summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2013-11-01 12:08:26 +0100
committerChristophe Grenier <grenier@cgsecurity.org>2013-11-01 12:08:26 +0100
commitb26e8bc1618a31e9afd1d15b25cb8e766ab8e026 (patch)
tree1b6e5c28ed28df0071af9f199509863042730c80 /src
parent159a0fa750ce874073a8ad9a46abd3ae8ed33897 (diff)
src/file_evt.c: rewrote to use a data structure
Diffstat (limited to 'src')
-rw-r--r--src/file_evt.c35
1 files changed, 18 insertions, 17 deletions
diff --git a/src/file_evt.c b/src/file_evt.c
index 82f6f41..a3812ca 100644
--- a/src/file_evt.c
+++ b/src/file_evt.c
@@ -46,25 +46,20 @@ const file_hint_t file_hint_evt= {
.register_header_check=&register_header_check_evt
};
-static const unsigned char evt_header[8]= {0x30, 0x00, 0x00, 0x00, 'L', 'f', 'L', 'e'};
-
-static void register_header_check_evt(file_stat_t *file_stat)
-{
- register_header_check(0, evt_header,sizeof(evt_header), &header_check_evt, file_stat);
-}
+struct evt_chunk {
+ uint32_t size;
+ uint32_t id;
+} __attribute__ ((__packed__));
static int header_check_evt(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
- if(memcmp(buffer,evt_header,sizeof(evt_header))==0)
- {
- reset_file_recovery(file_recovery_new);
- file_recovery_new->calculated_file_size=buffer[0] + (buffer[1]<<8) + (buffer[2]<<16) + (buffer[3]<<24);
- file_recovery_new->data_check=&data_check_evt;
- file_recovery_new->file_check=&file_check_size;
- file_recovery_new->extension=file_hint_evt.extension;
- return 1;
- }
- return 0;
+ const struct evt_chunk *chunk=(const struct evt_chunk *)buffer;
+ reset_file_recovery(file_recovery_new);
+ file_recovery_new->calculated_file_size=le32(chunk->size);
+ file_recovery_new->data_check=&data_check_evt;
+ file_recovery_new->file_check=&file_check_size;
+ file_recovery_new->extension=file_hint_evt.extension;
+ return 1;
}
static int data_check_evt(const unsigned char *buffer, const unsigned int buffer_size, file_recovery_t *file_recovery)
@@ -73,13 +68,14 @@ static int data_check_evt(const unsigned char *buffer, const unsigned int buffer
file_recovery->calculated_file_size + 8 < file_recovery->file_size + buffer_size/2)
{
const unsigned int i=file_recovery->calculated_file_size - file_recovery->file_size + buffer_size/2;
+ const struct evt_chunk *chunk=(const struct evt_chunk *)&buffer[i];
if((buffer[i+4]=='L' && buffer[i+5]=='f' && buffer[i+6]=='L' && buffer[i+7]=='e') ||
(buffer[i+4]==0x11 && buffer[i+5]==0x11 && buffer[i+6]==0x11 && buffer[i+7]==0x11) ||
(buffer[i+4]==0x22 && buffer[i+5]==0x22 && buffer[i+6]==0x22 && buffer[i+7]==0x22) ||
(buffer[i+4]==0x33 && buffer[i+5]==0x33 && buffer[i+6]==0x33 && buffer[i+7]==0x33) ||
(buffer[i+4]==0x44 && buffer[i+5]==0x44 && buffer[i+6]==0x44 && buffer[i+7]==0x44))
{
- const unsigned int length=(buffer[i+0] + (buffer[i+1]<<8) + (buffer[i+2]<<16) + (buffer[i+3]<<24));
+ const unsigned int length=le32(chunk->size);
if(length<8)
{
return 2;
@@ -97,3 +93,8 @@ static int data_check_evt(const unsigned char *buffer, const unsigned int buffer
return 1;
}
+static void register_header_check_evt(file_stat_t *file_stat)
+{
+ static const unsigned char evt_header[8]= {0x30, 0x00, 0x00, 0x00, 'L', 'f', 'L', 'e'};
+ register_header_check(0, evt_header,sizeof(evt_header), &header_check_evt, file_stat);
+}