private static List <PartitionEntry> GetExtended(FileStream streamToRead, uint startSector) { List <PartitionEntry> pList = new List <PartitionEntry>(); ulong offset = 512 * (ulong)startSector; byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200); pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector)); PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector); pList.Add(secondEntry); if (secondEntry.SystemID == "MS_EXTENDED") { pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector)); } return(pList); }
private static List<PartitionEntry> GetExtended(FileStream streamToRead, uint startSector) { List<PartitionEntry> pList = new List<PartitionEntry>(); ulong offset = 512 * (ulong)startSector; byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200); pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector)); PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector); pList.Add(secondEntry); if (secondEntry.SystemID == "MS_EXTENDED") { pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector)); } return pList; }
internal MasterBootRecord(byte[] bytes) { // Instantiate a byte array to hold 440 bytes (size of MBR Boot Code) // Copy MBR sub-array into mbrCode BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8); // Check MBR Code Section against a list of known signatures #region MD5Signature string MD5Signature = null; switch (Hash.Get(BootCode, BootCode.Length, "MD5")) { case WINDOWS5_X: MD5Signature = "Windows 5.X"; break; case WINDOWS6_0: MD5Signature = "Windows 6.0"; break; case WINDOWS6_1: MD5Signature = "Windows 6.1+"; break; case GRUB: MD5Signature = "GRUB"; break; case NYANCAT: MD5Signature = "BOOTKIT Nyan Cat"; break; case STONEDv2: MD5Signature = "BOOTKIT Stonedv2"; break; case STONEDv2_TRUE_CRYPT: MD5Signature = "BOOTKIT Stonedv2"; break; default: MD5Signature = "UNKNOWN"; break; } #endregion MD5Signature // Instantiate a blank Partition List List<PartitionEntry> partitionList = new List<PartitionEntry>(); // Set object properties DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", ""); MBRSignature = MD5Signature; for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE) { PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE)); if (entry.SystemID != "EMPTY") { partitionList.Add(entry); } } PartitionTable = partitionList.ToArray(); }
internal MasterBootRecord(byte[] bytes) { // Instantiate a byte array to hold 440 bytes (size of MBR Boot Code) // Copy MBR sub-array into mbrCode BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8); // Check MBR Code Section against a list of known signatures #region MD5Signature string MD5Signature = null; switch (Hash.Get(BootCode, BootCode.Length, "MD5")) { case WINDOWS5_X: MD5Signature = "Windows 5.X"; break; case WINDOWS6_0: MD5Signature = "Windows 6.0"; break; case WINDOWS6_1: MD5Signature = "Windows 6.1+"; break; case GRUB: MD5Signature = "GRUB"; break; case NYANCAT: MD5Signature = "BOOTKIT Nyan Cat"; break; case STONEDv2: MD5Signature = "BOOTKIT Stonedv2"; break; case STONEDv2_TRUE_CRYPT: MD5Signature = "BOOTKIT Stonedv2"; break; default: MD5Signature = "UNKNOWN"; break; } #endregion MD5Signature // Instantiate a blank Partition List List <PartitionEntry> partitionList = new List <PartitionEntry>(); // Set object properties DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", ""); MBRSignature = MD5Signature; for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE) { PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE)); if (entry.SystemID != "EMPTY") { partitionList.Add(entry); } } PartitionTable = partitionList.ToArray(); }