Exemplo n.º 1
0
        private static List <PartitionEntry> GetExtended(FileStream streamToRead, uint startSector)
        {
            List <PartitionEntry> pList = new List <PartitionEntry>();

            ulong offset = 512 * (ulong)startSector;

            byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200);

            pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector));

            PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector);

            pList.Add(secondEntry);

            if (secondEntry.SystemID == "MS_EXTENDED")
            {
                pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector));
            }

            return(pList);
        }
        private static List<PartitionEntry> GetExtended(FileStream streamToRead, uint startSector)
        {
            List<PartitionEntry> pList = new List<PartitionEntry>();

            ulong offset = 512 * (ulong)startSector;

            byte[] extendedMBR = NativeMethods.readDrive(streamToRead, offset, 0x200);

            pList.Add(new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1BE, PARTITION_ENTRY_SIZE), startSector));

            PartitionEntry secondEntry = new PartitionEntry(NativeMethods.GetSubArray(extendedMBR, 0x1CE, PARTITION_ENTRY_SIZE), startSector);
            pList.Add(secondEntry);

            if (secondEntry.SystemID == "MS_EXTENDED")
            {
                pList.AddRange(GetExtended(streamToRead, secondEntry.StartSector));
            }

            return pList;
        }
        internal MasterBootRecord(byte[] bytes)
        {
            // Instantiate a byte array to hold 440 bytes (size of MBR Boot Code)
            // Copy MBR sub-array into mbrCode
            BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8);

            // Check MBR Code Section against a list of known signatures
            #region MD5Signature

            string MD5Signature = null;

            switch (Hash.Get(BootCode, BootCode.Length, "MD5"))
            {
                case WINDOWS5_X:
                    MD5Signature = "Windows 5.X";
                    break;
                case WINDOWS6_0:
                    MD5Signature = "Windows 6.0";
                    break;
                case WINDOWS6_1:
                    MD5Signature = "Windows 6.1+";
                    break;
                case GRUB:
                    MD5Signature = "GRUB";
                    break;
                case NYANCAT:
                    MD5Signature = "BOOTKIT Nyan Cat";
                    break;
                case STONEDv2:
                    MD5Signature = "BOOTKIT Stonedv2";
                    break;
                case STONEDv2_TRUE_CRYPT:
                    MD5Signature = "BOOTKIT Stonedv2";
                    break;
                default:
                    MD5Signature = "UNKNOWN";
                    break;
            }

            #endregion MD5Signature

            // Instantiate a blank Partition List
            List<PartitionEntry> partitionList = new List<PartitionEntry>();

            // Set object properties
            DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
            MBRSignature = MD5Signature;

            for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
            {
                PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));

                if (entry.SystemID != "EMPTY")
                {
                    partitionList.Add(entry);
                }
            }

            PartitionTable = partitionList.ToArray();
        }
Exemplo n.º 4
0
        internal MasterBootRecord(byte[] bytes)
        {
            // Instantiate a byte array to hold 440 bytes (size of MBR Boot Code)
            // Copy MBR sub-array into mbrCode
            BootCode = NativeMethods.GetSubArray(bytes, 0x00, 0x1B8);

            // Check MBR Code Section against a list of known signatures
            #region MD5Signature

            string MD5Signature = null;

            switch (Hash.Get(BootCode, BootCode.Length, "MD5"))
            {
            case WINDOWS5_X:
                MD5Signature = "Windows 5.X";
                break;

            case WINDOWS6_0:
                MD5Signature = "Windows 6.0";
                break;

            case WINDOWS6_1:
                MD5Signature = "Windows 6.1+";
                break;

            case GRUB:
                MD5Signature = "GRUB";
                break;

            case NYANCAT:
                MD5Signature = "BOOTKIT Nyan Cat";
                break;

            case STONEDv2:
                MD5Signature = "BOOTKIT Stonedv2";
                break;

            case STONEDv2_TRUE_CRYPT:
                MD5Signature = "BOOTKIT Stonedv2";
                break;

            default:
                MD5Signature = "UNKNOWN";
                break;
            }

            #endregion MD5Signature

            // Instantiate a blank Partition List
            List <PartitionEntry> partitionList = new List <PartitionEntry>();

            // Set object properties
            DiskSignature = BitConverter.ToString(NativeMethods.GetSubArray(bytes, 0x1B8, 0x04)).Replace("-", "");
            MBRSignature  = MD5Signature;

            for (uint i = 0x1BE; i <= 0x1DE; i += PARTITION_ENTRY_SIZE)
            {
                PartitionEntry entry = new PartitionEntry(NativeMethods.GetSubArray(bytes, i, PARTITION_ENTRY_SIZE));

                if (entry.SystemID != "EMPTY")
                {
                    partitionList.Add(entry);
                }
            }

            PartitionTable = partitionList.ToArray();
        }