departition.c File Reference

Extract a partition table from file systems. More...

#include <stdlib.h>
#include <errno.h>
#include <stdio.h>
#include <stdint.h>
#include <unistd.h>
#include <limits.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

Include dependency graph for departition.c:

Go to the source code of this file.

Functions
void	ExtractKernel (int Fin)
	Extract a kernel file system and copy it to a new file called "Kernel_%04d",Counter. More...
void	ExtractPartition (int Fin, uint64_t Start, uint64_t Size)
	Dump a partition to a file. More...
int	ReadMBR (int Fin, uint64_t MBRStart)
	Read a master boot record (first 0x200 bytes). More...
void	Usage (char *Filename)
	Usage. More...
int	main (int argc, char *argv[])
	Main for departition.

Variables
int	Test =0
	Set to 0 to extract, 1 to just be verbose. More...
int	Verbose =0
	Verbose level for log. More...

Detailed Description

Extract a partition table from file systems.

Definition in file departition.c.

Function Documentation

ExtractKernel()

void ExtractKernel

(

int

Fin

)

Extract a kernel file system and copy it to a new file called "Kernel_%04d",Counter.

Parameters

Fin	Open file descriptor

The first linux kernels were files: vmlinux. The files got big, so they compressed them: vmlinux.gz Today, they are integrated into boot managers, so they actually are wrapped in a file system: vmlinux.gz + x86 sector = vmlinuz The location of the vmlinux.gz in vmlinuz varies based on boot options and versions. (Assembly code is actually used to identify the offset.)

So, we just scan until we find the start of the file. *.gz files begin with "1F 8B 08 00" or "1F 8B 08 08" Find the *.gz, then dump the entire file. (This is similar to the approach used by extract-ikconfig.)

BSD does not use nor need O_LARGEFILE

Note

ReadSize == bytes ready to save to file

Definition at line 61 of file departition.c.

ExtractPartition()

void ExtractPartition	(	int	Fin,
		uint64_t	Start,
		uint64_t	Size
	)

Dump a partition to a file.

This function extracts, then returns the pointer back to the original location.

Parameters

Fin	Source of data (disk image)
Start	Begin of partition
Size	End of partition

Definition at line 155 of file departition.c.

ReadMBR()

int ReadMBR	(	int	Fin,
		uint64_t	MBRStart
	)

Read a master boot record (first 0x200 bytes).

The MBR contains 446 bytes of assembly, and 4 partition tables. Extracts kernel and partitions based on MBR.

Parameters

Fin	Open file descriptor to read
MBRStart	offset for record

Returns

0=not MBR, 1=MBR

Types: http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

Definition at line 260 of file departition.c.

Usage()

void Usage

(

char *

Filename

)

Usage.

Say how to run this program.

Parameters

Filename

(executable argv[0] name)

Definition at line 377 of file departition.c.

Variable Documentation

Test

int Test =0

Set to 0 to extract, 1 to just be verbose.

Set if working in test mode else 0

Definition at line 39 of file departition.c.

Verbose

int Verbose =0

Verbose level for log.

Global verbose level.

Verbose level.

Contains all the functions supported by delagent

Verbosity level

Definition at line 40 of file departition.c.