/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private void getFilesSTFS(TreeNode tn) { int num = 0; long offset = 0; while (true) { offset = this.pirs_start + (num * 0x40); PirsEntry entry = new PirsEntry(); entry = this.getEntrySTFS(offset); if (entry.Filename.Trim() == "") { break; } if (((entry.Cluster == 0) && (entry.Size == 0)) && (entry.Parent == Convert.ToUInt16(tn.Tag))) { ListViewItem item = new ListViewItem(); item.Text = entry.Filename; item.SubItems.Add(entry.Size.ToString()); item.SubItems.Add(entry.Cluster.ToString()); item.SubItems.Add(entry.DateTime1.ToString()); item.SubItems.Add(""); item.ImageIndex = 0; item.Tag = num; this.listView.Items.Add(item); } num++; } num = 0; while (true) { offset = this.pirs_start + (num * 0x40); PirsEntry entry2 = new PirsEntry(); entry2 = this.getEntrySTFS(offset); if (entry2.Filename.Trim() == "") { return; } if ((entry2.Cluster != 0) && (entry2.Parent == Convert.ToUInt16(tn.Tag))) { ListViewItem item2 = new ListViewItem(); item2.Text = entry2.Filename; item2.SubItems.Add(entry2.Size.ToString()); item2.SubItems.Add(entry2.Cluster.ToString()); item2.SubItems.Add(entry2.DateTime1.ToString()); item2.SubItems.Add(""); item2.ImageIndex = 1; item2.ToolTipText = string.Format("Offset : 0x{0:X8}", this.getOffset((long)entry2.Cluster)); this.listView.Items.Add(item2); } num++; } }
/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private PirsEntry getEntrySTFS(long num) { CLKsFATXLib.Streams.Reader io2 = new CLKsFATXLib.Streams.Reader(xFile.GetStream()); io2.BaseStream.Position = (num); PirsEntry entry = new PirsEntry(); char ch; string str = ""; for (uint i = 0; i < 0x26; i++) { ch = io2.ReadChar(); if (ch != '\0') { str = str + Convert.ToString(ch); } } entry.Filename = str; if (entry.Filename.Trim() != "") { entry.Unknow = io2.ReadInt32(); entry.BlockLen = io2.ReadInt32(); int x = io2.ReadInt32(); entry.Cluster = (x >> 16); entry.Parent = io2.ReadUInt16(); entry.Size = io2.ReadInt32(); entry.DateTime1 = this.dosDateTime(io2.ReadInt32()); entry.DateTime2 = this.dosDateTime(io2.ReadInt32()); } //io2.Close(); return entry; }
private PirsEntry getEntry() { PirsEntry entry = new PirsEntry(); entry.Filename = this.wr.readString(this.br, 0x26); if (entry.Filename.Trim() != "") { entry.Unknow = this.wr.readInt32(this.br); entry.BlockLen = this.wr.readInt32(this.br); entry.Cluster = this.br.ReadInt32() >> 8; entry.Parent = this.wr.readUInt16(this.br); entry.Size = this.wr.readInt32(this.br); entry.DateTime1 = this.dosDateTime(this.wr.readInt32(this.br)); entry.DateTime2 = this.dosDateTime(this.wr.readInt32(this.br)); } return entry; }
/** * Title: Xbox 360 Forensic Toolkit. * Description: Xbox 360 Forensic Toolkit is built on top of the Party buffalo application. It allows users to read and * write to Xbox 360 devices, with support for reading Xbox 360 STFS package names. A number of Forensic Tools have * been added to extract/view sectors, extract partitions, view file details, examine files in HEX. It also incorporates the wxPIRS * Application so that we can sissamble STFS packages and see their contents. * * Original Author: Party Buffalo - [email protected], wxPIRS - gael360 * Another Author: [email protected] * License: http://www.gnu.org/licenses/gpl.html GNU GENERAL PUBLIC LICENSE * Link: https://code.google.com/p/party-buffalo/ * http://gael360.free.fr/ * Note: All Code that follows to the End point was added by [email protected] */ private void getDirectoriesSTFS(TreeNode tn) { int num = 0; long offset = 0; while (true) { offset = this.pirs_start + (num * 0x40); PirsEntry entry = new PirsEntry(); entry = this.getEntrySTFS(offset); if (entry.Filename.Trim() == "") { return; } if (((entry.Size == 0) && (entry.Cluster == 0)) && (entry.Parent == Convert.ToUInt16(tn.Tag))) { TreeNode node = new TreeNode(entry.Filename); node.Tag = num; node.ToolTipText = string.Format("0x{0:X4}", node.Tag); tn.Nodes.Add(node); this.getDirectoriesSTFS(node); } num++; } }
private void getDirectories(TreeNode tn) { int num = 0; while (true) { this.br.BaseStream.Seek(this.pirs_start + (num * 0x40), SeekOrigin.Begin); PirsEntry entry = new PirsEntry(); entry = this.getEntry(); if (entry.Filename.Trim() == "") { return; } if (((entry.Size == 0) && (entry.Cluster == 0)) && (entry.Parent == Convert.ToUInt16(tn.Tag))) { TreeNode node = new TreeNode(entry.Filename); node.Tag = num; node.ToolTipText = string.Format("0x{0:X4}", node.Tag); tn.Nodes.Add(node); this.getDirectories(node); } num++; } }
private void extractFolder(ushort tag, string foldername, string pathname) { ushort num = 0; long offset = 0; while (true) { PirsEntry entry = new PirsEntry(); if (STFSFile) { offset = ((PIRS_BASE + this.pirs_offset) + (num * 0x40)); entry = this.getEntrySTFS(offset); } else { this.br.BaseStream.Seek((PIRS_BASE + this.pirs_offset) + (num * 0x40), SeekOrigin.Begin); entry = this.getEntry(); } if (entry.Filename.Trim() == "") { return; } if (((entry.Cluster == 0) && (entry.Size == 0)) && (entry.Parent == tag)) { this.extractFolder(num, entry.Filename, pathname + @"\" + foldername); } else if ((entry.Cluster != 0) && (entry.Parent == tag)) { this.extractFile((long) entry.Cluster, (long) entry.Size, pathname + @"\" + foldername + @"\" + entry.Filename); } num = (ushort) (num + 1); } }