Formatação (cargo fmt) e ajustes do clippy para o CI da 1.0.0
Release / Cria a release (push) Canceled after 0s
Release / CLI (linux-aarch64) (push) Canceled after 0s
Release / CLI (linux-x86_64) (push) Canceled after 0s
Release / CLI (macos-aarch64) (push) Canceled after 0s
Release / CLI (macos-x86_64) (push) Canceled after 0s
Release / CLI (windows-x86_64) (push) Canceled after 0s
Release / App desktop (linux-x86_64) (push) Canceled after 0s
Release / App desktop (macos-aarch64) (push) Canceled after 0s
Release / App desktop (macos-x86_64) (push) Canceled after 0s
Release / App desktop (windows-x86_64) (push) Canceled after 0s
Release / Publica a release (push) Canceled after 0s

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Lucas RayanandClaude Opus 5.5 committed 2026-10-19 11:41:58 -03:00
1 parent 74218e7beb
commit beb83fef92
49 files changed
+3806 -854

No files matched your search

+170 -48
View File
@@ -16,7 +16,10 @@ use std::sync::Mutex;
pub fn is_aff4(head: &[u8]) -> bool {
// ZIP local file header + primeiro nome "container.description" ou "version.txt".
head.len() > 50 && head.starts_with(b"PK\x03\x04") && (find(&head[30..head.len().min(80)], b"container.description") || find(&head[30..head.len().min(80)], b"version.txt"))
head.len() > 50
&& head.starts_with(b"PK\x03\x04")
&& (find(&head[30..head.len().min(80)], b"container.description")
|| find(&head[30..head.len().min(80)], b"version.txt"))
}
fn find(h: &[u8], n: &[u8]) -> bool {
@@ -35,7 +38,10 @@ struct Resource {
impl Resource {
fn get(&self, k: &str) -> Option<&str> {
self.props.get(k).and_then(|v| v.first()).map(|s| s.as_str())
self.props
.get(k)
.and_then(|v| v.first())
.map(|s| s.as_str())
}
fn num(&self, k: &str) -> Option<u64> {
self.get(k)?.parse().ok()
@@ -111,7 +117,10 @@ impl Turtle<'_> {
}
_ => {
let s = self.i;
while self.i < self.b.len() && !self.b[self.i].is_ascii_whitespace() && !matches!(self.b[self.i], b';' | b',') {
while self.i < self.b.len()
&& !self.b[self.i].is_ascii_whitespace()
&& !matches!(self.b[self.i], b';' | b',')
{
self.i += 1;
}
// ponto final de sentença colado ao termo
@@ -128,7 +137,11 @@ impl Turtle<'_> {
}
fn parse_turtle(text: &str) -> HashMap<String, Resource> {
let mut t = Turtle { b: text.as_bytes(), i: 0, prefixes: HashMap::new() };
let mut t = Turtle {
b: text.as_bytes(),
i: 0,
prefixes: HashMap::new(),
};
let mut out: HashMap<String, Resource> = HashMap::new();
loop {
t.ws();
@@ -153,12 +166,14 @@ fn parse_turtle(text: &str) -> HashMap<String, Resource> {
continue;
}
// sujeito
let Some(subj) = (if t.b[t.i] == b':' && t.b.get(t.i + 1).map_or(true, |c| c.is_ascii_whitespace()) {
t.i += 1;
Some(t.prefixes.get("").cloned().unwrap_or_default())
} else {
t.term()
}) else {
let Some(subj) =
(if t.b[t.i] == b':' && t.b.get(t.i + 1).map_or(true, |c| c.is_ascii_whitespace()) {
t.i += 1;
Some(t.prefixes.get("").cloned().unwrap_or_default())
} else {
t.term()
})
else {
break;
};
let res = out.entry(subj).or_default();
@@ -278,14 +293,23 @@ fn method_of(uri: &str) -> Method {
impl Aff4Source {
pub fn open(path: &Path) -> Result<Self> {
let file = File::open(path)?;
let mut zip = zip::ZipArchive::new(file.try_clone()?).map_err(|e| Error::msg(format!("AFF4 inválido (ZIP): {e}")))?;
let mut zip = zip::ZipArchive::new(file.try_clone()?)
.map_err(|e| Error::msg(format!("AFF4 inválido (ZIP): {e}")))?;
let mut entries = HashMap::new();
for i in 0..zip.len() {
let f = zip.by_index_raw(i).map_err(|e| Error::msg(e.to_string()))?;
entries.insert(f.name().to_string(), Loc { data_start: f.data_start(), size: f.compressed_size() });
entries.insert(
f.name().to_string(),
Loc {
data_start: f.data_start(),
size: f.compressed_size(),
},
);
}
let turtle = {
let mut f = zip.by_name("information.turtle").map_err(|_| Error::msg("AFF4 sem information.turtle"))?;
let mut f = zip
.by_name("information.turtle")
.map_err(|_| Error::msg("AFF4 sem information.turtle"))?;
let mut s = String::new();
f.read_to_string(&mut s)?;
s
@@ -297,19 +321,30 @@ impl Aff4Source {
let image = res
.values()
.find(|r| (r.is(&img_t) || r.is(&disk_t)) && r.get(&ds).is_some())
.ok_or_else(|| Error::msg("AFF4 sem objeto de imagem (aff4:Image com aff4:dataStream)"))?;
.ok_or_else(|| {
Error::msg("AFF4 sem objeto de imagem (aff4:Image com aff4:dataStream)")
})?;
let mut info = HashMap::new();
if let Some(v) = image.get(&format!("{NS}diskModel")) {
info.insert("Modelo do disco".to_string(), v.to_string());
}
for (k, label) in [("caseNumber", "Número do caso"), ("examiner", "Examinador"), ("notes", "Notas"), ("evidenceNumber", "Número da evidência"), ("caseName", "Nome do caso")] {
for (k, label) in [
("caseNumber", "Número do caso"),
("examiner", "Examinador"),
("notes", "Notas"),
("evidenceNumber", "Número da evidência"),
("caseName", "Nome do caso"),
] {
if let Some(v) = res.values().find_map(|r| r.get(&format!("{NS}{k}"))) {
info.insert(label.to_string(), v.to_string());
}
}
let data_urn = image.get(&ds).unwrap().to_string();
// Hashes gravados no fluxo de dados (ou no mapa).
for r in res.values().filter(|r| r.get(&format!("{NS}hash")).is_some()) {
for r in res
.values()
.filter(|r| r.get(&format!("{NS}hash")).is_some())
{
for h in r.props.get(&format!("{NS}hash")).into_iter().flatten() {
match h.len() {
32 if h.chars().all(|c| c.is_ascii_hexdigit()) => {
@@ -333,7 +368,9 @@ impl Aff4Source {
cache: Mutex::new(None),
index_cache: Mutex::new(HashMap::new()),
};
let top = res.get(&data_urn).ok_or_else(|| Error::msg("AFF4: fluxo de dados da imagem não encontrado"))?;
let top = res
.get(&data_urn)
.ok_or_else(|| Error::msg("AFF4: fluxo de dados da imagem não encontrado"))?;
let map_t = format!("{NS}Map");
if top.is(&map_t) {
me.size = top.num(&format!("{NS}size")).unwrap_or(0);
@@ -345,7 +382,8 @@ impl Aff4Source {
continue;
}
if let Some(sym) = line.strip_prefix(&format!("{NS}SymbolicStream")) {
let b = u8::from_str_radix(sym, 16).map_err(|_| Error::msg("AFF4: fluxo simbólico inválido"))?;
let b = u8::from_str_radix(sym, 16)
.map_err(|_| Error::msg("AFF4: fluxo simbólico inválido"))?;
me.targets.push(Target::Fill(b));
} else if line == format!("{NS}Zero") {
me.targets.push(Target::Zero);
@@ -372,7 +410,12 @@ impl Aff4Source {
me.size = s.size;
me.streams.push(s);
me.targets.push(Target::Stream(0));
me.map = vec![MapEntry { start: 0, len: me.size, target_off: 0, target: 0 }];
me.map = vec![MapEntry {
start: 0,
len: me.size,
target_off: 0,
target: 0,
}];
}
if me.size == 0 {
me.size = image.num(&format!("{NS}size")).unwrap_or(0);
@@ -381,20 +424,29 @@ impl Aff4Source {
}
fn load_stream(&self, res: &HashMap<String, Resource>, urn: &str) -> Result<ImageStream> {
let r = res.get(urn).ok_or_else(|| Error::msg(format!("AFF4: fluxo {urn} não descrito")))?;
let r = res
.get(urn)
.ok_or_else(|| Error::msg(format!("AFF4: fluxo {urn} não descrito")))?;
Ok(ImageStream {
urn: urn.to_string(),
chunk: r.num(&format!("{NS}chunkSize")).unwrap_or(32768),
per_bevy: r.num(&format!("{NS}chunksInSegment")).unwrap_or(2048),
method: r.get(&format!("{NS}compressionMethod")).map(method_of).unwrap_or(Method::Stored),
method: r
.get(&format!("{NS}compressionMethod"))
.map(method_of)
.unwrap_or(Method::Stored),
size: r.num(&format!("{NS}size")).unwrap_or(0),
})
}
/// MD5 do primeiro fluxo de blocos (o que o AFF4 grava em `aff4:hash`), para conferir a integridade.
pub fn verify_stream_md5(&self) -> Result<Option<bool>> {
let Some(want) = self.info.get("md5").cloned() else { return Ok(None) };
let Some(st) = self.streams.first() else { return Ok(None) };
let Some(want) = self.info.get("md5").cloned() else {
return Ok(None);
};
let Some(st) = self.streams.first() else {
return Ok(None);
};
let mut h = MultiHasher::new();
let mut buf = vec![0u8; st.chunk as usize];
let mut pos = 0u64;
@@ -408,7 +460,10 @@ impl Aff4Source {
}
fn read_entry(&self, name: &str) -> Result<Vec<u8>> {
let loc = self.entries.get(name).ok_or_else(|| Error::msg(format!("AFF4: entrada {name} ausente")))?;
let loc = self
.entries
.get(name)
.ok_or_else(|| Error::msg(format!("AFF4: entrada {name} ausente")))?;
let mut v = vec![0u8; loc.size as usize];
read_exact_at_file(&self.file, loc.data_start, &mut v)?;
Ok(v)
@@ -431,7 +486,9 @@ impl Aff4Source {
if let Some(i) = ic.get(&(si, bevy)) {
i.clone()
} else {
let loc = self.entries.get(&format!("{base}.index")).ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "índice do bevy ausente"))?;
let loc = self.entries.get(&format!("{base}.index")).ok_or_else(|| {
io::Error::new(io::ErrorKind::NotFound, "índice do bevy ausente")
})?;
let mut v = vec![0u8; loc.size as usize];
read_exact_at_file(&self.file, loc.data_start, &mut v)?;
let a = std::sync::Arc::new(v);
@@ -439,9 +496,17 @@ impl Aff4Source {
a
}
};
let e = index.get(within as usize * 12..within as usize * 12 + 12).ok_or_else(|| io::Error::new(io::ErrorKind::UnexpectedEof, "bloco fora do índice"))?;
let (off, len) = (u64::from_le_bytes(e[0..8].try_into().unwrap()), u32::from_le_bytes(e[8..12].try_into().unwrap()) as usize);
let loc = self.entries.get(&base).ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "bevy ausente"))?;
let e = index
.get(within as usize * 12..within as usize * 12 + 12)
.ok_or_else(|| io::Error::new(io::ErrorKind::UnexpectedEof, "bloco fora do índice"))?;
let (off, len) = (
u64::from_le_bytes(e[0..8].try_into().unwrap()),
u32::from_le_bytes(e[8..12].try_into().unwrap()) as usize,
);
let loc = self
.entries
.get(&base)
.ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "bevy ausente"))?;
let mut raw = vec![0u8; len];
read_exact_at_file(&self.file, loc.data_start + off, &mut raw)?;
let want = st.chunk.min(st.size.saturating_sub(chunk_no * st.chunk)) as usize;
@@ -450,16 +515,23 @@ impl Aff4Source {
} else {
let bad = |m: String| io::Error::new(io::ErrorKind::InvalidData, m);
match st.method {
Method::Snappy => snap::raw::Decoder::new().decompress_vec(&raw).map_err(|e| bad(format!("snappy: {e}")))?,
Method::Lz4 => lz4_flex::block::decompress(&raw, st.chunk as usize).map_err(|e| bad(format!("lz4: {e}")))?,
Method::Snappy => snap::raw::Decoder::new()
.decompress_vec(&raw)
.map_err(|e| bad(format!("snappy: {e}")))?,
Method::Lz4 => lz4_flex::block::decompress(&raw, st.chunk as usize)
.map_err(|e| bad(format!("lz4: {e}")))?,
Method::Deflate => {
let mut v = Vec::with_capacity(st.chunk as usize);
flate2::read::DeflateDecoder::new(&raw[..]).read_to_end(&mut v).map_err(|e| bad(format!("deflate: {e}")))?;
flate2::read::DeflateDecoder::new(&raw[..])
.read_to_end(&mut v)
.map_err(|e| bad(format!("deflate: {e}")))?;
v
}
Method::Zlib => {
let mut v = Vec::with_capacity(st.chunk as usize);
flate2::read::ZlibDecoder::new(&raw[..]).read_to_end(&mut v).map_err(|e| bad(format!("zlib: {e}")))?;
flate2::read::ZlibDecoder::new(&raw[..])
.read_to_end(&mut v)
.map_err(|e| bad(format!("zlib: {e}")))?;
v
}
Method::Stored => unreachable!(),
@@ -499,9 +571,13 @@ fn read_exact_at_file(f: &File, off: u64, buf: &mut [u8]) -> io::Result<()> {
{
let mut done = 0;
while done < buf.len() {
let n = std::os::windows::fs::FileExt::seek_read(f, &mut buf[done..], off + done as u64)?;
let n =
std::os::windows::fs::FileExt::seek_read(f, &mut buf[done..], off + done as u64)?;
if n == 0 {
return Err(io::Error::new(io::ErrorKind::UnexpectedEof, "AFF4 truncado"));
return Err(io::Error::new(
io::ErrorKind::UnexpectedEof,
"AFF4 truncado",
));
}
done += n;
}
@@ -534,7 +610,9 @@ impl Source for Aff4Source {
let n = ((e.start + e.len - pos) as usize).min(want - done);
let toff = e.target_off + (pos - e.start);
match self.targets.get(e.target as usize) {
Some(Target::Stream(si)) => self.read_stream(*si, toff, &mut buf[done..done + n])?,
Some(Target::Stream(si)) => {
self.read_stream(*si, toff, &mut buf[done..done + n])?
}
Some(Target::Fill(b)) => buf[done..done + n].fill(*b),
_ => buf[done..done + n].fill(0),
}
@@ -557,7 +635,13 @@ pub struct Aff4Options {
impl Default for Aff4Options {
fn default() -> Self {
Self { case_name: String::new(), examiner: String::new(), notes: String::new(), evidence_number: String::new(), chunk_size: 32768 }
Self {
case_name: String::new(),
examiner: String::new(),
notes: String::new(),
evidence_number: String::new(),
chunk_size: 32768,
}
}
}
@@ -565,17 +649,30 @@ fn new_uuid() -> String {
let mut b = [0u8; 16];
let _ = std::fs::File::open("/dev/urandom").and_then(|mut f| f.read_exact(&mut b));
if b == [0u8; 16] {
let t = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or(1);
let t = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.map(|d| d.as_nanos())
.unwrap_or(1);
b = (t ^ (std::process::id() as u128) << 64).to_le_bytes();
}
b[6] = (b[6] & 0x0F) | 0x40;
b[8] = (b[8] & 0x3F) | 0x80;
let h: Vec<String> = b.iter().map(|x| format!("{x:02x}")).collect();
format!("{}-{}-{}-{}-{}", h[0..4].concat(), h[4..6].concat(), h[6..8].concat(), h[8..10].concat(), h[10..16].concat())
format!(
"{}-{}-{}-{}-{}",
h[0..4].concat(),
h[4..6].concat(),
h[6..8].concat(),
h[8..10].concat(),
h[10..16].concat()
)
}
fn iso_now() -> String {
let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs() as i64).unwrap_or(0);
let secs = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.map(|d| d.as_secs() as i64)
.unwrap_or(0);
let days = secs.div_euclid(86400);
let rem = secs.rem_euclid(86400);
let z = days + 719468;
@@ -588,11 +685,18 @@ fn iso_now() -> String {
let d = doy - (153 * mp + 2) / 5 + 1;
let m = if mp < 10 { mp + 3 } else { mp - 9 };
let y = if m <= 2 { y + 1 } else { y };
format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.000Z", rem / 3600, rem % 3600 / 60, rem % 60)
format!(
"{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.000Z",
rem / 3600,
rem % 3600 / 60,
rem % 60
)
}
fn esc(s: &str) -> String {
s.replace('\\', "\\\\").replace('"', "\\\"").replace('\n', "\\n")
s.replace('\\', "\\\\")
.replace('"', "\\\"")
.replace('\n', "\\n")
}
/// Grava uma imagem AFF4 linear (um fluxo de blocos snappy) de `src`.
@@ -607,7 +711,12 @@ pub fn write_aff4(
.write(true)
.create_new(true)
.open(dest)
.map_err(|e| Error::msg(format!("não foi possível criar {}: {e} (o arquivo não pode existir)", dest.display())))?;
.map_err(|e| {
Error::msg(format!(
"não foi possível criar {}: {e} (o arquivo não pode existir)",
dest.display()
))
})?;
crate::owner::give_to_user(dest);
let total = src.size();
let chunk = opts.chunk_size as u64;
@@ -616,9 +725,12 @@ pub fn write_aff4(
let stream = format!("aff4://{}", new_uuid());
let image = format!("aff4://{}", new_uuid());
let mut zip = zip::ZipWriter::new(out);
let stored = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Stored).large_file(true);
let stored = zip::write::SimpleFileOptions::default()
.compression_method(zip::CompressionMethod::Stored)
.large_file(true);
let result = (|| -> Result<ImageReport> {
zip.start_file("container.description", stored).map_err(zerr)?;
zip.start_file("container.description", stored)
.map_err(zerr)?;
zip.write_all(volume.as_bytes())?;
zip.start_file("version.txt", stored).map_err(zerr)?;
zip.write_all(format!("major=1\nminor=2\ntool=Guara {}\n", crate::VERSION).as_bytes())?;
@@ -661,9 +773,15 @@ pub fn write_aff4(
}
hasher.update(b);
// bloco curto (último) é guardado como está; comprimido só se ficar menor
let comp = enc_snap.compress_vec(b).map_err(|e| Error::msg(e.to_string()))?;
let comp = enc_snap
.compress_vec(b)
.map_err(|e| Error::msg(e.to_string()))?;
// Só um bloco cheio pode ficar sem compressão (comprimento == tamanho do bloco).
let data: &[u8] = if want as u64 == chunk && comp.len() >= want { b } else { &comp };
let data: &[u8] = if want as u64 == chunk && comp.len() >= want {
b
} else {
&comp
};
zip.write_all(data)?;
index.extend_from_slice(&boff.to_le_bytes());
index.extend_from_slice(&(data.len() as u32).to_le_bytes());
@@ -672,7 +790,8 @@ pub fn write_aff4(
chunk_no += 1;
progress(pos, total);
}
zip.start_file(format!("{name}.index").as_str(), stored).map_err(zerr)?;
zip.start_file(format!("{name}.index").as_str(), stored)
.map_err(zerr)?;
zip.write_all(&index)?;
if rep.cancelled {
break;
@@ -708,7 +827,10 @@ pub fn write_aff4(
match result {
Ok(rep) => {
zip.finish().map_err(zerr)?;
crate::owner::write_owned(&dest.with_extension("map.json"), serde_json::to_vec_pretty(&rep)?)?;
crate::owner::write_owned(
&dest.with_extension("map.json"),
serde_json::to_vec_pretty(&rep)?,
)?;
Ok(rep)
}
Err(e) => {
+146 -32
View File
@@ -15,12 +15,20 @@ use std::sync::Arc;
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "lowercase")]
pub enum SecretInput {
Password { value: String },
Recovery { value: String },
Password {
value: String,
},
Recovery {
value: String,
},
/// Caminho de um arquivo de chave (.BEK do BitLocker, keyfile do LUKS).
Keyfile { path: String },
Keyfile {
path: String,
},
/// Chave do volume em hexadecimal.
Key { hex: String },
Key {
hex: String,
},
}
/// Chave de volume guardada na sessão (só quando o usuário pede para lembrar).
@@ -62,7 +70,10 @@ pub struct Assembly {
impl Assembly {
pub fn is_plain(&self) -> bool {
self.members.is_empty() && self.secrets.is_empty() && self.keys.is_empty() && self.raid.is_none()
self.members.is_empty()
&& self.secrets.is_empty()
&& self.keys.is_empty()
&& self.raid.is_none()
}
}
@@ -102,11 +113,14 @@ fn to_secrets(a: &Assembly) -> Result<Vec<Secret>> {
v.push(match s {
SecretInput::Password { value } => Secret::Password(value.clone()),
SecretInput::Recovery { value } => Secret::RecoveryKey(value.clone()),
SecretInput::Keyfile { path } => Secret::KeyFile(
std::fs::read(path).map_err(|e| Error::msg(format!("não foi possível ler o arquivo de chave {path}: {e}")))?,
),
SecretInput::Keyfile { path } => Secret::KeyFile(std::fs::read(path).map_err(|e| {
Error::msg(format!(
"não foi possível ler o arquivo de chave {path}: {e}"
))
})?),
SecretInput::Key { hex } => Secret::VolumeKey(
crypt::from_hex(hex).ok_or_else(|| Error::msg("chave do volume em hexadecimal inválida"))?,
crypt::from_hex(hex)
.ok_or_else(|| Error::msg("chave do volume em hexadecimal inválida"))?,
),
});
}
@@ -142,8 +156,16 @@ const MIB: u64 = 1 << 20;
/// Coloca `src` em `start`; se cair dentro de uma região virtual, a substitui por dentro.
fn patch(regions: &mut Vec<Region>, start: u64, src: Arc<dyn Source>, label: String) {
let len = src.size();
if let Some(r) = regions.iter_mut().find(|r| r.start <= start && start < r.start + r.len) {
let inner = Region { start: start - r.start, len, src, label: label.clone() };
if let Some(r) = regions
.iter_mut()
.find(|r| r.start <= start && start < r.start + r.len)
{
let inner = Region {
start: start - r.start,
len,
src,
label: label.clone(),
};
let wrapped = Overlay::new(r.src.clone(), vec![inner]);
if start == r.start {
r.len = r.len.max(len);
@@ -151,7 +173,12 @@ fn patch(regions: &mut Vec<Region>, start: u64, src: Arc<dyn Source>, label: Str
r.src = Arc::new(wrapped);
return;
}
regions.push(Region { start, len, src, label });
regions.push(Region {
start,
len,
src,
label,
});
}
/// Candidato a membro de RAID/LVM: uma janela de disco (inteiro ou partição).
@@ -162,10 +189,17 @@ struct Window {
}
fn windows_of(src: &Arc<dyn Source>, primary: bool) -> Vec<Window> {
let mut v = vec![Window { src: src.clone(), primary_start: primary.then_some(0) }];
let mut v = vec![Window {
src: src.clone(),
primary_start: primary.then_some(0),
}];
let layout = partition::analyze(src.as_ref(), false);
for p in &layout.partitions {
let len = if p.len == 0 { src.size().saturating_sub(p.start) } else { p.len };
let len = if p.len == 0 {
src.size().saturating_sub(p.start)
} else {
p.len
};
v.push(Window {
src: Arc::new(SubSource::new(src.clone(), p.start, len)),
primary_start: primary.then_some(p.start),
@@ -196,11 +230,21 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
let mut disks: Vec<Arc<dyn Source>> = vec![base.clone()];
disks.extend(members.iter().cloned());
let params = pick_raid(&disks, spec, &mut out.notes)?;
let src: Arc<dyn Source> = Arc::new(crate::raid::RaidSource::new(params).map_err(Error::msg)?);
out.notes.push(format!("RAID montado a partir de {} disco(s) sem metadados.", disks.len()));
let src: Arc<dyn Source> =
Arc::new(crate::raid::RaidSource::new(params).map_err(Error::msg)?);
out.notes.push(format!(
"RAID montado a partir de {} disco(s) sem metadados.",
disks.len()
));
out.skip_primary = true;
members.clear();
add_virtual(&mut regions, &mut next_virtual, &mut out, src, "RAID".into());
add_virtual(
&mut regions,
&mut next_virtual,
&mut out,
src,
"RAID".into(),
);
}
let mut done_containers: std::collections::BTreeSet<String> = Default::default();
let mut tried_pool = false;
@@ -219,11 +263,21 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
// 1) RAID e LVM: reúne janelas do disco principal e dos membros extras.
if round == 0 || !tried_pool || !out.extra_parts.is_empty() {
let mut pool: Vec<Window> = vec![];
pool.push(Window { src: current.clone(), primary_start: Some(0) });
pool.push(Window {
src: current.clone(),
primary_start: Some(0),
});
for p in &all_parts {
if matches!(p.fs, FsKind::Raid | FsKind::Lvm) {
let len = if p.len == 0 { current.size().saturating_sub(p.start) } else { p.len };
pool.push(Window { src: Arc::new(SubSource::new(current.clone(), p.start, len)), primary_start: Some(p.start) });
let len = if p.len == 0 {
current.size().saturating_sub(p.start)
} else {
p.len
};
pool.push(Window {
src: Arc::new(SubSource::new(current.clone(), p.start, len)),
primary_start: Some(p.start),
});
}
}
for m in &members {
@@ -241,7 +295,12 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
md.push((w.src.clone(), sup));
}
}
let new_md: Vec<_> = md.into_iter().filter(|(_, s)| !done_containers.contains(&format!("md{}", crypt::to_hex(&s.uuid)))).collect();
let new_md: Vec<_> = md
.into_iter()
.filter(|(_, s)| {
!done_containers.contains(&format!("md{}", crypt::to_hex(&s.uuid)))
})
.collect();
if !new_md.is_empty() {
for (_, s) in &new_md {
done_containers.insert(format!("md{}", crypt::to_hex(&s.uuid)));
@@ -249,13 +308,30 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
for res in crate::raid::assemble_md(new_md) {
match res {
Ok(a) => {
let label = format!("{} {}", a.info.level.name(), if a.name.is_empty() { a.uuid.clone() } else { a.name.clone() });
let label = format!(
"{} {}",
a.info.level.name(),
if a.name.is_empty() {
a.uuid.clone()
} else {
a.name.clone()
}
);
if a.missing > 0 {
out.notes.push(format!("{label}: montado sem {} membro(s) (modo degradado).", a.missing));
out.notes.push(format!(
"{label}: montado sem {} membro(s) (modo degradado).",
a.missing
));
} else {
out.notes.push(format!("{label} montado."));
}
add_virtual(&mut regions, &mut next_virtual, &mut out, a.source.clone(), label);
add_virtual(
&mut regions,
&mut next_virtual,
&mut out,
a.source.clone(),
label,
);
progress = true;
}
Err(e) => out.notes.push(format!("RAID não montado: {e}")),
@@ -267,7 +343,10 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
let mut pvs: Vec<(Arc<dyn Source>, crate::lvm::PvInfo)> = vec![];
let mut pv_primary: Vec<u64> = vec![];
let md_srcs: Vec<Arc<dyn Source>> = regions.iter().map(|r| r.src.clone()).collect();
let mut lvm_pool: Vec<(Arc<dyn Source>, Option<u64>)> = pool.iter().map(|w| (w.src.clone(), w.primary_start)).collect();
let mut lvm_pool: Vec<(Arc<dyn Source>, Option<u64>)> = pool
.iter()
.map(|w| (w.src.clone(), w.primary_start))
.collect();
for (r, s) in regions.iter().zip(md_srcs) {
lvm_pool.push((s, Some(r.start)));
}
@@ -288,7 +367,13 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
out.notes.push(format!("LVM {}: {w}", vg.name));
}
for (name, lv) in vg.lvs {
add_virtual(&mut regions, &mut next_virtual, &mut out, lv, format!("LVM {}/{}", vg.name, name));
add_virtual(
&mut regions,
&mut next_virtual,
&mut out,
lv,
format!("LVM {}/{}", vg.name, name),
);
progress = true;
}
}
@@ -310,7 +395,11 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
if p.encrypted.is_none() || out.unlocked.iter().any(|u| u.start == p.start) {
continue;
}
let len = if p.len == 0 { current.size().saturating_sub(p.start) } else { p.len };
let len = if p.len == 0 {
current.size().saturating_sub(p.start)
} else {
p.len
};
let window: Arc<dyn Source> = Arc::new(SubSource::new(current.clone(), p.start, len));
let mut all = secrets.clone();
for k in asm.keys.iter().filter(|k| k.start == p.start) {
@@ -366,7 +455,13 @@ pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assemble
}
/// Anexa um volume virtual depois do fim do disco e registra as partições que ele contém.
fn add_virtual(regions: &mut Vec<Region>, next: &mut u64, out: &mut Assembled, src: Arc<dyn Source>, label: String) {
fn add_virtual(
regions: &mut Vec<Region>,
next: &mut u64,
out: &mut Assembled,
src: Arc<dyn Source>,
label: String,
) {
let start = *next;
let len = src.size();
if len == 0 {
@@ -393,15 +488,34 @@ fn add_virtual(regions: &mut Vec<Region>, next: &mut u64, out: &mut Assembled, s
out.extra_parts.push(q);
}
}
regions.push(Region { start, len, src, label });
regions.push(Region {
start,
len,
src,
label,
});
}
/// Escolhe os parâmetros do RAID: o que o usuário deu manda; o resto vem da detecção.
fn pick_raid(disks: &[Arc<dyn Source>], spec: &RaidSpec, notes: &mut Vec<String>) -> Result<crate::raid::RaidParams> {
fn pick_raid(
disks: &[Arc<dyn Source>],
spec: &RaidSpec,
notes: &mut Vec<String>,
) -> Result<crate::raid::RaidParams> {
use crate::raid::{Member, RaidParams};
if let (Some(level), Some(chunk), Some(layout), Some(order)) = (spec.level, spec.chunk_kb, spec.layout, spec.order.clone()) {
if let (Some(level), Some(chunk), Some(layout), Some(order)) =
(spec.level, spec.chunk_kb, spec.layout, spec.order.clone())
{
if order.len() == disks.len() && order.iter().all(|&i| i < disks.len()) {
let members = order.iter().map(|&i| Some(Member { src: disks[i].clone(), data_offset: 0 })).collect();
let members = order
.iter()
.map(|&i| {
Some(Member {
src: disks[i].clone(),
data_offset: 0,
})
})
.collect();
return Ok(RaidParams::simple(level, chunk * 1024, layout, members));
}
}
+74 -15
View File
@@ -16,8 +16,12 @@ fn le64(b: &[u8], o: usize) -> u64 {
u64::from_le_bytes(b[o..o + 8].try_into().unwrap())
}
const GUID_NORMAL: [u8; 16] = [0x3b, 0xd6, 0x67, 0x49, 0x29, 0x2e, 0xd8, 0x4a, 0x83, 0x99, 0xf6, 0xa3, 0x39, 0xe3, 0xd0, 0x01];
const GUID_EOW: [u8; 16] = [0x3b, 0x4d, 0xa8, 0x92, 0x80, 0xdd, 0x0e, 0x4d, 0x9e, 0x4e, 0xb1, 0xe3, 0x28, 0x4e, 0xae, 0xd8];
const GUID_NORMAL: [u8; 16] = [
0x3b, 0xd6, 0x67, 0x49, 0x29, 0x2e, 0xd8, 0x4a, 0x83, 0x99, 0xf6, 0xa3, 0x39, 0xe3, 0xd0, 0x01,
];
const GUID_EOW: [u8; 16] = [
0x3b, 0x4d, 0xa8, 0x92, 0x80, 0xdd, 0x0e, 0x4d, 0x9e, 0x4e, 0xb1, 0xe3, 0x28, 0x4e, 0xae, 0xd8,
];
/// Posição da tabela de deslocamentos FVE, se for BitLocker (normal ou To Go).
fn offsets_pos(vbr: &[u8]) -> Option<usize> {
@@ -45,7 +49,9 @@ const RA: [u32; 4] = [9, 0, 13, 0];
const RB: [u32; 4] = [0, 10, 0, 25];
fn words(buf: &[u8]) -> Vec<u32> {
buf.chunks_exact(4).map(|c| u32::from_le_bytes(c.try_into().unwrap())).collect()
buf.chunks_exact(4)
.map(|c| u32::from_le_bytes(c.try_into().unwrap()))
.collect()
}
// Decifragem (ordem do dm-crypt do Linux): somas em ordem crescente.
@@ -219,7 +225,11 @@ impl Vmk {
self.nested.iter().find(|e| e.vtype == 5)
}
fn stretch_salt(&self) -> Option<&[u8]> {
self.nested.iter().find(|e| e.vtype == 3).filter(|e| e.data.len() >= 20).map(|e| &e.data[4..20])
self.nested
.iter()
.find(|e| e.vtype == 3)
.filter(|e| e.data.len() >= 20)
.map(|e| &e.data[4..20])
}
}
@@ -366,8 +376,13 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
}
}
}
let fve = fve.ok_or_else(|| UnlockError::Unsupported("metadados FVE ilegíveis ou do Windows Vista".into()))?;
let fvek_entry = fve.fvek.as_ref().ok_or_else(|| UnlockError::Corrupt("sem FVEK".into()))?;
let fve = fve.ok_or_else(|| {
UnlockError::Unsupported("metadados FVE ilegíveis ou do Windows Vista".into())
})?;
let fvek_entry = fve
.fvek
.as_ref()
.ok_or_else(|| UnlockError::Corrupt("sem FVEK".into()))?;
let mut volume_key: Option<Vec<u8>> = None;
for s in secrets {
@@ -393,7 +408,8 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
k
} else {
let vmk = vmk_found.ok_or(UnlockError::WrongSecret)?;
decrypt_key_entry(&vmk, fvek_entry).ok_or_else(|| UnlockError::Corrupt("FVEK não decifra com a VMK".into()))?
decrypt_key_entry(&vmk, fvek_entry)
.ok_or_else(|| UnlockError::Corrupt("FVEK não decifra com a VMK".into()))?
};
let k = &fvek_bytes;
let bad = || UnlockError::Corrupt("tamanho de chave incompatível com o método".into());
@@ -408,7 +424,11 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
key: AesAny::new(&k[..n]).ok_or_else(bad)?,
tweak: AesAny::new(&k[32..32 + n]).ok_or_else(bad)?,
},
if n == 16 { "AES-128-CBC + difusor" } else { "AES-256-CBC + difusor" },
if n == 16 {
"AES-128-CBC + difusor"
} else {
"AES-256-CBC + difusor"
},
)
}
0x8002 | 0x8003 => {
@@ -417,35 +437,69 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
return Err(bad());
}
let key = AesAny::new(&k[..n]).ok_or_else(bad)?;
(SectorCipher::Cbc { key: key.clone(), iv: Iv::Eboiv(key) }, if n == 16 { "AES-128-CBC" } else { "AES-256-CBC" })
(
SectorCipher::Cbc {
key: key.clone(),
iv: Iv::Eboiv(key),
},
if n == 16 {
"AES-128-CBC"
} else {
"AES-256-CBC"
},
)
}
0x8004 | 0x8005 => {
let n = if fve.method == 0x8004 { 16 } else { 32 };
if k.len() < 2 * n {
return Err(bad());
}
let iv = if bps > 512 { Iv::Unit(bps) } else { Iv::Plain64 };
let iv = if bps > 512 {
Iv::Unit(bps)
} else {
Iv::Plain64
};
(
SectorCipher::Xts {
k1: AesAny::new(&k[..n]).ok_or_else(bad)?,
k2: AesAny::new(&k[n..2 * n]).ok_or_else(bad)?,
iv,
},
if n == 16 { "AES-128-XTS" } else { "AES-256-XTS" },
if n == 16 {
"AES-128-XTS"
} else {
"AES-256-XTS"
},
)
}
m => return Err(UnlockError::Unsupported(format!("método de cifragem BitLocker {m:#x}"))),
m => {
return Err(UnlockError::Unsupported(format!(
"método de cifragem BitLocker {m:#x}"
)))
}
};
let len = src.size();
let mut cs = CryptSource::new(src.clone(), cipher, 0, len, bps);
let mut patches = vec![];
// Áreas de metadados FVE: o Windows não as expõe como dados.
for off in meta_offsets {
patches.push(Patch { at: off, len: fve.meta_size, from: 0, decrypt_from: None, zero: true });
patches.push(Patch {
at: off,
len: fve.meta_size,
from: 0,
decrypt_from: None,
zero: true,
});
}
if fve.volume_header_size > 0 && fve.volume_header_offset > 0 {
// O início do volume original foi movido para outro lugar e cifrado lá.
patches.push(Patch { at: fve.volume_header_offset, len: fve.volume_header_size, from: 0, decrypt_from: None, zero: true });
patches.push(Patch {
at: fve.volume_header_offset,
len: fve.volume_header_size,
from: 0,
decrypt_from: None,
zero: true,
});
patches.push(Patch {
at: 0,
len: fve.volume_header_size,
@@ -465,6 +519,11 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
})
}
pub fn unlock_window(base: Arc<dyn Source>, start: u64, len: u64, secrets: &[Secret]) -> UnlockResult {
pub fn unlock_window(
base: Arc<dyn Source>,
start: u64,
len: u64,
secrets: &[Secret],
) -> UnlockResult {
unlock(Arc::new(SubSource::new(base, start, len)), secrets)
}
+39 -11
View File
@@ -80,12 +80,18 @@ fn plist_value(xml: &str, key: &str) -> Option<String> {
while let Some(p) = xml[from..].find(&k) {
let rest = &xml[from + p + k.len()..];
from += p + k.len();
let Some(open) = rest.find('<').filter(|&o| o == 0) else { continue };
let Some(gt) = rest[open..].find('>') else { continue };
let Some(open) = rest.find('<').filter(|&o| o == 0) else {
continue;
};
let Some(gt) = rest[open..].find('>') else {
continue;
};
if rest[open..open + gt].ends_with('/') {
continue; // <reference .../>
}
let Some(te) = rest[open + 1..].find(|c: char| c == ' ' || c == '>') else { continue };
let Some(te) = rest[open + 1..].find([' ', '>']) else {
continue;
};
let tag = &rest[open + 1..open + 1 + te];
let vstart = open + gt + 1;
if let Some(e) = rest[vstart..].find(&format!("</{tag}>")) {
@@ -116,20 +122,31 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
let block_size = le32(&h, 96) as u64;
let disklbl = le64(&h, 104);
if block_size == 0 || block_size > 1 << 20 || le32(&h, 168) != 16 {
return Err(UnlockError::Unsupported("Core Storage com chave de metadados que não é AES-128".into()));
return Err(UnlockError::Unsupported(
"Core Storage com chave de metadados que não é AES-128".into(),
));
}
let mut md_key = [0u8; 32];
md_key[..16].copy_from_slice(&h[176..192]);
md_key[16..].copy_from_slice(&h[304..320]);
let (k1, k2) = (AesAny::new(&md_key[..16]).unwrap(), AesAny::new(&md_key[16..]).unwrap());
let md_cipher = SectorCipher::Xts { k1, k2, iv: Iv::Plain64 };
let (k1, k2) = (
AesAny::new(&md_key[..16]).unwrap(),
AesAny::new(&md_key[16..]).unwrap(),
);
let md_cipher = SectorCipher::Xts {
k1,
k2,
iv: Iv::Plain64,
};
let label = read_vec(src.as_ref(), disklbl * block_size, MD_BLOCK).map_err(|e| corrupt(&e.to_string()))?;
let label = read_vec(src.as_ref(), disklbl * block_size, MD_BLOCK)
.map_err(|e| corrupt(&e.to_string()))?;
if label.len() < MD_BLOCK {
return Err(corrupt("rótulo do disco truncado"));
}
let vgd_off = le32(&label, 220) as u64;
let vgd = read_vec(src.as_ref(), disklbl * block_size + vgd_off, 40).map_err(|e| corrupt(&e.to_string()))?;
let vgd = read_vec(src.as_ref(), disklbl * block_size + vgd_off, 40)
.map_err(|e| corrupt(&e.to_string()))?;
if vgd.len() < 40 {
return Err(corrupt("descritor de grupos truncado"));
}
@@ -141,7 +158,8 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
let mut family = [0u8; 16];
let mut got = 0u8;
for i in 0..md_blocks.min(64) {
let mut b = read_vec(src.as_ref(), md_start + i * MD_BLOCK as u64, MD_BLOCK).map_err(|e| corrupt(&e.to_string()))?;
let mut b = read_vec(src.as_ref(), md_start + i * MD_BLOCK as u64, MD_BLOCK)
.map_err(|e| corrupt(&e.to_string()))?;
if b.len() < MD_BLOCK || b.iter().all(|&x| x == 0) {
break;
}
@@ -192,7 +210,12 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
let finish = |vk16: [u8; 16]| -> UnlockResult {
let mut full = [0u8; 32];
full[..16].copy_from_slice(&vk16);
full[16..].copy_from_slice(&Sha256::new().chain_update(vk16).chain_update(family).finalize()[..16]);
full[16..].copy_from_slice(
&Sha256::new()
.chain_update(vk16)
.chain_update(family)
.finalize()[..16],
);
let cipher = SectorCipher::Xts {
k1: AesAny::new(&full[..16]).unwrap(),
k2: AesAny::new(&full[16..]).unwrap(),
@@ -228,6 +251,11 @@ pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
Err(UnlockError::WrongSecret)
}
pub fn unlock_window(base: Arc<dyn Source>, start: u64, len: u64, secrets: &[Secret]) -> UnlockResult {
pub fn unlock_window(
base: Arc<dyn Source>,
start: u64,
len: u64,
secrets: &[Secret],
) -> UnlockResult {
unlock(Arc::new(SubSource::new(base, start, len)), secrets)
}
+79 -23
View File
@@ -89,9 +89,13 @@ pub fn af_merge(src: &[u8], block: usize, stripes: usize, h: Hash) -> Vec<u8> {
/// Cifra descrita por texto como "aes-xts-plain64" ou "aes-cbc-essiv:sha256".
pub fn parse_cipher(spec: &str, key: &[u8]) -> std::result::Result<SectorCipher, UnlockError> {
let (alg, rest) = spec.split_once('-').ok_or_else(|| UnlockError::Unsupported(spec.into()))?;
let (alg, rest) = spec
.split_once('-')
.ok_or_else(|| UnlockError::Unsupported(spec.into()))?;
if !alg.eq_ignore_ascii_case("aes") {
return Err(UnlockError::Unsupported(format!("cifra {alg} (apenas AES)")));
return Err(UnlockError::Unsupported(format!(
"cifra {alg} (apenas AES)"
)));
}
let (mode, ivs) = rest.split_once('-').unwrap_or((rest, "plain"));
let bad = || UnlockError::Unsupported(format!("chave inválida para {spec}"));
@@ -102,7 +106,8 @@ pub fn parse_cipher(spec: &str, key: &[u8]) -> std::result::Result<SectorCipher,
"plain" | "plain32" => Iv::Plain32,
"plain64be" => Iv::Plain64Be,
s if s.starts_with("essiv:") => {
let h = Hash::parse(&s[6..]).ok_or_else(|| UnlockError::Unsupported(spec.into()))?;
let h =
Hash::parse(&s[6..]).ok_or_else(|| UnlockError::Unsupported(spec.into()))?;
Iv::Essiv(AesAny::new(&h.digest(&[k])).ok_or_else(bad)?)
}
_ => return Err(UnlockError::Unsupported(format!("IV {ivs}"))),
@@ -181,7 +186,8 @@ fn unlock_v1(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
}
let cipher_name = cstr(&h[8..40]);
let cipher_mode = cstr(&h[40..72]);
let hash = Hash::parse(&cstr(&h[72..104])).ok_or_else(|| UnlockError::Unsupported(format!("hash {}", cstr(&h[72..104]))))?;
let hash = Hash::parse(&cstr(&h[72..104]))
.ok_or_else(|| UnlockError::Unsupported(format!("hash {}", cstr(&h[72..104]))))?;
let payload = be32(&h, 104) as u64 * 512;
let key_bytes = be32(&h, 108) as usize;
let mk_digest = &h[112..132];
@@ -221,7 +227,9 @@ fn unlock_v1(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
continue;
}
let km_len = (key_bytes * stripes).div_ceil(512) * 512;
let Ok(mut km) = read_vec(src.as_ref(), km_off, km_len) else { continue };
let Ok(mut km) = read_vec(src.as_ref(), km_off, km_len) else {
continue;
};
if km.len() < km_len {
continue;
}
@@ -284,25 +292,38 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
}
let hdr_size = u64::from_be_bytes(h[8..16].try_into().unwrap());
if !(16384..=(4 << 20)).contains(&hdr_size) {
return Err(UnlockError::Corrupt("tamanho de cabeçalho LUKS2 inválido".into()));
return Err(UnlockError::Corrupt(
"tamanho de cabeçalho LUKS2 inválido".into(),
));
}
let area = read_vec(src.as_ref(), 4096, (hdr_size - 4096) as usize).map_err(|e| UnlockError::Corrupt(e.to_string()))?;
let area = read_vec(src.as_ref(), 4096, (hdr_size - 4096) as usize)
.map_err(|e| UnlockError::Corrupt(e.to_string()))?;
let end = area.iter().position(|&c| c == 0).unwrap_or(area.len());
let json: serde_json::Value = serde_json::from_slice(&area[..end]).map_err(|e| UnlockError::Corrupt(format!("JSON: {e}")))?;
let segments = json.get("segments").and_then(|s| s.as_object()).ok_or_else(|| UnlockError::Corrupt("sem segments".into()))?;
let json: serde_json::Value = serde_json::from_slice(&area[..end])
.map_err(|e| UnlockError::Corrupt(format!("JSON: {e}")))?;
let segments = json
.get("segments")
.and_then(|s| s.as_object())
.ok_or_else(|| UnlockError::Corrupt("sem segments".into()))?;
let (_, seg) = segments
.iter()
.find(|(_, s)| jstr(s, "type") == Some("crypt"))
.ok_or_else(|| UnlockError::Unsupported("sem segmento cifrado".into()))?;
let seg_off = jnum(seg, "offset").ok_or_else(|| UnlockError::Corrupt("offset do segmento".into()))?;
let seg_off =
jnum(seg, "offset").ok_or_else(|| UnlockError::Corrupt("offset do segmento".into()))?;
let seg_len = match seg.get("size").and_then(|s| s.as_str()) {
Some("dynamic") | None => src.size().saturating_sub(seg_off),
Some(n) => n.parse().unwrap_or(0),
};
let seg_enc = jstr(seg, "encryption").unwrap_or("aes-xts-plain64").to_string();
let seg_enc = jstr(seg, "encryption")
.unwrap_or("aes-xts-plain64")
.to_string();
let sector = jnum(seg, "sector_size").unwrap_or(512);
let iv_tweak = jnum(seg, "iv_tweak").unwrap_or(0);
let digests = json.get("digests").and_then(|d| d.as_object()).ok_or_else(|| UnlockError::Corrupt("sem digests".into()))?;
let digests = json
.get("digests")
.and_then(|d| d.as_object())
.ok_or_else(|| UnlockError::Corrupt("sem digests".into()))?;
let check = |vk: &[u8]| -> bool {
for (_, d) in digests {
@@ -325,7 +346,8 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
};
let finish = |vk: Vec<u8>| -> UnlockResult {
let cipher = parse_cipher(&seg_enc, &vk)?;
let cs = CryptSource::new(src.clone(), cipher, seg_off, seg_len, sector).with_iv_tweak(iv_tweak);
let cs =
CryptSource::new(src.clone(), cipher, seg_off, seg_len, sector).with_iv_tweak(iv_tweak);
Ok(Unlocked {
source: Arc::new(cs),
description: format!("LUKS2 ({seg_enc})"),
@@ -338,7 +360,10 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
}
}
let pws = passwords(secrets);
let slots = json.get("keyslots").and_then(|d| d.as_object()).ok_or_else(|| UnlockError::Corrupt("sem keyslots".into()))?;
let slots = json
.get("keyslots")
.and_then(|d| d.as_object())
.ok_or_else(|| UnlockError::Corrupt("sem keyslots".into()))?;
let mut unsupported: Option<String> = None;
for (_, slot) in slots {
if jstr(slot, "type") != Some("luks2") {
@@ -347,10 +372,20 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
let key_size = jnum(slot, "key_size").unwrap_or(0) as usize;
let af = slot.get("af");
let stripes = af.and_then(|a| jnum(a, "stripes")).unwrap_or(4000) as usize;
let af_hash = af.and_then(|a| jstr(a, "hash")).and_then(Hash::parse).unwrap_or(Hash::Sha256);
let af_hash = af
.and_then(|a| jstr(a, "hash"))
.and_then(Hash::parse)
.unwrap_or(Hash::Sha256);
let ar = slot.get("area");
let (Some(a_off), Some(a_size)) = (ar.and_then(|a| jnum(a, "offset")), ar.and_then(|a| jnum(a, "size"))) else { continue };
let a_enc = ar.and_then(|a| jstr(a, "encryption")).unwrap_or("aes-xts-plain64");
let (Some(a_off), Some(a_size)) = (
ar.and_then(|a| jnum(a, "offset")),
ar.and_then(|a| jnum(a, "size")),
) else {
continue;
};
let a_enc = ar
.and_then(|a| jstr(a, "encryption"))
.unwrap_or("aes-xts-plain64");
let a_ksize = ar.and_then(|a| jnum(a, "key_size")).unwrap_or(64) as usize;
let kdf = slot.get("kdf");
let Some(kdf) = kdf else { continue };
@@ -359,18 +394,31 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
if key_size == 0 || stripes == 0 || km_len as u64 > a_size {
continue;
}
let Ok(km) = read_vec(src.as_ref(), a_off, km_len) else { continue };
let Ok(km) = read_vec(src.as_ref(), a_off, km_len) else {
continue;
};
if km.len() < km_len {
continue;
}
for pw in &pws {
let dk: Vec<u8> = match jstr(kdf, "type") {
Some("pbkdf2") => {
let hh = jstr(kdf, "hash").and_then(Hash::parse).unwrap_or(Hash::Sha256);
hh.pbkdf2(pw, &salt, jnum(kdf, "iterations").unwrap_or(1000) as u32, a_ksize)
let hh = jstr(kdf, "hash")
.and_then(Hash::parse)
.unwrap_or(Hash::Sha256);
hh.pbkdf2(
pw,
&salt,
jnum(kdf, "iterations").unwrap_or(1000) as u32,
a_ksize,
)
}
Some(t @ ("argon2i" | "argon2id")) => {
let alg = if t == "argon2i" { argon2::Algorithm::Argon2i } else { argon2::Algorithm::Argon2id };
let alg = if t == "argon2i" {
argon2::Algorithm::Argon2i
} else {
argon2::Algorithm::Argon2id
};
let params = match argon2::Params::new(
jnum(kdf, "memory").unwrap_or(65536) as u32,
jnum(kdf, "time").unwrap_or(4) as u32,
@@ -384,7 +432,10 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
}
};
let mut out = vec![0u8; a_ksize];
if argon2::Argon2::new(alg, argon2::Version::V0x13, params).hash_password_into(pw, &salt, &mut out).is_err() {
if argon2::Argon2::new(alg, argon2::Version::V0x13, params)
.hash_password_into(pw, &salt, &mut out)
.is_err()
{
continue;
}
out
@@ -413,6 +464,11 @@ fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
}
/// Atalho: abre uma janela da origem como LUKS.
pub fn unlock_window(base: Arc<dyn Source>, start: u64, len: u64, secrets: &[Secret]) -> UnlockResult {
pub fn unlock_window(
base: Arc<dyn Source>,
start: u64,
len: u64,
secrets: &[Secret],
) -> UnlockResult {
unlock(Arc::new(SubSource::new(base, start, len)), secrets)
}
+25 -6
View File
@@ -98,10 +98,20 @@ impl Iv {
/// Cifra aplicada setor a setor.
#[derive(Clone)]
pub enum SectorCipher {
Xts { k1: AesAny, k2: AesAny, iv: Iv },
Cbc { key: AesAny, iv: Iv },
Xts {
k1: AesAny,
k2: AesAny,
iv: Iv,
},
Cbc {
key: AesAny,
iv: Iv,
},
/// BitLocker AES-CBC com difusor Elephant (chave de dados + chave de ajuste).
Elephant { key: AesAny, tweak: AesAny },
Elephant {
key: AesAny,
tweak: AesAny,
},
}
fn gf_double(t: &mut [u8; 16]) {
@@ -200,7 +210,13 @@ pub struct Patch {
}
impl CryptSource {
pub fn new(inner: Arc<dyn Source>, cipher: SectorCipher, data_offset: u64, len: u64, sector: u64) -> Self {
pub fn new(
inner: Arc<dyn Source>,
cipher: SectorCipher,
data_offset: u64,
len: u64,
sector: u64,
) -> Self {
let sector = sector.max(512);
Self {
inner,
@@ -245,7 +261,8 @@ impl CryptSource {
}
crate::source::read_exact_at(self.inner.as_ref(), self.data_offset + rel, out)?;
if rel < self.plain_from {
self.cipher.decrypt_sector(out, rel / 512 + self.iv_tweak, rel);
self.cipher
.decrypt_sector(out, rel / 512 + self.iv_tweak, rel);
}
Ok(())
}
@@ -342,5 +359,7 @@ pub fn from_hex(s: &str) -> Option<Vec<u8>> {
if s.len() % 2 != 0 {
return None;
}
(0..s.len() / 2).map(|i| u8::from_str_radix(&s[i * 2..i * 2 + 2], 16).ok()).collect()
(0..s.len() / 2)
.map(|i| u8::from_str_radix(&s[i * 2..i * 2 + 2], 16).ok())
.collect()
}
+87 -21
View File
@@ -26,7 +26,9 @@ pub struct ClusterIndex {
impl ClusterIndex {
pub fn new(size: u64) -> Self {
Self { bits: vec![0; (size / CLUSTER / 64 + 1) as usize] }
Self {
bits: vec![0; (size / CLUSTER / 64 + 1) as usize],
}
}
pub fn set(&mut self, off: u64) {
let c = (off / CLUSTER) as usize;
@@ -36,7 +38,10 @@ impl ClusterIndex {
}
pub fn get(&self, off: u64) -> bool {
let c = (off / CLUSTER) as usize;
self.bits.get(c / 64).map(|w| w >> (c % 64) & 1 == 1).unwrap_or(false)
self.bits
.get(c / 64)
.map(|w| w >> (c % 64) & 1 == 1)
.unwrap_or(false)
}
/// Examina um trecho lido e marca os clusters candidatos.
pub fn scan_chunk(&mut self, abs: u64, buf: &[u8]) {
@@ -52,7 +57,14 @@ impl ClusterIndex {
}
pub fn iter_range(&self, from: u64, to: u64) -> impl Iterator<Item = u64> + '_ {
let (a, b) = (from.div_ceil(CLUSTER), to / CLUSTER);
(a..b).filter(move |&c| self.bits.get(c as usize / 64).map(|w| w >> (c % 64) & 1 == 1).unwrap_or(false)).map(|c| c * CLUSTER)
(a..b)
.filter(move |&c| {
self.bits
.get(c as usize / 64)
.map(|w| w >> (c % 64) & 1 == 1)
.unwrap_or(false)
})
.map(|c| c * CLUSTER)
}
}
@@ -84,7 +96,10 @@ pub struct Pool<'a> {
impl Pool<'_> {
fn free_at(&self, off: u64, len: u64) -> bool {
!self.used.iter().any(|u| off < u.end() && off + len > u.offset)
!self
.used
.iter()
.any(|u| off < u.end() && off + len > u.offset)
}
}
@@ -103,14 +118,26 @@ pub enum Analysis {
/// Procura FF D9 logo depois do último MCU (até 64 bytes de preenchimento).
fn eoi_after(data: &[u8], pos: usize) -> Option<usize> {
let end = (pos + 64).min(data.len().saturating_sub(1));
(pos.saturating_sub(2)..end).find(|&i| data[i] == 0xFF && data[i + 1] == 0xD9).map(|i| i + 2)
(pos.saturating_sub(2)..end)
.find(|&i| data[i] == 0xFF && data[i + 1] == 0xD9)
.map(|i| i + 2)
}
/// Valida o JPEG que começa em `off` e, se estiver quebrado, tenta recompô-lo.
pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow_rebuild: bool) -> Analysis {
pub fn analyze_jpeg(
src: &dyn Source,
off: u64,
hit_len: u64,
pool: &Pool,
allow_rebuild: bool,
) -> Analysis {
let read_len = (hit_len as usize).clamp(4096, MAX_FILE);
let Ok(buf) = read_vec(src, off, read_len) else { return Analysis::Unsupported };
let Some(h) = jpegscan::parse_header(&buf) else { return Analysis::Unsupported };
let Ok(buf) = read_vec(src, off, read_len) else {
return Analysis::Unsupported;
};
let Some(h) = jpegscan::parse_header(&buf) else {
return Analysis::Unsupported;
};
let d = jpegscan::decode(&h, &buf, State::start(&h), u32::MAX, 512);
let disc = jpegscan::first_discontinuity(&h, &d.dc);
if d.stop == Stop::Done && disc.is_none() {
@@ -123,12 +150,20 @@ pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow
Stop::Truncated | Stop::Done => buf.len(),
};
if let Some(m) = disc {
let bad = d.snaps.iter().rev().find(|s| (s.mcu as usize) <= m).map(|s| s.pos).unwrap_or(h.scan_start);
let bad = d
.snaps
.iter()
.rev()
.find(|s| (s.mcu as usize) <= m)
.map(|s| s.pos)
.unwrap_or(h.scan_start);
stop_pos = stop_pos.min(bad);
}
let cl = CLUSTER as usize;
if off % CLUSTER != 0 || !allow_rebuild {
return Analysis::Broken { good_len: (stop_pos / 512 * 512).max(512) as u64 };
return Analysis::Broken {
good_len: (stop_pos / 512 * 512).max(512) as u64,
};
}
let mut pieces: Vec<(u64, usize)> = vec![];
@@ -143,7 +178,9 @@ pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow
let mut best: Option<(usize, u64, State, f64)> = None;
let mut probes = 0usize;
for back in 0..4usize {
let Some(bc_rel) = top.checked_sub(back * cl).filter(|&b| b > 0) else { break };
let Some(bc_rel) = top.checked_sub(back * cl).filter(|&b| b > 0) else {
break;
};
let bc = frag_start + bc_rel;
let Some(snap) = snaps
.iter()
@@ -155,24 +192,32 @@ pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow
continue;
};
let mut plane = jpegscan::Plane::new(&h);
let _ = jpegscan::decode_plane(&h, &joined[..bc], State::start(&h), u32::MAX, &mut plane);
let _ =
jpegscan::decode_plane(&h, &joined[..bc], State::start(&h), u32::MAX, &mut plane);
let lo = off.saturating_sub(WINDOW_BEFORE);
let hi = cur_base + bc_rel as u64 + WINDOW_AFTER;
let pre = jpegscan::decode(&h, &joined[..bc], State::start(&h), u32::MAX, 0);
let bpm_prefix = (pre.state.pos.saturating_sub(h.scan_start)) as f64 / pre.dc.len().max(1) as f64;
let bpm_prefix =
(pre.state.pos.saturating_sub(h.scan_start)) as f64 / pre.dc.len().max(1) as f64;
let mut ranked: Vec<(f64, u64)> = vec![];
for q in pool.index.iter_range(lo, hi) {
if q >= cur_base && q < cur_base + bc_rel as u64 + CLUSTER {
continue;
}
if !pool.free_at(q, CLUSTER) || pieces.iter().any(|&(po, pl)| q < po + pl as u64 && q + CLUSTER > po) {
if !pool.free_at(q, CLUSTER)
|| pieces
.iter()
.any(|&(po, pl)| q < po + pl as u64 && q + CLUSTER > po)
{
continue;
}
probes += 1;
if probes > MAX_PROBES {
break;
}
if let Some(sc) = probe_candidate(src, &h, &joined[..bc], &plane, &snap, q, bpm_prefix) {
if let Some(sc) =
probe_candidate(src, &h, &joined[..bc], &plane, &snap, q, bpm_prefix)
{
ranked.push((sc, q));
}
}
@@ -208,7 +253,7 @@ pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow
}
}
}
if best.as_ref().map_or(false, |b| b.3 == 0.0) {
if best.as_ref().is_some_and(|b| b.3 == 0.0) {
break;
}
}
@@ -231,7 +276,13 @@ pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow
};
let all = jpegscan::decode(&h, &joined, State::start(&h), u32::MAX, 0);
if let Some(m) = jpegscan::first_discontinuity(&h, &all.dc) {
let bad = d2.snaps.iter().rev().find(|s| (s.mcu as usize) <= m).map(|s| s.pos).unwrap_or(bc);
let bad = d2
.snaps
.iter()
.rev()
.find(|s| (s.mcu as usize) <= m)
.map(|s| s.pos)
.unwrap_or(bc);
if bad > bc {
sp = sp.min(bad);
}
@@ -241,8 +292,11 @@ pub fn analyze_jpeg(src: &dyn Source, off: u64, hit_len: u64, pool: &Pool, allow
frag_start = bc;
suspect = sp.max(bc + cl);
}
let good = pieces.iter().map(|p| p.1).sum::<usize>() + suspect.saturating_sub(frag_start).min(cl * 4) / 512 * 512;
Analysis::Broken { good_len: (stop_pos.min(good.max(512)) / 512 * 512).max(512) as u64 }
let good = pieces.iter().map(|p| p.1).sum::<usize>()
+ suspect.saturating_sub(frag_start).min(cl * 4) / 512 * 512;
Analysis::Broken {
good_len: (stop_pos.min(good.max(512)) / 512 * 512).max(512) as u64,
}
}
fn finish(pieces: Vec<(u64, usize)>) -> Analysis {
@@ -262,7 +316,15 @@ fn finish(pieces: Vec<(u64, usize)>) -> Analysis {
/// Pontuação (menor é melhor) de `q` como continuação de `prefix`: diferença média de pixels
/// nas bordas entre os MCUs novos e seus vizinhos. Natural: poucos níveis de cinza; lixo: dezenas.
fn probe_candidate(src: &dyn Source, h: &Header, prefix: &[u8], plane: &jpegscan::Plane, snap: &State, q: u64, bpm_prefix: f64) -> Option<f64> {
fn probe_candidate(
src: &dyn Source,
h: &Header,
prefix: &[u8],
plane: &jpegscan::Plane,
snap: &State,
q: u64,
bpm_prefix: f64,
) -> Option<f64> {
let more = read_vec(src, q, PROBE).ok()?;
if more.len() < 1024 {
return None;
@@ -326,7 +388,11 @@ fn probe_candidate(src: &dyn Source, h: &Header, prefix: &[u8], plane: &jpegscan
// Bytes por MCU depois da emenda, comparados com os do trecho anterior.
let after = d.dc.len() as f64 - (seam.saturating_sub(snap.mcu)) as f64;
let used = d.state.pos.saturating_sub(prefix.len()) as f64;
let ratio = if after > 4.0 && used > 0.0 { (used / after) / bpm_prefix.max(0.5) } else { 1.0 };
let ratio = if after > 4.0 && used > 0.0 {
(used / after) / bpm_prefix.max(0.5)
} else {
1.0
};
let sc = sum / n as f64 + 20.0 * ratio.ln().abs();
Some(sc)
}
+119 -27
View File
@@ -55,7 +55,10 @@ fn pread_exact(f: &File, buf: &mut [u8], mut off: u64) -> io::Result<()> {
while done < buf.len() {
let n = pread(f, &mut buf[done..], off)?;
if n == 0 {
return Err(io::Error::new(io::ErrorKind::UnexpectedEof, "segmento EWF truncado"));
return Err(io::Error::new(
io::ErrorKind::UnexpectedEof,
"segmento EWF truncado",
));
}
done += n;
off += n as u64;
@@ -83,7 +86,9 @@ enum Codec {
#[derive(Clone, Copy, Debug)]
enum Kind {
/// Dados guardados como estão; `checksum` indica 4 bytes de Adler-32 no fim.
Stored { checksum: bool },
Stored {
checksum: bool,
},
Packed(Codec),
/// Chunk inteiro repetindo estes 8 bytes (EnCase 7 "empty block").
Pattern([u8; 8]),
@@ -141,7 +146,11 @@ pub fn next_segment_ext(ext: &str) -> Option<String> {
format!("{}AA", first as char)
}
} else {
let mut c = [first, rest.as_bytes()[0].to_ascii_uppercase(), rest.as_bytes()[1].to_ascii_uppercase()];
let mut c = [
first,
rest.as_bytes()[0].to_ascii_uppercase(),
rest.as_bytes()[1].to_ascii_uppercase(),
];
let mut i = 2;
loop {
if c[i] < b'Z' {
@@ -206,13 +215,22 @@ impl EwfSource {
}
}
fn finish(files: Vec<File>, chunks: Vec<Chunk>, mut info: EwfInfo, size_hint: u64) -> Result<Self> {
fn finish(
files: Vec<File>,
chunks: Vec<Chunk>,
mut info: EwfInfo,
size_hint: u64,
) -> Result<Self> {
if chunks.is_empty() {
return Err(Error::msg("imagem EWF sem tabela de chunks"));
}
let chunk_size = info.chunk_size;
let max = chunks.len() as u64 * chunk_size;
let size = if size_hint > 0 { size_hint.min(max) } else { max };
let size = if size_hint > 0 {
size_hint.min(max)
} else {
max
};
info.segments = files.len();
Ok(Self {
files,
@@ -284,7 +302,11 @@ impl EwfSource {
.collect();
for i in 0..n {
let (off, comp) = offs[i];
let end = if i + 1 < n { offs[i + 1].0 } else { sectors_end };
let end = if i + 1 < n {
offs[i + 1].0
} else {
sectors_end
};
if end <= off {
return Err(Error::msg("tabela EWF inconsistente"));
}
@@ -396,11 +418,25 @@ impl EwfSource {
let kind = if fl & 4 != 0 {
Kind::Pattern(off.to_le_bytes())
} else if fl & 1 != 0 {
Kind::Packed(if method == Codec::Raw { Codec::Deflate } else { method })
Kind::Packed(if method == Codec::Raw {
Codec::Deflate
} else {
method
})
} else {
Kind::Stored { checksum: fl & 2 != 0 }
Kind::Stored {
checksum: fl & 2 != 0,
}
};
slots.insert(first + i as u64, Chunk { seg: si as u32, off, len, kind });
slots.insert(
first + i as u64,
Chunk {
seg: si as u32,
off,
len,
kind,
},
);
}
}
}
@@ -432,7 +468,9 @@ impl EwfSource {
let mut chunks = Vec::with_capacity(slots.len());
for (i, (k, c)) in slots.into_iter().enumerate() {
if k != i as u64 {
return Err(Error::msg("segmento Ex01 ausente: sequência de chunks com lacuna"));
return Err(Error::msg(
"segmento Ex01 ausente: sequência de chunks com lacuna",
));
}
chunks.push(c);
}
@@ -457,10 +495,19 @@ impl EwfSource {
pread_exact(&self.files[c.seg as usize], &mut raw, c.off)?;
let mut v = Vec::with_capacity(want);
let r: io::Result<usize> = match codec {
Codec::Bzip2 => bzip2::read::BzDecoder::new(&raw[..]).take(want as u64).read_to_end(&mut v),
_ => flate2::read::ZlibDecoder::new(&raw[..]).take(want as u64).read_to_end(&mut v),
Codec::Bzip2 => bzip2::read::BzDecoder::new(&raw[..])
.take(want as u64)
.read_to_end(&mut v),
_ => flate2::read::ZlibDecoder::new(&raw[..])
.take(want as u64)
.read_to_end(&mut v),
};
r.map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("chunk EWF {idx} corrompido: {e}")))?;
r.map_err(|e| {
io::Error::new(
io::ErrorKind::InvalidData,
format!("chunk EWF {idx} corrompido: {e}"),
)
})?;
v
}
};
@@ -529,7 +576,9 @@ impl Source for EwfSource {
fn inflate_all(raw: &[u8]) -> Vec<u8> {
let mut v = vec![];
if raw.len() > 2 && raw[0] == 0x78 {
let _ = flate2::read::ZlibDecoder::new(raw).take(1 << 24).read_to_end(&mut v);
let _ = flate2::read::ZlibDecoder::new(raw)
.take(1 << 24)
.read_to_end(&mut v);
if !v.is_empty() {
return v;
}
@@ -538,8 +587,13 @@ fn inflate_all(raw: &[u8]) -> Vec<u8> {
}
fn utf16_text(b: &[u8]) -> String {
let u: Vec<u16> = b.chunks_exact(2).map(|c| u16::from_le_bytes([c[0], c[1]])).collect();
String::from_utf16_lossy(&u).trim_start_matches('\u{feff}').to_string()
let u: Vec<u16> = b
.chunks_exact(2)
.map(|c| u16::from_le_bytes([c[0], c[1]]))
.collect();
String::from_utf16_lossy(&u)
.trim_start_matches('\u{feff}')
.to_string()
}
fn header_key_name(k: &str) -> &str {
@@ -594,9 +648,18 @@ fn parse_v2_text(text: &str, info: &mut EwfInfo, total_bytes: &mut u64, ty: u32)
let spc: u64 = v.parse().unwrap_or(64);
info.chunk_size = spc * 512;
}
(2, "tb") | (2, "gr") | (_, "dt") | (_, "pid") | (_, "rs") | (_, "ls") | (_, "ph") | (_, "tt") | (_, "at") => {}
(2, "tb")
| (2, "gr")
| (_, "dt")
| (_, "pid")
| (_, "rs")
| (_, "ls")
| (_, "ph")
| (_, "tt")
| (_, "at") => {}
(2, key) => {
info.fields.insert(header_key_name(key).to_string(), v.to_string());
info.fields
.insert(header_key_name(key).to_string(), v.to_string());
}
_ => {}
}
@@ -728,7 +791,12 @@ fn utc_now() -> String {
let d = doy - (153 * mp + 2) / 5 + 1;
let m = if mp < 10 { mp + 3 } else { mp - 9 };
let y = if m <= 2 { y + 1 } else { y };
format!("{y} {m} {d} {} {} {}", rem / 3600, rem % 3600 / 60, rem % 60)
format!(
"{y} {m} {d} {} {} {}",
rem / 3600,
rem % 3600 / 60,
rem % 60
)
}
/// Cria `base.E01` (e `.E02`... se houver divisão) a partir de `src`.
@@ -772,7 +840,8 @@ pub fn write_e01(
// O segmento está cheio? (reserva espaço para as tabelas e os hashes finais)
let full = |pos: u64, entries: u64| {
opts.segment_size > 0 && pos + chunk_size + 2 * (entries * 4 + 110) + 1024 >= opts.segment_size
opts.segment_size > 0
&& pos + chunk_size + 2 * (entries * 4 + 110) + 1024 >= opts.segment_size
};
let result = (|| -> Result<()> {
loop {
@@ -781,7 +850,9 @@ pub fn write_e01(
.write(true)
.create_new(true)
.open(&path)
.map_err(|e| Error::msg(format!("não foi possível criar {}: {e}", path.display())))?;
.map_err(|e| {
Error::msg(format!("não foi possível criar {}: {e}", path.display()))
})?;
crate::owner::give_to_user(&path);
created.push(path);
let mut w = SegWriter { f, pos: 0 };
@@ -794,7 +865,15 @@ pub fn write_e01(
let hdr = zlib(&header_text(opts, &now), 9);
w.section("header", &hdr, false)?;
w.section("header2", &hdr, false)?;
w.section("volume", &volume_data(opts, chunks_total as u32, total.div_ceil(opts.bytes_per_sector as u64)), false)?;
w.section(
"volume",
&volume_data(
opts,
chunks_total as u32,
total.div_ceil(opts.bytes_per_sector as u64),
),
false,
)?;
}
// Grupos "sectors" + "table" + "table2" até estourar o limite do segmento.
loop {
@@ -821,7 +900,9 @@ pub fn write_e01(
let mut o = 0;
while o < want {
let n = 512.min(want - o);
if crate::source::read_exact_at(src, off + o as u64, &mut b[o..o + n]).is_err() {
if crate::source::read_exact_at(src, off + o as u64, &mut b[o..o + n])
.is_err()
{
b[o..o + n].fill(0);
match rep.bad_ranges.last_mut() {
Some(l) if l.0 + l.1 == off + o as u64 => l.1 += n as u64,
@@ -833,7 +914,11 @@ pub fn write_e01(
}
hasher.update(b);
let rel = w.pos - base_off;
let packed = if opts.compression > 0 { zlib(b, opts.compression) } else { vec![] };
let packed = if opts.compression > 0 {
zlib(b, opts.compression)
} else {
vec![]
};
if opts.compression > 0 && packed.len() < want {
entries.push(rel as u32 | 0x8000_0000);
w.put(&packed)?;
@@ -888,8 +973,12 @@ pub fn write_e01(
if chunk_idx >= chunks_total {
// Segmento final: hashes e "done".
let h = std::mem::take(&mut hasher).finalize();
let md5: Vec<u8> = (0..16).map(|i| u8::from_str_radix(&h.md5[i * 2..i * 2 + 2], 16).unwrap()).collect();
let sha1: Vec<u8> = (0..20).map(|i| u8::from_str_radix(&h.sha1[i * 2..i * 2 + 2], 16).unwrap()).collect();
let md5: Vec<u8> = (0..16)
.map(|i| u8::from_str_radix(&h.md5[i * 2..i * 2 + 2], 16).unwrap())
.collect();
let sha1: Vec<u8> = (0..20)
.map(|i| u8::from_str_radix(&h.sha1[i * 2..i * 2 + 2], 16).unwrap())
.collect();
let mut hs = md5.clone();
hs.extend_from_slice(&[0; 16]);
let c = adler32(&hs);
@@ -924,6 +1013,9 @@ pub fn write_e01(
if rep.cancelled {
rep.bytes = chunk_idx * chunk_size;
}
crate::owner::write_owned(&base.with_extension("map.json"), serde_json::to_vec_pretty(&rep)?)?;
crate::owner::write_owned(
&base.with_extension("map.json"),
serde_json::to_vec_pretty(&rep)?,
)?;
Ok(rep)
}
+248 -47
View File
@@ -7,28 +7,64 @@ use crate::source::{read_vec, Source};
use crate::types::Confidence;
fn u16le(b: &[u8], o: usize) -> u64 {
b.get(o..o + 2).map(|s| u16::from_le_bytes([s[0], s[1]]) as u64).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_le_bytes([s[0], s[1]]) as u64)
.unwrap_or(0)
}
fn u32le(b: &[u8], o: usize) -> u64 {
b.get(o..o + 4).map(|s| u32::from_le_bytes(s.try_into().unwrap()) as u64).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_le_bytes(s.try_into().unwrap()) as u64)
.unwrap_or(0)
}
fn u64le(b: &[u8], o: usize) -> u64 {
b.get(o..o + 8).map(|s| u64::from_le_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 8)
.map(|s| u64::from_le_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
fn u32be(b: &[u8], o: usize) -> u64 {
b.get(o..o + 4).map(|s| u32::from_be_bytes(s.try_into().unwrap()) as u64).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_be_bytes(s.try_into().unwrap()) as u64)
.unwrap_or(0)
}
fn u16be(b: &[u8], o: usize) -> u64 {
b.get(o..o + 2).map(|s| u16::from_be_bytes([s[0], s[1]]) as u64).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_be_bytes([s[0], s[1]]) as u64)
.unwrap_or(0)
}
fn hit(len: u64, ext: &'static str, confidence: Confidence) -> Option<Hit> {
Some(Hit { len, ext, confidence })
Some(Hit {
len,
ext,
confidence,
})
}
/// Primeiros bytes que disparam os detectores deste módulo.
pub fn might_start(b0: u8) -> bool {
matches!(b0, 0x1F | b'B' | 0x1A | b'O' | b'R' | 0x7F | b'I' | b'M' | 0x00 | b'r' | b'E' | 0x47 | b'!' | b'F' | b'C' | b'Z' | 0x30 | b'{' | 0x28 | 0xD4 | 0x0A)
matches!(
b0,
0x1F | b'B'
| 0x1A
| b'O'
| b'R'
| 0x7F
| b'I'
| b'M'
| 0x00
| b'r'
| b'E'
| 0x47
| b'!'
| b'F'
| b'C'
| b'Z'
| 0x30
| b'{'
| 0x28
| 0xD4
| 0x0A
)
}
/// Tenta os formatos adicionais. `h` são os primeiros bytes (>= 12) lidos em `off`.
@@ -36,7 +72,10 @@ pub fn detect(src: &dyn Source, off: u64, h: &[u8], max: u64) -> Option<Hit> {
if h.starts_with(&[0x1F, 0x8B, 0x08]) {
return gzip(src, off, max);
}
if h.starts_with(b"BZh") && (b'1'..=b'9').contains(&h[3]) && h[4..10] == [0x31, 0x41, 0x59, 0x26, 0x53, 0x59] {
if h.starts_with(b"BZh")
&& (b'1'..=b'9').contains(&h[3])
&& h[4..10] == [0x31, 0x41, 0x59, 0x26, 0x53, 0x59]
{
return bzip2(src, off, max);
}
if h.starts_with(&[0x1A, 0x45, 0xDF, 0xA3]) {
@@ -68,7 +107,9 @@ pub fn detect(src: &dyn Source, off: u64, h: &[u8], max: u64) -> Option<Hit> {
}
if h.starts_with(b"MSCF") {
let len = u32le(h, 8);
return (len > 36 && len <= max).then(|| ()).and_then(|_| hit(len, "cab", Confidence::High));
return (len > 36 && len <= max)
.then_some(())
.and_then(|_| hit(len, "cab", Confidence::High));
}
if h.starts_with(b"!<arch>\n") {
return ar(src, off, max);
@@ -96,7 +137,9 @@ pub fn detect(src: &dyn Source, off: u64, h: &[u8], max: u64) -> Option<Hit> {
}
if h.starts_with(b"FORM") && matches!(&h[8..12], b"AIFF" | b"AIFC") {
let len = u32be(h, 4) + 8;
return (len <= max).then(|| ()).and_then(|_| hit(len, "aif", Confidence::High));
return (len <= max)
.then_some(())
.and_then(|_| hit(len, "aif", Confidence::High));
}
if h.starts_with(&[0x28, 0xB5, 0x2F, 0xFD]) {
return zstd(src, off, max);
@@ -113,7 +156,13 @@ pub fn detect(src: &dyn Source, off: u64, h: &[u8], max: u64) -> Option<Hit> {
// -------------------------------------------------------------- compactadores
/// Alimenta um descompactador com blocos de `src` até o fim do fluxo; devolve (bytes lidos, saída crc32 opcional).
fn inflate_len(src: &dyn Source, start: u64, max: u64, raw: bool, zlib_header: bool) -> Option<(u64, u32, u64)> {
fn inflate_len(
src: &dyn Source,
start: u64,
max: u64,
raw: bool,
zlib_header: bool,
) -> Option<(u64, u32, u64)> {
let mut d = flate2::Decompress::new(zlib_header && !raw);
let mut pos = start;
let mut out = vec![0u8; 1 << 16];
@@ -132,13 +181,19 @@ fn inflate_len(src: &dyn Source, start: u64, max: u64, raw: bool, zlib_header: b
while consumed < n {
let before_in = d.total_in();
let before_out = d.total_out();
let status = d.decompress(&buf[consumed..n], &mut out, flate2::FlushDecompress::None).ok()?;
let status = d
.decompress(&buf[consumed..n], &mut out, flate2::FlushDecompress::None)
.ok()?;
let used = (d.total_in() - before_in) as usize;
let produced = (d.total_out() - before_out) as usize;
for &b in &out[..produced] {
crc ^= b as u32;
for _ in 0..8 {
crc = if crc & 1 != 0 { (crc >> 1) ^ 0xEDB8_8320 } else { crc >> 1 };
crc = if crc & 1 != 0 {
(crc >> 1) ^ 0xEDB8_8320
} else {
crc >> 1
};
}
}
total_out += produced as u64;
@@ -178,7 +233,15 @@ fn gzip(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
let ok = u32le(&trailer, 0) as u32 == crc && u32le(&trailer, 4) == out_len & 0xFFFF_FFFF;
hit(p as u64 + consumed + 8, "gz", if ok { Confidence::High } else { Confidence::Medium })
hit(
p as u64 + consumed + 8,
"gz",
if ok {
Confidence::High
} else {
Confidence::Medium
},
)
}
fn bzip2(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -286,8 +349,13 @@ fn matroska(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
let h = read_vec(src, off, 4096).ok()?;
let (hs, hl, _) = vint(&h[4..])?;
let mut p = 4 + hl + hs as usize;
let doctype = String::from_utf8_lossy(&h[4 + hl..(4 + hl + hs as usize).min(h.len())]).to_string();
let ext = if doctype.contains("webm") { "webm" } else { "mkv" };
let doctype =
String::from_utf8_lossy(&h[4 + hl..(4 + hl + hs as usize).min(h.len())]).to_string();
let ext = if doctype.contains("webm") {
"webm"
} else {
"mkv"
};
if h.get(p..p + 4)? != [0x18, 0x53, 0x80, 0x67] {
return None;
}
@@ -307,9 +375,13 @@ fn matroska(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
if e.len() < 6 {
break;
}
let Some((id, idl, _)) = (e[0] >= 0x10).then(|| vint_id(&e)).flatten() else { break };
let Some((id, idl, _)) = (e[0] >= 0x10).then(|| vint_id(&e)).flatten() else {
break;
};
let _ = id;
let Some((size, sl2, unk)) = vint(&e[idl..]) else { break };
let Some((size, sl2, unk)) = vint(&e[idl..]) else {
break;
};
if unk {
break;
}
@@ -370,7 +442,17 @@ fn ogg(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
break;
}
}
(pages >= 2).then(|| ()).and_then(|_| hit(pos - off, "ogg", if eos { Confidence::High } else { Confidence::Low }))
(pages >= 2).then_some(()).and_then(|_| {
hit(
pos - off,
"ogg",
if eos {
Confidence::High
} else {
Confidence::Low
},
)
})
}
fn mpegts(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -396,7 +478,9 @@ fn mpegts(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
}
}
let len = n_packets * 188;
(n_packets >= 16).then(|| ()).and_then(|_| hit(len, "ts", Confidence::Medium))
(n_packets >= 16)
.then_some(())
.and_then(|_| hit(len, "ts", Confidence::Medium))
}
fn flv(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -420,14 +504,16 @@ fn flv(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
}
(tags > 3).then(|| ()).and_then(|_| hit(pos + 4 - off, "flv", Confidence::Medium))
(tags > 3)
.then_some(())
.and_then(|_| hit(pos + 4 - off, "flv", Confidence::Medium))
}
fn asf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
let h = read_vec(src, off, 30).ok()?;
let hdr_size = u64le(&h, 16);
let n_objs = u32le(&h, 24);
if hdr_size < 30 || hdr_size > 1 << 24 {
if !(30..=1 << 24).contains(&hdr_size) {
return None;
}
let all = read_vec(src, off + 30, (hdr_size - 30) as usize).ok()?;
@@ -437,7 +523,12 @@ fn asf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
break;
}
let size = u64le(&all, p + 16) as usize;
if all[p..p + 16] == [0xA1, 0xDC, 0xAB, 0x8C, 0x47, 0xA9, 0xCF, 0x11, 0x8E, 0xE4, 0x00, 0xC0, 0x0C, 0x20, 0x53, 0x65] {
if all[p..p + 16]
== [
0xA1, 0xDC, 0xAB, 0x8C, 0x47, 0xA9, 0xCF, 0x11, 0x8E, 0xE4, 0x00, 0xC0, 0x0C, 0x20,
0x53, 0x65,
]
{
let fsize = u64le(&all, p + 40);
if fsize >= hdr_size && fsize <= max {
return hit(fsize, "wmv", Confidence::High);
@@ -596,7 +687,9 @@ fn ar(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
}
(members >= 2).then(|| ()).and_then(|_| hit(pos - off, "deb", Confidence::Medium))
(members >= 2)
.then_some(())
.and_then(|_| hit(pos - off, "deb", Confidence::Medium))
}
fn swf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -606,11 +699,21 @@ fn swf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
if h[0] == b'F' {
return (len > 21 && len <= max).then(|| ()).and_then(|_| hit(len, "swf", Confidence::High));
return (len > 21 && len <= max)
.then_some(())
.and_then(|_| hit(len, "swf", Confidence::High));
}
// CWS: corpo em zlib a partir do byte 8
let (consumed, _, out) = inflate_len(src, off + 8, max, false, true)?;
hit(8 + consumed, "swf", if out + 8 == len { Confidence::High } else { Confidence::Medium })
hit(
8 + consumed,
"swf",
if out + 8 == len {
Confidence::High
} else {
Confidence::Medium
},
)
}
// ---------------------------------------------------------- binários e dados
@@ -635,9 +738,23 @@ fn elf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
let (shoff, shentsize, shnum, phoff, phentsize, phnum) = if is64 {
(rd(40, 8), rd(58, 2), rd(60, 2), rd(32, 8), rd(54, 2), rd(56, 2))
(
rd(40, 8),
rd(58, 2),
rd(60, 2),
rd(32, 8),
rd(54, 2),
rd(56, 2),
)
} else {
(rd(32, 4), rd(46, 2), rd(48, 2), rd(28, 4), rd(42, 2), rd(44, 2))
(
rd(32, 4),
rd(46, 2),
rd(48, 2),
rd(28, 4),
rd(42, 2),
rd(44, 2),
)
};
let mut end = shoff + shentsize * shnum;
// Segmentos de programa podem ir além (binários sem tabela de seções).
@@ -653,11 +770,27 @@ fn elf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
}
v
};
let (po, fs) = if is64 { (rd2(8, 8), rd2(32, 8)) } else { (rd2(4, 4), rd2(16, 4)) };
let (po, fs) = if is64 {
(rd2(8, 8), rd2(32, 8))
} else {
(rd2(4, 4), rd2(16, 4))
};
end = end.max(po + fs);
}
}
(end > 64 && end <= max.min(4 << 30)).then(|| ()).and_then(|_| hit(end, "elf", if shoff > 0 { Confidence::High } else { Confidence::Medium }))
(end > 64 && end <= max.min(4 << 30))
.then_some(())
.and_then(|_| {
hit(
end,
"elf",
if shoff > 0 {
Confidence::High
} else {
Confidence::Medium
},
)
})
}
fn tiff(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -665,11 +798,22 @@ fn tiff(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
let le = h[0] == b'I';
let r16 = |b: &[u8], o: usize| -> u64 {
let s = b.get(o..o + 2).unwrap_or(&[0, 0]);
if le { u16::from_le_bytes([s[0], s[1]]) as u64 } else { u16::from_be_bytes([s[0], s[1]]) as u64 }
if le {
u16::from_le_bytes([s[0], s[1]]) as u64
} else {
u16::from_be_bytes([s[0], s[1]]) as u64
}
};
let r32 = |b: &[u8], o: usize| -> u64 {
let s: [u8; 4] = b.get(o..o + 4).and_then(|x| x.try_into().ok()).unwrap_or([0; 4]);
if le { u32::from_le_bytes(s) as u64 } else { u32::from_be_bytes(s) as u64 }
let s: [u8; 4] = b
.get(o..o + 4)
.and_then(|x| x.try_into().ok())
.unwrap_or([0; 4]);
if le {
u32::from_le_bytes(s) as u64
} else {
u32::from_be_bytes(s) as u64
}
};
let mut ifd = r32(&h, 4);
let mut end = 8u64;
@@ -714,7 +858,11 @@ fn tiff(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
if count == 0 || count > 1 << 20 {
return out;
}
let bytes: Vec<u8> = if total <= 4 { en[8..8 + total as usize].to_vec() } else { read_vec(src, off + value_off, total as usize).unwrap_or_default() };
let bytes: Vec<u8> = if total <= 4 {
en[8..8 + total as usize].to_vec()
} else {
read_vec(src, off + value_off, total as usize).unwrap_or_default()
};
for k in 0..count as usize {
let v = match sz {
2 => r16(&bytes, k * 2),
@@ -726,8 +874,20 @@ fn tiff(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
out
};
match tag {
273 | 324 | 513 => strip_off = if tag == 513 { vec![r32(en, 8)] } else { read_vals(count) },
279 | 325 | 514 => strip_cnt = if tag == 514 { vec![r32(en, 8)] } else { read_vals(count) },
273 | 324 | 513 => {
strip_off = if tag == 513 {
vec![r32(en, 8)]
} else {
read_vals(count)
}
}
279 | 325 | 514 => {
strip_cnt = if tag == 514 {
vec![r32(en, 8)]
} else {
read_vals(count)
}
}
330 | 34665 | 34853 | 40965 => {
if ty == 4 && count == 1 {
subs.push(value_off);
@@ -739,7 +899,10 @@ fn tiff(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
}
_ => {}
}
if (tag == 273 || tag == 324 || tag == 513) && !strip_off.is_empty() && !strip_cnt.is_empty() {
if (tag == 273 || tag == 324 || tag == 513)
&& !strip_off.is_empty()
&& !strip_cnt.is_empty()
{
for (o, c) in strip_off.iter().zip(&strip_cnt) {
end = end.max(o + c);
}
@@ -749,13 +912,23 @@ fn tiff(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
end = end.max(o + c);
}
seen += 1;
ifd = if let Some(s) = subs.pop() { s } else { r32(&e, n * 12) };
ifd = if let Some(s) = subs.pop() {
s
} else {
r32(&e, n * 12)
};
if end > max {
return None;
}
}
let ext = if h.get(8..10) == Some(b"CR") { "cr2" } else { "tif" };
(end > 16).then(|| ()).and_then(|_| hit(end, ext, Confidence::Medium))
let ext = if h.get(8..10) == Some(b"CR") {
"cr2"
} else {
"tif"
};
(end > 16)
.then_some(())
.and_then(|_| hit(end, ext, Confidence::Medium))
}
fn ico(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -795,7 +968,17 @@ fn regf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
}
let ok = x == u32le(&h, 0x1FC) as u32;
let len = 4096 + u32le(&h, 0x28);
(len > 4096 && len <= max).then(|| ()).and_then(|_| hit(len, "dat", if ok { Confidence::High } else { Confidence::Medium }))
(len > 4096 && len <= max).then_some(()).and_then(|_| {
hit(
len,
"dat",
if ok {
Confidence::High
} else {
Confidence::Medium
},
)
})
}
fn evtx(src: &dyn Source, off: u64) -> Option<Hit> {
@@ -817,8 +1000,14 @@ fn pst(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
let ver = u16le(&h, 10);
let len = if ver >= 23 { u64le(&h, 0xB8) } else { u32le(&h, 0xA8) };
(len > 0x200 && len <= max).then(|| ()).and_then(|_| hit(len, "pst", Confidence::High))
let len = if ver >= 23 {
u64le(&h, 0xB8)
} else {
u32le(&h, 0xA8)
};
(len > 0x200 && len <= max)
.then_some(())
.and_then(|_| hit(len, "pst", Confidence::High))
}
fn rtf(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -863,7 +1052,11 @@ fn pcap(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
let le = h[0] == 0xD4;
let r32 = |b: &[u8], o: usize| -> u64 {
let s: [u8; 4] = b[o..o + 4].try_into().unwrap();
if le { u32::from_le_bytes(s) as u64 } else { u32::from_be_bytes(s) as u64 }
if le {
u32::from_le_bytes(s) as u64
} else {
u32::from_be_bytes(s) as u64
}
};
let snaplen = r32(&h, 16);
if snaplen == 0 || snaplen > 1 << 20 {
@@ -896,7 +1089,9 @@ fn pcap(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
}
(n > 0).then(|| ()).and_then(|_| hit(pos - off, "pcap", Confidence::Medium))
(n > 0)
.then_some(())
.and_then(|_| hit(pos - off, "pcap", Confidence::Medium))
}
fn pcapng(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
@@ -908,7 +1103,11 @@ fn pcapng(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
};
let r32 = |b: &[u8], o: usize| -> u64 {
let s: [u8; 4] = b[o..o + 4].try_into().unwrap();
if le { u32::from_le_bytes(s) as u64 } else { u32::from_be_bytes(s) as u64 }
if le {
u32::from_le_bytes(s) as u64
} else {
u32::from_be_bytes(s) as u64
}
};
let mut pos = off;
let mut blocks = 0;
@@ -931,5 +1130,7 @@ fn pcapng(src: &dyn Source, off: u64, max: u64) -> Option<Hit> {
return None;
}
}
(blocks >= 2).then(|| ()).and_then(|_| hit(pos - off, "pcapng", Confidence::Medium))
(blocks >= 2)
.then_some(())
.and_then(|_| hit(pos - off, "pcapng", Confidence::Medium))
}
+162 -42
View File
@@ -9,13 +9,19 @@ use crate::types::{Confidence, DataLoc, Extent, Origin};
use std::collections::{BTreeMap, HashMap, HashSet};
fn le16(b: &[u8], o: usize) -> u16 {
b.get(o..o + 2).map(|s| u16::from_le_bytes([s[0], s[1]])).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_le_bytes([s[0], s[1]]))
.unwrap_or(0)
}
fn le32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_le_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_le_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
fn le64(b: &[u8], o: usize) -> u64 {
b.get(o..o + 8).map(|s| u64::from_le_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 8)
.map(|s| u64::from_le_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
const OBJ_TYPE_MASK: u32 = 0xFFFF;
@@ -99,22 +105,42 @@ impl<'a> Apfs<'a> {
}
let ks = key_base + koff;
let k = b.get(ks..ks + klen)?.to_vec();
let v = if voff == 0xFFFF { vec![] } else { b.get(val_end.checked_sub(voff)?..)?.get(..vlen)?.to_vec() };
let v = if voff == 0xFFFF {
vec![]
} else {
b.get(val_end.checked_sub(voff)?..)?.get(..vlen)?.to_vec()
};
entries.push((k, v));
}
Some(BNode { flags, level, entries, oid: le64(b, 8), xid: le64(b, 16) })
Some(BNode {
flags,
level,
entries,
oid: le64(b, 8),
xid: le64(b, 16),
})
}
/// Todas as entradas de uma árvore física (mapa de objetos): filhos são endereços físicos.
fn walk_physical(&self, root: u64, fixed_k: usize, fixed_v: usize, f: &mut dyn FnMut(&[u8], &[u8])) {
fn walk_physical(
&self,
root: u64,
fixed_k: usize,
fixed_v: usize,
f: &mut dyn FnMut(&[u8], &[u8]),
) {
let mut stack = vec![(root, 0u32)];
let mut seen = HashSet::new();
while let Some((p, depth)) = stack.pop() {
if depth > 8 || !seen.insert(p) {
continue;
}
let Some(b) = self.checked_block(p) else { continue };
let Some(n) = self.parse_node(&b, fixed_k, fixed_v) else { continue };
let Some(b) = self.checked_block(p) else {
continue;
};
let Some(n) = self.parse_node(&b, fixed_k, fixed_v) else {
continue;
};
if n.level == 0 {
for (k, v) in &n.entries {
f(k, v);
@@ -130,10 +156,14 @@ impl<'a> Apfs<'a> {
/// Mapa de objetos: oid -> [(xid, paddr)] ordenado por xid.
fn omap(&self, omap_paddr: u64) -> HashMap<u64, Vec<(u64, u64)>> {
let mut m: HashMap<u64, Vec<(u64, u64)>> = HashMap::new();
let Some(ob) = self.checked_block(omap_paddr) else { return m };
let Some(ob) = self.checked_block(omap_paddr) else {
return m;
};
let tree = le64(&ob, 48);
self.walk_physical(tree, 16, 16, &mut |k, v| {
m.entry(le64(k, 0)).or_default().push((le64(k, 8), le64(v, 8)));
m.entry(le64(k, 0))
.or_default()
.push((le64(k, 8), le64(v, 8)));
});
for v in m.values_mut() {
v.sort();
@@ -143,7 +173,11 @@ impl<'a> Apfs<'a> {
}
fn lookup(m: &HashMap<u64, Vec<(u64, u64)>>, oid: u64, max_xid: u64) -> Option<u64> {
m.get(&oid)?.iter().rev().find(|(x, _)| *x <= max_xid).map(|(_, p)| *p)
m.get(&oid)?
.iter()
.rev()
.find(|(x, _)| *x <= max_xid)
.map(|(_, p)| *p)
}
// ---------------------------------------------------------------- registros
@@ -188,7 +222,7 @@ fn add_record(files: &mut Files, extents: &mut Extents, k: &[u8], v: &[u8]) {
mtime: ns(le64(v, 24)),
atime: ns(le64(v, 40)),
mode: le16(v, 80),
size: le64(v, 84).max(0),
size: le64(v, 84),
has: true,
..Default::default()
};
@@ -204,7 +238,14 @@ fn add_record(files: &mut Files, extents: &mut Extents, k: &[u8], v: &[u8]) {
let (xt, xs) = (xf[4 + i * 4], le16(xf, 6 + i * 4) as usize);
let data = xf.get(p..p + xs).unwrap_or(&[]);
match xt {
4 => ino.name = Some(String::from_utf8_lossy(data.split(|&c| c == 0).next().unwrap_or(&[])).to_string()),
4 => {
ino.name = Some(
String::from_utf8_lossy(
data.split(|&c| c == 0).next().unwrap_or(&[]),
)
.to_string(),
)
}
8 if data.len() >= 8 => ino.size = le64(data, 0),
_ => {}
}
@@ -216,13 +257,17 @@ fn add_record(files: &mut Files, extents: &mut Extents, k: &[u8], v: &[u8]) {
R_DIR_REC if k.len() > 12 && v.len() >= 18 => {
let nl = (le32(k, 8) & 0x3FF) as usize;
if let Some(name) = k.get(12..12 + nl) {
let name = String::from_utf8_lossy(name.split(|&c| c == 0).next().unwrap_or(&[])).to_string();
let name = String::from_utf8_lossy(name.split(|&c| c == 0).next().unwrap_or(&[]))
.to_string();
files.entry(le64(v, 0)).or_default().names.insert(id, name);
}
}
R_FILE_EXTENT if k.len() >= 16 && v.len() >= 24 => {
let len = le64(v, 0) & 0x00FF_FFFF_FFFF_FFFF;
extents.entry(id).or_default().insert(le64(k, 8), (len, le64(v, 8), le64(v, 16)));
extents
.entry(id)
.or_default()
.insert(le64(k, 8), (len, le64(v, 8), le64(v, 16)));
}
_ => {}
}
@@ -230,16 +275,28 @@ fn add_record(files: &mut Files, extents: &mut Extents, k: &[u8], v: &[u8]) {
impl Apfs<'_> {
/// Percorre a árvore de arquivos a partir de uma raiz virtual.
fn walk_fstree(&self, root_oid: u64, omap: &HashMap<u64, Vec<(u64, u64)>>, xid: u64, f: &mut dyn FnMut(&[u8], &[u8], u64)) {
let Some(rp) = lookup(omap, root_oid, xid) else { return };
fn walk_fstree(
&self,
root_oid: u64,
omap: &HashMap<u64, Vec<(u64, u64)>>,
xid: u64,
f: &mut dyn FnMut(&[u8], &[u8], u64),
) {
let Some(rp) = lookup(omap, root_oid, xid) else {
return;
};
let mut stack = vec![(rp, 0u32)];
let mut seen = HashSet::new();
while let Some((p, depth)) = stack.pop() {
if depth > 10 || !seen.insert(p) {
continue;
}
let Some(b) = self.checked_block(p) else { continue };
let Some(n) = self.parse_node(&b, 16, 16) else { continue };
let Some(b) = self.checked_block(p) else {
continue;
};
let Some(n) = self.parse_node(&b, 16, 16) else {
continue;
};
if n.level == 0 {
for (k, v) in &n.entries {
f(k, v, p);
@@ -261,7 +318,10 @@ fn path_of(files: &Files, mut id: u64) -> String {
if id == 2 || id == 1 {
break;
}
match files.get(&id).and_then(|f| f.names.iter().next().map(|(p, n)| (*p, n.clone()))) {
match files
.get(&id)
.and_then(|f| f.names.iter().next().map(|(p, n)| (*p, n.clone())))
{
Some((p, n)) => {
parts.push(n);
id = p;
@@ -285,7 +345,11 @@ fn parse_volume(b: &[u8]) -> Option<Volume> {
if &b[32..36] != b"APSB" {
return None;
}
let name = String::from_utf8_lossy(&b[704..960]).split('\0').next().unwrap_or("").to_string();
let name = String::from_utf8_lossy(&b[704..960])
.split('\0')
.next()
.unwrap_or("")
.to_string();
Some(Volume {
name,
omap_paddr: le64(b, 128),
@@ -305,7 +369,12 @@ fn open_container<'a>(src: &'a dyn Source, base: u64) -> Option<(Apfs<'a>, Vec<u
if !(4096..=65536).contains(&bs) || !bs.is_power_of_two() {
return None;
}
let a = Apfs { src, base, bs, blocks };
let a = Apfs {
src,
base,
bs,
blocks,
};
// O superbloco mais recente está na área de descritores de checkpoint.
let desc_blocks = le32(&b0, 104) as u64;
let desc_base = le64(&b0, 112);
@@ -323,8 +392,12 @@ fn open_container<'a>(src: &'a dyn Source, base: u64) -> Option<(Apfs<'a>, Vec<u
pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let _ = part_len;
let mut res = VolumeScan::default();
let Some((a, nx)) = open_container(ctx.src, base) else { return res };
let Some(cont_omap_block) = a.checked_block(le64(&nx, 160)) else { return res };
let Some((a, nx)) = open_container(ctx.src, base) else {
return res;
};
let Some(cont_omap_block) = a.checked_block(le64(&nx, 160)) else {
return res;
};
let _ = cont_omap_block;
let container_omap = a.omap(le64(&nx, 160));
let max_fs = le32(&nx, 180).min(100) as usize;
@@ -379,8 +452,12 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
if !seen.insert(p) {
continue;
}
let Some(b) = a.checked_block(p) else { continue };
let Some(n) = a.parse_node(&b, 0, 0) else { continue };
let Some(b) = a.checked_block(p) else {
continue;
};
let Some(n) = a.parse_node(&b, 0, 0) else {
continue;
};
if n.level == 0 {
for (k, val) in &n.entries {
let hdr = le64(k, 0);
@@ -397,8 +474,12 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
}
}
for (xid, sblock) in snaps {
let Some(sb) = a.checked_block(sblock) else { continue };
let Some(sv) = parse_volume(&sb) else { continue };
let Some(sb) = a.checked_block(sblock) else {
continue;
};
let Some(sv) = parse_volume(&sb) else {
continue;
};
a.walk_fstree(sv.root_oid, &omap, xid, &mut |k, val, _| {
add_record(&mut stale, &mut stale_ext, k, val);
});
@@ -417,7 +498,10 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
}
let Some(b) = a.block(p) else { continue };
let ty = le32(&b, 24) & OBJ_TYPE_MASK;
if (ty != T_BTREE_NODE && ty != T_BTREE_ROOT) || le32(&b, 28) != SUBTYPE_FSTREE || le16(&b, 34) != 0 {
if (ty != T_BTREE_NODE && ty != T_BTREE_ROOT)
|| le32(&b, 28) != SUBTYPE_FSTREE
|| le16(&b, 34) != 0
{
continue;
}
if live_nodes.contains(&p) || fletcher64(&b[8..]) != le64(&b, 0) {
@@ -436,7 +520,7 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
ids.sort();
let mut seen_first: HashSet<u64> = HashSet::new();
for id in ids {
if live.get(id).map_or(false, |f| f.inode.has) {
if live.get(id).is_some_and(|f| f.inode.has) {
continue;
}
let rec = &stale[id];
@@ -444,7 +528,9 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
if !ino.has || ino.mode & 0o170000 != 0o100000 || ino.size == 0 {
continue;
}
let Some(ex) = stale_ext.get(&ino.private_id) else { continue };
let Some(ex) = stale_ext.get(&ino.private_id) else {
continue;
};
if ex.values().any(|e| e.2 != 0) {
continue; // extensão cifrada
}
@@ -456,17 +542,29 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
None => (format!("arquivo_{id}"), ino.parent),
},
};
let merged: Files = stale.iter().map(|(k, v)| (*k, v.clone())).chain(live.iter().map(|(k, v)| (*k, v.clone()))).collect();
let merged: Files = stale
.iter()
.map(|(k, v)| (*k, v.clone()))
.chain(live.iter().map(|(k, v)| (*k, v.clone())))
.collect();
let dir = Some(format!("/{}", path_of(&merged, parent)).replace("//", "/"));
let mut extents: Vec<Extent> = vec![];
let mut pos = 0u64;
let mut ok = true;
for (&lo, &(len, paddr, _)) in ex {
if lo > pos {
extents.push(Extent { offset: 0, len: lo - pos, sparse: true });
extents.push(Extent {
offset: 0,
len: lo - pos,
sparse: true,
});
}
if paddr == 0 {
extents.push(Extent { offset: 0, len, sparse: true });
extents.push(Extent {
offset: 0,
len,
sparse: true,
});
} else if paddr < a.blocks {
extents.push(Extent::new(a.base + paddr * a.bs, len));
} else {
@@ -478,11 +576,17 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
continue;
}
let extents = super::fat::trim_extents(extents, ino.size);
let Some(first) = extents.iter().find(|e| !e.sparse) else { continue };
let Some(first) = extents.iter().find(|e| !e.sparse) else {
continue;
};
if !seen_first.insert(first.offset) {
continue;
}
let note = if ino.compressed { "arquivo comprimido pelo macOS (decmpfs): o conteúdo pode estar incompleto" } else { "versão antiga da árvore ou instantâneo do APFS" };
let note = if ino.compressed {
"arquivo comprimido pelo macOS (decmpfs): o conteúdo pode estar incompleto"
} else {
"versão antiga da árvore ou instantâneo do APFS"
};
let ts = |t: i64| (t > 0).then_some(t);
let nf = NewFound {
name,
@@ -493,7 +597,11 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
modified: ts(ino.mtime),
created: ts(ino.ctime),
accessed: ts(ino.atime),
base: if ino.compressed { Confidence::Low } else { Confidence::Medium },
base: if ino.compressed {
Confidence::Low
} else {
Confidence::Medium
},
note: Some(note),
};
let f = make_found(ctx, nf);
@@ -504,13 +612,19 @@ fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res:
/// Arquivos e pastas atuais do primeiro volume sem cifragem (caminho, tamanho, é pasta).
pub fn live_paths(src: &dyn Source, base: u64) -> Vec<(String, u64, bool)> {
let Some((a, nx)) = open_container(src, base) else { return vec![] };
let Some((a, nx)) = open_container(src, base) else {
return vec![];
};
let cont = a.omap(le64(&nx, 160));
let mut out = vec![];
for i in 0..le32(&nx, 180).min(100) as usize {
let oid = le64(&nx, 184 + i * 8);
let Some(p) = lookup(&cont, oid, u64::MAX) else { continue };
let Some(vb) = a.checked_block(p) else { continue };
let Some(p) = lookup(&cont, oid, u64::MAX) else {
continue;
};
let Some(vb) = a.checked_block(p) else {
continue;
};
let Some(v) = parse_volume(&vb) else { continue };
if v.encrypted {
continue;
@@ -518,12 +632,18 @@ pub fn live_paths(src: &dyn Source, base: u64) -> Vec<(String, u64, bool)> {
let omap = a.omap(v.omap_paddr);
let mut files: Files = HashMap::new();
let mut ext: Extents = HashMap::new();
a.walk_fstree(v.root_oid, &omap, u64::MAX, &mut |k, val, _| add_record(&mut files, &mut ext, k, val));
a.walk_fstree(v.root_oid, &omap, u64::MAX, &mut |k, val, _| {
add_record(&mut files, &mut ext, k, val)
});
for (&id, f) in &files {
if !f.inode.has || id <= 2 {
continue;
}
out.push((path_of(&files, id), f.inode.size, f.inode.mode & 0o170000 == 0o040000));
out.push((
path_of(&files, id),
f.inode.size,
f.inode.mode & 0o170000 == 0o040000,
));
}
}
out.sort();
+158 -36
View File
@@ -22,13 +22,19 @@ const METADATA_ITEM: u8 = 169;
const CHUNK_ITEM: u8 = 228;
fn le16(b: &[u8], o: usize) -> u16 {
b.get(o..o + 2).map(|s| u16::from_le_bytes([s[0], s[1]])).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_le_bytes([s[0], s[1]]))
.unwrap_or(0)
}
fn le32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_le_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_le_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
fn le64(b: &[u8], o: usize) -> u64 {
b.get(o..o + 8).map(|s| u64::from_le_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 8)
.map(|s| u64::from_le_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
pub fn crc32c(data: &[u8]) -> u32 {
@@ -38,7 +44,11 @@ pub fn crc32c(data: &[u8]) -> u32 {
for i in 0..256u32 {
let mut c = i;
for _ in 0..8 {
c = if c & 1 != 0 { (c >> 1) ^ 0x82F6_3B78 } else { c >> 1 };
c = if c & 1 != 0 {
(c >> 1) ^ 0x82F6_3B78
} else {
c >> 1
};
}
t[i as usize] = c;
}
@@ -59,7 +69,11 @@ pub struct Key {
}
fn key_at(b: &[u8], o: usize) -> Key {
Key { objectid: le64(b, o), ty: b.get(o + 8).copied().unwrap_or(0), offset: le64(b, o + 9) }
Key {
objectid: le64(b, o),
ty: b.get(o + 8).copied().unwrap_or(0),
offset: le64(b, o + 9),
}
}
#[derive(Clone, Debug)]
@@ -108,7 +122,10 @@ impl<'a> Fs<'a> {
}
let nodesize = le32(&sb, 148) as u64;
let sectorsize = le32(&sb, 144) as u64;
if !nodesize.is_power_of_two() || !(4096..=65536).contains(&nodesize) || !sectorsize.is_power_of_two() {
if !nodesize.is_power_of_two()
|| !(4096..=65536).contains(&nodesize)
|| !sectorsize.is_power_of_two()
{
return None;
}
let mut fsid = [0u8; 16];
@@ -156,9 +173,17 @@ impl<'a> Fs<'a> {
}
fn phys(&self, logical: u64) -> Option<u64> {
let i = self.chunks.partition_point(|c| c.logical + c.len <= logical);
let i = self
.chunks
.partition_point(|c| c.logical + c.len <= logical);
let c = self.chunks.get(i)?;
(c.logical <= logical).then(|| c.phys.first().map(|p| self.base + p + (logical - c.logical))).flatten()
(c.logical <= logical)
.then(|| {
c.phys
.first()
.map(|p| self.base + p + (logical - c.logical))
})
.flatten()
}
fn read_node(&self, logical: u64) -> Option<Node> {
@@ -172,7 +197,7 @@ impl<'a> Fs<'a> {
return None;
}
let bytenr = le64(raw, 48);
if expect.map_or(false, |e| e != bytenr) {
if expect.is_some_and(|e| e != bytenr) {
return None;
}
if crc32c(&raw[32..]) != le32(raw, 0) {
@@ -208,7 +233,12 @@ impl<'a> Fs<'a> {
}
NodeKind::Internal(ptrs)
};
Some(Node { bytenr, generation: le64(raw, 80), owner: le64(raw, 88), kind })
Some(Node {
bytenr,
generation: le64(raw, 80),
owner: le64(raw, 88),
kind,
})
}
/// Percorre uma árvore em ordem, chamando `f` para cada item de folha.
@@ -222,7 +252,14 @@ impl<'a> Fs<'a> {
self.walk_inner(root, f, &mut seen, nodes, 0);
}
fn walk_inner(&self, at: u64, f: &mut dyn FnMut(&Key, &[u8]), seen: &mut HashSet<u64>, nodes: &mut dyn FnMut(&Node), depth: u32) {
fn walk_inner(
&self,
at: u64,
f: &mut dyn FnMut(&Key, &[u8]),
seen: &mut HashSet<u64>,
nodes: &mut dyn FnMut(&Node),
depth: u32,
) {
if depth > 10 || !seen.insert(at) {
return;
}
@@ -254,7 +291,15 @@ fn parse_chunk(d: &[u8], logical: u64) -> Option<(Chunk, usize)> {
return None;
}
let phys = (0..nstripes).map(|i| le64(d, 48 + i * 32 + 8)).collect();
Some((Chunk { logical, len, ty, phys }, 48 + nstripes * 32))
Some((
Chunk {
logical,
len,
ty,
phys,
},
48 + nstripes * 32,
))
}
// ---------------------------------------------------------------- inodes
@@ -293,7 +338,11 @@ fn add_item(files: &mut Files, owner: u64, gen: u64, k: &Key, d: &[u8]) {
INODE_REF if d.len() >= 10 => {
let nlen = le16(d, 8) as usize;
if let Some(n) = d.get(10..10 + nlen) {
files.entry((owner, k.objectid)).or_default().refs.insert(k.offset, String::from_utf8_lossy(n).to_string());
files
.entry((owner, k.objectid))
.or_default()
.refs
.insert(k.offset, String::from_utf8_lossy(n).to_string());
}
}
EXTENT_DATA if d.len() >= 21 => {
@@ -319,7 +368,11 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let Some(fs) = Fs::open(ctx.src, base) else {
return res;
};
if fs.chunks.iter().any(|c| c.ty & 0x1 << 3 != 0 || c.ty & 0x10 != 0 || c.ty & 0x100 != 0 || c.ty & 0x200 != 0) {
if fs
.chunks
.iter()
.any(|c| c.ty & 0x1 << 3 != 0 || c.ty & 0x10 != 0 || c.ty & 0x100 != 0 || c.ty & 0x200 != 0)
{
res.warnings.push("Btrfs em RAID 0/10/5/6: a leitura de metadados ainda não suporta esses perfis; usando só assinaturas.".into());
return res;
}
@@ -404,11 +457,18 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let mut stale: Files = HashMap::new();
let ns = fs.nodesize as usize;
let step = fs.sectorsize as usize;
let md_chunks: Vec<Chunk> = fs.chunks.iter().filter(|c| c.ty & 0x4 != 0).cloned().collect();
let md_chunks: Vec<Chunk> = fs
.chunks
.iter()
.filter(|c| c.ty & 0x4 != 0)
.cloned()
.collect();
let total_md: u64 = md_chunks.iter().map(|c| c.len).sum();
let mut done_md = 0u64;
for c in &md_chunks {
let Some(p0) = c.phys.first().copied() else { continue };
let Some(p0) = c.phys.first().copied() else {
continue;
};
let mut off = 0u64;
let block = 8usize << 20;
while off < c.len {
@@ -416,12 +476,17 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
return res;
}
let n = ((c.len - off) as usize).min(block + ns);
let Ok(buf) = read_vec(ctx.src, fs.base + p0 + off, n) else { break };
let Ok(buf) = read_vec(ctx.src, fs.base + p0 + off, n) else {
break;
};
let mut i = 0usize;
while i + ns <= buf.len() && (off + i as u64) < c.len {
let logical = c.logical + off + i as u64;
// cabeçalho barato antes do CRC
if buf[i + 32..i + 48] == fs.fsid && le64(&buf[i..], 48) == logical && buf[i + 100] == 0 {
if buf[i + 32..i + 48] == fs.fsid
&& le64(&buf[i..], 48) == logical
&& buf[i + 100] == 0
{
if let Some(node) = fs.parse_node(&buf[i..i + ns], Some(logical)) {
if is_fs_tree(node.owner) && !live_nodes.contains(&logical) {
if let NodeKind::Leaf(items) = &node.kind {
@@ -473,18 +538,32 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
if !e.has_inode || e.mode & 0o170000 != 0o100000 || e.size == 0 || e.extents.is_empty() {
continue;
}
let Some((name, parent)) = e.refs.iter().next().map(|(p, n)| (n.clone(), *p)) else { continue };
let Some((name, parent)) = e.refs.iter().next().map(|(p, n)| (n.clone(), *p)) else {
continue;
};
let dir = {
let p = path_of(owner, parent);
Some(if p.is_empty() { String::new() } else { format!("/{p}") })
Some(if p.is_empty() {
String::new()
} else {
format!("/{p}")
})
};
let Some((data, any_alloc, all_ok)) = build_data(&fs, e, &allocated) else {
continue;
};
let Some((data, any_alloc, all_ok)) = build_data(&fs, e, &allocated) else { continue };
let (conf, note) = if !all_ok {
(Confidence::Low, "faltam trechos do arquivo na versão antiga da árvore".to_string())
(
Confidence::Low,
"faltam trechos do arquivo na versão antiga da árvore".to_string(),
)
} else if any_alloc {
(Confidence::Medium, "versão antiga do Btrfs; alguns blocos ainda constam como alocados (podem ser de outro arquivo)".to_string())
} else {
(Confidence::High, "versão antiga da árvore do Btrfs; blocos de dados livres".to_string())
(
Confidence::High,
"versão antiga da árvore do Btrfs; blocos de dados livres".to_string(),
)
};
let ts = |t: i64| (t > 0).then_some(t);
let nf = NewFound {
@@ -526,7 +605,10 @@ fn build_data(fs: &Fs, e: &InodeData, allocated: &[Extent]) -> Option<(DataLoc,
}
if foff > pos {
sparse_marks.push(parts.len());
parts.push(Part::Run { offset: 0, len: foff - pos });
parts.push(Part::Run {
offset: 0,
len: foff - pos,
});
plain_only = false;
pos = foff;
}
@@ -541,7 +623,9 @@ fn build_data(fs: &Fs, e: &InodeData, allocated: &[Extent]) -> Option<(DataLoc,
c => decode(c, raw, ram)?,
};
let len = (bytes.len() as u64).min(e.size - foff);
parts.push(Part::Bytes { bytes: bytes[..len as usize].to_vec() });
parts.push(Part::Bytes {
bytes: bytes[..len as usize].to_vec(),
});
plain_only = false;
pos = foff + len;
continue;
@@ -554,7 +638,10 @@ fn build_data(fs: &Fs, e: &InodeData, allocated: &[Extent]) -> Option<(DataLoc,
let num = num.min(e.size.saturating_sub(foff));
if disk == 0 || ty == 2 {
sparse_marks.push(parts.len());
parts.push(Part::Run { offset: 0, len: num });
parts.push(Part::Run {
offset: 0,
len: num,
});
plain_only = false;
} else {
let Some(phys) = fs.phys(disk) else {
@@ -563,22 +650,32 @@ fn build_data(fs: &Fs, e: &InodeData, allocated: &[Extent]) -> Option<(DataLoc,
};
let overlaps = {
let i = allocated.partition_point(|x| x.end() <= disk);
allocated.get(i).map_or(false, |x| x.offset < disk + disk_len)
allocated.get(i).is_some_and(|x| x.offset < disk + disk_len)
};
any_alloc |= overlaps;
if comp == 0 {
parts.push(Part::Run { offset: phys + offset, len: num });
parts.push(Part::Run {
offset: phys + offset,
len: num,
});
} else {
let codec = match comp {
1 => PackedCodec::Zlib,
2 => PackedCodec::Zstd,
3 | 4 | 5 | 6 => PackedCodec::Lzo,
3..=6 => PackedCodec::Lzo,
_ => {
all_ok = false;
break;
}
};
parts.push(Part::Packed(Packed { offset: phys, disk_len, ram_len: le64(d, 8), skip: offset, len: num, codec }));
parts.push(Part::Packed(Packed {
offset: phys,
disk_len,
ram_len: le64(d, 8),
skip: offset,
len: num,
codec,
}));
plain_only = false;
}
}
@@ -588,7 +685,16 @@ fn build_data(fs: &Fs, e: &InodeData, allocated: &[Extent]) -> Option<(DataLoc,
all_ok = false;
}
if plain_only {
let ex: Vec<Extent> = parts.iter().filter_map(|p| if let Part::Run { offset, len } = p { Some(Extent::new(*offset, *len)) } else { None }).collect();
let ex: Vec<Extent> = parts
.iter()
.filter_map(|p| {
if let Part::Run { offset, len } = p {
Some(Extent::new(*offset, *len))
} else {
None
}
})
.collect();
return Some((DataLoc::Extents { extents: ex }, any_alloc, all_ok));
}
// Buracos viram trechos esparsos: Part::Run com offset 0 não serve; usa Bytes de zeros pequenos.
@@ -610,7 +716,9 @@ fn decode(codec: u8, raw: &[u8], ram: usize) -> Option<Vec<u8>> {
1 => {
use std::io::Read;
let mut v = Vec::with_capacity(ram);
flate2::read::ZlibDecoder::new(raw).read_to_end(&mut v).ok()?;
flate2::read::ZlibDecoder::new(raw)
.read_to_end(&mut v)
.ok()?;
Some(v)
}
2 => {
@@ -695,7 +803,11 @@ pub fn lzo1x_decompress(src: &[u8], max_out: usize) -> Option<Vec<u8>> {
}
let h = byte(ip)?;
ip += 1;
let (dist, len) = if state == 4 { ((t >> 2) + (h << 2) + 2049, 3) } else { ((t >> 2) + (h << 2) + 1, 2) };
let (dist, len) = if state == 4 {
((t >> 2) + (h << 2) + 2049, 3)
} else {
((t >> 2) + (h << 2) + 1, 2)
};
copy_match(&mut out, dist, len)?;
let next = t & 3;
lits(&mut out, &mut ip, next)?;
@@ -708,7 +820,11 @@ pub fn lzo1x_decompress(src: &[u8], max_out: usize) -> Option<Vec<u8>> {
lits(&mut out, &mut ip, next)?;
state = next;
} else if t >= 32 {
let len = if t & 31 == 0 { ext(&mut ip, 31)? } else { t & 31 } + 2;
let len = if t & 31 == 0 {
ext(&mut ip, 31)?
} else {
t & 31
} + 2;
let b = (byte(ip)?) | (byte(ip + 1)? << 8);
ip += 2;
copy_match(&mut out, 1 + (b >> 2), len)?;
@@ -745,7 +861,9 @@ fn copy_match(out: &mut Vec<u8>, dist: usize, len: usize) -> Option<()> {
/// Arquivos e pastas atuais com caminho completo e tamanho (usa só as árvores vivas).
pub fn live_paths(src: &dyn Source, base: u64) -> Vec<(String, u64, bool)> {
let Some(fs) = Fs::open(src, base) else { return vec![] };
let Some(fs) = Fs::open(src, base) else {
return vec![];
};
let mut roots: Vec<(u64, u64)> = vec![];
fs.walk(fs.root, &mut |k, d| {
if k.ty == ROOT_ITEM && d.len() >= 239 && is_fs_tree(k.objectid) {
@@ -817,6 +935,10 @@ pub fn locate_trees(src: &dyn Source, base: u64) -> Option<TreeLocations> {
root_tree_logical: fs.root,
fs_tree_logical: fs_t,
extent_tree_logical: ext_t,
chunks: fs.chunks.iter().filter_map(|c| c.phys.first().map(|p| (c.logical, c.len, fs.base + p))).collect(),
chunks: fs
.chunks
.iter()
.filter_map(|c| c.phys.first().map(|p| (c.logical, c.len, fs.base + p)))
.collect(),
})
}
+193 -55
View File
@@ -18,13 +18,19 @@ const EXT_MAGIC: u16 = 0xF30A;
const JBD2_MAGIC: u32 = 0xC03B_3998;
fn le16(b: &[u8], o: usize) -> u16 {
b.get(o..o + 2).map(|s| u16::from_le_bytes([s[0], s[1]])).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_le_bytes([s[0], s[1]]))
.unwrap_or(0)
}
fn le32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_le_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_le_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
fn be32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_be_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_be_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
#[derive(Clone, Copy, Default)]
@@ -102,7 +108,9 @@ type ExtentList = Vec<(u64, u64, u64, bool)>;
impl<'a> Ext<'a> {
fn open(src: &'a dyn Source, base: u64) -> Option<Self> {
let sb = read_vec(src, base + 1024, 1024).ok().filter(|s| s.len() == 1024)?;
let sb = read_vec(src, base + 1024, 1024)
.ok()
.filter(|s| s.len() == 1024)?;
if le16(&sb, 56) != 0xEF53 {
return None;
}
@@ -125,7 +133,11 @@ impl<'a> Ext<'a> {
if !(128..=4096).contains(&inode_size) {
return None;
}
let desc_size = if is64 { (le16(&sb, 254) as u64).max(64) } else { 32 };
let desc_size = if is64 {
(le16(&sb, 254) as u64).max(64)
} else {
32
};
let ngroups = blocks.saturating_sub(first_data).div_ceil(bpg);
let gdt_block = first_data + 1;
let gdt = read_vec(src, base + gdt_block * bs, (ngroups * desc_size) as usize).ok()?;
@@ -190,7 +202,13 @@ impl<'a> Ext<'a> {
}
/// Extents de uma árvore ext4 (raiz em `node`, 60 bytes ou um bloco).
fn walk_extent_node(&self, node: &[u8], depth_limit: u32, out: &mut ExtentList, strict: bool) -> bool {
fn walk_extent_node(
&self,
node: &[u8],
depth_limit: u32,
out: &mut ExtentList,
strict: bool,
) -> bool {
if node.len() < 12 || le16(node, 0) != EXT_MAGIC {
return false;
}
@@ -219,7 +237,9 @@ impl<'a> Ext<'a> {
out.push((lblk, start, len, uninit));
} else {
let child = ((le16(e, 8) as u64) << 32) | le32(e, 4) as u64;
let Some(b) = self.read_block(child) else { return false };
let Some(b) = self.read_block(child) else {
return false;
};
if !self.walk_extent_node(&b, depth - 1, out, true) {
return false;
}
@@ -249,14 +269,12 @@ impl<'a> Ext<'a> {
v.truncate(max_blocks as usize);
} else {
ind(ptr(12), &mut v);
if (v.len() as u64) < max_blocks {
if ptr(13) != 0 {
if let Some(d) = self.read_block(ptr(13)) {
for i in 0..ppb as usize {
ind(le32(&d, i * 4) as u64, &mut v);
if v.len() as u64 >= max_blocks {
break;
}
if (v.len() as u64) < max_blocks && ptr(13) != 0 {
if let Some(d) = self.read_block(ptr(13)) {
for i in 0..ppb as usize {
ind(le32(&d, i * 4) as u64, &mut v);
if v.len() as u64 >= max_blocks {
break;
}
}
}
@@ -311,14 +329,22 @@ impl<'a> Ext<'a> {
}
if l > cur_l {
let hole = ((l - cur_l) * self.bs).min(left);
out.push(Extent { offset: 0, len: hole, sparse: true });
out.push(Extent {
offset: 0,
len: hole,
sparse: true,
});
left -= hole;
if left == 0 {
break;
}
}
let take = (n * self.bs).min(left);
out.push(Extent { offset: self.base + p * self.bs, len: take, sparse: uninit });
out.push(Extent {
offset: self.base + p * self.bs,
len: take,
sparse: uninit,
});
left -= take;
cur_l = l + n;
}
@@ -340,9 +366,13 @@ impl<'a> Ext<'a> {
if gr.flags & 0x2 != 0 {
used_bits.fill(false);
free.push(Extent::new(self.base + gstart * self.bs, gblocks * self.bs));
} else if let Some(bm) = read_vec(self.src, self.base + gr.block_bitmap * self.bs, gblocks.div_ceil(8) as usize)
.ok()
.filter(|b| b.len() as u64 == gblocks.div_ceil(8))
} else if let Some(bm) = read_vec(
self.src,
self.base + gr.block_bitmap * self.bs,
gblocks.div_ceil(8) as usize,
)
.ok()
.filter(|b| b.len() as u64 == gblocks.div_ceil(8))
{
let mut run: Option<u64> = None;
for i in 0..gblocks {
@@ -351,14 +381,20 @@ impl<'a> Ext<'a> {
match (used, run) {
(false, None) => run = Some(i),
(true, Some(s)) => {
free.push(Extent::new(self.base + (gstart + s) * self.bs, (i - s) * self.bs));
free.push(Extent::new(
self.base + (gstart + s) * self.bs,
(i - s) * self.bs,
));
run = None;
}
_ => {}
}
}
if let Some(s) = run {
free.push(Extent::new(self.base + (gstart + s) * self.bs, (gblocks - s) * self.bs));
free.push(Extent::new(
self.base + (gstart + s) * self.bs,
(gblocks - s) * self.bs,
));
}
}
allocated_all.extend(used_bits);
@@ -395,7 +431,11 @@ fn parse_dir_block(b: &[u8], max_ino: u64, out: &mut Vec<DirEnt>) {
let real = (8 + nlen).div_ceil(4) * 4;
if ino != 0 && nlen > 0 && ino <= max_ino {
let name = String::from_utf8_lossy(&b[off + 8..off + 8 + nlen]).to_string();
out.push(DirEnt { ino, name, live: true });
out.push(DirEnt {
ino,
name,
live: true,
});
}
// Folga: entradas apagadas ficam coladas depois do fim "real" desta.
let mut s = off + if ino != 0 || nlen > 0 { real } else { 8 };
@@ -413,7 +453,9 @@ fn parse_dir_block(b: &[u8], max_ino: u64, out: &mut Vec<DirEnt>) {
&& drec >= 8 + dn
&& drec % 4 == 0
&& s + drec <= end
&& b[s + 8..s + 8 + dn].iter().all(|&c| c >= 0x20 && c != b'/' && c != 0x7f);
&& b[s + 8..s + 8 + dn]
.iter()
.all(|&c| c >= 0x20 && c != b'/' && c != 0x7f);
if !ok {
s += 4;
continue;
@@ -437,16 +479,22 @@ struct Names {
}
fn walk_dirs(ext: &Ext, ctx: &Ctx) -> Names {
let mut names = Names { live: HashMap::new(), dead: HashMap::new() };
let mut names = Names {
live: HashMap::new(),
dead: HashMap::new(),
};
let mut queue: Vec<(u64, String)> = vec![(2, String::new())];
let mut seen: HashSet<u64> = HashSet::new();
let mut visited = 0usize;
while let Some((dino, path)) = queue.pop() {
if !seen.insert(dino) || (visited % 256 == 255 && (ctx.cancelled)()) || visited > 2_000_000 {
if !seen.insert(dino) || (visited % 256 == 255 && (ctx.cancelled)()) || visited > 2_000_000
{
continue;
}
visited += 1;
let Some(ino) = ext.read_inode(dino).filter(|i| i.is_dir()) else { continue };
let Some(ino) = ext.read_inode(dino).filter(|i| i.is_dir()) else {
continue;
};
let mut ents = vec![];
for e in ext.file_extents(&ino, ino.size.min(64 << 20)) {
if e.sparse {
@@ -467,10 +515,16 @@ fn walk_dirs(ext: &Ext, ctx: &Ctx) -> Names {
continue;
}
if en.live {
names.live.entry(en.ino).or_insert_with(|| (path.clone(), en.name.clone()));
names
.live
.entry(en.ino)
.or_insert_with(|| (path.clone(), en.name.clone()));
queue.push((en.ino, format!("{}/{}", path, en.name)));
} else {
names.dead.entry(en.ino).or_insert_with(|| (path.clone(), en.name));
names
.dead
.entry(en.ino)
.or_insert_with(|| (path.clone(), en.name));
}
}
}
@@ -485,7 +539,9 @@ fn journal_inodes(ext: &Ext, ctx: &Ctx) -> HashMap<u64, Vec<Vec<u8>>> {
if ext.journal_inum == 0 {
return out;
}
let Some(jino) = ext.read_inode(ext.journal_inum as u64) else { return out };
let Some(jino) = ext.read_inode(ext.journal_inum as u64) else {
return out;
};
let jext = ext.file_extents(&jino, jino.size.min(1 << 30));
// Blocos físicos do diário em ordem lógica.
let mut jblocks: Vec<u64> = vec![];
@@ -500,7 +556,9 @@ fn journal_inodes(ext: &Ext, ctx: &Ctx) -> HashMap<u64, Vec<Vec<u8>>> {
if jblocks.len() < 4 {
return out;
}
let Some(jsb) = ext.read_block(jblocks[0]) else { return out };
let Some(jsb) = ext.read_block(jblocks[0]) else {
return out;
};
if be32(&jsb, 0) != JBD2_MAGIC {
return out;
}
@@ -512,13 +570,21 @@ fn journal_inodes(ext: &Ext, ctx: &Ctx) -> HashMap<u64, Vec<Vec<u8>>> {
let is64 = incompat & 0x2 != 0;
let csum_v3 = incompat & 0x10 != 0;
let csum_v2 = incompat & 0x8 != 0;
let tag_bytes = if csum_v3 { 16 } else { 8 + if is64 { 4 } else { 0 } };
let tag_bytes = if csum_v3 {
16
} else {
8 + if is64 { 4 } else { 0 }
};
let have_csum = csum_v2 || csum_v3;
// Tabela de inodes: faixa de blocos de cada grupo.
let itable_blocks = (ext.ipg * ext.inode_size).div_ceil(ext.bs);
let mut tables: Vec<(u64, u64, u64)> = vec![]; // (início, fim, primeiro inode)
for (g, gr) in ext.groups.iter().enumerate() {
tables.push((gr.inode_table, gr.inode_table + itable_blocks, g as u64 * ext.ipg + 1));
tables.push((
gr.inode_table,
gr.inode_table + itable_blocks,
g as u64 * ext.ipg + 1,
));
}
let n = jblocks.len();
let first = (be32(&jsb, 20) as usize).clamp(1, n);
@@ -540,7 +606,9 @@ fn journal_inodes(ext: &Ext, ctx: &Ctx) -> HashMap<u64, Vec<Vec<u8>>> {
}
seqs.sort_by_key(|s| s.0);
for (_seq, didx) in seqs {
let Some(d) = ext.read_block(jblocks[didx]) else { continue };
let Some(d) = ext.read_block(jblocks[didx]) else {
continue;
};
let limit = d.len() - if have_csum { 4 } else { 0 };
let mut off = 12usize;
let mut data_idx = didx + 1;
@@ -552,14 +620,21 @@ fn journal_inodes(ext: &Ext, ctx: &Ctx) -> HashMap<u64, Vec<Vec<u8>>> {
let (flags, hi) = if csum_v3 {
(be32(&d, off + 4), be32(&d, off + 8))
} else {
(u16::from_be_bytes([d[off + 6], d[off + 7]]) as u32, if is64 { be32(&d, off + 8) } else { 0 })
(
u16::from_be_bytes([d[off + 6], d[off + 7]]) as u32,
if is64 { be32(&d, off + 8) } else { 0 },
)
};
blk |= (hi as u64) << 32;
off += tag_bytes;
if flags & 2 == 0 {
off += 16;
}
let di = if data_idx >= n { first + (data_idx - n) } else { data_idx };
let di = if data_idx >= n {
first + (data_idx - n)
} else {
data_idx
};
data_idx += 1;
if flags & 4 == 0 {
if let Some(t) = tables.iter().position(|t| blk >= t.0 && blk < t.1) {
@@ -570,9 +645,12 @@ fn journal_inodes(ext: &Ext, ctx: &Ctx) -> HashMap<u64, Vec<Vec<u8>>> {
let per_block = (ext.bs / ext.inode_size) as usize;
let first_ino = tables[t].2 + (blk - tables[t].0) * per_block as u64;
for k in 0..per_block {
let rec = &data[k * ext.inode_size as usize..(k + 1) * ext.inode_size as usize];
let rec = &data
[k * ext.inode_size as usize..(k + 1) * ext.inode_size as usize];
if rec[..128].iter().any(|&x| x != 0) {
out.entry(first_ino + k as u64).or_default().push(rec.to_vec());
out.entry(first_ino + k as u64)
.or_default()
.push(rec.to_vec());
}
}
}
@@ -612,13 +690,20 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
continue; // INODE_UNINIT
}
let used = ext.ipg.saturating_sub(gr.itable_unused as u64).min(ext.ipg);
let Some(table) = read_vec(ext.src, ext.base + gr.inode_table * ext.bs, (used * ext.inode_size) as usize).ok() else {
let Some(table) = read_vec(
ext.src,
ext.base + gr.inode_table * ext.bs,
(used * ext.inode_size) as usize,
)
.ok() else {
continue;
};
for i in 0..(table.len() as u64 / ext.inode_size) {
let ino_no = g as u64 * ext.ipg + i + 1;
let raw = &table[(i * ext.inode_size) as usize..((i + 1) * ext.inode_size) as usize];
let Some(ino) = Inode::parse(raw) else { continue };
let Some(ino) = Inode::parse(raw) else {
continue;
};
if names.live.contains_key(&ino_no) || ino_no < 11 || ino.mode == 0 {
continue;
}
@@ -645,7 +730,16 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
cand = Some((ino.clone(), "inode"));
}
if let Some((c, src_kind)) = cand {
if emit_inode(ctx, &ext, &alloc, &names, ino_no, &c, src_kind, &mut seen_extents) {
if emit_inode(
ctx,
&ext,
&alloc,
&names,
ino_no,
&c,
src_kind,
&mut seen_extents,
) {
emitted.insert(ino_no);
}
}
@@ -662,15 +756,31 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
}
let cur = ext.read_inode(*ino_no);
// Se o inode atual está vivo e é outro arquivo, não mexe.
if cur.as_ref().map(|c| c.dtime == 0 && c.links > 0 && c.mode != 0).unwrap_or(false) {
if cur
.as_ref()
.map(|c| c.dtime == 0 && c.links > 0 && c.mode != 0)
.unwrap_or(false)
{
continue;
}
for raw in snaps.iter().rev() {
if let Some(j) = Inode::parse(raw) {
if j.is_reg() && j.size > 0 && j.dtime == 0 && j.links > 0 {
if emit_inode(ctx, &ext, &alloc, &names, *ino_no, &j, "diário", &mut seen_extents) {
break;
}
if j.is_reg()
&& j.size > 0
&& j.dtime == 0
&& j.links > 0
&& emit_inode(
ctx,
&ext,
&alloc,
&names,
*ino_no,
&j,
"diário",
&mut seen_extents,
)
{
break;
}
}
}
@@ -716,7 +826,11 @@ fn emit_inode(
if extents.is_empty() || extents.iter().all(|e| e.sparse) {
return false;
}
let first = extents.iter().find(|e| !e.sparse).map(|e| (e.offset, e.len)).unwrap();
let first = extents
.iter()
.find(|e| !e.sparse)
.map(|e| (e.offset, e.len))
.unwrap();
if !seen.insert((first.0, first.1)) {
return false;
}
@@ -735,8 +849,14 @@ fn emit_inode(
let mut note = Some(format!("recuperado do {src_kind} do ext4"));
let mut conf = Confidence::High;
if reused > 0 {
conf = if reused * 2 > total_blocks { Confidence::Low } else { Confidence::Medium };
note = Some(format!("{reused} de {total_blocks} blocos já foram reaproveitados por outros arquivos"));
conf = if reused * 2 > total_blocks {
Confidence::Low
} else {
Confidence::Medium
};
note = Some(format!(
"{reused} de {total_blocks} blocos já foram reaproveitados por outros arquivos"
));
}
if estimated {
// Tamanho desconhecido: tenta achar o fim real pelo conteúdo.
@@ -754,7 +874,8 @@ fn emit_inode(
}
if estimated {
conf = conf.min(Confidence::Medium);
note = Some("tamanho exato perdido na exclusão; usando todos os blocos do arquivo".into());
note =
Some("tamanho exato perdido na exclusão; usando todos os blocos do arquivo".into());
}
}
let (dir, name) = match names.dead.get(&ino_no).or_else(|| names.live.get(&ino_no)) {
@@ -789,14 +910,22 @@ fn layout_from_list(ext: &Ext, list: &ExtentList, size: u64) -> Vec<Extent> {
}
if l > cur {
let hole = ((l - cur) * ext.bs).min(left);
out.push(Extent { offset: 0, len: hole, sparse: true });
out.push(Extent {
offset: 0,
len: hole,
sparse: true,
});
left -= hole;
if left == 0 {
break;
}
}
let take = (n * ext.bs).min(left);
out.push(Extent { offset: ext.base + p * ext.bs, len: take, sparse: uninit });
out.push(Extent {
offset: ext.base + p * ext.bs,
len: take,
sparse: uninit,
});
left -= take;
cur = l + n;
}
@@ -841,7 +970,9 @@ pub fn consistency_score(src: &dyn Source, base: u64) -> Option<f64> {
if !seen.insert(d) || total >= 600 {
continue;
}
let Some(ino) = ext.read_inode(d).filter(|i| i.is_dir()) else { continue };
let Some(ino) = ext.read_inode(d).filter(|i| i.is_dir()) else {
continue;
};
let mut ents = vec![];
for e in ext.file_extents(&ino, ino.size.min(1 << 20)) {
if e.sparse {
@@ -863,7 +994,10 @@ pub fn consistency_score(src: &dyn Source, base: u64) -> Option<f64> {
if ents.iter().any(|e| e.live && e.name == "." && e.ino == d) {
dots_ok += 1;
}
for en in ents.iter().filter(|e| e.live && e.name != "." && e.name != "..") {
for en in ents
.iter()
.filter(|e| e.live && e.name != "." && e.name != "..")
{
total += 1;
if let Some(i) = ext.read_inode(en.ino) {
if i.mode != 0 && i.links > 0 {
@@ -882,6 +1016,10 @@ pub fn consistency_score(src: &dyn Source, base: u64) -> Option<f64> {
return None;
}
let a = ok as f64 / total as f64;
let b = if dots_total > 0 { dots_ok as f64 / dots_total as f64 } else { 0.0 };
let b = if dots_total > 0 {
dots_ok as f64 / dots_total as f64
} else {
0.0
};
Some(1.0 + 5.0 * a + 5.0 * b)
}
+129 -31
View File
@@ -12,13 +12,19 @@ use std::collections::{HashMap, HashSet};
const HFS_EPOCH: i64 = 2_082_844_800;
fn be16(b: &[u8], o: usize) -> u16 {
b.get(o..o + 2).map(|s| u16::from_be_bytes([s[0], s[1]])).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_be_bytes([s[0], s[1]]))
.unwrap_or(0)
}
fn be32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_be_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_be_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
fn be64(b: &[u8], o: usize) -> u64 {
b.get(o..o + 8).map(|s| u64::from_be_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 8)
.map(|s| u64::from_be_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
#[derive(Clone, Debug, Default)]
@@ -29,7 +35,11 @@ struct Fork {
}
fn parse_fork(b: &[u8]) -> Fork {
let mut f = Fork { size: be64(b, 0), blocks: be32(b, 12), extents: vec![] };
let mut f = Fork {
size: be64(b, 0),
blocks: be32(b, 12),
extents: vec![],
};
for i in 0..8 {
let (s, c) = (be32(b, 16 + i * 8), be32(b, 20 + i * 8));
if c != 0 {
@@ -105,9 +115,13 @@ impl<'a> Vol<'a> {
have = ex.iter().map(|e| e.1 as u64).sum();
let _ = have;
}
merge_extents(ex.into_iter().map(|(s, c)| Extent::new(self.block_off(s as u64), c as u64 * self.bs)).collect::<Vec<_>>())
.into_iter()
.collect()
merge_extents(
ex.into_iter()
.map(|(s, c)| Extent::new(self.block_off(s as u64), c as u64 * self.bs))
.collect::<Vec<_>>(),
)
.into_iter()
.collect()
}
/// Extensões além das oito iniciais, procuradas no arquivo de overflow (árvore B+).
@@ -119,7 +133,9 @@ impl<'a> Vol<'a> {
};
let total_nodes = self.extents_file.size / node_size as u64;
for n in 1..total_nodes.min(100_000) {
let Some(node) = self.read_tree_node(&self.extents_file, n as u32, node_size) else { continue };
let Some(node) = self.read_tree_node(&self.extents_file, n as u32, node_size) else {
continue;
};
if node[8] != 0xFF {
continue;
}
@@ -193,8 +209,13 @@ fn records(node: &[u8]) -> Vec<&[u8]> {
}
fn utf16be(b: &[u8]) -> String {
let u: Vec<u16> = b.chunks_exact(2).map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
String::from_utf16_lossy(&u).replace('/', "_").replace(':', "/")
let u: Vec<u16> = b
.chunks_exact(2)
.map(|c| u16::from_be_bytes([c[0], c[1]]))
.collect();
String::from_utf16_lossy(&u)
.replace('/', "_")
.replace(':', "/")
}
struct CatFile {
@@ -213,7 +234,14 @@ fn date(d: u32) -> Option<i64> {
}
/// Decodifica um registro do catálogo (chave + dados). `max_id` descarta lixo.
fn decode_record(r: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut HashMap<u32, (u32, String)>, folders: &mut HashMap<(u32, String), u32>, stale: bool) {
fn decode_record(
r: &[u8],
max_id: u32,
files: &mut Vec<CatFile>,
threads: &mut HashMap<u32, (u32, String)>,
folders: &mut HashMap<(u32, String), u32>,
stale: bool,
) {
let klen = be16(r, 0) as usize;
if klen < 6 || klen + 2 > r.len() {
return;
@@ -240,7 +268,10 @@ fn decode_record(r: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut
// thread de pasta: chave = (id da pasta, ""); dados = (pai, nome)
let pn = be16(rec, 8) as usize;
if pn <= 255 {
threads.entry(parent).or_insert((be32(rec, 4), utf16be(rec.get(10..10 + pn * 2).unwrap_or(&[]))));
threads.entry(parent).or_insert((
be32(rec, 4),
utf16be(rec.get(10..10 + pn * 2).unwrap_or(&[])),
));
}
}
2 if rec.len() >= 248 => {
@@ -263,7 +294,10 @@ fn decode_record(r: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut
4 if rec.len() >= 10 => {
let pn = be16(rec, 8) as usize;
if pn <= 255 {
threads.entry(parent).or_insert((be32(rec, 4), utf16be(rec.get(10..10 + pn * 2).unwrap_or(&[]))));
threads.entry(parent).or_insert((
be32(rec, 4),
utf16be(rec.get(10..10 + pn * 2).unwrap_or(&[])),
));
}
}
_ => {}
@@ -271,7 +305,13 @@ fn decode_record(r: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut
}
/// Procura registros de arquivo nas sobras de um nó (entre os dados e a tabela de offsets).
fn scan_slack(node: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut HashMap<u32, (u32, String)>, folders: &mut HashMap<(u32, String), u32>) {
fn scan_slack(
node: &[u8],
max_id: u32,
files: &mut Vec<CatFile>,
threads: &mut HashMap<u32, (u32, String)>,
folders: &mut HashMap<(u32, String), u32>,
) {
let n = be16(node, 10) as usize;
let table = node.len().saturating_sub(2 * (n + 1));
let used_end = (be16(node, table) as usize).max(14);
@@ -284,7 +324,7 @@ fn scan_slack(node: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut
if parent >= 1 && parent < max_id.max(16) {
let d = (p + 2 + klen + 1) & !1;
let rt = be16(node, d);
if matches!(rt, 1 | 2 | 3 | 4) {
if matches!(rt, 1..=4) {
let end = (d + 248).min(table);
decode_record(&node[p..end], max_id, files, threads, folders, true);
p = d + if rt == 2 { 248 } else { 16 };
@@ -299,15 +339,22 @@ fn scan_slack(node: &[u8], max_id: u32, files: &mut Vec<CatFile>, threads: &mut
pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let mut res = VolumeScan::default();
let _ = part_len;
let Some(vbase) = locate(ctx.src, base) else { return res };
let Some(vol) = Vol::open(ctx.src, vbase) else { return res };
let Some(vbase) = locate(ctx.src, base) else {
return res;
};
let Some(vol) = Vol::open(ctx.src, vbase) else {
return res;
};
// Mapa de espaço livre.
if let Some(bm) = vol.read_fork_all(&vol.alloc, (vol.total / 8 + 1) as usize) {
let mut free = vec![];
let mut run: Option<u64> = None;
for b in 0..vol.total {
let used = bm.get((b / 8) as usize).map(|x| x >> (7 - (b % 8)) & 1 == 1).unwrap_or(true);
let used = bm
.get((b / 8) as usize)
.map(|x| x >> (7 - (b % 8)) & 1 == 1)
.unwrap_or(true);
match (used, run) {
(false, None) => run = Some(b),
(true, Some(s)) => {
@@ -327,7 +374,9 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
res.warnings.push("HFS+: catálogo ilegível.".into());
return res;
};
let Some(hdr) = vol.read_tree_node(&vol.catalog, 0, ns) else { return res };
let Some(hdr) = vol.read_tree_node(&vol.catalog, 0, ns) else {
return res;
};
let first_leaf = be32(&hdr, 24);
let max_id = vol.next_cnid.max(16);
let mut files: Vec<CatFile> = vec![];
@@ -342,7 +391,9 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
if (ctx.cancelled)() {
return res;
}
let Some(node) = vol.read_tree_node(&vol.catalog, n, ns) else { break };
let Some(node) = vol.read_tree_node(&vol.catalog, n, ns) else {
break;
};
if node[8] != 0xFF {
break;
}
@@ -360,7 +411,15 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
// Diário: cópias antigas de nós folha do catálogo.
if vol.journal_info != 0 {
scan_journal(&vol, ns, max_id, &mut files, &mut threads, &mut folders, ctx);
scan_journal(
&vol,
ns,
max_id,
&mut files,
&mut threads,
&mut folders,
ctx,
);
}
// Caminho de cada pasta a partir dos threads.
@@ -385,13 +444,19 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let free_set = res.free.clone().unwrap_or_default();
let mut seen: HashSet<(u32, u64)> = HashSet::new();
for f in files.iter().filter(|f| f.stale && !live_ids.contains(&f.id)) {
for f in files
.iter()
.filter(|f| f.stale && !live_ids.contains(&f.id))
{
if f.data.size == 0 || f.data.extents.is_empty() {
continue;
}
let ex = vol.fork_extents(&f.data, f.id, 0);
let total_len: u64 = ex.iter().map(|e| e.len).sum();
if ex.is_empty() || total_len < f.data.size || ex.iter().any(|e| e.end() > vol.base + vol.total * vol.bs) {
if ex.is_empty()
|| total_len < f.data.size
|| ex.iter().any(|e| e.end() > vol.base + vol.total * vol.bs)
{
continue;
}
if !seen.insert((f.id, ex[0].offset)) {
@@ -402,9 +467,15 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
// Blocos já reaproveitados?
let reused = extents.iter().filter(|e| !covered_by(&free_set, e)).count();
let (conf, note) = if reused == 0 {
(Confidence::High, "registro apagado do catálogo HFS+; blocos ainda livres".to_string())
(
Confidence::High,
"registro apagado do catálogo HFS+; blocos ainda livres".to_string(),
)
} else {
(Confidence::Low, "alguns blocos do arquivo já foram reaproveitados".to_string())
(
Confidence::Low,
"alguns blocos do arquivo já foram reaproveitados".to_string(),
)
};
let nf = NewFound {
name: f.name.clone(),
@@ -426,7 +497,9 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
fn covered_by(free: &[Extent], e: &Extent) -> bool {
let i = free.partition_point(|f| f.end() <= e.offset);
free.get(i).map(|f| f.offset <= e.offset && f.end() >= e.end()).unwrap_or(false)
free.get(i)
.map(|f| f.offset <= e.offset && f.end() >= e.end())
.unwrap_or(false)
}
impl Vol<'_> {
@@ -434,7 +507,14 @@ impl Vol<'_> {
let mut out = vec![];
for &(s, c) in &f.extents {
let n = (c as u64 * self.bs) as usize;
out.extend(read_vec(self.src, self.block_off(s as u64), n.min(max.saturating_sub(out.len()))).ok()?);
out.extend(
read_vec(
self.src,
self.block_off(s as u64),
n.min(max.saturating_sub(out.len())),
)
.ok()?,
);
if out.len() >= max {
break;
}
@@ -444,8 +524,21 @@ impl Vol<'_> {
}
/// Procura nós folha do catálogo nas transações guardadas no diário.
fn scan_journal(vol: &Vol, ns: usize, max_id: u32, files: &mut Vec<CatFile>, threads: &mut HashMap<u32, (u32, String)>, folders: &mut HashMap<(u32, String), u32>, ctx: &Ctx) {
let Some(info) = read_vec(vol.src, vol.block_off(vol.journal_info as u64), 52).ok().filter(|b| b.len() == 52) else { return };
fn scan_journal(
vol: &Vol,
ns: usize,
max_id: u32,
files: &mut Vec<CatFile>,
threads: &mut HashMap<u32, (u32, String)>,
folders: &mut HashMap<(u32, String), u32>,
ctx: &Ctx,
) {
let Some(info) = read_vec(vol.src, vol.block_off(vol.journal_info as u64), 52)
.ok()
.filter(|b| b.len() == 52)
else {
return;
};
let (joff, jsize) = (be64(&info, 36), be64(&info, 44));
if jsize == 0 || jsize > 1 << 30 || vol.base + joff + jsize > vol.src.size() {
return;
@@ -457,14 +550,19 @@ fn scan_journal(vol: &Vol, ns: usize, max_id: u32, files: &mut Vec<CatFile>, thr
return;
}
let n = chunk.min(jsize - pos) as usize;
let Ok(buf) = read_vec(vol.src, vol.base + joff + pos, n + ns) else { break };
let Ok(buf) = read_vec(vol.src, vol.base + joff + pos, n + ns) else {
break;
};
let mut i = 0;
while i + ns <= buf.len().min(n + ns) && i < n {
let nd = &buf[i..i + ns];
// nó folha do catálogo: kind = -1, altura 1, registros plausíveis
if nd[8] == 0xFF && nd[9] == 1 && be16(nd, 10) > 0 && (be16(nd, 10) as usize) < ns / 8 {
let table = ns - 2 * (be16(nd, 10) as usize + 1);
if (be16(nd, ns - 2) as usize) == 14 && be16(nd, table) as usize > 14 && (be16(nd, table) as usize) <= table {
if (be16(nd, ns - 2) as usize) == 14
&& be16(nd, table) as usize > 14
&& (be16(nd, table) as usize) <= table
{
for r in records(nd) {
decode_record(r, max_id, files, threads, folders, true);
}
+1 -1
View File
@@ -10,8 +10,8 @@ pub mod exfat;
pub mod ext;
pub mod fat;
pub mod hfsplus;
pub mod xfs;
pub mod ntfs;
pub mod xfs;
use crate::signatures::{category_for_ext, matches_ext};
use crate::source::{read_vec, Source};
+105 -26
View File
@@ -10,13 +10,19 @@ use crate::types::{Confidence, DataLoc, Extent, Origin};
use std::collections::{HashMap, HashSet};
fn be16(b: &[u8], o: usize) -> u16 {
b.get(o..o + 2).map(|s| u16::from_be_bytes([s[0], s[1]])).unwrap_or(0)
b.get(o..o + 2)
.map(|s| u16::from_be_bytes([s[0], s[1]]))
.unwrap_or(0)
}
fn be32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_be_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_be_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
fn be64(b: &[u8], o: usize) -> u64 {
b.get(o..o + 8).map(|s| u64::from_be_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 8)
.map(|s| u64::from_be_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
struct Xfs<'a> {
@@ -46,7 +52,12 @@ impl<'a> Xfs<'a> {
let agblocks = be32(&sb, 84) as u64;
let agcount = be32(&sb, 88) as u64;
let inodesize = be16(&sb, 104) as u64;
if !(512..=65536).contains(&bs) || !bs.is_power_of_two() || agblocks == 0 || agcount == 0 || !(256..=2048).contains(&inodesize) {
if !(512..=65536).contains(&bs)
|| !bs.is_power_of_two()
|| agblocks == 0
|| agcount == 0
|| !(256..=2048).contains(&inodesize)
{
return None;
}
let incompat = be32(&sb, 216);
@@ -63,7 +74,11 @@ impl<'a> Xfs<'a> {
agblklog: sb[124] as u32,
sectsize: be16(&sb, 102) as u64,
v5,
ftype: if v5 { incompat & 1 != 0 } else { features2 & 0x200 != 0 },
ftype: if v5 {
incompat & 1 != 0
} else {
features2 & 0x200 != 0
},
root_ino: be64(&sb, 56),
dblocks: be64(&sb, 8),
})
@@ -84,7 +99,8 @@ impl<'a> Xfs<'a> {
let agno = ino >> shift;
let agbno = (ino >> self.inopblog) & ((1 << self.agblklog) - 1);
let idx = ino & ((1 << self.inopblog) - 1);
(agno < self.agcount && agbno < self.agblocks).then(|| self.ag_off(agno) + agbno * self.bs + idx * self.inodesize)
(agno < self.agcount && agbno < self.agblocks)
.then(|| self.ag_off(agno) + agbno * self.bs + idx * self.inodesize)
}
fn read_ino(&self, ino: u64) -> Option<Vec<u8>> {
@@ -104,7 +120,11 @@ impl<'a> Xfs<'a> {
fn extents_of(&self, ino: &[u8], max_blocks: u64) -> Vec<(u64, u64, u64)> {
let fmt = ino[5];
let start = self.core_size(ino);
let fork_end = if ino[82] != 0 { start.max(100 + ino[82] as usize * 8) } else { self.inodesize as usize };
let fork_end = if ino[82] != 0 {
start.max(100 + ino[82] as usize * 8)
} else {
self.inodesize as usize
};
let lit = &ino[start..fork_end.min(ino.len())];
let mut out = vec![];
match fmt {
@@ -136,7 +156,9 @@ impl<'a> Xfs<'a> {
return;
}
let Some(off) = self.fsb_off(fsb) else { return };
let Ok(b) = read_vec(self.src, off, self.bs as usize) else { return };
let Ok(b) = read_vec(self.src, off, self.bs as usize) else {
return;
};
if b.len() < 24 || !(&b[0..4] == b"BMAP" || &b[0..4] == b"BMA3") {
return;
}
@@ -169,11 +191,21 @@ fn unpack_extent(r: &[u8]) -> (u64, u64, u64) {
}
/// Percorre as folhas de uma árvore B+ curta, entregando cada registro de 16 (inobt) ou 8 (bnobt) bytes.
fn walk_short_btree(x: &Xfs, agno: u64, root: u64, levels: u32, rec: usize, key_size: usize, f: &mut dyn FnMut(&[u8])) {
fn walk_short_btree(
x: &Xfs,
agno: u64,
root: u64,
levels: u32,
rec: usize,
key_size: usize,
f: &mut dyn FnMut(&[u8]),
) {
let mut cur = root;
// desce pela esquerda até a folha
for lvl in (1..levels).rev() {
let Ok(b) = read_vec(x.src, x.ag_off(agno) + cur * x.bs, x.bs as usize) else { return };
let Ok(b) = read_vec(x.src, x.ag_off(agno) + cur * x.bs, x.bs as usize) else {
return;
};
if b.len() < 24 {
return;
}
@@ -185,7 +217,9 @@ fn walk_short_btree(x: &Xfs, agno: u64, root: u64, levels: u32, rec: usize, key_
}
let mut seen = HashSet::new();
while cur != 0 && cur != u32::MAX as u64 && seen.insert(cur) {
let Ok(b) = read_vec(x.src, x.ag_off(agno) + cur * x.bs, x.bs as usize) else { return };
let Ok(b) = read_vec(x.src, x.ag_off(agno) + cur * x.bs, x.bs as usize) else {
return;
};
if b.len() < 24 {
return;
}
@@ -203,7 +237,9 @@ fn walk_short_btree(x: &Xfs, agno: u64, root: u64, levels: u32, rec: usize, key_
pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let _ = part_len;
let mut res = VolumeScan::default();
let Some(x) = Xfs::open(ctx.src, base) else { return res };
let Some(x) = Xfs::open(ctx.src, base) else {
return res;
};
// Espaço livre por grupo e inodes livres.
let mut free: Vec<Extent> = vec![];
@@ -237,7 +273,9 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
free_set.sort();
let is_free = |fsb: u64, count: u64| -> bool {
let i = free_set.partition_point(|&(s, c)| s + c <= fsb);
free_set.get(i).map_or(false, |&(s, c)| s <= fsb && s + c >= fsb + count)
free_set
.get(i)
.is_some_and(|&(s, c)| s <= fsb && s + c >= fsb + count)
};
// Nomes: entradas de diretório liberadas (guardam o nome e os 4 bytes baixos do inode).
@@ -290,16 +328,30 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
continue;
}
let all_free = ext.iter().all(|e| is_free(e.1, e.2));
let extents: Vec<Extent> = ext.iter().filter_map(|e| x.fsb_off(e.1).map(|o| Extent::new(o, e.2 * x.bs))).collect();
let extents: Vec<Extent> = ext
.iter()
.filter_map(|e| x.fsb_off(e.1).map(|o| Extent::new(o, e.2 * x.bs)))
.collect();
if extents.is_empty() || !seen_first.insert(extents[0].offset) {
continue;
}
let mut size = total_blocks * x.bs;
let mut conf = if all_free { Confidence::High } else { Confidence::Low };
let mut note = if all_free { "inode XFS liberado; lista de extents recuperada do próprio inode".to_string() } else { "blocos do arquivo já reaproveitados".to_string() };
let mut conf = if all_free {
Confidence::High
} else {
Confidence::Low
};
let mut note = if all_free {
"inode XFS liberado; lista de extents recuperada do próprio inode".to_string()
} else {
"blocos do arquivo já reaproveitados".to_string()
};
// tamanho exato: tenta achar o fim real pelo conteúdo
let mut est = true;
if let Some(h) = read_vec(ctx.src, extents[0].offset, 128).ok().and_then(|head| signatures::detect(ctx.src, extents[0].offset, &head, size)) {
if let Some(h) = read_vec(ctx.src, extents[0].offset, 128)
.ok()
.and_then(|head| signatures::detect(ctx.src, extents[0].offset, &head, size))
{
if h.len > 0 && h.len <= size {
size = h.len;
est = false;
@@ -312,7 +364,10 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
let extents = super::fat::trim_extents(extents, size);
let low = ino & 0xFFFF_FFFF;
let (dir, name) = match stale_names.get(&low) {
Some((parent, n)) => (Some(live_dirs.get(parent).cloned().unwrap_or_default()), n.clone()),
Some((parent, n)) => (
Some(live_dirs.get(parent).cloned().unwrap_or_default()),
n.clone(),
),
None => (None, format!("inode_{ino}")),
};
let ts = |s: u32| (s != 0).then_some(s as i64);
@@ -323,7 +378,11 @@ pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
origin: Origin::Xfs,
data: DataLoc::Extents { extents },
modified: ts(be32(&raw, 40)),
created: if raw[4] >= 3 { ts(be32(&raw, 144)) } else { None },
created: if raw[4] >= 3 {
ts(be32(&raw, 144))
} else {
None
},
accessed: ts(be32(&raw, 32)),
base: conf,
note: Some(&note),
@@ -345,7 +404,9 @@ fn collect_names(x: &Xfs, ctx: &Ctx) -> (HashMap<u64, String>, HashMap<u64, (u64
if !seen.insert(dino) || (ctx.cancelled)() || seen.len() > 200_000 {
continue;
}
let Some(raw) = x.read_ino(dino) else { continue };
let Some(raw) = x.read_ino(dino) else {
continue;
};
if be16(&raw, 2) & 0o170000 != 0o040000 {
continue;
}
@@ -365,9 +426,14 @@ fn collect_names(x: &Xfs, ctx: &Ctx) -> (HashMap<u64, String>, HashMap<u64, (u64
}
let nl = lit[p] as usize;
p += 3;
let name = String::from_utf8_lossy(lit.get(p..p + nl).unwrap_or(&[])).to_string();
let name =
String::from_utf8_lossy(lit.get(p..p + nl).unwrap_or(&[])).to_string();
p += nl + if x.ftype { 1 } else { 0 };
let ino = if i8 { be64(lit, p) } else { be32(lit, p) as u64 };
let ino = if i8 {
be64(lit, p)
} else {
be32(lit, p) as u64
};
p += isz;
queue.push((ino, format!("{path}/{name}")));
}
@@ -382,8 +448,12 @@ fn collect_names(x: &Xfs, ctx: &Ctx) -> (HashMap<u64, String>, HashMap<u64, (u64
continue;
}
for k in 0..cnt.min(256) {
let Some(o) = x.fsb_off(fsb + k) else { continue };
let Ok(b) = read_vec(x.src, o, x.bs as usize) else { continue };
let Some(o) = x.fsb_off(fsb + k) else {
continue;
};
let Ok(b) = read_vec(x.src, o, x.bs as usize) else {
continue;
};
parse_dir_block(x, &b, dino, &path, &mut queue, &mut stale);
}
}
@@ -394,7 +464,14 @@ fn collect_names(x: &Xfs, ctx: &Ctx) -> (HashMap<u64, String>, HashMap<u64, (u64
(paths, stale)
}
fn parse_dir_block(x: &Xfs, b: &[u8], dino: u64, path: &str, queue: &mut Vec<(u64, String)>, stale: &mut HashMap<u64, (u64, String)>) {
fn parse_dir_block(
x: &Xfs,
b: &[u8],
dino: u64,
path: &str,
queue: &mut Vec<(u64, String)>,
stale: &mut HashMap<u64, (u64, String)>,
) {
let magic = &b[0..4];
let hdr = match magic {
b"XD2B" | b"XD2D" => 16,
@@ -447,7 +524,9 @@ fn scan_free_region(x: &Xfs, r: &[u8], dir_ino: u64, stale: &mut HashMap<u64, (u
if nl == 0 || name.iter().any(|&c| c < 0x20 || c == b'/' || c == 0x7F) {
return None;
}
stale.entry(low).or_insert((dir_ino, String::from_utf8_lossy(name).to_string()));
stale
.entry(low)
.or_insert((dir_ino, String::from_utf8_lossy(name).to_string()));
Some((8 + 1 + nl + if x.ftype { 1 } else { 0 } + 2).div_ceil(8) * 8)
};
if r.len() >= 16 {
+23 -3
View File
@@ -77,7 +77,12 @@ pub fn create_image_as(
) -> Result<ImageReport> {
match format {
ImageFormat::Raw => create_image(src, dest, cancelled, progress),
ImageFormat::Aff4 { case_number, examiner, evidence_number, notes } => {
ImageFormat::Aff4 {
case_number,
examiner,
evidence_number,
notes,
} => {
let opts = crate::aff4::Aff4Options {
case_name: case_number.clone(),
examiner: examiner.clone(),
@@ -85,10 +90,25 @@ pub fn create_image_as(
evidence_number: evidence_number.clone(),
..Default::default()
};
let dest = if dest.extension().map_or(false, |e| e.eq_ignore_ascii_case("aff4")) { dest.to_path_buf() } else { dest.with_extension("aff4") };
let dest = if dest
.extension()
.is_some_and(|e| e.eq_ignore_ascii_case("aff4"))
{
dest.to_path_buf()
} else {
dest.with_extension("aff4")
};
crate::aff4::write_aff4(src, &dest, &opts, cancelled, progress)
}
ImageFormat::E01 { case_number, description, evidence_number, examiner, notes, segment_mib, compression } => {
ImageFormat::E01 {
case_number,
description,
evidence_number,
examiner,
notes,
segment_mib,
compression,
} => {
let opts = crate::ewf::E01Options {
case_number: case_number.clone(),
description: description.clone(),
+82 -16
View File
@@ -16,7 +16,12 @@ struct Huff {
impl Huff {
fn new(counts: &[u8; 16], vals: Vec<u8>) -> Huff {
let mut h = Huff { mincode: [0; 17], maxcode: [-1; 18], valptr: [0; 17], vals };
let mut h = Huff {
mincode: [0; 17],
maxcode: [-1; 18],
valptr: [0; 17],
vals,
};
let mut code = 0i32;
let mut k = 0i32;
for l in 1..=16 {
@@ -103,7 +108,15 @@ pub fn parse_header(d: &[u8]) -> Option<Header> {
if n == 0 || n > 4 || seg.len() < 6 + n * 3 || w == 0 || h == 0 {
return None;
}
let comps = (0..n).map(|i| (seg[7 + i * 3] >> 4, seg[7 + i * 3] & 15, seg[8 + i * 3] as usize & 3)).collect();
let comps = (0..n)
.map(|i| {
(
seg[7 + i * 3] >> 4,
seg[7 + i * 3] & 15,
seg[8 + i * 3] as usize & 3,
)
})
.collect();
sof = Some((w, h, comps));
}
0xC2 | 0xC3 | 0xC5..=0xC7 | 0xC9..=0xCB | 0xCD..=0xCF => return None, // progressivo, aritmético etc.
@@ -136,7 +149,11 @@ pub fn parse_header(d: &[u8]) -> Option<Header> {
return None;
}
for i in 0..64 {
qt[id][i] = if prec == 0 { seg[q + i] as u16 } else { u16::from_be_bytes([seg[q + 2 * i], seg[q + 2 * i + 1]]) };
qt[id][i] = if prec == 0 {
seg[q + i] as u16
} else {
u16::from_be_bytes([seg[q + 2 * i], seg[q + 2 * i + 1]])
};
}
q += n;
}
@@ -155,7 +172,13 @@ pub fn parse_header(d: &[u8]) -> Option<Header> {
let mut cs = vec![];
for i in 0..ns {
let t = seg[2 + i * 2];
cs.push(Comp { h: comps[i].0, v: comps[i].1, tq: comps[i].2, dc_tbl: (t >> 4) as usize & 3, ac_tbl: (t & 15) as usize & 3 });
cs.push(Comp {
h: comps[i].0,
v: comps[i].1,
tq: comps[i].2,
dc_tbl: (t >> 4) as usize & 3,
ac_tbl: (t & 15) as usize & 3,
});
}
let hmax = cs.iter().map(|c| c.h).max()? as u32;
let vmax = cs.iter().map(|c| c.v).max()? as u32;
@@ -218,7 +241,15 @@ impl State {
self.pred[0]
}
pub fn start(h: &Header) -> State {
State { pos: h.scan_start, bitbuf: 0, bitcnt: 0, pred: [0; 4], mcu: 0, rst_next: 0, mcus_since_rst: 0 }
State {
pos: h.scan_start,
bitbuf: 0,
bitcnt: 0,
pred: [0; 4],
mcu: 0,
rst_next: 0,
mcus_since_rst: 0,
}
}
}
@@ -240,7 +271,9 @@ struct Bits<'a> {
impl Bits<'_> {
fn fill(&mut self) {
while self.st.bitcnt <= 24 && self.marker.is_none() {
let Some(&b) = self.d.get(self.st.pos) else { break };
let Some(&b) = self.d.get(self.st.pos) else {
break;
};
if b == 0xFF {
match self.d.get(self.st.pos + 1) {
Some(0) => {
@@ -283,7 +316,10 @@ impl Bits<'_> {
return None;
}
code = (self.st.bitbuf >> (32 - l)) as i32;
if h.maxcode[l as usize] >= 0 && code <= h.maxcode[l as usize] && code >= h.mincode[l as usize] {
if h.maxcode[l as usize] >= 0
&& code <= h.maxcode[l as usize]
&& code >= h.mincode[l as usize]
{
self.st.bitbuf <<= l;
self.st.bitcnt -= l;
let idx = h.valptr[l as usize] + code - h.mincode[l as usize];
@@ -321,7 +357,11 @@ pub fn decode_hook(
mut hook: Option<&mut dyn FnMut(u32, &[[i32; 64]])>,
) -> Decoded {
let mut lblocks: Vec<[i32; 64]> = Vec::new();
let mut b = Bits { d: data, st: state, marker: None };
let mut b = Bits {
d: data,
st: state,
marker: None,
};
let total = h.total_mcus();
let mut dc_out = Vec::new();
let mut snaps = Vec::new();
@@ -428,7 +468,12 @@ pub fn decode_hook(
last_snap = b.st.pos;
}
}
Decoded { dc: dc_out, snaps, stop, state: b.st }
Decoded {
dc: dc_out,
snaps,
stop,
state: b.st,
}
}
fn fail(b: &Bits, data: &[u8]) -> Stop {
@@ -496,8 +541,9 @@ pub fn first_discontinuity(h: &Header, dc: &[i32]) -> Option<usize> {
// --------------------------------------------------------------- pixels
const ZIGZAG: [usize; 64] = [
0, 1, 8, 16, 9, 2, 3, 10, 17, 24, 32, 25, 18, 11, 4, 5, 12, 19, 26, 33, 40, 48, 41, 34, 27, 20, 13, 6, 7, 14, 21, 28, 35, 42, 49, 56, 57, 50, 43, 36, 29, 22, 15, 23, 30, 37, 44,
51, 58, 59, 52, 45, 38, 31, 39, 46, 53, 60, 61, 54, 47, 55, 62, 63,
0, 1, 8, 16, 9, 2, 3, 10, 17, 24, 32, 25, 18, 11, 4, 5, 12, 19, 26, 33, 40, 48, 41, 34, 27, 20,
13, 6, 7, 14, 21, 28, 35, 42, 49, 56, 57, 50, 43, 36, 29, 22, 15, 23, 30, 37, 44, 51, 58, 59,
52, 45, 38, 31, 39, 46, 53, 60, 61, 54, 47, 55, 62, 63,
];
fn cos_table() -> &'static [[f32; 8]; 8] {
@@ -506,8 +552,14 @@ fn cos_table() -> &'static [[f32; 8]; 8] {
let mut t = [[0f32; 8]; 8];
for x in 0..8 {
for u in 0..8 {
let cu = if u == 0 { std::f32::consts::FRAC_1_SQRT_2 } else { 1.0 };
t[x][u] = 0.5 * cu * (((2 * x + 1) as f32 * u as f32 * std::f32::consts::PI) / 16.0).cos();
let cu = if u == 0 {
std::f32::consts::FRAC_1_SQRT_2
} else {
1.0
};
t[x][u] = 0.5
* cu
* (((2 * x + 1) as f32 * u as f32 * std::f32::consts::PI) / 16.0).cos();
}
}
t
@@ -556,7 +608,8 @@ pub fn mcu_luma(h: &Header, blocks: &[[i32; 64]]) -> Vec<u8> {
let px = idct_block(blk, &h.qt[c.tq]);
let (bx, by) = (i % bw, i / bw);
for y in 0..8 {
out[(by * 8 + y) * w + bx * 8..(by * 8 + y) * w + bx * 8 + 8].copy_from_slice(&px[y * 8..y * 8 + 8]);
out[(by * 8 + y) * w + bx * 8..(by * 8 + y) * w + bx * 8 + 8]
.copy_from_slice(&px[y * 8..y * 8 + 8]);
}
}
out
@@ -576,7 +629,14 @@ impl Plane {
pub fn new(h: &Header) -> Plane {
let c = &h.comps[0];
let (mw, mh) = (c.h as usize * 8, c.v as usize * 8);
Plane { w: mw * h.mcus_x as usize, h: mh * h.mcus_y as usize, px: vec![0; mw * h.mcus_x as usize * mh * h.mcus_y as usize], mw, mh, have: 0 }
Plane {
w: mw * h.mcus_x as usize,
h: mh * h.mcus_y as usize,
px: vec![0; mw * h.mcus_x as usize * mh * h.mcus_y as usize],
mw,
mh,
have: 0,
}
}
pub fn put(&mut self, h: &Header, mcu: u32, luma: &[u8]) {
let (mx, my) = ((mcu % h.mcus_x) as usize, (mcu / h.mcus_x) as usize);
@@ -589,7 +649,13 @@ impl Plane {
}
/// Decodifica e preenche o plano com as luminâncias.
pub fn decode_plane(h: &Header, data: &[u8], state: State, max_mcus: u32, plane: &mut Plane) -> Decoded {
pub fn decode_plane(
h: &Header,
data: &[u8],
state: State,
max_mcus: u32,
plane: &mut Plane,
) -> Decoded {
let mut hook = |mcu: u32, blocks: &[[i32; 64]]| {
let l = mcu_luma(h, blocks);
plane.put(h, mcu, &l);
+9 -2
View File
@@ -1,3 +1,10 @@
#![allow(
clippy::type_complexity,
clippy::too_many_arguments,
clippy::if_same_then_else,
clippy::large_enum_variant,
clippy::needless_range_loop
)]
//! Guará: núcleo de recuperação de arquivos.
//!
//! Princípio central: a origem é aberta **somente para leitura**; nada neste
@@ -6,9 +13,9 @@
pub mod aff4;
pub mod assemble;
pub mod carve;
pub mod crypt;
pub mod defrag;
pub mod device;
pub mod crypt;
pub mod error;
pub mod ewf;
pub mod explorer;
@@ -26,9 +33,9 @@ pub mod mp4rebuild;
pub mod notify;
pub mod owner;
pub mod partition;
pub mod reconnect;
pub mod raid;
pub mod raid_detect;
pub mod reconnect;
pub mod recover;
pub mod report;
pub mod scan;
+134 -30
View File
@@ -60,7 +60,9 @@ pub fn read_pv(src: &dyn Source) -> Option<PvInfo> {
}
let mut best: Option<PvInfo> = None;
for (mda_off, mda_size) in mdas {
let Ok(h) = read_vec(src, mda_off, 512) else { continue };
let Ok(h) = read_vec(src, mda_off, 512) else {
continue;
};
if h.len() < 512 || &h[4..20] != MDA_MAGIC {
continue;
}
@@ -85,11 +87,25 @@ pub fn read_pv(src: &dyn Source) -> Option<PvInfo> {
text = [a, b].concat();
}
}
let s = String::from_utf8_lossy(&text).trim_end_matches('\0').to_string();
let s = String::from_utf8_lossy(&text)
.trim_end_matches('\0')
.to_string();
let Some(tree) = parse(&s) else { continue };
let Some((vg_name, vg)) = tree.sections.iter().find(|(_, sec)| sec.values.contains_key("extent_size")) else { continue };
let Some((vg_name, vg)) = tree
.sections
.iter()
.find(|(_, sec)| sec.values.contains_key("extent_size"))
else {
continue;
};
let seqno = vg.int("seqno").unwrap_or(0);
let cand = PvInfo { uuid: uuid.clone(), size, seqno, vg_name: vg_name.clone(), text: s.clone() };
let cand = PvInfo {
uuid: uuid.clone(),
size,
seqno,
vg_name: vg_name.clone(),
text: s.clone(),
};
if best.as_ref().map(|b| cand.seqno > b.seqno).unwrap_or(true) {
best = Some(cand);
}
@@ -133,7 +149,10 @@ impl Section {
}
}
pub fn sub(&self, name: &str) -> Option<&Section> {
self.sections.iter().find(|(n, _)| n == name).map(|(_, s)| s)
self.sections
.iter()
.find(|(n, _)| n == name)
.map(|(_, s)| s)
}
}
@@ -145,7 +164,9 @@ struct Lexer<'a> {
impl Lexer<'_> {
fn skip(&mut self) {
loop {
while self.i < self.b.len() && (self.b[self.i].is_ascii_whitespace() || self.b[self.i] == b',') {
while self.i < self.b.len()
&& (self.b[self.i].is_ascii_whitespace() || self.b[self.i] == b',')
{
self.i += 1;
}
if self.i < self.b.len() && self.b[self.i] == b'#' {
@@ -160,7 +181,13 @@ impl Lexer<'_> {
fn ident(&mut self) -> Option<String> {
self.skip();
let s = self.i;
while self.i < self.b.len() && !self.b[self.i].is_ascii_whitespace() && !matches!(self.b[self.i], b'=' | b'{' | b'}' | b'[' | b']' | b'"' | b'#') {
while self.i < self.b.len()
&& !self.b[self.i].is_ascii_whitespace()
&& !matches!(
self.b[self.i],
b'=' | b'{' | b'}' | b'[' | b']' | b'"' | b'#'
)
{
self.i += 1;
}
(self.i > s).then(|| String::from_utf8_lossy(&self.b[s..self.i]).to_string())
@@ -196,13 +223,19 @@ impl Lexer<'_> {
}
_ => {
let s = self.i;
while self.i < self.b.len() && (self.b[self.i].is_ascii_digit() || self.b[self.i] == b'-') {
while self.i < self.b.len()
&& (self.b[self.i].is_ascii_digit() || self.b[self.i] == b'-')
{
self.i += 1;
}
if self.i == s {
return None;
}
std::str::from_utf8(&self.b[s..self.i]).ok()?.parse().ok().map(Val::Int)
std::str::from_utf8(&self.b[s..self.i])
.ok()?
.parse()
.ok()
.map(Val::Int)
}
}
}
@@ -237,7 +270,11 @@ impl Lexer<'_> {
}
pub fn parse(text: &str) -> Option<Section> {
Lexer { b: text.as_bytes(), i: 0 }.section(true)
Lexer {
b: text.as_bytes(),
i: 0,
}
.section(true)
}
// ------------------------------------------------------------- montagem
@@ -246,15 +283,32 @@ fn dashed(u: &str) -> String {
if u.len() != 32 {
return u.to_string();
}
format!("{}-{}-{}-{}-{}-{}-{}", &u[0..6], &u[6..10], &u[10..14], &u[14..18], &u[18..22], &u[22..26], &u[26..32])
format!(
"{}-{}-{}-{}-{}-{}-{}",
&u[0..6],
&u[6..10],
&u[10..14],
&u[14..18],
&u[18..22],
&u[22..26],
&u[26..32]
)
}
#[derive(Clone)]
enum Map {
/// Lê de `src` a partir de `base` (linear).
Linear { src: Option<Arc<dyn Source>>, base: u64 },
Striped { srcs: Vec<(Option<Arc<dyn Source>>, u64)>, stripe: u64 },
Mirror { legs: Vec<(Option<Arc<dyn Source>>, u64)> },
Linear {
src: Option<Arc<dyn Source>>,
base: u64,
},
Striped {
srcs: Vec<(Option<Arc<dyn Source>>, u64)>,
stripe: u64,
},
Mirror {
legs: Vec<(Option<Arc<dyn Source>>, u64)>,
},
Raid(Arc<RaidSource>),
}
@@ -395,31 +449,53 @@ impl Ctx<'_> {
})
.collect();
if srcs.iter().any(|(s, _)| s.is_none()) {
self.warnings.push(format!("{name}: falta um volume físico; as áreas dele aparecem zeradas"));
self.warnings.push(format!(
"{name}: falta um volume físico; as áreas dele aparecem zeradas"
));
}
if srcs.len() == 1 {
let (src, base) = srcs.into_iter().next().unwrap();
Map::Linear { src, base }
} else {
Map::Striped { srcs, stripe: seg.int("stripe_size").unwrap_or(128) * 512 }
Map::Striped {
srcs,
stripe: seg.int("stripe_size").unwrap_or(128) * 512,
}
}
}
"mirror" => {
let st = mk_stripes(seg.list("mirrors").unwrap_or(&[]));
let legs = st
.iter()
.filter_map(|(pv, e)| self.pvs.get(pv).map(|(s, pe)| (s.clone(), pe + e * self.ext)))
.filter_map(|(pv, e)| {
self.pvs
.get(pv)
.map(|(s, pe)| (s.clone(), pe + e * self.ext))
})
.collect();
Map::Mirror { legs }
}
t if t.starts_with("raid") => {
let raids = seg.list("raids").unwrap_or(&[]);
let imgs: Vec<String> = raids.iter().filter_map(|v| if let Val::Str(s) = v { Some(s.clone()) } else { None }).collect();
let imgs: Vec<String> = raids
.iter()
.filter_map(|v| {
if let Val::Str(s) = v {
Some(s.clone())
} else {
None
}
})
.collect();
// Pares (rimage, rmeta) ou lista só de imagens.
let data_lvs: Vec<&String> = imgs.iter().filter(|n| n.contains("_rimage_")).collect();
let data_lvs: Vec<&String> =
imgs.iter().filter(|n| n.contains("_rimage_")).collect();
let mut members: Vec<Option<Member>> = vec![];
for n in &data_lvs {
members.push(self.build(n, depth + 1).map(|src| Member { src, data_offset: 0 }));
members.push(self.build(n, depth + 1).map(|src| Member {
src,
data_offset: 0,
}));
}
let chunk = seg.int("stripe_size").unwrap_or(128) * 512;
let (level, layout) = match t {
@@ -435,7 +511,8 @@ impl Ctx<'_> {
"raid6_nc" | "raid6_n_6" => (Level::R6, Layout::ParityLast),
"raid10" => (Level::R10, Layout::LeftSymmetric),
other => {
self.warnings.push(format!("{name}: tipo {other} não suportado"));
self.warnings
.push(format!("{name}: tipo {other} não suportado"));
return None;
}
};
@@ -451,7 +528,9 @@ impl Ctx<'_> {
}
}
other => {
self.warnings.push(format!("{name}: tipo de segmento \"{other}\" não suportado"));
self.warnings.push(format!(
"{name}: tipo de segmento \"{other}\" não suportado"
));
return None;
}
};
@@ -474,27 +553,48 @@ pub fn assemble_vgs(pvs: Vec<(Arc<dyn Source>, PvInfo)>) -> Vec<VgResult> {
let mut out = vec![];
for (vg_name, list) in by_vg {
let newest = list.iter().max_by_key(|(_, p)| p.seqno).unwrap();
let Some(tree) = parse(&newest.1.text) else { continue };
let Some(vg) = tree.sub(&vg_name) else { continue };
let Some(tree) = parse(&newest.1.text) else {
continue;
};
let Some(vg) = tree.sub(&vg_name) else {
continue;
};
let ext = vg.int("extent_size").unwrap_or(8192) * 512;
let mut pvmap = BTreeMap::new();
let mut warnings = vec![];
if let Some(pvsec) = vg.sub("physical_volumes") {
for (pvname, def) in &pvsec.sections {
let id = def.str("id").unwrap_or("").to_string();
let found = list.iter().find(|(_, p)| dashed(&p.uuid) == id).map(|(s, _)| s.clone());
let found = list
.iter()
.find(|(_, p)| dashed(&p.uuid) == id)
.map(|(s, _)| s.clone());
if found.is_none() {
warnings.push(format!("volume físico {pvname} ({id}) não foi fornecido"));
}
pvmap.insert(pvname.clone(), (found, def.int("pe_start").unwrap_or(2048) * 512));
pvmap.insert(
pvname.clone(),
(found, def.int("pe_start").unwrap_or(2048) * 512),
);
}
}
let Some(lvsec) = vg.sub("logical_volumes") else { continue };
let mut ctx = Ctx { ext, pvs: pvmap, lvs: lvsec, cache: BTreeMap::new(), warnings };
let Some(lvsec) = vg.sub("logical_volumes") else {
continue;
};
let mut ctx = Ctx {
ext,
pvs: pvmap,
lvs: lvsec,
cache: BTreeMap::new(),
warnings,
};
let mut lvs = vec![];
for (name, def) in &lvsec.sections {
// Imagens internas do RAID e metadados não são volumes de usuário.
let hidden = def.list("status").map(|l| !l.iter().any(|v| matches!(v, Val::Str(s) if s == "VISIBLE"))).unwrap_or(false);
let hidden = def
.list("status")
.map(|l| !l.iter().any(|v| matches!(v, Val::Str(s) if s == "VISIBLE")))
.unwrap_or(false);
if hidden {
continue;
}
@@ -502,7 +602,11 @@ pub fn assemble_vgs(pvs: Vec<(Arc<dyn Source>, PvInfo)>) -> Vec<VgResult> {
lvs.push((name.clone(), src));
}
}
out.push(VgResult { name: vg_name, lvs, warnings: ctx.warnings });
out.push(VgResult {
name: vg_name,
lvs,
warnings: ctx.warnings,
});
}
out
}
+230 -59
View File
@@ -6,7 +6,9 @@
use crate::source::{read_vec, Source};
fn be32(b: &[u8], o: usize) -> u32 {
b.get(o..o + 4).map(|s| u32::from_be_bytes(s.try_into().unwrap())).unwrap_or(0)
b.get(o..o + 4)
.map(|s| u32::from_be_bytes(s.try_into().unwrap()))
.unwrap_or(0)
}
// ------------------------------------------------------------------ bits
@@ -45,7 +47,11 @@ impl<'a> Bits<'a> {
}
fn se(&mut self) -> Option<i32> {
let k = self.ue()?;
Some(if k % 2 == 1 { (k / 2 + 1) as i32 } else { -((k / 2) as i32) })
Some(if k % 2 == 1 {
(k / 2 + 1) as i32
} else {
-((k / 2) as i32)
})
}
fn skip(&mut self, n: usize) {
self.pos += n;
@@ -101,10 +107,18 @@ pub fn parse_sps264(nal: &[u8]) -> Option<Sps264> {
}
let rbsp = unescape(&nal[1..]);
let mut b = Bits::new(&rbsp);
let mut s = Sps264 { profile: b.u(8)? as u8, compat: b.u(8)? as u8, level: b.u(8)? as u8, ..Default::default() };
let mut s = Sps264 {
profile: b.u(8)? as u8,
compat: b.u(8)? as u8,
level: b.u(8)? as u8,
..Default::default()
};
b.ue()?; // sps_id
let mut chroma = 1;
if matches!(s.profile, 100 | 110 | 122 | 244 | 44 | 83 | 86 | 118 | 128 | 138 | 139 | 134 | 135) {
if matches!(
s.profile,
100 | 110 | 122 | 244 | 44 | 83 | 86 | 118 | 128 | 138 | 139 | 134 | 135
) {
chroma = b.ue()?;
if chroma == 3 {
b.bit()?;
@@ -161,10 +175,8 @@ pub fn parse_sps264(nal: &[u8]) -> Option<Sps264> {
s.height = ((2 - s.frame_mbs_only as u32) * h * 16).checked_sub((ct + cb) * sub_h)?;
// VUI até o timing_info.
if b.bit()? == 1 {
if b.bit()? == 1 {
if b.u(8)? == 255 {
b.skip(32);
}
if b.bit()? == 1 && b.u(8)? == 255 {
b.skip(32);
}
if b.bit()? == 1 {
b.bit()?;
@@ -207,10 +219,8 @@ fn slice264(nal: &[u8], sps: &Sps264, pic_order_present: bool) -> Option<SliceIn
b.ue()?; // pps_id
let frame_num = b.u(sps.log2_max_frame_num)?;
let mut bottom = false;
if !sps.frame_mbs_only {
if b.bit()? == 1 {
bottom = b.bit()? == 1;
}
if !sps.frame_mbs_only && b.bit()? == 1 {
bottom = b.bit()? == 1;
}
let idr = nal[0] & 0x1F == 5;
if idr {
@@ -221,14 +231,22 @@ fn slice264(nal: &[u8], sps: &Sps264, pic_order_present: bool) -> Option<SliceIn
poc_lsb = Some(b.u(sps.log2_max_poc_lsb)?);
let _ = pic_order_present;
}
Some(SliceInfo { frame_num, first_mb0: first == 0, idr, poc_lsb, bottom })
Some(SliceInfo {
frame_num,
first_mb0: first == 0,
idr,
poc_lsb,
bottom,
})
}
/// bottom_field_pic_order_in_frame_present_flag do PPS.
fn pps_pic_order_present(nal: &[u8]) -> bool {
let rbsp = unescape(&nal[1..]);
let mut b = Bits::new(&rbsp);
let (Some(_), Some(_), Some(_)) = (b.ue(), b.ue(), b.bit()) else { return false };
let (Some(_), Some(_), Some(_)) = (b.ue(), b.ue(), b.bit()) else {
return false;
};
b.bit() == Some(1)
}
@@ -345,7 +363,12 @@ pub fn config_from_mp4(src: &dyn Source, off: u64, max: u64) -> Option<MediaConf
p += 2 + l;
}
if !sps.is_empty() && !pps.is_empty() {
return Some(MediaConfig { codec: Codec::Avc, sps, pps, vps: vec![] });
return Some(MediaConfig {
codec: Codec::Avc,
sps,
pps,
vps: vec![],
});
}
}
} else if tag == b"hvcC" {
@@ -371,7 +394,12 @@ pub fn config_from_mp4(src: &dyn Source, off: u64, max: u64) -> Option<MediaConf
}
}
if !sps.is_empty() && !pps.is_empty() {
return Some(MediaConfig { codec: Codec::Hevc, sps, pps, vps });
return Some(MediaConfig {
codec: Codec::Hevc,
sps,
pps,
vps,
});
}
}
}
@@ -448,10 +476,16 @@ pub fn rebuild(src: &dyn Source, off: u64, avail: u64, refs: &[MediaConfig]) ->
if let Some(r) = rebuild_with(src, off, avail, None) {
return Some(r);
}
refs.iter().find_map(|c| rebuild_with(src, off, avail, Some(c)))
refs.iter()
.find_map(|c| rebuild_with(src, off, avail, Some(c)))
}
fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaConfig>) -> Option<Rebuilt> {
fn rebuild_with(
src: &dyn Source,
off: u64,
avail: u64,
preset: Option<&MediaConfig>,
) -> Option<Rebuilt> {
// Átomos antes do mdat.
let mut p = 0u64;
let mut pre_end = None;
@@ -465,7 +499,10 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
pre_end = Some(p);
break;
}
if !matches!(ty, b"ftyp" | b"free" | b"skip" | b"wide" | b"uuid" | b"pnot" | b"junk" | b"styp") {
if !matches!(
ty,
b"ftyp" | b"free" | b"skip" | b"wide" | b"uuid" | b"pnot" | b"junk" | b"styp"
) {
return None;
}
let sz = be32(&h, 0) as u64;
@@ -477,7 +514,11 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
let pre_len = pre_end?;
let (data_start, declared) = mdat_at(src, off + pre_len)?;
let hard_end = off + avail.min(src.size() - off);
let data_end_decl = if declared == 0 { hard_end } else { (off + pre_len + declared).min(hard_end) };
let data_end_decl = if declared == 0 {
hard_end
} else {
(off + pre_len + declared).min(hard_end)
};
// Lê o payload em blocos, interpretando NALs.
let mut samples: Vec<Sample> = vec![];
@@ -485,7 +526,10 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
let mut cache_off = data_start;
let read_at = |o: u64, n: usize, cache: &mut Vec<u8>, cache_off: &mut u64| -> Option<Vec<u8>> {
if o < *cache_off || o + n as u64 > *cache_off + cache.len() as u64 {
let want = (data_end_decl.saturating_sub(o) as usize).min(8 << 20).max(n).min((hard_end - o) as usize);
let want = (data_end_decl.saturating_sub(o) as usize)
.min(8 << 20)
.max(n)
.min((hard_end - o) as usize);
*cache = read_vec(src, o, want).ok()?;
*cache_off = o;
}
@@ -494,15 +538,18 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
};
// Detecta o codec: o que forma a cadeia mais longa de unidades NAL válidas.
let chain = |c: Codec| -> usize {
let Ok(head) = read_vec(src, data_start, 64 << 10) else { return 0 };
let Ok(head) = read_vec(src, data_start, 64 << 10) else {
return 0;
};
let mut p = 0usize;
let mut n = 0;
while p + 6 <= head.len() {
let l = be32(&head, p) as usize;
let ok = l >= 1 && l <= 8 << 20 && match c {
Codec::Avc => avc_nal_ok(head[p + 4]),
Codec::Hevc => hevc_nal_ok(head[p + 4], head[p + 5]),
};
let ok = (1..=8 << 20).contains(&l)
&& match c {
Codec::Avc => avc_nal_ok(head[p + 4]),
Codec::Hevc => hevc_nal_ok(head[p + 4], head[p + 5]),
};
if !ok {
break;
}
@@ -540,7 +587,11 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
match codec {
Codec::Avc => {
sps264 = c.sps.iter().find_map(|n| parse_sps264(n));
pic_order_present = c.pps.first().map(|p| pps_pic_order_present(p)).unwrap_or(false);
pic_order_present = c
.pps
.first()
.map(|p| pps_pic_order_present(p))
.unwrap_or(false);
}
Codec::Hevc => sps265 = c.sps.iter().find_map(|n| parse_sps_hevc(n)),
}
@@ -558,10 +609,12 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
'outer: while pos + 6 <= data_end_decl {
let hdr = read_at(pos, 6, &mut cache, &mut cache_off)?;
let len = be32(&hdr, 0) as u64;
let ok = len >= 1 && len <= 16 << 20 && pos + 4 + len <= data_end_decl && match codec {
Codec::Avc => avc_nal_ok(hdr[4]),
Codec::Hevc => hevc_nal_ok(hdr[4], hdr[5]),
};
let ok = (1..=16 << 20).contains(&len)
&& pos + 4 + len <= data_end_decl
&& match codec {
Codec::Avc => avc_nal_ok(hdr[4]),
Codec::Hevc => hevc_nal_ok(hdr[4], hdr[5]),
};
let mut ok = ok;
if ok && nal_count >= 3 && len > (max_len * 6).max(1 << 20) {
// Um "tamanho" muito maior que os já vistos é lixo (áudio lido como vídeo).
@@ -577,7 +630,16 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
}
if !valid {
// Pode ser áudio intercalado: procura a próxima unidade NAL plausível.
let found = scan_nal(src, codec, pos + 1, (pos + (2 << 20)).min(data_end_decl), data_end_decl, sps264.as_ref(), pps_nals.len(), (max_len * 6).max(1 << 20));
let found = scan_nal(
src,
codec,
pos + 1,
(pos + (2 << 20)).min(data_end_decl),
data_end_decl,
sps264.as_ref(),
pps_nals.len(),
(max_len * 6).max(1 << 20),
);
match found {
Some(q) if nal_count > 0 => {
// O que veio antes fecha o quadro atual.
@@ -593,20 +655,32 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
}
}
let nal_start = pos + 4;
let nal = read_at(nal_start, len.min(64 << 10) as usize, &mut cache, &mut cache_off)?;
let nal = read_at(
nal_start,
len.min(64 << 10) as usize,
&mut cache,
&mut cache_off,
)?;
let (is_vcl, first_of_pic, is_idr, ty) = match codec {
Codec::Avc => {
let t = nal[0] & 0x1F;
match t {
1 | 2 | 5 => {
let first = sps264.as_ref().and_then(|s| slice264(&nal, s, pic_order_present));
(true, first.as_ref().map(|f| f.first_mb0).unwrap_or(true), t == 5, t)
let first = sps264
.as_ref()
.and_then(|s| slice264(&nal, s, pic_order_present));
(
true,
first.as_ref().map(|f| f.first_mb0).unwrap_or(true),
t == 5,
t,
)
}
7 => {
if sps264.is_none() {
sps264 = parse_sps264(&nal);
}
if !sps_nals.iter().any(|x| *x == nal) && sps_nals.len() < 4 {
if !sps_nals.contains(&nal) && sps_nals.len() < 4 {
sps_nals.push(nal.clone());
}
(false, false, false, t)
@@ -615,7 +689,7 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
if pps_nals.is_empty() {
pic_order_present = pps_pic_order_present(&nal);
}
if !pps_nals.iter().any(|x| *x == nal) && pps_nals.len() < 4 {
if !pps_nals.contains(&nal) && pps_nals.len() < 4 {
pps_nals.push(nal.clone());
}
(false, false, false, t)
@@ -626,9 +700,14 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
Codec::Hevc => {
let t = (nal[0] >> 1) & 0x3F;
match t {
0..=9 | 16..=21 => (true, nal.get(2).map(|b| b & 0x80 != 0).unwrap_or(true), (16..=21).contains(&t), t),
0..=9 | 16..=21 => (
true,
nal.get(2).map(|b| b & 0x80 != 0).unwrap_or(true),
(16..=21).contains(&t),
t,
),
32 => {
if !vps_nals.iter().any(|x| *x == nal) && vps_nals.len() < 2 {
if !vps_nals.contains(&nal) && vps_nals.len() < 2 {
vps_nals.push(nal.clone());
}
(false, false, false, t)
@@ -637,13 +716,13 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
if sps265.is_none() {
sps265 = parse_sps_hevc(&nal);
}
if !sps_nals.iter().any(|x| *x == nal) && sps_nals.len() < 4 {
if !sps_nals.contains(&nal) && sps_nals.len() < 4 {
sps_nals.push(nal.clone());
}
(false, false, false, t)
}
34 => {
if !pps_nals.iter().any(|x| *x == nal) && pps_nals.len() < 4 {
if !pps_nals.contains(&nal) && pps_nals.len() < 4 {
pps_nals.push(nal.clone());
}
(false, false, false, t)
@@ -695,7 +774,13 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
}
}
}
cur = Some(Sample { off: start, size: 0, sync: is_idr, poc, idr: is_idr });
cur = Some(Sample {
off: start,
size: 0,
sync: is_idr,
poc,
idr: is_idr,
});
}
if !first_of_pic {
group_start = None;
@@ -736,7 +821,11 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
None => (30, 1),
};
let fps = num as f64 / den as f64;
let (num, den) = if !(1.0..=240.0).contains(&fps) { (30, 1) } else { (num, den) };
let (num, den) = if !(1.0..=240.0).contains(&fps) {
(30, 1)
} else {
(num, den)
};
let fps = num as f64 / den as f64;
// Escala: tique do quadro = den, escala de tempo = num.
let (timescale, dur) = (num, den);
@@ -766,12 +855,30 @@ fn rebuild_with(src: &dyn Source, off: u64, avail: u64, preset: Option<&MediaCon
ctts = Some(offs.iter().map(|&d| (d + depth) * dur as i64).collect());
}
}
let reorder_delay: i64 = ctts.as_ref().map(|c| c.iter().copied().min().unwrap_or(0)).unwrap_or(0);
let reorder_delay: i64 = ctts
.as_ref()
.map(|c| c.iter().copied().min().unwrap_or(0))
.unwrap_or(0);
let payload = (data_start, payload_end);
let out_payload_start = pre_len + 16;
let map_off = |abs: u64| -> u64 { out_payload_start + (abs - data_start) };
let moov = build_moov(codec, width, height, &sps_nals, &pps_nals, &vps_nals, profile_info.as_ref(), &sps264, &samples, timescale, dur, ctts.as_deref(), reorder_delay, &map_off);
let moov = build_moov(
codec,
width,
height,
&sps_nals,
&pps_nals,
&vps_nals,
profile_info.as_ref(),
&sps264,
&samples,
timescale,
dur,
ctts.as_deref(),
reorder_delay,
&map_off,
);
let used: u64 = samples.iter().map(|s| s.size as u64).sum();
Some(Rebuilt {
pre_len,
@@ -846,7 +953,14 @@ fn build_moov(
let (fourcc, cfg) = match codec {
Codec::Avc => {
let s = avc.as_ref().unwrap();
let mut c = vec![1, s.profile, s.compat, s.level, 0xFF, 0xE0 | sps.len() as u8];
let mut c = vec![
1,
s.profile,
s.compat,
s.level,
0xFF,
0xE0 | sps.len() as u8,
];
for x in sps {
c.extend_from_slice(&(x.len() as u16).to_be_bytes());
c.extend_from_slice(x);
@@ -893,14 +1007,24 @@ fn build_moov(
stsd_body.extend_from_slice(&sample_entry);
let stsd = full(b"stsd", 0, 0, &stsd_body);
let stts = full(b"stts", 0, 0, &[u32b(1).as_slice(), &u32b(n as u32), &u32b(dur)].concat());
let stts = full(
b"stts",
0,
0,
&[u32b(1).as_slice(), &u32b(n as u32), &u32b(dur)].concat(),
);
let mut stsz_body = u32b(0).to_vec();
stsz_body.extend_from_slice(&u32b(n as u32));
for s in samples {
stsz_body.extend_from_slice(&u32b(s.size));
}
let stsz = full(b"stsz", 0, 0, &stsz_body);
let stsc = full(b"stsc", 0, 0, &[u32b(1).as_slice(), &u32b(1), &u32b(1), &u32b(1)].concat());
let stsc = full(
b"stsc",
0,
0,
&[u32b(1).as_slice(), &u32b(1), &u32b(1), &u32b(1)].concat(),
);
let need64 = samples.iter().any(|s| map_off(s.off) > u32::MAX as u64);
let stco = if need64 {
let mut b = u32b(n as u32).to_vec();
@@ -915,7 +1039,12 @@ fn build_moov(
}
full(b"stco", 0, 0, &b)
};
let syncs: Vec<u32> = samples.iter().enumerate().filter(|(_, s)| s.sync).map(|(i, _)| i as u32 + 1).collect();
let syncs: Vec<u32> = samples
.iter()
.enumerate()
.filter(|(_, s)| s.sync)
.map(|(i, _)| i as u32 + 1)
.collect();
let mut stbl_parts = vec![stsd, stts];
if let Some(c) = ctts {
// entradas agrupadas
@@ -1008,7 +1137,13 @@ fn build_moov(
}
/// A unidade NAL parece de verdade? Valida o cabeçalho de fatia e o tamanho de SPS/PPS/AUD.
fn nal_plausible(codec: Codec, head: &[u8], len: u64, sps: Option<&Sps264>, pps_count: usize) -> bool {
fn nal_plausible(
codec: Codec,
head: &[u8],
len: u64,
sps: Option<&Sps264>,
pps_count: usize,
) -> bool {
match codec {
Codec::Avc => {
let t = head[0] & 0x1F;
@@ -1016,8 +1151,13 @@ fn nal_plausible(codec: Codec, head: &[u8], len: u64, sps: Option<&Sps264>, pps_
1 | 2 | 5 => {
let rbsp = unescape(&head[1..]);
let mut b = Bits::new(&rbsp);
let (Some(first), Some(st), Some(pps)) = (b.ue(), b.ue(), b.ue()) else { return false };
if st > 9 || pps > 255 || (pps_count > 0 && pps as usize >= pps_count.max(1) && pps > 3) {
let (Some(first), Some(st), Some(pps)) = (b.ue(), b.ue(), b.ue()) else {
return false;
};
if st > 9
|| pps > 255
|| (pps_count > 0 && pps as usize >= pps_count.max(1) && pps > 3)
{
return false;
}
if t == 5 && !matches!(st, 2 | 4 | 7 | 9) {
@@ -1047,7 +1187,7 @@ fn nal_plausible(codec: Codec, head: &[u8], len: u64, sps: Option<&Sps264>, pps_
let t = (head[0] >> 1) & 0x3F;
match t {
35 => len <= 4,
32 | 33 | 34 => (4..=1000).contains(&len),
32..=34 => (4..=1000).contains(&len),
_ => true,
}
}
@@ -1055,17 +1195,34 @@ fn nal_plausible(codec: Codec, head: &[u8], len: u64, sps: Option<&Sps264>, pps_
}
/// Quantas unidades NAL válidas seguidas (sem vãos) começam em `at` (até `max`).
fn chain_len(buf: &[u8], base: u64, at: u64, codec: Codec, sps: Option<&Sps264>, pps_count: usize, cap: u64, max: usize) -> usize {
fn chain_len(
buf: &[u8],
base: u64,
at: u64,
codec: Codec,
sps: Option<&Sps264>,
pps_count: usize,
cap: u64,
max: usize,
) -> usize {
let mut p = (at - base) as usize;
let mut n = 0;
while n < max && p + 8 <= buf.len() {
let l = be32(buf, p) as u64;
let ok = l >= 1 && l <= cap && p as u64 + 4 + l <= buf.len() as u64 + 8
let ok = l >= 1
&& l <= cap
&& p as u64 + 4 + l <= buf.len() as u64 + 8
&& match codec {
Codec::Avc => avc_nal_ok(buf[p + 4]),
Codec::Hevc => hevc_nal_ok(buf[p + 4], buf[p + 5]),
}
&& nal_plausible(codec, &buf[p + 4..(p + 4 + (l as usize).min(48)).min(buf.len())], l, sps, pps_count);
&& nal_plausible(
codec,
&buf[p + 4..(p + 4 + (l as usize).min(48)).min(buf.len())],
l,
sps,
pps_count,
);
if !ok {
break;
}
@@ -1077,12 +1234,22 @@ fn chain_len(buf: &[u8], base: u64, at: u64, codec: Codec, sps: Option<&Sps264>,
/// Próxima posição em [from, limit) onde começa uma sequência de unidades NAL plausíveis.
/// Prefere o primeiro ponto com duas ou mais unidades seguidas; senão, uma unidade isolada.
fn scan_nal(src: &dyn Source, codec: Codec, from: u64, limit: u64, data_end: u64, sps: Option<&Sps264>, pps_count: usize, cap: u64) -> Option<u64> {
fn scan_nal(
src: &dyn Source,
codec: Codec,
from: u64,
limit: u64,
data_end: u64,
sps: Option<&Sps264>,
pps_count: usize,
cap: u64,
) -> Option<u64> {
if limit <= from + 8 {
return None;
}
// Lê um pouco além do limite para poder seguir a cadeia de unidades.
let want = ((limit - from) as usize + (cap as usize).min(4 << 20)).min((data_end - from) as usize);
let want =
((limit - from) as usize + (cap as usize).min(4 << 20)).min((data_end - from) as usize);
let buf = read_vec(src, from, want).ok()?;
let mut single = None;
let mut i = 0usize;
@@ -1093,7 +1260,11 @@ fn scan_nal(src: &dyn Source, codec: Codec, from: u64, limit: u64, data_end: u64
let nb = buf[i + 4];
let good_head = match codec {
// Um quadro novo começa por parâmetros/AUD/SEI ou por fatia do macrobloco 0.
Codec::Avc => avc_nal_ok(nb) && (matches!(nb & 0x1F, 6..=9) || (matches!(nb & 0x1F, 1 | 5) && buf[i + 5] & 0x80 != 0)),
Codec::Avc => {
avc_nal_ok(nb)
&& (matches!(nb & 0x1F, 6..=9)
|| (matches!(nb & 0x1F, 1 | 5) && buf[i + 5] & 0x80 != 0))
}
Codec::Hevc => hevc_nal_ok(nb, buf[i + 5]),
};
if good_head {
+8 -2
View File
@@ -19,7 +19,10 @@ pub fn detect_fs(src: &dyn Source, start: u64) -> Option<(FsKind, Option<u64>)>
// Assinaturas mais adiante no volume: Btrfs (64 KiB) e RAID mdadm 1.2 (4 KiB).
if let Ok(h) = read_vec(src, start + 0x10000, 0x100) {
if h.len() >= 0x80 && &h[0x40..0x48] == b"_BHRfS_M" {
return Some((FsKind::Btrfs, Some(u64::from_le_bytes(h[0x70..0x78].try_into().unwrap()))));
return Some((
FsKind::Btrfs,
Some(u64::from_le_bytes(h[0x70..0x78].try_into().unwrap())),
));
}
}
if let Ok(h) = read_vec(src, start + 4096, 16) {
@@ -68,7 +71,10 @@ pub fn detect_fs_in(b: &[u8]) -> Option<(FsKind, Option<u64>)> {
return Some((FsKind::Refs, Some(sectors * bps)));
}
if crate::crypt::filevault::detect(b) {
return Some((FsKind::Corestorage, Some(u64::from_le_bytes(b[64..72].try_into().unwrap()))));
return Some((
FsKind::Corestorage,
Some(u64::from_le_bytes(b[64..72].try_into().unwrap())),
));
}
if crate::crypt::bitlocker::detect(b) {
return Some((FsKind::Bitlocker, None));
+90 -21
View File
@@ -60,7 +60,12 @@ impl Layout {
}
}
pub fn all_raid5() -> [Layout; 4] {
[Layout::LeftSymmetric, Layout::LeftAsymmetric, Layout::RightSymmetric, Layout::RightAsymmetric]
[
Layout::LeftSymmetric,
Layout::LeftAsymmetric,
Layout::RightSymmetric,
Layout::RightAsymmetric,
]
}
}
@@ -89,7 +94,16 @@ pub struct RaidParams {
impl RaidParams {
pub fn simple(level: Level, chunk: u64, layout: Layout, members: Vec<Option<Member>>) -> Self {
Self { level, chunk, layout, members, near: 2, far: 1, far_offset: false, per_member: 0 }
Self {
level,
chunk,
layout,
members,
near: 2,
far: 1,
far_offset: false,
per_member: 0,
}
}
}
@@ -149,7 +163,11 @@ impl RaidSource {
let present: Vec<&Member> = p.members.iter().flatten().collect();
let min = |f: &dyn Fn(&Member) -> u64| present.iter().map(|m| f(m)).min().unwrap_or(0);
let avail = min(&|m| m.src.size().saturating_sub(m.data_offset));
let mut per_member = if p.per_member > 0 { p.per_member.min(avail) } else { avail };
let mut per_member = if p.per_member > 0 {
p.per_member.min(avail)
} else {
avail
};
if p.level != Level::Linear {
per_member = per_member / p.chunk.max(512) * p.chunk.max(512);
}
@@ -162,7 +180,10 @@ impl RaidSource {
Level::R10 => (p.near.max(1) as usize).saturating_sub(1).min(1),
};
if missing > need && p.level != Level::R10 {
return Err(format!("faltam {missing} membro(s); {} tolera no máximo {need}", p.level.name()));
return Err(format!(
"faltam {missing} membro(s); {} tolera no máximo {need}",
p.level.name()
));
}
if matches!(p.level, Level::R4 | Level::R5) && n < 3 || p.level == Level::R6 && n < 4 {
return Err("poucos membros para o nível".into());
@@ -171,14 +192,21 @@ impl RaidSource {
return Err("parâmetros de RAID 10 inválidos".into());
}
let size = match p.level {
Level::Linear => present.iter().map(|m| m.src.size().saturating_sub(m.data_offset)).sum(),
Level::Linear => present
.iter()
.map(|m| m.src.size().saturating_sub(m.data_offset))
.sum(),
Level::R0 => per_member * n as u64,
Level::R1 => per_member,
Level::R4 | Level::R5 => per_member * (n as u64 - 1),
Level::R6 => per_member * (n as u64 - 2),
Level::R10 => per_member * n as u64 / (p.near.max(1) * p.far.max(1)) as u64,
};
Ok(Self { p, size, per_member })
Ok(Self {
p,
size,
per_member,
})
}
pub fn params(&self) -> &RaidParams {
@@ -186,10 +214,14 @@ impl RaidSource {
}
fn read_member(&self, i: usize, off: u64, buf: &mut [u8]) -> io::Result<()> {
let m = self.p.members[i].as_ref().ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "membro ausente"))?;
let m = self.p.members[i]
.as_ref()
.ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "membro ausente"))?;
let mut done = 0;
while done < buf.len() {
let n = m.src.read_at(m.data_offset + off + done as u64, &mut buf[done..])?;
let n = m
.src
.read_at(m.data_offset + off + done as u64, &mut buf[done..])?;
if n == 0 {
buf[done..].fill(0);
break;
@@ -206,12 +238,24 @@ impl RaidSource {
match self.p.layout {
Layout::LeftAsymmetric | Layout::LeftSymmetric => {
let pd = n - 1 - r;
let disk = if self.p.layout == Layout::LeftSymmetric { (pd + 1 + d) % n } else if d >= pd { d + 1 } else { d };
let disk = if self.p.layout == Layout::LeftSymmetric {
(pd + 1 + d) % n
} else if d >= pd {
d + 1
} else {
d
};
(pd, disk)
}
Layout::RightAsymmetric | Layout::RightSymmetric => {
let pd = r;
let disk = if self.p.layout == Layout::RightSymmetric { (pd + 1 + d) % n } else if d >= pd { d + 1 } else { d };
let disk = if self.p.layout == Layout::RightSymmetric {
(pd + 1 + d) % n
} else if d >= pd {
d + 1
} else {
d
};
(pd, disk)
}
Layout::ParityFirst => (0, d + 1),
@@ -273,11 +317,13 @@ impl RaidSource {
}
Level::R1 => {
for i in 0..n {
if self.p.members[i].is_some() && self.read_member(i, chunk_idx * c + within, buf).is_ok() {
if self.p.members[i].is_some()
&& self.read_member(i, chunk_idx * c + within, buf).is_ok()
{
return Ok(());
}
}
Err(io::Error::new(io::ErrorKind::Other, "nenhuma cópia legível"))
Err(io::Error::other("nenhuma cópia legível"))
}
Level::R4 | Level::R5 => {
let dd = n - 1;
@@ -322,7 +368,8 @@ impl RaidSource {
}
}
}
Err(last.unwrap_or_else(|| io::Error::new(io::ErrorKind::NotFound, "cópias ausentes")))
Err(last
.unwrap_or_else(|| io::Error::new(io::ErrorKind::NotFound, "cópias ausentes")))
}
}
}
@@ -338,7 +385,11 @@ impl RaidSource {
if self.p.far_offset {
stripe *= far;
}
let stride = if self.p.far_offset { c } else { (self.per_member / far) / c * c };
let stride = if self.p.far_offset {
c
} else {
(self.per_member / far) / c * c
};
let mut out = vec![];
let mut d = dev;
let mut off = stripe * c;
@@ -367,7 +418,9 @@ impl RaidSource {
let len = buf.len();
// Estado de cada dado da linha.
let disks: Vec<usize> = (0..dd).map(|k| self.raid6_map(row, k).2).collect();
let missing_data: Vec<usize> = (0..dd).filter(|&k| self.p.members[disks[k]].is_none()).collect();
let missing_data: Vec<usize> = (0..dd)
.filter(|&k| self.p.members[disks[k]].is_none())
.collect();
let p_ok = self.p.members[pd].is_some();
let q_ok = self.p.members[qd].is_some();
let mut data: Vec<Option<Vec<u8>>> = vec![None; dd];
@@ -437,7 +490,9 @@ impl RaidSource {
}
return Ok(());
}
Err(io::Error::new(io::ErrorKind::Other, "RAID 6 sem redundância suficiente nesta linha"))
Err(io::Error::other(
"RAID 6 sem redundância suficiente nesta linha",
))
}
}
@@ -467,7 +522,9 @@ impl Source for RaidSource {
if offset + done as u64 >= base && offset + (done as u64) < base + len {
let rel = offset + done as u64 - base;
let n = ((len - rel) as usize).min(want - done);
let got = m.src.read_at(m.data_offset + rel, &mut buf[done..done + n])?;
let got = m
.src
.read_at(m.data_offset + rel, &mut buf[done..done + n])?;
if got == 0 {
break;
}
@@ -541,7 +598,9 @@ pub fn read_md_super(src: &dyn Source) -> Option<MdSuper> {
cands.push(((size & !4095) - 8192, "1.0"));
}
for (off, ver) in cands {
let Ok(b) = read_vec(src, off, 4096) else { continue };
let Ok(b) = read_vec(src, off, 4096) else {
continue;
};
if b.len() < 4096 || le32(&b, 0) != 0xA92B_4EFC || le32(&b, 4) != 1 {
continue;
}
@@ -556,7 +615,9 @@ pub fn read_md_super(src: &dyn Source) -> Option<MdSuper> {
};
let mut uuid = [0u8; 16];
uuid.copy_from_slice(&b[16..32]);
let name = String::from_utf8_lossy(&b[32..64]).trim_end_matches('\0').to_string();
let name = String::from_utf8_lossy(&b[32..64])
.trim_end_matches('\0')
.to_string();
let data_offset = le64(&b, 128) * 512;
let data_size = le64(&b, 136) * 512;
let raid_disks = le32(&b, 92);
@@ -661,12 +722,20 @@ pub fn assemble_md(members: Vec<(Arc<dyn Source>, MdSuper)>) -> Vec<Result<Found
stale += 1;
continue;
}
slots[r as usize] = Some(Member { src: s.clone(), data_offset: m.data_offset });
slots[r as usize] = Some(Member {
src: s.clone(),
data_offset: m.data_offset,
});
}
}
}
let missing = slots.iter().filter(|s| s.is_none()).count();
let mut p = RaidParams::simple(top.level, top.chunk.max(512), Layout::from_md(top.layout), slots);
let mut p = RaidParams::simple(
top.level,
top.chunk.max(512),
Layout::from_md(top.layout),
slots,
);
if top.level == Level::R10 {
p.near = top.layout & 0xff;
p.far = (top.layout >> 8) & 0xff;
+71 -16
View File
@@ -23,13 +23,23 @@ impl Candidate {
self.level,
self.chunk,
self.layout,
self.order.iter().map(|&i| Some(Member { src: members[i].clone(), data_offset: 0 })).collect(),
self.order
.iter()
.map(|&i| {
Some(Member {
src: members[i].clone(),
data_offset: 0,
})
})
.collect(),
)
}
}
const PREFIX: u64 = 24 << 20;
const CHUNKS: [u64; 9] = [4096, 8192, 16384, 32768, 65536, 131072, 262144, 524288, 1048576];
const CHUNKS: [u64; 9] = [
4096, 8192, 16384, 32768, 65536, 131072, 262144, 524288, 1048576,
];
fn permutations(n: usize) -> Vec<Vec<usize>> {
fn rec(cur: &mut Vec<usize>, used: &mut Vec<bool>, n: usize, out: &mut Vec<Vec<usize>>) {
@@ -53,7 +63,9 @@ fn permutations(n: usize) -> Vec<Vec<usize>> {
}
fn ntfs_score(src: &dyn Source, start: u64) -> f64 {
let Ok(b) = read_vec(src, start, 512) else { return 0.0 };
let Ok(b) = read_vec(src, start, 512) else {
return 0.0;
};
if b.len() < 512 || &b[3..11] != b"NTFS " {
return 0.0;
}
@@ -61,18 +73,26 @@ fn ntfs_score(src: &dyn Source, start: u64) -> f64 {
let spc = b[13] as u64;
let mft = u64::from_le_bytes(b[0x30..0x38].try_into().unwrap());
let rs = b[0x40] as i8;
let rec = if rs > 0 { rs as u64 * bps * spc } else { 1u64 << (-rs) };
let rec = if rs > 0 {
rs as u64 * bps * spc
} else {
1u64 << (-rs)
};
if bps == 0 || spc == 0 || rec == 0 || rec > 65536 {
return 0.0;
}
let mft_off = start + mft * bps * spc;
let (mut ok, mut total) = (0, 0);
for k in [0u64, 1, 2, 3, 5, 11, 16, 24, 40, 100, 250, 600, 1500, 3000, 6000, 12000, 24000, 50000] {
for k in [
0u64, 1, 2, 3, 5, 11, 16, 24, 40, 100, 250, 600, 1500, 3000, 6000, 12000, 24000, 50000,
] {
let off = mft_off + k * rec;
if off + rec > src.size() {
break;
}
let Ok(r) = read_vec(src, off, 64) else { continue };
let Ok(r) = read_vec(src, off, 64) else {
continue;
};
if r.len() < 64 {
continue;
}
@@ -106,18 +126,25 @@ pub fn fs_score(src: &dyn Source) -> f64 {
let layout = partition::analyze(src, false);
let mut best = 0.0f64;
for p in &layout.partitions {
best = best.max(volume_score(src, p.start, p.fs) + if p.fs != FsKind::Unknown { 0.5 } else { 0.0 });
best = best.max(
volume_score(src, p.start, p.fs) + if p.fs != FsKind::Unknown { 0.5 } else { 0.0 },
);
}
best
}
fn first_sector_plausible(src: &dyn Source) -> bool {
let Ok(b) = read_vec(src, 0, 4096) else { return false };
let Ok(b) = read_vec(src, 0, 4096) else {
return false;
};
b.len() >= 1100 && ((b[510] == 0x55 && b[511] == 0xAA) || partition::detect_fs_in(&b).is_some())
}
/// Testa as combinações e devolve as melhores (maior pontuação primeiro).
pub fn detect(members: &[Arc<dyn Source>], cancelled: &(dyn Fn() -> bool + Sync)) -> Vec<Candidate> {
pub fn detect(
members: &[Arc<dyn Source>],
cancelled: &(dyn Fn() -> bool + Sync),
) -> Vec<Candidate> {
let n = members.len();
if n < 2 {
return vec![];
@@ -140,13 +167,22 @@ pub fn detect(members: &[Arc<dyn Source>], cancelled: &(dyn Fn() -> bool + Sync)
let probe = |s: &Arc<dyn Source>| read_vec(s.as_ref(), 0, 1 << 20).unwrap_or_default();
let first = probe(&cached[0]);
if first.iter().any(|&x| x != 0) && cached.iter().skip(1).all(|c| probe(c) == first) {
let c = Candidate { level: Level::R1, chunk: 65536, layout: Layout::LeftSymmetric, order: (0..n).collect(), score: fs_score(cached[0].as_ref()) + 1.0 };
let c = Candidate {
level: Level::R1,
chunk: 65536,
layout: Layout::LeftSymmetric,
order: (0..n).collect(),
score: fs_score(cached[0].as_ref()) + 1.0,
};
out.push(c);
}
// RAID 5/4 satisfaz "XOR de todos os discos = 0" em toda faixa.
let sample = 4usize << 20;
let bufs: Vec<Vec<u8>> = cached.iter().map(|c| read_vec(c.as_ref(), 0, sample).unwrap_or_default()).collect();
let bufs: Vec<Vec<u8>> = cached
.iter()
.map(|c| read_vec(c.as_ref(), 0, sample).unwrap_or_default())
.collect();
let mut xor_zero = 0usize;
let mut nonzero_rows = 0usize;
for blk in 0..sample / 4096 {
@@ -181,20 +217,35 @@ pub fn detect(members: &[Arc<dyn Source>], cancelled: &(dyn Fn() -> bool + Sync)
levels.push(Level::R6);
}
}
let ok_first: Vec<bool> = cached.iter().map(|c| first_sector_plausible(c.as_ref())).collect();
let ok_first: Vec<bool> = cached
.iter()
.map(|c| first_sector_plausible(c.as_ref()))
.collect();
let any_first = ok_first.iter().any(|&b| b);
let perms = permutations(n);
for level in levels {
let layouts: Vec<Layout> = if matches!(level, Level::R0) { vec![Layout::LeftSymmetric] } else { Layout::all_raid5().to_vec() };
let layouts: Vec<Layout> = if matches!(level, Level::R0) {
vec![Layout::LeftSymmetric]
} else {
Layout::all_raid5().to_vec()
};
for &chunk in &CHUNKS {
for layout in &layouts {
for order in &perms {
if cancelled() {
return finish(out);
}
let cand = Candidate { level, chunk, layout: *layout, order: order.clone(), score: 0.0 };
let cand = Candidate {
level,
chunk,
layout: *layout,
order: order.clone(),
score: 0.0,
};
let params = cand.params(&cached);
let Ok(r) = RaidSource::new(params) else { continue };
let Ok(r) = RaidSource::new(params) else {
continue;
};
// O primeiro setor do volume precisa estar num disco que o tenha.
if any_first {
let mut b = [0u8; 512];
@@ -221,7 +272,11 @@ pub fn detect(members: &[Arc<dyn Source>], cancelled: &(dyn Fn() -> bool + Sync)
}
fn finish(mut out: Vec<Candidate>) -> Vec<Candidate> {
out.sort_by(|a, b| b.score.partial_cmp(&a.score).unwrap_or(std::cmp::Ordering::Equal));
out.sort_by(|a, b| {
b.score
.partial_cmp(&a.score)
.unwrap_or(std::cmp::Ordering::Equal)
});
out.truncate(10);
out
}
+38 -10
View File
@@ -274,8 +274,12 @@ impl Handler<'_> {
refs.push(c);
}
}
let Some(r) = crate::mp4rebuild::rebuild(self.src, off, p.hit_len, &refs) else { return };
let Ok(pre) = crate::source::read_vec(self.src, off, r.pre_len as usize) else { return };
let Some(r) = crate::mp4rebuild::rebuild(self.src, off, p.hit_len, &refs) else {
return;
};
let Ok(pre) = crate::source::read_vec(self.src, off, r.pre_len as usize) else {
return;
};
let payload_len = r.payload.1 - r.payload.0;
let mut f = p.found;
let hdr = r.mdat_header();
@@ -284,7 +288,10 @@ impl Handler<'_> {
parts: vec![
Part::Bytes { bytes: pre },
Part::Bytes { bytes: hdr },
Part::Run { offset: r.payload.0, len: payload_len },
Part::Run {
offset: r.payload.0,
len: payload_len,
},
Part::Bytes { bytes: r.moov },
],
};
@@ -311,13 +318,23 @@ impl Handler<'_> {
used.extend(self.carved.iter().copied());
// O próprio começo do arquivo não conta como "ocupado" para ele mesmo.
used.retain(|e| !(e.offset == off));
let pool = crate::defrag::Pool { index: &self.index, used: &used };
if let crate::defrag::Analysis::Rebuilt { extents, size } = crate::defrag::analyze_jpeg(self.src, off, p.hit_len, &pool, true) {
let pool = crate::defrag::Pool {
index: &self.index,
used: &used,
};
if let crate::defrag::Analysis::Rebuilt { extents, size } =
crate::defrag::analyze_jpeg(self.src, off, p.hit_len, &pool, true)
{
let mut f = p.found;
f.size = size;
f.data = DataLoc::Extents { extents: extents.clone() };
f.data = DataLoc::Extents {
extents: extents.clone(),
};
f.confidence = Confidence::Medium;
f.note = Some(format!("remontado a partir de {} fragmentos separados no disco; confira a imagem", extents.len()));
f.note = Some(format!(
"remontado a partir de {} fragmentos separados no disco; confira a imagem",
extents.len()
));
self.carved.extend(extents);
self.sink.replace(f);
}
@@ -354,7 +371,10 @@ impl CarveEvents for Handler<'_> {
let mut skip_len = None;
let mut pending_len = None;
if hit.ext == "jpg" {
let pool = crate::defrag::Pool { index: &self.index, used: &[] };
let pool = crate::defrag::Pool {
index: &self.index,
used: &[],
};
match crate::defrag::analyze_jpeg(self.src, off, hit.len, &pool, false) {
crate::defrag::Analysis::Intact { len } => {
hit.len = len;
@@ -412,8 +432,16 @@ impl CarveEvents for Handler<'_> {
self.carved.push(Extent::new(off, hit.len));
if let Some(hl) = pending_len {
let mut pf = f.clone();
pf.note = Some(if pending_mp4 { "vídeo sem índice (moov)".into() } else { "JPEG interrompido ou fragmentado".into() });
self.pending.push(Pending { found: pf, hit_len: hl, mp4: pending_mp4 });
pf.note = Some(if pending_mp4 {
"vídeo sem índice (moov)".into()
} else {
"JPEG interrompido ou fragmentado".into()
});
self.pending.push(Pending {
found: pf,
hit_len: hl,
mp4: pending_mp4,
});
}
self.sink.found(f);
match skip_len {
+36 -9
View File
@@ -225,14 +225,25 @@ impl Engine {
if opts.assembly.remember_keys {
opts.assembly.keys = asm.keys.clone();
}
let job = self.register(JobKind::Scan, path.to_string(), opts, Some(asm.source.clone()));
let job = self.register(
JobKind::Scan,
path.to_string(),
opts,
Some(asm.source.clone()),
);
{
let mut s = job.st.lock().unwrap();
for u in &asm.unlocked {
s.warnings.push(format!("Volume cifrado aberto na posição {}: {}.", u.start, u.description));
s.warnings.push(format!(
"Volume cifrado aberto na posição {}: {}.",
u.start, u.description
));
}
for l in &asm.locked {
s.warnings.push(format!("Volume cifrado na posição {} não foi aberto: {}.", l.start, l.reason));
s.warnings.push(format!(
"Volume cifrado na posição {} não foi aberto: {}.",
l.start, l.reason
));
}
s.warnings.extend(asm.notes.iter().cloned());
}
@@ -552,7 +563,12 @@ impl Engine {
}
/// Cria a imagem em bruto ou em outro formato forense (E01 ou AFF4).
pub fn start_image_as(&self, path: &str, dest: &str, format: &image::ImageFormat) -> Result<String> {
pub fn start_image_as(
&self,
path: &str,
dest: &str,
format: &image::ImageFormat,
) -> Result<String> {
let format = format.clone();
let src = open_path(Path::new(path)).map_err(|e| open_error(path, e))?;
recover::check_destination(
@@ -848,8 +864,14 @@ impl Engine {
let mut last_err = None;
for path in &tried {
match open_path(Path::new(path)) {
Ok(src) if crate::reconnect::matches(src.as_ref(), if j.opts.assembly.is_plain() { size } else { 0 }, fp.as_deref()) => {
*j.src.lock().unwrap() = Some(finish_source(&j, src));
Ok(src)
if crate::reconnect::matches(
src.as_ref(),
if j.opts.assembly.is_plain() { size } else { 0 },
fp.as_deref(),
) =>
{
*j.src.lock().unwrap() = Some(finish_source(j, src));
*j.src_path.lock().unwrap() = path.clone();
return Ok(None);
}
@@ -860,7 +882,7 @@ impl Engine {
if let Some((path, src)) =
crate::reconnect::find_matching_source(size, fp.as_deref(), &tried)
{
*j.src.lock().unwrap() = Some(finish_source(&j, src));
*j.src.lock().unwrap() = Some(finish_source(j, src));
*j.src_path.lock().unwrap() = path.clone();
return Ok(Some(path));
}
@@ -1019,10 +1041,15 @@ impl Engine {
}
layout.warnings.extend(a.notes.iter().cloned());
for u in &a.unlocked {
layout.warnings.push(format!("Volume aberto em {}: {}.", u.start, u.description));
layout
.warnings
.push(format!("Volume aberto em {}: {}.", u.start, u.description));
}
for l in &a.locked {
layout.warnings.push(format!("Volume cifrado em {} continua fechado: {}.", l.start, l.reason));
layout.warnings.push(format!(
"Volume cifrado em {} continua fechado: {}.",
l.start, l.reason
));
}
json!(layout)
}
+28 -22
View File
@@ -20,13 +20,19 @@ pub fn category_for_ext(ext: &str) -> Category {
"jpg" | "jpeg" | "png" | "gif" | "bmp" | "webp" | "heic" | "avif" | "tif" | "tiff"
| "psd" | "svg" | "ico" | "cr2" | "nef" | "dng" | "jp2" => Category::Image,
"pdf" | "doc" | "docx" | "xls" | "xlsx" | "ppt" | "pptx" | "odt" | "ods" | "odp"
| "txt" | "rtf" | "epub" | "md" | "csv" | "html" | "xml" | "json" | "swf" => Category::Document,
"mp4" | "mov" | "m4v" | "avi" | "mkv" | "webm" | "wmv" | "flv" | "mpg" | "mpeg" | "3gp" | "ts" => {
Category::Video
| "txt" | "rtf" | "epub" | "md" | "csv" | "html" | "xml" | "json" | "swf" => {
Category::Document
}
"mp4" | "mov" | "m4v" | "avi" | "mkv" | "webm" | "wmv" | "flv" | "mpg" | "mpeg" | "3gp"
| "ts" => Category::Video,
"mp3" | "wav" | "flac" | "ogg" | "m4a" | "aac" | "wma" | "opus" | "mid" | "aif" => {
Category::Audio
}
"zip" | "rar" | "7z" | "gz" | "tar" | "bz2" | "xz" | "jar" | "apk" | "zst" | "cab"
| "deb" => Category::Archive,
"sqlite" | "db" | "sqlite3" | "mdb" | "accdb" | "pst" | "dat" | "evtx" => {
Category::Database
}
"mp3" | "wav" | "flac" | "ogg" | "m4a" | "aac" | "wma" | "opus" | "mid" | "aif" => Category::Audio,
"zip" | "rar" | "7z" | "gz" | "tar" | "bz2" | "xz" | "jar" | "apk" | "zst" | "cab" | "deb" => Category::Archive,
"sqlite" | "db" | "sqlite3" | "mdb" | "accdb" | "pst" | "dat" | "evtx" => Category::Database,
_ => Category::Other,
}
}
@@ -85,22 +91,22 @@ pub fn matches_ext(ext: &str, head: &[u8]) -> Option<bool> {
pub fn might_start(b0: u8) -> bool {
crate::formats::might_start(b0)
|| matches!(
b0,
0xFF | 0x89
| b'G'
| b'B'
| b'%'
| b'P'
| 0xD0
| b'7'
| b'S'
| b'R'
| b'I'
| b'M'
| 0x00
| b'f'
| 0x1F
)
b0,
0xFF | 0x89
| b'G'
| b'B'
| b'%'
| b'P'
| 0xD0
| b'7'
| b'S'
| b'R'
| b'I'
| b'M'
| 0x00
| b'f'
| 0x1F
)
}
const MAX_HEADER: usize = 64 * 1024;
+4 -2
View File
@@ -277,11 +277,13 @@ pub fn open_path(path: &Path) -> io::Result<Arc<dyn Source>> {
let mut head = [0u8; 96];
let got = file.read_at(0, &mut head).unwrap_or(0);
if got >= 4 && head.starts_with(b"PK") && crate::aff4::is_aff4(&head[..got]) {
let a = crate::aff4::Aff4Source::open(path).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))?;
let a = crate::aff4::Aff4Source::open(path)
.map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))?;
return Ok(Arc::new(a));
}
if got >= 8 && crate::ewf::is_ewf_header(&head) {
let e = crate::ewf::EwfSource::open(path).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))?;
let e = crate::ewf::EwfSource::open(path)
.map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))?;
return Ok(Arc::new(e));
}
Ok(Arc::new(file))
+39 -8
View File
@@ -154,19 +154,30 @@ impl Packed {
pub fn read(&self, src: &dyn crate::source::Source) -> std::io::Result<Vec<u8>> {
use std::io::Read;
let raw = crate::source::read_vec(src, self.offset, self.disk_len as usize)?;
let bad = |m: &str| std::io::Error::new(std::io::ErrorKind::InvalidData, format!("extensão comprimida ilegível ({m})"));
let bad = |m: &str| {
std::io::Error::new(
std::io::ErrorKind::InvalidData,
format!("extensão comprimida ilegível ({m})"),
)
};
let mut data = match self.codec {
PackedCodec::Zlib => {
let mut v = Vec::with_capacity(self.ram_len as usize);
flate2::read::ZlibDecoder::new(&raw[..]).read_to_end(&mut v).map_err(|_| bad("zlib"))?;
flate2::read::ZlibDecoder::new(&raw[..])
.read_to_end(&mut v)
.map_err(|_| bad("zlib"))?;
v
}
PackedCodec::Zstd => {
let mut v = Vec::with_capacity(self.ram_len as usize);
ruzstd::StreamingDecoder::new(&raw[..]).map_err(|_| bad("zstd"))?.read_to_end(&mut v).map_err(|_| bad("zstd"))?;
ruzstd::StreamingDecoder::new(&raw[..])
.map_err(|_| bad("zstd"))?
.read_to_end(&mut v)
.map_err(|_| bad("zstd"))?;
v
}
PackedCodec::Lzo => crate::fs::btrfs::lzo_btrfs(&raw, self.ram_len as usize).ok_or_else(|| bad("lzo"))?,
PackedCodec::Lzo => crate::fs::btrfs::lzo_btrfs(&raw, self.ram_len as usize)
.ok_or_else(|| bad("lzo"))?,
};
data.resize(self.ram_len.max(data.len() as u64) as usize, 0);
let s = (self.skip as usize).min(data.len());
@@ -193,14 +204,25 @@ impl Part {
mod b64 {
use serde::{Deserialize, Deserializer, Serializer};
const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
#[allow(clippy::ptr_arg)]
pub fn serialize<S: Serializer>(b: &Vec<u8>, s: S) -> Result<S::Ok, S::Error> {
let mut out = String::with_capacity(b.len().div_ceil(3) * 4);
for c in b.chunks(3) {
let n = (c[0] as u32) << 16 | (*c.get(1).unwrap_or(&0) as u32) << 8 | *c.get(2).unwrap_or(&0) as u32;
let n = (c[0] as u32) << 16
| (*c.get(1).unwrap_or(&0) as u32) << 8
| *c.get(2).unwrap_or(&0) as u32;
out.push(T[(n >> 18) as usize & 63] as char);
out.push(T[(n >> 12) as usize & 63] as char);
out.push(if c.len() > 1 { T[(n >> 6) as usize & 63] as char } else { '=' });
out.push(if c.len() > 2 { T[n as usize & 63] as char } else { '=' });
out.push(if c.len() > 1 {
T[(n >> 6) as usize & 63] as char
} else {
'='
});
out.push(if c.len() > 2 {
T[n as usize & 63] as char
} else {
'='
});
}
s.serialize_str(&out)
}
@@ -386,7 +408,16 @@ impl FsKind {
pub fn has_metadata_scanner(self) -> bool {
matches!(
self,
FsKind::Ntfs | FsKind::Fat12 | FsKind::Fat16 | FsKind::Fat32 | FsKind::Exfat | FsKind::Ext | FsKind::HfsPlus | FsKind::Btrfs | FsKind::Xfs | FsKind::Apfs
FsKind::Ntfs
| FsKind::Fat12
| FsKind::Fat16
| FsKind::Fat32
| FsKind::Exfat
| FsKind::Ext
| FsKind::HfsPlus
| FsKind::Btrfs
| FsKind::Xfs
| FsKind::Apfs
)
}
}
+11 -2
View File
@@ -25,8 +25,17 @@ pub struct Overlay {
impl Overlay {
pub fn new(base: Arc<dyn Source>, mut regions: Vec<Region>) -> Self {
regions.sort_by_key(|r| r.start);
let size = regions.iter().map(|r| r.start + r.len).max().unwrap_or(0).max(base.size());
Self { base, regions, size }
let size = regions
.iter()
.map(|r| r.start + r.len)
.max()
.unwrap_or(0)
.max(base.size());
Self {
base,
regions,
size,
}
}
pub fn regions(&self) -> &[Region] {
&self.regions