hfs_attributes.hpp

Go to the documentation of this file.

// hfs_attributes.hpp -- HFS+ Attributes file walker (extended attributes
// stored in the attributes B-tree, special file #6).
//
// The Attributes file is a B-tree using the standard HFS+ B-tree format
// (same as Catalog and Extents Overflow). Each record has:
//
//   KEY:
//     __be16 keyLength
//     __be16 pad
//     __be32 fileID
//     __be32 startBlock     (= 0 for non-extent records)
//     __be16 attrNameLength (= number of UTF-16 code units, NOT bytes)
//     UTF-16BE attrName[attrNameLength]
//
//   BODY (3 record types):
//     kHFSPlusAttrInlineData (0x10):
//       __be32 recordType (= 0x10)
//       __be32 reserved[2]
//       __be32 attrSize  (in bytes)
//       attribute data[attrSize]
//
//     kHFSPlusAttrForkData (0x20):
//       __be32 recordType (= 0x20)
//       __be32 reserved
//       HFSPlusForkData theFork  (80 bytes)
//
//     kHFSPlusAttrExtents (0x30):
//       __be32 recordType (= 0x30)
//       __be32 reserved
//       HFSPlusExtentRecord extents  (8 ForkExtents, 64 bytes total)
//
// For decmpfs (type 3 = zlib in xattr) the data is ALMOST ALWAYS stored
// inline (the inline limit on HFS+ is large -- thousands of bytes).
// We support ONLY the Inline record type here. ForkData and Extents
// variants are rare for decmpfs and out of scope.
 
#pragma once
 
#include "hfs_format.hpp"
#include "hfs_btree.hpp"
#include "disk_reader.hpp"
 
#include <cstdint>
#include <string>
#include <vector>
 
namespace hfs {
 
constexpr uint32_t kHFSPlusAttrInlineData = 0x10;
constexpr uint32_t kHFSPlusAttrForkData   = 0x20;
constexpr uint32_t kHFSPlusAttrExtents    = 0x30;
 
// Find the inline data of an attribute named `attr_name` for the file
// with CNID `fileID`. The Attributes file content must be already
// loaded in `attributes_btree_buffer` (loaded lazily via read_fork_full
// like the Extents Overflow file).
//
// `attr_name` is the UTF-8 attribute name (e.g. "com.apple.decmpfs").
// Internally we convert it to UTF-16BE for matching against the key.
//
// Returns true and fills `out` with the attribute's bytes if found.
// Returns false if not found, if the record type is non-inline
// (ForkData / Extents -- not supported), or if the B-tree is malformed.
bool find_inline_attribute(const std::vector<unsigned char>& attributes_btree_buffer,
                            uint32_t fileID,
                            const std::string& attr_name,
                            std::vector<unsigned char>& out,
                            std::vector<std::string>& logs);
 
} // namespace hfs