 ((uint64_t)((uint8_t *)(x))[5] << 40) + \
00200 ((uint64_t)((uint8_t *)(x))[6] << 48) + \
00201 ((uint64_t)((uint8_t *)(x))[7] << 56)) \
00202 : \
00203 ((uint64_t) \
00204 ((uint64_t)((uint8_t *)(x))[7] << 0) + \
00205 ((uint64_t)((uint8_t *)(x))[6] << 8) + \
00206 ((uint64_t)((uint8_t *)(x))[5] << 16) + \
00207 ((uint64_t)((uint8_t *)(x))[4] << 24) + \
00208 ((uint64_t)((uint8_t *)(x))[3] << 32) + \
00209 ((uint64_t)((uint8_t *)(x))[2] << 40) + \
00210 ((uint64_t)((uint8_t *)(x))[1] << 48) + \
00211 ((uint64_t)((uint8_t *)(x))[0] << 56)) )
00212
00213 #define tsk_gets64(flag, x) \
00214 ((int64_t)tsk_getu64(flag, x))
00215
00216
00217
00218
00219
00220
00221
00222
00223 #define TSK_WALK_CONT 0x0
00224 #define TSK_WALK_STOP 0x1
00225 #define TSK_WALK_ERROR 0x2
00226
00227
00228
00229
00230 extern int tsk_verbose;
00231
00232 #define TSK_ERRSTR_L 512
00233 #define TSK_ERRSTR_PR_L (TSK_ERRSTR_L << 2)
00234
00235 extern uint32_t tsk_errno;
00236 extern char tsk_errstr[TSK_ERRSTR_L];
00237 extern char tsk_errstr2[TSK_ERRSTR_L];
00238 extern char tsk_errstr_print[TSK_ERRSTR_PR_L];
00239
00240 extern char *tsk_error_get();
00241 extern void tsk_error_print(FILE *);
00242 extern void tsk_error_reset();
00243
00244 #define TSK_ERR_AUX 0x01000000
00245 #define TSK_ERR_IMG 0x02000000
00246 #define TSK_ERR_MM 0x04000000
00247 #define TSK_ERR_FS 0x08000000
00248 #define TSK_ERR_HDB 0x10000000
00249 #define TSK_ERR_MASK 0x00ffffff
00250
00251 #define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0)
00252 #define TSK_ERR_AUX_MAX 2
00253
00254 #define TSK_ERR_IMG_NOFILE (TSK_ERR_IMG | 0)
00255 #define TSK_ERR_IMG_OFFSET (TSK_ERR_IMG | 1)
00256 #define TSK_ERR_IMG_UNKTYPE (TSK_ERR_IMG | 2)
00257 #define TSK_ERR_IMG_UNSUPTYPE (TSK_ERR_IMG | 3)
00258 #define TSK_ERR_IMG_OPEN (TSK_ERR_IMG | 4)
00259 #define TSK_ERR_IMG_STAT (TSK_ERR_IMG | 5)
00260 #define TSK_ERR_IMG_SEEK (TSK_ERR_IMG | 6)
00261 #define TSK_ERR_IMG_READ (TSK_ERR_IMG | 7)
00262 #define TSK_ERR_IMG_READ_OFF (TSK_ERR_IMG | 8)
00263 #define TSK_ERR_IMG_LAYERS (TSK_ERR_IMG | 9)
00264 #define TSK_ERR_IMG_MAGIC (TSK_ERR_IMG | 10)
00265 #define TSK_ERR_IMG_WRITE (TSK_ERR_IMG | 11)
00266 #define TSK_ERR_IMG_MAX 12
00267
00268 #define TSK_ERR_MM_UNKTYPE (TSK_ERR_MM | 0)
00269 #define TSK_ERR_MM_UNSUPTYPE (TSK_ERR_MM | 1)
00270 #define TSK_ERR_MM_READ (TSK_ERR_MM | 2)
00271 #define TSK_ERR_MM_MAGIC (TSK_ERR_MM | 3)
00272 #define TSK_ERR_MM_WALK_RNG (TSK_ERR_MM | 4)
00273 #define TSK_ERR_MM_BUF (TSK_ERR_MM | 5)
00274 #define TSK_ERR_MM_BLK_NUM (TSK_ERR_MM | 6)
00275 #define TSK_ERR_MM_MAX 7
00276
00277 #define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0)
00278 #define TSK_ERR_FS_UNSUPTYPE (TSK_ERR_FS | 1)
00279 #define TSK_ERR_FS_FUNC (TSK_ERR_FS | 2)
00280 #define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3)
00281 #define TSK_ERR_FS_READ (TSK_ERR_FS | 4)
00282 #define TSK_ERR_FS_ARG (TSK_ERR_FS | 5)
00283 #define TSK_ERR_FS_BLK_NUM (TSK_ERR_FS | 6)
00284 #define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 7)
00285 #define TSK_ERR_FS_INODE_INT (TSK_ERR_FS | 8)
00286 #define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 9)
00287 #define TSK_ERR_FS_FWALK (TSK_ERR_FS | 10)
00288 #define TSK_ERR_FS_WRITE (TSK_ERR_FS | 11)
00289 #define TSK_ERR_FS_UNICODE (TSK_ERR_FS | 12)
00290 #define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 13)
00291 #define TSK_ERR_FS_GENFS (TSK_ERR_FS | 14)
00292 #define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 15)
00293 #define TSK_ERR_FS_MAX 16
00294
00295
00296 #define TSK_ERR_HDB_UNKTYPE (TSK_ERR_HDB | 0)
00297 #define TSK_ERR_HDB_UNSUPTYPE (TSK_ERR_HDB | 1)
00298 #define TSK_ERR_HDB_READDB (TSK_ERR_HDB | 2)
00299 #define TSK_ERR_HDB_READIDX (TSK_ERR_HDB | 3)
00300 #define TSK_ERR_HDB_ARG (TSK_ERR_HDB | 4)
00301 #define TSK_ERR_HDB_WRITE (TSK_ERR_HDB | 5)
00302 #define TSK_ERR_HDB_CREATE (TSK_ERR_HDB | 6)
00303 #define TSK_ERR_HDB_DELETE (TSK_ERR_HDB | 7)
00304 #define TSK_ERR_HDB_MISSING (TSK_ERR_HDB | 8)
00305 #define TSK_ERR_HDB_PROC (TSK_ERR_HDB | 9)
00306 #define TSK_ERR_HDB_OPEN (TSK_ERR_HDB | 10)
00307 #define TSK_ERR_HDB_CORRUPT (TSK_ERR_HDB | 11)
00308 #define TSK_ERR_HDB_MAX 12
00309
00310
00311
00312
00313 typedef struct TSK_DATA_BUF TSK_DATA_BUF;
00314
00315 struct TSK_DATA_BUF {
00316 char *data;
00317 size_t size;
00318 size_t used;
00319 DADDR_T addr;
00320 };
00321
00322 extern TSK_DATA_BUF *tsk_data_buf_alloc(size_t);
00323 extern void tsk_data_buf_free(TSK_DATA_BUF *);
00324
00325
00326
00327
00328 #ifndef TSK_UNI_REPLACEMENT_CHAR
00329
00330
00331
00332
00333
00334
00335
00336
00337
00338
00339
00340
00341
00342
00343
00344
00345
00346
00347
00348
00349
00350
00351
00352
00353
00354
00355
00356
00357
00358
00359
00360
00361
00362
00363
00364
00365
00366
00367
00368
00369
00370
00371
00372
00373
00374
00375
00376
00377
00378
00379
00380
00381
00382
00383
00384
00385
00386
00387
00388
00389
00390
00391
00392
00393
00394
00395
00396
00397
00398
00399
00400
00401
00402
00403
00404
00405
00406
00407
00408
00409
00410
00411
00412
00413
00414
00415
00416
00417
00418
00419
00420 #define TSK_IS_CNTRL(x) \
00421 (((x) < 0x20) && ((x) >= 0x00))
00422
00423 typedef unsigned long UTF32;
00424 typedef unsigned short UTF16;
00425 typedef unsigned char UTF8;
00426 typedef unsigned char Boolean;
00427
00428
00429 #define TSK_UNI_REPLACEMENT_CHAR (UTF32)0x0000FFFD
00430 #define TSK_UNI_MAX_BMP (UTF32)0x0000FFFF
00431 #define TSK_UNI_MAX_UTF16 (UTF32)0x0010FFFF
00432 #define TSK_UNI_MAX_UTF32 (UTF32)0x7FFFFFFF
00433 #define TSK_UNI_MAX_LEGAL_UTF32 (UTF32)0x0010FFFF
00434
00435 typedef enum {
00436 TSKconversionOK,
00437 TSKsourceExhausted,
00438 TSKtargetExhausted,
00439 TSKsourceIllegal
00440 } TSKConversionResult;
00441
00442 typedef enum {
00443 TSKstrictConversion = 0,
00444 TSKlenientConversion
00445 } TSKConversionFlags;
00446
00447 TSKConversionResult tsk_UTF8toUTF16(const UTF8 ** sourceStart,
00448 const UTF8 * sourceEnd,
00449 UTF16 ** targetStart, UTF16 * targetEnd, TSKConversionFlags flags);
00450
00451 TSKConversionResult tsk_UTF16toUTF8(uint16_t,
00452 const UTF16 ** sourceStart, const UTF16 * sourceEnd,
00453 UTF8 ** targetStart, UTF8 * targetEnd, TSKConversionFlags flags);
00454
00455 Boolean tsk_isLegalUTF8Sequence(const UTF8 * source,
00456 const UTF8 * sourceEnd);
00457
00458 #endif
00459
00460
00461 #ifdef TSK_WIN32
00462 extern int optind, opterr;
00463 extern TSK_TCHAR *optarg;
00464 int getopt(int argc, TSK_TCHAR * argv[], TSK_TCHAR * optstring);
00465 #endif
00466
00467
00468 extern void tsk_fprintf(FILE * fd, char *msg, ...);
00469
00470 extern void tsk_printf(char *msg, ...);
00471
00472
00473 typedef struct TSK_LIST TSK_LIST;
00474 struct TSK_LIST {
00475 TSK_LIST *next;
00476 uint64_t key;
00477 uint64_t len;
00478 };
00479
00480 extern uint8_t tsk_list_add(TSK_LIST ** list, uint64_t key);
00481 extern uint8_t tsk_list_find(TSK_LIST * list, uint64_t key);
00482 extern void tsk_list_free(TSK_LIST * list);
00483
00484
00485
00486
00487
00488
00489
00490
00491
00492
00493
00494
00495
00496
00497
00498
00499
00500
00501
00502
00503
00504
00505
00506
00507
00508
00509
00510
00511
00512
00513 typedef unsigned char *POINTER;
00514
00515
00516
00517 typedef uint16_t UINT2;
00518
00519
00520 typedef uint32_t UINT4;
00521
00522
00523
00524
00525
00526
00527
00528
00529
00530
00531
00532
00533 typedef uint8_t BYTE;
00534
00535 #ifndef TRUE
00536 #define FALSE 0
00537 #define TRUE ( !FALSE )
00538 #endif
00539
00540
00541
00542
00543 typedef struct {
00544 UINT4 state[4];
00545 UINT4 count[2];
00546 unsigned char buffer[64];
00547 } MD5_CTX;
00548
00549 void MD5Init(MD5_CTX *);
00550 void MD5Update(MD5_CTX *, unsigned char *, unsigned int);
00551 void MD5Final(unsigned char[16], MD5_CTX *);
00552
00553
00554
00555
00556
00557
00558
00559 typedef struct {
00560 UINT4 digest[5];
00561 UINT4 countLo, countHi;
00562 UINT4 data[16];
00563 int Endianness;
00564 } SHA_CTX;
00565
00566
00567
00568 void SHAInit(SHA_CTX *);
00569 void SHAUpdate(SHA_CTX *, BYTE * buffer, int count);
00570 void SHAFinal(BYTE * output, SHA_CTX *);
00571
00572
00573
00574 #ifdef __cplusplus
00575 }
00576 #endif
00577 #endif