public PrivateHeader(byte[] buffer)
{
if (buffer.Length > Length)
{
// Checksum only applies to the first 512 bytes (even when the sector size > 512 bytes)
buffer = ByteReader.ReadBytes(buffer, 0, 512);
}
Signature = ByteReader.ReadAnsiString(buffer, 0x00, 8);
uint checksum = BigEndianConverter.ToUInt32(buffer, 0x08);
MajorVersion = BigEndianConverter.ToUInt16(buffer, 0x0C);
MinorVersion = BigEndianConverter.ToUInt16(buffer, 0x0E);
LastUpdateDT = DateTime.FromFileTimeUtc(BigEndianConverter.ToInt64(buffer, 0x10));
UpdateSequenceNumber = BigEndianConverter.ToUInt64(buffer, 0x18);
PrimaryPrivateHeaderLBA = BigEndianConverter.ToUInt64(buffer, 0x20);
SecondaryPrivateHeaderLBA = BigEndianConverter.ToUInt64(buffer, 0x28);
DiskGuidString = ByteReader.ReadAnsiString(buffer, 0x30, 0x40).Trim('\0');
HostGuidString = ByteReader.ReadAnsiString(buffer, 0x70, 0x40).Trim('\0');
DiskGroupGuidString = ByteReader.ReadAnsiString(buffer, 0xB0, 0x40).Trim('\0');
DiskGroupName = ByteReader.ReadAnsiString(buffer, 0xF0, 31).Trim('\0');
BytesPerSector = BigEndianConverter.ToUInt32(buffer, 0x10F);
Flags = (PrivateHeaderFlags)BigEndianConverter.ToUInt32(buffer, 0x113);
PublicRegionSliceNumber = BigEndianConverter.ToUInt16(buffer, 0x117);
PrivateRegionSliceNumber = BigEndianConverter.ToUInt16(buffer, 0x119);
PublicRegionStartLBA = BigEndianConverter.ToUInt64(buffer, 0x11B);
PublicRegionSizeLBA = BigEndianConverter.ToUInt64(buffer, 0x123);
PrivateRegionStartLBA = BigEndianConverter.ToUInt64(buffer, 0x12B);
PrivateRegionSizeLBA = BigEndianConverter.ToUInt64(buffer, 0x133);
PrimaryTocLBA = BigEndianConverter.ToUInt64(buffer, 0x13B);
SecondaryTocLBA = BigEndianConverter.ToUInt64(buffer, 0x143);
NumberOfConfigs = BigEndianConverter.ToUInt32(buffer, 0x14B);
NumberOfLogs = BigEndianConverter.ToUInt32(buffer, 0x14F);
ConfigSizeLBA = BigEndianConverter.ToUInt64(buffer, 0x153);
LogSizeLBA = BigEndianConverter.ToUInt64(buffer, 0x15B);
DiskSignature = BigEndianConverter.ToUInt32(buffer, 0x163);
DiskSetGuid = BigEndianConverter.ToGuid(buffer, 0x167);
DiskSetGuidRepeat = BigEndianConverter.ToGuid(buffer, 0x177);
BigEndianWriter.WriteUInt32(buffer, 0x08, (uint)0); // we exclude the checksum field from checksum calculations
m_isChecksumValid = (checksum == CalculateChecksum(buffer));
}
public TOCBlock(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0x00, 8);
uint checksum = BigEndianConverter.ToUInt32(buffer, 0x08);
UpdateSequenceNumber = BigEndianConverter.ToUInt64(buffer, 0x0C);
// 16 zeros
int offset = 0x24;
// If the first character is not null (0x00), then there is a region defined
while (buffer[offset] != 0)
{
TOCRegion region = new TOCRegion(buffer, offset);
Regions.Add(region);
offset += TOCRegion.Length;
}
BigEndianWriter.WriteUInt32(buffer, 0x08, (uint)0); // we exclude the checksum field from checksum calculations
m_isChecksumValid = (checksum == PrivateHeader.CalculateChecksum(buffer));
}
/// <returns>List of sectors that failed verification</returns>
public static List <long> VerifyTestPattern(Disk disk, ref long sectorsRead)
{
int transferSize = Settings.MaximumTransferSizeLBA;
sectorsRead = 0;
List <long> failedSectorList = new List <long>();
long totalSectors = disk.TotalSectors;
for (long sectorIndex = 0; sectorIndex < totalSectors; sectorIndex += transferSize)
{
int sectorsToRead = (int)Math.Min(transferSize, totalSectors - sectorIndex);
// Clear allocations from previous iteration
GC.Collect();
GC.WaitForPendingFinalizers();
byte[] data = disk.ReadSectors(sectorIndex, sectorsToRead);
for (int offset = 0; offset < sectorsToRead; offset++)
{
byte[] sectorBytes = ByteReader.ReadBytes(data, (int)(offset * disk.BytesPerSector), disk.BytesPerSector);
byte[] expected = GetTestPattern(sectorIndex + offset, disk.BytesPerSector);
if (sectorIndex + offset == 0)
{
long sectorNumber = (long)BigEndianConverter.ToUInt64(sectorBytes, 0);
long sectorCount = (long)BigEndianConverter.ToUInt64(sectorBytes, 8);
if (sectorNumber == 0 && sectorCount > 0)
{
totalSectors = sectorCount;
BigEndianWriter.WriteUInt64(sectorBytes, 8, 0);
}
}
if (!ByteUtils.AreByteArraysEqual(sectorBytes, expected))
{
failedSectorList.Add(sectorIndex + offset);
}
}
sectorsRead += sectorsToRead;
}
return(failedSectorList);
}
private List <KernelUpdateLogEntry> m_logEntries = new List <KernelUpdateLogEntry>(); // PendingTransactionID, CommitTransactionID
public KernelUpdateLogPage(byte[] buffer)
{
Signature = ByteReader.ReadAnsiString(buffer, 0x00, 4);
UnknownTransactionID = BigEndianConverter.ToUInt64(buffer, 0x04);
SequenceNumber = BigEndianConverter.ToUInt32(buffer, 0x0C);
NumberOfPages = BigEndianConverter.ToUInt32(buffer, 0x10);
PageIndex = BigEndianConverter.ToUInt32(buffer, 0x14);
// Note: for the first KLog, the most recent entry is at the top
m_logEntries.Clear();
int offset = 0x18;
while (offset < buffer.Length - 24) // room of one more entry
{
KernelUpdateLogEntryStatus status = (KernelUpdateLogEntryStatus)buffer[offset];
offset += 1;
if (status != KernelUpdateLogEntryStatus.NotExist)
{
KernelUpdateLogEntry entry = new KernelUpdateLogEntry();
entry.Status = status;
entry.CommittedTransactionID = BigEndianConverter.ToUInt64(buffer, offset);
offset += 8;
entry.PendingTransactionID = BigEndianConverter.ToUInt64(buffer, offset);
offset += 8;
entry.RecoverySequenceNumber = BigEndianConverter.ToUInt32(buffer, offset);
offset += 4;
m_logEntries.Add(entry);
offset += 3; // padding to align to 4-byte boundary
}
else
{
break;
}
}
}
public TrueCryptHeader(byte[] buffer, byte[] password)
{
Salt = ByteReader.ReadBytes(buffer, 0, 64);
byte[] headerBytes = new byte[448];
Array.Copy(buffer, 64, headerBytes, 0, 448);
byte[] decrypted = DecryptHeader(headerBytes, password);
if (m_isValid)
{
Signature = ByteReader.ReadAnsiString(decrypted, 0, 4);
FormatVersion = BigEndianConverter.ToUInt16(decrypted, 4);
MinProgramVersionRequired = BigEndianConverter.ToUInt16(decrypted, 6);
Checksum256 = BigEndianConverter.ToUInt32(decrypted, 8);
HiddenVolumeSize = BigEndianConverter.ToUInt64(decrypted, 28);
VolumeSize = BigEndianConverter.ToUInt64(decrypted, 36);
MasterKeyScopeOffset = BigEndianConverter.ToUInt64(decrypted, 44);
MasterKeyEncryptedAreaSize = BigEndianConverter.ToUInt64(decrypted, 52);
Flags = BigEndianConverter.ToUInt32(decrypted, 60);
SectorSize = BigEndianConverter.ToUInt32(decrypted, 64);
Checksum64 = BigEndianConverter.ToUInt32(decrypted, 188);
MasterKey = ByteReader.ReadBytes(decrypted, 192, 192);
AssignKey(m_algorithmChain, MasterKey);
}
}
public CodeDirectoryBlob(byte[] buffer, int offset) : base(buffer, offset)
{
uint length = BigEndianConverter.ToUInt32(buffer, offset + 4);
Version = BigEndianConverter.ToUInt32(buffer, offset + 8);
Flags = (CodeDirectoryFlags)BigEndianConverter.ToUInt32(buffer, offset + 12);
uint hashOffset = BigEndianConverter.ToUInt32(buffer, offset + 16);
uint identOffset = BigEndianConverter.ToUInt32(buffer, offset + 20);
uint numberOfSpecialSlots = BigEndianConverter.ToUInt32(buffer, offset + 24);
uint numberOfCodeSlots = BigEndianConverter.ToUInt32(buffer, offset + 28);
CodeLimit = BigEndianConverter.ToUInt32(buffer, offset + 32);
HashSize = ByteReader.ReadByte(buffer, offset + 36);
HashType = (HashType)ByteReader.ReadByte(buffer, offset + 37);
Platform = ByteReader.ReadByte(buffer, offset + 38);
PageSizeLog2 = ByteReader.ReadByte(buffer, offset + 39);
Spare2 = BigEndianConverter.ToUInt32(buffer, offset + 40);
uint scatterOffset = 0;
uint teamIDOffset = 0;
if (Version >= ScatterMinimumVersion)
{
scatterOffset = BigEndianConverter.ToUInt32(buffer, offset + 44);
if (Version >= TeamIDMinimumVersion)
{
teamIDOffset = BigEndianConverter.ToUInt32(buffer, offset + 48);
if (Version >= CodeLimit64MinimumVersion)
{
Spare3 = BigEndianConverter.ToUInt32(buffer, offset + 52);
CodeLimit64 = BigEndianConverter.ToUInt64(buffer, offset + 56);
if (Version >= ExecSegMinimumVersion)
{
ExecSegBase = BigEndianConverter.ToUInt64(buffer, offset + 64);
ExecSegLimit = BigEndianConverter.ToUInt64(buffer, offset + 72);
ExecSegFlags = BigEndianConverter.ToUInt64(buffer, offset + 80);
}
}
}
}
if (identOffset != 0)
{
Ident = ByteReader.ReadNullTerminatedAnsiString(buffer, offset + (int)identOffset);
}
if (teamIDOffset != 0)
{
TeamID = ByteReader.ReadNullTerminatedAnsiString(buffer, offset + (int)teamIDOffset);
}
int specialHashesOffset = (int)hashOffset - (int)numberOfSpecialSlots * (int)HashSize;
for (int index = 0; index < numberOfSpecialSlots; index++)
{
byte[] hash = ByteReader.ReadBytes(buffer, offset + specialHashesOffset + index * (int)HashSize, (int)HashSize);
SpecialHashes.Add(hash);
}
for (int index = 0; index < numberOfCodeSlots; index++)
{
byte[] hash = ByteReader.ReadBytes(buffer, offset + (int)hashOffset + index * (int)HashSize, (int)HashSize);
CodeHashes.Add(hash);
}
}
public LongLBAModeParameterBlockDescriptor(byte[] buffer, int offset)
{
NumberOfBlocks = BigEndianConverter.ToUInt64(buffer, offset + 0);
Reserved = BigEndianConverter.ToUInt32(buffer, offset + 8);
LogicalBlockLength = BigEndianConverter.ToUInt32(buffer, offset + 12);
}
public ReadCapacity16Parameter(byte[] buffer)
{
ReturnedLBA = BigEndianConverter.ToUInt64(buffer, 0);
BlockLengthInBytes = BigEndianConverter.ToUInt32(buffer, 8);
}
protected override void ReadOperationParameters(byte[] buffer, int offset)
{
VolumeGuid = BigEndianConverter.ToGuid(buffer, offset + 0);
NumberOfCommittedSectors = BigEndianConverter.ToUInt64(buffer, offset + 16);
}
