/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private void getFilesSTFS(TreeNode tn) { int num = 0; long offset = 0; while (true) { offset = this.pirs_start + (num * 0x40); PirsEntry entry = new PirsEntry(); entry = this.getEntrySTFS(offset); if (entry.Filename.Trim() == "") { break; } if (((entry.Cluster == 0) && (entry.Size == 0)) && (entry.Parent == Convert.ToUInt16(tn.Tag))) { ListViewItem item = new ListViewItem(); item.Text = entry.Filename; item.SubItems.Add(entry.Size.ToString()); item.SubItems.Add(entry.Cluster.ToString()); item.SubItems.Add(entry.DateTime1.ToString()); item.SubItems.Add(""); item.ImageIndex = 0; item.Tag = num; this.listView.Items.Add(item); } num++; } num = 0; while (true) { offset = this.pirs_start + (num * 0x40); PirsEntry entry2 = new PirsEntry(); entry2 = this.getEntrySTFS(offset); if (entry2.Filename.Trim() == "") { return; } if ((entry2.Cluster != 0) && (entry2.Parent == Convert.ToUInt16(tn.Tag))) { ListViewItem item2 = new ListViewItem(); item2.Text = entry2.Filename; item2.SubItems.Add(entry2.Size.ToString()); item2.SubItems.Add(entry2.Cluster.ToString()); item2.SubItems.Add(entry2.DateTime1.ToString()); item2.SubItems.Add(""); item2.ImageIndex = 1; item2.ToolTipText = string.Format("Offset : 0x{0:X8}", this.getOffset((long)entry2.Cluster)); this.listView.Items.Add(item2); } num++; } }
/**
* Title: Xbox 360 Forensic Toolkit.
* Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and
* write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have
* been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS
* Application so that we can sissamble STFS packages and see their contents.
*
* Original Author: Party Buffalo - [email protected], wxPIRS - gael360
* Another Author: [email protected]
* License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE
* Link: https://code.google.com/p/party-buffalo/
* http://gael360.free.fr/
* Note: All Code that follows to the End point was added by [email protected]
*/
private PirsEntry getEntrySTFS(long num)
{
CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream());
io2.BaseStream.Position = (num);
PirsEntry entry = new PirsEntry();
char ch;
string str = "";
for (uint i = 0; i < 0x26; i++)
{
ch = io2.ReadChar();
if (ch != '\0')
{
str = str + Convert.ToString(ch);
}
}
entry.Filename = str;
if (entry.Filename.Trim() != "")
{
entry.Unknow = io2.ReadInt32();
entry.BlockLen = io2.ReadInt32();
int x = io2.ReadInt32();
entry.Cluster = (x >> 16);
entry.Parent = io2.ReadUInt16();
entry.Size = io2.ReadInt32();
entry.DateTime1 = this.dosDateTime(io2.ReadInt32());
entry.DateTime2 = this.dosDateTime(io2.ReadInt32());
}
//io2.Close();
return entry;
}
private PirsEntry getEntry()
{
PirsEntry entry = new PirsEntry();
entry.Filename = this.wr.readString(this.br, 0x26);
if (entry.Filename.Trim() != "")
{
entry.Unknow = this.wr.readInt32(this.br);
entry.BlockLen = this.wr.readInt32(this.br);
entry.Cluster = this.br.ReadInt32() >> 8;
entry.Parent = this.wr.readUInt16(this.br);
entry.Size = this.wr.readInt32(this.br);
entry.DateTime1 = this.dosDateTime(this.wr.readInt32(this.br));
entry.DateTime2 = this.dosDateTime(this.wr.readInt32(this.br));
}
return entry;
}
/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private void getDirectoriesSTFS(TreeNode tn) { int num = 0; long offset = 0; while (true) { offset = this.pirs_start + (num * 0x40); PirsEntry entry = new PirsEntry(); entry = this.getEntrySTFS(offset); if (entry.Filename.Trim() == "") { return; } if (((entry.Size == 0) && (entry.Cluster == 0)) && (entry.Parent == Convert.ToUInt16(tn.Tag))) { TreeNode node = new TreeNode(entry.Filename); node.Tag = num; node.ToolTipText = string.Format("0x{0:X4}", node.Tag); tn.Nodes.Add(node); this.getDirectoriesSTFS(node); } num++; } }
private void getDirectories(TreeNode tn)
{
int num = 0;
while (true)
{
this.br.BaseStream.Seek(this.pirs_start + (num * 0x40), SeekOrigin.Begin);
PirsEntry entry = new PirsEntry();
entry = this.getEntry();
if (entry.Filename.Trim() == "")
{
return;
}
if (((entry.Size == 0) && (entry.Cluster == 0)) && (entry.Parent == Convert.ToUInt16(tn.Tag)))
{
TreeNode node = new TreeNode(entry.Filename);
node.Tag = num;
node.ToolTipText = string.Format("0x{0:X4}", node.Tag);
tn.Nodes.Add(node);
this.getDirectories(node);
}
num++;
}
}
private void extractFolder(ushort tag, string foldername, string pathname)
{
ushort num = 0;
long offset = 0;
while (true)
{
PirsEntry entry = new PirsEntry();
if (STFSFile)
{
offset = ((PIRS_BASE + this.pirs_offset) + (num * 0x40));
entry = this.getEntrySTFS(offset);
}
else
{
this.br.BaseStream.Seek((PIRS_BASE + this.pirs_offset) + (num * 0x40), SeekOrigin.Begin);
entry = this.getEntry();
}
if (entry.Filename.Trim() == "")
{
return;
}
if (((entry.Cluster == 0) && (entry.Size == 0)) && (entry.Parent == tag))
{
this.extractFolder(num, entry.Filename, pathname + @"\" + foldername);
}
else if ((entry.Cluster != 0) && (entry.Parent == tag))
{
this.extractFile((long) entry.Cluster, (long) entry.Size, pathname + @"\" + foldername + @"\" + entry.Filename);
}
num = (ushort) (num + 1);
}
}
