private static List <PartitionEntry> GetExtended(FileStream streamToRead, uint startSector)
{
List <PartitionEntry> pList = new List <PartitionEntry>();
ulong offset = 512 * (ulong)startSector;
byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200);
pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector));
PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector);
pList.Add(secondEntry);
if (secondEntry.SystemID == "MS_EXTENDED")
{
pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector));
}
return(pList);
}
private static List<PartitionEntry> GetExtended(FileStream streamToRead, uint startSector)
{
List<PartitionEntry> pList = new List<PartitionEntry>();
ulong offset = 512 * (ulong)startSector;
byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200);
pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector));
PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector);
pList.Add(secondEntry);
if (secondEntry.SystemID == "MS_EXTENDED")
{
pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector));
}
return pList;
}
internal MasterBootRecord(byte[] bytes)
{
// Instantiate a byte array to hold 440 bytes (size of MBR Boot Code)
// Copy MBR sub-array into mbrCode
BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8);
// Check MBR Code Section against a list of known signatures
#region MD5Signature
string MD5Signature = null;
switch (Hash.Get(BootCode, BootCode.Length, "MD5"))
{
case WINDOWS5_X:
MD5Signature = "Windows 5.X";
break;
case WINDOWS6_0:
MD5Signature = "Windows 6.0";
break;
case WINDOWS6_1:
MD5Signature = "Windows 6.1+";
break;
case GRUB:
MD5Signature = "GRUB";
break;
case NYANCAT:
MD5Signature = "BOOTKIT Nyan Cat";
break;
case STONEDv2:
MD5Signature = "BOOTKIT Stonedv2";
break;
case STONEDv2_TRUE_CRYPT:
MD5Signature = "BOOTKIT Stonedv2";
break;
default:
MD5Signature = "UNKNOWN";
break;
}
#endregion MD5Signature
// Instantiate a blank Partition List
List<PartitionEntry> partitionList = new List<PartitionEntry>();
// Set object properties
DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
MBRSignature = MD5Signature;
for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));
if (entry.SystemID != "EMPTY")
{
partitionList.Add(entry);
}
}
PartitionTable = partitionList.ToArray();
}
internal MasterBootRecord(byte[] bytes)
{
// Instantiate a byte array to hold 440 bytes (size of MBR Boot Code)
// Copy MBR sub-array into mbrCode
BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8);
// Check MBR Code Section against a list of known signatures
#region MD5Signature
string MD5Signature = null;
switch (Hash.Get(BootCode, BootCode.Length, "MD5"))
{
case WINDOWS5_X:
MD5Signature = "Windows 5.X";
break;
case WINDOWS6_0:
MD5Signature = "Windows 6.0";
break;
case WINDOWS6_1:
MD5Signature = "Windows 6.1+";
break;
case GRUB:
MD5Signature = "GRUB";
break;
case NYANCAT:
MD5Signature = "BOOTKIT Nyan Cat";
break;
case STONEDv2:
MD5Signature = "BOOTKIT Stonedv2";
break;
case STONEDv2_TRUE_CRYPT:
MD5Signature = "BOOTKIT Stonedv2";
break;
default:
MD5Signature = "UNKNOWN";
break;
}
#endregion MD5Signature
// Instantiate a blank Partition List
List <PartitionEntry> partitionList = new List <PartitionEntry>();
// Set object properties
DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
MBRSignature = MD5Signature;
for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));
if (entry.SystemID != "EMPTY")
{
partitionList.Add(entry);
}
}
PartitionTable = partitionList.ToArray();
}
