/// <summary>
///
/// </summary>
/// <param name="bytes"></param>
/// <param name="startSector"></param>
/// <param name="drivePath"></param>
/// <returns></returns>
private static PartitionEntry[] GetPartitions(byte[] bytes, uint startSector, string drivePath)
{
// Instantiate a blank Partition List
List <PartitionEntry> partitionList = new List <PartitionEntry>();
for (int i = PARTITION_TABLE_OFFSET; i <= 0x1EE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(bytes, startSector, i);
try
{
if (entry.SystemId.Contains("EXTENDED"))
{
partitionList.AddRange(GetExtended(entry, drivePath));
}
else if (entry.SystemId != "EMPTY")
{
partitionList.Add(entry);
}
}
catch
{
}
}
return(partitionList.ToArray());
}
/// <summary>
///
/// </summary>
/// <param name="entry"></param>
/// <param name="drivePath"></param>
/// <returns></returns>
private static PartitionEntry[] GetExtended(PartitionEntry entry, string drivePath)
{
List <PartitionEntry> pList = new List <PartitionEntry>();
byte[] extendedBytes = Helper.readSector(drivePath, entry.StartSector, 0x01);
pList.AddRange(GetPartitions(extendedBytes, entry.StartSector, drivePath));
return(pList.ToArray());
}
private static List <PartitionEntry> GetExtended(FileStream streamToRead, uint startSector)
{
List <PartitionEntry> pList = new List <PartitionEntry>();
ulong offset = 512 * (ulong)startSector;
byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200);
pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector));
PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector);
pList.Add(secondEntry);
if (secondEntry.SystemID == "MS_EXTENDED")
{
pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector));
}
return(pList);
}
internal MasterBootRecord(byte[] bytes)
{
// Instantiate a byte array to hold 440 bytes (size of MBR Boot Code)
// Copy MBR sub-array into mbrCode
BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8);
// Check MBR Code Section against a list of known signatures
#region MD5Signature
string MD5Signature = null;
switch (Hash.Get(BootCode, BootCode.Length, "MD5"))
{
case WINDOWS5_X:
MD5Signature = "Windows 5.X";
break;
case WINDOWS6_0:
MD5Signature = "Windows 6.0";
break;
case WINDOWS6_1:
MD5Signature = "Windows 6.1+";
break;
case GRUB:
MD5Signature = "GRUB";
break;
case NYANCAT:
MD5Signature = "BOOTKIT Nyan Cat";
break;
case STONEDv2:
MD5Signature = "BOOTKIT Stonedv2";
break;
case STONEDv2_TRUE_CRYPT:
MD5Signature = "BOOTKIT Stonedv2";
break;
default:
MD5Signature = "UNKNOWN";
break;
}
#endregion MD5Signature
// Instantiate a blank Partition List
List <PartitionEntry> partitionList = new List <PartitionEntry>();
// Set object properties
DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
MBRSignature = MD5Signature;
for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));
if (entry.SystemID != "EMPTY")
{
partitionList.Add(entry);
}
}
PartitionTable = partitionList.ToArray();
}
internal MasterBootRecord(byte[] bytes)
{
// Copy MBR sub-array into CodeSection
CodeSection = Helper.GetSubArray(bytes, 0x00, 0x1B8);
// Check MBR Code Section against a list of known signatures
#region MD5Signature
/*switch (Hash.Get(CodeSection, CodeSection.Length, "MD5"))
{
case WINDOWS5_X:
MD5Signature = "Windows 5.X";
break;
case WINDOWS6_0:
MD5Signature = "Windows 6.0";
break;
case WINDOWS6_1:
MD5Signature = "Windows 6.1+";
break;
case GRUB:
MD5Signature = "GRUB";
break;
case NYANCAT:
MD5Signature = "BOOTKIT Nyan Cat";
break;
case STONEDv2:
MD5Signature = "BOOTKIT Stonedv2";
break;
case STONEDv2_TRUE_CRYPT:
MD5Signature = "BOOTKIT Stonedv2";
break;
default:
MD5Signature = "UNKNOWN";
break;
}*/
#endregion MD5Signature
// Instantiate a blank Partition List
List<PartitionEntry> partitionList = new List<PartitionEntry>();
// Set object properties
DiskSignature = BitConverter.ToString(Helper.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
//MbrSignature = MD5Signature;
for (int i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(Helper.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));
if(entry.SystemId == "MS_EXTENDED")
{
partitionList.AddRange(GetExtended(entry));
}
else if (entry.SystemId != "EMPTY")
{
partitionList.Add(entry);
}
}
PartitionTable = partitionList.ToArray();
}
private static List<PartitionEntry> GetExtended(FileStream streamToRead, uint startSector)
{
List<PartitionEntry> pList = new List<PartitionEntry>();
ulong offset = 0x200 * (ulong)startSector;
byte[] extendedMBR = Helper.readDrive(streamToRead, offset, 0x200);
pList.Add(new PartitionEntry(Helper.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector));
PartitionEntry secondEntry = new PartitionEntry(Helper.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector);
pList.Add(secondEntry);
if (secondEntry.SystemId == "MS_EXTENDED")
{
pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector));
}
return pList;
}
private static List<PartitionEntry> GetExtended(PartitionEntry entry)
{
List<PartitionEntry> pList = new List<PartitionEntry>();
return null;
}
internal MasterBootRecord(byte[] bytes)
{
// Instantiate a byte array to hold 440 bytes (size of MBR Boot Code)
// Copy MBR sub-array into mbrCode
BootCode = Util.GetSubArray(bytes, 0x00, 0x1B8);
// Check MBR Code Section against a list of known signatures
#region MD5Signature
string MD5Signature = null;
switch (Hash.Get(BootCode, BootCode.Length, "MD5"))
{
case WINDOWS5_X:
MD5Signature = "Windows 5.X";
break;
case WINDOWS6_0:
MD5Signature = "Windows 6.0";
break;
case WINDOWS6_1:
MD5Signature = "Windows 6.1+";
break;
case GRUB:
MD5Signature = "GRUB";
break;
case NYANCAT:
MD5Signature = "BOOTKIT Nyan Cat";
break;
case STONEDv2:
MD5Signature = "BOOTKIT Stonedv2";
break;
case STONEDv2_TRUE_CRYPT:
MD5Signature = "BOOTKIT Stonedv2";
break;
default:
MD5Signature = "UNKNOWN";
break;
}
#endregion MD5Signature
// Instantiate a blank Partition List
List<PartitionEntry> partitionList = new List<PartitionEntry>();
// Set object properties
DiskSignature = BitConverter.ToString(Util.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
MbrSignature = MD5Signature;
for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(Util.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));
if (entry.SystemId != "EMPTY")
{
partitionList.Add(entry);
}
}
PartitionTable = partitionList.ToArray();
}
private static List <PartitionEntry> GetExtended(PartitionEntry entry)
{
List <PartitionEntry> pList = new List <PartitionEntry>();
return(null);
}
internal MasterBootRecord(byte[] bytes)
{
// Copy MBR sub-array into CodeSection
CodeSection = Helper.GetSubArray(bytes, 0x00, 0x1B8);
// Check MBR Code Section against a list of known signatures
#region MD5Signature
/*switch (Hash.Get(CodeSection, CodeSection.Length, "MD5"))
* {
* case WINDOWS5_X:
* MD5Signature = "Windows 5.X";
* break;
* case WINDOWS6_0:
* MD5Signature = "Windows 6.0";
* break;
* case WINDOWS6_1:
* MD5Signature = "Windows 6.1+";
* break;
* case GRUB:
* MD5Signature = "GRUB";
* break;
* case NYANCAT:
* MD5Signature = "BOOTKIT Nyan Cat";
* break;
* case STONEDv2:
* MD5Signature = "BOOTKIT Stonedv2";
* break;
* case STONEDv2_TRUE_CRYPT:
* MD5Signature = "BOOTKIT Stonedv2";
* break;
* default:
* MD5Signature = "UNKNOWN";
* break;
* }*/
#endregion MD5Signature
// Instantiate a blank Partition List
List <PartitionEntry> partitionList = new List <PartitionEntry>();
// Set object properties
DiskSignature = BitConverter.ToString(Helper.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
//MbrSignature = MD5Signature;
for (int i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
{
PartitionEntry entry = new PartitionEntry(Helper.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));
if (entry.SystemId == "MS_EXTENDED")
{
partitionList.AddRange(GetExtended(entry));
}
else if (entry.SystemId != "EMPTY")
{
partitionList.Add(entry);
}
}
PartitionTable = partitionList.ToArray();
}
