├── FileRecovery.scpt ├── LICENSE ├── README.md ├── applet.icns └── foremost-1.5.7 ├── CHANGES ├── Makefile ├── README ├── api.c ├── cli.c ├── config.c ├── dir.c ├── engine.c ├── extract.c ├── extract.h ├── foremost.8.gz ├── foremost.conf ├── helpers.c ├── main.c ├── main.h ├── ole.h └── state.c /FileRecovery.scpt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dev-coco/FileRecovery/d60c63b2d9ff87aad0d536ec4b138c848310ccc6/FileRecovery.scpt -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2020-2024 Raz1ner 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # FileRecovery 2 | Recover deleted or lost data from storage device. 从存储设备中恢复已删除或丢失的数据。 3 | 4 | # 使用方法 5 | [删除文件恢复](https://dev-coco.github.io/post/File-Recovery) 6 | -------------------------------------------------------------------------------- /applet.icns: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dev-coco/FileRecovery/d60c63b2d9ff87aad0d536ec4b138c848310ccc6/applet.icns -------------------------------------------------------------------------------- /foremost-1.5.7/CHANGES: -------------------------------------------------------------------------------- 1 | Version 1.5.7 2 | -Added support for MP4 files 3 | Version 1.5.6 4 | -Added support for Office 2007 file as well as bug fixes 5 | Version 1.5.5 6 | -Added patch submitted by John K. Antonishek as well as cleaning 7 | up compiler warnings and man file installation. 8 | Version 1.5.4 9 | -Added patch submitted by Milan Broz & Eamonn Saunders that 10 | fixes jpeg extraction bug. 11 | warnings 12 | and an 64 bit bug. 13 | Version 1.5.3 14 | -Added patches submitted by Toshio Kuratomi that fix compiler warnings 15 | and an 64 bit bug. 16 | Version 1.5.2 17 | -Fixed problem with gap code thanks to Jeffry Turnmire 18 | Version 1.5.1 19 | -Fixed jpeg extraction bug thanks to Jeffry Turnmire 20 | -Fixed bug in OLE extraction thanks to Filip Van Raemdonck 21 | Version 1.5 22 | -Fixed Endian errors on OSX 23 | -Fixed several bugs reported by John K. Antonishek 24 | Version 1.4 25 | -Fixed realpath problems when compiling with cygwin 26 | -Fixed flaw in Zip extraction 27 | -Made indirect block detection a little more stable 28 | Version 1.3 29 | - Fixed flaw in ZIP algorithm that didn't take into acct zeroized local file headers 30 | that contain valid compressed/uncompressed info in the data descriptors 31 | Version 1.2 32 | - Fixed conf file typos 33 | Version 1.1 34 | - Improved Speed of extraction functions 35 | - Added NEXT option to config file 36 | - Fixed some integer overflow problems 37 | - Updated config file 38 | - Added ASCII option for the config file 39 | Version 1.0 40 | - Changed display functionq 41 | - Enhanced RaR and PE extraction 42 | - Minor bug fixes thanks to Eamon Walsh for the bug report and patch 43 | - Added support for Windows PE executables 44 | - Added support for multiple files 45 | - Thanks to Toshio Kuratomi for fixing some compiler warnings under gcc 4 46 | - Fixed bugs with respect to unique file names, and quick mode 47 | Version 0.9.4 48 | - Improved speed and reliability of zip and mpeg extraction algorithms. 49 | Version 0.9.3 50 | - Added subdirectories for each output type as opposed to 1 directory 51 | containing 90,000 files. 52 | Version 0.9.2 53 | - Greatly improved OLE extraction capabilites. 54 | Version 0.9.1 55 | - Re-wrote code to run on LINUX,OSX,BSD,and SOLARIS 56 | - Added builtin extraction functions 57 | - Changed default behavior to look for the conf file in /usr/local/etc as 58 | well as the the current dir. Also the conf file is not required 59 | for the program to run if the -t option is enabled. 60 | - Added a -i switch to specify an input file as opposed to using stdin 61 | - Added -k to allow the user to change the default chunk size as well 62 | as -b to change the default block size 63 | - Changed the output dir to a time stamp of when the program was run. 64 | - Added -d for indirect block detection 65 | Version 0.69 (Our thanks to Zach Kanner for these improvements...) 66 | - Corrected a bug that prevented the "reverse footer search" option 67 | from working correctly. 68 | - Added a new "NEXT" option, specify NEXT after the footer on any 69 | search specification line and foremost will search for 70 | the last occurence (forward only currently) of that footer in the 71 | window of size length but not including that footer in the resulting 72 | output file created. This feature lets you search for files that 73 | don't have good ending footers but are separated by multiple starting footers or other identifiable data which you know should not be 74 | included in the output. This works really well for MS Word documents where you don't know where the end is. The start of another document 75 | becomes the end. With this feature as you can specific the "NEXT" 76 | or something after the end of the data we are looking for. 77 | - Updated the default foremost.conf file to use the feature for .doc 78 | files. Also added tags for ScanSoft PaperPort files (.max), and 79 | a Windows program called PINs (.pins), which stores encrypted 80 | passwords. 81 | Version 0.68 82 | Version 0.67 83 | - Added "reverse footer search" option, specify REVERSE after the 84 | footer on any search specification line and foremost will search for 85 | the last occurence of that footer in the window of size length. 86 | 87 | Version 0.66 88 | - Changed normal search to Boyer-Moore algorithm. Much faster! 89 | - Added progress meter 90 | - Added ability to suppress extensions from a single file type or 91 | from all file types. 92 | - Added "chop" field to show when files have been trimmed 93 | based on their definitions in the configuration file 94 | - Added "interior" field to show when files have been found 95 | somewhere other than a sector boundary 96 | - Added OpenBSD support 97 | - Added Win32 support via native compilation (Mingw) 98 | - Added Win32 support via Cygwin, to include: 99 | -using %lld instead of %Ld 100 | -ignoring the fnctl line for O_LARGEFILE in Win32 101 | -redeclare strsignal as const char strsignal 102 | -write function basename for Win32 using '\\' as delimiter 103 | -updated Makefile 104 | - Removed unneccessary header files from foremost.h 105 | 106 | (Version 0.65 was not published) 107 | 108 | Version 0.64 - Audit file now records full paths of input and output files 109 | Foremost now requires that the output directory is empty 110 | before running. If necessary, foremost will create the 111 | output directory (ie. if it doesn't exist) 112 | Added structure to internal code of foremost.c and created 113 | dig.c file 114 | Fixed bug that generated wrong line number in configuration 115 | file error messages 116 | Fixed bug on empty wildcard definitions 117 | Added limit for number of file types in configuration file 118 | 119 | Version 0.63 - Increased speed by using files already loaded in memory 120 | instead of going back to the disk every time. 121 | Minor speed increase to helper functions 122 | Added footers for several file formats including ZIP 123 | 124 | Version 0.62 - Added man page and make install functionality 125 | Added "internal" indicator to show when a file is found 126 | off the start of the sector. 127 | Fixed discrepancy between audit file and screen output 128 | regarding file numbers and offset locations (off by one) 129 | Added more graceful error handling 130 | 131 | Version 0.61 - Added check for "^M" line feeds added by MSDOS editors 132 | while reading configuration files. 133 | 134 | Version 0.6 - Renamed project to "foremost" 135 | Added support for wildcards 136 | Added -q for quick mode 137 | More code clean up 138 | Removed BSD porting code (oops) and added support 139 | for large (>2GB) files. 140 | 141 | Version 0.5 - Added -v for verbose mode 142 | Added more intelligble output regarding file locations 143 | Added error handling procedures 144 | Added support for loading specification files from the disk 145 | 146 | Version 0.4 - More code cleanup 147 | (not actually released, used as test during investigation) 148 | 149 | Version 0.3 - Code cleanup continues, moved all variables into the 150 | state variable. The program still needs a LOT of work. 151 | 152 | Version 0.2 - Code cleanup by Jesse Kornblum. Removed linux specific 153 | code and ported to OpenBSD. Added support for handling 154 | multiple images from the command line and created the 155 | state variable. 07 March 2001 156 | 157 | Version 0.1 - Proof of concept code written by Kris Kendall, 158 | originally called "snarfit" 05 March 2001 159 | -------------------------------------------------------------------------------- /foremost-1.5.7/Makefile: -------------------------------------------------------------------------------- 1 | 2 | RAW_CC = gcc 3 | RAW_FLAGS = -Wall -O2 4 | LINK_OPT = 5 | VERSION = 1.5.7 6 | # Try to determine the host system 7 | SYS := $(shell uname -s | tr -d "[0-9]" | tr -d "-" | tr "[A-Z]" "[a-z]") 8 | 9 | 10 | # You can cross compile this program for Win32 using Linux and the 11 | # MinGW compiler. See the README for details. If you have already 12 | # installed MinGW, put the location ($PREFIX) here: 13 | CR_BASE = /usr/local/cross-tools/i386-mingw32msvc/bin 14 | 15 | # You shouldn't need to change anything below this line 16 | #--------------------------------------------------------------------- 17 | 18 | # This should be commented out when debugging is done 19 | #RAW_FLAGS += -D__DEBUG -ggdb 20 | 21 | NAME = foremost 22 | MAN_PAGES = $(NAME).8.gz 23 | 24 | RAW_FLAGS += -DVERSION=\"$(VERSION)\" 25 | 26 | # Where we get installed 27 | BIN = /usr/local/bin 28 | MAN = /usr/share/man/man8 29 | CONF= /usr/local/etc 30 | # Setup for compiling and cross-compiling for Windows 31 | # The CR_ prefix refers to cross compiling from OSX to Windows 32 | CR_CC = $(CR_BASE)/gcc 33 | CR_OPT = $(RAW_FLAGS) -D__WIN32 34 | CR_LINK = -liberty 35 | CR_STRIP = $(CR_BASE)/strip 36 | CR_GOAL = $(NAME).exe 37 | WINCC = $(RAW_CC) $(RAW_FLAGS) -D__WIN32 38 | 39 | # Generic "how to compile C files" 40 | CC = $(RAW_CC) $(RAW_FLAGS) -D__UNIX 41 | .c.o: 42 | $(CC) -c $< 43 | 44 | 45 | # Definitions we'll need later (and that should rarely change) 46 | HEADER_FILES = main.h ole.h extract.h 47 | SRC = main.c state.c helpers.c config.c cli.c engine.c dir.c extract.c api.c 48 | OBJ = main.o state.o helpers.o config.o cli.o engine.o dir.o extract.o api.o 49 | DOCS = Makefile README CHANGES $(MAN_PAGES) foremost.conf 50 | WINDOC = README.txt CHANGES.txt 51 | 52 | 53 | #--------------------------------------------------------------------- 54 | # OPERATING SYSTEM DIRECTIVES 55 | #--------------------------------------------------------------------- 56 | 57 | all: $(SYS) goals 58 | 59 | goals: $(NAME) 60 | 61 | linux: CC += -D__LINUX -DLARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 62 | linux: goals 63 | 64 | sunos: solaris 65 | solaris: CC += -D__SOLARIS -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 66 | solaris: goals 67 | 68 | darwin: CC += -D__MACOSX 69 | darwin: goals 70 | 71 | mac: CC += -D__MACOSX 72 | mac: goals 73 | 74 | netbsd: unix 75 | openbsd: unix 76 | freebsd: unix 77 | unix: goals 78 | 79 | #Fore some reasons BSD variants get confused on how to build engine.o 80 | #so lets make it real clear 81 | 82 | engine.o: engine.c 83 | $(CC) -c engine.c 84 | 85 | 86 | # Common commands for compiling versions for Windows. 87 | # See cross and windows directives below. 88 | win_general: LINK_OPT = $(CR_LINK) 89 | win_general: GOAL = $(CR_GOAL) 90 | win_general: goals 91 | $(STRIP) $(CR_GOAL) 92 | 93 | # Cross compiling from Linux to Windows. See README for more info 94 | cross: CC = $(CR_CC) $(CR_OPT) 95 | cross: STRIP = $(CR_STRIP) 96 | cross: win_general 97 | 98 | # See the README for information on Windows compilation 99 | windows: CC = $(WINCC) 100 | windows: STRIP = strip 101 | windows: win_general 102 | 103 | cygwin_nt.: unix 104 | cygwin: unix 105 | 106 | 107 | #--------------------------------------------------------------------- 108 | # COMPILE THE PROGRAMS 109 | # This section must be updated each time you add an algorithm 110 | #--------------------------------------------------------------------- 111 | 112 | foremost: $(OBJ) 113 | $(CC) $(OBJ) -o $(NAME) $(LINK_OPT) 114 | 115 | 116 | #--------------------------------------------------------------------- 117 | # INSTALLATION AND REMOVAL 118 | #--------------------------------------------------------------------- 119 | 120 | install: goals 121 | install -m 755 $(NAME) $(BIN) 122 | install -m 444 $(MAN_PAGES) $(MAN) 123 | install -m 444 foremost.conf $(CONF) 124 | macinstall: BIN = /usr/local/bin/ 125 | macinstall: MAN = /usr/share/man/man1/ 126 | macinstall: CONF = /usr/local/etc/ 127 | macinstall: mac install 128 | 129 | 130 | uninstall: 131 | rm -f -- $(BIN)/{$(RM_GOALS)} 132 | rm -f -- $(MAN)/{$(RM_DOCS)} 133 | 134 | macuninstall: BIN = /usr/bin 135 | macuninstall: MAN = /usr/share/man/man1 136 | macuninstall: uninstall 137 | 138 | #--------------------------------------------------------------------- 139 | # CLEAN UP 140 | #--------------------------------------------------------------------- 141 | 142 | # This is used for debugging 143 | preflight: 144 | grep -n RBF *.1 *.h *.c README CHANGES 145 | 146 | nice: 147 | rm -f -- *~ 148 | 149 | clean: nice 150 | rm -f -- *.o 151 | rm -f -- $(CR_GOAL) $(NAME) $(WIN_DOC) 152 | rm -f -- $(TAR_FILE).gz $(DEST_DIR).zip $(DEST_DIR).zip.gpg 153 | 154 | #------------------------------------------------------------------------- 155 | # MAKING PACKAGES 156 | #------------------------------------------------------------------------- 157 | 158 | EXTRA_FILES = 159 | DEST_DIR = $(NAME)-$(VERSION) 160 | TAR_FILE = $(DEST_DIR).tar 161 | PKG_FILES = $(SRC) $(HEADER_FILES) $(DOCS) $(EXTRA_FILES) 162 | 163 | # This packages me up to send to somebody else 164 | package: clean 165 | rm -f $(TAR_FILE) $(TAR_FILE).gz 166 | mkdir $(DEST_DIR) 167 | cp $(PKG_FILES) $(DEST_DIR) 168 | tar cvf $(TAR_FILE) $(DEST_DIR) 169 | rm -rf $(DEST_DIR) 170 | gzip $(TAR_FILE) 171 | 172 | 173 | # This Makefile is designed for Mac OSX to package the file. 174 | # To do this on a linux box, The big line below starting with "/usr/bin/tbl" 175 | # should be replaced with: 176 | # 177 | # man ./$(MD5GOAL).1 | col -bx > README.txt 178 | # 179 | # and the "flip -d" command should be replaced with dos2unix 180 | # 181 | # The flip command can be found at: 182 | # http://ccrma-www.stanford.edu/~craig/utility/flip/# 183 | win-doc: 184 | /usr/bin/tbl ./$(MD5GOAL).1 | /usr/bin/groff -S -Wall -mtty-char -mandoc -Tascii | /usr/bin/col > README.txt 185 | cp CHANGES CHANGES.txt 186 | flip -d $(WINDOC) 187 | 188 | cross-pkg: clean cross win-doc 189 | rm -f $(DEST_DIR).zip 190 | zip $(DEST_DIR).zip $(CR_MD5GOAL) $(CR_SHA1GOAL) $(CR_SHA256GOAL) $(WINDOC) 191 | rm -f $(WINDOC) 192 | 193 | world: package cross-pkg 194 | -------------------------------------------------------------------------------- /foremost-1.5.7/README: -------------------------------------------------------------------------------- 1 | 2 | FOREMOST 3 | ---------------------------------------------------------------------- 4 | 5 | Foremost is a Linux program to recover files based on their headers and 6 | footers. Foremost can work on image files, such as those generated by dd, 7 | Safeback, Encase, etc, or directly on a drive. The headers and footers are 8 | specified by a configuration file, so you can pick and choose which 9 | headers you want to look for. 10 | 11 | 12 | 13 | -------------------------------------------- 14 | INSTALL FOREMOST 15 | -------------------------------------------- 16 | 17 | To run foremost, you must: 18 | 19 | - uncompress the archive 20 | - compile 21 | - install 22 | 23 | Here's how to do it: 24 | 25 | LINUX: 26 | $ tar zxvf foremost-xx.tar.gz 27 | $ cd foremost-xx 28 | $ make 29 | $ make install 30 | 31 | BSD: 32 | $ tar zxvf foremost-xx.tar.gz 33 | $ cd foremost-xx 34 | $ make unix 35 | $ make install 36 | 37 | SOLARIS: 38 | $ tar zxvf foremost-xx.tar.gz 39 | $ cd foremost-xx 40 | $ make solaris 41 | $ make install 42 | 43 | OSX: 44 | $ tar zxvf foremost-xx.tar.gz 45 | $ cd foremost-xx 46 | $ make mac 47 | $ make macinstall 48 | 49 | On systems with older versions of glibc (earlier than 2.2.0), you will get 50 | some harmless warnings about ftello and fseeko not being defined. You can 51 | ignore these. 52 | 53 | 54 | If you ever need to remove foremost from your system, you can do this: 55 | 56 | $ make uninstall 57 | 58 | 59 | 60 | -------------------------------------------- 61 | USING FOREMOST 62 | -------------------------------------------- 63 | 64 | A description of the command line arguments can be found in the man page. 65 | To view it: 66 | 67 | $ man foremost 68 | 69 | 70 | 71 | -------------------------------------------- 72 | CONFIGURATION FILE FORMAT 73 | -------------------------------------------- 74 | 75 | The configuration file is used to control what types of files foremost 76 | searches for. A sample configuration file, foremost.conf, is included with 77 | this distribution. For each file type, the configuration file describes 78 | the file's extension, whether the header and footer are case sensitive, 79 | the maximum file size, and the header and footer for the file. The footer 80 | field is optional, but header, size, case sensitivity, and extension are 81 | not! 82 | 83 | Any line that begins with a '#' is considered a comment and ignored. Thus, 84 | to skip a file type just put a '#' at the beginning of that line 85 | 86 | Headers and footers are decoded before use. To specify a value in 87 | hexadecimal use \x[0-f][0-f], and for octal use \[1-9][1-9][1-9]. Spaces 88 | can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI CCI". 89 | 90 | To match any single character (aka a wildcard) use a '?'. If you need to 91 | search for the '?' character, you will need to change the 'wildcard' line 92 | *and* every occurrence of the old wildcard character in the configuration 93 | file. Don't forget those hex and octal values! '?' is equal to 0x3f and 94 | \063. 95 | 96 | Here's a sample set of headers and footers: 97 | 98 | # extension case-sens max-size header footer (option) 99 | # 100 | # GIF and JPG files (very common) 101 | gif y 155000 \x47\x49\x46\x38\x37\x61 \x00\x3b 102 | gif y 155000 \x47\x49\x46\x38\x39\x61 \x00\x00\x3b 103 | jpg y 200000 \xff\xd8\xff \xff\xd9 104 | 105 | Note: the option is a method of specifying additional options. Current the following options exist: 106 | 107 | FORWARD: Specify to search from the header to the footer (optional) up to the max-size. 108 | REVERSE: Specify to search from the footer to the header up to the max-size. 109 | NEXT: Specify to search from the header to the data just past the footer. This allows you to specify data that you know is 'NOT' in the data you are looking for and should terminated the search, up to the max-size. 110 | 111 | -------------------------------------------- 112 | BUG REPORTING 113 | -------------------------------------------- 114 | 115 | Please report ALL bugs to nick dot mikus AT gmail d0t com. Please include a 116 | description of the bug, how you found it, and your contact information. 117 | 118 | 119 | 120 | 121 | -------------------------------------------- 122 | CREDITS AND THANKS 123 | -------------------------------------------- 124 | 125 | Foremost was written by Special Agent Kris Kendall and Special Agent Jesse 126 | Kornblum of the United States Air Force Office of Special Investigations 127 | starting in March 2001. This program would not be what it is today without 128 | help from (in no particular order): Rob Meekins, Dan Kalil, and Chet 129 | Maciag. This project was inspired by CarvThis, written by the Defense 130 | Computer Forensic Lab in 1999. 131 | 132 | 133 | -------------------------------------------- 134 | LEGAL NOTICE 135 | -------------------------------------------- 136 | 137 | dd, Safeback, and Encase are copyrighted works and any questions regarding 138 | these tools should be directed to the copyright holders. The United States 139 | Government does not endorse the use of these or any other imaging tools. 140 | -------------------------------------------------------------------------------- /foremost-1.5.7/api.c: -------------------------------------------------------------------------------- 1 | /* 2 | Modified API from http://chicago.sourceforge.net/devel/docs/ole/ 3 | Basically the same API, added error checking and the ability 4 | to check buffers for docs, not just files. 5 | */ 6 | #include "main.h" 7 | #include "ole.h" 8 | 9 | /*Some ugly globals 10 | * This API should be re-written 11 | * in a modular fashion*/ 12 | unsigned char buffer[OUR_BLK_SIZE]; 13 | char *extract_name; 14 | int extract = 0; 15 | int dir_count = 0; 16 | int *FAT; 17 | int verbose = TRUE; 18 | int FATblk; 19 | int currFATblk; 20 | int highblk = 0; 21 | int block_list[OUR_BLK_SIZE / sizeof(int)]; 22 | extern int errno; 23 | 24 | /*Inititialize those globals used by extract_ole*/ 25 | void init_ole() 26 | { 27 | int i = 0; 28 | extract = 0; 29 | dir_count = 0; 30 | FAT = NULL; 31 | highblk = 0; 32 | FATblk = 0; 33 | currFATblk = -1; 34 | dirlist = NULL; 35 | dl = NULL; 36 | for (i = 0; i < OUR_BLK_SIZE / sizeof(int); i++) 37 | { 38 | block_list[i] = 0; 39 | } 40 | 41 | for (i = 0; i < OUR_BLK_SIZE; i++) 42 | { 43 | buffer[i] = 0; 44 | } 45 | } 46 | 47 | void *Malloc(size_t bytes) 48 | { 49 | void *x; 50 | 51 | x = malloc(bytes); 52 | if (x) 53 | return x; 54 | die("Can't malloc %d bytes.\n", (char *)bytes); 55 | return 0; 56 | } 57 | 58 | void die(char *fmt, void *arg) 59 | { 60 | fprintf(stderr, fmt, arg); 61 | exit(1); 62 | } 63 | 64 | int get_dir_block(unsigned char *fd, int blknum, int buffersize) 65 | { 66 | int i; 67 | struct OLE_DIR *dir; 68 | unsigned char *dest = NULL; 69 | 70 | dest = get_ole_block(fd, blknum, buffersize); 71 | if (dest == NULL) 72 | { 73 | return FALSE; 74 | } 75 | 76 | for (i = 0; i < DIRS_PER_BLK; i++) 77 | { 78 | dir = (struct OLE_DIR *) &dest[sizeof(struct OLE_DIR) * i]; 79 | if (dir->type == NO_ENTRY) 80 | break; 81 | } 82 | 83 | if (i == DIRS_PER_BLK) 84 | { 85 | return TRUE; 86 | } 87 | else 88 | { 89 | return SHORT_BLOCK; 90 | } 91 | } 92 | 93 | int get_dir_info(unsigned char *src) 94 | { 95 | int i, j; 96 | char *p, *q; 97 | struct OLE_DIR *dir; 98 | int punctCount = 0; 99 | short name_size = 0; 100 | 101 | for (i = 0; i < DIRS_PER_BLK; i++) 102 | { 103 | dir = (struct OLE_DIR *) &src[sizeof(struct OLE_DIR) * i]; 104 | punctCount = 0; 105 | 106 | //if(dir->reserved!=0) return FALSE; 107 | if (dir->type < 0) //Should we check if values are > 5 ????? 108 | { 109 | #ifdef DEBUG 110 | printf("\n Invalid directory type\n"); 111 | printf("type:=%c size:=%lu \n", dir->type, dir->size); 112 | #endif 113 | return FALSE; 114 | } 115 | 116 | if (dir->type == NO_ENTRY) 117 | break; 118 | 119 | #ifdef DEBUG 120 | 121 | //dump_dirent (i); 122 | #endif 123 | dl = &dirlist[dir_count++]; 124 | if (dl == NULL) 125 | { 126 | #ifdef DEBUG 127 | printf("dl==NULL!!! bailing out\n"); 128 | #endif 129 | return FALSE; 130 | } 131 | 132 | if (dir_count > 500) 133 | return FALSE; /*SANITY CHECKING*/ 134 | q = dl->name; 135 | p = dir->name; 136 | 137 | name_size = htos((unsigned char *) &dir->namsiz, FOREMOST_LITTLE_ENDIAN); 138 | 139 | #ifdef DEBUG 140 | printf(" dir->namsiz:=%d\n", name_size); 141 | #endif 142 | if (name_size > 64 || name_size <= 0) 143 | return FALSE; 144 | 145 | if (*p < ' ') 146 | p += 2; /* skip leading short */ 147 | for (j = 0; j < name_size; j++, p++) 148 | { 149 | 150 | if (p == NULL || q == NULL) 151 | return FALSE; 152 | if (*p && isprint(*p)) 153 | { 154 | 155 | if (ispunct(*p)) 156 | punctCount++; 157 | *q++ = *p; 158 | 159 | } 160 | } 161 | 162 | if (punctCount > 3) 163 | { 164 | #ifdef DEBUG 165 | printf("dl->name:=%s\n", dl->name); 166 | printf("pcount > 3!!! bailing out\n"); 167 | #endif 168 | return FALSE; 169 | } 170 | 171 | if (dl->name == NULL) 172 | { 173 | #ifdef DEBUG 174 | printf(" ***NULL dir name. bailing out \n"); 175 | #endif 176 | return FALSE; 177 | } 178 | 179 | /*Ignore Catalogs*/ 180 | if (strstr(dl->name, "Catalog")) 181 | return FALSE; 182 | *q = 0; 183 | dl->type = dir->type; 184 | dl->size = htoi((unsigned char *) &dir->size, FOREMOST_LITTLE_ENDIAN); 185 | 186 | dl->start_block = htoi((unsigned char *) &dir->start_block, FOREMOST_LITTLE_ENDIAN); 187 | dl->next = htoi((unsigned char *) &dir->next_dirent, FOREMOST_LITTLE_ENDIAN); 188 | dl->prev = htoi((unsigned char *) &dir->prev_dirent, FOREMOST_LITTLE_ENDIAN); 189 | dl->dir = htoi((unsigned char *) &dir->dir_dirent, FOREMOST_LITTLE_ENDIAN); 190 | if (dir->type != STREAM) 191 | { 192 | dl->s1 = dir->secs1; 193 | dl->s2 = dir->secs2; 194 | dl->d1 = dir->days1; 195 | dl->d2 = dir->days2; 196 | } 197 | } 198 | 199 | return TRUE; 200 | } 201 | 202 | static int *lnlv; /* last next link visited ! */ 203 | int reorder_dirlist(struct DIRECTORY *dir, int level) 204 | { 205 | 206 | //printf(" Reordering the dirlist\n"); 207 | dir->level = level; 208 | if (dir->dir != -1 || dir->dir > dir_count) 209 | { 210 | return 0; 211 | } 212 | else if (!reorder_dirlist(&dirlist[dir->dir], level + 1)) 213 | return 0; 214 | 215 | /* reorder next-link subtree, saving the most next link visited */ 216 | if (dir->next != -1) 217 | { 218 | if (dir->next > dir_count) 219 | return 0; 220 | else if (!reorder_dirlist(&dirlist[dir->next], level)) 221 | return 0; 222 | } 223 | else 224 | lnlv = &dir->next; 225 | 226 | /* move the prev child to the next link and reorder it, if any exist 227 | */ 228 | if (dir->prev != -1) 229 | { 230 | if (dir->prev > dir_count) 231 | return 0; 232 | else 233 | { 234 | *lnlv = dir->prev; 235 | dir->prev = -1; 236 | if (!reorder_dirlist(&dirlist[*lnlv], level)) 237 | return 0; 238 | } 239 | } 240 | 241 | return 1; 242 | } 243 | 244 | int get_block(unsigned char *fd, int blknum, unsigned char *dest, long long int buffersize) 245 | { 246 | unsigned char *temp = fd; 247 | int i = 0; 248 | unsigned long long jump = (unsigned long long)OUR_BLK_SIZE * (unsigned long long)(blknum + 1); 249 | if (blknum < -1 || jump < 0 || blknum > buffersize || buffersize < jump) 250 | { 251 | #ifdef DEBUG 252 | printf(" Bad blk read1 blknum:=%d jump:=%lld buffersize=%lld\n", blknum, jump, buffersize); 253 | #endif 254 | return FALSE; 255 | } 256 | 257 | temp = fd + jump; 258 | #ifdef DEBUG 259 | printf(" Jumping to %lld blknum=%d buffersize=%lld\n", jump, blknum, buffersize); 260 | #endif 261 | for (i = 0; i < OUR_BLK_SIZE; i++) 262 | { 263 | dest[i] = temp[i]; 264 | } 265 | 266 | if ((blknum + 1) > highblk) 267 | highblk = blknum + 1; 268 | return TRUE; 269 | } 270 | 271 | unsigned char *get_ole_block(unsigned char *fd, int blknum, unsigned long long buffersize) 272 | { 273 | unsigned long long jump = (unsigned long long)OUR_BLK_SIZE * (unsigned long long)(blknum + 1); 274 | if (blknum < -1 || jump < 0 || blknum > buffersize || buffersize < jump) 275 | { 276 | #ifdef DEBUG 277 | printf(" Bad blk read1 blknum:=%d jump:=%lld buffersize=%lld\n", blknum, jump, buffersize); 278 | #endif 279 | return FALSE; 280 | } 281 | 282 | #ifdef DEBUG 283 | printf(" Jumping to %lld blknum=%d buffersize=%lld\n", jump, blknum, buffersize); 284 | #endif 285 | return (fd + jump); 286 | } 287 | 288 | int get_FAT_block(unsigned char *fd, int blknum, int *dest, int buffersize) 289 | { 290 | static int FATblk; 291 | 292 | // static int currFATblk = -1; 293 | FATblk = htoi((unsigned char *) &FAT[blknum / (OUR_BLK_SIZE / sizeof(int))], 294 | FOREMOST_LITTLE_ENDIAN); 295 | #ifdef DEBUG 296 | printf("****blknum:=%d FATblk:=%d currFATblk:=%d\n", blknum, FATblk, currFATblk); 297 | #endif 298 | if (currFATblk != FATblk) 299 | { 300 | #ifdef DEBUG 301 | printf("*****blknum:=%d FATblk:=%d\n", blknum, FATblk); 302 | #endif 303 | if (!get_block(fd, FATblk, (unsigned char *)dest, buffersize)) 304 | { 305 | return FALSE; 306 | } 307 | 308 | currFATblk = FATblk; 309 | } 310 | 311 | return TRUE; 312 | } 313 | 314 | void dump_header(struct OLE_HDR *h) 315 | { 316 | int i, *x; 317 | 318 | //struct OLE_HDR *h = (struct OLE_HDR *) buffer; 319 | // fprintf (stderr, "clsid = "); 320 | //printx(h->clsid,0,16); 321 | fprintf(stderr, 322 | "\nuMinorVersion = %u\t", 323 | htos((unsigned char *) &h->uMinorVersion, FOREMOST_LITTLE_ENDIAN)); 324 | fprintf(stderr, 325 | "uDllVersion = %u\t", 326 | htos((unsigned char *) &h->uDllVersion, FOREMOST_LITTLE_ENDIAN)); 327 | fprintf(stderr, 328 | "uByteOrder = %u\n", 329 | htos((unsigned char *) &h->uByteOrder, FOREMOST_LITTLE_ENDIAN)); 330 | fprintf(stderr, 331 | "uSectorShift = %u\t", 332 | htos((unsigned char *) &h->uSectorShift, FOREMOST_LITTLE_ENDIAN)); 333 | fprintf(stderr, 334 | "uMiniSectorShift = %u\t", 335 | htos((unsigned char *) &h->uMiniSectorShift, FOREMOST_LITTLE_ENDIAN)); 336 | fprintf(stderr, 337 | "reserved = %u\n", 338 | htos((unsigned char *) &h->reserved, FOREMOST_LITTLE_ENDIAN)); 339 | fprintf(stderr, 340 | "reserved1 = %u\t", 341 | htoi((unsigned char *) &h->reserved1, FOREMOST_LITTLE_ENDIAN)); 342 | fprintf(stderr, 343 | "reserved2 = %u\t", 344 | htoi((unsigned char *) &h->reserved2, FOREMOST_LITTLE_ENDIAN)); 345 | fprintf(stderr, 346 | "csectMiniFat = %u\t", 347 | htoi((unsigned char *) &h->csectMiniFat, FOREMOST_LITTLE_ENDIAN)); 348 | fprintf(stderr, 349 | "miniSectorCutoff = %u\n", 350 | htoi((unsigned char *) &h->miniSectorCutoff, FOREMOST_LITTLE_ENDIAN)); 351 | fprintf(stderr, 352 | "root_start_block = %u\n", 353 | htoi((unsigned char *) &h->root_start_block, FOREMOST_LITTLE_ENDIAN)); 354 | fprintf(stderr, 355 | "dir flag = %u\n", 356 | htoi((unsigned char *) &h->dir_flag, FOREMOST_LITTLE_ENDIAN)); 357 | fprintf(stderr, 358 | "# FAT blocks = %u\n", 359 | htoi((unsigned char *) &h->num_FAT_blocks, FOREMOST_LITTLE_ENDIAN)); 360 | fprintf(stderr, 361 | "FAT_next_block = %u\n", 362 | htoi((unsigned char *) &h->FAT_next_block, FOREMOST_LITTLE_ENDIAN)); 363 | fprintf(stderr, 364 | "# extra FAT blocks = %u\n", 365 | htoi((unsigned char *) &h->num_extra_FAT_blocks, FOREMOST_LITTLE_ENDIAN)); 366 | x = (int *) &h[1]; 367 | fprintf(stderr, "bbd list:"); 368 | for (i = 0; i < 109; i++, x++) 369 | { 370 | if ((i % 10) == 0) 371 | fprintf(stderr, "\n"); 372 | if (*x == '\xff') 373 | break; 374 | fprintf(stderr, "%x ", *x); 375 | } 376 | 377 | fprintf(stderr, "\n **************End of header***********\n"); 378 | } 379 | 380 | struct OLE_HDR *reverseBlock(struct OLE_HDR *dest, struct OLE_HDR *h) 381 | { 382 | int i, *x, *y; 383 | dest->uMinorVersion = htos((unsigned char *) &h->uMinorVersion, FOREMOST_LITTLE_ENDIAN); 384 | dest->uDllVersion = htos((unsigned char *) &h->uDllVersion, FOREMOST_LITTLE_ENDIAN); 385 | dest->uByteOrder = htos((unsigned char *) &h->uByteOrder, FOREMOST_LITTLE_ENDIAN); /*28*/ 386 | dest->uSectorShift = htos((unsigned char *) &h->uSectorShift, FOREMOST_LITTLE_ENDIAN); 387 | dest->uMiniSectorShift = htos((unsigned char *) &h->uMiniSectorShift, FOREMOST_LITTLE_ENDIAN); /*32*/ 388 | dest->reserved = htos((unsigned char *) &h->reserved, FOREMOST_LITTLE_ENDIAN); /*34*/ 389 | dest->reserved1 = htoi((unsigned char *) &h->reserved1, FOREMOST_LITTLE_ENDIAN); /*36*/ 390 | dest->reserved2 = htoi((unsigned char *) &h->reserved2, FOREMOST_LITTLE_ENDIAN); /*40*/ 391 | dest->num_FAT_blocks = htoi((unsigned char *) &h->num_FAT_blocks, FOREMOST_LITTLE_ENDIAN); /*44*/ 392 | dest->root_start_block = htoi((unsigned char *) &h->root_start_block, FOREMOST_LITTLE_ENDIAN); /*48*/ 393 | dest->dfsignature = htoi((unsigned char *) &h->dfsignature, FOREMOST_LITTLE_ENDIAN); /*52*/ 394 | dest->miniSectorCutoff = htoi((unsigned char *) &h->miniSectorCutoff, FOREMOST_LITTLE_ENDIAN); /*56*/ 395 | dest->dir_flag = htoi((unsigned char *) &h->dir_flag, FOREMOST_LITTLE_ENDIAN); /*60 first sec in the mini fat chain*/ 396 | dest->csectMiniFat = htoi((unsigned char *) &h->csectMiniFat, FOREMOST_LITTLE_ENDIAN); /*64 number of sectors in the minifat */ 397 | dest->FAT_next_block = htoi((unsigned char *) &h->FAT_next_block, FOREMOST_LITTLE_ENDIAN); /*68*/ 398 | dest->num_extra_FAT_blocks = htoi((unsigned char *) &h->num_extra_FAT_blocks, 399 | FOREMOST_LITTLE_ENDIAN); 400 | 401 | x = (int *) &h[1]; 402 | y = (int *) &dest[1]; 403 | for (i = 0; i < 109; i++, x++) 404 | { 405 | *y = htoi((unsigned char *)x, FOREMOST_LITTLE_ENDIAN); 406 | y++; 407 | } 408 | 409 | return dest; 410 | } 411 | 412 | void dump_ole_header(struct OLE_HDR *h) 413 | { 414 | int i, *x; 415 | 416 | //fprintf (stderr, "clsid = "); 417 | //printx(h->clsid,0,16); 418 | fprintf(stderr, 419 | "\nuMinorVersion = %u\t", 420 | htos((unsigned char *) &h->uMinorVersion, FOREMOST_LITTLE_ENDIAN)); 421 | fprintf(stderr, 422 | "uDllVersion = %u\t", 423 | htos((unsigned char *) &h->uDllVersion, FOREMOST_LITTLE_ENDIAN)); 424 | fprintf(stderr, 425 | "uByteOrder = %u\n", 426 | htos((unsigned char *) &h->uByteOrder, FOREMOST_LITTLE_ENDIAN)); 427 | fprintf(stderr, 428 | "uSectorShift = %u\t", 429 | htos((unsigned char *) &h->uSectorShift, FOREMOST_LITTLE_ENDIAN)); 430 | fprintf(stderr, 431 | "uMiniSectorShift = %u\t", 432 | htos((unsigned char *) &h->uMiniSectorShift, FOREMOST_LITTLE_ENDIAN)); 433 | fprintf(stderr, 434 | "reserved = %u\n", 435 | htos((unsigned char *) &h->reserved, FOREMOST_LITTLE_ENDIAN)); 436 | fprintf(stderr, 437 | "reserved1 = %u\t", 438 | htoi((unsigned char *) &h->reserved1, FOREMOST_LITTLE_ENDIAN)); 439 | fprintf(stderr, 440 | "reserved2 = %u\t", 441 | htoi((unsigned char *) &h->reserved2, FOREMOST_LITTLE_ENDIAN)); 442 | fprintf(stderr, 443 | "csectMiniFat = %u\t", 444 | htoi((unsigned char *) &h->csectMiniFat, FOREMOST_LITTLE_ENDIAN)); 445 | fprintf(stderr, 446 | "miniSectorCutoff = %u\n", 447 | htoi((unsigned char *) &h->miniSectorCutoff, FOREMOST_LITTLE_ENDIAN)); 448 | fprintf(stderr, 449 | "root_start_block = %u\n", 450 | htoi((unsigned char *) &h->root_start_block, FOREMOST_LITTLE_ENDIAN)); 451 | fprintf(stderr, 452 | "dir flag = %u\n", 453 | htoi((unsigned char *) &h->dir_flag, FOREMOST_LITTLE_ENDIAN)); 454 | fprintf(stderr, 455 | "# FAT blocks = %u\n", 456 | htoi((unsigned char *) &h->num_FAT_blocks, FOREMOST_LITTLE_ENDIAN)); 457 | fprintf(stderr, 458 | "FAT_next_block = %u\n", 459 | htoi((unsigned char *) &h->FAT_next_block, FOREMOST_LITTLE_ENDIAN)); 460 | fprintf(stderr, 461 | "# extra FAT blocks = %u\n", 462 | htoi((unsigned char *) &h->num_extra_FAT_blocks, FOREMOST_LITTLE_ENDIAN)); 463 | x = (int *) &h[1]; 464 | fprintf(stderr, "bbd list:"); 465 | for (i = 0; i < 109; i++, x++) 466 | { 467 | if ((i % 10) == 0) 468 | fprintf(stderr, "\n"); 469 | if (*x == '\xff') 470 | break; 471 | fprintf(stderr, "%x ", htoi((unsigned char *)x, FOREMOST_LITTLE_ENDIAN)); 472 | } 473 | 474 | fprintf(stderr, "\n **************End of header***********\n"); 475 | } 476 | 477 | int dump_dirent(int which_one) 478 | { 479 | int i; 480 | char *p; 481 | short unknown; 482 | struct OLE_DIR *dir; 483 | 484 | dir = (struct OLE_DIR *) &buffer[which_one * sizeof(struct OLE_DIR)]; 485 | if (dir->type == NO_ENTRY) 486 | return TRUE; 487 | fprintf(stderr, "DIRENT_%d :\t", dir_count); 488 | fprintf(stderr, 489 | "%s\t", 490 | (dir->type == ROOT) ? "root directory" : (dir->type == STORAGE) ? "directory" : "file"); 491 | 492 | /* get UNICODE name */ 493 | p = dir->name; 494 | if (*p < ' ') 495 | { 496 | unknown = *((short *)p); 497 | 498 | //fprintf (stderr, "%04x\t", unknown); 499 | p += 2; /* step over unknown short */ 500 | } 501 | 502 | for (i = 0; i < dir->namsiz; i++, p++) 503 | { 504 | if (*p && (*p > 0x1f)) 505 | { 506 | if (isprint(*p)) 507 | { 508 | fprintf(stderr, "%c", *p); 509 | } 510 | else 511 | { 512 | printf("*** Invalid char %x ***\n", *p); 513 | return FALSE; 514 | } 515 | } 516 | } 517 | 518 | fprintf(stderr, "\n"); 519 | 520 | //fprintf (stderr, "prev_dirent = %lu\t", dir->prev_dirent); 521 | //fprintf (stderr, "next_dirent = %lu\t", dir->next_dirent); 522 | //fprintf (stderr, "dir_dirent = %lu\n", dir->dir_dirent); 523 | //fprintf (stderr, "name = %s\t", dir->name); 524 | fprintf(stderr, "namsiz = %u\t", dir->namsiz); 525 | fprintf(stderr, "type = %d\t", dir->type); 526 | fprintf(stderr, "reserved = %u\n", dir->reserved); 527 | 528 | fprintf(stderr, "start block = %lu\n", dir->start_block); 529 | fprintf(stderr, "size = %lu\n", dir->size); 530 | fprintf(stderr, "\n **************End of dirent***********\n"); 531 | return TRUE; 532 | } 533 | -------------------------------------------------------------------------------- /foremost-1.5.7/cli.c: -------------------------------------------------------------------------------- 1 | 2 | 3 | #include "main.h" 4 | 5 | void fatal_error (f_state * s, char *msg) 6 | { 7 | fprintf(stderr, "%s: %s%s", __progname, msg, NEWLINE); 8 | if (get_audit_file_open(s)) 9 | { 10 | audit_msg(s, msg); 11 | close_audit_file(s); 12 | } 13 | exit(EXIT_FAILURE); 14 | } 15 | 16 | void print_error(f_state *s, char *fn, char *msg) 17 | { 18 | if (!(get_mode(s, mode_quiet))) 19 | fprintf(stderr, "%s: %s: %s%s", __progname, fn, msg, NEWLINE); 20 | } 21 | 22 | void print_message(f_state *s, char *format, va_list argp) 23 | { 24 | vfprintf(stdout, format, argp); 25 | fprintf(stdout, "%s", NEWLINE); 26 | } 27 | -------------------------------------------------------------------------------- /foremost-1.5.7/config.c: -------------------------------------------------------------------------------- 1 | 2 | 3 | #include "main.h" 4 | 5 | int translate (char *str) 6 | { 7 | char next; 8 | char *rd = str, *wr = str, *bad; 9 | char temp[1 + 3 + 1]; 10 | char ch; 11 | 12 | if (!*rd) //If it's a null string just return 13 | { 14 | return 0; 15 | } 16 | 17 | while (*rd) 18 | { 19 | 20 | /* Is it an escaped character ? */ 21 | if (*rd == '\\') 22 | { 23 | rd++; 24 | switch (*rd) 25 | { 26 | case '\\': 27 | *rd++; 28 | *wr++ = '\\'; 29 | break; 30 | 31 | case 'a': 32 | *rd++; 33 | *wr++ = '\a'; 34 | break; 35 | 36 | case 's': 37 | *rd++; 38 | *wr++ = ' '; 39 | break; 40 | 41 | case 'n': 42 | *rd++; 43 | *wr++ = '\n'; 44 | break; 45 | 46 | case 'r': 47 | *rd++; 48 | *wr++ = '\r'; 49 | break; 50 | 51 | case 't': 52 | *rd++; 53 | *wr++ = '\t'; 54 | break; 55 | 56 | case 'v': 57 | *rd++; 58 | *wr++ = '\v'; 59 | break; 60 | 61 | /* Hexadecimal/Octal values are treated in one place using strtoul() */ 62 | case 'x': 63 | case '0': 64 | case '1': 65 | case '2': 66 | case '3': 67 | next = *(rd + 1); 68 | if (next < 48 || (57 < next && next < 65) || (70 < next && next < 97) || next > 102) 69 | break; //break if not a digit or a-f, A-F 70 | next = *(rd + 2); 71 | if (next < 48 || (57 < next && next < 65) || (70 < next && next < 97) || next > 102) 72 | break; //break if not a digit or a-f, A-F 73 | temp[0] = '0'; 74 | bad = temp; 75 | strncpy(temp + 1, rd, 3); 76 | temp[4] = '\0'; 77 | ch = strtoul(temp, &bad, 0); 78 | if (*bad == '\0') 79 | { 80 | *wr++ = ch; 81 | rd += 3; 82 | } /* else INVALID CHARACTER IN INPUT ('\\' followed by *rd) */ 83 | break; 84 | 85 | default: /* INVALID CHARACTER IN INPUT (*rd)*/ 86 | *wr++ = '\\'; 87 | break; 88 | } 89 | } 90 | 91 | /* Unescaped characters go directly to the output */ 92 | else 93 | *wr++ = *rd++; 94 | } 95 | *wr = '\0'; //Null terminate the string that we just created... 96 | return wr - str; 97 | } 98 | 99 | char *skipWhiteSpace(char *str) 100 | { 101 | while (isspace(str[0])) 102 | str++; 103 | return str; 104 | } 105 | 106 | int extractSearchSpecData(f_state *state, char **tokenarray) 107 | { 108 | 109 | /* Process a normal line with 3-4 tokens on it 110 | token[0] = suffix 111 | token[1] = case sensitive 112 | token[2] = size to snarf 113 | token[3] = begintag 114 | token[4] = endtag (optional) 115 | token[5] = search for footer from back of buffer flag and other options (whew!) 116 | */ 117 | 118 | /* Allocate the memory for these lines.... */ 119 | s_spec *s = &search_spec[state->num_builtin]; 120 | 121 | s->suffix = malloc(MAX_SUFFIX_LENGTH * sizeof(char)); 122 | s->header = malloc(MAX_STRING_LENGTH * sizeof(char)); 123 | s->footer = malloc(MAX_STRING_LENGTH * sizeof(char)); 124 | s->type = CONF; 125 | if (!strncasecmp(tokenarray[0], FOREMOST_NOEXTENSION_SUFFIX, strlen(FOREMOST_NOEXTENSION_SUFFIX) 126 | )) 127 | { 128 | s->suffix[0] = ' '; 129 | s->suffix[1] = 0; 130 | } 131 | else 132 | { 133 | 134 | /* Assign the current line to the SearchSpec object */ 135 | memcpy(s->suffix, tokenarray[0], MAX_SUFFIX_LENGTH); 136 | } 137 | 138 | /* Check for case sensitivity */ 139 | s->case_sen = (!strncasecmp(tokenarray[1], "y", 1) || !strncasecmp(tokenarray[1], "yes", 3)); 140 | 141 | s->max_len = atoi(tokenarray[2]); 142 | 143 | /* Determine which search type we want to use for this needle */ 144 | s->searchtype = SEARCHTYPE_FORWARD; 145 | if (!strncasecmp(tokenarray[5], "REVERSE", strlen("REVERSE"))) 146 | { 147 | 148 | s->searchtype = SEARCHTYPE_REVERSE; 149 | } 150 | else if (!strncasecmp(tokenarray[5], "NEXT", strlen("NEXT"))) 151 | { 152 | s->searchtype = SEARCHTYPE_FORWARD_NEXT; 153 | } 154 | 155 | // this is the default, but just if someone wants to provide this value just to be sure 156 | else if (!strncasecmp(tokenarray[5], "FORWARD", strlen("FORWARD"))) 157 | { 158 | s->searchtype = SEARCHTYPE_FORWARD; 159 | } 160 | else if (!strncasecmp(tokenarray[5], "ASCII", strlen("ASCII"))) 161 | { 162 | //fprintf(stderr,"Setting ASCII TYPE\n"); 163 | s->searchtype = SEARCHTYPE_ASCII; 164 | } 165 | 166 | /* Done determining searchtype */ 167 | 168 | /* We copy the tokens and translate them from the file format. 169 | The translate() function does the translation and returns 170 | the length of the argument being translated */ 171 | s->header_len = translate(tokenarray[3]); 172 | memcpy(s->header, tokenarray[3], s->header_len); 173 | s->footer_len = translate(tokenarray[4]); 174 | memcpy(s->footer, tokenarray[4], s->footer_len); 175 | 176 | init_bm_table(s->header, s->header_bm_table, s->header_len, s->case_sen, s->searchtype); 177 | init_bm_table(s->footer, s->footer_bm_table, s->footer_len, s->case_sen, s->searchtype); 178 | 179 | return TRUE; 180 | } 181 | 182 | int process_line(f_state *s, char *buffer, int line_number) 183 | { 184 | 185 | char *buf = buffer; 186 | char *token; 187 | char **tokenarray = (char **)malloc(6 * sizeof(char[MAX_STRING_LENGTH])); 188 | int i = 0, len = strlen(buffer); 189 | 190 | /* Any line that ends with a CTRL-M (0x0d) has been processed 191 | by a DOS editor. We will chop the CTRL-M to ignore it */ 192 | if (buffer[len - 2] == 0x0d && buffer[len - 1] == 0x0a) 193 | { 194 | buffer[len - 2] = buffer[len - 1]; 195 | buffer[len - 1] = buffer[len]; 196 | } 197 | 198 | buf = (char *)skipWhiteSpace(buf); 199 | token = strtok(buf, " \t\n"); 200 | 201 | /* Any line that starts with a '#' is a comment and can be skipped */ 202 | if (token == NULL || token[0] == '#') 203 | { 204 | return TRUE; 205 | } 206 | 207 | /* Check for the wildcard */ 208 | if (!strncasecmp(token, "wildcard", 9)) 209 | { 210 | if ((token = strtok(NULL, " \t\n")) != NULL) 211 | { 212 | translate(token); 213 | } 214 | else 215 | { 216 | return TRUE; 217 | } 218 | 219 | if (strlen(token) > 1) 220 | { 221 | fprintf(stderr, 222 | "Warning: Wildcard can only be one character," 223 | " but you specified %zu characters.\n" 224 | " Using the first character, \"%c\", as the wildcard.\n", 225 | strlen(token), 226 | token[0]); 227 | } 228 | 229 | wildcard = token[0]; 230 | return TRUE; 231 | } 232 | 233 | while (token && (i < NUM_SEARCH_SPEC_ELEMENTS)) 234 | { 235 | tokenarray[i] = token; 236 | i++; 237 | token = strtok(NULL, " \t\n"); 238 | } 239 | 240 | switch (NUM_SEARCH_SPEC_ELEMENTS - i) 241 | { 242 | case 2: 243 | tokenarray[NUM_SEARCH_SPEC_ELEMENTS - 1] = ""; 244 | tokenarray[NUM_SEARCH_SPEC_ELEMENTS - 2] = ""; 245 | break; 246 | 247 | case 1: 248 | tokenarray[NUM_SEARCH_SPEC_ELEMENTS - 1] = ""; 249 | break; 250 | 251 | case 0: 252 | break; 253 | 254 | default: 255 | fprintf(stderr, "\nERROR: In line %d of the configuration file.\n", line_number); 256 | return FALSE; 257 | return TRUE; 258 | 259 | } 260 | 261 | if (!extractSearchSpecData(s, tokenarray)) 262 | { 263 | fprintf(stderr, 264 | "\nERROR: Unknown error on line %d of the configuration file.\n", 265 | line_number); 266 | } 267 | 268 | s->num_builtin++; 269 | 270 | return TRUE; 271 | } 272 | 273 | int load_config_file(f_state *s) 274 | { 275 | FILE *f; 276 | char *buffer = (char *)malloc(MAX_STRING_LENGTH * sizeof(char)); 277 | off_t line_number = 0; 278 | 279 | #ifdef __DEBUG 280 | printf("About to open config file %s%s", get_config_file(s), NEWLINE); 281 | #endif 282 | 283 | if ((f = fopen(get_config_file(s), "r")) == NULL) 284 | { 285 | 286 | /*Can't find a conf in the current directory 287 | * So lets try the /usr/local/etc*/ 288 | #ifdef __WIN32 289 | set_config_file(s, "/Program Files/foremost/foremost.conf"); 290 | #else 291 | set_config_file(s, "/usr/local/etc/foremost.conf"); 292 | #endif 293 | if ((f = fopen(get_config_file(s), "r")) == NULL) 294 | { 295 | print_error(s, get_config_file(s), strerror(errno)); 296 | free(buffer); 297 | return TRUE; 298 | } 299 | 300 | } 301 | 302 | while (fgets(buffer, MAX_STRING_LENGTH, f)) 303 | { 304 | ++line_number; 305 | if (!process_line(s, buffer, line_number)) 306 | { 307 | free(buffer); 308 | fclose(f); 309 | return TRUE; 310 | 311 | } 312 | } 313 | 314 | fclose(f); 315 | free(buffer); 316 | return FALSE; 317 | } 318 | -------------------------------------------------------------------------------- /foremost-1.5.7/dir.c: -------------------------------------------------------------------------------- 1 | 2 | 3 | #include "main.h" 4 | 5 | int is_empty_directory (DIR * temp) 6 | { 7 | 8 | /* Empty directories contain two entries for . and .. 9 | A directory with three entries, therefore, is not empty */ 10 | if (readdir(temp) && readdir(temp) && readdir(temp)) 11 | return FALSE; 12 | 13 | return TRUE; 14 | } 15 | 16 | /*Try to cleanup the ouput directory if nothing to a sub-dir*/ 17 | void cleanup_output(f_state *s) 18 | { 19 | char dir_name[MAX_STRING_LENGTH]; 20 | 21 | DIR *temp; 22 | DIR *outputDir; 23 | struct dirent *entry; 24 | 25 | if ((outputDir = opendir(get_output_directory(s))) == NULL) 26 | { 27 | 28 | /*Error?*/ 29 | } 30 | 31 | while ((entry = readdir(outputDir))) 32 | { 33 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 34 | strcpy(dir_name, get_output_directory(s)); 35 | strcat(dir_name, "/"); 36 | strcat(dir_name, entry->d_name); 37 | temp = opendir(dir_name); 38 | if (temp != NULL) 39 | { 40 | if (is_empty_directory(temp)) 41 | { 42 | rmdir(dir_name); 43 | } 44 | } 45 | 46 | } 47 | 48 | } 49 | 50 | int make_new_directory(f_state *s, char *fn) 51 | { 52 | 53 | #ifdef __WIN32 54 | 55 | #ifndef __CYGWIN 56 | fprint(stderr,"Calling mkdir with\n"); 57 | if (mkdir(fn)) 58 | #endif 59 | 60 | #else 61 | mode_t new_mode = 62 | ( 63 | S_IRUSR | 64 | S_IWUSR | 65 | S_IXUSR | 66 | S_IRGRP | 67 | S_IWGRP | 68 | S_IXGRP | 69 | S_IROTH | 70 | S_IWOTH 71 | ); 72 | if (mkdir(fn, new_mode)) 73 | #endif 74 | { 75 | if (errno != EEXIST) 76 | { 77 | print_error(s, fn, strerror(errno)); 78 | return TRUE; 79 | } 80 | } 81 | 82 | return FALSE; 83 | } 84 | 85 | /*Clean the timestamped dir name to make it a little more file system friendly*/ 86 | char *clean_time_string(char *time) 87 | { 88 | int len = strlen(time); 89 | int i = 0; 90 | 91 | for (i = 0; i < len; i++) 92 | { 93 | #ifdef __WIN32 94 | if (time[i] == ':' && time[i + 1] != '\\') 95 | { 96 | time[i] = '_'; 97 | } 98 | 99 | #else 100 | if (time[i] == ' ' || time[i] == ':') 101 | { 102 | time[i] = '_'; 103 | } 104 | #endif 105 | } 106 | 107 | return time; 108 | } 109 | 110 | int create_output_directory(f_state *s) 111 | { 112 | DIR *d; 113 | char dir_name[MAX_STRING_LENGTH]; 114 | 115 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 116 | if (s->time_stamp) 117 | { 118 | strcpy(dir_name, get_output_directory(s)); 119 | strcat(dir_name, "_"); 120 | strcat(dir_name, get_start_time(s)); 121 | clean_time_string(dir_name); 122 | set_output_directory(s, dir_name); 123 | } 124 | #ifdef DEBUG 125 | printf("Checking output directory %s\n", get_output_directory(s)); 126 | #endif 127 | 128 | if ((d = opendir(get_output_directory(s))) != NULL) 129 | { 130 | 131 | /* The directory exists already. It MUST be empty for us to continue */ 132 | if (!is_empty_directory(d)) 133 | { 134 | printf("ERROR: %s is not empty\n \tPlease specify another directory or run with -T.\n", 135 | get_output_directory(s)); 136 | 137 | exit(EXIT_FAILURE); 138 | } 139 | 140 | /* The directory exists and is empty. We're done! */ 141 | closedir(d); 142 | return FALSE; 143 | } 144 | 145 | /* The error value ENOENT means that either the directory doesn't exist, 146 | which is fine, or that the filename is zero-length, which is bad. 147 | All other errors are, of course, bad. 148 | */ 149 | if (errno != ENOENT) 150 | { 151 | print_error(s, get_output_directory(s), strerror(errno)); 152 | return TRUE; 153 | } 154 | 155 | if (strlen(get_output_directory(s)) == 0) 156 | { 157 | 158 | /* Careful! Calling print_error will try to display a filename 159 | that is zero characters! In theory this should never happen 160 | as our call to realpath should avoid this. But we'll play it safe. */ 161 | print_error(s, "(output_directory)", "Output directory name unknown"); 162 | return TRUE; 163 | } 164 | 165 | return (make_new_directory(s, get_output_directory(s))); 166 | } 167 | 168 | /*Create file type sub dirs, can get tricky when multiple types use one 169 | extraction algorithm (OLE)*/ 170 | int create_sub_dirs(f_state *s) 171 | { 172 | int i = 0; 173 | int j = 0; 174 | char dir_name[MAX_STRING_LENGTH]; 175 | char ole_types[7][4] = { "ppt", "doc", "xls", "sdw", "mbd", "vis", "ole" }; 176 | char riff_types[2][4] = { "avi", "wav" }; 177 | char zip_types[8][5] = { "sxc", "sxw", "sxi", "sx", "jar","docx","pptx","xlsx" }; 178 | 179 | for (i = 0; i < s->num_builtin; i++) 180 | { 181 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 182 | strcpy(dir_name, get_output_directory(s)); 183 | strcat(dir_name, "/"); 184 | strcat(dir_name, search_spec[i].suffix); 185 | make_new_directory(s, dir_name); 186 | 187 | if (search_spec[i].type == OLE) 188 | { 189 | for (j = 0; j < 7; j++) 190 | { 191 | if (strstr(ole_types[j], search_spec[i].suffix)) 192 | continue; 193 | 194 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 195 | strcpy(dir_name, get_output_directory(s)); 196 | strcat(dir_name, "/"); 197 | strcat(dir_name, ole_types[j]); 198 | make_new_directory(s, dir_name); 199 | } 200 | } 201 | else if (get_mode(s, mode_write_all)) 202 | { 203 | for (j = 0; j < 7; j++) 204 | { 205 | if (strstr(search_spec[i].suffix, ole_types[j])) 206 | { 207 | for (j = 0; j < 7; j++) 208 | { 209 | if (strstr(ole_types[j], search_spec[i].suffix)) 210 | continue; 211 | 212 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 213 | strcpy(dir_name, get_output_directory(s)); 214 | strcat(dir_name, "/"); 215 | strcat(dir_name, ole_types[j]); 216 | make_new_directory(s, dir_name); 217 | } 218 | break; 219 | } 220 | 221 | } 222 | } 223 | 224 | if (search_spec[i].type == EXE) 225 | { 226 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 227 | strcpy(dir_name, get_output_directory(s)); 228 | strcat(dir_name, "/"); 229 | strcat(dir_name, "dll"); 230 | make_new_directory(s, dir_name); 231 | } 232 | 233 | if (search_spec[i].type == RIFF) 234 | { 235 | for (j = 0; j < 2; j++) 236 | { 237 | if (strstr(ole_types[j], search_spec[i].suffix)) 238 | continue; 239 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 240 | strcpy(dir_name, get_output_directory(s)); 241 | strcat(dir_name, "/"); 242 | strcat(dir_name, riff_types[j]); 243 | make_new_directory(s, dir_name); 244 | } 245 | } 246 | else if (get_mode(s, mode_write_all)) 247 | { 248 | for (j = 0; j < 2; j++) 249 | { 250 | if (strstr(search_spec[i].suffix, riff_types[j])) 251 | { 252 | for (j = 0; j < 2; j++) 253 | { 254 | if (strstr(ole_types[j], search_spec[i].suffix)) 255 | continue; 256 | 257 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 258 | strcpy(dir_name, get_output_directory(s)); 259 | strcat(dir_name, "/"); 260 | strcat(dir_name, riff_types[j]); 261 | make_new_directory(s, dir_name); 262 | } 263 | break; 264 | } 265 | 266 | } 267 | } 268 | 269 | if (search_spec[i].type == ZIP) 270 | { 271 | for (j = 0; j < 8; j++) 272 | { 273 | if (strstr(ole_types[j], search_spec[i].suffix)) 274 | continue; 275 | 276 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 277 | strcpy(dir_name, get_output_directory(s)); 278 | strcat(dir_name, "/"); 279 | strcat(dir_name, zip_types[j]); 280 | make_new_directory(s, dir_name); 281 | } 282 | } 283 | else if (get_mode(s, mode_write_all)) 284 | { 285 | for (j = 0; j < 8; j++) 286 | { 287 | if (strstr(search_spec[i].suffix, zip_types[j])) 288 | { 289 | for (j = 0; j < 5; j++) 290 | { 291 | if (strstr(ole_types[j], search_spec[i].suffix)) 292 | continue; 293 | 294 | memset(dir_name, 0, MAX_STRING_LENGTH - 1); 295 | strcpy(dir_name, get_output_directory(s)); 296 | strcat(dir_name, "/"); 297 | strcat(dir_name, zip_types[j]); 298 | make_new_directory(s, dir_name); 299 | } 300 | break; 301 | } 302 | } 303 | } 304 | 305 | } 306 | 307 | return TRUE; 308 | } 309 | 310 | /*We have found a file so write to disk*/ 311 | int write_to_disk(f_state *s, s_spec *needle, u_int64_t len, unsigned char *buf, u_int64_t t_offset) 312 | { 313 | 314 | char fn[MAX_STRING_LENGTH]; 315 | FILE *f; 316 | FILE *test; 317 | long byteswritten = 0; 318 | char temp[32]; 319 | u_int64_t block = ((t_offset) / s->block_size); 320 | int i = 1; 321 | 322 | //Name files based on their block offset 323 | needle->written = TRUE; 324 | 325 | if (get_mode(s, mode_write_audit)) 326 | { 327 | if (needle->comment == NULL) 328 | strcpy(needle->comment, " "); 329 | 330 | audit_msg(s, 331 | "%d:\t%10ld.%s \t %10s \t %10llu \t %s", 332 | s->fileswritten, 333 | block, 334 | needle->suffix, 335 | human_readable(len, temp), 336 | t_offset, 337 | needle->comment); 338 | s->fileswritten++; 339 | needle->found++; 340 | return TRUE; 341 | } 342 | 343 | snprintf(fn, 344 | MAX_STRING_LENGTH, 345 | "%s/%s/%0*llu.%s", 346 | s->output_directory, 347 | needle->suffix, 348 | 8, 349 | block, 350 | needle->suffix); 351 | 352 | test = fopen(fn, "r"); 353 | while (test) /*Test the files to make sure we have unique file names, some headers could be within the same block*/ 354 | { 355 | memset(fn, 0, MAX_STRING_LENGTH - 1); 356 | snprintf(fn, 357 | MAX_STRING_LENGTH - 1, 358 | "%s/%s/%0*llu_%d.%s", 359 | s->output_directory, 360 | needle->suffix, 361 | 8, 362 | block, 363 | i, 364 | needle->suffix); 365 | i++; 366 | fclose(test); 367 | test = fopen(fn, "r"); 368 | } 369 | 370 | if (!(f = fopen(fn, "w"))) 371 | { 372 | printf("fn = %s failed\n", fn); 373 | fatal_error(s, "Can't open file for writing \n"); 374 | } 375 | 376 | if ((byteswritten = fwrite(buf, sizeof(char), len, f)) != len) 377 | { 378 | fprintf(stderr, "fn=%s bytes=%lu\n", fn, byteswritten); 379 | fatal_error(s, "Error writing file\n"); 380 | } 381 | 382 | if (fclose(f)) 383 | { 384 | fatal_error(s, "Error closing file\n"); 385 | } 386 | 387 | if (needle->comment == NULL) 388 | strcpy(needle->comment, " "); 389 | 390 | if (i == 1) { 391 | audit_msg(s,"%d:\t%08llu.%s \t %10s \t %10llu \t %s", 392 | s->fileswritten, 393 | block, 394 | needle->suffix, 395 | human_readable(len, temp), 396 | t_offset, 397 | needle->comment); 398 | } else { 399 | audit_msg(s,"%d:\t%08llu_%d.%s \t %10s \t %10llu \t %s", 400 | s->fileswritten, 401 | block, 402 | i - 1, 403 | needle->suffix, 404 | human_readable(len, temp), 405 | t_offset, 406 | needle->comment); 407 | } 408 | 409 | /* 410 | audit_msg(s,"%d:\t%10llu.%s \t %10s \t %10llu \t %s", 411 | s->fileswritten, 412 | block, 413 | needle->suffix, 414 | human_readable(len, temp), 415 | t_offset, 416 | needle->comment); 417 | 418 | */ 419 | s->fileswritten++; 420 | needle->found++; 421 | return TRUE; 422 | } 423 | -------------------------------------------------------------------------------- /foremost-1.5.7/engine.c: -------------------------------------------------------------------------------- 1 | 2 | /* FOREMOST 3 | * 4 | * By Jesse Kornblum, Kris Kendall, & Nick Mikus 5 | * 6 | * This is a work of the US Government. In accordance with 17 USC 105, 7 | * copyright protection is not available for any work of the US Government. 8 | * 9 | * This program is distributed in the hope that it will be useful, but 10 | * WITHOUT ANY WARRANTY; without even the implied warranty of 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 12 | * 13 | */ 14 | 15 | #include "main.h" 16 | 17 | int user_interrupt (f_state * s, f_info * i) 18 | { 19 | audit_msg(s, "Interrupt received at %s", current_time()); 20 | 21 | /* RBF - Write user_interrupt */ 22 | fclose(i->handle); 23 | free(s); 24 | free(i); 25 | cleanup_output(s); 26 | exit(-1); 27 | return FALSE; 28 | } 29 | 30 | unsigned char *read_from_disk(u_int64_t offset, f_info *i, u_int64_t length) 31 | { 32 | 33 | u_int64_t bytesread = 0; 34 | unsigned char *newbuf = (unsigned char *)malloc(length * sizeof(char)); 35 | if (!newbuf) { 36 | fprintf(stderr, "Ran out of memory in read_from_disk()\n"); 37 | exit(1); 38 | } 39 | 40 | fseeko(i->handle, offset, SEEK_SET); 41 | bytesread = fread(newbuf, 1, length, i->handle); 42 | if (bytesread != length) 43 | { 44 | free(newbuf); 45 | return NULL; 46 | } 47 | else 48 | { 49 | return newbuf; 50 | } 51 | } 52 | 53 | /* 54 | Perform a modified boyer-moore string search (w/ support for wildcards and case-insensitive searches) 55 | and allows the starting position in the buffer to be manually set, which allows data to be skipped 56 | */ 57 | unsigned char *bm_search_skipn(unsigned char *needle, size_t needle_len, unsigned char *haystack, 58 | size_t haystack_len, size_t table[UCHAR_MAX + 1], int casesensitive, 59 | int searchtype, int start_pos) 60 | { 61 | register size_t shift = 0; 62 | register size_t pos = start_pos; 63 | unsigned char *here; 64 | 65 | if (needle_len == 0) 66 | return haystack; 67 | 68 | if (searchtype == SEARCHTYPE_FORWARD || searchtype == SEARCHTYPE_FORWARD_NEXT) 69 | { 70 | while (pos < haystack_len) 71 | { 72 | while (pos < haystack_len && (shift = table[(unsigned char)haystack[pos]]) > 0) 73 | { 74 | pos += shift; 75 | } 76 | 77 | if (0 == shift) 78 | { 79 | here = (unsigned char *) &haystack[pos - needle_len + 1]; 80 | if (0 == memwildcardcmp(needle, here, needle_len, casesensitive)) 81 | { 82 | return (here); 83 | } 84 | else 85 | pos++; 86 | } 87 | } 88 | 89 | return NULL; 90 | } 91 | else if (searchtype == SEARCHTYPE_REVERSE) //Run our search backwards 92 | { 93 | while (pos < haystack_len) 94 | { 95 | while 96 | ( 97 | pos < haystack_len && 98 | (shift = table[(unsigned char)haystack[haystack_len - pos - 1]]) > 0 99 | ) 100 | { 101 | pos += shift; 102 | } 103 | 104 | if (0 == shift) 105 | { 106 | if (0 == memwildcardcmp(needle, here = (unsigned char *) &haystack[haystack_len - pos - 1], 107 | needle_len, casesensitive)) 108 | { 109 | return (here); 110 | } 111 | else 112 | pos++; 113 | } 114 | } 115 | 116 | return NULL; 117 | } 118 | 119 | return NULL; 120 | } 121 | 122 | /* 123 | Perform a modified boyer-moore string search (w/ support for wildcards and case-insensitive searches) 124 | and allows the starting position in the buffer to be manually set, which allows data to be skipped 125 | */ 126 | unsigned char *bm_search(unsigned char *needle, size_t needle_len, unsigned char *haystack, 127 | size_t haystack_len, size_t table[UCHAR_MAX + 1], int case_sen, 128 | int searchtype) 129 | { 130 | 131 | //printf("The needle2 is:\t"); 132 | //printx(needle,0,needle_len); 133 | return bm_search_skipn(needle, 134 | needle_len, 135 | haystack, 136 | haystack_len, 137 | table, 138 | case_sen, 139 | searchtype, 140 | needle_len - 1); 141 | 142 | } 143 | 144 | void setup_stream(f_state *s, f_info *i) 145 | { 146 | char buffer[MAX_STRING_LENGTH]; 147 | u_int64_t skip = (((u_int64_t) s->skip) * ((u_int64_t) s->block_size)); 148 | #ifdef DEBUG 149 | printf("s->skip=%d s->block_size=%d total=%llu\n", 150 | s->skip, 151 | s->block_size, 152 | (((u_int64_t) s->skip) * ((u_int64_t) s->block_size))); 153 | #endif 154 | i->bytes_read = 0; 155 | i->total_megs = i->total_bytes / ONE_MEGABYTE; 156 | 157 | if (i->total_bytes != 0) 158 | { 159 | audit_msg(s, 160 | "Length: %s (%llu bytes)", 161 | human_readable(i->total_bytes, buffer), 162 | i->total_bytes); 163 | } 164 | else 165 | audit_msg(s, "Length: Unknown"); 166 | 167 | if (s->skip != 0) 168 | { 169 | audit_msg(s, "Skipping: %s (%llu bytes)", human_readable(skip, buffer), skip); 170 | fseeko(i->handle, skip, SEEK_SET); 171 | if (i->total_bytes != 0) 172 | i->total_bytes -= skip; 173 | } 174 | 175 | audit_msg(s, " "); 176 | 177 | #ifdef __WIN32 178 | i->last_read = 0; 179 | i->overflow_count = 0; 180 | #endif 181 | 182 | } 183 | 184 | void audit_layout(f_state *s) 185 | { 186 | audit_msg(s, 187 | "Num\t %s (bs=%d)\t %10s\t %s\t %s \n", 188 | "Name", 189 | s->block_size, 190 | "Size", 191 | "File Offset", 192 | "Comment"); 193 | 194 | } 195 | 196 | void dumpInd(unsigned char *ind, int bs) 197 | { 198 | int i = 0; 199 | printf("\n/*******************************/\n"); 200 | 201 | while (bs > 0) 202 | { 203 | if (i % 10 == 0) 204 | printf("\n"); 205 | 206 | //printx(ind,0,10); 207 | printf("%4u ", htoi(ind, FOREMOST_LITTLE_ENDIAN)); 208 | 209 | bs -= 4; 210 | ind += 4; 211 | i++; 212 | } 213 | 214 | printf("\n/*******************************/\n"); 215 | } 216 | 217 | /******************************************************************************** 218 | *Function: ind_block 219 | *Description: check if the block foundat is pointing to looks like an indirect 220 | * block 221 | *Return: TRUE/FALSE 222 | **********************************************************************************/ 223 | int ind_block(unsigned char *foundat, u_int64_t buflen, int bs) 224 | { 225 | 226 | unsigned char *temp = foundat; 227 | int jump = 12 * bs; 228 | unsigned int block = 0; 229 | unsigned int block2 = 0; 230 | unsigned int dif = 0; 231 | int i = 0; 232 | unsigned int one = 1; 233 | unsigned int numbers = (bs / 4) - 1; 234 | 235 | //int reconstruct=FALSE; 236 | 237 | /*Make sure we don't jump past the end of the buffer*/ 238 | if (buflen < jump + 16) 239 | return FALSE; 240 | 241 | while (i < numbers) 242 | { 243 | block = htoi(&temp[jump + (i * 4)], FOREMOST_LITTLE_ENDIAN); 244 | 245 | if (block < 0) 246 | return FALSE; 247 | 248 | if (block == 0) 249 | { 250 | break; 251 | } 252 | 253 | i++; 254 | block2 = htoi(&temp[jump + (i * 4)], FOREMOST_LITTLE_ENDIAN); 255 | if (block2 < 0) 256 | return FALSE; 257 | 258 | if (block2 == 0) 259 | { 260 | break; 261 | } 262 | 263 | dif = block2 - block; 264 | 265 | if (dif == one) 266 | { 267 | 268 | #ifdef DEBUG 269 | printf("block1:=%u, block2:=%u dif=%u\n", block, block2, dif); 270 | #endif 271 | } 272 | else 273 | { 274 | 275 | #ifdef DEBUG 276 | printf("Failure, dif!=1\n"); 277 | printf("\tblock1:=%u, block2:=%u dif=%u\n", block, block2, dif); 278 | #endif 279 | 280 | return FALSE; 281 | } 282 | 283 | #ifdef DEBUG 284 | printf("block1:=%u, block2:=%u dif=%u\n", block, block2, dif); 285 | #endif 286 | } 287 | 288 | if (i == 0) 289 | return FALSE; 290 | 291 | /*Check if the rest of the bytes are zero'd out */ 292 | for (i = i + 1; i < numbers; i++) 293 | { 294 | block = htoi(&temp[jump + (i * 4)], FOREMOST_LITTLE_ENDIAN); 295 | if (block != 0) 296 | { 297 | 298 | //printf("Failure, 0 test\n"); 299 | return FALSE; 300 | } 301 | } 302 | 303 | return TRUE; 304 | } 305 | 306 | /******************************************************************************** 307 | *Function: search_chunk 308 | *Description: Analyze the given chunk by running each defined search spec on it 309 | *Return: TRUE/FALSE 310 | **********************************************************************************/ 311 | int search_chunk(f_state *s, unsigned char *buf, f_info *i, u_int64_t chunk_size, u_int64_t f_offset) 312 | { 313 | 314 | u_int64_t c_offset = 0; 315 | //u_int64_t foundat_off = 0; 316 | //u_int64_t buf_off = 0; 317 | 318 | unsigned char *foundat = buf; 319 | unsigned char *current_pos = NULL; 320 | unsigned char *header_pos = NULL; 321 | unsigned char *newbuf = NULL; 322 | unsigned char *ind_ptr = NULL; 323 | u_int64_t current_buflen = chunk_size; 324 | int tryBS[3] = { 4096, 1024, 512 }; 325 | unsigned char *extractbuf = NULL; 326 | u_int64_t file_size = 0; 327 | s_spec *needle = NULL; 328 | int j = 0; 329 | int bs = 0; 330 | int rem = 0; 331 | int x = 0; 332 | int found_ind = FALSE; 333 | off_t saveme; 334 | //char comment[32]; 335 | for (j = 0; j < s->num_builtin; j++) 336 | { 337 | needle = &search_spec[j]; 338 | foundat = buf; /*reset the buffer for the next search spec*/ 339 | #ifdef DEBUG 340 | printf(" SEARCHING FOR %s's\n", needle->suffix); 341 | #endif 342 | bs = 0; 343 | current_buflen = chunk_size; 344 | while (foundat) 345 | { 346 | needle->written = FALSE; 347 | found_ind = FALSE; 348 | memset(needle->comment, 0, COMMENT_LENGTH - 1); 349 | if (chunk_size <= (foundat - buf)) { 350 | #ifdef DEBUG 351 | printf("avoided seg fault in search_chunk()\n"); 352 | #endif 353 | foundat = NULL; 354 | break; 355 | } 356 | current_buflen = chunk_size - (foundat - buf); 357 | 358 | //if((foundat-buf)< 1 ) break; 359 | #ifdef DEBUG 360 | //foundat_off=foundat; 361 | //buf_off=buf; 362 | //printf("current buf:=%llu (foundat-buf)=%llu \n", current_buflen, (u_int64_t) (foundat_off - buf_off)); 363 | #endif 364 | if (signal_caught == SIGTERM || signal_caught == SIGINT) 365 | { 366 | user_interrupt(s, i); 367 | printf("Cleaning up.\n"); 368 | signal_caught = 0; 369 | } 370 | 371 | if (get_mode(s, mode_quick)) /*RUN QUICK SEARCH*/ 372 | { 373 | #ifdef DEBUG 374 | 375 | //printf("quick mode is on\n"); 376 | #endif 377 | 378 | /*Check if we are not on a block head, adjust if so*/ 379 | rem = (foundat - buf) % s->block_size; 380 | if (rem != 0) 381 | { 382 | foundat += (s->block_size - rem); 383 | } 384 | 385 | if (memwildcardcmp(needle->header, foundat, needle->header_len, needle->case_sen 386 | ) != 0) 387 | { 388 | 389 | /*No match, jump to the next block*/ 390 | if (current_buflen > s->block_size) 391 | { 392 | foundat += s->block_size; 393 | continue; 394 | } 395 | else /*We are out of buffer lets go to the next search spec*/ 396 | { 397 | foundat = NULL; 398 | break; 399 | } 400 | } 401 | 402 | header_pos = foundat; 403 | } 404 | else /**********RUN STANDARD SEARCH********************/ 405 | { 406 | foundat = bm_search(needle->header, 407 | needle->header_len, 408 | foundat, 409 | current_buflen, //How much to search through 410 | needle->header_bm_table, 411 | needle->case_sen, //casesensative 412 | SEARCHTYPE_FORWARD); 413 | 414 | header_pos = foundat; 415 | } 416 | 417 | if (foundat != NULL && foundat >= 0) /*We got something, run the appropriate heuristic to find the EOF*/ 418 | { 419 | current_buflen = chunk_size - (foundat - buf); 420 | 421 | if (get_mode(s, mode_ind_blk)) 422 | { 423 | #ifdef DEBUG 424 | printf("ind blk detection on\n"); 425 | #endif 426 | 427 | //dumpInd(foundat+12*1024,1024); 428 | for (x = 0; x < 3; x++) 429 | { 430 | bs = tryBS[x]; 431 | 432 | if (ind_block(foundat, current_buflen, bs)) 433 | { 434 | if (get_mode(s, mode_verbose)) 435 | { 436 | sprintf(needle->comment, " (IND BLK bs:=%d)", bs); 437 | } 438 | 439 | //dumpInd(foundat+12*bs,bs); 440 | #ifdef DEBUG 441 | printf("performing mem move\n"); 442 | #endif 443 | if(current_buflen > 13 * bs)//Make sure we have enough buffer 444 | { 445 | if (!memmove(foundat + 12 * bs, foundat + 13 * bs, current_buflen - 13 * bs)) 446 | break; 447 | 448 | found_ind = TRUE; 449 | #ifdef DEBUG 450 | printf("performing mem move complete\n"); 451 | #endif 452 | ind_ptr = foundat + 12 * bs; 453 | current_buflen -= bs; 454 | chunk_size -= bs; 455 | break; 456 | } 457 | } 458 | 459 | } 460 | 461 | } 462 | 463 | c_offset = (foundat - buf); 464 | current_pos = foundat; 465 | 466 | /*Now lets analyze the file and see if we can determine its size*/ 467 | 468 | // printf("c_offset=%llu %x %x %llx\n", c_offset,foundat,buf,c_offset); 469 | foundat = extract_file(s, c_offset, foundat, current_buflen, needle, f_offset); 470 | #ifdef DEBUG 471 | if (foundat == NULL) 472 | { 473 | printf("Foundat == NULL!!!\n"); 474 | } 475 | #endif 476 | if (get_mode(s, mode_write_all)) 477 | { 478 | if (needle->written == FALSE) 479 | { 480 | 481 | /*write every header we find*/ 482 | if (current_buflen >= needle->max_len) 483 | { 484 | file_size = needle->max_len; 485 | } 486 | else 487 | { 488 | file_size = current_buflen; 489 | } 490 | 491 | sprintf(needle->comment, " (Header dump)"); 492 | extractbuf = (unsigned char *)malloc(file_size * sizeof(char)); 493 | memcpy(extractbuf, header_pos, file_size); 494 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 495 | free(extractbuf); 496 | } 497 | } 498 | else if (!foundat) /*Should we search further?*/ 499 | { 500 | 501 | /*We couldn't determine where the file ends, now lets check to see 502 | * if we should try again 503 | */ 504 | if (current_buflen < needle->max_len) /*We need to bridge the gap*/ 505 | { 506 | #ifdef DEBUG 507 | printf(" Bridge the gap\n"); 508 | #endif 509 | saveme = ftello(i->handle); 510 | /*grow the buffer and try to extract again*/ 511 | newbuf = read_from_disk(c_offset + f_offset, i, needle->max_len); 512 | if (newbuf == NULL) 513 | break; 514 | current_pos = extract_file(s, 515 | c_offset, 516 | newbuf, 517 | needle->max_len, 518 | needle, 519 | f_offset); 520 | 521 | /*Lets put the fp back*/ 522 | fseeko(i->handle, saveme, SEEK_SET); 523 | 524 | 525 | free(newbuf); 526 | } 527 | else 528 | { 529 | foundat = header_pos; /*reset the foundat pointer to the location of the last header*/ 530 | foundat += needle->header_len + 1; /*jump past the header*/ 531 | } 532 | } 533 | 534 | 535 | } 536 | 537 | if (found_ind) 538 | { 539 | 540 | /*Put the ind blk back in, re-arrange the buffer so that the future blks names come out correct*/ 541 | #ifdef DEBUG 542 | printf("Replacing the ind block\n"); 543 | #endif 544 | /*This is slow, should we do this??????*/ 545 | if (!memmove(ind_ptr + 1 * bs, ind_ptr, current_buflen - 13 * bs)) 546 | break; 547 | memset(ind_ptr, 0, bs - 1); 548 | chunk_size += bs; 549 | memset(needle->comment, 0, COMMENT_LENGTH - 1); 550 | } 551 | } //end while 552 | } 553 | 554 | return TRUE; 555 | } 556 | 557 | /******************************************************************************** 558 | *Function: search_stream 559 | *Description: Analyze the file by reading 1 chunk (default: 100MB) at a time and 560 | *passing it to search_chunk 561 | *Return: TRUE/FALSE 562 | **********************************************************************************/ 563 | int search_stream(f_state *s, f_info *i) 564 | { 565 | u_int64_t bytesread = 0; 566 | u_int64_t f_offset = 0; 567 | u_int64_t chunk_size = ((u_int64_t) s->chunk_size) * MEGABYTE; 568 | unsigned char *buf = (unsigned char *)malloc(sizeof(char) * chunk_size); 569 | 570 | setup_stream(s, i); 571 | 572 | audit_layout(s); 573 | #ifdef DEBUG 574 | printf("\n\t READING THE FILE INTO MEMORY\n"); 575 | #endif 576 | 577 | while ((bytesread = fread(buf, 1, chunk_size, i->handle)) > 0) 578 | { 579 | if (signal_caught == SIGTERM || signal_caught == SIGINT) 580 | { 581 | user_interrupt(s, i); 582 | printf("Cleaning up.\n"); 583 | signal_caught = 0; 584 | } 585 | 586 | #ifdef DEBUG 587 | printf("\n\tbytes_read:=%llu\n", bytesread); 588 | #endif 589 | search_chunk(s, buf, i, bytesread, f_offset); 590 | f_offset += bytesread; 591 | if (!get_mode(s, mode_quiet)) 592 | { 593 | fprintf(stderr, "*"); 594 | 595 | //displayPosition(s,i,f_offset); 596 | } 597 | 598 | /*FIX ME*** 599 | * We should jump back and make sure we didn't miss any headers that are 600 | * bridged between chunks. What is the best way to do this?\ 601 | */ 602 | } 603 | 604 | if (!get_mode(s, mode_quiet)) 605 | { 606 | fprintf(stderr, "|\n"); 607 | } 608 | 609 | #ifdef DEBUG 610 | printf("\n\tDONE READING bytes_read:=%llu\n", bytesread); 611 | #endif 612 | if (signal_caught == SIGTERM || signal_caught == SIGINT) 613 | { 614 | user_interrupt(s, i); 615 | printf("Cleaning up.\n"); 616 | signal_caught = 0; 617 | } 618 | 619 | free(buf); 620 | return FALSE; 621 | } 622 | 623 | void audit_start(f_state *s, f_info *i) 624 | { 625 | if (!get_mode(s, mode_quiet)) 626 | { 627 | fprintf(stderr, "Processing: %s\n|", i->file_name); 628 | } 629 | 630 | audit_msg(s, FOREMOST_DIVIDER); 631 | audit_msg(s, "File: %s", i->file_name); 632 | audit_msg(s, "Start: %s", current_time()); 633 | } 634 | 635 | void audit_finish(f_state *s, f_info *i) 636 | { 637 | audit_msg(s, "Finish: %s", current_time()); 638 | } 639 | 640 | int process_file(f_state *s) 641 | { 642 | 643 | //printf("processing file\n"); 644 | f_info *i = (f_info *)malloc(sizeof(f_info)); 645 | char temp[PATH_MAX]; 646 | 647 | if ((realpath(s->input_file, temp)) == NULL) 648 | { 649 | print_error(s, s->input_file, strerror(errno)); 650 | return TRUE; 651 | } 652 | 653 | i->file_name = strdup(s->input_file); 654 | i->is_stdin = FALSE; 655 | audit_start(s, i); 656 | 657 | // printf("opening file %s\n",i->file_name); 658 | #if defined(__LINUX) 659 | #ifdef DEBUG 660 | printf("Using 64 bit fopen\n"); 661 | #endif 662 | i->handle = fopen64(i->file_name, "rb"); 663 | #elif defined(__WIN32) 664 | 665 | /*I would like to be able to read from 666 | * physical devices in Windows, have played 667 | * with different options to fopen and the 668 | * dd src says you need write access on WinXP 669 | * but nothing seems to work*/ 670 | i->handle = fopen(i->file_name, "rb"); 671 | #else 672 | i->handle = fopen(i->file_name, "rb"); 673 | #endif 674 | if (i->handle == NULL) 675 | { 676 | print_error(s, s->input_file, strerror(errno)); 677 | audit_msg(s, "Error: %s", strerror(errno)); 678 | return TRUE; 679 | } 680 | 681 | i->total_bytes = find_file_size(i->handle); 682 | search_stream(s, i); 683 | audit_finish(s, i); 684 | 685 | fclose(i->handle); 686 | free(i); 687 | return FALSE; 688 | } 689 | 690 | int process_stdin(f_state *s) 691 | { 692 | f_info *i = (f_info *)malloc(sizeof(f_info)); 693 | 694 | i->file_name = strdup("stdin"); 695 | s->input_file = "stdin"; 696 | i->handle = stdin; 697 | i->is_stdin = TRUE; 698 | 699 | /* We can't compute the size of this stream, we just ignore it*/ 700 | i->total_bytes = 0; 701 | audit_start(s, i); 702 | 703 | search_stream(s, i); 704 | 705 | free(i->file_name); 706 | free(i); 707 | return FALSE; 708 | } 709 | -------------------------------------------------------------------------------- /foremost-1.5.7/extract.c: -------------------------------------------------------------------------------- 1 | 2 | /* extract.c 3 | * Copyright (c) 2005, Nick Mikus 4 | * This file contains the file specific functions used to extract 5 | * data from an image. 6 | * 7 | * Each has a similar structure 8 | * f_state *s: state of the program. 9 | * c_offset: offset that the header was recorded within the current chunk 10 | * foundat: The location the header was "foundat" 11 | * buflen: How much buffer is left until the end of the current chunk 12 | * needle: Search specification 13 | * f_offset: Offset that the current chunk is located within the file 14 | */ 15 | 16 | #include "main.h" 17 | #include "extract.h" 18 | #include "ole.h" 19 | extern unsigned char buffer[OUR_BLK_SIZE]; 20 | extern int verbose; 21 | extern int dir_count; 22 | extern int block_list[OUR_BLK_SIZE / sizeof(int)]; 23 | extern int *FAT; 24 | extern char *extract_name; 25 | extern int extract; 26 | extern int FATblk; 27 | extern int highblk; 28 | 29 | /******************************************************************************** 30 | *Function: extract_zip 31 | *Description: Given that we have a ZIP header jump through the file headers 32 | until we reach the EOF. 33 | *Return: A pointer to where the EOF of the ZIP is in the current buffer 34 | **********************************************************************************/ 35 | unsigned char *extract_zip(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 36 | s_spec *needle, u_int64_t f_offset, char *type) 37 | { 38 | unsigned char *currentpos = NULL; 39 | unsigned char *buf = foundat; 40 | unsigned short comment_length = 0; 41 | unsigned char *extractbuf = NULL; 42 | struct zipLocalFileHeader localFH; 43 | u_int64_t bytes_to_search = 50 * KILOBYTE; 44 | u_int64_t file_size = 0; 45 | int oOffice = FALSE; 46 | int office2007 = FALSE; 47 | 48 | char comment[32]; 49 | localFH.genFlag=0; 50 | localFH.compressed=0; 51 | localFH.uncompressed =0; 52 | if (buflen < 100) 53 | return NULL; 54 | 55 | if (strncmp((char *) &foundat[30], "mimetypeapplication/vnd.sun.xml.", 32) == 0) 56 | { 57 | oOffice = TRUE; 58 | if (strncmp((char *) &foundat[62], "calc", 4) == 0) 59 | { 60 | needle->suffix = "sxc"; 61 | } 62 | else if (strncmp((char *) &foundat[62], "impress", 7) == 0) 63 | { 64 | needle->suffix = "sxi"; 65 | } 66 | else if (strncmp((char *) &foundat[62], "writer", 6) == 0) 67 | { 68 | needle->suffix = "sxw"; 69 | } 70 | else 71 | { 72 | sprintf(comment, " (OpenOffice Doc?)"); 73 | strcat(needle->comment, comment); 74 | needle->suffix = "sx"; 75 | } 76 | } 77 | else 78 | { 79 | needle->suffix = "zip"; 80 | } 81 | 82 | 83 | while (1) //Jump through each local file header until the central directory structure is reached, much faster than searching 84 | { 85 | 86 | if (foundat[2] == '\x03' && foundat[3] == '\x04') //Verfiy we are looking at a local file header// 87 | { 88 | 89 | localFH.compression=htos(&foundat[8], FOREMOST_LITTLE_ENDIAN); 90 | localFH.compressed = htoi(&foundat[18], FOREMOST_LITTLE_ENDIAN); 91 | localFH.uncompressed = htoi(&foundat[22], FOREMOST_LITTLE_ENDIAN); 92 | localFH.filename_length = htos(&foundat[26], FOREMOST_LITTLE_ENDIAN); 93 | localFH.extra_length = htos(&foundat[28], FOREMOST_LITTLE_ENDIAN);; 94 | localFH.genFlag = htos(&foundat[6], FOREMOST_LITTLE_ENDIAN); 95 | 96 | // Sanity checking 97 | if (localFH.compressed > needle->max_len) 98 | return foundat + needle->header_len; 99 | 100 | if (localFH.filename_length > 100) 101 | return foundat + needle->header_len; 102 | 103 | //Check if we should grab more from the disk 104 | if (localFH.compressed + 30 > buflen - (foundat - buf)) 105 | { 106 | return NULL; 107 | } 108 | 109 | //Size of the local file header data structure 110 | foundat += 30; 111 | 112 | if (strcmp(needle->suffix,"zip")==0) 113 | { 114 | if (strncmp((char *)foundat, "content.xml", 11) == 0 && strcmp(needle->suffix,"zip")==0) 115 | { 116 | oOffice = TRUE; 117 | sprintf(comment, " (OpenOffice Doc?)"); 118 | strcat(needle->comment, comment); 119 | needle->suffix = "sx"; 120 | } 121 | else if (strstr((char *)foundat, ".class") || strstr((char *)foundat, ".jar") || 122 | strstr((char *)foundat, ".java")) 123 | { 124 | needle->suffix = "jar"; 125 | } 126 | else if(strncmp((char *)foundat, "[Content_Types].xml",19)==0) 127 | { 128 | office2007=TRUE; 129 | } 130 | else if(strncmp((char *)foundat, "ppt/slides",10)==0 && office2007==TRUE) 131 | { 132 | needle->suffix = "pptx"; 133 | } 134 | else if(strncmp((char *)foundat, "word/document.xml",17)==0 && office2007==TRUE) 135 | { 136 | needle->suffix = "docx"; 137 | } 138 | else if(strncmp((char *)foundat, "xl/workbook.xml",15)==0 && office2007==TRUE) 139 | { 140 | needle->suffix = "xlsx"; 141 | } 142 | 143 | 144 | else 145 | { 146 | printf("foundat=%s\n",foundat); 147 | } 148 | } 149 | 150 | foundat += localFH.compressed; 151 | foundat += localFH.filename_length; 152 | foundat += localFH.extra_length; 153 | 154 | if (localFH.genFlag == 8) 155 | { 156 | #ifdef DEBUG 157 | fprintf(stderr,"We have extra stuff!!!"); 158 | #endif 159 | } 160 | 161 | 162 | if(localFH.genFlag & 1<<3 && localFH.uncompressed==0 && localFH.compressed==0 ) 163 | { 164 | #ifdef DEBUG 165 | fprintf(stderr,"No data to jmp Just search for the next file Footer (localFH.genFlag:=%d)\n",localFH.genFlag); 166 | #endif 167 | break; 168 | } 169 | 170 | #ifdef DEBUG 171 | printf("localFH.compressed:=%d localFH.uncompressed:=%d\n\t jumping %d bytes filename=%d bytes", 172 | localFH.compressed, 173 | localFH.uncompressed,localFH.filename_length+localFH.compressed+localFH.extra_length,localFH.filename_length); 174 | printx(foundat, 0, 16); 175 | #endif 176 | 177 | } 178 | else if (oOffice && localFH.genFlag == 8) 179 | { 180 | break; 181 | } 182 | else 183 | { 184 | break; 185 | } 186 | 187 | 188 | }//end while loop 189 | 190 | if (oOffice) 191 | { 192 | 193 | //We have an OO doc how long should we search for? 194 | bytes_to_search = 1 * MEGABYTE; 195 | } 196 | else if (localFH.genFlag & 1<<3 && localFH.uncompressed==0 && localFH.compressed==0 ) 197 | { 198 | bytes_to_search = needle->max_len; 199 | } 200 | else 201 | { 202 | bytes_to_search = (buflen < (foundat - buf) ? buflen : buflen - (foundat - buf)); 203 | } 204 | 205 | //Make sure we are not searching more than what he have 206 | if (buflen <= (foundat - buf)) { 207 | #ifdef DEBUG 208 | printf("avoided bug in extract_zip!\n"); 209 | #endif 210 | bytes_to_search = 0; 211 | } else { 212 | if (buflen - (foundat - buf) < bytes_to_search) 213 | { 214 | bytes_to_search = buflen - (foundat - buf); 215 | } 216 | } 217 | 218 | 219 | currentpos = foundat; 220 | #ifdef DEBUG 221 | printf("Search for the footer bytes_to_search:=%lld buflen:=%lld\n", bytes_to_search, buflen); 222 | #endif 223 | 224 | foundat = bm_search(needle->footer, 225 | needle->footer_len, 226 | foundat, 227 | bytes_to_search, 228 | needle->footer_bm_table, 229 | needle->case_sen, 230 | SEARCHTYPE_FORWARD); 231 | #ifdef DEBUG 232 | printf("Search complete \n"); 233 | #endif 234 | 235 | if (foundat) /*Found the end of the central directory structure, determine the exact length and extract*/ 236 | { 237 | 238 | /*Jump to the comment length field*/ 239 | #ifdef DEBUG 240 | printf("distance searched:=%lu\n", foundat - currentpos); 241 | #endif 242 | if (buflen - (foundat - buf) > 20) 243 | { 244 | foundat += 20; 245 | } 246 | else 247 | { 248 | return NULL; 249 | } 250 | 251 | comment_length = htos(foundat, FOREMOST_LITTLE_ENDIAN); 252 | foundat += comment_length + 2; 253 | file_size = (foundat - buf); 254 | #ifdef DEBUG 255 | printf("File size %lld\n", file_size); 256 | printf("Found a %s type:=%s\n", needle->suffix, type); 257 | #endif 258 | extractbuf = buf; 259 | if (strcmp(type,"all")==0 || strcmp(type,needle->suffix)==0) 260 | { 261 | #ifdef DEBUG 262 | printf("Writing a %s to disk\n", needle->suffix); 263 | #endif 264 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 265 | } 266 | 267 | #ifdef DEBUG 268 | printf("Found a %s\n", needle->suffix); 269 | #endif 270 | return foundat-2; 271 | } 272 | 273 | if (bytes_to_search > buflen - (currentpos - buf)) 274 | return NULL; 275 | 276 | #ifdef DEBUG 277 | printf("I give up \n"); 278 | #endif 279 | return currentpos; 280 | } 281 | 282 | /******************************************************************************** 283 | *Function: extract_pdf 284 | *Description: Given that we have a PDF header check if it is Linearized, if so 285 | grab the file size and we are done, else search for the %%EOF 286 | *Return: A pointer to where the EOF of the PDF is in the current buffer 287 | **********************************************************************************/ 288 | unsigned char *extract_pdf(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 289 | s_spec *needle, u_int64_t f_offset) 290 | { 291 | unsigned char *currentpos = NULL; 292 | unsigned char *buf = foundat; 293 | unsigned char *extractbuf = NULL; 294 | unsigned char *tempsize; 295 | unsigned long int size = 0; 296 | int file_size = 0; 297 | unsigned char *header = foundat; 298 | int bytes_to_search = 0; 299 | char comment[32]; 300 | 301 | foundat += needle->header_len; /* Jump Past the %PDF HEADER */ 302 | currentpos = foundat; 303 | 304 | #ifdef DEBUG 305 | printf("PDF SEARCH\n"); 306 | #endif 307 | 308 | /*Determine when we have searched enough*/ 309 | if (buflen >= needle->max_len) 310 | { 311 | bytes_to_search = needle->max_len; 312 | } 313 | else 314 | { 315 | bytes_to_search = buflen; 316 | } 317 | 318 | /*Check if the buffer is less than 100 bytes, if so search what we have*/ 319 | if (buflen < 512) 320 | return NULL; 321 | else 322 | { 323 | currentpos = foundat; 324 | 325 | /*Check for .obj in the first 100 bytes*/ 326 | foundat = bm_search(needle->markerlist[1].value, 327 | needle->markerlist[1].len, 328 | foundat, 329 | 100, 330 | needle->markerlist[1].marker_bm_table, 331 | needle->case_sen, 332 | SEARCHTYPE_FORWARD); 333 | 334 | if (!foundat) 335 | { 336 | #ifdef DEBUG 337 | printf("no obj found\n"); 338 | #endif 339 | return currentpos + 100; 340 | } 341 | 342 | foundat = currentpos; 343 | 344 | /*Search for "./L " to see if the file is linearized*/ 345 | foundat = bm_search(needle->markerlist[2].value, 346 | needle->markerlist[2].len, 347 | foundat, 348 | 512, 349 | needle->markerlist[2].marker_bm_table, 350 | needle->case_sen, 351 | SEARCHTYPE_FORWARD); 352 | 353 | if (foundat) 354 | { 355 | foundat = bm_search(needle->markerlist[0].value, 356 | needle->markerlist[0].len, 357 | foundat, 358 | 512, 359 | needle->markerlist[0].marker_bm_table, 360 | needle->case_sen, 361 | SEARCHTYPE_FORWARD); 362 | } 363 | else 364 | { 365 | #ifdef DEBUG 366 | printf("not linearized\n"); 367 | #endif 368 | } 369 | } 370 | 371 | if (foundat) /*The PDF is linearized extract the size and we are done*/ 372 | { 373 | sprintf(comment, " (PDF is Linearized)"); 374 | strcat(needle->comment, comment); 375 | 376 | foundat += needle->markerlist[0].len; 377 | tempsize = (unsigned char *)malloc(8 * sizeof(char)); 378 | tempsize = memcpy(tempsize, foundat, 8); 379 | size = atoi((char *)tempsize); 380 | 381 | free(tempsize); 382 | if (size <= 0) 383 | return foundat; 384 | if (size > buflen) 385 | { 386 | if (size > needle->max_len) 387 | return foundat; 388 | else 389 | return NULL; 390 | } 391 | 392 | header += size; 393 | foundat = header; 394 | foundat -= needle->footer_len; 395 | 396 | /*Jump back 10 bytes and see if we actually have and EOF there*/ 397 | foundat -= 10; 398 | currentpos = foundat; 399 | foundat = bm_search(needle->footer, 400 | needle->footer_len, 401 | foundat, 402 | needle->footer_len + 9, 403 | needle->footer_bm_table, 404 | needle->case_sen, 405 | SEARCHTYPE_FORWARD); 406 | if (foundat) /*There is an valid EOF at the end, Write to disk*/ 407 | { 408 | foundat += needle->footer_len + 1; 409 | file_size = (foundat - buf); 410 | 411 | extractbuf = buf; 412 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 413 | 414 | return foundat; 415 | } 416 | 417 | return NULL; 418 | 419 | } 420 | else /*Search for Linearized PDF failed, just look for %%EOF */ 421 | { 422 | #ifdef DEBUG 423 | printf(" Linearized search failed, searching %d bytes, buflen:=%lld\n", 424 | bytes_to_search, 425 | buflen - (header - buf)); 426 | #endif 427 | foundat = currentpos; 428 | foundat = bm_search(needle->footer, 429 | needle->footer_len, 430 | foundat, 431 | bytes_to_search, 432 | needle->footer_bm_table, 433 | needle->case_sen, 434 | SEARCHTYPE_FORWARD); 435 | 436 | if (foundat) /*Write the non-linearized PDF to disk*/ 437 | { 438 | foundat += needle->footer_len + 1; 439 | file_size = (foundat - buf); 440 | extractbuf = buf; 441 | 442 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 443 | 444 | return foundat; 445 | 446 | } 447 | 448 | return NULL; 449 | } 450 | 451 | } 452 | 453 | /******************************************************************************** 454 | *Function: extract_cpp 455 | *Description: Use keywords to attempt to find C/C++ source code 456 | *Return: A pointer to where the EOF of the CPP file is in the current buffer 457 | **********************************************************************************/ 458 | unsigned char *extract_cpp(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 459 | s_spec *needle, u_int64_t f_offset) 460 | { 461 | 462 | unsigned char *header = foundat; 463 | unsigned char *buf = foundat; 464 | unsigned char *extractbuf = NULL; 465 | int end = 0; 466 | int start = 0; 467 | int i = 0; 468 | int marker_score = 0; 469 | int ok = FALSE; 470 | int file_size = 0; 471 | unsigned char *footer = NULL; 472 | 473 | /*Search for a " or a < within 20 bytes of a #include statement*/ 474 | for (i = 0; i < 20; i++) 475 | { 476 | if (foundat[i] == '\x22' || foundat[i] == '\x3C') 477 | { 478 | ok = TRUE; 479 | } 480 | } 481 | 482 | if (!ok) 483 | return foundat + needle->header_len; 484 | 485 | /*Keep running through the buffer until an non printable character is reached*/ 486 | while (isprint(foundat[end]) || foundat[end] == '\x0a' || foundat[end] == '\x09') 487 | { 488 | end++; 489 | } 490 | 491 | foundat += end - 1; 492 | footer = foundat; 493 | 494 | if (end < 50) 495 | return foundat; 496 | 497 | /*Now lets go the other way and grab all those comments at the begining of the file*/ 498 | while (isprint(buf[start]) || buf[start] == '\x0a' || buf[start] == '\x09') 499 | { 500 | start--; 501 | } 502 | 503 | header = &buf[start + 1]; 504 | file_size = (footer - header); 505 | 506 | foundat = header; 507 | 508 | /*Now we have an ascii file to look for keywords in*/ 509 | foundat = bm_search(needle->footer, 510 | needle->footer_len, 511 | header, 512 | file_size, 513 | needle->footer_bm_table, 514 | FALSE, 515 | SEARCHTYPE_FORWARD); 516 | if (foundat) 517 | marker_score += 1; 518 | 519 | foundat = header; 520 | foundat = bm_search(needle->markerlist[0].value, 521 | needle->markerlist[0].len, 522 | header, 523 | file_size, 524 | needle->markerlist[0].marker_bm_table, 525 | 1, 526 | SEARCHTYPE_FORWARD); 527 | if (foundat) 528 | marker_score += 1; 529 | 530 | if (marker_score == 0) 531 | return foundat; 532 | 533 | if (foundat) 534 | { 535 | extractbuf = buf; 536 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset + start + 1); 537 | 538 | return footer; 539 | 540 | } 541 | 542 | return NULL; 543 | } 544 | 545 | /******************************************************************************** 546 | *Function: extract_htm 547 | *Description: Given that we have a HTM header 548 | search for the file EOF and check that the bytes areound the header are ascii 549 | *Return: A pointer to where the EOF of the HTM is in the current buffer 550 | **********************************************************************************/ 551 | unsigned char *extract_htm(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 552 | s_spec *needle, u_int64_t f_offset) 553 | { 554 | unsigned char *buf = foundat; 555 | unsigned char *extractbuf = NULL; 556 | unsigned char *currentpos = NULL; 557 | 558 | int bytes_to_search = 0; 559 | int i = 0; 560 | int file_size = 0; 561 | 562 | /*Jump past the header_len; 564 | 565 | /*Check the first 16 bytes to see if they are ASCII*/ 566 | for (i = 0; i < 16; i++) 567 | { 568 | if (!isprint(foundat[i]) && foundat[i] != '\x0a' && foundat[i] != '\x09') 569 | { 570 | return foundat + 16; 571 | } 572 | } 573 | 574 | /*Determine if the buffer is large enough to encompass a reasonable search*/ 575 | if (buflen < needle->max_len) 576 | { 577 | bytes_to_search = buflen - (foundat - buf); 578 | } 579 | else 580 | { 581 | bytes_to_search = needle->max_len; 582 | } 583 | 584 | /*Store the current position and search for the HTML> tag*/ 585 | currentpos = foundat; 586 | foundat = bm_search(needle->footer, 587 | needle->footer_len, 588 | foundat, 589 | bytes_to_search, 590 | needle->footer_bm_table, 591 | needle->case_sen, 592 | SEARCHTYPE_FORWARD); 593 | if (foundat) //Found the footer, write to disk 594 | { 595 | file_size = (foundat - buf) + needle->footer_len; 596 | extractbuf = buf; 597 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 598 | foundat += needle->footer_len; 599 | return foundat; 600 | 601 | } 602 | else 603 | { 604 | return NULL; 605 | } 606 | 607 | } 608 | 609 | /******************************************************************************** 610 | *Function: validOLEheader 611 | *Description: run various tests aginst an OLE-HEADER to determine whether or not 612 | it is valid. 613 | *Return: TRUE/FALSE 614 | **********************************************************************************/ 615 | int valid_ole_header(struct OLE_HDR *h) 616 | { 617 | 618 | if (htos((unsigned char *) &h->reserved, FOREMOST_LITTLE_ENDIAN) != 0 || 619 | htoi((unsigned char *) &h->reserved1, FOREMOST_LITTLE_ENDIAN) != 0 || 620 | htoi((unsigned char *) &h->reserved2, FOREMOST_LITTLE_ENDIAN) != 0) 621 | { 622 | return FALSE; 623 | } 624 | 625 | /*The minimum sector shift is usually 2^6(64) and the uSectorShift is 2^9(512))*/ 626 | if (htos((unsigned char *) &h->uMiniSectorShift, FOREMOST_LITTLE_ENDIAN) != 6 || 627 | htos((unsigned char *) &h->uSectorShift, FOREMOST_LITTLE_ENDIAN) != 9 || 628 | htoi((unsigned char *) &h->dir_flag, FOREMOST_LITTLE_ENDIAN) < 0) 629 | { 630 | return FALSE; 631 | } 632 | 633 | /*Sanity Checking*/ 634 | if (htoi((unsigned char *) &h->num_FAT_blocks, FOREMOST_LITTLE_ENDIAN) <= 0 || 635 | htoi((unsigned char *) &h->num_FAT_blocks, FOREMOST_LITTLE_ENDIAN) > 100) 636 | { 637 | return FALSE; 638 | } 639 | 640 | if (htoi((unsigned char *) &h->num_extra_FAT_blocks, FOREMOST_LITTLE_ENDIAN) < 0 || 641 | htoi((unsigned char *) &h->num_extra_FAT_blocks, FOREMOST_LITTLE_ENDIAN) > 100) 642 | { 643 | return FALSE; 644 | } 645 | 646 | return TRUE; 647 | 648 | } 649 | 650 | /******************************************************************************** 651 | *Function:checkOleName 652 | *Description: Determine what type of file is stored in the OLE format based on the 653 | names of DIRENT in the FAT table. 654 | *Return: A char* consisting of the suffix of the appropriate file. 655 | **********************************************************************************/ 656 | char *check_ole_name(char *name) 657 | { 658 | if (strstr(name, "WordDocument")) 659 | { 660 | return "doc"; 661 | } 662 | else if (strstr(name, "Worksheet") || strstr(name, "Book") || strstr(name, "Workbook")) 663 | { 664 | return "xls"; 665 | } 666 | else if (strstr(name, "Power")) 667 | { 668 | return "ppt"; 669 | } 670 | else if (strstr(name, "Access") || strstr(name, "AccessObjSiteData")) 671 | { 672 | return "mbd"; 673 | } 674 | else if (strstr(name, "Visio")) 675 | { 676 | return "vis"; 677 | } 678 | else if (strstr(name, "Sfx")) 679 | { 680 | return "sdw"; 681 | } 682 | else 683 | { 684 | return NULL; 685 | } 686 | 687 | return NULL; 688 | 689 | } 690 | 691 | int adjust_bs(int size, int bs) 692 | { 693 | int rem = (size % bs); 694 | 695 | if (rem == 0) 696 | { 697 | 698 | return size; 699 | } 700 | 701 | #ifdef DEBUG 702 | printf("\tnew size:=%d\n", size + (bs - rem)); 703 | #endif 704 | return (size + (bs - rem)); 705 | 706 | } 707 | 708 | /******************************************************************************** 709 | *Function: extract_ole 710 | *Description: Given that we have a OLE header, jump through the OLE structure and 711 | determine what type of file it is. 712 | *Return: A pointer to where the EOF of the OLE is in the current buffer 713 | **********************************************************************************/ 714 | unsigned char *extract_ole(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 715 | s_spec *needle, u_int64_t f_offset, char *type) 716 | { 717 | unsigned char *buf = foundat; 718 | unsigned char *extractbuf = NULL; 719 | char *temp = NULL; 720 | char *suffix = "ole"; 721 | int totalsize = 0; 722 | int extrasize = 0; 723 | int oldblk = 0; 724 | int i, j; 725 | int size = 0; 726 | int blknum = 0; 727 | int validblk = 512; 728 | int file_size = 0; 729 | int num_extra_FAT_blocks = 0; 730 | unsigned char *htoi_c = NULL; 731 | int extra_dir_blocks = 0; 732 | int num_FAT_blocks = 0; 733 | int next_FAT_block = 0; 734 | unsigned char *p; 735 | int fib = 1024; 736 | struct OLE_HDR *h = NULL; 737 | 738 | int result = 0; 739 | int highblock = 0; 740 | unsigned long miniSectorCutoff = 0; 741 | unsigned long csectMiniFat = 0; 742 | 743 | /*Deal with globals defined in the OLE API, ugly*/ 744 | if (dirlist != NULL) 745 | free(dirlist); 746 | if (FAT != NULL) 747 | free(FAT); 748 | init_ole(); 749 | 750 | if (buflen < validblk) 751 | validblk = buflen; 752 | h = (struct OLE_HDR *)foundat; /*cast the header block to point at foundat*/ 753 | #ifdef DEBUG 754 | dump_header(h); 755 | #endif 756 | num_FAT_blocks = htoi((unsigned char *) &h->num_FAT_blocks, FOREMOST_LITTLE_ENDIAN); 757 | 758 | if (!valid_ole_header(h)) 759 | return (buf + validblk); 760 | 761 | miniSectorCutoff = htoi((unsigned char *) &h->miniSectorCutoff, FOREMOST_LITTLE_ENDIAN); 762 | csectMiniFat = htoi((unsigned char *) &h->csectMiniFat, FOREMOST_LITTLE_ENDIAN); 763 | next_FAT_block = htoi((unsigned char *) &h->FAT_next_block, FOREMOST_LITTLE_ENDIAN); 764 | num_extra_FAT_blocks = htoi((unsigned char *) &h->num_extra_FAT_blocks, FOREMOST_LITTLE_ENDIAN); 765 | 766 | FAT = (int *)Malloc(OUR_BLK_SIZE * (num_FAT_blocks + 1)); 767 | p = (unsigned char *)FAT; 768 | memcpy(p, &h[1], OUR_BLK_SIZE - FAT_START); 769 | if (next_FAT_block > 0) 770 | { 771 | p += (OUR_BLK_SIZE - FAT_START); 772 | blknum = next_FAT_block; 773 | for (i = 0; i < num_extra_FAT_blocks; i++) 774 | { 775 | if (!get_block(buf, blknum, p, buflen)) 776 | return buf + validblk; 777 | validblk = (blknum + 1) * OUR_BLK_SIZE; 778 | p += OUR_BLK_SIZE - sizeof(int); 779 | blknum = htoi(p, FOREMOST_LITTLE_ENDIAN); 780 | } 781 | } 782 | 783 | blknum = htoi((unsigned char *) &h->root_start_block, FOREMOST_LITTLE_ENDIAN); 784 | 785 | if(blknum < 0) 786 | { 787 | return buf + 10; 788 | } 789 | 790 | highblock = htoi((unsigned char *) &h->dir_flag, FOREMOST_LITTLE_ENDIAN); 791 | #ifdef DEBUG 792 | printf("getting dir block\n"); 793 | #endif 794 | 795 | //if(!get_dir_block (buf, blknum, buflen)) return buf+validblk; 796 | if (!get_block(buf, blknum, buffer, buflen)) 797 | return buf + validblk; /*GET DIR BLOCK*/ 798 | #ifdef DEBUG 799 | printf("done getting dir block\n"); 800 | #endif 801 | validblk = (blknum + 1) * OUR_BLK_SIZE; 802 | while (blknum != END_OF_CHAIN) 803 | { 804 | #ifdef DEBUG 805 | printf("finding dir info extra_dir_blks:=%d\n", extra_dir_blocks); 806 | #endif 807 | if (extra_dir_blocks > 300) 808 | return buf + validblk; 809 | 810 | /**PROBLEMA**/ 811 | #ifdef DEBUG 812 | printf("***blknum:=%d FATblk:=%d ourblksize=%d\n", blknum, FATblk,OUR_BLK_SIZE); 813 | #endif 814 | oldblk = blknum; 815 | htoi_c = (unsigned char *) &FAT[blknum / (OUR_BLK_SIZE / sizeof(int))]; 816 | 817 | FATblk = htoi(htoi_c, FOREMOST_LITTLE_ENDIAN); 818 | #ifdef DEBUG 819 | printf("***blknum:=%d FATblk:=%d\n", blknum, FATblk); 820 | #endif 821 | 822 | if (!get_FAT_block(buf, blknum, block_list, buflen)) 823 | return buf + validblk; 824 | blknum = htoi((unsigned char *) &block_list[blknum % 128], FOREMOST_LITTLE_ENDIAN); 825 | #ifdef DEBUG 826 | printf("**blknum:=%d FATblk:=%d\n", blknum, FATblk); 827 | #endif 828 | if (blknum == END_OF_CHAIN || oldblk == blknum) 829 | { 830 | #ifdef DEBUG 831 | printf("EOC\n"); 832 | #endif 833 | break; 834 | } 835 | 836 | extra_dir_blocks++; 837 | result = get_dir_block(buf, blknum, buflen); 838 | if (result == SHORT_BLOCK) 839 | { 840 | #ifdef DEBUG 841 | printf("SHORT BLK\n"); 842 | #endif 843 | break; 844 | } 845 | else if (!result) 846 | return buf + validblk; 847 | 848 | } 849 | 850 | #ifdef DEBUG 851 | printf("DONE WITH WHILE\n"); 852 | #endif 853 | blknum = htoi((unsigned char *) &h->root_start_block, FOREMOST_LITTLE_ENDIAN); 854 | size = OUR_BLK_SIZE * (extra_dir_blocks + 1); 855 | dirlist = (struct DIRECTORY *)Malloc(size); 856 | memset(dirlist, 0, size); 857 | 858 | if (!get_block(buf, blknum, buffer, buflen)) 859 | return buf + validblk; /*GET DIR BLOCK*/ 860 | 861 | if (!get_dir_info(buffer)) 862 | { 863 | return foundat + validblk; 864 | } 865 | 866 | for (i = 0; i < extra_dir_blocks; i++) 867 | { 868 | if (!get_FAT_block(buf, blknum, block_list, buflen)) 869 | return buf + validblk; 870 | blknum = htoi((unsigned char *) &block_list[blknum % 128], FOREMOST_LITTLE_ENDIAN); 871 | if (blknum == END_OF_CHAIN) 872 | break; 873 | #ifdef DEBUG 874 | printf("getting dir blk blknum=%d\n", blknum); 875 | #endif 876 | if (!get_block(buf, blknum, buffer, buflen)) 877 | return buf + validblk; /*GET DIR BLOCK*/ 878 | if (!get_dir_info(buffer)) 879 | { 880 | return buf + validblk; 881 | } 882 | } 883 | 884 | #ifdef DEBUG 885 | printf("dir count is %d\n", i); 886 | #endif 887 | for (dl = dirlist, i = 0; i < dir_count; i++, dl++) 888 | { 889 | memset(buffer, ' ', 75); 890 | j = htoi((unsigned char *) &dl->level, FOREMOST_LITTLE_ENDIAN) * 4; 891 | sprintf((char *) &buffer[j], "%-s", dl->name); 892 | j = strlen((char *)buffer); 893 | 894 | if (dl->name[0] == '@') 895 | return foundat + validblk; 896 | if (dl->type == STREAM) 897 | { 898 | buffer[j] = ' '; 899 | sprintf((char *) &buffer[60], "%8d\n", dl->size); 900 | 901 | if (temp == NULL) /*check if we have alread defined the type*/ 902 | { 903 | temp = check_ole_name(dl->name); 904 | if (temp) 905 | suffix = temp; 906 | } 907 | 908 | if (dl->size > miniSectorCutoff) 909 | { 910 | totalsize += adjust_bs(dl->size, 512); 911 | } 912 | else 913 | { 914 | totalsize += adjust_bs(dl->size, 64); 915 | } 916 | 917 | #ifdef DEBUG 918 | fprintf(stdout, buffer); 919 | #endif 920 | } 921 | else 922 | { 923 | sprintf((char *) &buffer[j], "\n"); 924 | #ifdef DEBUG 925 | printf("\tnot stream data \n"); 926 | fprintf(stdout, buffer); 927 | #endif 928 | 929 | extrasize += adjust_bs(dl->size, 512); 930 | 931 | } 932 | } 933 | 934 | totalsize += fib; 935 | #ifdef DEBUG 936 | printf("DIR SIZE:=%d, numFATblks:=%d MiniFat:=%d\n", 937 | adjust_bs(((dir_count) * 128), 512), 938 | (num_FAT_blocks * 512), 939 | adjust_bs((64 * csectMiniFat), 512)); 940 | #endif 941 | totalsize += adjust_bs(((dir_count) * 128), 512); 942 | totalsize += (num_FAT_blocks * 512); 943 | totalsize += adjust_bs((64 * csectMiniFat), 512); 944 | if ((highblk + 5) > highblock && highblk > 0) 945 | { 946 | highblock = highblk + 5; 947 | } 948 | 949 | highblock = highblock * 512; 950 | 951 | #ifdef DEBUG 952 | printf("\t highblock:=%d\n", highblock); 953 | #endif 954 | if (highblock > totalsize) 955 | { 956 | #ifdef DEBUG 957 | printf(" Total size:=%d a difference of %lld\n", totalsize, buflen - totalsize); 958 | printf(" Extra size:=%d \n", extrasize); 959 | printf(" Highblock is greater than totalsize\n"); 960 | #endif 961 | totalsize = highblock; 962 | } 963 | 964 | totalsize = adjust_bs(totalsize, 512); 965 | #ifdef DEBUG 966 | printf(" Total size:=%d a difference of %lld\n", totalsize, buflen - totalsize); 967 | printf(" Extra size:=%d \n", extrasize); 968 | #endif 969 | 970 | if (buflen < totalsize) 971 | { 972 | #ifdef DEBUG 973 | printf(" ***Error not enough left in the buffer left:=%lld needed=%d***\n", 974 | buflen, 975 | totalsize); 976 | #endif 977 | totalsize = buflen; 978 | } 979 | 980 | foundat = buf; 981 | highblock -= 5 * 512; 982 | if (highblock > 0 && highblock < buflen) 983 | { 984 | foundat += highblock; 985 | } 986 | else 987 | { 988 | foundat += totalsize; 989 | } 990 | 991 | /*Return to the highest blknum read in the file, that way we don't miss files that are close*/ 992 | file_size = totalsize; 993 | extractbuf = buf; 994 | 995 | if (suffix) 996 | needle->suffix = suffix; 997 | 998 | if (!strstr(needle->suffix, type) && strcmp(type,"all")!=0) 999 | { 1000 | return foundat; 1001 | } 1002 | 1003 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1004 | return foundat; 1005 | 1006 | } 1007 | 1008 | //********************************************************************************/ 1009 | int check_mov(unsigned char *atom) 1010 | { 1011 | #ifdef DEBUG 1012 | printf("Atom:= %c%c%c%c\n", atom[0], atom[1], atom[2], atom[3]); 1013 | #endif 1014 | if (strncmp((char *)atom, "free", 4) == 0 || strncmp((char *)atom, "mdat", 4) == 0 || 1015 | strncmp((char *)atom, "free", 4) == 0 || strncmp((char *)atom, "wide", 4) == 0 || 1016 | strncmp((char *)atom, "PICT", 4) == 0) 1017 | { 1018 | return TRUE; 1019 | } 1020 | 1021 | if (strncmp((char *)atom, "trak", 4) == 0 || strncmp((char *)atom, "mdat", 4) == 0 || 1022 | strncmp((char *)atom, "mp3", 3) == 0 || strncmp((char *)atom, "wide", 4) == 0 || 1023 | strncmp((char *)atom, "moov", 4) == 0) 1024 | { 1025 | return TRUE; 1026 | } 1027 | 1028 | return FALSE; 1029 | } 1030 | 1031 | /******************************************************************************** 1032 | *Function: extract_mov 1033 | *Description: Given that we have a MOV header JUMP through the mov data structures 1034 | until we reach EOF 1035 | *Return: A pointer to where the EOF of the MOV is in the current buffer 1036 | **********************************************************************************/ 1037 | unsigned char *extract_mov(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1038 | s_spec *needle, u_int64_t f_offset) 1039 | { 1040 | unsigned char *buf = foundat - 4; 1041 | unsigned char *extractbuf = NULL; 1042 | unsigned int atomsize = 0; 1043 | unsigned int filesize = 0; 1044 | int mdat = FALSE; 1045 | foundat -= 4; 1046 | buflen += 4; 1047 | while (1) /*Loop through all the atoms until the EOF is reached*/ 1048 | { 1049 | atomsize = htoi(foundat, FOREMOST_BIG_ENDIAN); 1050 | #ifdef DEBUG 1051 | printf("Atomsize:=%d\n", atomsize); 1052 | #endif 1053 | if (atomsize <= 0 || atomsize > needle->max_len) 1054 | { 1055 | return foundat + needle->header_len + 4; 1056 | } 1057 | 1058 | filesize += atomsize; /*Add the atomsize to the total file size*/ 1059 | if (filesize > buflen) 1060 | { 1061 | #ifdef DEBUG 1062 | printf("file size > buflen fs:=%d bf:=%lld\n", filesize, buflen); 1063 | #endif 1064 | if (buflen >= needle->max_len) 1065 | return foundat + needle->header_len + 4; 1066 | else 1067 | { 1068 | return NULL; 1069 | } 1070 | } 1071 | 1072 | foundat += atomsize; 1073 | if (buflen - (foundat - buf) < 5) 1074 | { 1075 | if (mdat) 1076 | { 1077 | break; 1078 | } 1079 | else 1080 | { 1081 | #ifdef DEBUG 1082 | printf("No mdat found"); 1083 | #endif 1084 | return foundat; 1085 | } 1086 | } 1087 | 1088 | /*Check if we have an mdat atom, these are required thus can be used to 1089 | * Weed out corrupted file*/ 1090 | if (strncmp((char *)foundat + 4, "mdat", 4) == 0) 1091 | { 1092 | mdat = TRUE; 1093 | } 1094 | 1095 | if (check_mov(foundat + 4)) /*Check to see if we are at a valid header*/ 1096 | { 1097 | #ifdef DEBUG 1098 | printf("Checkmov succeeded\n"); 1099 | #endif 1100 | } 1101 | else 1102 | { 1103 | #ifdef DEBUG 1104 | printf("Checkmov failed\n"); 1105 | #endif 1106 | if (mdat) 1107 | { 1108 | break; 1109 | } 1110 | else 1111 | { 1112 | #ifdef DEBUG 1113 | printf("No mdat found"); 1114 | #endif 1115 | return foundat; 1116 | 1117 | } 1118 | } 1119 | } //End loop 1120 | 1121 | if (foundat) 1122 | { 1123 | 1124 | filesize = (foundat - buf); 1125 | #ifdef DEBUG 1126 | printf("file size:=%d\n", filesize); 1127 | #endif 1128 | extractbuf = buf; 1129 | write_to_disk(s, needle, filesize, extractbuf, c_offset + f_offset - 4); 1130 | return foundat; 1131 | } 1132 | 1133 | #ifdef DEBUG 1134 | printf("NULL Atomsize:=%d\n", atomsize); 1135 | #endif 1136 | return NULL; 1137 | 1138 | } 1139 | 1140 | /******************************************************************************** 1141 | *Function: extract_wmv 1142 | *Description: Given that we have a WMV header 1143 | search for the file header and grab the file size. 1144 | *Return: A pointer to where the EOF of the WMV is in the current buffer 1145 | **********************************************************************************/ 1146 | unsigned char *extract_wmv(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1147 | s_spec *needle, u_int64_t f_offset) 1148 | { 1149 | 1150 | unsigned char *currentpos = NULL; 1151 | unsigned char *header = foundat; 1152 | unsigned char *extractbuf = NULL; 1153 | unsigned char *buf = foundat; 1154 | unsigned int size = 0; 1155 | u_int64_t file_size = 0; 1156 | u_int64_t headerSize = 0; 1157 | u_int64_t fileObjHeaderSize = 0; 1158 | int numberofHeaderObjects = 0; 1159 | int reserved[2]; 1160 | int bytes_to_search = 0; 1161 | 1162 | /*If we have less than a WMV header bail out*/ 1163 | if (buflen < 70) 1164 | return NULL; 1165 | 1166 | foundat += 16; /*Jump to the header size*/ 1167 | headerSize = htoll(foundat, FOREMOST_LITTLE_ENDIAN); 1168 | //printx(foundat,0,8); 1169 | foundat += 8; 1170 | numberofHeaderObjects = htoi(foundat, FOREMOST_LITTLE_ENDIAN); 1171 | foundat += 4; //Jump to the begin File properties obj 1172 | reserved[0] = foundat[0]; 1173 | reserved[1] = foundat[1]; 1174 | foundat += 2; 1175 | //printf("found WMV\n"); 1176 | //end header obj 1177 | //****************************************************/ 1178 | //Sanity Check 1179 | //printf("WMV num_header_objs=%d headerSize=%llu\n",numberofHeaderObjects,headerSize); 1180 | 1181 | if (headerSize <= 0 || numberofHeaderObjects <= 0 || reserved[0] != 1) 1182 | { 1183 | printf("WMV err num_header_objs=%d headerSize=%llu\n",numberofHeaderObjects,headerSize); 1184 | return foundat; 1185 | } 1186 | 1187 | currentpos = foundat; 1188 | if (buflen - (foundat - buf) >= needle->max_len) 1189 | bytes_to_search = needle->max_len; 1190 | else 1191 | bytes_to_search = buflen - (foundat - buf); 1192 | 1193 | /*Note we are not searching for the footer here, just the file header ID so we can get the file size*/ 1194 | foundat = bm_search(needle->footer, 1195 | needle->footer_len, 1196 | foundat, 1197 | bytes_to_search, 1198 | needle->footer_bm_table, 1199 | needle->case_sen, 1200 | SEARCHTYPE_FORWARD); 1201 | if (foundat) 1202 | { 1203 | foundat += 16; /*jump to the headersize*/ 1204 | fileObjHeaderSize = htoll(foundat, FOREMOST_LITTLE_ENDIAN); 1205 | //printx(foundat,0,8); 1206 | foundat += 24; //Jump to the file size obj 1207 | size = htoi(foundat, FOREMOST_LITTLE_ENDIAN); 1208 | //printx(foundat,0,8); 1209 | 1210 | #ifdef DEBUG 1211 | printf("SIZE:=%u fileObjHeaderSize=%llu\n", size,fileObjHeaderSize); 1212 | #endif 1213 | } 1214 | else 1215 | { 1216 | return NULL; 1217 | } 1218 | 1219 | /*Sanity check data*/ 1220 | if (size > 0 && size <= needle->max_len && size <= buflen) 1221 | { 1222 | header += size; 1223 | #ifdef DEBUG 1224 | printf(" Found a WMV at:=%lld,File size:=%lld\n", c_offset, size); 1225 | printf(" Headersize:=%d, numberofHeaderObjects:= %d ,reserved:=%d,%d\n", 1226 | headerSize, 1227 | numberofHeaderObjects, 1228 | reserved[0], 1229 | reserved[1]); 1230 | #endif 1231 | 1232 | /*Everything seem ok, write to disk*/ 1233 | file_size = (header - buf); 1234 | extractbuf = buf; 1235 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1236 | foundat += file_size; 1237 | return header; 1238 | } 1239 | 1240 | return NULL; 1241 | 1242 | } 1243 | 1244 | /******************************************************************************** 1245 | *Function: extract_riff 1246 | *Description: Given that we have a RIFF header parse header and grab the file size. 1247 | *Return: A pointer to where the EOF of the RIFF is in the current buffer 1248 | **********************************************************************************/ 1249 | unsigned char *extract_riff(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1250 | s_spec *needle, u_int64_t f_offset, char *type) 1251 | { 1252 | unsigned char *buf = foundat; 1253 | unsigned char *extractbuf = NULL; 1254 | int size = 0; 1255 | u_int64_t file_size = 0; 1256 | 1257 | size = htoi(&foundat[4], FOREMOST_LITTLE_ENDIAN); /* Grab the total file size in little endian from offset 4*/ 1258 | if (strncmp((char *) &foundat[8], "AVI", 3) == 0) /*Sanity Check*/ 1259 | { 1260 | if (strncmp((char *) &foundat[12], "LIST", 4) == 0) /*Sanity Check*/ 1261 | { 1262 | if (size > 0 && size <= needle->max_len && size <= buflen) 1263 | { 1264 | #ifdef DEBUG 1265 | printf("\n Found an AVI at:=%lld,File size:=%d\n", c_offset, size); 1266 | #endif 1267 | file_size = size; 1268 | extractbuf = buf; 1269 | needle->suffix = "avi"; 1270 | if (!strstr(needle->suffix, type) && strcmp(type,"all")!=0) 1271 | return foundat + size; 1272 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1273 | foundat += size; 1274 | return foundat; 1275 | } 1276 | 1277 | return buf + needle->header_len; 1278 | 1279 | } 1280 | else 1281 | { 1282 | return buf + needle->header_len; 1283 | } 1284 | } 1285 | else if (strncmp((char *) &foundat[8], "WAVE", 4) == 0) /*Sanity Check*/ 1286 | { 1287 | if (size > 0 && size <= needle->max_len && size <= buflen) 1288 | { 1289 | #ifdef DEBUG 1290 | printf("\n Found a WAVE at:=%lld,File size:=%d\n", c_offset, size); 1291 | #endif 1292 | 1293 | file_size = size; 1294 | extractbuf = buf; 1295 | needle->suffix = "wav"; 1296 | if (!strstr(needle->suffix, type) && strcmp(type,"all")!=0) 1297 | return foundat + size; 1298 | 1299 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1300 | foundat += file_size; 1301 | return foundat; 1302 | } 1303 | 1304 | return buf + needle->header_len; 1305 | 1306 | } 1307 | else 1308 | { 1309 | return buf + needle->header_len; 1310 | } 1311 | 1312 | return NULL; 1313 | 1314 | } 1315 | 1316 | /******************************************************************************** 1317 | *Function: extract_bmp 1318 | *Description: Given that we have a BMP header parse header and grab the file size. 1319 | *Return: A pointer to where the EOF of the BMP is in the current buffer 1320 | **********************************************************************************/ 1321 | unsigned char *extract_bmp(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1322 | s_spec *needle, u_int64_t f_offset) 1323 | { 1324 | unsigned char *buf = foundat; 1325 | int size = 0; 1326 | int headerlength = 0; 1327 | int v_size = 0; 1328 | int h_size = 0; 1329 | unsigned char *extractbuf = NULL; 1330 | u_int64_t file_size = 0; 1331 | char comment[32]; 1332 | int dataOffset = 0; 1333 | int dataSize = 0; 1334 | 1335 | if (buflen < 100) 1336 | return buf + needle->header_len; 1337 | 1338 | /*JUMP the first to bytes of the header (BM)*/ 1339 | size = htoi(&foundat[2], FOREMOST_LITTLE_ENDIAN); /*Grab the total file size in little_endian*/ 1340 | 1341 | /*Sanity Check*/ 1342 | if (size <= 100 || size > needle->max_len) 1343 | return buf + needle->header_len; 1344 | 1345 | dataOffset = htoi(&foundat[10], FOREMOST_LITTLE_ENDIAN); 1346 | dataSize = htoi(&foundat[34], FOREMOST_LITTLE_ENDIAN); 1347 | 1348 | headerlength = htoi(&foundat[14], FOREMOST_LITTLE_ENDIAN); 1349 | 1350 | if (dataSize + dataOffset != size) 1351 | { 1352 | 1353 | //printf("newtest != dataSize:=%d dataOffset:=%d\n",dataSize,dataOffset); 1354 | } 1355 | 1356 | //Header length 1357 | if (headerlength > 1000 || headerlength <= 0) 1358 | return buf + needle->header_len; 1359 | 1360 | //foundat+=4; 1361 | v_size = htoi(&foundat[22], FOREMOST_LITTLE_ENDIAN); 1362 | h_size = htoi(&foundat[18], FOREMOST_LITTLE_ENDIAN); 1363 | 1364 | //Vertical length 1365 | if (v_size <= 0 || v_size > 2000 || h_size <= 0) 1366 | return buf + needle->header_len; 1367 | 1368 | #ifdef DEBUG 1369 | printf("\n The size of the BMP is %d, Header length:=%d , Vertical Size:= %d, dataSize:=%d dataOffset:=%d\n", 1370 | size, 1371 | headerlength, 1372 | v_size, 1373 | dataSize, 1374 | dataOffset); 1375 | #endif 1376 | if (size <= buflen) 1377 | { 1378 | 1379 | sprintf(comment, " (%d x %d)", h_size, v_size); 1380 | strcat(needle->comment, comment); 1381 | 1382 | file_size = size; 1383 | extractbuf = buf; 1384 | 1385 | write_to_disk(s, needle, file_size, extractbuf, (c_offset + f_offset)); 1386 | foundat += file_size; 1387 | return foundat; 1388 | 1389 | } 1390 | 1391 | return NULL; 1392 | } 1393 | 1394 | /******************************************************************************** 1395 | *Function: extract_gif 1396 | *Description: Given that we have a GIF header parse the given buffer to determine 1397 | * where the file ends. 1398 | *Return: A pointer to where the EOF of the GIF is in the current buffer 1399 | **********************************************************************************/ 1400 | unsigned char *extract_gif(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1401 | s_spec *needle, u_int64_t f_offset) 1402 | { 1403 | unsigned char *buf = foundat; 1404 | unsigned char *currentpos = foundat; 1405 | unsigned char *extractbuf = NULL; 1406 | int bytes_to_search = 0; 1407 | unsigned short width = 0; 1408 | unsigned short height = 0; 1409 | u_int64_t file_size = 0; 1410 | char comment[32]; 1411 | foundat += 4; /*Jump the first 4 bytes of the gif header (GIF8)*/ 1412 | 1413 | /*Check if the GIF is type 89a or 87a*/ 1414 | if (strncmp((char *)foundat, "9a", 2) == 0 || strncmp((char *)foundat, "7a", 2) == 0) 1415 | { 1416 | foundat += 2; /*Jump the length of the header*/ 1417 | width = htos(foundat, FOREMOST_LITTLE_ENDIAN); 1418 | height = htos(&foundat[2], FOREMOST_LITTLE_ENDIAN); 1419 | 1420 | sprintf(comment, " (%d x %d)", width, height); 1421 | strcat(needle->comment, comment); 1422 | 1423 | currentpos = foundat; 1424 | if (buflen - (foundat - buf) >= needle->max_len) 1425 | bytes_to_search = needle->max_len; 1426 | else 1427 | bytes_to_search = buflen - (foundat - buf); 1428 | foundat = bm_search(needle->footer, 1429 | needle->footer_len, 1430 | foundat, 1431 | bytes_to_search, 1432 | needle->footer_bm_table, 1433 | needle->case_sen, 1434 | SEARCHTYPE_FORWARD); 1435 | if (foundat) 1436 | { 1437 | 1438 | /*We found the EOF, write the file to disk and return*/ 1439 | #ifdef DEBUG 1440 | printx(foundat, 0, 16); 1441 | #endif 1442 | file_size = (foundat - buf) + needle->footer_len; 1443 | #ifdef DEBUG 1444 | printf("The GIF file size is %llu c_offset:=%llu\n", file_size, c_offset); 1445 | #endif 1446 | extractbuf = buf; 1447 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1448 | foundat += needle->footer_len; 1449 | return foundat; 1450 | } 1451 | 1452 | return NULL; 1453 | 1454 | } 1455 | else /*Invalid GIF header return the current pointer*/ 1456 | { 1457 | return foundat; 1458 | } 1459 | 1460 | } 1461 | 1462 | /******************************************************************************** 1463 | *Function: extract_mpg 1464 | * Not done yet 1465 | **********************************************************************************/ 1466 | unsigned char *extract_mpg(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1467 | s_spec *needle, u_int64_t f_offset) 1468 | { 1469 | unsigned char *buf = foundat; 1470 | unsigned char *currentpos = NULL; 1471 | 1472 | unsigned char *extractbuf = NULL; 1473 | int bytes_to_search = 0; 1474 | unsigned short size = 0; 1475 | u_int64_t file_size = 0; 1476 | 1477 | /* 1478 | size=htos(&foundat[4],FOREMOST_BIG_ENDIAN); 1479 | printf("size:=%d\n",size); 1480 | 1481 | printx(foundat,0,16); 1482 | foundat+=4; 1483 | */ 1484 | int j = 0; 1485 | if (foundat[15] == (unsigned char)'\xBB') 1486 | { 1487 | } 1488 | else 1489 | { 1490 | 1491 | return buf + needle->header_len; 1492 | } 1493 | 1494 | if (buflen <= 2 * KILOBYTE) 1495 | { 1496 | bytes_to_search = buflen; 1497 | } 1498 | else 1499 | { 1500 | bytes_to_search = 2 * KILOBYTE; 1501 | } 1502 | 1503 | while (1) 1504 | { 1505 | j = 0; 1506 | currentpos = foundat; 1507 | #ifdef DEBUG 1508 | printf("Searching for marker\n"); 1509 | #endif 1510 | foundat = bm_search(needle->markerlist[0].value, 1511 | needle->markerlist[0].len, 1512 | foundat, 1513 | bytes_to_search, 1514 | needle->markerlist[0].marker_bm_table, 1515 | needle->case_sen, 1516 | SEARCHTYPE_FORWARD); 1517 | 1518 | if (foundat) 1519 | { 1520 | #ifdef DEBUG 1521 | printf("Found after searching %d\n", foundat - currentpos); 1522 | #endif 1523 | while (1) 1524 | { 1525 | 1526 | if (foundat[3] >= (unsigned char)'\xBB' && foundat[3] <= (unsigned char)'\xEF') 1527 | { 1528 | #ifdef DEBUG 1529 | printf("jumping %d:\n", j); 1530 | #endif 1531 | size = htos(&foundat[4], FOREMOST_BIG_ENDIAN); 1532 | #ifdef DEBUG 1533 | printf("\t hit: "); 1534 | printx(foundat, 0, 16); 1535 | printf("size:=%d\n\tjump: ", size); 1536 | #endif 1537 | file_size += (foundat - buf) + size; 1538 | if (size <= 0 || size > buflen - (foundat - buf)) 1539 | { 1540 | #ifdef DEBUG 1541 | printf("Not enough room in the buffer "); 1542 | #endif 1543 | if (size <= 50 * KILOBYTE && size > 0) 1544 | { 1545 | 1546 | /*We should probably search more*/ 1547 | if (file_size < needle->max_len) 1548 | { 1549 | return NULL; 1550 | } 1551 | else 1552 | { 1553 | break; 1554 | } 1555 | } 1556 | else 1557 | { 1558 | return currentpos + needle->header_len; 1559 | } 1560 | } 1561 | 1562 | foundat += size + 6; 1563 | #ifdef DEBUG 1564 | printx(foundat, 0, 16); 1565 | #endif 1566 | j++; 1567 | } 1568 | else 1569 | { 1570 | 1571 | break; 1572 | } 1573 | } 1574 | 1575 | if (foundat[3] == (unsigned char)'\xB9') 1576 | { 1577 | break; 1578 | } 1579 | else if (foundat[3] != (unsigned char)'\xBA' && foundat[3] != (unsigned char)'\x00') 1580 | { 1581 | 1582 | /*This is the error state where this doesn't seem to be an mpg anymore*/ 1583 | size = htos(&foundat[4], FOREMOST_BIG_ENDIAN); 1584 | #ifdef DEBUG 1585 | printf("\t ***TEST: %x\n", foundat[3]); 1586 | printx(foundat, 0, 16); 1587 | 1588 | printf("size:=%d\n", size); 1589 | #endif 1590 | if ((currentpos - buf) >= 1 * MEGABYTE) 1591 | { 1592 | foundat = currentpos; 1593 | break; 1594 | } 1595 | 1596 | return currentpos + needle->header_len; 1597 | 1598 | } 1599 | else if (foundat[3] == (unsigned char)'\xB3') 1600 | { 1601 | foundat += 3; 1602 | } 1603 | else 1604 | { 1605 | foundat += 3; 1606 | } 1607 | } 1608 | else 1609 | { 1610 | if ((currentpos - buf) >= 1 * MEGABYTE) 1611 | { 1612 | foundat = currentpos; 1613 | break; 1614 | } 1615 | else 1616 | { 1617 | #ifdef DEBUG 1618 | printf("RETURNING BUF\n"); 1619 | #endif 1620 | return buf + needle->header_len; 1621 | } 1622 | } 1623 | } 1624 | 1625 | if (foundat) 1626 | { 1627 | file_size = (foundat - buf) + needle->footer_len; 1628 | if (file_size < 1 * KILOBYTE) 1629 | return buf + needle->header_len; 1630 | } 1631 | else 1632 | { 1633 | return buf + needle->header_len; 1634 | } 1635 | 1636 | if (file_size > buflen) 1637 | file_size = buflen; 1638 | foundat = buf; 1639 | #ifdef DEBUG 1640 | printf("The file size is %llu c_offset:=%llu\n", file_size, c_offset); 1641 | #endif 1642 | 1643 | extractbuf = buf; 1644 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1645 | foundat += file_size; 1646 | return foundat; 1647 | } 1648 | 1649 | 1650 | /******************************************************************************** 1651 | *Function: extract_mp4 1652 | * Not done yet 1653 | **********************************************************************************/ 1654 | unsigned char *extract_mp4(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1655 | s_spec *needle, u_int64_t f_offset) 1656 | { 1657 | unsigned char *buf = foundat; 1658 | 1659 | unsigned char *extractbuf = NULL; 1660 | unsigned int size = 0; 1661 | u_int64_t file_size = 0; 1662 | 1663 | 1664 | while(1) 1665 | { 1666 | size=htoi(&foundat[28],FOREMOST_BIG_ENDIAN); 1667 | if(size ==0) 1668 | { 1669 | //printf("size ==0\n"); 1670 | foundat+=28; 1671 | break; 1672 | } 1673 | //printf("size:=%d\n",size); 1674 | if(size > 0 && size < buflen) 1675 | { 1676 | if(!isprint(foundat[32]) || !isprint(foundat[33])) 1677 | { 1678 | //printf("print err\n"); 1679 | break; 1680 | //return foundat+8; 1681 | } 1682 | foundat+=size; 1683 | 1684 | } 1685 | else 1686 | { 1687 | if (size < needle->max_len) 1688 | { 1689 | //printf("Searching More\n"); 1690 | return NULL; 1691 | } 1692 | else 1693 | { 1694 | //printf("ERR\n"); 1695 | //return foundat+8; 1696 | break; 1697 | } 1698 | } 1699 | 1700 | //printx(foundat,0,32); 1701 | 1702 | } 1703 | if (foundat) 1704 | { 1705 | file_size = (foundat - buf) + needle->footer_len; 1706 | if (file_size < 1 * KILOBYTE) 1707 | return buf + needle->header_len; 1708 | } 1709 | 1710 | 1711 | if (file_size > buflen) 1712 | file_size = buflen; 1713 | foundat = buf; 1714 | 1715 | 1716 | extractbuf = buf; 1717 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1718 | foundat += file_size; 1719 | return foundat; 1720 | } 1721 | 1722 | 1723 | /******************************************************************************** 1724 | *Function: extract_png 1725 | *Description: Given that we have a PNG header parse the given buffer to determine 1726 | * where the file ends. 1727 | *Return: A pointer to where the EOF of the PNG is in the current buffer 1728 | **********************************************************************************/ 1729 | unsigned char *extract_png(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1730 | s_spec *needle, u_int64_t f_offset) 1731 | { 1732 | unsigned char *buf = foundat; 1733 | unsigned char *currentpos = NULL; 1734 | 1735 | unsigned char *extractbuf = NULL; 1736 | int size = 0; 1737 | int height = 0; 1738 | int width = 0; 1739 | u_int64_t file_size = 0; 1740 | char comment[32]; 1741 | 1742 | if (buflen < 100) 1743 | return NULL; 1744 | foundat += 8; 1745 | width = htoi(&foundat[8], FOREMOST_BIG_ENDIAN); 1746 | height = htoi(&foundat[12], FOREMOST_BIG_ENDIAN); 1747 | 1748 | if (width < 1 || height < 1) 1749 | return foundat; 1750 | 1751 | if (width > 3000 || height > 3000) 1752 | return foundat; 1753 | 1754 | sprintf(comment, " (%d x %d)", width, height); 1755 | strcat(needle->comment, comment); 1756 | 1757 | while (1) /* Jump through the headers until we reach the "data" part of the file*/ 1758 | { 1759 | size = htoi(foundat, FOREMOST_BIG_ENDIAN); 1760 | #ifdef DEBUG 1761 | printx(foundat, 0, 16); 1762 | printf("Size:=%d\n", size); 1763 | #endif 1764 | 1765 | currentpos = foundat; 1766 | if (size <= 0 || size > buflen - (foundat - buf)) 1767 | { 1768 | #ifdef DEBUG 1769 | printf("buflen - (foundat-buf)=%lu\n", buflen - (foundat - buf)); 1770 | #endif 1771 | return currentpos; 1772 | } 1773 | 1774 | /*12 is the length of the size, TYPE, and CRC field*/ 1775 | foundat += size + 12; 1776 | 1777 | if (isprint(foundat[4])) 1778 | { 1779 | if (strncmp((char *) &foundat[4], "IEND", 4) == 0) 1780 | { 1781 | break; 1782 | } 1783 | } 1784 | else 1785 | { 1786 | #ifdef DEBUG 1787 | printx(foundat, 0, 16); 1788 | printf("Not ascii returning\n"); 1789 | #endif 1790 | return currentpos; 1791 | } 1792 | 1793 | } 1794 | 1795 | if (foundat) 1796 | { 1797 | file_size = (foundat - buf) + htoi(foundat, FOREMOST_BIG_ENDIAN) + 12; 1798 | 1799 | if (file_size > buflen) 1800 | file_size = buflen; 1801 | foundat = buf; 1802 | #ifdef DEBUG 1803 | printf("The file size is %llu c_offset:=%llu\n", file_size, c_offset); 1804 | #endif 1805 | extractbuf = buf; 1806 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1807 | foundat += file_size; 1808 | return foundat; 1809 | } 1810 | 1811 | return NULL; 1812 | } 1813 | 1814 | /******************************************************************************** 1815 | *Function: extract_jpeg 1816 | *Description: Given that we have a JPEG header parse the given buffer to determine 1817 | * where the file ends. 1818 | *Return: A pointer to where the EOF of the JPEG is in the current buffer 1819 | **********************************************************************************/ 1820 | unsigned char *extract_jpeg(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 1821 | s_spec *needle, u_int64_t f_offset) 1822 | { 1823 | unsigned char *buf = foundat; 1824 | unsigned char *currentpos = NULL; 1825 | 1826 | unsigned char *extractbuf = NULL; 1827 | unsigned short headersize; 1828 | int bytes_to_search = 0; 1829 | int hasTable = FALSE; 1830 | int hasHuffman = FALSE; 1831 | u_int64_t file_size = 0; 1832 | 1833 | // char comment[32]; 1834 | 1835 | /*Check if we have a valid header*/ 1836 | if (buflen < 128) 1837 | { 1838 | return NULL; 1839 | } 1840 | 1841 | if (foundat[3] == (unsigned char)'\xe0') 1842 | { 1843 | 1844 | //JFIF header 1845 | //sprintf(comment," (JFIF)"); 1846 | //strcat(needle->comment,comment); 1847 | } 1848 | else if (foundat[3] == (unsigned char)'\xe1') 1849 | { 1850 | 1851 | //sprintf(comment," (EXIF)"); 1852 | //strcat(needle->comment,comment); 1853 | } 1854 | else 1855 | return foundat + needle->header_len; //Invalid keep searching 1856 | while (1) /* Jump through the headers until we reach the "data" part of the file*/ 1857 | { 1858 | #ifdef DEBUG 1859 | printx(foundat, 0, 16); 1860 | #endif 1861 | foundat += 2; 1862 | headersize = htos(&foundat[2], FOREMOST_BIG_ENDIAN); 1863 | #ifdef DEBUG 1864 | printf("Headersize:=%d buflen:=%lld\n", headersize, buflen); 1865 | #endif 1866 | 1867 | 1868 | if (((foundat + headersize) - buf) > buflen){ return NULL; } 1869 | 1870 | foundat += headersize; 1871 | 1872 | if (foundat[2] != (unsigned char)'\xff') 1873 | { 1874 | break; 1875 | } 1876 | 1877 | /*Ignore 2 "0xff" side by side*/ 1878 | if (foundat[2] == (unsigned char)'\xff' && foundat[3] == (unsigned char)'\xff') 1879 | { 1880 | foundat++; 1881 | } 1882 | 1883 | if (foundat[3] == (unsigned char)'\xdb' || foundat[4] == (unsigned char)'\xdb') 1884 | { 1885 | hasTable = TRUE; 1886 | } 1887 | else if (foundat[3] == (unsigned char)'\xc4') 1888 | { 1889 | hasHuffman = TRUE; 1890 | } 1891 | } 1892 | 1893 | /*All jpegs must contain a Huffman marker as well as a quantization table*/ 1894 | if (!hasTable || !hasHuffman) 1895 | { 1896 | #ifdef DEBUG 1897 | printf("No Table or Huffman \n"); 1898 | #endif 1899 | return buf + needle->header_len; 1900 | } 1901 | 1902 | currentpos = foundat; 1903 | 1904 | //sprintf("Searching for footer\n"); 1905 | if (buflen < (foundat - buf)) { 1906 | #ifdef DEBUG 1907 | printf("avoided bug in extract_jpeg!\n"); 1908 | #endif 1909 | bytes_to_search = 0; 1910 | } else { 1911 | if (buflen - (foundat - buf) >= needle->max_len) 1912 | bytes_to_search = needle->max_len; 1913 | else 1914 | bytes_to_search = buflen - (foundat - buf); 1915 | } 1916 | 1917 | foundat = bm_search(needle->footer, 1918 | needle->footer_len, 1919 | foundat, 1920 | bytes_to_search, 1921 | needle->footer_bm_table, 1922 | needle->case_sen, 1923 | SEARCHTYPE_FORWARD); 1924 | 1925 | if (foundat) /*Found found a valid JPEG*/ 1926 | { 1927 | 1928 | /*We found the EOF, write the file to disk and return*/ 1929 | file_size = (foundat - buf) + needle->footer_len; 1930 | #ifdef DEBUG 1931 | printf("The jpeg file size is %llu c_offset:=%llu\n", file_size, c_offset); 1932 | #endif 1933 | 1934 | //extractbuf=(unsigned char*) malloc(file_size*sizeof(char)); 1935 | //memcpy(extractbuf,buf,file_size); 1936 | extractbuf = buf; 1937 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 1938 | foundat += needle->footer_len; 1939 | 1940 | ////free(extractbuf); 1941 | return foundat; 1942 | } 1943 | else 1944 | { 1945 | return NULL; 1946 | } 1947 | 1948 | } //End extract_jpeg 1949 | 1950 | /******************************************************************************** 1951 | *Function: extract_generic 1952 | *Description: 1953 | *Return: A pointer to where the EOF of the 1954 | **********************************************************************************/ 1955 | unsigned char *extract_generic(f_state *s, u_int64_t c_offset, unsigned char *foundat, 1956 | u_int64_t buflen, s_spec *needle, u_int64_t f_offset) 1957 | { 1958 | unsigned char *buf = foundat; 1959 | unsigned char *endptr = foundat; 1960 | unsigned char *beginptr = foundat; 1961 | unsigned char *extractbuf = NULL; 1962 | int bytes_to_search = 0; 1963 | u_int64_t file_size = 0; 1964 | int begin=0; 1965 | int end=0; 1966 | 1967 | 1968 | if (buflen - (foundat - buf) >= needle->max_len) 1969 | bytes_to_search = needle->max_len; 1970 | else 1971 | bytes_to_search = buflen - (foundat - buf); 1972 | 1973 | if(needle->searchtype ==SEARCHTYPE_FORWARD_NEXT) 1974 | { 1975 | foundat+=needle->header_len; 1976 | foundat = bm_search(needle->header, 1977 | needle->header_len, 1978 | foundat, 1979 | bytes_to_search, 1980 | needle->footer_bm_table, 1981 | needle->case_sen, 1982 | SEARCHTYPE_FORWARD); 1983 | } 1984 | else if(needle->searchtype ==SEARCHTYPE_ASCII) 1985 | { 1986 | 1987 | 1988 | while (isprint(foundat[end]) || foundat[end] == '\x0a' || foundat[end] == '\x0d' || foundat[end] == '\x09') 1989 | { 1990 | end++; 1991 | } 1992 | 1993 | foundat+=end; 1994 | endptr=foundat; 1995 | foundat=buf; 1996 | 1997 | while (isprint(foundat[begin-1]) || foundat[begin-1] == '\x0a' || foundat[begin-1] == '\x0d' || foundat[begin-1] == '\x09') 1998 | { 1999 | begin--; 2000 | } 2001 | 2002 | foundat+=begin; 2003 | beginptr=foundat; 2004 | 2005 | buf=beginptr; 2006 | foundat=endptr; 2007 | //printx(buf,0,4); 2008 | 2009 | file_size=end-begin; 2010 | //fprintf(stderr,"file_size=%llu end=%d begin=%d ptrsize=%d ptrsize2=%d\n",file_size,end,begin,endptr-beginptr,foundat-buf); 2011 | if(buf==foundat) 2012 | { 2013 | fprintf(stderr,"Returning Foundat\n"); 2014 | return foundat+needle->header_len; 2015 | } 2016 | } 2017 | else if (needle->footer == NULL || strlen((char *)needle->footer) < 1) 2018 | { 2019 | #ifdef DEBUG 2020 | printf("footer is NULL\n"); 2021 | #endif 2022 | foundat = NULL; 2023 | } 2024 | else 2025 | { 2026 | #ifdef DEBUG 2027 | printf("footer is not NULL %p\n", needle->footer); 2028 | #endif 2029 | foundat = bm_search(needle->footer, 2030 | needle->footer_len, 2031 | foundat, 2032 | bytes_to_search, 2033 | needle->footer_bm_table, 2034 | needle->case_sen, 2035 | SEARCHTYPE_FORWARD); 2036 | } 2037 | 2038 | if (foundat) 2039 | { 2040 | #ifdef DEBUG 2041 | printf("found %s!!!\n", needle->footer); 2042 | #endif 2043 | if(needle->searchtype ==SEARCHTYPE_FORWARD_NEXT || needle->searchtype ==SEARCHTYPE_ASCII) 2044 | { 2045 | file_size = (foundat - buf); 2046 | } 2047 | else 2048 | { 2049 | file_size = (foundat - buf) + needle->footer_len; 2050 | } 2051 | } 2052 | else 2053 | { 2054 | file_size = needle->max_len; 2055 | } 2056 | 2057 | if (file_size == 0) 2058 | { 2059 | file_size = needle->max_len; 2060 | } 2061 | 2062 | if (file_size > (buflen-begin)) 2063 | { 2064 | file_size = buflen; 2065 | } 2066 | 2067 | #ifdef DEBUG 2068 | printf("The file size is %llu c_offset:=%llu\n", file_size, c_offset); 2069 | #endif 2070 | 2071 | extractbuf = buf; 2072 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 2073 | 2074 | if(needle->searchtype !=SEARCHTYPE_ASCII) 2075 | { 2076 | foundat=buf; 2077 | foundat += needle->header_len; 2078 | } 2079 | return foundat; 2080 | 2081 | 2082 | 2083 | } 2084 | 2085 | /******************************************************************************** 2086 | *Function: extract_exe 2087 | *Description: 2088 | *Return: A pointer to where the EOF of the 2089 | **********************************************************************************/ 2090 | unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 2091 | s_spec *needle, u_int64_t f_offset) 2092 | { 2093 | unsigned char *buf = foundat; 2094 | unsigned char *extractbuf = NULL; 2095 | u_int64_t file_size = 0; 2096 | unsigned short pe_offset = 0; 2097 | unsigned int SizeOfCode = 0; 2098 | unsigned int SizeOfInitializedData = 0; 2099 | unsigned int SizeOfUninitializedData = 0; 2100 | unsigned int rva = 0; 2101 | unsigned int offset = 0; 2102 | unsigned short sections = 0; 2103 | unsigned int sizeofimage = 0; 2104 | unsigned int raw_section_size = 0; 2105 | unsigned int size_of_headers = 0; 2106 | unsigned short dll = 0; 2107 | unsigned int sum = 0; 2108 | unsigned short exe_char = 0; 2109 | unsigned int align = 0; 2110 | int i = 0; 2111 | time_t compile_time = 0; 2112 | struct tm *ret_time; 2113 | char comment[32]; 2114 | char ascii_time[32]; 2115 | 2116 | if (buflen < 100) 2117 | return foundat + 2; 2118 | pe_offset = htos(&foundat[60], FOREMOST_LITTLE_ENDIAN); 2119 | if (pe_offset < 1 || pe_offset > 1000 || pe_offset > buflen) 2120 | { 2121 | return foundat + 60; 2122 | } 2123 | 2124 | foundat += pe_offset; 2125 | if (foundat[0] != (unsigned char)'\x50' || foundat[1] != (unsigned char)'\x45') 2126 | { 2127 | return foundat; 2128 | } 2129 | 2130 | sections = htos(&foundat[6], FOREMOST_LITTLE_ENDIAN); 2131 | if (buflen < (40 * sections + 224)) 2132 | { 2133 | return foundat; 2134 | } 2135 | 2136 | compile_time = (time_t) htoi(&foundat[8], FOREMOST_LITTLE_ENDIAN); 2137 | ret_time = gmtime(&compile_time); 2138 | sprintf(ascii_time, 2139 | "%02d/%02d/%04d %02d:%02d:%02d", 2140 | ret_time->tm_mon + 1, 2141 | ret_time->tm_mday, 2142 | ret_time->tm_year + 1900, 2143 | ret_time->tm_hour, 2144 | ret_time->tm_min, 2145 | ret_time->tm_sec); 2146 | chop(ascii_time); 2147 | 2148 | sprintf(comment, ascii_time); 2149 | strcat(needle->comment, comment); 2150 | exe_char = htos(&foundat[22], FOREMOST_LITTLE_ENDIAN); 2151 | if (exe_char & 0x2000) 2152 | { 2153 | dll = 1; 2154 | } 2155 | else if (exe_char & 0x1000) 2156 | { 2157 | 2158 | //printf("System File!!!\n"); 2159 | } 2160 | else if (exe_char & 0x0002) 2161 | { 2162 | 2163 | //printf("EXE !!!\n"); 2164 | } 2165 | else 2166 | { 2167 | return foundat; 2168 | } 2169 | 2170 | foundat += 0x18; /*Jump to opt header should be 0x0b 0x01*/ 2171 | 2172 | SizeOfCode = htoi(&foundat[4], FOREMOST_LITTLE_ENDIAN); 2173 | SizeOfInitializedData = htoi(&foundat[8], FOREMOST_LITTLE_ENDIAN); 2174 | SizeOfUninitializedData = htoi(&foundat[12], FOREMOST_LITTLE_ENDIAN); 2175 | rva = htoi(&foundat[16], FOREMOST_LITTLE_ENDIAN); 2176 | align = htoi(&foundat[36], FOREMOST_LITTLE_ENDIAN); 2177 | 2178 | sizeofimage = htoi(&foundat[56], FOREMOST_LITTLE_ENDIAN); 2179 | size_of_headers = htoi(&foundat[60], FOREMOST_LITTLE_ENDIAN); 2180 | foundat += 224; 2181 | 2182 | /*Start of sections*/ 2183 | for (i = 0; i < sections; i++) 2184 | { 2185 | 2186 | //strncpy(name,foundat,8); 2187 | offset = htoi(&foundat[20], FOREMOST_LITTLE_ENDIAN); 2188 | raw_section_size = htoi(&foundat[16], FOREMOST_LITTLE_ENDIAN); 2189 | 2190 | //printf("\t%s size=%d offset=%d\n",name,raw_section_size,offset); 2191 | foundat += 40; 2192 | 2193 | //rem+=(raw_section_size%align); 2194 | //sum+=raw_section_size; 2195 | sum = offset + raw_section_size; 2196 | } 2197 | 2198 | /* 2199 | printf("rva is %d sum= %d\n",rva,sum); 2200 | printf("soi is %d,soh is %d \n",sizeofimage,size_of_headers); 2201 | printf("we are off by %d\n",sum-buflen); 2202 | printf("soc=%d ,soidr=%d, souid=%d\n",SizeOfCode,SizeOfInitializedData,SizeOfUninitializedData); 2203 | printf("fs=%d ,extr=%d\n",SizeOfCode+SizeOfInitializedData,SizeOfUninitializedData); 2204 | */ 2205 | file_size = sum; 2206 | if (file_size < 512 || file_size > 4 * MEGABYTE) 2207 | { 2208 | return foundat + 60; 2209 | } 2210 | 2211 | if (file_size > buflen) 2212 | file_size = buflen; 2213 | foundat = buf; 2214 | #ifdef DEBUG 2215 | printf("The file size is %llu c_offset:=%llu\n", file_size, c_offset); 2216 | #endif 2217 | 2218 | extractbuf = buf; 2219 | if (dll == 1) 2220 | { 2221 | strcpy(needle->suffix, "dll"); 2222 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 2223 | strcpy(needle->suffix, "exe"); 2224 | } 2225 | else 2226 | { 2227 | write_to_disk(s, needle, file_size, extractbuf, c_offset + f_offset); 2228 | } 2229 | 2230 | foundat += needle->header_len; 2231 | return (buf + file_size); 2232 | } 2233 | 2234 | 2235 | /******************************************************************************** 2236 | *Function: extract_reg 2237 | *Description: 2238 | *Return: A pointer to where the EOF of the 2239 | **********************************************************************************/ 2240 | unsigned char *extract_reg(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 2241 | s_spec *needle, u_int64_t f_offset) 2242 | { 2243 | unsigned char *buf = foundat; 2244 | unsigned char *extractbuf = NULL; 2245 | int sizeofreg = htoi(&foundat[0x28], FOREMOST_LITTLE_ENDIAN); 2246 | int file_size=0; 2247 | if(sizeofreg < 0 || sizeofreg > needle->max_len) 2248 | { 2249 | return (foundat+4); 2250 | } 2251 | foundat+=sizeofreg; 2252 | file_size = (foundat - buf); 2253 | 2254 | extractbuf = buf; 2255 | 2256 | 2257 | write_to_disk(s, needle, file_size , extractbuf, c_offset + f_offset); 2258 | 2259 | 2260 | return NULL; 2261 | } 2262 | /******************************************************************************** 2263 | *Function: extract_rar 2264 | *Description: 2265 | *Return: A pointer to where the EOF of the 2266 | **********************************************************************************/ 2267 | unsigned char *extract_rar(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 2268 | s_spec *needle, u_int64_t f_offset) 2269 | { 2270 | unsigned char *buf = foundat; 2271 | unsigned char *extractbuf = NULL; 2272 | u_int64_t file_size = 0; 2273 | unsigned short headersize = 0; 2274 | unsigned short flags = 0; 2275 | unsigned int filesize = 0; 2276 | unsigned int tot_file_size = 0; 2277 | unsigned int ufilesize = 0; 2278 | int i = 0; 2279 | int scan = 0; 2280 | int flag = 0; 2281 | int passwd = 0; 2282 | u_int64_t bytes_to_search = 50 * KILOBYTE; 2283 | char comment[32]; 2284 | 2285 | /*Marker Block*/ 2286 | headersize = htos(&foundat[5], FOREMOST_LITTLE_ENDIAN); 2287 | foundat += headersize; 2288 | 2289 | /*Archive Block*/ 2290 | headersize = htos(&foundat[5], FOREMOST_LITTLE_ENDIAN); 2291 | filesize = htoi(&foundat[7], FOREMOST_LITTLE_ENDIAN); 2292 | 2293 | if (foundat[2] != '\x73') 2294 | { 2295 | return foundat; /*Error*/ 2296 | } 2297 | 2298 | flags = htos(&foundat[3], FOREMOST_LITTLE_ENDIAN); 2299 | if ((flags & 0x01) != 0) 2300 | { 2301 | sprintf(comment, " Multi-volume:"); 2302 | strcat(needle->comment, comment); 2303 | } 2304 | 2305 | if (flags & 0x02) 2306 | { 2307 | sprintf(comment, " an archive comment is present:"); 2308 | strcat(needle->comment, comment); 2309 | } 2310 | 2311 | foundat += headersize; 2312 | 2313 | if (foundat[2] != '\x74') 2314 | { 2315 | for (i = 0; i < 500; i++) 2316 | { 2317 | if (foundat[i] == '\x74') 2318 | { 2319 | foundat += i - 2; 2320 | scan = 1; 2321 | break; 2322 | } 2323 | } 2324 | } 2325 | 2326 | if (headersize == 13 && foundat[2] != '\x74') 2327 | { 2328 | 2329 | if (scan == 0) 2330 | { 2331 | sprintf(comment, "Encrypted Headers!"); 2332 | strcat(needle->comment, comment); 2333 | } 2334 | 2335 | if (buflen - (foundat - buf) >= needle->max_len) 2336 | bytes_to_search = needle->max_len; 2337 | else 2338 | bytes_to_search = buflen - (foundat - buf); 2339 | 2340 | //printf("bytes_to_search:=%d needle->footer_len:=%d needle->header_len:=%d\n",bytes_to_search,needle->footer_len,needle->header_len); 2341 | foundat = bm_search(needle->footer, 2342 | needle->footer_len, 2343 | foundat, 2344 | bytes_to_search, 2345 | needle->footer_bm_table, 2346 | needle->case_sen, 2347 | SEARCHTYPE_FORWARD); 2348 | if (foundat == NULL) 2349 | { 2350 | tot_file_size = bytes_to_search; 2351 | foundat = buf + tot_file_size; 2352 | } 2353 | } 2354 | else 2355 | { 2356 | 2357 | /*Loop through files*/ 2358 | while (foundat[2] == '\x74') 2359 | { 2360 | 2361 | headersize = htos(&foundat[5], FOREMOST_LITTLE_ENDIAN); 2362 | filesize = htoi(&foundat[7], FOREMOST_LITTLE_ENDIAN); 2363 | ufilesize = htoi(&foundat[11], FOREMOST_LITTLE_ENDIAN); 2364 | 2365 | if (headersize < 1 || headersize > buflen) 2366 | flag = 1; 2367 | if (filesize < 0 || filesize > buflen) 2368 | flag = 1; 2369 | if ((headersize + filesize) > buflen) 2370 | flag = 1; 2371 | if (ufilesize < 0) 2372 | flag = 1; 2373 | 2374 | flags = htos(&foundat[3], FOREMOST_LITTLE_ENDIAN); 2375 | if ((flags & 0x04) != 0) 2376 | { 2377 | passwd = 1; 2378 | } 2379 | 2380 | tot_file_size = (foundat - buf); 2381 | if ((tot_file_size + headersize + filesize) > buflen) 2382 | { 2383 | break; 2384 | } 2385 | 2386 | foundat += headersize + filesize; 2387 | } 2388 | 2389 | if (passwd == 1) 2390 | { 2391 | sprintf(comment, "Password Protected:"); 2392 | strcat(needle->comment, comment); 2393 | } 2394 | 2395 | if (flag == 1) 2396 | { 2397 | sprintf(comment, "Encrypted Headers!"); 2398 | strcat(needle->comment, comment); 2399 | foundat = bm_search(needle->footer, 2400 | needle->footer_len, 2401 | foundat, 2402 | bytes_to_search, 2403 | needle->footer_bm_table, 2404 | needle->case_sen, 2405 | SEARCHTYPE_FORWARD); 2406 | if (foundat == NULL) 2407 | { 2408 | tot_file_size = bytes_to_search; 2409 | foundat = buf + tot_file_size; 2410 | } 2411 | } 2412 | 2413 | if (foundat[2] != '\x7B' && tot_file_size == 0) 2414 | { 2415 | 2416 | //printf("Error 7B!!!! %x\n",foundat[2]); 2417 | return foundat; 2418 | } 2419 | 2420 | foundat += 7; 2421 | 2422 | } 2423 | 2424 | if (foundat) 2425 | { 2426 | 2427 | /*We found the EOF, write the file to disk and return*/ 2428 | tot_file_size = (foundat - buf); 2429 | if (tot_file_size > buflen) 2430 | file_size = buflen; 2431 | 2432 | extractbuf = buf; 2433 | write_to_disk(s, needle, tot_file_size, extractbuf, c_offset + f_offset); 2434 | return foundat; 2435 | } 2436 | else 2437 | { 2438 | return NULL; 2439 | } 2440 | 2441 | return NULL; 2442 | } 2443 | 2444 | unsigned char *extract_file(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen, 2445 | s_spec *needle, u_int64_t f_offset) 2446 | { 2447 | if (needle->type == JPEG) 2448 | { 2449 | return extract_jpeg(s, c_offset, foundat, buflen, needle, f_offset); 2450 | } 2451 | else if (needle->type == GIF) 2452 | { 2453 | return extract_gif(s, c_offset, foundat, buflen, needle, f_offset); 2454 | } 2455 | else if (needle->type == PNG) 2456 | { 2457 | return extract_png(s, c_offset, foundat, buflen, needle, f_offset); 2458 | } 2459 | else if (needle->type == BMP) 2460 | { 2461 | return extract_bmp(s, c_offset, foundat, buflen, needle, f_offset); 2462 | } 2463 | else if (needle->type == RIFF) 2464 | { 2465 | needle->suffix = "rif"; 2466 | return extract_riff(s, c_offset, foundat, buflen, needle, f_offset, "all"); 2467 | } 2468 | else if (needle->type == AVI) 2469 | { 2470 | return extract_riff(s, c_offset, foundat, buflen, needle, f_offset, "avi"); 2471 | } 2472 | else if (needle->type == WAV) 2473 | { 2474 | needle->suffix = "rif"; 2475 | return extract_riff(s, c_offset, foundat, buflen, needle, f_offset, "wav"); 2476 | } 2477 | else if (needle->type == WMV) 2478 | { 2479 | return extract_wmv(s, c_offset, foundat, buflen, needle, f_offset); 2480 | } 2481 | else if (needle->type == OLE) 2482 | { 2483 | needle->suffix = "ole"; 2484 | return extract_ole(s, c_offset, foundat, buflen, needle, f_offset, "all"); 2485 | } 2486 | else if (needle->type == DOC) 2487 | { 2488 | return extract_ole(s, c_offset, foundat, buflen, needle, f_offset, "doc"); 2489 | } 2490 | else if (needle->type == PPT) 2491 | { 2492 | return extract_ole(s, c_offset, foundat, buflen, needle, f_offset, "ppt"); 2493 | } 2494 | else if (needle->type == XLS) 2495 | { 2496 | needle->suffix = "ole"; 2497 | return extract_ole(s, c_offset, foundat, buflen, needle, f_offset, "xls"); 2498 | } 2499 | else if (needle->type == PDF) 2500 | { 2501 | return extract_pdf(s, c_offset, foundat, buflen, needle, f_offset); 2502 | } 2503 | else if (needle->type == CPP) 2504 | { 2505 | return extract_cpp(s, c_offset, foundat, buflen, needle, f_offset); 2506 | } 2507 | else if (needle->type == HTM) 2508 | { 2509 | return extract_htm(s, c_offset, foundat, buflen, needle, f_offset); 2510 | } 2511 | else if (needle->type == MPG) 2512 | { 2513 | return extract_mpg(s, c_offset, foundat, buflen, needle, f_offset); 2514 | } 2515 | else if (needle->type == MP4) 2516 | { 2517 | return extract_mp4(s, c_offset, foundat, buflen, needle, f_offset); 2518 | } 2519 | else if (needle->type == ZIP) 2520 | { 2521 | return extract_zip(s, c_offset, foundat, buflen, needle, f_offset, "all"); 2522 | } 2523 | else if (needle->type == RAR) 2524 | { 2525 | return extract_rar(s, c_offset, foundat, buflen, needle, f_offset); 2526 | } 2527 | else if (needle->type == SXW) 2528 | { 2529 | return extract_zip(s, c_offset, foundat, buflen, needle, f_offset, "sxw"); 2530 | } 2531 | else if (needle->type == SXC) 2532 | { 2533 | return extract_zip(s, c_offset, foundat, buflen, needle, f_offset, "sxc"); 2534 | } 2535 | else if (needle->type == SXI) 2536 | { 2537 | return extract_zip(s, c_offset, foundat, buflen, needle, f_offset, "sxi"); 2538 | } 2539 | else if (needle->type == EXE) 2540 | { 2541 | return extract_exe(s, c_offset, foundat, buflen, needle, f_offset); 2542 | } 2543 | else if (needle->type == MOV || needle->type == VJPEG) 2544 | { 2545 | return extract_mov(s, c_offset, foundat, buflen, needle, f_offset); 2546 | } 2547 | else if (needle->type == CONF) 2548 | { 2549 | return extract_generic(s, c_offset, foundat, buflen, needle, f_offset); 2550 | } 2551 | else 2552 | { 2553 | return NULL; 2554 | } 2555 | return NULL; 2556 | } 2557 | -------------------------------------------------------------------------------- /foremost-1.5.7/extract.h: -------------------------------------------------------------------------------- 1 | /* 2 | local file header signature 4 bytes (0x04034b50) 3 | version needed to extract 2 bytes 4 | general purpose bit flag 2 bytes 5 | compression method 2 bytes 6 | last mod file time 2 bytes 7 | last mod file date 2 bytes 8 | crc-32 4 bytes 9 | compressed size 4 bytes 10 | uncompressed size 4 bytes 11 | filename length 2 bytes 12 | extra field length 2 bytes 13 | */ 14 | 15 | /* 16 | central file header signature 4 bytes (0x02014b50) 17 | version made by 2 bytes 18 | version needed to extract 2 bytes 19 | general purpose bit flag 2 bytes 20 | compression method 2 bytes 21 | last mod file time 2 bytes 22 | last mod file date 2 bytes 23 | crc-32 4 bytes 24 | compressed size 4 bytes 25 | uncompressed size 4 bytes 26 | filename length 2 bytes 27 | extra field length 2 bytes 28 | file comment length 2 bytes 29 | disk number start 2 bytes 30 | internal file attributes 2 bytes 31 | external file attributes 4 bytes 32 | relative offset of local header 4 bytes 33 | */ 34 | 35 | /* end of central dir signature 4 bytes (0x06054b50) 36 | number of this disk 2 bytes 37 | number of the disk with the 38 | start of the central directory 2 bytes 39 | total number of entries in 40 | the central dir on this disk 2 bytes 41 | total number of entries in 42 | the central dir 2 bytes 43 | size of the central directory 4 bytes 44 | offset of start of central 45 | directory with respect to 46 | the starting disk number 4 bytes 47 | zipfile comment length 2 bytes 48 | zipfile comment (variable size) 49 | */ 50 | struct zipLocalFileHeader 51 | { 52 | unsigned int signature; //0 53 | unsigned short version; //4 54 | unsigned short genFlag; //6 55 | signed short compression; //8 56 | unsigned short last_mod_time; //10 57 | unsigned short last_mod_date; //12 58 | unsigned int crc; //14 59 | unsigned int compressed; //18 60 | unsigned int uncompressed; //22 61 | unsigned short filename_length; //26 62 | unsigned short extra_length; //28 63 | }; 64 | struct zipCentralFileHeader 65 | { 66 | unsigned int signature; //0 67 | unsigned char version_extract[2]; //4 68 | unsigned char version_madeby[2]; //6 69 | unsigned short genFlag; //8 70 | unsigned short compression; //10 71 | unsigned short last_mod_time; //12 72 | unsigned short last_mod_date; //14 73 | unsigned int crc; //16 74 | unsigned int compressed; //20 75 | unsigned int uncompressed; //24 76 | unsigned short filename_length; //28 77 | unsigned short extra_length; //30 78 | unsigned short filecomment_length; //32 79 | unsigned short disk_number_start; //34 80 | }; 81 | struct zipEndCentralFileHeader 82 | { 83 | unsigned int signature; //0 84 | unsigned short numOfdisk; //4 85 | unsigned short compression; //6 86 | unsigned short start_of_central_dir; //8 87 | unsigned short num_entries_in_central_dir; //10 88 | unsigned int size_of_central_dir; //12 89 | unsigned int offset; //16 90 | unsigned short comment_length; //20 91 | }; 92 | 93 | void print_zip(struct zipLocalFileHeader *fileHeader, struct zipCentralFileHeader *centralHeader) 94 | { 95 | printf("\n Local Header Data\n"); 96 | printf("GenFlag:=%d,compressed:=%d,uncompressed:=%d\n", 97 | fileHeader->genFlag, 98 | fileHeader->compressed, 99 | fileHeader->uncompressed); 100 | printf("Compression:=%d, filename_len:=%d,extralen:=%d\n", 101 | fileHeader->compression, 102 | fileHeader->filename_length, 103 | fileHeader->extra_length); 104 | 105 | printf(" Central Header Data\n"); 106 | printf("GenFlag:=%d,compressed:=%d,uncompressed:=%d\n", 107 | centralHeader->genFlag, 108 | centralHeader->compressed, 109 | centralHeader->uncompressed); 110 | printf("Compression:=%d, Version Madeby:=%x%x\n", 111 | centralHeader->compression, 112 | centralHeader->version_madeby[0], 113 | centralHeader->version_madeby[1]); 114 | } 115 | -------------------------------------------------------------------------------- /foremost-1.5.7/foremost.8.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dev-coco/FileRecovery/d60c63b2d9ff87aad0d536ec4b138c848310ccc6/foremost-1.5.7/foremost.8.gz -------------------------------------------------------------------------------- /foremost-1.5.7/foremost.conf: -------------------------------------------------------------------------------- 1 | # 2 | # Foremost configuration file 3 | #------------------------------------------------------------------------- 4 | # Note the foremost configuration file is provided to support formats which 5 | # don't have built-in extraction functions. If the format is built-in to foremost 6 | # simply run foremost with -t and provide the format you wish to extract. 7 | # 8 | # The configuration file is used to control what types of files foremost 9 | # searches for. A sample configuration file, foremost.conf, is included with 10 | # this distribution. For each file type, the configuration file describes 11 | # the file's extension, whether the header and footer are case sensitive, 12 | # the maximum file size, and the header and footer for the file. The footer 13 | # field is optional, but header, size, case sensitivity, and extension are 14 | # not! 15 | # 16 | # Any line that begins with a '#' is considered a comment and ignored. Thus, 17 | # to skip a file type just put a '#' at the beginning of that line 18 | # 19 | 20 | # Headers and footers are decoded before use. To specify a value in 21 | # hexadecimal use \x[0-f][0-f], and for octal use \[0-3][0-7][0-7]. Spaces 22 | # can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI CCI". 23 | # 24 | # To match any single character (aka a wildcard) use a '?'. If you need to 25 | # search for the '?' character, you will need to change the 'wildcard' line 26 | # *and* every occurrence of the old wildcard character in the configuration 27 | # file. Don't forget those hex and octal values! '?' is equal to 0x3f and 28 | # \063. 29 | # 30 | # If you would like to extract files without an extension enter the value 31 | # "NONE" in the extension column (note: you can change the value of this 32 | # "no suffix" flag by setting the variable FOREMOST_NOEXTENSION_SUFFIX 33 | # in foremost.h and recompiling). 34 | # 35 | # The ASCII option will extract all ASCII printable characters before and after 36 | # the keyword provided. 37 | # 38 | # The NEXT keyword after a footer instructs foremost to search forwards for data 39 | # that starts with the header provided and terminates or is followed by data in 40 | # the footer -- the footer data is not included in the output. The data in the 41 | # footer, when used with the NEXT keyword effectively allows you to search for 42 | # data that you know for sure should not be in the output file. This method for 43 | # example, lets you search for two 'starting' headers in a document that doesn't 44 | # have a good ending footer and you can't say exactly what the footer is, but 45 | # you know if you see another header, that should end the search and an output 46 | # file should be written. 47 | 48 | # To redefine the wildcard character, change the setting below and all 49 | # occurances in the formost.conf file. 50 | # 51 | #wildcard ? 52 | # 53 | # case size header footer 54 | #extension sensitive 55 | # 56 | #--------------------------------------------------------------------- 57 | # EXAMPLE WITH NO SUFFIX 58 | #--------------------------------------------------------------------- 59 | # 60 | # Here is an example of how to use the no extension option. Any files 61 | # containing the string "FOREMOST" would be extracted to a file without 62 | # an extension (eg: 00000000,00000001) 63 | # NONE y 1000 FOREMOST 64 | # 65 | #--------------------------------------------------------------------- 66 | # GRAPHICS FILES 67 | #--------------------------------------------------------------------- 68 | # 69 | # 70 | # AOL ART files 71 | # art y 150000 \x4a\x47\x04\x0e \xcf\xc7\xcb 72 | # art y 150000 \x4a\x47\x03\x0e \xd0\xcb\x00\x00 73 | # 74 | # GIF and JPG files (very common) 75 | # (NOTE THESE FORMATS HAVE BUILTIN EXTRACTION FUNCTION) 76 | # gif y 155000000 \x47\x49\x46\x38\x37\x61 \x00\x3b 77 | # gif y 155000000 \x47\x49\x46\x38\x39\x61 \x00\x00\x3b 78 | # jpg y 20000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9 79 | # jpg y 20000000 \xff\xd8\xff\xe1 \xff\xd9 80 | # jpg y 20000000 \xff\xd8 \xff\xd9 81 | # 82 | # PNG (used in web pages) 83 | # (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 84 | # png y 200000 \x50\x4e\x47? \xff\xfc\xfd\xfe 85 | # 86 | # 87 | # BMP 88 | # (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 89 | # bmp y 100000 BM??\x00\x00\x00 90 | # 91 | # TIF 92 | # tif y 200000000 \x49\x49\x2a\x00 93 | # 94 | #--------------------------------------------------------------------- 95 | # ANIMATION FILES 96 | #--------------------------------------------------------------------- 97 | # 98 | # AVI (Windows animation and DiVX/MPEG-4 movies) 99 | # (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 100 | # avi y 4000000 RIFF????AVI 101 | # 102 | # Apple Quicktime 103 | # (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 104 | # mov y 4000000 ????????\x6d\x6f\x6f\x76 105 | # mov y 4000000 ????????\x6d\x64\x61\x74 106 | # 107 | # MPEG Video 108 | # mpg y 4000000 mpg eof 109 | # mpg y 20000000 \x00\x00\x01\xba \x00\x00\x01\xb9 110 | # mpg y 20000000 \x00\x00\x01\xb3 \x00\x00\x01\xb7 111 | # 112 | # Macromedia Flash 113 | # fws y 4000000 FWS 114 | # 115 | #--------------------------------------------------------------------- 116 | # MICROSOFT OFFICE 117 | #--------------------------------------------------------------------- 118 | # 119 | # Word documents 120 | # (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 121 | # doc y 12500000 \xd0\xcf\x11\xe0\xa1\xb1 122 | # 123 | # Outlook files 124 | # pst y 400000000 \x21\x42\x4e\xa5\x6f\xb5\xa6 125 | # ost y 400000000 \x21\x42\x44\x4e 126 | # 127 | # Outlook Express 128 | # dbx y 4000000 \xcf\xad\x12\xfe\xc5\xfd\x74\x6f 129 | # idx y 4000000 \x4a\x4d\x46\x39 130 | # mbx y 4000000 \x4a\x4d\x46\x36 131 | # 132 | #--------------------------------------------------------------------- 133 | # WORDPERFECT 134 | #--------------------------------------------------------------------- 135 | # 136 | # wpc y 100000 ?WPC 137 | # 138 | #--------------------------------------------------------------------- 139 | # HTML (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 140 | #--------------------------------------------------------------------- 141 | # 142 | # htm n 50000 143 | # 144 | #--------------------------------------------------------------------- 145 | # ADOBE PDF (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 146 | #--------------------------------------------------------------------- 147 | # 148 | # pdf y 5000000 %PDF- %EOF 149 | # 150 | # 151 | #--------------------------------------------------------------------- 152 | # AOL (AMERICA ONLINE) 153 | #--------------------------------------------------------------------- 154 | # 155 | # AOL Mailbox 156 | # mail y 500000 \x41\x4f\x4c\x56\x4d 157 | # 158 | # 159 | # 160 | #--------------------------------------------------------------------- 161 | # PGP (PRETTY GOOD PRIVACY) 162 | #--------------------------------------------------------------------- 163 | # 164 | # PGP Disk Files 165 | # pgd y 500000 \x50\x47\x50\x64\x4d\x41\x49\x4e\x60\x01 166 | # 167 | # Public Key Ring 168 | # pgp y 100000 \x99\x00 169 | # Security Ring 170 | # pgp y 100000 \x95\x01 171 | # pgp y 100000 \x95\x00 172 | # Encrypted Data or ASCII armored keys 173 | # pgp y 100000 \xa6\x00 174 | # (there should be a trailer for this...) 175 | # txt y 100000 -----BEGIN\040PGP 176 | # 177 | # 178 | #--------------------------------------------------------------------- 179 | # RPM (Linux package format) 180 | #--------------------------------------------------------------------- 181 | # rpm y 1000000 \xed\xab 182 | # 183 | # 184 | #--------------------------------------------------------------------- 185 | # SOUND FILES 186 | #--------------------------------------------------------------------- 187 | # (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION) 188 | # wav y 200000 RIFF????WAVE 189 | # 190 | # Real Audio Files 191 | # ra y 1000000 \x2e\x72\x61\xfd 192 | # ra y 1000000 .RMF 193 | # 194 | # asf y 8000000 \x30\x26\xB2\x75\x8E\x66\xCF\x11\xA6\xD9\x00\xAA\x00\x62\xCE\x6C 195 | # 196 | # wmv y 20000000 \x30\x26\xB2\x75\x8E\x66\xCF\x11\xA6\xD9\x00\xAA\x00\x62\xCE\x6C 197 | # 198 | # wma y 8000000 \x30\x26\xB2\x75 \x00\x00\x00\xFF 199 | # 200 | # wma y 8000000 \x30\x26\xB2\x75 \x52\x9A\x12\x46 201 | # 202 | # mp3 y 8000000 \xFF\xFB??\x44\x00\x00 203 | # mp3 y 8000000 \x57\x41\x56\45 \x00\x00\xFF\ 204 | # mp3 y 8000000 \xFF\xFB\xD0\ \xD1\x35\x51\xCC\ 205 | # mp3 y 8000000 \x49\x44\x33\ 206 | # mp3 y 8000000 \x4C\x41\x4D\x45\ 207 | #--------------------------------------------------------------------- 208 | # WINDOWS REGISTRY FILES 209 | #--------------------------------------------------------------------- 210 | # 211 | # Windows NT registry 212 | # dat y 4000000 regf 213 | # Windows 95 registry 214 | # dat y 4000000 CREG 215 | # 216 | # lnk y 5000 \x4C\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00 217 | # chm y 100000 \x49\x54\x53\x46\x03\x00\x00\x00\x60\x00\x00\x00\x01\x00\x00 218 | # cookie n 4096 id= 219 | # rdp y 4096 \xFF\xFE\x73\x00\x63\x00\x72\x00\x65\x00\x65\x00\x6E\x00\x20\x00\x6D 220 | # 221 | #--------------------------------------------------------------------- 222 | # MISCELLANEOUS 223 | #--------------------------------------------------------------------- 224 | # (NOTE THIS FORMAT HAS BUILTIN EXTRACTION FUNCTION) 225 | # zip y 10000000 PK\x03\x04 \x3c\xac 226 | # (NOTE THIS FORMAT HAS BUILTIN EXTRACTION FUNCTION) 227 | # rar y 10000000 Rar! 228 | # 229 | # java y 1000000 \xca\xfe\xba\xbe 230 | # 231 | # cpp y 20000 #include #include ASCII 232 | #--------------------------------------------------------------------- 233 | # ScanSoft PaperPort "Max" files 234 | #--------------------------------------------------------------------- 235 | # max y 1000000 \x56\x69\x47\x46\x6b\x1a\x00\x00\x00\x00 \x00\x00\x05\x80\x00\x00 236 | #--------------------------------------------------------------------- 237 | # PINs Password Manager program 238 | #--------------------------------------------------------------------- 239 | # pins y 8000 \x50\x49\x4e\x53\x20\x34\x2e\x32\x30\x0d 240 | -------------------------------------------------------------------------------- /foremost-1.5.7/helpers.c: -------------------------------------------------------------------------------- 1 | 2 | /* MD5DEEP - helpers.c 3 | * 4 | * By Jesse Kornblum 5 | * 6 | * This is a work of the US Government. In accordance with 17 USC 105, 7 | * copyright protection is not available for any work of the US Government. 8 | * 9 | * This program is distributed in the hope that it will be useful, but 10 | * WITHOUT ANY WARRANTY; without even the implied warranty of 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 12 | * 13 | */ 14 | 15 | #include "main.h" 16 | 17 | /* Removes any newlines at the end of the string buf. 18 | Works for both *nix and Windows styles of newlines. 19 | Returns the new length of the string. */ 20 | unsigned int chop (char *buf) 21 | { 22 | 23 | /* Windows newlines are 0x0d 0x0a, *nix are 0x0a */ 24 | unsigned int len = strlen(buf); 25 | if (buf[len - 1] == 0x0a) 26 | { 27 | if (buf[len - 2] == 0x0d) 28 | { 29 | buf[len - 2] = buf[len - 1]; 30 | } 31 | buf[len - 1] = buf[len]; 32 | } 33 | return strlen(buf); 34 | } 35 | 36 | char *units(unsigned int c) 37 | { 38 | switch (c) 39 | { 40 | case 0: return "B"; 41 | case 1: return "KB"; 42 | case 2: return "MB"; 43 | case 3: return "GB"; 44 | case 4: return "TB"; 45 | case 5: return "PB"; 46 | case 6: return "EB"; 47 | /* Steinbach's Guideline for Systems Programming: 48 | Never test for an error condition you don't know how to handle. 49 | 50 | Granted, given that no existing system can handle anything 51 | more than 18 exabytes, this shouldn't be an issue. But how do we 52 | communicate that 'this shouldn't happen' to the user? */ 53 | default: return "??"; 54 | } 55 | } 56 | 57 | char *human_readable(off_t size, char *buffer) 58 | { 59 | unsigned int count = 0; 60 | while (size > 1024) 61 | { 62 | size /= 1024; 63 | ++count; 64 | } 65 | 66 | /* The size will be, at most, 1023, and the units will be 67 | two characters no matter what. Thus, the maximum length of 68 | this string is six characters. e.g. strlen("1023 EB") = 6 */ 69 | if (sizeof(off_t) == 4) 70 | { 71 | snprintf(buffer, 8, "%u %s", (unsigned int)size, units(count)); 72 | } 73 | else if (sizeof(off_t) == 8) 74 | { 75 | snprintf(buffer, 8, "%llu %s", (u_int64_t) size, units(count)); 76 | } 77 | 78 | return buffer; 79 | } 80 | 81 | char *current_time(void) 82 | { 83 | time_t now = time(NULL); 84 | char *ascii_time = ctime(&now); 85 | chop(ascii_time); 86 | return ascii_time; 87 | } 88 | 89 | /* Shift the contents of a string so that the values after 'new_start' 90 | will now begin at location 'start' */ 91 | void shift_string(char *fn, int start, int new_start) 92 | { 93 | if (start < 0 || start > strlen(fn) || new_start < 0 || new_start < start) 94 | return; 95 | 96 | while (new_start < strlen(fn)) 97 | { 98 | fn[start] = fn[new_start]; 99 | new_start++; 100 | start++; 101 | } 102 | 103 | fn[start] = 0; 104 | } 105 | 106 | void make_magic(void) 107 | { 108 | printf("%s%s", 109 | "\x53\x41\x4E\x20\x44\x49\x4D\x41\x53\x20\x48\x49\x47\x48\x20\x53\x43\x48\x4F\x4F\x4C\x20\x46\x4F\x4F\x54\x42\x41\x4C\x4C\x20\x52\x55\x4C\x45\x53\x21", 110 | NEWLINE); 111 | } 112 | 113 | #if defined(__UNIX) 114 | 115 | /* Return the size, in bytes of an open file stream. On error, return 0 */ 116 | #if defined(__LINUX) 117 | 118 | off_t find_file_size(FILE *f) 119 | { 120 | off_t num_sectors = 0; 121 | int fd = fileno(f); 122 | struct stat sb; 123 | 124 | if (fstat(fd, &sb)) 125 | { 126 | return 0; 127 | } 128 | 129 | if (S_ISREG(sb.st_mode) || S_ISDIR(sb.st_mode)) 130 | return sb.st_size; 131 | else if (S_ISCHR(sb.st_mode) || S_ISBLK(sb.st_mode)) 132 | { 133 | if (ioctl(fd, BLKGETSIZE, &num_sectors)) 134 | { 135 | #if defined(__DEBUG) 136 | fprintf(stderr, "%s: ioctl call to BLKGETSIZE failed.%s", __progname, NEWLINE); 137 | #endif 138 | } 139 | else 140 | return (num_sectors * 512); 141 | } 142 | 143 | return 0; 144 | } 145 | 146 | #elif defined(__MACOSX) 147 | 148 | #include 149 | #include 150 | #include 151 | 152 | off_t find_file_size(FILE *f) 153 | { 154 | #ifdef DEBUG 155 | printf(" FIND MAC file size\n"); 156 | #endif 157 | return 0; /*FIX ME this function causes strange problems on MACOSX, so for now return 0*/ 158 | struct stat info; 159 | off_t total = 0; 160 | off_t original = ftello(f); 161 | int ok = TRUE, fd = fileno(f); 162 | 163 | /* I'd prefer not to use fstat as it will follow symbolic links. We don't 164 | follow symbolic links. That being said, all symbolic links *should* 165 | have been caught before we got here. */ 166 | fstat(fd, &info); 167 | 168 | /* Block devices, like /dev/hda, don't return a normal filesize. 169 | If we are working with a block device, we have to ask the operating 170 | system to tell us the true size of the device. 171 | 172 | The following only works on Linux as far as I know. If you know 173 | how to port this code to another operating system, please contact 174 | the current maintainer of this program! */ 175 | if (S_ISBLK(info.st_mode)) 176 | { 177 | daddr_t blocksize = 0; 178 | daddr_t blockcount = 0; 179 | 180 | /* Get the block size */ 181 | if (ioctl(fd, DKIOCGETBLOCKSIZE, blocksize) < 0) 182 | { 183 | ok = FALSE; 184 | #if defined(__DEBUG) 185 | perror("DKIOCGETBLOCKSIZE failed"); 186 | #endif 187 | } 188 | 189 | /* Get the number of blocks */ 190 | if (ok) 191 | { 192 | if (ioctl(fd, DKIOCGETBLOCKCOUNT, blockcount) < 0) 193 | { 194 | #if defined(__DEBUG) 195 | perror("DKIOCGETBLOCKCOUNT failed"); 196 | #endif 197 | } 198 | } 199 | 200 | total = blocksize * blockcount; 201 | 202 | } 203 | 204 | else 205 | { 206 | 207 | /* I don't know why, but if you don't initialize this value you'll 208 | get wildly innacurate results when you try to run this function */ 209 | if ((fseeko(f, 0, SEEK_END))) 210 | return 0; 211 | total = ftello(f); 212 | if ((fseeko(f, original, SEEK_SET))) 213 | return 0; 214 | } 215 | 216 | return (total - original); 217 | } 218 | 219 | #else 220 | 221 | /* This is code for general UNIX systems 222 | (e.g. NetBSD, FreeBSD, OpenBSD, etc) */ 223 | static off_t midpoint(off_t a, off_t b, long blksize) 224 | { 225 | off_t aprime = a / blksize; 226 | off_t bprime = b / blksize; 227 | off_t c, cprime; 228 | 229 | cprime = (bprime - aprime) / 2 + aprime; 230 | c = cprime * blksize; 231 | 232 | return c; 233 | } 234 | 235 | off_t find_dev_size(int fd, int blk_size) 236 | { 237 | 238 | off_t curr = 0, amount = 0; 239 | void *buf; 240 | 241 | if (blk_size == 0) 242 | return 0; 243 | 244 | buf = malloc(blk_size); 245 | 246 | for (;;) 247 | { 248 | ssize_t nread; 249 | 250 | lseek(fd, curr, SEEK_SET); 251 | nread = read(fd, buf, blk_size); 252 | if (nread < blk_size) 253 | { 254 | if (nread <= 0) 255 | { 256 | if (curr == amount) 257 | { 258 | free(buf); 259 | lseek(fd, 0, SEEK_SET); 260 | return amount; 261 | } 262 | 263 | curr = midpoint(amount, curr, blk_size); 264 | } 265 | else 266 | { /* 0 < nread < blk_size */ 267 | free(buf); 268 | lseek(fd, 0, SEEK_SET); 269 | return amount + nread; 270 | } 271 | } 272 | else 273 | { 274 | amount = curr + blk_size; 275 | curr = amount * 2; 276 | } 277 | } 278 | 279 | free(buf); 280 | lseek(fd, 0, SEEK_SET); 281 | return amount; 282 | } 283 | 284 | off_t find_file_size(FILE *f) 285 | { 286 | int fd = fileno(f); 287 | struct stat sb; 288 | return 0; /*FIX ME SOLARIS FILE SIZE CAUSES SEG FAULT, for now just return 0*/ 289 | 290 | if (fstat(fd, &sb)) 291 | return 0; 292 | 293 | if (S_ISREG(sb.st_mode) || S_ISDIR(sb.st_mode)) 294 | return sb.st_size; 295 | else if (S_ISCHR(sb.st_mode) || S_ISBLK(sb.st_mode)) 296 | return find_dev_size(fd, sb.st_blksize); 297 | 298 | return 0; 299 | } 300 | 301 | #endif /* UNIX Flavors */ 302 | #endif /* ifdef __UNIX */ 303 | 304 | #if defined(__WIN32) 305 | off_t find_file_size(FILE *f) 306 | { 307 | off_t total = 0, original = ftello(f); 308 | 309 | if ((fseeko(f, 0, SEEK_END))) 310 | return 0; 311 | 312 | total = ftello(f); 313 | if ((fseeko(f, original, SEEK_SET))) 314 | return 0; 315 | 316 | return total; 317 | } 318 | 319 | #endif /* ifdef __WIN32 */ 320 | 321 | void print_search_specs(f_state *s) 322 | { 323 | int i = 0; 324 | int j = 0; 325 | printf("\nDUMPING BUILTIN SEARCH INFO\n\t"); 326 | for (i = 0; i < s->num_builtin; i++) 327 | { 328 | 329 | printf("%s:\n\t footer_len:=%d, header_len:=%d, max_len:=%llu ", 330 | search_spec[i].suffix, 331 | search_spec[i].footer_len, 332 | search_spec[i].header_len, 333 | search_spec[i].max_len); 334 | printf("\n\t header:\t"); 335 | printx(search_spec[i].header, 0, search_spec[i].header_len); 336 | printf("\t footer:\t"); 337 | printx(search_spec[i].footer, 0, search_spec[i].footer_len); 338 | for (j = 0; j < search_spec[i].num_markers; j++) 339 | { 340 | printf("\tmarker: \t"); 341 | printx(search_spec[i].markerlist[j].value, 0, search_spec[i].markerlist[j].len); 342 | } 343 | 344 | } 345 | 346 | } 347 | 348 | void print_stats(f_state *s) 349 | { 350 | int i = 0; 351 | audit_msg(s, "\n%d FILES EXTRACTED\n\t", s->fileswritten); 352 | for (i = 0; i < s->num_builtin; i++) 353 | { 354 | 355 | if (search_spec[i].found != 0) 356 | { 357 | if (search_spec[i].type == OLE) 358 | search_spec[i].suffix = "ole"; 359 | else if (search_spec[i].type == RIFF) 360 | search_spec[i].suffix = "rif"; 361 | else if (search_spec[i].type == ZIP) 362 | search_spec[i].suffix = "zip"; 363 | audit_msg(s, "%s:= %d", search_spec[i].suffix, search_spec[i].found); 364 | } 365 | } 366 | } 367 | 368 | int charactersMatch(char a, char b, int caseSensitive) 369 | { 370 | 371 | //if(a==b) return 1; 372 | if (a == wildcard || a == b) 373 | return 1; 374 | if (caseSensitive || (a < 'A' || a > 'z' || b < 'A' || b > 'z')) 375 | return 0; 376 | 377 | /* This line is equivalent to (abs(a-b)) == 'a' - 'A' */ 378 | return (abs(a - b) == 32); 379 | } 380 | 381 | int memwildcardcmp(const void *s1, const void *s2, size_t n, int caseSensitive) 382 | { 383 | if (n != 0) 384 | { 385 | register const unsigned char *p1 = s1, *p2 = s2; 386 | do 387 | { 388 | if (!charactersMatch(*p1++, *p2++, caseSensitive)) 389 | return (*--p1 -*--p2); 390 | } 391 | while (--n != 0); 392 | } 393 | 394 | return (0); 395 | } 396 | 397 | void printx(unsigned char *buf, int start, int end) 398 | { 399 | int i = 0; 400 | for (i = start; i < end; i++) 401 | { 402 | printf("%x ", buf[i]); 403 | } 404 | 405 | printf("\n"); 406 | } 407 | 408 | char *reverse_string(char *to, char *from, int startLocation, int endLocation) 409 | { 410 | int i = endLocation; 411 | int j = 0; 412 | for (j = startLocation; j < endLocation; j++) 413 | { 414 | i--; 415 | to[j] = from[i]; 416 | } 417 | 418 | return to; 419 | } 420 | 421 | unsigned short htos(unsigned char s[], int endian) 422 | { 423 | 424 | unsigned char *bytes = (unsigned char *)malloc(sizeof(unsigned short) * sizeof(char)); 425 | unsigned short size = 0; 426 | char temp = 'x'; 427 | bytes = memcpy(bytes, s, sizeof(short)); 428 | 429 | if (endian == FOREMOST_BIG_ENDIAN && BYTE_ORDER == LITTLE_ENDIAN) 430 | { 431 | 432 | //printf("switching the byte order\n"); 433 | temp = bytes[0]; 434 | bytes[0] = bytes[1]; 435 | bytes[1] = temp; 436 | 437 | } 438 | else if (endian == FOREMOST_LITTLE_ENDIAN && BYTE_ORDER == BIG_ENDIAN) 439 | { 440 | temp = bytes[0]; 441 | bytes[0] = bytes[1]; 442 | bytes[1] = temp; 443 | } 444 | 445 | size = *((unsigned short *)bytes); 446 | free(bytes); 447 | return size; 448 | } 449 | 450 | unsigned int htoi(unsigned char s[], int endian) 451 | { 452 | 453 | int length = sizeof(int); 454 | unsigned char *bytes = (unsigned char *)malloc(length * sizeof(char)); 455 | unsigned int size = 0; 456 | 457 | bytes = memcpy(bytes, s, length); 458 | 459 | if (endian == FOREMOST_BIG_ENDIAN && BYTE_ORDER == LITTLE_ENDIAN) 460 | { 461 | 462 | bytes = (unsigned char *)reverse_string((char *)bytes, (char *)s, 0, length); 463 | } 464 | else if (endian == FOREMOST_LITTLE_ENDIAN && BYTE_ORDER == BIG_ENDIAN) 465 | { 466 | 467 | bytes = (unsigned char *)reverse_string((char *)bytes, (char *)s, 0, length); 468 | } 469 | 470 | size = *((unsigned int *)bytes); 471 | 472 | free(bytes); 473 | return size; 474 | } 475 | 476 | u_int64_t htoll(unsigned char s[], int endian) 477 | { 478 | int length = sizeof(u_int64_t); 479 | unsigned char *bytes = (unsigned char *)malloc(length * sizeof(char)); 480 | u_int64_t size = 0; 481 | bytes = memcpy(bytes, s, length); 482 | #ifdef DEBUG 483 | printf("htoll len=%d endian=%d\n",length,endian); 484 | #endif 485 | if (endian == FOREMOST_BIG_ENDIAN && BYTE_ORDER == LITTLE_ENDIAN) 486 | { 487 | #ifdef DEBUG 488 | printf("reverse0\n"); 489 | #endif 490 | bytes = (unsigned char *)reverse_string((char *)bytes, (char *)s, 0, length); 491 | } 492 | else if (endian == FOREMOST_LITTLE_ENDIAN && BYTE_ORDER == BIG_ENDIAN) 493 | { 494 | #ifdef DEBUG 495 | printf("reverse1\n"); 496 | #endif 497 | bytes = (unsigned char *)reverse_string((char *)bytes, (char *)s, 0, length); 498 | } 499 | 500 | size = *((u_int64_t *)bytes); 501 | #ifdef DEBUG 502 | printf("htoll size=%llu\n",size); 503 | printx(bytes,0,length); 504 | #endif 505 | 506 | 507 | free(bytes); 508 | return size; 509 | } 510 | 511 | /* display Position: Tell the user how far through the infile we are */ 512 | int displayPosition(f_state *s, f_info *i, u_int64_t pos) 513 | { 514 | 515 | int percentDone = 0; 516 | static int last_val = 0; 517 | int count; 518 | int flag = FALSE; 519 | int factor = 4; 520 | int multiplier = 25; 521 | int number_of_stars = 0; 522 | char buffer[256]; 523 | long double skip = s->skip * s->block_size; 524 | 525 | long double tot_bytes = (long double)((i->total_bytes)); 526 | tot_bytes -= skip; 527 | if (i->total_bytes > 0) 528 | { 529 | percentDone = (((long double)pos) / ((long double)tot_bytes)) * 100; 530 | if (percentDone != last_val) 531 | flag = TRUE; 532 | last_val = percentDone; 533 | } 534 | else 535 | { 536 | flag = TRUE; 537 | factor = 4; 538 | multiplier = 25; 539 | } 540 | 541 | if (flag) 542 | { 543 | number_of_stars = percentDone / factor; 544 | 545 | printf("%s: |", s->input_file); 546 | for (count = 0; count < number_of_stars; count++) 547 | { 548 | printf("*"); 549 | } 550 | 551 | for (count = 0; count < (multiplier - number_of_stars); count++) 552 | { 553 | printf(" "); 554 | } 555 | 556 | if (i->total_bytes > 0) 557 | { 558 | printf("|\t %d%% done\n", percentDone); 559 | } 560 | else 561 | { 562 | printf("|\t %s done\n", human_readable(pos, buffer)); 563 | 564 | } 565 | } 566 | 567 | if (percentDone == 100) 568 | { 569 | last_val = 0; 570 | } 571 | 572 | return TRUE; 573 | } 574 | -------------------------------------------------------------------------------- /foremost-1.5.7/main.c: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | /* FOREMOST 5 | * 6 | * By Jesse Kornblum and Kris Kendall 7 | * 8 | * This is a work of the US Government. In accordance with 17 USC 105, 9 | * copyright protection is not available for any work of the US Government. 10 | * 11 | * This program is distributed in the hope that it will be useful, but 12 | * WITHOUT ANY WARRANTY; without even the implied warranty of 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 14 | * 15 | * 16 | */ 17 | #include "main.h" 18 | 19 | #ifdef __WIN32 20 | 21 | /* Allows us to open standard input in binary mode by default 22 | See http://gnuwin32.sourceforge.net/compile.html for more */ 23 | int _CRT_fmode = _O_BINARY; 24 | #endif 25 | 26 | void catch_alarm(int signum) 27 | { 28 | signal_caught = signum; 29 | signal(signum, catch_alarm); 30 | } 31 | 32 | void register_signal_handler(void) 33 | { 34 | signal_caught = 0; 35 | 36 | if (signal(SIGINT, catch_alarm) == SIG_IGN) 37 | signal(SIGINT, SIG_IGN); 38 | if (signal(SIGTERM, catch_alarm) == SIG_IGN) 39 | signal(SIGTERM, SIG_IGN); 40 | 41 | #ifndef __WIN32 42 | 43 | /* Note: I haven't found a way to get notified of 44 | console resize events in Win32. Right now the statusbar 45 | will be too long or too short if the user decides to resize 46 | their console window while foremost runs.. */ 47 | 48 | /* RBF - Handle TTY events */ 49 | 50 | // The function setttywidth is in the old helpers.c 51 | // signal(SIGWINCH, setttywidth); 52 | #endif 53 | } 54 | 55 | void try_msg(void) 56 | { 57 | fprintf(stderr, "Try `%s -h` for more information.%s", __progname, NEWLINE); 58 | } 59 | 60 | /* The usage function should, at most, display 22 lines of text to fit 61 | on a single screen */ 62 | void usage(void) 63 | { 64 | fprintf(stderr, "%s version %s by %s.%s", __progname, VERSION, AUTHOR, NEWLINE); 65 | fprintf(stderr, 66 | "%s %s [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t ] [-s ] [-k ] \n\t[-b ] [-c ] [-o ] [-i time_stamp = TRUE; 162 | break; 163 | 164 | case 't': 165 | 166 | /*See if we have multiple file types to define*/ 167 | ptr1 = ptr2 = optarg; 168 | while (1) 169 | { 170 | if (!*ptr2) 171 | { 172 | if (!set_search_def(s, ptr1, 0)) 173 | { 174 | usage(); 175 | exit(EXIT_SUCCESS); 176 | } 177 | break; 178 | } 179 | 180 | if (*ptr2 == ',') 181 | { 182 | *ptr2 = '\0'; 183 | if (!set_search_def(s, ptr1, 0)) 184 | { 185 | usage(); 186 | exit(EXIT_SUCCESS); 187 | } 188 | 189 | *ptr2++ = ','; 190 | ptr1 = ptr2; 191 | } 192 | else 193 | { 194 | ptr2++; 195 | } 196 | } 197 | break; 198 | 199 | case 'h': 200 | usage(); 201 | exit(EXIT_SUCCESS); 202 | 203 | case 'V': 204 | printf("%s%s", VERSION, NEWLINE); 205 | 206 | /* We could just say printf(COPYRIGHT), but that's a good way 207 | to introduce a format string vulnerability. Better to always 208 | use good programming practice... */ 209 | printf("%s", COPYRIGHT); 210 | exit(EXIT_SUCCESS); 211 | 212 | default: 213 | try_msg(); 214 | exit(EXIT_FAILURE); 215 | 216 | } 217 | 218 | } 219 | 220 | #ifdef __DEBUG 221 | dump_state(s); 222 | #endif 223 | 224 | } 225 | 226 | int main(int argc, char **argv) 227 | { 228 | 229 | FILE *testFile = NULL; 230 | f_state *s = (f_state *)malloc(sizeof(f_state)); 231 | int input_files = 0; 232 | char **temp = argv; 233 | DIR* dir; 234 | 235 | #ifndef __GLIBC__ 236 | __progname = basename(argv[0]); 237 | #endif 238 | 239 | /*Initialize the global state struct*/ 240 | if (initialize_state(s, argc, argv)) 241 | fatal_error(s, "Unable to initialize state"); 242 | 243 | register_signal_handler(); 244 | process_command_line(argc, argv, s); 245 | 246 | load_config_file(s); 247 | 248 | if (s->num_builtin == 0) 249 | { 250 | 251 | /*Nothing specified via the command line or the conf 252 | file so default to all builtin search types*/ 253 | set_search_def(s, "all", 0); 254 | } 255 | 256 | if (create_output_directory(s)) 257 | fatal_error(s, "Unable to open output directory"); 258 | 259 | if (!get_mode(s, mode_write_audit)) 260 | { 261 | create_sub_dirs(s); 262 | } 263 | 264 | if (open_audit_file(s)) 265 | fatal_error(s, "Can't open audit file"); 266 | 267 | /* Scan for valid files to open */ 268 | while (*argv != NULL) 269 | { 270 | if(strcmp(*argv,"-c")==0) 271 | { 272 | /*jump past the conf file so we don't process it.*/ 273 | argv+=2; 274 | } 275 | testFile = fopen(*argv, "rb"); 276 | if (testFile) 277 | { 278 | fclose(testFile); 279 | dir = opendir(*argv); 280 | 281 | if(!strstr(s->config_file,*argv)!=0 && !dir) 282 | { 283 | input_files++; 284 | } 285 | 286 | if(dir) closedir(dir); 287 | } 288 | 289 | ++argv; 290 | } 291 | 292 | argv = temp; 293 | if (input_files > 1) 294 | { 295 | set_mode(s, mode_multi_file); 296 | } 297 | 298 | ++argv; 299 | while (*argv != NULL) 300 | { 301 | testFile = fopen(*argv, "rb"); 302 | 303 | if (testFile) 304 | { 305 | fclose(testFile); 306 | dir = opendir(*argv); 307 | if(!strstr(s->config_file,*argv)!=0 && !dir) 308 | { 309 | set_input_file(s, *argv); 310 | process_file(s); 311 | } 312 | if(dir) closedir(dir); 313 | } 314 | 315 | ++argv; 316 | } 317 | 318 | if (input_files == 0) 319 | { 320 | 321 | //printf("using stdin\n"); 322 | process_stdin(s); 323 | } 324 | 325 | print_stats(s); 326 | 327 | /*Lets try to clean up some of the extra sub_dirs*/ 328 | cleanup_output(s); 329 | 330 | if (close_audit_file(s)) 331 | { 332 | 333 | /* Hells bells. This is bad, but really, what can we do about it? 334 | Let's just report the error and try to get out of here! */ 335 | print_error(s, AUDIT_FILE_NAME, "Error closing audit file"); 336 | } 337 | 338 | free_state(s); 339 | free(s); 340 | return EXIT_SUCCESS; 341 | } 342 | -------------------------------------------------------------------------------- /foremost-1.5.7/main.h: -------------------------------------------------------------------------------- 1 | 2 | /* FOREMOST 3 | * 4 | * By Jesse Kornblum 5 | * 6 | * This is a work of the US Government. In accordance with 17 USC 105, 7 | * copyright protection is not available for any work of the US Government. 8 | * 9 | * This program is distributed in the hope that it will be useful, but 10 | * WITHOUT ANY WARRANTY; without even the implied warranty of 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 12 | * 13 | */ 14 | 15 | //#define DEBUG 1 16 | 17 | #ifndef __FOREMOST_H 18 | #define __FOREMOST_H 19 | 20 | /* Version information is defined in the Makefile */ 21 | 22 | #define AUTHOR "Jesse Kornblum, Kris Kendall, and Nick Mikus" 23 | 24 | /* We use \r\n for newlines as this has to work on Win32. It's redundant for 25 | everybody else, but shouldn't cause any harm. */ 26 | #define COPYRIGHT "This program is a work of the US Government. "\ 27 | "In accordance with 17 USC 105,\r\n"\ 28 | "copyright protection is not available for any work of the US Government.\r\n"\ 29 | "This is free software; see the source for copying conditions. There is NO\r\n"\ 30 | "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\r\n" 31 | 32 | #define _GNU_SOURCE 33 | #include 34 | #include 35 | #include 36 | #include 37 | #include 38 | #include 39 | #include 40 | #include 41 | #include 42 | #include 43 | #include 44 | #include 45 | #include 46 | 47 | /* For va_arg */ 48 | #include 49 | 50 | #ifdef __LINUX 51 | #include 52 | #include 53 | #define u_int64_t unsigned long long 54 | #endif 55 | 56 | 57 | #ifdef __LINUX 58 | 59 | #ifndef __USE_BSD 60 | #define __USE_BSD 61 | #endif 62 | #include 63 | 64 | #elif defined (__SOLARIS) 65 | 66 | #define BIG_ENDIAN 4321 67 | #define LITTLE_ENDIAN 1234 68 | 69 | #include 70 | #ifdef _BIG_ENDIAN 71 | #define BYTE_ORDER BIG_ENDIAN 72 | #else 73 | #define BYTE_ORDER LITTLE_ENDIAN 74 | #endif 75 | 76 | #elif defined (__WIN32) 77 | #include 78 | 79 | #elif defined (__MACOSX) 80 | #include 81 | #define __U16_TYPE unsigned short 82 | #endif 83 | 84 | 85 | #define TRUE 1 86 | #define FALSE 0 87 | #define ONE_MEGABYTE 1048576 88 | 89 | 90 | /* RBF - Do we need these type definitions? */ 91 | #ifdef __SOLARIS 92 | #define u_int32_t unsigned int 93 | #define u_int64_t unsigned long long 94 | #endif 95 | 96 | 97 | /* The only time we're *not* on a UNIX system is when we're on Windows */ 98 | #ifndef __WIN32 99 | #ifndef __UNIX 100 | #define __UNIX 101 | #endif /* ifndef __UNIX */ 102 | #endif /* ifndef __WIN32 */ 103 | 104 | 105 | #ifdef __UNIX 106 | 107 | #ifndef __U16_TYPE 108 | #define __U16_TYPE unsigned short 109 | #endif 110 | 111 | #include 112 | 113 | #ifndef BYTE_ORDER 114 | 115 | #define BIG_ENDIAN 4321 116 | #define LITTLE_ENDIAN 1234 117 | 118 | #define BYTE_ORDER LITTLE_ENDIAN 119 | 120 | #endif 121 | /* This avoids compiler warnings on older systems */ 122 | int fseeko(FILE *stream, off_t offset, int whence); 123 | off_t ftello(FILE *stream); 124 | 125 | 126 | #define CMD_PROMPT "$" 127 | #define DIR_SEPARATOR '/' 128 | #define NEWLINE "\n" 129 | #define LINE_LENGTH 74 130 | #define BLANK_LINE \ 131 | " " 132 | 133 | #endif /* #ifdef __UNIX */ 134 | 135 | /* This allows us to open standard input in binary mode by default 136 | See http://gnuwin32.sourceforge.net/compile.html for more */ 137 | #include 138 | 139 | /* Code specific to Microsoft Windows */ 140 | #ifdef __WIN32 141 | 142 | /* By default, Windows uses long for off_t. This won't do. We 143 | need an unsigned number at minimum. Windows doesn't have 64 bit 144 | numbers though. */ 145 | #ifdef off_t 146 | #undef off_t 147 | #endif 148 | #define off_t unsigned long 149 | 150 | #define CMD_PROMPT "c:\\>" 151 | #define DIR_SEPARATOR '\\' 152 | #define NEWLINE "\r\n" 153 | #define LINE_LENGTH 72 154 | #define BLANK_LINE \ 155 | " " 156 | 157 | 158 | /* It would be nice to use 64-bit file lengths in Windows */ 159 | #define ftello ftell 160 | #define fseeko fseek 161 | 162 | #ifndef __CYGWIN 163 | #define snprintf _snprintf 164 | #endif 165 | 166 | #define u_int32_t unsigned long 167 | 168 | /* We create macros for the Windows equivalent UNIX functions. 169 | No worries about lstat to stat; Windows doesn't have symbolic links */ 170 | #define lstat(A,B) stat(A,B) 171 | 172 | #define u_int64_t unsigned __int64 173 | 174 | #ifndef __CYGWIN 175 | #define realpath(A,B) _fullpath(B,A,PATH_MAX) 176 | #endif 177 | /* Not used in md5deep anymore, but left in here in case I 178 | ever need it again. Win32 documentation searches are evil. 179 | int asprintf(char **strp, const char *fmt, ...); 180 | */ 181 | 182 | char *basename(char *a); 183 | extern char *optarg; 184 | extern int optind; 185 | int getopt(int argc, char *const argv[], const char *optstring); 186 | 187 | #endif /* ifdef _WIN32 */ 188 | 189 | 190 | /* On non-glibc systems we have to manually set the __progname variable */ 191 | #ifdef __GLIBC__ 192 | extern char *__progname; 193 | #else 194 | char *__progname; 195 | #endif /* ifdef __GLIBC__ */ 196 | 197 | /* ----------------------------------------------------------------- 198 | Program Defaults 199 | ----------------------------------------------------------------- */ 200 | #define MAX_STRING_LENGTH 1024 201 | #define COMMENT_LENGTH 64 202 | 203 | /* Modes refer to options that can be set by the user. */ 204 | 205 | #define mode_none 0 206 | #define mode_verbose 1<<1 207 | #define mode_quiet 1<<2 208 | #define mode_ind_blk 1<<3 209 | #define mode_quick 1<<4 210 | #define mode_write_all 1<<5 211 | #define mode_write_audit 1<<6 212 | #define mode_multi_file 1<<7 213 | 214 | #define MAX_NEEDLES 254 215 | #define NUM_SEARCH_SPEC_ELEMENTS 6 216 | #define MAX_SUFFIX_LENGTH 8 217 | #define MAX_FILE_TYPES 100 218 | #define FOREMOST_NOEXTENSION_SUFFIX "NONE" 219 | /* Modes 3 to 31 are reserved for future use. We shouldn't use 220 | modes higher than 31 as Win32 can't go that high. */ 221 | 222 | #define DEFAULT_MODE mode_none 223 | #define DEFAULT_CONFIG_FILE "foremost.conf" 224 | #define DEFAULT_OUTPUT_DIRECTORY "output" 225 | #define AUDIT_FILE_NAME "audit.txt" 226 | #define FOREMOST_DIVIDER "------------------------------------------------------------------" 227 | 228 | #define JPEG 0 229 | #define GIF 1 230 | #define BMP 2 231 | #define MPG 3 232 | #define PDF 4 233 | #define DOC 5 234 | #define AVI 6 235 | #define WMV 7 236 | #define HTM 8 237 | #define ZIP 9 238 | #define MOV 10 239 | #define XLS 11 240 | #define PPT 12 241 | #define WPD 13 242 | #define CPP 14 243 | #define OLE 15 244 | #define GZIP 16 245 | #define RIFF 17 246 | #define WAV 18 247 | #define VJPEG 19 248 | #define SXW 20 249 | #define SXC 21 250 | #define SXI 22 251 | #define CONF 23 252 | #define PNG 24 253 | #define RAR 25 254 | #define EXE 26 255 | #define ELF 27 256 | #define REG 28 257 | #define DOCX 29 258 | #define XLSX 30 259 | #define PPTX 31 260 | #define MP4 32 261 | 262 | 263 | #define KILOBYTE 1024 264 | #define MEGABYTE 1024 * KILOBYTE 265 | #define GIGABYTE 1024 * MEGABYTE 266 | #define TERABYTE 1024 * GIGABYTE 267 | #define PETABYTE 1024 * TERABYTE 268 | #define EXABYTE 1024 * PETABYTE 269 | 270 | #define UNITS_BYTES 0 271 | #define UNITS_KILOB 1 272 | #define UNITS_MEGAB 2 273 | #define UNITS_GIGAB 3 274 | #define UNITS_TERAB 4 275 | #define UNITS_PETAB 5 276 | #define UNITS_EXAB 6 277 | 278 | #define SEARCHTYPE_FORWARD 0 279 | #define SEARCHTYPE_REVERSE 1 280 | #define SEARCHTYPE_FORWARD_NEXT 2 281 | #define SEARCHTYPE_ASCII 3 282 | 283 | #define FOREMOST_BIG_ENDIAN 0 284 | #define FOREMOST_LITTLE_ENDIAN 1 285 | /*DEFAULT CHUNK SIZE In MB*/ 286 | #define CHUNK_SIZE 100 287 | 288 | 289 | /* Wildcard is a global variable because it's used by very simple 290 | functions that don't need the whole state passed to them */ 291 | 292 | /* ----------------------------------------------------------------- 293 | State Variable and Global Variables 294 | ----------------------------------------------------------------- */ 295 | char wildcard; 296 | typedef struct f_state 297 | { 298 | off_t mode; 299 | char *config_file; 300 | char *input_file; 301 | char *output_directory; 302 | char *start_time; 303 | char *invocation; 304 | char *audit_file_name; 305 | FILE *audit_file; 306 | int audit_file_open; 307 | int num_builtin; 308 | int chunk_size; /*IN MB*/ 309 | int fileswritten; 310 | int block_size; 311 | int skip; 312 | 313 | int time_stamp; 314 | } f_state; 315 | 316 | typedef struct marker 317 | { 318 | unsigned char* value; 319 | int len; 320 | size_t marker_bm_table[UCHAR_MAX+1]; 321 | }marker; 322 | 323 | typedef struct s_spec 324 | { 325 | char* suffix; 326 | int type; 327 | u_int64_t max_len; 328 | unsigned char* header; 329 | unsigned int header_len; 330 | size_t header_bm_table[UCHAR_MAX+1]; 331 | 332 | unsigned char* footer; 333 | unsigned int footer_len; 334 | size_t footer_bm_table[UCHAR_MAX+1]; 335 | marker markerlist[5]; 336 | int num_markers; 337 | int searchtype; 338 | 339 | int case_sen; 340 | 341 | int found; 342 | 343 | char comment[MAX_STRING_LENGTH];/*Used for audit*/ 344 | int written; /*used for -a mode*/ 345 | }s_spec; 346 | 347 | s_spec search_spec[50]; /*ARRAY OF BUILTIN SEARCH TYPES*/ 348 | 349 | typedef struct f_info { 350 | char *file_name; 351 | off_t total_bytes; 352 | 353 | /* We never use the total number of bytes in a file, 354 | only the number of megabytes when we display a time estimate */ 355 | off_t total_megs; 356 | off_t bytes_read; 357 | 358 | #ifdef __WIN32 359 | /* Win32 is a 32-bit operating system and can't handle file sizes 360 | larger than 4GB. We use this to keep track of overflows */ 361 | off_t last_read; 362 | off_t overflow_count; 363 | #endif 364 | 365 | FILE *handle; 366 | int is_stdin; 367 | } f_info; 368 | 369 | /* Set if the user hits ctrl-c */ 370 | int signal_caught; 371 | 372 | /* ----------------------------------------------------------------- 373 | Function definitions 374 | ----------------------------------------------------------------- */ 375 | 376 | /* State functions */ 377 | 378 | int initialize_state(f_state *s, int argc, char **argv); 379 | void free_state(f_state *s); 380 | 381 | char *get_invocation(f_state *s); 382 | char *get_start_time(f_state *s); 383 | 384 | int set_config_file(f_state *s, char *fn); 385 | char* get_config_file(f_state *s); 386 | 387 | int set_output_directory(f_state *s, char *fn); 388 | char* get_output_directory(f_state *s); 389 | 390 | void set_audit_file_open(f_state *s); 391 | int get_audit_file_open(f_state *s); 392 | 393 | void set_mode(f_state *s, off_t new_mode); 394 | int get_mode(f_state *s, off_t check_mode); 395 | 396 | int set_search_def(f_state *s,char* ft,u_int64_t max_file_size); 397 | void get_search_def(f_state s); 398 | 399 | void set_input_file(f_state *s,char* filename); 400 | void get_input_file(f_state *s); 401 | 402 | void set_chunk(f_state *s, int size); 403 | 404 | void init_bm_table(unsigned char *needle, size_t table[UCHAR_MAX + 1], size_t len, int casesensitive,int searchtype); 405 | 406 | void set_skip(f_state *s, int size); 407 | void set_block(f_state *s, int size); 408 | 409 | 410 | #ifdef __DEBUG 411 | void dump_state(f_state *s); 412 | #endif 413 | 414 | /* The audit file */ 415 | int open_audit_file(f_state *s); 416 | void audit_msg(f_state *s, char *format, ...); 417 | int close_audit_file(f_state *s); 418 | 419 | 420 | /* Set up our output directory */ 421 | int create_output_directory(f_state *s); 422 | int write_to_disk(f_state *s,s_spec * needle,u_int64_t len,unsigned char* buf, u_int64_t t_offset); 423 | int create_sub_dirs(f_state *s); 424 | void cleanup_output(f_state *s); 425 | 426 | /* Configuration Files */ 427 | int load_config_file(f_state *s); 428 | 429 | 430 | /* Helper functions */ 431 | char *current_time(void); 432 | off_t find_file_size(FILE *f); 433 | char *human_readable(off_t size, char *buffer); 434 | char *units(unsigned int c); 435 | unsigned int chop(char *buf); 436 | void print_search_specs(f_state *s); 437 | int memwildcardcmp(const void *s1, const void *s2,size_t n,int caseSensitive); 438 | int charactersMatch(char a, char b, int caseSensitive); 439 | void printx(unsigned char* buf,int start, int end); 440 | unsigned short htos(unsigned char s[],int endian); 441 | unsigned int htoi(unsigned char s[],int endian); 442 | u_int64_t htoll(unsigned char s[],int endian); 443 | int displayPosition(f_state* s,f_info* i,u_int64_t pos); 444 | 445 | 446 | /* Interface functions 447 | These functions stay the same regardless if we're using a 448 | command line interface or a GUI */ 449 | void fatal_error(f_state *s, char *msg); 450 | void print_error(f_state *s, char *fn, char *msg); 451 | void print_message(f_state *s, char *format, va_list argp); 452 | void print_stats(f_state *s); 453 | 454 | /* Engine */ 455 | int process_file(f_state *s); 456 | int process_stdin(f_state *s); 457 | unsigned char *bm_search(unsigned char *needle, size_t needle_len,unsigned char *haystack, size_t haystack_len, 458 | size_t table[UCHAR_MAX + 1], int case_sen,int searchtype); 459 | unsigned char *bm_search_skipn(unsigned char *needle, size_t needle_len,unsigned char *haystack, size_t haystack_len, 460 | size_t table[UCHAR_MAX + 1], int casesensitive,int searchtype, int start_pos) ; 461 | #endif /* __FOREMOST_H */ 462 | 463 | /* BUILTIN */ 464 | unsigned char* extract_file(f_state *s, u_int64_t c_offset,unsigned char *foundat, u_int64_t buflen, s_spec * needle, u_int64_t f_offset); 465 | 466 | 467 | 468 | 469 | 470 | -------------------------------------------------------------------------------- /foremost-1.5.7/ole.h: -------------------------------------------------------------------------------- 1 | #define TRUE 1 2 | #define FALSE 0 3 | #define SPECIAL_BLOCK - 3 4 | #define END_OF_CHAIN - 2 5 | #define UNUSED - 1 6 | 7 | #define NO_ENTRY 0 8 | #define STORAGE 1 9 | #define STREAM 2 10 | #define ROOT 5 11 | #define SHORT_BLOCK 3 12 | 13 | #define FAT_START 0x4c 14 | #define OUR_BLK_SIZE 512 15 | #define DIRS_PER_BLK 4 16 | #ifndef __CYGWIN 17 | #define MIN(x, y) ((x) < (y) ? (x) : (y)) 18 | #endif 19 | 20 | #include 21 | #include 22 | #include 23 | #include 24 | #include 25 | #include 26 | #include 27 | #include 28 | #include 29 | 30 | struct OLE_HDR 31 | { 32 | char magic[8]; /*0*/ 33 | char clsid[16]; /*8*/ 34 | __U16_TYPE uMinorVersion; /*24*/ 35 | __U16_TYPE uDllVersion; /*26*/ 36 | __U16_TYPE uByteOrder; /*28*/ 37 | __U16_TYPE uSectorShift; /*30*/ 38 | __U16_TYPE uMiniSectorShift; /*32*/ 39 | __U16_TYPE reserved; /*34*/ 40 | u_int32_t reserved1; /*36*/ 41 | u_int32_t reserved2; /*40*/ 42 | u_int32_t num_FAT_blocks; /*44*/ 43 | u_int32_t root_start_block; /*48*/ 44 | u_int32_t dfsignature; /*52*/ 45 | u_int32_t miniSectorCutoff; /*56*/ 46 | u_int32_t dir_flag; /*60 first sec in the mini fat chain*/ 47 | u_int32_t csectMiniFat; /*64 number of sectors in the minifat */ 48 | u_int32_t FAT_next_block; /*68*/ 49 | u_int32_t num_extra_FAT_blocks; /*72*/ 50 | /* FAT block list starts here !! first 109 entries */ 51 | }; 52 | 53 | struct OLE_DIR 54 | { 55 | char name[64]; 56 | unsigned short namsiz; 57 | char type; 58 | char bflags; //0 or 1 59 | unsigned long prev_dirent; 60 | unsigned long next_dirent; 61 | unsigned long dir_dirent; 62 | char clsid[16]; 63 | unsigned long userFlags; 64 | int secs1; 65 | int days1; 66 | int secs2; 67 | int days2; 68 | unsigned long start_block; //starting SECT of stream 69 | unsigned long size; 70 | short reserved; //must be 0 71 | }; 72 | 73 | struct DIRECTORY 74 | { 75 | char name[64]; 76 | int type; 77 | int level; 78 | int start_block; 79 | int size; 80 | int next; 81 | int prev; 82 | int dir; 83 | int s1; 84 | int s2; 85 | int d1; 86 | int d2; 87 | } 88 | *dirlist, *dl; 89 | 90 | int get_dir_block(unsigned char *fd, int blknum, int buffersize); 91 | int get_dir_info(unsigned char *src); 92 | void extract_stream(char *fd, int blknum, int size); 93 | void dump_header(struct OLE_HDR *h); 94 | int dump_dirent(int which_one); 95 | int get_block(unsigned char *fd, int blknum, unsigned char *dest, long long int buffersize); 96 | int get_FAT_block(unsigned char *fd, int blknum, int *dest, int buffersize); 97 | int reorder_dirlist(struct DIRECTORY *dir, int level); 98 | 99 | unsigned char *get_ole_block(unsigned char *fd, int blknum, unsigned long long buffersize); 100 | struct OLE_HDR *reverseBlock(struct OLE_HDR *dest, struct OLE_HDR *h); 101 | 102 | void dump_ole_header(struct OLE_HDR *h); 103 | void *Malloc(size_t bytes); 104 | void die(char *fmt, void *arg); 105 | void init_ole(); 106 | -------------------------------------------------------------------------------- /foremost-1.5.7/state.c: -------------------------------------------------------------------------------- 1 | 2 | 3 | #include "main.h" 4 | 5 | int initialize_state (f_state * s, int argc, char **argv) 6 | { 7 | char **argv_copy = argv; 8 | 9 | /* The routines in current_time return statically allocated memory. 10 | We strdup the result so that we don't accidently free() the wrong 11 | thing later on. */ 12 | s->start_time = strdup(current_time()); 13 | wildcard = '?'; 14 | s->audit_file_open = FALSE; 15 | s->mode = DEFAULT_MODE; 16 | s->input_file = NULL; 17 | s->fileswritten = 0; 18 | s->block_size = 512; 19 | 20 | /* We use the setter fuctions here to call realpath */ 21 | set_config_file(s, DEFAULT_CONFIG_FILE); 22 | set_output_directory(s, DEFAULT_OUTPUT_DIRECTORY); 23 | 24 | s->invocation = (char *)malloc(sizeof(char) * MAX_STRING_LENGTH); 25 | s->invocation[0] = 0; 26 | s->chunk_size = CHUNK_SIZE; 27 | s->num_builtin = 0; 28 | s->skip = 0; 29 | s->time_stamp = FALSE; 30 | do 31 | { 32 | strncat(s->invocation, *argv_copy, MAX_STRING_LENGTH - strlen(s->invocation)); 33 | strncat(s->invocation, " ", MAX_STRING_LENGTH - strlen(s->invocation)); 34 | ++argv_copy; 35 | } 36 | while (*argv_copy); 37 | 38 | return FALSE; 39 | } 40 | 41 | void free_state(f_state *s) 42 | { 43 | free(s->start_time); 44 | free(s->output_directory); 45 | free(s->config_file); 46 | } 47 | 48 | int get_audit_file_open(f_state *s) 49 | { 50 | return (s->audit_file_open); 51 | } 52 | 53 | char *get_invocation(f_state *s) 54 | { 55 | return (s->invocation); 56 | } 57 | 58 | char *get_start_time(f_state *s) 59 | { 60 | return (s->start_time); 61 | } 62 | 63 | char *get_config_file(f_state *s) 64 | { 65 | return (s->config_file); 66 | } 67 | 68 | int set_config_file(f_state *s, char *fn) 69 | { 70 | char temp[PATH_MAX]; 71 | 72 | /* If the configuration file doesn't exist, this realpath will return 73 | NULL. We don't error check here as the user may specify a file 74 | that doesn't currently exist */ 75 | realpath(fn, temp); 76 | 77 | /* RBF - Does this create a memory leak? What happens to the old value? */ 78 | s->config_file = strdup(temp); 79 | return FALSE; 80 | } 81 | 82 | char *get_output_directory(f_state *s) 83 | { 84 | return (s->output_directory); 85 | } 86 | 87 | int set_output_directory(f_state *s, char *fn) 88 | { 89 | char temp[PATH_MAX]; 90 | int fullpathlen=0; 91 | /* We don't error check here as it's quite possible that the 92 | output directory doesn't exist yet. If it doesn't, realpath 93 | resolves the path correctly, but still returns NULL. */ 94 | //strncpy(s->output_directory,fn,PATH_MAX); 95 | 96 | realpath(fn, temp); 97 | fullpathlen=strlen(temp); 98 | 99 | if(fullpathlen!=0) 100 | { 101 | s->output_directory = strdup(temp); 102 | } 103 | else 104 | { 105 | /*Realpath failed just use cwd*/ 106 | s->output_directory = strdup(fn); 107 | } 108 | return FALSE; 109 | } 110 | 111 | int get_mode(f_state *s, off_t check_mode) 112 | { 113 | return (s->mode & check_mode); 114 | } 115 | 116 | void set_mode(f_state *s, off_t new_mode) 117 | { 118 | s->mode |= new_mode; 119 | } 120 | 121 | void set_chunk(f_state *s, int size) 122 | { 123 | s->chunk_size = size; 124 | } 125 | 126 | void set_skip(f_state *s, int size) 127 | { 128 | s->skip = size; 129 | } 130 | 131 | void set_block(f_state *s, int size) 132 | { 133 | s->block_size = size; 134 | } 135 | 136 | void write_audit_header(f_state *s) 137 | { 138 | audit_msg(s, "Foremost version %s by %s", VERSION, AUTHOR); 139 | audit_msg(s, "Audit File"); 140 | audit_msg(s, ""); 141 | audit_msg(s, "Foremost started at %s", get_start_time(s)); 142 | audit_msg(s, "Invocation: %s", get_invocation(s)); 143 | audit_msg(s, "Output directory: %s", get_output_directory(s)); 144 | audit_msg(s, "Configuration file: %s", get_config_file(s)); 145 | } 146 | 147 | int open_audit_file(f_state *s) 148 | { 149 | char fn[MAX_STRING_LENGTH]; 150 | 151 | snprintf(fn, 152 | MAX_STRING_LENGTH, 153 | "%s%c%s", 154 | get_output_directory(s), 155 | DIR_SEPARATOR, 156 | AUDIT_FILE_NAME); 157 | 158 | if ((s->audit_file = fopen(fn, "w")) == NULL) 159 | { 160 | print_error(s, fn, strerror(errno)); 161 | fatal_error(s, "Can't open audit file"); 162 | } 163 | 164 | s->audit_file_open = TRUE; 165 | write_audit_header(s); 166 | 167 | return FALSE; 168 | } 169 | 170 | int close_audit_file(f_state *s) 171 | { 172 | audit_msg(s, FOREMOST_DIVIDER); 173 | audit_msg(s, ""); 174 | audit_msg(s, "Foremost finished at %s", current_time()); 175 | 176 | if (fclose(s->audit_file)) 177 | { 178 | print_error(s, AUDIT_FILE_NAME, strerror(errno)); 179 | return TRUE; 180 | } 181 | 182 | return FALSE; 183 | } 184 | 185 | void audit_msg(f_state *s, char *format, ...) 186 | { 187 | va_list argp; 188 | va_start(argp, format); 189 | 190 | if (get_mode(s, mode_verbose)) { 191 | print_message(s, format, argp); 192 | va_end(argp); 193 | va_start(argp, format); 194 | } 195 | 196 | vfprintf(s->audit_file, format, argp); 197 | va_end(argp); 198 | 199 | fprintf(s->audit_file, "%s", NEWLINE); 200 | fflush(stdout); 201 | } 202 | 203 | void set_input_file(f_state *s, char *filename) 204 | { 205 | s->input_file = (char *)malloc((strlen(filename) + 1) * sizeof(char)); 206 | strncpy(s->input_file, filename, strlen(filename) + 1); 207 | } 208 | 209 | /*Initialize any search specs*/ 210 | int init_builtin(f_state *s, int type, char *suffix, char *header, char *footer, int header_len, 211 | int footer_len, u_int64_t max_len, int case_sen) 212 | { 213 | 214 | int i = s->num_builtin; 215 | 216 | search_spec[i].type = type; 217 | search_spec[i].suffix = (char *)malloc((strlen(suffix)+1) * sizeof(char)); 218 | search_spec[i].num_markers = 0; 219 | strcpy(search_spec[i].suffix, suffix); 220 | 221 | search_spec[i].header_len = header_len; 222 | search_spec[i].footer_len = footer_len; 223 | 224 | search_spec[i].max_len = max_len; 225 | search_spec[i].found = 0; 226 | search_spec[i].header = (unsigned char *)malloc(search_spec[i].header_len * sizeof(unsigned char)); 227 | search_spec[i].footer = (unsigned char *)malloc(search_spec[i].footer_len * sizeof(unsigned char)); 228 | search_spec[i].case_sen = case_sen; 229 | memset(search_spec[i].comment, 0, COMMENT_LENGTH - 1); 230 | 231 | memcpy(search_spec[i].header, header, search_spec[i].header_len); 232 | memcpy(search_spec[i].footer, footer, search_spec[i].footer_len); 233 | 234 | init_bm_table(search_spec[i].header, 235 | search_spec[i].header_bm_table, 236 | search_spec[i].header_len, 237 | search_spec[i].case_sen, 238 | SEARCHTYPE_FORWARD); 239 | init_bm_table(search_spec[i].footer, 240 | search_spec[i].footer_bm_table, 241 | search_spec[i].footer_len, 242 | search_spec[i].case_sen, 243 | SEARCHTYPE_FORWARD); 244 | s->num_builtin++; 245 | 246 | return i; 247 | } 248 | 249 | /*Markers are a method to search for any unique information besides just the header and the footer*/ 250 | void add_marker(f_state *s, int index, char *marker, int markerlength) 251 | { 252 | int i = search_spec[index].num_markers; 253 | if (marker == NULL) 254 | { 255 | search_spec[index].num_markers = 0; 256 | return; 257 | } 258 | 259 | search_spec[index].markerlist[i].len = markerlength; 260 | search_spec[index].markerlist[i].value = (unsigned char *)malloc(search_spec[index].markerlist[i].len * sizeof(unsigned char)); 261 | 262 | memcpy(search_spec[index].markerlist[i].value, marker, search_spec[index].markerlist[i].len); 263 | init_bm_table(search_spec[index].markerlist[i].value, 264 | search_spec[index].markerlist[i].marker_bm_table, 265 | search_spec[index].markerlist[i].len, 266 | TRUE, 267 | SEARCHTYPE_FORWARD); 268 | search_spec[index].num_markers++; 269 | } 270 | 271 | /*Initial every search spec we know about*/ 272 | void init_all(f_state *state) 273 | { 274 | int index = 0; 275 | init_builtin(state, JPEG, "jpg", "\xff\xd8\xff", "\xff\xd9", 3, 2, 20 * MEGABYTE, TRUE); 276 | index = init_builtin(state, GIF, "gif", "\x47\x49\x46\x38", "\x00\x3b", 4, 2, MEGABYTE, TRUE); 277 | add_marker(state, index, "\x00\x00\x3b", 3); 278 | init_builtin(state, BMP, "bmp", "BM", NULL, 2, 0, 2 * MEGABYTE, TRUE); 279 | init_builtin(state, 280 | WMV, 281 | "wmv", 282 | "\x30\x26\xB2\x75\x8E\x66\xCF\x11", 283 | "\xA1\xDC\xAB\x8C\x47\xA9", 284 | 8, 285 | 6, 286 | 40 * MEGABYTE, 287 | TRUE); 288 | init_builtin(state, MOV, "mov", "moov", NULL, 4, 0, 40 * MEGABYTE, TRUE); 289 | init_builtin(state, MP4, "mp4", "\x00\x00\x00\x1c\x66\x74\x79\x70", NULL, 8, 0, 600 * MEGABYTE, TRUE); 290 | init_builtin(state, RIFF, "rif", "RIFF", "INFO", 4, 4, 20 * MEGABYTE, TRUE); 291 | init_builtin(state, HTM, "htm", "", 5, 7, MEGABYTE, FALSE); 292 | init_builtin(state, 293 | OLE, 294 | "ole", 295 | "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00", 296 | NULL, 297 | 16, 298 | 0, 299 | 5 * MEGABYTE, 300 | TRUE); 301 | init_builtin(state, 302 | ZIP, 303 | "zip", 304 | "\x50\x4B\x03\x04", 305 | "\x4b\x05\x06\x00", 306 | 4, 307 | 4, 308 | 100 * MEGABYTE, 309 | TRUE); 310 | init_builtin(state, 311 | RAR, 312 | "rar", 313 | "\x52\x61\x72\x21\x1A\x07\x00", 314 | "\x00\x00\x00\x00\x00\x00\x00\x00", 315 | 7, 316 | 8, 317 | 100 * MEGABYTE, 318 | TRUE); 319 | init_builtin(state, EXE, "exe", "MZ", NULL, 2, 0, 1 * MEGABYTE, TRUE); 320 | 321 | index = init_builtin(state, 322 | PNG, 323 | "png", 324 | "\x89\x50\x4E\x47\x0D\x0A\x1A\x0A", 325 | "IEND", 326 | 8, 327 | 4, 328 | 1 * MEGABYTE, 329 | TRUE); 330 | index = init_builtin(state, 331 | MPG, 332 | "mpg", 333 | "\x00\x00\x01\xba", 334 | "\x00\x00\x01\xb9", 335 | 4, 336 | 4, 337 | 50 * MEGABYTE, 338 | TRUE); 339 | add_marker(state, index, "\x00\x00\x01", 3); 340 | 341 | index = init_builtin(state, PDF, "pdf", "%PDF-1.", "%%EOF", 7, 5, 40 * MEGABYTE, TRUE); 342 | add_marker(state, index, "/L ", 3); 343 | add_marker(state, index, "obj", 3); 344 | add_marker(state, index, "/Linearized", 11); 345 | add_marker(state, index, "/Length", 7); 346 | } 347 | 348 | /*Process any command line args following the -t switch)*/ 349 | int set_search_def(f_state *s, char *ft, u_int64_t max_file_size) 350 | { 351 | int index = 0; 352 | 353 | if (strcmp(ft, "jpg") == 0 || strcmp(ft, "jpeg") == 0) 354 | { 355 | if (max_file_size == 0) 356 | max_file_size = 20 * MEGABYTE; 357 | init_builtin(s, JPEG, "jpg", "\xff\xd8\xff", "\xff\xd9", 3, 2, max_file_size, TRUE); 358 | } 359 | else if (strcmp(ft, "gif") == 0) 360 | { 361 | if (max_file_size == 0) 362 | max_file_size = 1 * MEGABYTE; 363 | index = init_builtin(s, 364 | GIF, 365 | "gif", 366 | "\x47\x49\x46\x38", 367 | "\x00\x3b", 368 | 4, 369 | 2, 370 | max_file_size, 371 | TRUE); 372 | 373 | add_marker(s, index, "\x00\x00\x3b", 3); 374 | } 375 | else if (strcmp(ft, "bmp") == 0) 376 | { 377 | 378 | if (max_file_size == 0) 379 | max_file_size = 2 * MEGABYTE; 380 | 381 | init_builtin(s, BMP, "bmp", "BM", NULL, 2, 0, max_file_size, TRUE); 382 | } 383 | else if (strcmp(ft, "mp4") == 0) 384 | { 385 | init_builtin(s, MP4, "mp4", "\x00\x00\x00\x1c\x66\x74\x79\x70", NULL, 8, 0, 600 * MEGABYTE, TRUE); 386 | } 387 | else if (strcmp(ft, "exe") == 0) 388 | { 389 | 390 | if (max_file_size == 0) 391 | max_file_size = 1 * MEGABYTE; 392 | 393 | init_builtin(s, EXE, "exe", "MZ", NULL, 2, 0, max_file_size, TRUE); 394 | } 395 | else if (strcmp(ft, "elf") == 0) 396 | { 397 | 398 | if (max_file_size == 0) 399 | max_file_size = 1 * MEGABYTE; 400 | 401 | init_builtin(s, ELF, "elf", "0x7fELF", NULL, 4, 0, max_file_size, TRUE); 402 | } 403 | else if (strcmp(ft, "reg") == 0) 404 | { 405 | 406 | if (max_file_size == 0) 407 | max_file_size = 2 * MEGABYTE; 408 | 409 | init_builtin(s, REG, "reg", "regf", NULL, 4, 0, max_file_size, TRUE); 410 | 411 | } 412 | else if (strcmp(ft, "mpg") == 0 || strcmp(ft, "mpeg") == 0) 413 | { 414 | if (max_file_size == 0) 415 | max_file_size = 50 * MEGABYTE; 416 | 417 | //20000000 \x00\x00\x01\xb3 \x00\x00\x01\xb7 //system data 418 | index = init_builtin(s, 419 | MPG, 420 | "mpg", 421 | "\x00\x00\x01\xba", 422 | "\x00\x00\x01\xb9", 423 | 4, 424 | 4, 425 | max_file_size, 426 | TRUE); 427 | add_marker(s, index, "\x00\x00\x01", 3); 428 | 429 | /* 430 | add_marker(s,index,"\x00\x00\x01\xBB",4); 431 | add_marker(s,index,"\x00\x00\x01\xBE",4); 432 | add_marker(s,index,"\x00\x00\x01\xB3",4); 433 | */ 434 | } 435 | else if (strcmp(ft, "wmv") == 0) 436 | { 437 | 438 | if (max_file_size == 0) 439 | max_file_size = 20 * MEGABYTE; 440 | 441 | init_builtin(s, 442 | WMV, 443 | "wmv", 444 | "\x30\x26\xB2\x75\x8E\x66\xCF\x11", 445 | "\xA1\xDC\xAB\x8C\x47\xA9", 446 | 8, 447 | 6, 448 | max_file_size, 449 | TRUE); 450 | } 451 | else if (strcmp(ft, "avi") == 0) 452 | { 453 | 454 | if (max_file_size == 0) 455 | max_file_size = 20 * MEGABYTE; 456 | 457 | init_builtin(s, AVI, "avi", "RIFF", "INFO", 4, 4, max_file_size, TRUE); 458 | } 459 | 460 | else if (strcmp(ft, "rif") == 0) 461 | { 462 | 463 | if (max_file_size == 0) 464 | max_file_size = 20 * MEGABYTE; 465 | init_builtin(s, RIFF, "rif", "RIFF", "INFO", 4, 4, max_file_size, TRUE); 466 | } 467 | else if (strcmp(ft, "wav") == 0) 468 | { 469 | 470 | if (max_file_size == 0) 471 | max_file_size = 20 * MEGABYTE; 472 | init_builtin(s, WAV, "wav", "RIFF", "INFO", 4, 4, max_file_size, TRUE); 473 | 474 | } 475 | else if (strcmp(ft, "html") == 0 || strcmp(ft, "htm") == 0) 476 | { 477 | 478 | if (max_file_size == 0) 479 | max_file_size = 1 * MEGABYTE; 480 | init_builtin(s, HTM, "htm", "", 5, 7, max_file_size, FALSE); 481 | } 482 | 483 | else if (strcmp(ft, "ole") == 0 || strcmp(ft, "office") == 0) 484 | { 485 | 486 | if (max_file_size == 0) 487 | max_file_size = 10 * MEGABYTE; 488 | init_builtin(s, 489 | OLE, 490 | "ole", 491 | "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00", 492 | NULL, 493 | 16, 494 | 0, 495 | max_file_size, 496 | TRUE); 497 | } 498 | else if (strcmp(ft, "doc") == 0) 499 | { 500 | if (max_file_size == 0) 501 | max_file_size = 20 * MEGABYTE; 502 | init_builtin(s, 503 | DOC, 504 | "doc", 505 | "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00", 506 | NULL, 507 | 16, 508 | 0, 509 | max_file_size, 510 | TRUE); 511 | } 512 | else if (strcmp(ft, "xls") == 0) 513 | { 514 | if (max_file_size == 0) 515 | max_file_size = 10 * MEGABYTE; 516 | 517 | init_builtin(s, 518 | XLS, 519 | "xls", 520 | "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00", 521 | NULL, 522 | 16, 523 | 0, 524 | max_file_size, 525 | TRUE); 526 | 527 | } 528 | else if (strcmp(ft, "ppt") == 0) 529 | { 530 | 531 | if (max_file_size == 0) 532 | max_file_size = 10 * MEGABYTE; 533 | init_builtin(s, 534 | PPT, 535 | "ppt", 536 | "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00", 537 | NULL, 538 | 16, 539 | 0, 540 | max_file_size, 541 | TRUE); 542 | } 543 | else if (strcmp(ft, "zip") == 0) 544 | { 545 | if (max_file_size == 0) 546 | max_file_size = 100 * MEGABYTE; 547 | 548 | init_builtin(s, 549 | ZIP, 550 | "zip", 551 | "\x50\x4B\x03\x04", 552 | "\x50\x4b\x05\x06", 553 | 4, 554 | 4, 555 | max_file_size, 556 | TRUE); 557 | 558 | } 559 | else if (strcmp(ft, "rar") == 0) 560 | { 561 | if (max_file_size == 0) 562 | max_file_size = 100 * MEGABYTE; 563 | 564 | init_builtin(s, 565 | RAR, 566 | "rar", 567 | "\x52\x61\x72\x21\x1A\x07\x00", 568 | "\x00\x00\x00\x00\x00\x00\x00\x00", 569 | 7, 570 | 8, 571 | max_file_size, 572 | TRUE); 573 | 574 | } 575 | else if (strcmp(ft, "sxw") == 0) 576 | { 577 | if (max_file_size == 0) 578 | max_file_size = 10 * MEGABYTE; 579 | 580 | init_builtin(s, 581 | SXW, 582 | "sxw", 583 | "\x50\x4B\x03\x04", 584 | "\x4b\x05\x06\x00", 585 | 4, 586 | 4, 587 | max_file_size, 588 | TRUE); 589 | 590 | } 591 | else if (strcmp(ft, "sxc") == 0) 592 | { 593 | if (max_file_size == 0) 594 | max_file_size = 10 * MEGABYTE; 595 | 596 | init_builtin(s, 597 | SXC, 598 | "sxc", 599 | "\x50\x4B\x03\x04", 600 | "\x4b\x05\x06\x00", 601 | 4, 602 | 4, 603 | max_file_size, 604 | TRUE); 605 | 606 | } 607 | else if (strcmp(ft, "sxi") == 0) 608 | { 609 | if (max_file_size == 0) 610 | max_file_size = 10 * MEGABYTE; 611 | 612 | init_builtin(s, 613 | SXI, 614 | "sxi", 615 | "\x50\x4B\x03\x04", 616 | "\x4b\x05\x06\x00", 617 | 4, 618 | 4, 619 | max_file_size, 620 | TRUE); 621 | 622 | } 623 | else if (strcmp(ft, "docx") == 0) 624 | { 625 | if (max_file_size == 0) 626 | max_file_size = 10 * MEGABYTE; 627 | 628 | init_builtin(s, 629 | DOCX, 630 | "docx", 631 | "\x50\x4B\x03\x04", 632 | "\x4b\x05\x06\x00", 633 | 4, 634 | 4, 635 | max_file_size, 636 | TRUE); 637 | 638 | } 639 | else if (strcmp(ft, "pptx") == 0) 640 | { 641 | if (max_file_size == 0) 642 | max_file_size = 10 * MEGABYTE; 643 | 644 | init_builtin(s, 645 | PPTX, 646 | "pptx", 647 | "\x50\x4B\x03\x04", 648 | "\x4b\x05\x06\x00", 649 | 4, 650 | 4, 651 | max_file_size, 652 | TRUE); 653 | 654 | } 655 | else if (strcmp(ft, "xlsx") == 0) 656 | { 657 | if (max_file_size == 0) 658 | max_file_size = 10 * MEGABYTE; 659 | 660 | init_builtin(s, 661 | XLSX, 662 | "xlsx", 663 | "\x50\x4B\x03\x04", 664 | "\x4b\x05\x06\x00", 665 | 4, 666 | 4, 667 | max_file_size, 668 | TRUE); 669 | 670 | } 671 | else if (strcmp(ft, "gzip") == 0 || strcmp(ft, "gz") == 0) 672 | { 673 | if (max_file_size == 0) 674 | max_file_size = 100 * MEGABYTE; 675 | 676 | init_builtin(s, GZIP, "gz", "\x1F\x8B", "\x00\x00\x00\x00", 2, 4, max_file_size, TRUE); 677 | } 678 | else if (strcmp(ft, "pdf") == 0) 679 | { 680 | if (max_file_size == 0) 681 | max_file_size = 20 * MEGABYTE; 682 | 683 | index = init_builtin(s, PDF, "pdf", "%PDF-1.", "%%EOF", 7, 5, max_file_size, TRUE); 684 | add_marker(s, index, "/L ", 3); 685 | add_marker(s, index, "obj", 3); 686 | add_marker(s, index, "/Linearized", 11); 687 | add_marker(s, index, "/Length", 7); 688 | } 689 | else if (strcmp(ft, "vjpeg") == 0) 690 | { 691 | if (max_file_size == 0) 692 | max_file_size = 40 * MEGABYTE; 693 | init_builtin(s, VJPEG, "mov", "pnot", NULL, 4, 0, max_file_size, TRUE); 694 | } 695 | else if (strcmp(ft, "mov") == 0) 696 | { 697 | if (max_file_size == 0) 698 | max_file_size = 40 * MEGABYTE; 699 | 700 | init_builtin(s, MOV, "mov", "moov", NULL, 4, 0, max_file_size, TRUE); 701 | } 702 | else if (strcmp(ft, "wpd") == 0) 703 | { 704 | if (max_file_size == 0) 705 | max_file_size = 1 * MEGABYTE; 706 | 707 | init_builtin(s, WPD, "wpd", "\xff\x57\x50\x43", NULL, 4, 0, max_file_size, TRUE); 708 | } 709 | else if (strcmp(ft, "cpp") == 0) 710 | { 711 | if (max_file_size == 0) 712 | max_file_size = 1 * MEGABYTE; 713 | 714 | index = init_builtin(s, CPP, "cpp", "#include", "char", 8, 4, max_file_size, TRUE); 715 | add_marker(s, index, "int", 3); 716 | } 717 | else if (strcmp(ft, "png") == 0) 718 | { 719 | if (max_file_size == 0) 720 | max_file_size = 1 * MEGABYTE; 721 | index = init_builtin(s, 722 | PNG, 723 | "png", 724 | "\x89\x50\x4E\x47\x0D\x0A\x1A\x0A", 725 | "IEND", 726 | 8, 727 | 4, 728 | max_file_size, 729 | TRUE); 730 | } 731 | else if (strcmp(ft, "all") == 0) 732 | { 733 | init_all(s); 734 | } 735 | else 736 | { 737 | return FALSE; 738 | } 739 | 740 | return TRUE; 741 | 742 | } 743 | 744 | void init_bm_table(unsigned char *needle, size_t table[UCHAR_MAX + 1], size_t len, int casesensitive, 745 | int searchtype) 746 | { 747 | size_t i = 0, j = 0, currentindex = 0; 748 | 749 | for (i = 0; i <= UCHAR_MAX; i++) 750 | table[i] = len; 751 | for (i = 0; i < len; i++) 752 | { 753 | if (searchtype == SEARCHTYPE_REVERSE) 754 | { 755 | 756 | currentindex = i; //If we are running our searches backwards 757 | //we count from the beginning of the string 758 | } 759 | else 760 | { 761 | currentindex = len - i - 1; //Count from the back of string 762 | } 763 | 764 | if (needle[i] == wildcard) //No skip entry can advance us past the last wildcard in the string 765 | { 766 | for (j = 0; j <= UCHAR_MAX; j++) 767 | table[j] = currentindex; 768 | } 769 | 770 | table[(unsigned char)needle[i]] = currentindex; 771 | if (!casesensitive) 772 | { 773 | 774 | //RBF - this is a little kludgy but it works and this isn't the part 775 | //of the code we really need to worry about optimizing... 776 | //If we aren't case sensitive we just set both the upper and lower case 777 | //entries in the jump table. 778 | table[tolower(needle[i])] = currentindex; 779 | table[toupper(needle[i])] = currentindex; 780 | } 781 | } 782 | } 783 | 784 | #ifdef __DEBUG 785 | void dump_state(f_state *s) 786 | { 787 | printf("Current state:\n"); 788 | printf("Config file: %s\n", s->config_file); 789 | printf("Output directory: %s\n", s->output_directory); 790 | printf("Mode: %llu\n", s->mode); 791 | 792 | } 793 | #endif 794 | --------------------------------------------------------------------------------