mercredi 15 avril 2009

disktype et afflib

J'ai découvert disktype, par Christoph Pfisterer, il y a quelques mois en dérivant sur le web à la recherche d'outils relié à l'informatique légale sous linux. J'étais à la recherche d'information sur libewf et je suis tombé sur une ­ "patch", créer par David Loveall, permetant d'utilise des images EWF avec disktype. J'ai donc voulu ajouter le support pour afflib à disktype.

Voici donc ma contribution:

---
+++ aff.c 2009-01-07 12:59:06.000000000 -0400
@@ -0,0 +1,128 @@
+/*
+ * aff.c
+ * Layered data source for AFF images via afflib.
+ * For use with disktype, Copyright (c) 2003 Christoph Pfisterer
+ *
+ * Copyright (c) 2008 Jean-Francois Gingras
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "global.h"
+
+#ifdef USE_AFFLIB
+#include // necessaire pour uint64_t
+#include
+
+/*
+ * types
+ */
+
+typedef struct aff_source {
+ SOURCE c;
+ AFFILE *a;
+} AFF_SOURCE;
+
+/*
+ * helper functions
+ */
+
+static SOURCE *init_aff_source(char * const filename);
+static int read_block_aff(SOURCE *s, u8 pos, void *buf);
+static void close_aff(SOURCE *s);
+
+/*
+ * aff analyzer
+ */
+
+void analyze_aff(char * const filename)
+{
+ SOURCE *s;
+
+ print_line(0, "--- %s", filename);
+
+ /* create and analyze wrapped source */
+ s = init_aff_source(filename);
+ analyze_source(s, 1);
+ close_source(s);
+}
+
+/*
+ * initialize the aff source
+ */
+
+static SOURCE *init_aff_source(char * const filename)
+{
+ AFF_SOURCE *src;
+
+ src = (AFF_SOURCE *)malloc(sizeof(AFF_SOURCE));
+ if (src == NULL)
+ bailout("Out of memory");
+ memset(src, 0, sizeof(AFF_SOURCE));
+
+ src->a = af_open(filename, O_RDONLY, 0);
+ if (src->a == NULL)
+ bailout("Can't open AFF file");
+
+ src->c.size_known = 1;
+
+ if( ( src->c.size = af_get_imagesize( src->a ) ) == 0 )
+ bailout("Unable to get media size of AFF file");
+ if( af_get_seg( src->a, AF_SECTORSIZE, ( unsigned long * ) &( src->c.blocksize ), 0, 0 ) != 0 )
+ bailout("Unable to get sector size of AFF file");
+
+ src->c.read_block = read_block_aff;
+ src->c.close = close_aff;
+
+ return (SOURCE *)src;
+}
+
+/*
+ * raw read
+ */
+
+static int read_block_aff(SOURCE *s, u8 pos, void *buf)
+{
+ AFF_SOURCE *as = (AFF_SOURCE *)s;
+
+ if( af_seek( as->a, pos, SEEK_SET ) != -1 )
+ {
+ if( af_read( as->a, buf, as->c.blocksize ) != -1 ) {
+ return 1;
+ }
+ }
+
+ return 0;
+}
+
+/*
+ * cleanup
+ */
+
+static void close_aff(SOURCE *s)
+{
+ AFF_SOURCE *as = (AFF_SOURCE *)s;
+
+ af_close(as->a);
+}
+
+#endif
+/* EOF */
--- main.c 2003-05-24 13:35:44.000000000 -0400
+++ main.c 2009-04-15 21:58:28.000000000 -0400
@@ -24,22 +24,31 @@
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/

#include "global.h"

+#ifdef USE_AFFLIB
+#include
+#include // af_identify_file_type()
+#endif
+
#ifdef USE_MACOS_TYPE
#include
#endif

/*
* local functions
*/

static void analyze_file(const char *filename);
static void print_kind(int filekind, u8 size, int size_known);
+
+#ifdef USE_AFFLIB
+void analyze_aff(char * const filename);
+#endif

#ifdef USE_MACOS_TYPE
static void show_macos_type(const char *filename);
#endif

/*
@@ -56,13 +65,23 @@
return 1;
}

/* loop over filenames */
print_line(0, "");
for (i = 1; i < argc; i++) {
- analyze_file(argv[i]);
+#ifdef USE_AFFLIB
+ if( af_identify_file_type( argv[i], 0 ) == 1 ) {
+ print_line(0, "AFF image");
+ analyze_aff( argv[i] );
+ }
+ else {
+#endif
+ analyze_file(argv[i]);
+#ifdef USE_AFFLIB
+ }
+#endif
print_line(0, "");
}

return 0;
}

--- Makefile 2006-01-12 13:55:16.000000000 -0400
+++ Makefile 2009-04-15 21:57:26.000000000 -0400
@@ -6,13 +6,13 @@
CC = gcc

OBJS = main.o lib.o \
buffer.o file.o cdaccess.o cdimage.o vpc.o compressed.o \
detect.o apple.o amiga.o atari.o dos.o cdrom.o \
linux.o unix.o beos.o archives.o \
- udf.o blank.o cloop.o
+ udf.o blank.o cloop.o aff.o

TARGET = disktype

CPPFLAGS = -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
CFLAGS = -Wall
LDFLAGS =
@@ -40,12 +40,19 @@
CC += -noixemul
CFLAGS += -m68020-60 -msmall-code
LDFLAGS += -m68020-60
endif
endif

+ifneq ($(AFFLIB),)
+ CPPFLAGS += -DUSE_AFFLIB
+ CFLAGS += -I/usr/local/include/afflib
+ LDFLAGS += -L/usr/local/lib
+ LIBS += -lafflib
+endif
+
# real making

all: $(TARGET)

$(TARGET): $(OBJS)
$(CC) $(LDFLAGS) -o $(TARGET) $(OBJS) $(LIBS)
--- Seedfile 2006-01-12 13:55:16.000000000 -0400
+++ Seedfile 2009-04-15 21:58:38.000000000 -0400
@@ -4,12 +4,12 @@

binary disktype {
source main.c lib.c
buffer.c file.c cdaccess.c cdimage.c vpc.c compressed.c
detect.c apple.c amiga.c atari.c dos.c cdrom.c
linux.c unix.c beos.c archives.c
- udf.c blank.c cloop.c;
+ udf.c blank.c cloop.c aff.c;

cflags "-D_LARGEFILE_SOURCE" "-D_FILE_OFFSET_BITS=64";
}

manpage disktype.1;

mardi 14 avril 2009

Introduction

Je pense que le titre du blogue en dit suffisamment. Quoi que, je n'ai pas su avant 1 an et demi que "computer forensic" se traduisait en "informatique légale"...

Je sais qu'il existe beaucoup de blogue sur le domaine, vous n'avez qu'à regarder la liste de ceux que je suis. Je ne connais aucun blogue francophone qui traite activement du sujet alors je me lance. Oh!, si vous connaissez des blogues francophone, donnez moi le ou les liens dans un commentaire.

Sur ce...