x64dbg
/
btparser
mirror of https://github.com/x64dbg/btparser
1
0
Fork 0
Code Releases Activity
btparser/cparser/MFTRecord.bt

310 lines
11 KiB
Plaintext
Raw Blame History

//--------------------------------------
//--- 010 Editor v6.0.3 Binary Template
//
// File: MFTRecord.bt
// Author: Andrea Barberio <insomniac@slackware.it>
// Revision: 1
// Purpose: Parsing of MFT records in NTFS file systems
//--------------------------------------
string getMFTNameFromRecurdNumber(UINT32 record_number) {
// Return the name of well-known record numbers
switch (record_number) {
case 0:
return "$MFT";
case 1:
return "$MFTMirr";
case 2:
return "$LogFile";
case 3:
return "$Volume";
case 4:
return "$AttrDef";
case 5:
return "$. (root dir)";
case 6:
return "$Bitmap";
case 7:
return "$Boot";
case 8:
return "$BadClus";
case 9:
return "$Secure";
case 10:
return "$UpCase";
case 11:
return "$Extend";
default:
return "";
}
}
string GetMFTRecordComment(struct MFTRecord &record) {
string ret;
SPrintf(ret, "Record # %u %s (%s)",
record.mftheader.mft_rec_number,
getMFTNameFromRecurdNumber(record.mftheader.mft_rec_number),
HeaderFlagsToString(record.mftheader.flags)
);
return ret;
}
wstring GetMFTNameFromAttribute(struct Attributes &attrs) {
// TODO handle differences between NT and 2k fields
switch (attrs.attribute.fixed_header.type) {
case STANDARD_INFORMATION:
return "$STANDARD_INFORMATION";
case ATTRIBUTE_LIST:
return "$ATTRIBUTE_LIST";
case FILE_NAME:
string ret;
SPrintf(ret, "$FILE_NAME (%s)",
attrs.attribute.resident_attribute_content.file_name);
return ret;
case OBJECT_ID:
return "$OBJECT_ID";
case SECURITY_DESCRIPTOR:
return "$SECURITY_DESCRIPTOR";
case VOLUME_NAME:
return "$VOLUME_NAME";
case VOLUME_INFORMATION:
return "$VOLUME_INFORMATION";
case DATA:
string ret;
if (attrs.attribute.fixed_header.non_res_flag)
return "$DATA (Non resident)";
else
return "$DATA (Resident)";
case INDEX_ROOT:
return "$INDEX_ROOT";
case INDEX_ALLOCATION:
return "$INDEX_ALLOCATION";
case BITMAP:
string ret;
SPrintf(ret,
"$BITMAP (map of bits telling for each record if they are in use or not)");
return ret;
case REPARSE_POINT:
return "$REPARSE_POINT";
case EA_INFORMATION:
return "$EA_INFORMATION";
case EA:
return "$EA";
case LOGGED_UTILITY_STREAM:
return "$LOGGED_UTILITY_STREAM";
default:
return "";
}
}
string HeaderFlagsToString(UINT16 flags) {
string ret;
if (flags & 0x02)
Strcat(ret, "Directory, ");
else
Strcat(ret, "File, ");
if (flags & 0x01)
Strcat(ret, "In use");
else
Strcat(ret, "Not in use");
return ret;
}
string AttributeFlagsToString(UINT16 flags) {
string ret;
if (flags & 0x01)
Strcat(ret, "Compressed, ");
else
Strcat(ret, "Not Compressed, ");
if (flags & 0x4000)
Strcat(ret, "Encrypted, ");
else
Strcat(ret, "Not Encrypted, ");
if (flags & 0x8000)
Strcat(ret, "Sparse");
else
Strcat(ret, "Not Sparse");
return ret;
}
string GetParentDirComment(uint64 ref_to_parent_dir) {
string ret,
details;
// FIXME for some reason the input number is truncated, hence the seq_num is
// wrong
UINT16 seq_num = ref_to_parent_dir >> 24;
UQUAD mft_entry = ref_to_parent_dir & 0x0000ffffffffffff;
if (mft_entry == 0x05) {
// record 0x05 is the root directory ($.)
Strcat(ret, "Root dir, ");
}
SPrintf(details, "Seq num = %04xh [!!] , MFT entry = %012xh", seq_num, mft_entry);
Strcat(ret, details);
return ret;
}
string GetAllocSize(UQUAD alloc_size) {
// assuming 4096-byte cluster size
string ret;
UQUAD num_clusters = alloc_size / 4096 + (alloc_size % 4096 ? 1 : 0);
SPrintf(ret, "%lu clusters (each cluster 4096 bytes)", num_clusters);
return ret;
}
string GetDataRunStart(UINT16 data_run_info) {
string ret;
SPrintf(ret, "Starting at 0x%x (assuming cluster size = 4096)", data_run_info * 4096);
return ret;
}
typedef struct MFTAttribute {
local int64 mftattribute_start = FTell();
struct FixedHeader {
enum <UINT32> {
STANDARD_INFORMATION = 0x10,
ATTRIBUTE_LIST = 0x20,
FILE_NAME = 0x30,
OBJECT_ID = 0x40, // on NT it's VOLUME_VERSION, on 2k it's OBJECT_ID
SECURITY_DESCRIPTOR = 0x50,
VOLUME_NAME = 0x60,
VOLUME_INFORMATION = 0x70,
DATA = 0x80,
INDEX_ROOT = 0x90,
INDEX_ALLOCATION = 0xa0,
BITMAP = 0xb0,
REPARSE_POINT = 0xc0, // on NT it's SYMBOLIC_LINK, on 2k it's REPARSE_POINT
EA_INFORMATION = 0xd0,
EA = 0xe0,
LOGGED_UTILITY_STREAM = 0x100 // on NT it's PROPERTY_SET, on 2k it's LOGGED_UTILITY_STREAM
} type; // Attribute type identifier
UINT32 attr_length; // length of attribute
enum <UBYTE> {
RESIDENT = 0,
NON_RESIDENT = 1
} non_res_flag <comment="Resident: stored in the record. Non-resident: stored in the data runs">; // resident flag
UBYTE name_length; // length of name
UINT16 name_offset; // offset to name
UINT16 flags <comment=AttributeFlagsToString>; // flags
UINT16 attribute_id; // attribute identifier
} fixed_header;
if (fixed_header.non_res_flag) {
struct NonResidentAttributeHeader {
UQUAD start_vcn; // starting Virtual Cluster Number of the runlist
UQUAD end_vcn; // ending Virtual Cluster Number of the runlist
UINT16 datarun_offset; // offset to the runlist
UINT16 compression_size <comment="If 0, not compressed">; // compression unit size
UINT32 padding; // unused
UQUAD alloc_size <comment=GetAllocSize>; // allocated size of attribute content
UQUAD real_size <comment="File size in bytes">; // actual size of attribute content
UQUAD stream_size <comment="Equal to real_size unless resized">; // initialized size of attribute content
} non_resident_attribute_header;
if (fixed_header.type == DATA) {
struct AttributeContentNonResidentData {
UBYTE unknown;
UBYTE num_of_clusters;
UINT16 data_run_start <format=hex, comment=GetDataRunStart>;
char padding[3];
} attribute_content_non_resident_data;
} else if (fixed_header.type == BITMAP) {
struct AttributeContentNonResidentBitmap {
char bitmap[fixed_header.attr_length - non_resident_attribute_header.datarun_offset];
} attribute_content_non_resident_bitmap;
} else {
// TODO define other data types
}
} else {
struct ResidentAttributeHeader {
UINT32 content_size;
UINT16 content_offset;
UINT16 indexed_tag;
} resident_attribute_header;
struct ResidentAttributeContent {
if (fixed_header.type == STANDARD_INFORMATION) {
struct AttributeContentStandardInformation {
FILETIME creation_time;
FILETIME alteration_time;
FILETIME mft_changed_time;
FILETIME read_time;
UINT32 dos_permissions;
UINT32 max_num_of_versions;
UINT32 version_number;
UINT32 class_id;
} attribute_content_standard_information;
if (resident_attribute_header.content_size != 48) {
UINT32 owner_id;
UINT32 security_id;
UQUAD quota_charged;
UQUAD update_sequence_number;
}
} else if (fixed_header.type == FILE_NAME) {
struct AttributeContentFileName {
UQUAD file_ref_to_parent_dir <format=hex, comment=GetParentDirComment>;
FILETIME file_creation_time;
FILETIME file_modification_time;
FILETIME mft_modification_time;
FILETIME file_access_time;
UQUAD allocated_size;
UQUAD real_size;
UINT32 flags;
UINT32 used_by_eas_and_reparse;
UBYTE filename_length_unicode;
UBYTE filename_namespace;
} attribute_content_file_name;
// variable, file name in Unicode
wchar_t file_name[attribute_content_file_name.filename_length_unicode];
} else {
UCHAR data[resident_attribute_header.content_size];
// TODO define other data types
}
} resident_attribute_content;
}
UCHAR padding[fixed_header.attr_length - (FTell() - mftattribute_start)];
} mftattribute;
struct MFTRecord {
struct MFTHeader {
char file_signature[4] <comment="Must be FILE">; // magic number, "FILE"
UINT16 fixup_offset; // offset to the update sequence
UINT16 fixup_size; // number of entries in the fixup array
UQUAD log_seq_number; // $LogFile Sequence Number (LSN)
UINT16 sequence; // Sequence Number
UINT16 hard_links <comment="Number of hard links">; // Hard link count
UINT16 attrib_offset; // Offset to first attribute
UINT16 flags <comment=HeaderFlagsToString>; // Flags: 0x01: record in use, 0x02: directory
UINT32 rec_length <comment="Length of the bytes used for this record. Must be <= 1024">; // Used size of MFT entry
UINT32 all_length <comment="Length of the whole record. Must be 1024">; // Allocated size of MFT entry
UQUAD base_mft_rec; // File reference to the base FILE record
UINT16 next_attr_id; // Next attribute ID
UINT16 fixup_pattern; // Align to 4 bytes boundary
UINT32 mft_rec_number <comment=getMFTNameFromRecurdNumber>; // Number of this MFT record
} mftheader;
UQUAD fixup; // is this correct?
local int i;
local int64 pos;
local UINT32 terminator;
for (i = 0; i == i ; i++) {
pos = FTell();
terminator = ReadUInt();
if (terminator == 0xffffffff) {
struct Terminator {
UINT32 terminator <format=hex, comment="Must be FF FF FF FF">;
} terminator <comment="Attribute list terminator">;
break;
} else {
struct Attributes {
mftattribute attribute;
} attributes <comment=GetMFTNameFromAttribute>;
}
}
} mftrecord <comment=GetMFTRecordComment>;
View Git Blame Copy Permalink