summaryrefslogtreecommitdiffstats
path: root/src/file_qbb.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2016-02-21 10:25:42 +0100
committerChristophe Grenier <grenier@cgsecurity.org>2016-02-21 10:25:42 +0100
commit638bf26c387c86b91c8539237b510146a89a5bd7 (patch)
tree1b0fc736e7d9601d6f7431de7ee6a53fc1142540 /src/file_qbb.c
parentf68cd0f314d2cb650d10cc5e53e9cae19eb74980 (diff)
PhotoRec: Set the correct filesize for Quickbooks .qbb
Recover .qbmb variant Extract the document name from the header
Diffstat (limited to 'src/file_qbb.c')
-rw-r--r--src/file_qbb.c102
1 files changed, 84 insertions, 18 deletions
diff --git a/src/file_qbb.c b/src/file_qbb.c
index e29397f..076b6ae 100644
--- a/src/file_qbb.c
+++ b/src/file_qbb.c
@@ -29,7 +29,10 @@
#include <stdio.h>
#include "types.h"
#include "filegen.h"
-
+#include "common.h"
+#ifdef DEBUG_QBB
+#include "log.h"
+#endif
static void register_header_check_qbb(file_stat_t *file_stat);
@@ -42,30 +45,91 @@ const file_hint_t file_hint_qbb= {
.register_header_check=&register_header_check_qbb
};
-static data_check_t data_check_qbb(const unsigned char *buffer, const unsigned int buffer_size, file_recovery_t *file_recovery)
+struct qbb_header
{
- if(file_recovery->file_size + buffer_size / 2 > file_recovery->calculated_file_size+512)
- {
- return DC_STOP;
- }
- return DC_CONTINUE;
-}
+ uint16_t magic;
+ uint16_t type;
+ uint16_t data_len;
+ uint16_t unk1;
+ unsigned char data[0];
+} __attribute__ ((gcc_struct, __packed__));
+
+struct qbb_header02
+{
+ uint16_t magic;
+ uint16_t type; /* 2 */
+ uint16_t data_len;
+ uint16_t unk1;
+ uint8_t unk2[6];
+ uint32_t size;
+ uint8_t unk3[10];
+ uint16_t title_len;
+ uint8_t title[0];
+} __attribute__ ((gcc_struct, __packed__));
-static void file_check_qbb(file_recovery_t *file_recovery)
+static void file_rename_qbb(file_recovery_t *file_recovery)
{
- if(file_recovery->file_size < file_recovery->calculated_file_size)
- file_recovery->file_size=0;
+ FILE *file;
+ unsigned int i=0;
+ unsigned char buffer[4096];
+ size_t lu;
+ if((file=fopen(file_recovery->filename, "rb"))==NULL)
+ return;
+ lu=fread(&buffer, 1, sizeof(buffer), file);
+ fclose(file);
+ while(i+sizeof(struct qbb_header02) < lu)
+ {
+ const struct qbb_header *hdr=(const struct qbb_header*)&buffer[i];
+ if(le16(hdr->magic)!=0x8645)
+ return ;
+ if(le16(hdr->type)==2)
+ {
+ const struct qbb_header02 *hdr2=(const struct qbb_header02 *)hdr;
+ if(sizeof(struct qbb_header02)+le16(hdr2->title_len) <= sizeof(struct qbb_header)+le16(hdr2->data_len) &&
+ i+sizeof(struct qbb_header)+le16(hdr->data_len) < lu)
+ file_rename(file_recovery, hdr2->title, le16(hdr2->title_len), 0, NULL, 1);
+ return ;
+ }
+ i+=sizeof(struct qbb_header)+le16(hdr->data_len);
+ }
}
static int header_check_qbb(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
+ const struct qbb_header *hdr0=(const struct qbb_header*)buffer;
+ uint64_t data_size=0;
+ unsigned int i=0;
+ if(buffer[0x0e]!=0x45 || buffer[0x0f]!=0x86)
+ return 0;
+ while(i+sizeof(struct qbb_header02) < buffer_size)
+ {
+ const struct qbb_header *hdr=(const struct qbb_header*)&buffer[i];
+ if(le16(hdr->magic)!=0x8645)
+ break;
+ if(le16(hdr->type)==2)
+ {
+ const struct qbb_header02 *hdr2=(const struct qbb_header02 *)hdr;
+ data_size=le32(hdr2->size);
+ }
+#ifdef DEBUG_QBB
+ log_info("i=0x%x size=0x%lx len=0x%x\n", i, sizeof(struct qbb_header), le16(hdr->data_len));
+#endif
+ i+=sizeof(struct qbb_header)+le16(hdr->data_len);
+ }
+#ifdef DEBUG_QBB
+ log_info("i=0x%x data_size=0x%lx\n", i, (long unsigned)data_size);
+#endif
+ if(data_size==0)
+ return 0;
reset_file_recovery(file_recovery_new);
- /* The filesize is bigger */
- file_recovery_new->calculated_file_size=(uint64_t)buffer[0x37] + (((uint64_t)buffer[0x37+1])<<8)+
- (((uint64_t)buffer[0x37+2])<<16) + (((uint64_t)buffer[0x37+3])<<24);
- file_recovery_new->extension=file_hint_qbb.extension;
- file_recovery_new->data_check=&data_check_qbb;
- file_recovery_new->file_check=&file_check_qbb;
+ file_recovery_new->calculated_file_size=data_size+i;
+ if(le16(hdr0->unk1)==1)
+ file_recovery_new->extension="qbmb";
+ else
+ file_recovery_new->extension=file_hint_qbb.extension;
+ file_recovery_new->data_check=&data_check_size;
+ file_recovery_new->file_check=&file_check_size;
+ file_recovery_new->file_rename=&file_rename_qbb;
return 1;
}
@@ -98,10 +162,12 @@ static int header_check_qbw2(const unsigned char *buffer, const unsigned int buf
static void register_header_check_qbb(file_stat_t *file_stat)
{
- static const unsigned char qbb_header[10]= {0x45, 0x86, 0x00, 0x00, 0x06, 0x00, 0x02, 0x00, 0x01, 0x00};
+ static const unsigned char qbb_header[8]= {0x45, 0x86, 0x00, 0x00, 0x06, 0x00, 0x02, 0x00};
+ static const unsigned char qbmb_header[8]= {0x45, 0x86, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00};
static const unsigned char qbw2_header[4]= {0x5e, 0xba, 0x7a, 0xda};
static const unsigned char qbw_header[4]= {0x56, 0x00, 0x00, 0x00};
register_header_check(0, qbb_header,sizeof(qbb_header), &header_check_qbb, file_stat);
+ register_header_check(0, qbmb_header,sizeof(qbmb_header), &header_check_qbb, file_stat);
register_header_check(4, qbw_header,sizeof(qbw_header), &header_check_qbw, file_stat);
register_header_check(0x14, qbw2_header,sizeof(qbw2_header), &header_check_qbw2, file_stat);
}