DragonFlyBSD Kernel Audit
DF-2956 / findentry.c
← back to finding ↓ download raw
/*
 * findentry.c — scan a raw FAT image for an 8.3 directory entry by its
 * 11-byte padded name and dump the first 32 bytes (MTime @ 22-23,
 * MDate @ 24-25, little-endian).
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main(int argc, char **argv)
{
	FILE *f;
	unsigned char buf[512], name[11];
	const char *nm;
	long off = 0;
	int i, found = 0;

	if (argc != 3) {
		fprintf(stderr, "usage: %s image 8.3name\n", argv[0]);
		return (2);
	}
	f = fopen(argv[1], "rb");
	if (f == NULL) {
		perror("fopen");
		return (2);
	}
	memset(name, ' ', 11);
	nm = argv[2];
	for (i = 0; i < 8 && nm[i] && nm[i] != '.'; i++)
		name[i] = nm[i];
	for (; i < 8; i++)
		name[i] = ' ';
	nm = strchr(argv[2], '.');
	if (nm != NULL) {
		nm++;
		for (i = 8; i < 11 && *nm; i++, nm++)
			name[i] = *nm;
	}
	while (fread(buf, 1, 512, f) == 512) {
		for (i = 0; i <= 512 - 32; i += 32) {
			if (buf[i] == name[0] && memcmp(&buf[i], name, 11) == 0) {
				int j;
				printf("entry %s at image offset %ld (0x%lx)\n",
				    argv[2], off + i, off + i);
				for (j = 0; j < 32; j++) {
					printf("%02x%s", buf[i + j],
					    (j % 8 == 7) ? "\n" : " ");
				}
				printf("MTime=0x%02x%02x MDate=0x%02x%02x "
				    "-> y=%d m=%d d=%d hh=%d mm=%d ss=%d\n",
				    buf[i + 23], buf[i + 22],
				    buf[i + 25], buf[i + 24],
				    1980 + ((buf[i + 25] << 1) | (buf[i + 24] >> 7)),
				    (buf[i + 24] >> 5) & 0x0f,
				    buf[i + 24] & 0x1f,
				    buf[i + 23] >> 3,
				    (buf[i + 23] << 3 | buf[i + 22] >> 5) & 0x3f,
				    (buf[i + 22] & 0x1f) * 2);
				found = 1;
			}
		}
		off += 512;
	}
	fclose(f);
	return (found ? 0 : 1);
}