hfs_attributes.cpp

Go to the documentation of this file.

// hfs_attributes.cpp -- HFS+ Attributes file walker.
 
#include "hfs_attributes.hpp"
 
#include <algorithm>
#include <cstring>
#include <sstream>
 
namespace hfs {
 
namespace {
 
// Build the UTF-16BE representation of a UTF-8 attribute name.
// HFS+ attr names are ASCII in practice (e.g. "com.apple.decmpfs"),
// so we don't bother with full UTF-8 decoding -- we just expand each
// ASCII byte to 2 bytes (00 + byte).
std::vector<unsigned char> utf8_to_utf16be_ascii(const std::string& s) {
    std::vector<unsigned char> out(s.size() * 2);
    for (size_t i = 0; i < s.size(); ++i) {
        out[i * 2 + 0] = 0;
        out[i * 2 + 1] = static_cast<unsigned char>(s[i]);
    }
    return out;
}
 
} // anonymous namespace
 
bool find_inline_attribute(const std::vector<unsigned char>& attributes_btree_buffer,
                            uint32_t fileID,
                            const std::string& attr_name,
                            std::vector<unsigned char>& out,
                            std::vector<std::string>& logs) {
    out.clear();
    if (attributes_btree_buffer.size() < 14) return false;
 
    // Step 1: parse the B-tree header (node 0)
    NodeDescriptor n0;
    if (!parse_node_descriptor(attributes_btree_buffer.data(), n0) ||
        n0.kind != kBTHeaderNode) {
        logs.push_back("HFS+ Attributes: node 0 is not a header node");
        return false;
    }
    HeaderRec hdr;
    if (!parse_header_rec(attributes_btree_buffer.data() + 14, hdr)) {
        logs.push_back("HFS+ Attributes: B-tree header parse failed");
        return false;
    }
 
    // Step 2: build the UTF-16BE search key (we only match by name + fileID;
    // attribute records may also have startBlock != 0 for extent
    // continuation records, but those are not Inline records)
    const auto target_name_utf16be = utf8_to_utf16be_ascii(attr_name);
 
    // Step 3: walk the tree looking for matching records
    auto node_reader = [&](uint32_t node_index,
                           std::vector<unsigned char>& nodebuf) -> bool {
        const uint64_t off = static_cast<uint64_t>(node_index) * hdr.nodeSize;
        if (off + hdr.nodeSize > attributes_btree_buffer.size()) return false;
        nodebuf.assign(attributes_btree_buffer.begin() + off,
                       attributes_btree_buffer.begin() + off + hdr.nodeSize);
        return true;
    };
 
    bool found = false;
    auto on_leaf = [&](const unsigned char* rec, uint16_t rec_len) -> bool {
        // Attribute KEY layout (after the 2-byte keyLength):
        //   __be16 pad
        //   __be32 fileID
        //   __be32 startBlock
        //   __be16 attrNameLength
        //   UTF-16BE attrName[attrNameLength]
        if (rec_len < 14) return true;
        const uint16_t keyLength = be16(rec + 0);
        if (keyLength < 12 || 2u + keyLength > rec_len) return true;
        // pad at +2
        const uint32_t rec_fileID    = be32(rec + 4);
        if (rec_fileID != fileID) return true;
        // startBlock at +8 (we want startBlock=0 for the primary record)
        const uint32_t rec_startBlock = be32(rec + 8);
        if (rec_startBlock != 0) return true;  // skip overflow records
        const uint16_t rec_nameLen = be16(rec + 12);
        if (rec_nameLen != target_name_utf16be.size() / 2) return true;
        // Compare UTF-16BE name byte-by-byte
        const size_t name_offset = 14;
        const size_t name_bytes = static_cast<size_t>(rec_nameLen) * 2;
        if (name_offset + name_bytes > 2u + keyLength) return true;
        if (std::memcmp(rec + name_offset, target_name_utf16be.data(),
                         name_bytes) != 0) return true;
 
        // Found a key match. Body starts AFTER the key, on a 2-byte
        // alignment boundary.
        const uint32_t key_total = 2u + keyLength;
        const uint32_t body_off = (key_total + 1u) & ~1u;
        if (body_off + 4 > rec_len) return true;
 
        const uint32_t recordType = be32(rec + body_off);
        if (recordType != kHFSPlusAttrInlineData) {
            // ForkData or Extents -- not supported here
            std::ostringstream m;
            m << "HFS+ Attributes: attribute '" << attr_name
              << "' on fileID " << fileID
              << " uses non-inline storage (recordType=0x"
              << std::hex << recordType << ") -- not supported";
            logs.push_back(m.str());
            return false;  // stop walk: this is the only record we expected
        }
 
        // Inline record body layout:
        //   __be32 recordType (= 0x10)        already read
        //   __be32 reserved[2]                 +4..+12
        //   __be32 attrSize                    +12
        //   attribute data[attrSize]           +16
        if (body_off + 16 > rec_len) return true;
        const uint32_t attrSize = be32(rec + body_off + 12);
        if (attrSize == 0) return false;
        if (body_off + 16 + attrSize > rec_len) {
            logs.push_back("HFS+ Attributes: inline data overruns record");
            return false;
        }
        out.assign(rec + body_off + 16, rec + body_off + 16 + attrSize);
        found = true;
        return false;  // stop walk -- we got what we wanted
    };
 
    std::vector<std::string> walk_logs;
    std::string walk_err;
    walk_btree(hdr, node_reader, on_leaf, walk_logs, walk_err);
    for (auto& l : walk_logs) logs.push_back(std::move(l));
    if (!walk_err.empty()) {
        logs.push_back("HFS+ Attributes walk: " + walk_err);
    }
    return found;
}
 
} // namespace hfs