GUIDingForensics/guiding.cpp at master · shujianyang/GUIDingForensics · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
/** \file read_guid.cpp
  * Main function.
  */

#include <iostream>
#include <fstream>
#include <iomanip>
#include <string>
#include <unistd.h>
#include <tsk/libtsk.h>
#include <unistd.h>
#include "guid.h"

using namespace std;

int main(int argc, char *argv[])
{
    TSK_OFF_T imgOffset(0);
    int option;
    while((option = getopt(argc, argv, "o:")) != -1){
        switch(option){
            case 'o':
                if( (imgOffset = tsk_parse_offset(optarg)) == -1){
                    tsk_error_print(stderr);
                    exit(1);
                }
                break;
            case '?':
            default:
                cerr << "Unkown arguments." << endl;
        }
    }

    if(optind >= argc) {
        cerr << "Please provide the image name" << endl;
        exit(1);
    }

    string img_name(argv[optind]);


    TSK_IMG_INFO *img = tsk_img_open(1, &argv[optind], TSK_IMG_TYPE_DETECT, 0);
    if(img == NULL){
        tsk_error_print(stderr);
        cerr << "Cannot open image " << img_name << "." << endl;
        exit(1);
    }

    if( imgOffset * img->sector_size >= img->size){
        cerr << "Offset is too large." << endl;
        exit(1);
    }

    TSK_VS_INFO *vs = tsk_vs_open(img, imgOffset*img->sector_size, TSK_VS_TYPE_GPT);
    if( vs == NULL){
        tsk_error_print(stderr);
        cerr << "The partition type of the image is not GPT." << endl;
        exit(1);
    }


    char diskArr[GUID::BYTES_OF_GUID];
    tsk_img_read(img, 0x238, diskArr, GUID::BYTES_OF_GUID);
    GUID diskGUID(vs->endian, (uint8_t*)diskArr);

    cout << "[Disk GUID] " << diskGUID.encode() << endl;

    cout << "[Variant] " << diskGUID.variantInfo()
        << setw(11) << "[Version] " << diskGUID.versionInfo()
        << "\n" << endl;

    cout << "Partition List:" << endl;

    const TSK_VS_PART_INFO * partition = tsk_vs_part_get(vs, 3);

    int emptyEntries = 0;

    for(TSK_OFF_T count = 0; count < 128; ++count){
        char byteArr[GUID::BYTES_OF_GUID];
        tsk_vs_part_read(partition, count * 128, byteArr, GUID::BYTES_OF_GUID);

        GUID typeGUID(vs->endian, (uint8_t*)byteArr);

        if(!typeGUID.isUnused()){
            cout << setw(3) << count;
            if(emptyEntries > 0){
                cout << string(16, '-') << emptyEntries
                    << " Unused Entries" << string(10, '-') << endl;
                emptyEntries = 0;
            }
            cout << setw(20) << "[Type GUID] "
                << typeGUID.encode() << "  "
                << typeGUID. guidType() << endl;

            cout << setw(23) << "[Variant] " << typeGUID.variantInfo()
                << setw(15) << "[Version] " << typeGUID.versionInfo()
                << endl;

            tsk_vs_part_read(partition, count * 128 + 16, byteArr, GUID::BYTES_OF_GUID);
            GUID partGUID(vs->endian, (uint8_t*)byteArr);
            cout << setw(23) << "[Partition GUID] "
                << partGUID.encode() <<  endl;

            cout << setw(23) << "[Variant] " << partGUID.variantInfo()
                << setw(15) << "[Version] " << partGUID.versionInfo()
                << "\n" << endl;
        }
        else
            emptyEntries++;
    }
    if(emptyEntries > 0)
        cout << string(16, '-') << emptyEntries
            << " Unused GPT Entries" << string(16, '-') << endl;


    tsk_vs_close(vs);
    tsk_img_close(img);


    return 0;
}