public VHDFooter(byte[] buffer)
{
Cookie = ByteReader.ReadAnsiString(buffer, 0x00, 8);
Features = BigEndianConverter.ToUInt32(buffer, 0x08);
FileFormatVersion = BigEndianConverter.ToUInt32(buffer, 0x0C);
DataOffset = BigEndianConverter.ToUInt64(buffer, 0x10);
TimeStamp = BigEndianConverter.ToUInt32(buffer, 0x18);
CreatorApplication = ByteReader.ReadAnsiString(buffer, 0x1C, 4);
CreatorVersion = BigEndianConverter.ToUInt32(buffer, 0x20);
CreatorHostOS = BigEndianConverter.ToUInt32(buffer, 0x24);
OriginalSize = BigEndianConverter.ToUInt64(buffer, 0x28);
CurrentSize = BigEndianConverter.ToUInt64(buffer, 0x30);
DiskGeometry = BigEndianConverter.ToUInt32(buffer, 0x38);
DiskType = (VirtualHardDiskType)BigEndianConverter.ToUInt32(buffer, 0x3C);
uint checksum = BigEndianConverter.ToUInt32(buffer, 0x40);
UniqueId = BigEndianConverter.ToGuid(buffer, 0x44);
SavedState = ByteReader.ReadByte(buffer, 0x54);
byte[] temp = (byte[])buffer.Clone();
BigEndianWriter.WriteInt32(temp, 0x40, 0);
uint expectedChecksum = CalculateChecksum(temp);
m_isValid = String.Equals(Cookie, VirtualHardDiskCookie) && (checksum == expectedChecksum) && (FileFormatVersion == 0x00010000);
}
public VolumeManagerDatabaseHeader(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0x00, 4);
NumberOfVBlks = BigEndianConverter.ToUInt32(buffer, 0x04);
BlockSize = BigEndianConverter.ToUInt32(buffer, 0x08);
HeaderSize = BigEndianConverter.ToUInt32(buffer, 0x0C);
UpdateStatus = (DatabaseHeaderUpdateStatus)BigEndianConverter.ToUInt16(buffer, 0x10);
MajorVersion = BigEndianConverter.ToUInt16(buffer, 0x12);
MinorVersion = BigEndianConverter.ToUInt16(buffer, 0x14);
DiskGroupName = ByteReader.ReadAnsiString(buffer, 0x16, 31).Trim('\0');
DiskGroupGuidString = ByteReader.ReadAnsiString(buffer, 0x35, 64).Trim('\0');
CommitTransactionID = BigEndianConverter.ToUInt64(buffer, 0x75);
PendingTransactionID = BigEndianConverter.ToUInt64(buffer, 0x7D);
CommittedTotalNumberOfVolumeRecords = BigEndianConverter.ToUInt32(buffer, 0x85);
CommittedTotalNumberOfComponentRecords = BigEndianConverter.ToUInt32(buffer, 0x89);
CommittedTotalNumberOfExtentRecords = BigEndianConverter.ToUInt32(buffer, 0x8D);
CommittedTotalNumberOfDiskRecords = BigEndianConverter.ToUInt32(buffer, 0x91);
CommittedTotalNumberOfDiskAccessRecords = BigEndianConverter.ToUInt32(buffer, 0x95);
// Unused 8 bytes
PendingTotalNumberOfVolumeRecords = BigEndianConverter.ToUInt32(buffer, 0xA1);
PendingTotalNumberOfComponentRecords = BigEndianConverter.ToUInt32(buffer, 0xA5);
PendingTotalNumberOfExtentRecords = BigEndianConverter.ToUInt32(buffer, 0xA9);
PendingTotalNumberOfDiskRecords = BigEndianConverter.ToUInt32(buffer, 0xAD);
PendingTotalNumberOfDiskAccessRecords = BigEndianConverter.ToUInt32(buffer, 0xB1);
// Unused 8 bytes
LastModificationDT = DateTime.FromFileTimeUtc(BigEndianConverter.ToInt64(buffer, 0xBD));
}
public static string SecondLevelDecoding(byte[] buffer, ref int offset)
{
StringBuilder builder = new StringBuilder();
byte labelLength = ByteReader.ReadByte(buffer, ref offset);
while (labelLength > 0)
{
if (builder.Length > 0)
{
builder.Append(".");
}
// The high order two bits of the length field must be zero
if (labelLength > 63)
{
throw new ArgumentException("Invalid NetBIOS label length");
}
string label = ByteReader.ReadAnsiString(buffer, offset, labelLength);
builder.Append(label);
offset += labelLength;
labelLength = ByteReader.ReadByte(buffer, ref offset);
}
return(builder.ToString());
}
public static TOCBlock ReadFromDisk(Disk disk, PrivateHeader privateHeader, bool usePrimaryTOC)
{
ulong sectorIndex;
if (usePrimaryTOC)
{
sectorIndex = privateHeader.PrivateRegionStartLBA + privateHeader.PrimaryTocLBA;
}
else
{
sectorIndex = privateHeader.PrivateRegionStartLBA + privateHeader.SecondaryTocLBA;
}
byte[] sector = disk.ReadSector((long)sectorIndex);
string signature = ByteReader.ReadAnsiString(sector, 0x00, 8);
if (signature == TOCBlockSignature)
{
TOCBlock tocBlock = new TOCBlock(sector);
if (tocBlock.IsChecksumValid)
{
return(tocBlock);
}
}
return(null);
}
public TOCBlock(byte[] buffer)
{
if (buffer.Length > Length)
{
// Checksum only applies to the first 512 bytes (even when the sector size > 512 bytes)
buffer = ByteReader.ReadBytes(buffer, 0, 512);
}
Signature = ByteReader.ReadAnsiString(buffer, 0x00, 8);
uint checksum = BigEndianConverter.ToUInt32(buffer, 0x08);
UpdateSequenceNumber = BigEndianConverter.ToUInt64(buffer, 0x0C);
// 16 zeros
int offset = 0x24;
// If the first character is not null (0x00), then there is a region defined
while (buffer[offset] != 0)
{
TOCRegion region = new TOCRegion(buffer, offset);
Regions.Add(region);
offset += TOCRegion.Length;
}
BigEndianWriter.WriteUInt32(buffer, 0x08, (uint)0); // we exclude the checksum field from checksum calculations
m_isChecksumValid = (checksum == PrivateHeader.CalculateChecksum(buffer));
}
/// <summary>
/// Read port_any_t string structure
/// </summary>
public static string ReadPortAddress(byte[] buffer, int offset)
{
ushort length = LittleEndianConverter.ToUInt16(buffer, offset + 0);
// The length includes the C NULL string termination
return(ByteReader.ReadAnsiString(buffer, offset + 2, length - 1));
}
public DynamicDiskHeader(byte[] buffer)
{
Cookie = ByteReader.ReadAnsiString(buffer, 0x00, 8);
DataOffset = BigEndianConverter.ToUInt64(buffer, 0x08);
TableOffset = BigEndianConverter.ToUInt64(buffer, 0x10);
HeaderVersion = BigEndianConverter.ToUInt32(buffer, 0x18);
MaxTableEntries = BigEndianConverter.ToUInt32(buffer, 0x1C);
BlockSize = BigEndianConverter.ToUInt32(buffer, 0x20);
uint checksum = BigEndianConverter.ToUInt32(buffer, 0x24);
ParentUniqueID = BigEndianConverter.ToGuid(buffer, 0x28);
ParentTimeStamp = BigEndianConverter.ToUInt32(buffer, 0x38);
Reserved = BigEndianConverter.ToUInt32(buffer, 0x3C);
ParentUnicodeName = ByteReader.ReadUTF16String(buffer, 0x40, 256).TrimEnd('\0');
ParentLocatorEntry1 = new ParentLocatorEntry(buffer, 0x240);
ParentLocatorEntry2 = new ParentLocatorEntry(buffer, 0x258);
ParentLocatorEntry3 = new ParentLocatorEntry(buffer, 0x270);
ParentLocatorEntry4 = new ParentLocatorEntry(buffer, 0x288);
ParentLocatorEntry5 = new ParentLocatorEntry(buffer, 0x2A0);
ParentLocatorEntry6 = new ParentLocatorEntry(buffer, 0x2B8);
ParentLocatorEntry7 = new ParentLocatorEntry(buffer, 0x2D0);
ParentLocatorEntry8 = new ParentLocatorEntry(buffer, 0x2E8);
byte[] temp = (byte[])buffer.Clone();
BigEndianWriter.WriteInt32(temp, 0x24, 0);
uint expectedChecksum = VHDFooter.CalculateChecksum(temp);
m_isValid = String.Equals(Cookie, DynamidDiskHeaderCookie) && (checksum == expectedChecksum) && (HeaderVersion == 0x00010000);
}
public RAID5ManagerBootRecord(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0, 8);
RecordRevision = ByteReader.ReadByte(buffer, 8);
Operation = (RAID5ManagerOperation)BigEndianConverter.ToUInt16(buffer, 9);
ReadOperationParameters(buffer, 16);
}
public FullExtendedAttribute(byte[] buffer, int offset)
{
ExtendedAttributeFlag = (ExtendedAttributeFlags)ByteReader.ReadByte(buffer, offset);
AttributeNameLengthInBytes = ByteReader.ReadByte(buffer, offset + 1);
AttributeValueLengthInBytes = LittleEndianConverter.ToUInt16(buffer, offset + 2);
AttributeName = ByteReader.ReadAnsiString(buffer, offset + 4, AttributeNameLengthInBytes);
AttributeValue = ByteReader.ReadAnsiString(buffer, offset + 4 + AttributeNameLengthInBytes + 1, AttributeValueLengthInBytes);
}
public DynamicDiskPartitionerResumeRecord(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0, 8);
RecordRevision = ByteReader.ReadByte(buffer, 8);
Operation = (DynamicDiskPartitionerOperation)BigEndianConverter.ToUInt16(buffer, 9);
ReadOperationParameters(buffer, 16);
}
public FileRecordSegment(byte[] buffer, int offset, int bytesPerSector, long segmentNumber)
{
Signature = ByteReader.ReadAnsiString(buffer, offset + 0x00, 4);
ushort updateSequenceArrayOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x04);
ushort updateSequenceArraySize = LittleEndianConverter.ToUInt16(buffer, offset + 0x06);
LogFileSequenceNumber = LittleEndianConverter.ToUInt64(buffer, offset + 0x08);
SequenceNumber = LittleEndianConverter.ToUInt16(buffer, offset + 0x10);
HardLinkCount = LittleEndianConverter.ToUInt16(buffer, offset + 0x12);
ushort firstAttributeOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x14);
m_flags = (FileRecordFlags)LittleEndianConverter.ToUInt16(buffer, offset + 0x16);
uint segmentRealSize = LittleEndianConverter.ToUInt32(buffer, offset + 0x18);
uint segmentAllocatedSize = LittleEndianConverter.ToUInt32(buffer, offset + 0x1C);
BaseFileRecordSegmentNumber = LittleEndianConverter.ToUInt64(buffer, offset + 0x20);
NextAttributeId = LittleEndianConverter.ToUInt16(buffer, offset + 0x28);
// 2 zeros - padding
MftSegmentNumberXP = LittleEndianConverter.ToUInt32(buffer, offset + 0x2C);
// There is an UpdateSequenceNumber for the FileRecordSegment,
// and an entry in the UpdateSequenceArray for each sector of the record
// The last two bytes of each sector contains this entry for integrity-check purposes
int position = offset + updateSequenceArrayOffset;
UpdateSequenceNumber = LittleEndianConverter.ToUInt16(buffer, position);
position += 2;
// This stores the data that was supposed to be placed at the end of each sector, and was replaced with an UpdateSequenceNumber
List <byte[]> updateSequenceReplacementData = new List <byte[]>();
for (int index = 0; index < updateSequenceArraySize - 1; index++)
{
byte[] endOfSectorBytes = new byte[2];
endOfSectorBytes[0] = buffer[position + 0];
endOfSectorBytes[1] = buffer[position + 1];
updateSequenceReplacementData.Add(endOfSectorBytes);
position += 2;
}
MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData);
// read attributes
position = offset + firstAttributeOffset;
while (!IsEndMarker(buffer, position))
{
AttributeRecord attribute = AttributeRecord.FromBytes(buffer, position);
m_immediateAttributes.Add(attribute);
position += (int)attribute.StoredRecordLength;
if (position > buffer.Length)
{
throw new InvalidDataException("Improper attribute length");
}
}
m_mftSegmentNumber = segmentNumber;
}
public FileFullEAInformation(byte[] buffer, int offset)
{
NextEntryOffset = LittleEndianReader.ReadUInt32(buffer, ref offset);
Flags = ByteReader.ReadByte(buffer, ref offset);
EaNameLength = ByteReader.ReadByte(buffer, ref offset);
EaValueLength = LittleEndianReader.ReadUInt16(buffer, ref offset);
EaName = ByteReader.ReadAnsiString(buffer, ref offset, EaNameLength);
EaValue = ByteReader.ReadAnsiString(buffer, ref offset, EaValueLength);
}
protected static string ReadVarString(byte[] buffer, ref int offset)
{
int length = buffer[offset];
string result = ByteReader.ReadAnsiString(buffer, offset + 1, length);
offset += length + 1;
return(result);
}
public static string ReadFixedLengthString(byte[] buffer, ref int offset, bool isUnicode, int byteCount)
{
if (isUnicode)
{
return(ByteReader.ReadUTF16String(buffer, ref offset, byteCount / 2));
}
return(ByteReader.ReadAnsiString(buffer, ref offset, byteCount));
}
public ushort CopyNumber; // copy number, always 00 01
// 4 zero bytes
public TOCRegion(byte[] buffer, int offset)
{
Name = ByteReader.ReadAnsiString(buffer, offset + 0x00, 8).Trim('\0');
RegionFlags = (TOCRegionFlags)BigEndianConverter.ToUInt16(buffer, offset + 0x08);
StartLBA = BigEndianConverter.ToUInt64(buffer, offset + 0x0A);
SizeLBA = BigEndianConverter.ToUInt64(buffer, offset + 0x12);
Unknown = BigEndianConverter.ToUInt16(buffer, offset + 0x1A);
CopyNumber = BigEndianConverter.ToUInt16(buffer, offset + 0x1C);
}
public FileFullEAEntry(byte[] buffer, int offset)
{
NextEntryOffset = LittleEndianReader.ReadUInt32(buffer, ref offset);
Flags = (ExtendedAttributeFlags)ByteReader.ReadByte(buffer, ref offset);
EaNameLength = ByteReader.ReadByte(buffer, ref offset);
EaValueLength = LittleEndianReader.ReadUInt16(buffer, ref offset);
EaName = ByteReader.ReadAnsiString(buffer, ref offset, EaNameLength);
offset++; // terminating null
EaValue = ByteReader.ReadAnsiString(buffer, ref offset, EaValueLength);
}
public static bool IsSignatureValid(byte[] messageBytes)
{
if (messageBytes.Length < 8)
{
return(false);
}
string signature = ByteReader.ReadAnsiString(messageBytes, 0, 8);
return(signature == AuthenticateMessage.ValidSignature);
}
protected DatabaseRecordFragment(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0x00, 4);
SequenceNumber = BigEndianConverter.ToUInt32(buffer, 0x04);
GroupNumber = BigEndianConverter.ToUInt32(buffer, 0x08);
NumberInGroup = BigEndianConverter.ToUInt16(buffer, 0x0C);
FragmentCount = BigEndianConverter.ToUInt16(buffer, 0x0E);
Data = new byte[buffer.Length - HeaderLength];
Array.Copy(buffer, 0x10, Data, 0, buffer.Length - HeaderLength);
}
public NegotiateMessage(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0, 8);
MessageType = (MessageTypeName)LittleEndianConverter.ToUInt32(buffer, 8);
NegotiateFlags = (NegotiateFlags)LittleEndianConverter.ToUInt32(buffer, 12);
DomainName = AuthenticationMessageUtils.ReadAnsiStringBufferPointer(buffer, 16);
Workstation = AuthenticationMessageUtils.ReadAnsiStringBufferPointer(buffer, 24);
if ((NegotiateFlags & NegotiateFlags.Version) > 0)
{
Version = new NTLMVersion(buffer, 32);
}
}
private byte[] DecryptHeader(byte[] headerBytes, byte[] password)
{
Pbkdf2 pbkdf2;
KeyValuePairList <HMAC, int> hmacs = new KeyValuePairList <HMAC, int>();
hmacs.Add(new HMACSHA512(), 1000);
hmacs.Add(new HMACRIPEMD160(), 2000);
hmacs.Add(new HMACWhirlpool(), 1000);
foreach (KeyValuePair <HMAC, int> entry in hmacs)
{
HMAC hmac = entry.Key;
int iterations = entry.Value;
pbkdf2 = new Pbkdf2(hmac, password, Salt, iterations);
byte[] key = pbkdf2.GetBytes(192);
List <KeyValuePairList <SymmetricAlgorithm, byte[]> > algorithms = GetAlgorithms(key);
foreach (KeyValuePairList <SymmetricAlgorithm, byte[]> algorithmChain in algorithms)
{
byte[] decrypt = (byte[])headerBytes.Clone();
// TrueCrypt 7.1a Source (Common\Crypto.c):
// ----------------------------------------
// When encrypting/decrypting a buffer (typically a volume header) the sequential number
// of the first XTS data unit in the buffer is always 0 and the start of the buffer is
// always assumed to be aligned with the start of the data unit 0.
decrypt = XTSHelper.XTSChainDecrypt(algorithmChain, 0, decrypt, 0, 448);
string signature = ByteReader.ReadAnsiString(decrypt, 0, 4);
ushort formatVersion = BigEndianConverter.ToUInt16(decrypt, 4);
uint checksum256 = BigEndianConverter.ToUInt32(decrypt, 8);
byte[] temp = ByteReader.ReadBytes(decrypt, 192, 256);
uint computedChecksum = Utilities.CRC32.Compute(temp);
if (signature == TrueCryptSignature && checksum256 == computedChecksum)
{
m_isValid = true;
if (formatVersion == SupportedFormatVersion)
{
m_isSupported = true;
}
m_algorithmChain = algorithmChain;
m_hmac = hmac;
return(decrypt);
}
}
}
return(null);
}
public PSTHeader(byte[] buffer)
{
dwMagic = ByteReader.ReadAnsiString(buffer, 0, 4);
CRCPartial = LittleEndianConverter.ToUInt32(buffer, 4);
wMagicClient = ByteReader.ReadAnsiString(buffer, 8, 2);
wVer = LittleEndianConverter.ToUInt16(buffer, 10);
wVerClient = LittleEndianConverter.ToUInt16(buffer, 12);
bPlatformCreate = buffer[14];
bPlatformAccess = buffer[15];
dwReserved1 = LittleEndianConverter.ToUInt32(buffer, 16);
dwReserved2 = LittleEndianConverter.ToUInt32(buffer, 20);
// bidUnused - which is not necessarily zeroed out
bidUnused = new BlockID(buffer, 24);
bidNextP = new BlockID(buffer, 32);
dwUnique = LittleEndianConverter.ToUInt32(buffer, 40);
int position = 44;
for (int index = 0; index < 32; index++)
{
rgnid[index] = LittleEndianConverter.ToUInt32(buffer, position);
position += 4;
}
root = new RootStructure(buffer, 180);
dwAlign = LittleEndianConverter.ToUInt32(buffer, 252);
Array.Copy(buffer, 256, rgbFM, 0, 128);
Array.Copy(buffer, 384, rgbFP, 0, 128);
bSentinel = buffer[512];
bCryptMethod = (bCryptMethodName)buffer[513];
bidNextB = new BlockID(buffer, 516);
dwCRCFull = LittleEndianConverter.ToUInt32(buffer, 524);
Array.Copy(buffer, 528, rgbReserved2, 0, 3);
bReserved = buffer[531];
Array.Copy(buffer, 532, rgbReserved3, 0, 32);
uint partial = PSTCRCCalculation.ComputeCRC(buffer, 8, 471);
if (partial != CRCPartial)
{
throw new InvalidChecksumException();
}
uint full = PSTCRCCalculation.ComputeCRC(buffer, 8, 516);
if (full != dwCRCFull)
{
throw new InvalidChecksumException();
}
}
public Section32(byte[] buffer, int offset)
{
SectionName = ByteReader.ReadAnsiString(buffer, offset + 0, 16).Trim('\0');
SegmentName = ByteReader.ReadAnsiString(buffer, offset + 16, 16).Trim('\0');
Address = LittleEndianConverter.ToUInt32(buffer, offset + 32);
Size = LittleEndianConverter.ToUInt32(buffer, offset + 36);
Offset = LittleEndianConverter.ToUInt32(buffer, offset + 40);
Align = LittleEndianConverter.ToUInt32(buffer, offset + 44);
RelocationOffset = LittleEndianConverter.ToUInt32(buffer, offset + 48);
NumberOfRelocationOffsets = LittleEndianConverter.ToUInt32(buffer, offset + 52);
Flags = LittleEndianConverter.ToUInt32(buffer, offset + 56);
Reserved1 = LittleEndianConverter.ToUInt32(buffer, offset + 60);
Reserved2 = LittleEndianConverter.ToUInt32(buffer, offset + 64);
}
public static DatabaseRecordFragment GetDatabaseRecordFragment(byte[] buffer)
{
string signature = ByteReader.ReadAnsiString(buffer, 0x00, 4);
ushort fragmentCount = BigEndianConverter.ToUInt16(buffer, 0x0E);
if (fragmentCount == 0 || signature != "VBLK")
{
return(null);
}
else
{
return(new DatabaseRecordFragment(buffer));
}
}
public ChallengeMessage(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0, 8);
MessageType = (MessageTypeName)LittleEndianConverter.ToUInt32(buffer, 8);
TargetName = AuthenticationMessageUtils.ReadUnicodeStringBufferPointer(buffer, 12);
NegotiateFlags = (NegotiateFlags)LittleEndianConverter.ToUInt32(buffer, 20);
ServerChallenge = ByteReader.ReadBytes(buffer, 24, 8);
// Reserved
TargetInfo = AuthenticationMessageUtils.ReadBufferPointer(buffer, 40);
if ((NegotiateFlags & NegotiateFlags.Version) > 0)
{
Version = new NTLMVersion(buffer, 48);
}
}
public static NTFSBootRecord ReadRecord(byte[] buffer)
{
string OEMID = ByteReader.ReadAnsiString(buffer, 0x03, SignatureLength);
bool isValid = String.Equals(OEMID, ValidSignature);
if (isValid)
{
return(new NTFSBootRecord(buffer));
}
else
{
return(null);
}
}
public static GuidPartitionTableHeader ReadFromDisk(Disk disk, long sectorIndex)
{
byte[] buffer = disk.ReadSector(sectorIndex);
string signature = ByteReader.ReadAnsiString(buffer, 0, 8);
uint revision = LittleEndianConverter.ToUInt32(buffer, 8);
uint crc32 = LittleEndianConverter.ToUInt32(buffer, 16);
if (signature == GuidPartitionTableSignature &&
revision == GuidPartitionTableRevision &&
crc32 == ComputeCRC32(buffer))
{
return(new GuidPartitionTableHeader(buffer));
}
return(null);
}
public static VolumeManagerDatabaseHeader ReadFromDisk(Disk disk, PrivateHeader privateHeader, TOCBlock tocBlock)
{
ulong sectorIndex = privateHeader.PrivateRegionStartLBA + tocBlock.ConfigStart;
byte[] sector = disk.ReadSector((long)sectorIndex);
string signature = ByteReader.ReadAnsiString(sector, 0x00, 4);
if (signature == VolumeManagerDatabaseSignature)
{
return(new VolumeManagerDatabaseHeader(sector));
}
else
{
return(null);
}
}
public static void WriteToDisk(Disk disk, PrivateHeader privateHeader)
{
byte[] bytes = privateHeader.GetBytes();
disk.WriteSectors((long)(privateHeader.PrivateRegionStartLBA + privateHeader.PrimaryPrivateHeaderLBA), bytes);
disk.WriteSectors((long)(privateHeader.PrivateRegionStartLBA + privateHeader.SecondaryPrivateHeaderLBA), bytes);
// update sector 6 if a Private Header is already present there
byte[] sector = disk.ReadSector(PrivateHeaderSectorIndex);
string signature = ByteReader.ReadAnsiString(sector, 0x00, 8);
if (signature == PrivateHeaderSignature)
{
disk.WriteSectors(PrivateHeaderSectorIndex, bytes);
}
}
public GuidPartitionTableHeader(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0, 8);
Revision = LittleEndianConverter.ToUInt32(buffer, 8);
HeaderSize = LittleEndianConverter.ToUInt32(buffer, 12);
CRC32 = LittleEndianConverter.ToUInt32(buffer, 16);
CurrentLBA = LittleEndianConverter.ToUInt64(buffer, 24);
BackupLBA = LittleEndianConverter.ToUInt64(buffer, 32);
FirstUsableLBA = LittleEndianConverter.ToUInt64(buffer, 40);
LastUsableLBA = LittleEndianConverter.ToUInt64(buffer, 48);
DiskGuid = LittleEndianConverter.ToGuid(buffer, 56);
PartitionEntriesLBA = LittleEndianConverter.ToUInt64(buffer, 72);
NumberOfPartitionEntries = LittleEndianConverter.ToUInt32(buffer, 80);
SizeOfPartitionEntry = LittleEndianConverter.ToUInt32(buffer, 84);
PartitionArrayCRC32 = LittleEndianConverter.ToUInt32(buffer, 88);
}
public NodeStatusResponse(byte[] buffer, int offset)
{
Header = new NameServicePacketHeader(buffer, ref offset);
Resource = new ResourceRecord(buffer, ref offset);
int position = 0;
byte numberOfNames = ByteReader.ReadByte(Resource.Data, ref position);
for (int index = 0; index < numberOfNames; index++)
{
string name = ByteReader.ReadAnsiString(Resource.Data, ref position, 16);
NameFlags nameFlags = (NameFlags)BigEndianReader.ReadUInt16(Resource.Data, ref position);
Names.Add(name, nameFlags);
}
Statistics = new NodeStatistics(Resource.Data, ref position);
}