summaryrefslogtreecommitdiffstats
path: root/src/file_qbb.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2010-04-27 08:17:12 +0200
committerChristophe Grenier <grenier@cgsecurity.org>2010-04-27 08:17:12 +0200
commita2a0cf9800700c7bbd5e4e22bee04c7c5824d4e2 (patch)
treecd7a482a3c62ec9a28630f10c9e8ff022e8c69e2 /src/file_qbb.c
parent983f0a6f8779fdfd6d320da8a3c797dc33f2bd9c (diff)
PhotoRec: add another signature for Quickbooks qbw
Diffstat (limited to 'src/file_qbb.c')
-rw-r--r--src/file_qbb.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/src/file_qbb.c b/src/file_qbb.c
index 3eb1000..6688b6b 100644
--- a/src/file_qbb.c
+++ b/src/file_qbb.c
@@ -48,11 +48,13 @@ const file_hint_t file_hint_qbb= {
static const unsigned char qbb_header[10]= {0x45, 0x86, 0x00, 0x00, 0x06, 0x00, 0x02, 0x00, 0x01, 0x00};
static const unsigned char qbw_header[4]= {0x56, 0x00, 0x00, 0x00};
+static const unsigned char qbw2_header[4]= {0x5e, 0xba, 0x7a, 0xda};
static void register_header_check_qbb(file_stat_t *file_stat)
{
register_header_check(0, qbb_header,sizeof(qbb_header), &header_check_qbb, file_stat);
register_header_check(4, qbw_header,sizeof(qbw_header), &header_check_qbb, file_stat);
+ register_header_check(0x14, qbw2_header,sizeof(qbw2_header), &header_check_qbb, file_stat);
}
static int header_check_qbb(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
@@ -72,13 +74,20 @@ static int header_check_qbb(const unsigned char *buffer, const unsigned int buff
buffer[0x60]=='M' && buffer[0x61]=='A' && buffer[0x62]=='U' && buffer[0x63]=='I')
{
reset_file_recovery(file_recovery_new);
+ file_recovery_new->extension="qbw";
file_recovery_new->calculated_file_size=(((uint64_t)buffer[0x34] + (((uint64_t)buffer[0x34+1])<<8)+
(((uint64_t)buffer[0x34+2])<<16) + (((uint64_t)buffer[0x34+3])<<24))+1)*1024;
- file_recovery_new->extension="qbw";
file_recovery_new->data_check=&data_check_size;
file_recovery_new->file_check=&file_check_size;
return 1;
}
+ if(memcmp(&buffer[0x14], qbw2_header, sizeof(qbw2_header))==0 &&
+ memcmp(&buffer[0x87A], "Sybase", 6)==0)
+ {
+ reset_file_recovery(file_recovery_new);
+ file_recovery_new->extension="qbw";
+ return 1;
+ }
return 0;
}