signature_scanner.cpp

Go to the documentation of this file.

#include "signature_scanner.hpp"
#include "i18n.hpp"
 
#include <array>
#include <string>
 
namespace {
constexpr uint64_t MiB = 1024ull * 1024ull;
constexpr uint64_t GiB = 1024ull * 1024ull * 1024ull;
 
uint64_t adaptive_stride(uint64_t disk_size) {
    if (disk_size <= 64ull * GiB) return MiB;
    if (disk_size <= 512ull * GiB) return 4ull * MiB;
    if (disk_size <= 2ull * 1024ull * GiB) return 16ull * MiB;
    return 32ull * MiB;
}
 
bool is_ntfs(const std::array<unsigned char, 512>& b) {
    return std::string(reinterpret_cast<const char*>(b.data() + 3), 8) == "NTFS    ";
}
 
bool is_fat32(const std::array<unsigned char, 512>& b) {
    return std::string(reinterpret_cast<const char*>(b.data() + 82), 8) == "FAT32   ";
}
 
bool is_exfat(const std::array<unsigned char, 512>& b) {
    return std::string(reinterpret_cast<const char*>(b.data() + 3), 8) == "EXFAT   ";
}
 
bool looks_ext4(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 2> sig{};
    return reader.read_at(offset + 1024 + 56, sig.data(), sig.size()) && sig[0] == 0x53 && sig[1] == 0xEF;
}
 
bool looks_btrfs(DiskReader& reader, uint64_t offset) {
    std::array<char, 8> sig{};
    return reader.read_at(offset + 0x10040, sig.data(), sig.size()) && std::string(sig.data(), sig.size()) == "_BHRfS_M";
}
}
 
std::vector<ScanResult> SignatureScanner::scan(DiskReader& reader, std::vector<std::string>& logs) {
    std::vector<ScanResult> out;
    const uint64_t max_scan = reader.size() > 8 * GiB ? 8 * GiB : reader.size();
    const uint64_t stride = adaptive_stride(reader.size());
    logs.push_back(trs("Signature scan: starting filesystem signature scan."));
    logs.push_back(trs("Signature scan stride:") + std::string(" ") + std::to_string(stride / MiB) + " MiB");
 
    for (uint64_t offset = 0; offset + 4096 < max_scan; offset += stride) {
        std::array<unsigned char, 512> sector{};
        if (!reader.read_at(offset, sector.data(), sector.size())) {
            continue;
        }
        if (is_ntfs(sector)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "NTFS candidate", "Signature scan", trs("NTFS boot sector detected"), 0.80});
        }
        if (is_fat32(sector)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "FAT32 candidate", "Signature scan", trs("FAT32 boot sector detected"), 0.78});
        }
        if (is_exfat(sector)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "exFAT candidate", "Signature scan", trs("exFAT boot sector detected"), 0.82});
        }
        if (looks_ext4(reader, offset)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "ext4 candidate", "Signature scan", trs("ext4 superblock detected"), 0.76});
        }
        if (looks_btrfs(reader, offset)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "Btrfs candidate", "Signature scan", trs("Btrfs superblock detected"), 0.79});
        }
    }
 
    logs.push_back(trs("Signature scan: completed."));
    return out;
}