static void ListAllFiles(ExtFileSystem fs)
{
//List all files in /etc folder
foreach (var file in fs.GetFiles("/etc", "*", SearchOption.AllDirectories))
{
Console.WriteLine(file);
}
}
static void CreateFile(ExtFileSystem fs)
{
//Open a file for write
var file = fs.OpenFile("/etc/test", FileMode.Create, FileAccess.Write);
var hello = "Hello World";
var buf = Encoding.ASCII.GetBytes(hello);
//Write to file
file.Write(buf, 0, buf.Length);
file.Close();
}
static void Main(string[] args)
{
//Open a Linux ext4 disk image
var disk = ExtDisk.Open(@".\ext4.img");
//Get the file system
var fs = ExtFileSystem.Open(disk.Partitions[0]);
ReadFileContent(fs);
ListAllFiles(fs);
CreateFile(fs);
ChangeFileMode(fs);
}
static void ReadFileContent(ExtFileSystem fs)
{
//Open a file for read
var file = fs.OpenFile("/etc/shells", FileMode.Open, FileAccess.Read);
//Check the file length
var filelen = file.Length;
var buf = new byte[filelen];
//Read the file content
var count = file.Read(buf, 0, (int)filelen);
file.Close();
var content = Encoding.Default.GetString(buf);
Console.WriteLine(content);
}
public static DiscDirectoryInfoTreeItemViewModel OpenImgStream(Stream stream)
{
if (SparseStream.Detect(stream))
{
var sparseStream = new SparseStream(stream);
if (!sparseStream.Open())
{
throw new Exception("Wrong format");
}
stream = sparseStream;
}
var fileSystem = new ExtFileSystem(stream);
return(new DiscDirectoryInfoTreeItemViewModel(fileSystem.Root));
}
public void LoadFileSystem()
{
using (var data = Helpers.Helpers.LoadDataFile("data.ext4.dat"))
using (var fs = new ExtFileSystem(data, new FileSystemParameters()))
{
Assert.Collection(fs.Root.GetFileSystemInfos()
.OrderBy(s => s.Name),
s =>
{
Assert.Equal("bar", s.Name);
Assert.True((s.Attributes & FileAttributes.Directory) != 0);
},
s =>
{
Assert.Equal("foo", s.Name);
Assert.True((s.Attributes & FileAttributes.Directory) != 0);
},
s =>
{
Assert.Equal("lost+found", s.Name);
Assert.True((s.Attributes & FileAttributes.Directory) != 0);
});
Assert.Empty(fs.Root.GetDirectories("foo").First().GetFileSystemInfos());
Assert.Collection(fs.Root.GetDirectories("bar").First().GetFileSystemInfos()
.OrderBy(s => s.Name),
s =>
{
Assert.Equal("blah.txt", s.Name);
Assert.True((s.Attributes & FileAttributes.Directory) == 0);
},
s =>
{
Assert.Equal("testdir1", s.Name);
Assert.True((s.Attributes & FileAttributes.Directory) != 0);
});
var tmpData = fs.OpenFile("bar\\blah.txt", FileMode.Open).ReadAll();
Assert.Equal(Encoding.ASCII.GetBytes("hello world\n"), tmpData);
tmpData = fs.OpenFile("bar\\testdir1\\test.txt", FileMode.Open).ReadAll();
Assert.Equal(Encoding.ASCII.GetBytes("Mon Feb 11 19:54:14 UTC 2019\n"), tmpData);
}
}
public static int Run(Options opts)
{
RunHelpers(opts);
Logger.Info("Opening image \"{0}\"", opts.Path);
var imageStream = OpenPath(opts.Path, FileMode.Open, FileAccess.Read, FileShare.None);
if (imageStream == null)
{
Logger.Error("Failed to open image!");
WaitForUserExit();
return(INVALID_ARGUMENT);
}
var bufferSize = opts.BlockCount * BLOCK_SIZE;
var buffer = new byte[bufferSize];
var writeLock = new object();
var lastPositionReportLock = new object();
var lastPositionReport = DateTime.Now;
Logger.Info("Starting deep scan of {0} (0x{1:X})", FormatBytes(imageStream.Length, 3), imageStream.Length);
while (imageStream.Position < imageStream.Length)
{
var read = imageStream.Read(buffer, 0, buffer.Length);
if (read != buffer.Length)
{
Logger.Error("Failed to read {0} of data, got {1} at position 0x{2:X}",
FormatBytes(buffer.Length, 3), FormatBytes(read, 3), imageStream.Position);
break;
}
Parallel.For(0, bufferSize - BLOCK_SIZE + 1, new ParallelOptions()
{
MaxDegreeOfParallelism = opts.Threads
},
(i, l) =>
{
var actualPosition = imageStream.Position - buffer.Length + i;
if (i % opts.ScanGranularity != 0)
{
return;
}
Stream stream = new MemoryStream(BLOCK_SIZE);
stream.Write(buffer, i, (stream as MemoryStream).Capacity);
// assume file system is on the rest of the stream to fix file table position validating
stream = new FixedLengthStream(stream, imageStream.Length - imageStream.Position, false);
if (opts.ScanForNtfs && NtfsFileSystem.Detect(stream))
{
lock (writeLock)
Logger.Info("Found NTFS file system at offset 0x{0:X} ({1})", actualPosition, FormatBytes(actualPosition, 3));
}
else if (opts.ScanForFat && FatFileSystem.Detect(stream))
{
lock (writeLock)
Logger.Info("Found FAT file system at offset 0x{0:X} ({1})", actualPosition, FormatBytes(actualPosition, 3));
}
else if (opts.ScanForExt && ExtFileSystem.Detect(stream))
{
lock (writeLock)
Logger.Info("Found EXT file system at offset 0x{0:X} ({1})", actualPosition, FormatBytes(actualPosition, 3));
}
lock (lastPositionReportLock)
{
var now = DateTime.Now;
if (now.Subtract(lastPositionReport).TotalSeconds >= 10.0)
{
lock (writeLock)
Logger.Info("Currently scanning at offset 0x{0:X} ({1})", actualPosition, FormatBytes(actualPosition, 3));
lastPositionReport = now;
}
}
});
}
Cleanup(imageStream);
WaitForUserExit();
return(SUCCESS);
}
static void ChangeFileMode(ExtFileSystem fs)
{
//777(OCT) = 511(DEC) = 0x1FF(HEX)
fs.SetMode("/etc/hosts", 511);
}
