/// <summary>
/// Checks the file magic to check if it's a valid CON/LIVE/PIRS package
/// </summary>
public bool IsSTFSPackage()
{
if (PackageStream.Length >= 0xA000)
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = 0;
byte[] Buffer = r.ReadBytes(0x200);
r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
uint val = r.ReadUInt32();
switch (val)
{
// CON
case 0x434F4E20:
return(true);
// LIVE
case 0x4C495645:
return(true);
// PIRS
case 0x50495253:
return(true);
// NIGR
default:
return(true);
}
}
else
{
return(false);
}
}
List <DevPartitionRegions> dP;/*enetration*/
DevPartitionRegions[] DevPartitions()
{
if (dP == null)
{
dP = new List <DevPartitionRegions>();
// Load the regions
Streams.Reader r = Reader();
r.BaseStream.Position = 0;
byte[] Buffer = r.ReadBytes(0x200);
r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
r.BaseStream.Position = 0x8; // data
dP.Add(new DevPartitionRegions()
{
RegionName = "Content",
Sector = r.ReadUInt32(),
PartitionSize = r.ReadUInt32() * 0x200,
});
dP.Add(new DevPartitionRegions()
{
RegionName = "Xbox 360 Dashboard Volume",
Sector = r.ReadUInt32(),
PartitionSize = r.ReadUInt32() * 0x200,
});
}
return(dP.ToArray());
}
private void button1_Click(object sender, EventArgs e)
{
try
{
System.Threading.ThreadStart ts = delegate
{
CLKsFATXLib.Streams.Reader OR = Original.Reader();
CLKsFATXLib.Streams.Writer D = Destination.Writer();
OR.BaseStream.Position = 0;
D.BaseStream.Position = 0;
for (long i = 0; i < Original.Length; i += 0x6000)
{
D.Write(OR.ReadBytes(0x6000));
progressBar1.Invoke((MethodInvoker) delegate
{
try
{
progressBar1.Maximum = (int)(Original.Length >> 4);
progressBar1.Value = (int)(((i >> 8) < 0) ? 0 : i >> 4);
}
catch { }
});
}
OR.Close();
D.Close();
};
System.Threading.Thread t = new System.Threading.Thread(ts);
t.Start();
}
catch (Exception x) { MessageBox.Show(x.Message); }
}
/// <summary>
/// If the file is an STFS package, it will get the package's icon (non-game icon)
/// </summary>
/// <returns>STFS package content icon</returns>
public System.Drawing.Image ContentIcon()
{
// Get a new reader for this file
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.ContentImageSize;
int Size = r.ReadInt32();
r.BaseStream.Position = (long)Geometry.STFSOffsets.ContentImage;
try
{
return System.Drawing.Image.FromStream(new System.IO.MemoryStream(r.ReadBytes(Size)));
}
catch { return null; }
}
/// <summary>
/// If the file is an STFS package, it will get the package's icon (non-game icon)
/// </summary>
/// <returns>STFS package content icon</returns>
public System.Drawing.Image ContentIcon()
{
// Get a new reader for this file
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.ContentImageSize;
int Size = r.ReadInt32();
r.BaseStream.Position = (long)Geometry.STFSOffsets.ContentImage;
try
{
return(System.Drawing.Image.FromStream(new System.IO.MemoryStream(r.ReadBytes(Size))));
}
catch { return(null); }
}
/// <summary>
/// Gets the title names that correspond with title ID's from a file
/// </summary>
/// <returns>List of title ID's with their accurate title names</returns>
private Structs.CachedTitleName[] CachedFromFile(File f)
{
List <Structs.CachedTitleName> tnl = new List <CLKsFATXLib.Structs.CachedTitleName>();
int BlockLength = 0x34;
Streams.Reader r = new CLKsFATXLib.Streams.Reader(f.GetStream());
for (int i = 0, Previous = 0; i < r.BaseStream.Length / BlockLength; i++, Previous += 0x34)
{
// Set the position of the stream
r.BaseStream.Position = Previous;
// Create the new CachedTitleName struct
Structs.CachedTitleName TN = new CLKsFATXLib.Structs.CachedTitleName();
// Read the title ID
TN.ID = r.ReadUInt32();
// Read the name
TN.Name = r.ReadCString();
// Add that to the list
tnl.Add(TN);
}
return(tnl.ToArray());
}
void AfterSelect()
{
listView1.Items.Clear();
System.IO.DirectoryInfo clicked = new System.IO.DirectoryInfo((string)treeView1.SelectedNode.Tag);
foreach (System.IO.DirectoryInfo di in clicked.GetDirectories())
{
ListViewItem li = new ListViewItem(di.Name);
li.SubItems.Add("File Folder");
li.SubItems.Add("");
li.SubItems.Add(di.LastWriteTime.ToString());
li.SubItems.Add((VariousFunctions.IsTitleIDFolder(di.Name)) ? Party_Buffalo.Cache.CheckCache(di.Name) : "");
li.Tag = new object[] { di.FullName, true };
li.ImageIndex = 0;
listView1.Items.Add(li);
}
foreach (System.IO.FileInfo fi in clicked.GetFiles())
{
ListViewItem li = new ListViewItem(fi.Name);
li.SubItems.Add("File");
li.SubItems.Add(VariousFunctions.ByteConversion(fi.Length));
li.SubItems.Add(fi.LastWriteTime.ToString());
// Get the file name
CLKsFATXLib.Streams.Reader br = new CLKsFATXLib.Streams.Reader(new System.IO.FileStream(fi.FullName, System.IO.FileMode.Open));
if (br.BaseStream.Length > 4)
{
uint header = br.ReadUInt32(true);
if (header == 0x434F4E20 || header == 0x4C495645 || header == 0x50495253)
{
br.BaseStream.Position = (long)CLKsFATXLib.Geometry.STFSOffsets.DisplayName;
li.SubItems.Add(br.ReadUnicodeString(0x80));
}
}
br.Close();
li.Tag = new object[] { fi.FullName, true };
li.ImageIndex = 1;
listView1.Items.Add(li);
}
}
/// <summary>
/// Creates a new file from the given path
/// </summary>
/// <param name="Path">Path to the file</param>
/// <returns>Returns a WriteResult with a bool indicating whether or not there were problems writing the file. If true, then the Entry property will be the conflicting entry</returns>
public Structs.WriteResult CreateNewFile(string Path)
{
// Check to see if the file they want to use is currently in use
try
{
System.IO.FileStream fs = System.IO.File.Open(Path, System.IO.FileMode.Open);
// Check file length
if (fs.Length > UInt32.MaxValue)
{
throw new Exception("File size too large! Must be smaller than " + UInt32.MaxValue.ToString() + " bytes!");
}
// File was good, continue
fs.Close();
}
catch (Exception x)
{
Console.WriteLine("Error occured when creating new file. File in use");
throw x;
}
if (fa.Cancel)
{
return new WriteResult()
{
CouldNotWrite = false,
};
}
System.Diagnostics.Stopwatch sw = new System.Diagnostics.Stopwatch();
sw.Start();
EntryEventArgs eea = new EntryEventArgs();
string NewName = System.IO.Path.GetFileName(Path);
fa.CurrentFilePath = this.FullPath + "\\" + NewName;
fa.CurrentFile = NewName;
fa.MaxValue = 1;
fa.Progress = 0;
OnFolderAction(ref fa);
WriteResult Return = new WriteResult();
Console.WriteLine("Comparing folder/file names");
foreach (Folder f in Folders())
{
if (f.Name.ToLower() == NewName.ToLower())
{
Return.Entry = f;
Return.CouldNotWrite = true;
Return.ConflictingEntryPath = f.FullPath;
return Return;
}
}
foreach (File f in Files())
{
if (f.Name.ToLower() == NewName.ToLower())
{
Return.Entry = f;
Return.CouldNotWrite = true;
Return.ConflictingEntryPath = f.FullPath;
return Return;
}
}
if (new System.IO.FileInfo(Path).Length == 0)
{
Console.WriteLine("Creating null file");
EntryData newE = new EntryFunctions(this).GetNewEntry(this, 0, new Geometry.Flags[0], NewName);
try
{
Console.WriteLine("Getting blocks needed");
int BlocksNeeded = 1;
Console.WriteLine(sw.Elapsed.ToString());
List<uint> Blocks = new List<uint>();
Console.WriteLine("Getting new entry");
if (newE.EntryOffset >= VariousFunctions.GetBlockOffset(this.BlocksOccupied[BlocksOccupied.Length - 1], this) + this.PartitionInfo.ClusterSize)
{
List<uint> blocks = this.BlocksOccupied.ToList();
blocks.Add(VariousFunctions.GetBlockFromOffset(newE.EntryOffset, this.PartitionInfo));
this.BlocksOccupied = blocks.ToArray();
}
Console.WriteLine(sw.Elapsed.ToString());
Blocks.Add(newE.StartingCluster);
// Write the file data...
// FileAction to be used
fa.MaxValue = Blocks.Count;
File f = new File(this.PartitionInfo, newE, this.Drive);
f.Parent = this;
f.FullPath = this.FullPath + "\\" + f.Name;
eea.ModifiedEntry = f;
Return.Entry = f;
this.cachedFiles.Add(f);
fa.Progress = Blocks.Count;
}
// This excpetion here is going to be that we're out of space...
catch (Exception x)
{
Console.WriteLine("Exception thrown, deleting written entry");
// Delete this entry
newE.NameSize = 0xE5;
// Create a new entry functions class so we can get rid of this entry
EntryFunctions ef = new EntryFunctions(this);
// Clear the FAT chain
Console.WriteLine("Clearing FAT chain");
ef.ClearFATChain(new uint[] { newE.StartingCluster });
// Mark this entry as deleted
ef.CreateNewEntry(newE);
throw x;
}
}
else
{
Console.WriteLine(sw.Elapsed.ToString());
Console.WriteLine("Getting blocks needed");
int BlocksNeeded = (int)(VariousFunctions.UpToNearestCluster(new System.IO.FileInfo(Path).Length, PartitionInfo.ClusterSize) / PartitionInfo.ClusterSize);
Console.WriteLine(sw.Elapsed.ToString());
List<uint> Blocks = new List<uint>();
Console.WriteLine("Getting new entry");
EntryData newE = new EntryFunctions(this).GetNewEntry(this, (uint)new System.IO.FileInfo(Path).Length, new Geometry.Flags[0], NewName);
if (newE.EntryOffset >= VariousFunctions.GetBlockOffset(this.BlocksOccupied[BlocksOccupied.Length - 1], this) + this.PartitionInfo.ClusterSize)
{
List<uint> blocks = this.BlocksOccupied.ToList();
blocks.Add(VariousFunctions.GetBlockFromOffset(newE.EntryOffset, this.PartitionInfo));
this.BlocksOccupied = blocks.ToArray();
}
Console.WriteLine(sw.Elapsed.ToString());
Blocks.Add(newE.StartingCluster);
try
{
Console.WriteLine("Getting free blocks");
Blocks.AddRange(Drive.GetFreeBlocks(this, BlocksNeeded - 1, newE.StartingCluster, 0, false));
Console.WriteLine(sw.Elapsed.ToString());
}
// This excpetion here is going to be that we're out of space...
catch (Exception x)
{
Console.WriteLine("Exception thrown, deleting written entry");
// Delete this entry
newE.NameSize = 0xE5;
// Create a new entry functions class so we can get rid of this entry
EntryFunctions ef = new EntryFunctions(this);
// Clear the FAT chain
Console.WriteLine("Clearing FAT chain");
ef.ClearFATChain(new uint[] { newE.StartingCluster });
// Mark this entry as deleted
ef.CreateNewEntry(newE);
throw x;
}
Console.WriteLine("Writing FAT chain");
// Write that FAT chain
new EntryFunctions(this).WriteFATChain(Blocks.ToArray());
Console.WriteLine(sw.Elapsed.ToString());
// Write the file data...
// FileAction to be used
fa.MaxValue = Blocks.Count;
// The IO to read the file
Streams.Reader FileReader = null;
try
{
FileReader = new CLKsFATXLib.Streams.Reader(new System.IO.FileStream(Path, System.IO.FileMode.Open));
}
catch
{
System.Threading.Thread.Sleep(1000);
try
{
FileReader = new CLKsFATXLib.Streams.Reader(new System.IO.FileStream(Path, System.IO.FileMode.Open));
}
catch (Exception x)
{
Console.WriteLine("Exception thrown, deleting written entry");
// Delete this entry
newE.NameSize = 0xE5;
// Create a new entry functions class so we can get rid of this entry
EntryFunctions ef = new EntryFunctions(this);
// Clear the FAT chain
Console.WriteLine("Clearing FAT chain");
ef.ClearFATChain(Blocks.ToArray());
// Mark this entry as deleted
ef.CreateNewEntry(newE);
throw x;
}
}
// The IO to write to the destination file
Streams.Writer FileWriter = Drive.Writer();
// Loop for each block...
for (int i = 0; i < Blocks.Count - 1; i++)
{
if (fa.Cancel)
{
Console.WriteLine("Cancel engaged");
FileReader.Close();
File newfile = new File(this.PartitionInfo, newE, this.Drive);
newfile.Parent = this;
newfile.FullPath = this.FullPath + "\\" + newfile.Name;
this.cachedFiles.Add(newfile);
eea.FullParentPath = FullPath;
eea.ModifiedEntry = newfile;
eea.ParentFolder = this;
OnEntryEvent(ref eea);
UpdateModifiedTime();
Return.Entry = newfile;
return Return;
}
// Set the position to the beginning of the block
FileWriter.BaseStream.Position = VariousFunctions.GetBlockOffset(Blocks[i], this);
for (int j = 1, k = 0; j <= 0x100; j++, k++)
{
if (i + k == Blocks.Count - 1)
{
//Console.WriteLine("Writing part of file");
FileWriter.Write(FileReader.ReadBytes((int)PartitionInfo.ClusterSize * k));
i += k;
fa.Progress += k;
break;
}
else if (Blocks[i + k] == Blocks.Count - 2 || Blocks[i + k] + 1 != Blocks[i + j] || j == 10)
{
//Console.WriteLine("Writing part of file");
FileWriter.Write(FileReader.ReadBytes((int)PartitionInfo.ClusterSize * j));
i += k;
fa.Progress += j;
break;
}
}
OnFolderAction(ref fa);
}
Console.WriteLine(sw.Elapsed.ToString());
// For the last cluster, we don't know how long it is... so we use
// this nifty function I made to do that for us
Console.WriteLine("Seeking to final cluster");
FileWriter.BaseStream.Position = VariousFunctions.GetBlockOffset(Blocks[Blocks.Count - 1], this);
// Read/write data
byte[] ToWrite = new byte[(int)VariousFunctions.UpToNearest200(VariousFunctions.RemainingData(BlocksNeeded, new System.IO.FileInfo(Path).Length, this))];
if ((int)VariousFunctions.RemainingData(BlocksNeeded, new System.IO.FileInfo(Path).Length, this) < (int)VariousFunctions.UpToNearest200((int)VariousFunctions.RemainingData(BlocksNeeded, new System.IO.FileInfo(Path).Length, this)))
{
for (int i = (int)VariousFunctions.RemainingData(BlocksNeeded, new System.IO.FileInfo(Path).Length, this) + 1; i < ToWrite.Length; i++)
{
ToWrite[i] = 0xFF;
}
}
byte[] Buffer = FileReader.ReadBytes((int)VariousFunctions.RemainingData(BlocksNeeded, new System.IO.FileInfo(Path).Length, this));
Array.Copy(Buffer, 0, ToWrite, 0, Buffer.Length);
Buffer = null;
Console.WriteLine("Writing final cluster");
FileWriter.Write(ToWrite);
fa.Progress++;
OnFolderAction(ref fa);
Console.WriteLine("Closing streams");
FileReader.Close();
Console.WriteLine(sw.Elapsed.ToString());
File newF = new File(this.PartitionInfo, newE, this.Drive);
newF.Parent = this;
newF.FullPath = this.FullPath + "\\" + newF.Name;
this.cachedFiles.Add(newF);
Return.Entry = newF;
eea.ModifiedEntry = newF;
}
eea.FullParentPath = FullPath;
eea.ParentFolder = this;
OnEntryEvent(ref eea);
UpdateModifiedTime();
return Return;
}
/// <summary>
/// If the file is an STFS package, it will get the package's display (content) name
/// </summary>
/// <returns>Package display/content name</returns>
public string ContentName()
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.DisplayName;
return(r.ReadUnicodeString(0x80));
}
/// <summary>
/// If the file is an STFS package, it will get the icon for the game
/// </summary>
public System.Drawing.Image TitleIcon()
{
if (IsSTFSPackage())
{
if (ti == null && !tiattempted)
{
// Get a new reader for this file
Streams.Reader r = new CLKsFATXLib.Streams.Reader(GetStream());
r.BaseStream.Position = (long)Geometry.STFSOffsets.TitleImageSize;
int Size = r.ReadInt32();
if (Size == 0)
{
giattempted = true;
return null;
}
r.BaseStream.Position = (long)Geometry.STFSOffsets.TitleImage;
try
{
ti = System.Drawing.Image.FromStream(new System.IO.MemoryStream(r.ReadBytes(Size)));
}
catch { }
tiattempted = true;
}
return ti;
}
throw new Exception("File is not a valid STFS package!");
}
// Returns the profile, otherwise returns null
public File IsProfileFolder()
{
// Loop for each subdirectory
foreach (Folder XboxDashboard in Folders())
{
// If the folder name is that of the Xbox Dashboard title ID
if (XboxDashboard.IsTitleIDFolder && XboxDashboard.Name.ToLower() == "fffe07d1")
{
foreach (Folder ProfileFolder in XboxDashboard.Folders())
{
// If the folder name is that of the profile ID
if (ProfileFolder.IsKnownFolder && ProfileFolder.Name == "00010000")
{
// Loop for each file in this directory
foreach (File f in ProfileFolder.Files())
{
if (f.Name == f.ContentName())
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(f.GetStream());
r.BaseStream.Position = 0x344;
if (r.ReadUInt32() == 0x00010000)
{
return f;
}
}
}
break;
}
}
break;
}
}
return null;
}
public EntryData[] EntryDataFromBlock(uint Block)
{
bool Break = false;
List<EntryData> eList = new List<EntryData>();
// Get our binary reader
Streams.Reader r1 = Parent.Drive.Reader();
r1.BaseStream.Position = VariousFunctions.GetBlockOffset(Block, Parent);
/* Parent.PartitionInfo.Clusters / 0x40 / 0x8 because if each
* entry is 0x40 in length and the cluster is filled to the
* max with cluster entries, then we can do division to get
* the number of entries that would be in that cluster
* the 0x8 part is because on drives we have to read in intervals
* of 0x200 right? So if Parent.PartitionInfo.Clusters / 0x40 = 0x100,
* then that means that there are 0x100 entries per cluster...
* divide that by 8 (the number of clusters within a 0x200 interval) and
* that's how many shits we have to go forward */
for (int j = 0; j < Parent.PartitionInfo.ClusterSize / 0x1000; j++)
{
// Increment our position
// Open another reader using a memory stream
long r1Position = r1.BaseStream.Position;
Streams.Reader r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(r1.ReadBytes(0x1000)));
for (int k = 0; k < (0x1000 / 0x40); k++)
{
// Check to see if we've passed the last entry...
uint val = r.ReadUInt32();
if (val == 0x0 || val == 0xFFFFFFFF)
{
Break = true;
break;
}
// Go back four bytes because we just checked the next four...
r.BaseStream.Position -= 4;
long StartOffset = r.BaseStream.Position;
EntryData e = new EntryData();
e.EntryOffset = r.BaseStream.Position + r1Position;
e.NameSize = r.ReadByte();
e.Flags = r.ReadByte();
/* Because some f*****g smart guy decided to put the
* deleted flag in the name size field, we have to check
* if it's deleted or not...*/
if (e.NameSize == 0xE5)
{
// Fuckers
e.Name = Encoding.ASCII.GetString(r.ReadBytes(0x2A));
}
else
{
e.Name = Encoding.ASCII.GetString(r.ReadBytes(e.NameSize));
}
r.BaseStream.Position = StartOffset + 0x2C;
e.StartingCluster = r.ReadUInt32();
e.Size = r.ReadUInt32();
e.CreationDate = r.ReadUInt16();
e.CreationTime = r.ReadUInt16();
e.AccessDate = r.ReadUInt16();
e.AccessTime = r.ReadUInt16();
e.ModifiedDate = r.ReadUInt16();
e.ModifiedTime = r.ReadUInt16();
eList.Add(e);
}
r.Close();
if (Break)
{
break;
}
}
return eList.ToArray();
}
/// <summary>
/// If the file is an STFS package, it will get the game's unique identifier
/// </summary>
public uint TitleID()
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.TitleID;
return r.ReadUInt32();
}
/// <summary>
/// Checks the file magic to check if it's a valid CON/LIVE/PIRS package
/// </summary>
public bool IsSTFSPackage()
{
if (!isstfs && !stfschecked)
{
if (Size >= 0xA000)
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(Drive.Stream());
r.BaseStream.Position = StartingOffset;
byte[] Buffer = null;
try
{
Buffer = r.ReadBytes(0x200);
}
catch { stfschecked = false; return isstfs = false; }
r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
uint val = 0;
try
{
val = r.ReadUInt32();
}
catch { stfschecked = false; return isstfs = false; }
r.Close();
switch (val)
{
// CON
case 0x434F4E20:
stfschecked = true;
stfsmagic = "CON";
return isstfs = true;
// LIVE
case 0x4C495645:
stfschecked = true;
stfsmagic = "LIVE";
return isstfs = true;
// PIRS
case 0x50495253:
stfschecked = true;
stfsmagic = "PIRS";
return isstfs = true;
// NIGR
default:
stfschecked = true;
stfsmagic = "";
return isstfs = false;
}
}
else
{
stfschecked = true;
return isstfs = false;
}
}
return isstfs;
}
/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private void getSTFSDescription() { CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream()); long num = this.getCultureOffset(); io2.BaseStream.Position = (0x410L + num); byte[] data = new byte[0x100]; data = io2.ReadBytes(0x100); this.log("Title : " + this.wr.unicodeToStr(data, 2) + "\r\n"); io2.BaseStream.Position = (0xd10L + num); byte[] buffer2 = new byte[0x100]; buffer2 = io2.ReadBytes(0x100); this.log("Description : " + this.wr.unicodeToStr(buffer2, 2) + "\r\n"); io2.BaseStream.Position = (0x1610L); byte[] buffer3 = new byte[0x100]; buffer3 = io2.ReadBytes(0x100); this.log("Publisher : " + this.wr.unicodeToStr(buffer3, 2) + "\r\n"); //io2.Close(); }
public EntryData[] EntryDataFromBlock(uint Block)
{
bool Break = false;
List <EntryData> eList = new List <EntryData>();
// Get our binary reader
Streams.Reader r1 = Parent.Drive.Reader();
r1.BaseStream.Position = VariousFunctions.GetBlockOffset(Block, Parent);
/* Parent.PartitionInfo.Clusters / 0x40 / 0x8 because if each
* entry is 0x40 in length and the cluster is filled to the
* max with cluster entries, then we can do division to get
* the number of entries that would be in that cluster
* the 0x8 part is because on drives we have to read in intervals
* of 0x200 right? So if Parent.PartitionInfo.Clusters / 0x40 = 0x100,
* then that means that there are 0x100 entries per cluster...
* divide that by 8 (the number of clusters within a 0x200 interval) and
* that's how many shits we have to go forward */
for (int j = 0; j < Parent.PartitionInfo.ClusterSize / 0x1000; j++)
{
// Increment our position
// Open another reader using a memory stream
long r1Position = r1.BaseStream.Position;
Streams.Reader r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(r1.ReadBytes(0x1000)));
for (int k = 0; k < (0x1000 / 0x40); k++)
{
// Check to see if we've passed the last entry...
uint val = r.ReadUInt32();
if (val == 0x0 || val == 0xFFFFFFFF)
{
Break = true;
break;
}
// Go back four bytes because we just checked the next four...
r.BaseStream.Position -= 4;
long StartOffset = r.BaseStream.Position;
EntryData e = new EntryData();
e.EntryOffset = r.BaseStream.Position + r1Position;
e.NameSize = r.ReadByte();
e.Flags = r.ReadByte();
/* Because some f*****g smart guy decided to put the
* deleted flag in the name size field, we have to check
* if it's deleted or not...*/
if (e.NameSize == 0xE5)
{
// Fuckers
e.Name = Encoding.ASCII.GetString(r.ReadBytes(0x2A));
}
else
{
e.Name = Encoding.ASCII.GetString(r.ReadBytes(e.NameSize));
}
r.BaseStream.Position = StartOffset + 0x2C;
e.StartingCluster = r.ReadUInt32();
e.Size = r.ReadUInt32();
e.CreationDate = r.ReadUInt16();
e.CreationTime = r.ReadUInt16();
e.AccessDate = r.ReadUInt16();
e.AccessTime = r.ReadUInt16();
e.ModifiedDate = r.ReadUInt16();
e.ModifiedTime = r.ReadUInt16();
eList.Add(e);
}
r.Close();
if (Break)
{
break;
}
}
return(eList.ToArray());
}
public uint[] GetBlocksOccupied()
{
List <uint> Blocks = new List <uint>();
Streams.Reader r = Parent.Drive.Reader();
Blocks.Add(Parent.StartingCluster);
byte[] Buffer = new byte[0x1000];
int buffersize = 0x1000;
long lastoffset = 0;
for (int i = 0; i < Blocks.Count; i++)
{
r.BaseStream.Position = VariousFunctions.BlockToFATOffset(Blocks[i], Parent).DownToNearestCluster(0x1000);
// We use this so that we aren't reading the same buffer
// a zillion times
if (r.BaseStream.Position != lastoffset)
{
lastoffset = r.BaseStream.Position;
Buffer = r.ReadBytes(buffersize);
}
Streams.Reader r1 = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
int OffsetInBuffer = (int)(VariousFunctions.BlockToFATOffset(Blocks[i], Parent) - VariousFunctions.BlockToFATOffset(Blocks[i], Parent).DownToNearestCluster(0x1000));
r1.BaseStream.Position = OffsetInBuffer;
switch (Parent.PartitionInfo.EntrySize)
{
case 2:
ushort Value = r1.ReadUInt16();
if (Value != 0xFFFF && Value != 0xFFF8)
{
if (Value == 0)
{
EntryData ed = Parent.EntryData;
ed.NameSize = 0xE5;
CreateNewEntry(ed);
if (Blocks.Count > 0)
{
ClearFATChain(Blocks.ToArray());
}
throw new Exception(string.Format("Bad FAT chain in file or folder {0}\r\nEntry Offset: 0x{1}\r\nLast block in FAT: 0x{2}\r\nEntry marked as deleted to avoid further errors! Please reload this device", Parent.FullPath, Parent.EntryOffset.ToString("X"), Blocks.Last().ToString("X")));
}
Blocks.Add(Value);
}
break;
case 4:
uint Value2 = r1.ReadUInt32();
if (Value2 != 0xFFFFFFFF && Value2 != 0xFFFFFFF8)
{
if (Value2 == 0)
{
EntryData ed = Parent.EntryData;
ed.NameSize = 0xE5;
CreateNewEntry(ed);
if (Blocks.Count > 0)
{
ClearFATChain(Blocks.ToArray());
}
throw new Exception(string.Format("Bad FAT chain in file or folder {0}\r\nEntry Offset: 0x{1}\r\nLast block in FAT: 0x{2}\r\nEntry marked as deleted to avoid further errors! Please reload this device", Parent.FullPath, Parent.EntryOffset.ToString("X"), Blocks.Last().ToString("X")));
}
Blocks.Add(Value2);
}
break;
}
r1.Close();
}
return(Blocks.ToArray());
}
void AfterSelect()
{
listView1.Items.Clear();
System.IO.DirectoryInfo clicked = new System.IO.DirectoryInfo((string)treeView1.SelectedNode.Tag);
foreach (System.IO.DirectoryInfo di in clicked.GetDirectories())
{
ListViewItem li = new ListViewItem(di.Name);
li.SubItems.Add("File Folder");
li.SubItems.Add("");
li.SubItems.Add(di.LastWriteTime.ToString());
li.SubItems.Add((VariousFunctions.IsTitleIDFolder(di.Name)) ? Party_Buffalo.Cache.CheckCache(di.Name) : "");
li.Tag = new object[] { di.FullName, true };
li.ImageIndex = 0;
listView1.Items.Add(li);
}
foreach (System.IO.FileInfo fi in clicked.GetFiles())
{
ListViewItem li = new ListViewItem(fi.Name);
li.SubItems.Add("File");
li.SubItems.Add(VariousFunctions.ByteConversion(fi.Length));
li.SubItems.Add(fi.LastWriteTime.ToString());
// Get the file name
CLKsFATXLib.Streams.Reader br = new CLKsFATXLib.Streams.Reader(new System.IO.FileStream(fi.FullName, System.IO.FileMode.Open));
if (br.BaseStream.Length > 4)
{
uint header = br.ReadUInt32(true);
if (header == 0x434F4E20 || header == 0x4C495645 || header == 0x50495253)
{
br.BaseStream.Position = (long)CLKsFATXLib.Geometry.STFSOffsets.DisplayName;
li.SubItems.Add(br.ReadUnicodeString(0x80));
}
}
br.Close();
li.Tag = new object[] { fi.FullName, true };
li.ImageIndex = 1;
listView1.Items.Add(li);
}
}
/// <summary>
/// If the file is an STFS package, it will get the name of the game that the package belongs to
/// </summary>
public string TitleName()
{
if (IsSTFSPackage())
{
if (tname == null)
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(GetStream());
r.BaseStream.Position = (long)Geometry.STFSOffsets.TitleName;
tname = r.ReadUnicodeString(0x80);
}
return tname;
}
throw new Exception("File is not a valid STFS package!");
}
/// <summary>
/// If the file is an STFS package, it will get the game's unique identifier
/// </summary>
public uint TitleID()
{
if (IsSTFSPackage())
{
if (tid == 0)
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(GetStream());
r.BaseStream.Position = (long)Geometry.STFSOffsets.TitleID;
tid = r.ReadUInt32();
}
return tid;
}
throw new Exception("File is not a valid STFS package!");
}
void EntryAction_HandleCreated(object sender, EventArgs e)
{
if (Aero)
{
td = new TaskDialog();
}
System.Threading.ThreadStart ts = delegate
{
#if TRACE
try
{
#endif
//while (true)//(!this.IsHandleCreated || !progressBar1.IsHandleCreated || !label1.IsHandleCreated || !lPercent.IsHandleCreated || !button1.IsHandleCreated)
//{
// try
// {
// this.Invoke((MethodInvoker)delegate { });
// progressBar1.Invoke((MethodInvoker)delegate { });
// label1.Invoke((MethodInvoker)delegate { });
// lPercent.Invoke((MethodInvoker)delegate { });
// button1.Invoke((MethodInvoker)delegate { });
// break;
// }
// catch(Exception E) { Application.DoEvents(); }
//}
if (xDrive != null && m == Method.Backup || m == Method.ExtractJ || m == Method.ExtractSS || m == Method.Restore)
{
switch (m)
{
case Method.Backup:
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Add;
});
CLKsFATXLib.Streams.Reader r = xDrive.Reader();
CLKsFATXLib.Streams.Writer w = new CLKsFATXLib.Streams.Writer(new System.IO.FileStream(OutPath, System.IO.FileMode.Create));
int ReadLength = 0x200;
if (xDrive.Length % 0x100000 == 0)
{
ReadLength = 0x100000;
}
else if (xDrive.Length % 0x40000 == 0)
{
ReadLength = 0x40000;
}
else if (xDrive.Length % 0x10000 == 0)
{
ReadLength = 0x10000;
}
else if (xDrive.Length % 0x5000 == 0)
{
ReadLength = 0x5000;
}
for (int i = 0; i < xDrive.Length / ReadLength; i++)
{
if (Cancel)
{
break;
}
w.Write(r.ReadBytes(ReadLength));
progressBar1.Invoke((MethodInvoker) delegate
{
try
{
progressBar1.Maximum = (int)(xDrive.Length / ReadLength);
progressBar1.Value = (i + 1);
if (Windows7)
{
tm.SetProgressValue(progressBar1.Value, progressBar1.Maximum);
}
}
catch { }
});
this.Invoke((MethodInvoker) delegate
{
this.Text = "Backing Up Drive";
});
label1.Invoke((MethodInvoker) delegate
{
label1.Text = (((decimal)(i + 1) / (decimal)(xDrive.Length / ReadLength)) * 100).ToString("#") + "%";
});
}
w.Close();
break;
case Method.ExtractSS:
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Add;
});
//Create our io for the drive
CLKsFATXLib.Streams.Reader io = xDrive.Reader();
//Go to the location of the security sector
io.BaseStream.Position = 0x2000;
//Create our ref io for the file
CLKsFATXLib.Streams.Writer bw = new CLKsFATXLib.Streams.Writer(new System.IO.FileStream(OutPath, System.IO.FileMode.Create));
//Read the sector. The size is an estimation, since I have no idea how big it really is
bw.Write(io.ReadBytes(0xE00));
//Close our io
bw.Close();
break;
case Method.ExtractJ:
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Add;
});
//Create our io for the drive
CLKsFATXLib.Streams.Reader io2 = xDrive.Reader();
//Go to the location of the security sector
io2.BaseStream.Position = 0x800;
//Create our ref io for the file
CLKsFATXLib.Streams.Writer bw2 = new CLKsFATXLib.Streams.Writer(new System.IO.FileStream(OutPath, System.IO.FileMode.Create));
//Read the sector. The size is an estimation, since I have no idea how big it really is
bw2.Write(io2.ReadBytes(0x400));
//Close our io
bw2.Close();
break;
case Method.Restore:
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Remove;
});
if (MessageBox.Show("WARNING: Restoring a drive that does not match your current one can cause for data to not be read correctly by the Xbox 360, or for other unforseen problems! Please make sure you know what you're doing before continuing. Are you sure you want to continue?", "WARNING AND STUFF", MessageBoxButtons.YesNo, MessageBoxIcon.Warning) == DialogResult.Yes)
{
if (MessageBox.Show("This is your last chance to stop! Are you POSITIVE you want to continue?", "Last Chance!", MessageBoxButtons.YesNo, MessageBoxIcon.Warning) == DialogResult.Yes)
{
CLKsFATXLib.Streams.Reader r2 = new CLKsFATXLib.Streams.Reader(new System.IO.FileStream(OutPath, System.IO.FileMode.Open));
CLKsFATXLib.Streams.Writer w2 = xDrive.Writer();
int ReadLength2 = 0x200;
if (xDrive.Length % 0x4000 != 0)
{
ReadLength2 = 0x4000;
}
else
{
for (int i = 0x300000; i > 0x200; i -= 0x1000)
{
if (xDrive.Length % i == 0)
{
ReadLength2 = i;
break;
}
}
}
for (int i = 0; i < xDrive.Length / ReadLength2; i++)
{
if (Cancel)
{
break;
}
w2.Write(r2.ReadBytes(ReadLength2));
progressBar1.Invoke((MethodInvoker) delegate
{
try
{
progressBar1.Maximum = (int)(xDrive.Length / ReadLength2);
progressBar1.Value = (i + 1);
if (Windows7)
{
tm.SetProgressValue(progressBar1.Value, progressBar1.Maximum);
}
}
catch { }
});
this.Invoke((MethodInvoker) delegate
{
this.Text = "Restoring Drive";
});
label1.Invoke((MethodInvoker) delegate
{
label1.Text = (((decimal)(i + 1) / (decimal)(xDrive.Length / ReadLength2)) * 100).ToString("#") + "%";
});
}
r2.Close();
}
}
break;
}
}
else
{
Folder ParentFolder = null;
this.Invoke((MethodInvoker) delegate
{
ParentFolder = Parent;
});
switch (m)
{
case Method.Extract:
#if DEBUG
System.Diagnostics.Stopwatch sw = new System.Diagnostics.Stopwatch();
if (Timer)
{
sw.Start();
}
#endif
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Add;
});
foreach (Entry entry in Entries)
{
if (!entry.IsFolder)
{
((File)entry).FileAction += new CLKsFATXLib.Structs.FileActionChanged(EntryAction_FileAction);
this.Invoke((MethodInvoker) delegate { this.Text = entry.FullPath; });
label1.Invoke((MethodInvoker) delegate { label1.Text = entry.Name; });
// Check to see if we're batch-extracting...
if (Entries.Length == 1)
{
((File)entry).Extract(OutPath);
}
else
{
((File)entry).Extract(OutPath + "\\" + entry.Name);
}
}
else
{
((Folder)entry).FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
((Folder)entry).Extract(OutPath, EntriesToSkip);
}
if (Cancel)
{
break;
}
}
#if DEBUG
if (Timer)
{
sw.Stop();
MessageBox.Show(string.Format("{0}:{1}:{2}", sw.Elapsed.Minutes, sw.Elapsed.Seconds, sw.Elapsed.Milliseconds));
}
#endif
break;
case Method.Delete:
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Remove;
});
foreach (Entry entry in Entries)
{
if (Cancel)
{
break;
}
if (entry.IsFolder)
{
Folder current = ((Folder)entry);
current.ResetFolderAction();
current.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
current.Delete();
}
else
{
this.Invoke((MethodInvoker) delegate { this.Text = entry.FullPath; });
label1.Invoke((MethodInvoker) delegate { label1.Text = entry.Name; });
File current = ((File)entry);
current.FileAction += new CLKsFATXLib.Structs.FileActionChanged(EntryAction_FileAction);
current.Delete();
}
}
break;
case Method.Inject:
#if DEBUG
System.Diagnostics.Stopwatch sw2 = new System.Diagnostics.Stopwatch();
if (Timer)
{
sw2.Start();
}
#endif
this.Invoke((MethodInvoker) delegate
{
this.Icon = Properties.Resources.Add;
});
if (ParentFolder != null)
{
ParentFolder.ResetFolderAction();
ParentFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
List <CLKsFATXLib.Structs.ExistingEntry> Existing = new List <CLKsFATXLib.Structs.ExistingEntry>();
foreach (string s in Paths)
{
if (Cancel)
{
break;
}
if (VariousFunctions.IsFolder(s))
{
Existing.AddRange(ParentFolder.InjectFolder(s, false, false));
}
else
{
ParentFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
CLKsFATXLib.Structs.WriteResult wr = ParentFolder.CreateNewFile(s);
if (wr.CouldNotWrite)
{
CLKsFATXLib.Structs.ExistingEntry ex = new CLKsFATXLib.Structs.ExistingEntry();
ex.Existing = wr.Entry;
ex.NewPath = s;
Existing.Add(ex);
}
}
}
DoExisting(Existing);
}
else
{
List <CLKsFATXLib.Structs.ExistingEntry> Existing = new List <CLKsFATXLib.Structs.ExistingEntry>();
foreach (string s in Paths)
{
string Path = "";
try
{
Path = VariousFunctions.GetFATXPath(s);
}
catch (Exception x)
{
ExceptionHandler(x);
continue;
}
Folder thisFolder = xDrive.CreateDirectory("Data\\" + Path);
thisFolder.ResetFolderAction();
thisFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
if (Cancel)
{
break;
}
if (VariousFunctions.IsFolder(s))
{
ExceptionHandler(new Exception("Can not write folder as STFS package (silly error wording)"));
continue;
}
else
{
thisFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
CLKsFATXLib.Structs.WriteResult wr = thisFolder.CreateNewFile(s);
if (wr.CouldNotWrite)
{
CLKsFATXLib.Structs.ExistingEntry ex = new CLKsFATXLib.Structs.ExistingEntry();
ex.Existing = wr.Entry;
ex.NewPath = s;
Existing.Add(ex);
}
}
}
DoExisting(Existing);
}
#if DEBUG
if (Timer)
{
sw2.Stop();
MessageBox.Show(string.Format("{0}:{1}:{2}", sw2.Elapsed.Minutes, sw2.Elapsed.Seconds, sw2.Elapsed.Milliseconds));
}
#endif
break;
case Method.Move:
List <CLKsFATXLib.Structs.WriteResult> Results = new List <CLKsFATXLib.Structs.WriteResult>();
foreach (Entry Entry in Entries)
{
CLKsFATXLib.Structs.WriteResult wr = Entry.Move(OutPath);
if (wr.CouldNotWrite)
{
Results.Add(wr);
}
}
break;
}
}
this.Invoke((MethodInvoker) delegate { this.Close(); });
#if TRACE
}
catch (Exception x)
{
ExceptionHandler(x);
this.Invoke((MethodInvoker) delegate { this.Close(); });
}
#endif
};
t = new System.Threading.Thread(ts);
t.Start();
}
/// <summary>
/// If the file is an STFS package, it will get the package's display (content) name
/// </summary>
/// <returns>Package display/content name</returns>
public string ContentName()
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.DisplayName;
return r.ReadUnicodeString(0x80);
}
DevPartitionRegions[] DevPartitions()
{
if (dP == null)
{
dP = new List<DevPartitionRegions>();
// Load the regions
Streams.Reader r = Reader();
r.BaseStream.Position = 0;
byte[] Buffer = r.ReadBytes(0x200);
r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
r.BaseStream.Position = 0x8; // data
dP.Add(new DevPartitionRegions()
{
RegionName = "Content",
Sector = r.ReadUInt32(),
PartitionSize = r.ReadUInt32() * 0x200,
});
dP.Add(new DevPartitionRegions()
{
RegionName = "Xbox 360 Dashboard Volume",
Sector = r.ReadUInt32(),
PartitionSize = r.ReadUInt32() * 0x200,
});
}
return dP.ToArray();
}
/// <summary>
/// Checks the file magic to check if it's a valid CON/LIVE/PIRS package
/// </summary>
public bool IsSTFSPackage()
{
if (PackageStream.Length >= 0xA000)
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = 0;
byte[] Buffer = r.ReadBytes(0x200);
r = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
uint val = r.ReadUInt32();
switch (val)
{
// CON
case 0x434F4E20:
return true;
// LIVE
case 0x4C495645:
return true;
// PIRS
case 0x50495253:
return true;
// NIGR
default:
return true;
}
}
else
{
return false;
}
}
/**
* Title: Xbox 360 Forensic Toolkit.
* Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and
* write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have
* been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS
* Application so that we can sissamble STFS packages and see their contents.
*
* Original Author: Party Buffalo - [email protected], wxPIRS - gael360
* Another Author: [email protected]
* License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE
* Link: https://code.google.com/p/party-buffalo/
* http://gael360.free.fr/
* Note: All Code that follows to the End point was added by [email protected]
*/
private PirsEntry getEntrySTFS(long num)
{
CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream());
io2.BaseStream.Position = (num);
PirsEntry entry = new PirsEntry();
char ch;
string str = "";
for (uint i = 0; i < 0x26; i++)
{
ch = io2.ReadChar();
if (ch != '\0')
{
str = str + Convert.ToString(ch);
}
}
entry.Filename = str;
if (entry.Filename.Trim() != "")
{
entry.Unknow = io2.ReadInt32();
entry.BlockLen = io2.ReadInt32();
int x = io2.ReadInt32();
entry.Cluster = (x >> 16);
entry.Parent = io2.ReadUInt16();
entry.Size = io2.ReadInt32();
entry.DateTime1 = this.dosDateTime(io2.ReadInt32());
entry.DateTime2 = this.dosDateTime(io2.ReadInt32());
}
//io2.Close();
return entry;
}
private void extractFile(ListViewItem listViewItem, string filename)
{
FileStream stream;
BinaryWriter writer;
try
{
if (!Directory.Exists(this.wr.extractFolderName(filename)))
{
Directory.CreateDirectory(this.wr.extractFolderName(filename));
}
}
catch (IOException)
{
}
try
{
stream = new FileStream(filename, FileMode.Create, FileAccess.Write, FileShare.None);
writer = new BinaryWriter(stream);
}
catch (IOException exception)
{
this.log(string.Format("Error : {0}\r\n", exception));
return;
}
long cluster = Convert.ToInt64(listViewItem.SubItems[this.columnHeaderCluster.Index].Text);
long offset = this.getOffset(cluster);
long num3 = Convert.ToInt64(listViewItem.SubItems[this.columnHeaderSize.Index].Text);
long num4 = num3 >> 12;
long num5 = num3 - (num4 << 12);
for (long i = cluster; i < (cluster + num4); i += 1L)
{
offset = this.getOffset(i);
if (STFSFile)
{
CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream());
io2.BaseStream.Position = (offset);
writer.Write(io2.ReadBytes(0x1000));
//io2.Close();
}
else
{
this.br.BaseStream.Seek(offset, SeekOrigin.Begin);
writer.Write(this.br.ReadBytes(0x1000));
}
string str = string.Format("{0}%", (100L * (i - cluster)) / num4);
if (str != listViewItem.SubItems[this.columnHeaderStatus.Index].Text)
{
listViewItem.SubItems[this.columnHeaderStatus.Index].Text = str;
Application.DoEvents();
}
}
offset = this.getOffset(cluster + num4);
if (STFSFile)
{
CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream());
io2.BaseStream.Position = (offset);
writer.Write(io2.ReadBytes((int) num5));
//io2.Close();
}
else
{
this.br.BaseStream.Seek(offset, SeekOrigin.Begin);
writer.Write(this.br.ReadBytes((int) num5));
}
listViewItem.SubItems[this.columnHeaderStatus.Index].Text = "Done";
Application.DoEvents();
writer.Close();
stream.Dispose();
}
public uint[] GetBlocksOccupied()
{
List<uint> Blocks = new List<uint>();
Streams.Reader r = Parent.Drive.Reader();
Blocks.Add(Parent.StartingCluster);
byte[] Buffer = new byte[0x1000];
int buffersize = 0x1000;
long lastoffset = 0;
for (int i = 0; i < Blocks.Count; i++)
{
r.BaseStream.Position = VariousFunctions.BlockToFATOffset(Blocks[i], Parent).DownToNearestCluster(0x1000);
// We use this so that we aren't reading the same buffer
// a zillion times
if (r.BaseStream.Position != lastoffset)
{
lastoffset = r.BaseStream.Position;
Buffer = r.ReadBytes(buffersize);
}
Streams.Reader r1 = new CLKsFATXLib.Streams.Reader(new System.IO.MemoryStream(Buffer));
int OffsetInBuffer = (int)(VariousFunctions.BlockToFATOffset(Blocks[i], Parent) - VariousFunctions.BlockToFATOffset(Blocks[i], Parent).DownToNearestCluster(0x1000));
r1.BaseStream.Position = OffsetInBuffer;
switch (Parent.PartitionInfo.EntrySize)
{
case 2:
ushort Value = r1.ReadUInt16();
if (Value != 0xFFFF && Value != 0xFFF8)
{
if (Value == 0)
{
EntryData ed = Parent.EntryData;
ed.NameSize = 0xE5;
CreateNewEntry(ed);
if (Blocks.Count > 0)
{
ClearFATChain(Blocks.ToArray());
}
throw new Exception(string.Format("Bad FAT chain in file or folder {0}\r\nEntry Offset: 0x{1}\r\nLast block in FAT: 0x{2}\r\nEntry marked as deleted to avoid further errors! Please reload this device", Parent.FullPath, Parent.EntryOffset.ToString("X"), Blocks.Last().ToString("X")));
}
Blocks.Add(Value);
}
break;
case 4:
uint Value2 = r1.ReadUInt32();
if (Value2 != 0xFFFFFFFF && Value2 != 0xFFFFFFF8)
{
if (Value2 == 0)
{
EntryData ed = Parent.EntryData;
ed.NameSize = 0xE5;
CreateNewEntry(ed);
if (Blocks.Count > 0)
{
ClearFATChain(Blocks.ToArray());
}
throw new Exception(string.Format("Bad FAT chain in file or folder {0}\r\nEntry Offset: 0x{1}\r\nLast block in FAT: 0x{2}\r\nEntry marked as deleted to avoid further errors! Please reload this device", Parent.FullPath, Parent.EntryOffset.ToString("X"), Blocks.Last().ToString("X")));
}
Blocks.Add(Value2);
}
break;
}
r1.Close();
}
return Blocks.ToArray();
}
/// <summary>
/// If the file is an STFS package, it will get the identifier that the package was created on.
/// </summary>
/// <returns>Console ID for STFS package</returns>
public byte[] ConsoleID()
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.ConsoleID;
return(r.ReadBytes(0x5));
}
void EntryAction_HandleCreated(object sender, EventArgs e)
{
if (Aero)
{
td = new TaskDialog();
}
System.Threading.ThreadStart ts = delegate
{
#if TRACE
try
{
#endif
//while (true)//(!this.IsHandleCreated || !progressBar1.IsHandleCreated || !label1.IsHandleCreated || !lPercent.IsHandleCreated || !button1.IsHandleCreated)
//{
// try
// {
// this.Invoke((MethodInvoker)delegate { });
// progressBar1.Invoke((MethodInvoker)delegate { });
// label1.Invoke((MethodInvoker)delegate { });
// lPercent.Invoke((MethodInvoker)delegate { });
// button1.Invoke((MethodInvoker)delegate { });
// break;
// }
// catch(Exception E) { Application.DoEvents(); }
//}
if (xDrive != null && m == Method.Backup || m == Method.ExtractJ || m == Method.ExtractSS || m == Method.Restore)
{
switch (m)
{
case Method.Backup:
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Add;
});
CLKsFATXLib.Streams.Reader r = xDrive.Reader();
CLKsFATXLib.Streams.Writer w = new CLKsFATXLib.Streams.Writer(new System.IO.FileStream(OutPath, System.IO.FileMode.Create));
int ReadLength = 0x200;
if (xDrive.Length % 0x100000 == 0)
{
ReadLength = 0x100000;
}
else if (xDrive.Length % 0x40000 == 0)
{
ReadLength = 0x40000;
}
else if (xDrive.Length % 0x10000 == 0)
{
ReadLength = 0x10000;
}
else if (xDrive.Length % 0x5000 == 0)
{
ReadLength = 0x5000;
}
for (int i = 0; i < xDrive.Length / ReadLength; i++)
{
if (Cancel)
{
break;
}
w.Write(r.ReadBytes(ReadLength));
progressBar1.Invoke((MethodInvoker)delegate
{
try
{
progressBar1.Maximum = (int)(xDrive.Length / ReadLength);
progressBar1.Value = (i + 1);
if (Windows7)
{
tm.SetProgressValue(progressBar1.Value, progressBar1.Maximum);
}
}
catch { }
});
this.Invoke((MethodInvoker)delegate
{
this.Text = "Backing Up Drive";
});
label1.Invoke((MethodInvoker)delegate
{
label1.Text = (((decimal)(i + 1) / (decimal)(xDrive.Length / ReadLength)) * 100).ToString("#") + "%";
});
}
w.Close();
break;
case Method.ExtractSS:
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Add;
});
//Create our io for the drive
CLKsFATXLib.Streams.Reader io = xDrive.Reader();
//Go to the location of the security sector
io.BaseStream.Position = 0x2000;
//Create our ref io for the file
CLKsFATXLib.Streams.Writer bw = new CLKsFATXLib.Streams.Writer(new System.IO.FileStream(OutPath, System.IO.FileMode.Create));
//Read the sector. The size is an estimation, since I have no idea how big it really is
bw.Write(io.ReadBytes(0xE00));
//Close our io
bw.Close();
break;
case Method.ExtractJ:
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Add;
});
//Create our io for the drive
CLKsFATXLib.Streams.Reader io2 = xDrive.Reader();
//Go to the location of the security sector
io2.BaseStream.Position = 0x800;
//Create our ref io for the file
CLKsFATXLib.Streams.Writer bw2 = new CLKsFATXLib.Streams.Writer(new System.IO.FileStream(OutPath, System.IO.FileMode.Create));
//Read the sector. The size is an estimation, since I have no idea how big it really is
bw2.Write(io2.ReadBytes(0x400));
//Close our io
bw2.Close();
break;
case Method.Restore:
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Remove;
});
if (MessageBox.Show("WARNING: Restoring a drive that does not match your current one can cause for data to not be read correctly by the Xbox 360, or for other unforseen problems! Please make sure you know what you're doing before continuing. Are you sure you want to continue?", "WARNING AND STUFF", MessageBoxButtons.YesNo, MessageBoxIcon.Warning) == DialogResult.Yes)
{
if (MessageBox.Show("This is your last chance to stop! Are you POSITIVE you want to continue?", "Last Chance!", MessageBoxButtons.YesNo, MessageBoxIcon.Warning) == DialogResult.Yes)
{
CLKsFATXLib.Streams.Reader r2 = new CLKsFATXLib.Streams.Reader(new System.IO.FileStream(OutPath, System.IO.FileMode.Open));
CLKsFATXLib.Streams.Writer w2 = xDrive.Writer();
int ReadLength2 = 0x200;
if (xDrive.Length % 0x4000 != 0)
{
ReadLength2 = 0x4000;
}
else
{
for (int i = 0x300000; i > 0x200; i -= 0x1000)
{
if (xDrive.Length % i == 0)
{
ReadLength2 = i;
break;
}
}
}
for (int i = 0; i < xDrive.Length / ReadLength2; i++)
{
if (Cancel)
{
break;
}
w2.Write(r2.ReadBytes(ReadLength2));
progressBar1.Invoke((MethodInvoker)delegate
{
try
{
progressBar1.Maximum = (int)(xDrive.Length / ReadLength2);
progressBar1.Value = (i + 1);
if (Windows7)
{
tm.SetProgressValue(progressBar1.Value, progressBar1.Maximum);
}
}
catch { }
});
this.Invoke((MethodInvoker)delegate
{
this.Text = "Restoring Drive";
});
label1.Invoke((MethodInvoker)delegate
{
label1.Text = (((decimal)(i + 1) / (decimal)(xDrive.Length / ReadLength2)) * 100).ToString("#") + "%";
});
}
r2.Close();
}
}
break;
}
}
else
{
Folder ParentFolder = null;
this.Invoke((MethodInvoker)delegate
{
ParentFolder = Parent;
});
switch (m)
{
case Method.Extract:
#if DEBUG
System.Diagnostics.Stopwatch sw = new System.Diagnostics.Stopwatch();
if (Timer)
{
sw.Start();
}
#endif
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Add;
});
foreach (Entry entry in Entries)
{
if (!entry.IsFolder)
{
((File)entry).FileAction += new CLKsFATXLib.Structs.FileActionChanged(EntryAction_FileAction);
this.Invoke((MethodInvoker)delegate { this.Text = entry.FullPath; });
label1.Invoke((MethodInvoker)delegate { label1.Text = entry.Name; });
// Check to see if we're batch-extracting...
if (Entries.Length == 1)
{
((File)entry).Extract(OutPath);
}
else
{
((File)entry).Extract(OutPath + "\\" + entry.Name);
}
}
else
{
((Folder)entry).FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
((Folder)entry).Extract(OutPath, EntriesToSkip);
}
if (Cancel)
{
break;
}
}
#if DEBUG
if (Timer)
{
sw.Stop();
MessageBox.Show(string.Format("{0}:{1}:{2}", sw.Elapsed.Minutes, sw.Elapsed.Seconds, sw.Elapsed.Milliseconds));
}
#endif
break;
case Method.Delete:
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Remove;
});
foreach (Entry entry in Entries)
{
if (Cancel)
{
break;
}
if (entry.IsFolder)
{
Folder current = ((Folder)entry);
current.ResetFolderAction();
current.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
current.Delete();
}
else
{
this.Invoke((MethodInvoker)delegate { this.Text = entry.FullPath; });
label1.Invoke((MethodInvoker)delegate { label1.Text = entry.Name; });
File current = ((File)entry);
current.FileAction += new CLKsFATXLib.Structs.FileActionChanged(EntryAction_FileAction);
current.Delete();
}
}
break;
case Method.Inject:
#if DEBUG
System.Diagnostics.Stopwatch sw2 = new System.Diagnostics.Stopwatch();
if (Timer)
{
sw2.Start();
}
#endif
this.Invoke((MethodInvoker)delegate
{
this.Icon = Properties.Resources.Add;
});
if (ParentFolder != null)
{
ParentFolder.ResetFolderAction();
ParentFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
List<CLKsFATXLib.Structs.ExistingEntry> Existing = new List<CLKsFATXLib.Structs.ExistingEntry>();
foreach (string s in Paths)
{
if (Cancel)
{
break;
}
if (VariousFunctions.IsFolder(s))
{
Existing.AddRange(ParentFolder.InjectFolder(s, false, false));
}
else
{
ParentFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
CLKsFATXLib.Structs.WriteResult wr = ParentFolder.CreateNewFile(s);
if (wr.CouldNotWrite)
{
CLKsFATXLib.Structs.ExistingEntry ex = new CLKsFATXLib.Structs.ExistingEntry();
ex.Existing = wr.Entry;
ex.NewPath = s;
Existing.Add(ex);
}
}
}
DoExisting(Existing);
}
else
{
List<CLKsFATXLib.Structs.ExistingEntry> Existing = new List<CLKsFATXLib.Structs.ExistingEntry>();
foreach (string s in Paths)
{
string Path = "";
try
{
Path = VariousFunctions.GetFATXPath(s);
}
catch (Exception x)
{
ExceptionHandler(x);
continue;
}
Folder thisFolder = xDrive.CreateDirectory("Data\\" + Path);
thisFolder.ResetFolderAction();
thisFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
if (Cancel)
{
break;
}
if (VariousFunctions.IsFolder(s))
{
ExceptionHandler(new Exception("Can not write folder as STFS package (silly error wording)"));
continue;
}
else
{
thisFolder.FolderAction += new CLKsFATXLib.Structs.FolderActionChanged(EntryAction_FolderAction);
CLKsFATXLib.Structs.WriteResult wr = thisFolder.CreateNewFile(s);
if (wr.CouldNotWrite)
{
CLKsFATXLib.Structs.ExistingEntry ex = new CLKsFATXLib.Structs.ExistingEntry();
ex.Existing = wr.Entry;
ex.NewPath = s;
Existing.Add(ex);
}
}
}
DoExisting(Existing);
}
#if DEBUG
if (Timer)
{
sw2.Stop();
MessageBox.Show(string.Format("{0}:{1}:{2}", sw2.Elapsed.Minutes, sw2.Elapsed.Seconds, sw2.Elapsed.Milliseconds));
}
#endif
break;
case Method.Move:
List<CLKsFATXLib.Structs.WriteResult> Results = new List<CLKsFATXLib.Structs.WriteResult>();
foreach (Entry Entry in Entries)
{
CLKsFATXLib.Structs.WriteResult wr = Entry.Move(OutPath);
if (wr.CouldNotWrite)
{
Results.Add(wr);
}
}
break;
}
}
this.Invoke((MethodInvoker)delegate { this.Close(); });
#if TRACE
}
catch (Exception x)
{
ExceptionHandler(x);
this.Invoke((MethodInvoker)delegate { this.Close(); });
}
#endif
};
t = new System.Threading.Thread(ts);
t.Start();
}
/// <summary>
/// If the file is an STFS package, it will get the package owner's profile ID
/// </summary>
public byte[] ProfileID()
{
if (IsSTFSPackage())
{
if (pid == null)
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(GetStream());
r.BaseStream.Position = (long)Geometry.STFSOffsets.ProfileID;
pid = r.ReadBytes(0x8);
}
return pid;
}
throw new Exception("File is not a valid STFS package!");
}
/// <summary>
/// If the file is an STFS package, it will get the device ID that the package was created on (HDD/USB)
/// </summary>
/// <returns>Package device ID</returns>
public byte[] DeviceID()
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.DeviceID;
return r.ReadBytes(0x14);
}
/// <summary>
/// If the file is an STFS package, it will get the game's unique identifier
/// </summary>
public uint TitleID()
{
Streams.Reader r = new CLKsFATXLib.Streams.Reader(PackageStream);
r.BaseStream.Position = (long)Geometry.STFSOffsets.TitleID;
return(r.ReadUInt32());
}
/// <summary>
/// Gets the title names that correspond with title ID's from a file
/// </summary>
/// <returns>List of title ID's with their accurate title names</returns>
private Structs.CachedTitleName[] CachedFromFile(File f)
{
List<Structs.CachedTitleName> tnl = new List<CLKsFATXLib.Structs.CachedTitleName>();
int BlockLength = 0x34;
Streams.Reader r = new CLKsFATXLib.Streams.Reader(f.GetStream());
for (int i = 0, Previous = 0; i < r.BaseStream.Length / BlockLength; i++, Previous += 0x34)
{
// Set the position of the stream
r.BaseStream.Position = Previous;
// Create the new CachedTitleName struct
Structs.CachedTitleName TN = new CLKsFATXLib.Structs.CachedTitleName();
// Read the title ID
TN.ID = r.ReadUInt32();
// Read the name
TN.Name = r.ReadCString();
// Add that to the list
tnl.Add(TN);
}
return tnl.ToArray();
}
/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private void openFileSTFS() { this.textBoxLog.Clear(); this.treeView.BeginUpdate(); this.treeView.Nodes.Clear(); this.treeView.EndUpdate(); this.listView.BeginUpdate(); this.listView.Items.Clear(); this.listView.EndUpdate(); try { this.getSTFSDescription(); CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream()); io2.BaseStream.Position = 0L; int num = io2.ReadInt32(); if (((num != MAGIC_PIRS) && (num != MAGIC_LIVE)) && (num != MAGIC_CON_)) { this.log("Not a PIRS/LIVE file!\r\n"); } else { io2.BaseStream.Position = 0xc030L; int num2 = io2.ReadInt32(); if (num == MAGIC_CON_) { this.pirs_offset = PIRS_TYPE2; this.pirs_start = 0xc000L; } else if (num2 == 0xffff) { this.pirs_offset = PIRS_TYPE1; this.pirs_start = PIRS_BASE + this.pirs_offset; } else { this.pirs_offset = PIRS_TYPE2; this.pirs_start = PIRS_BASE + this.pirs_offset; } this.parseSFTS(); } } catch (IOException exception) { this.log(string.Format("{0}\r\n", exception.Message)); } }
