dissect.extfs.c_ext
#
Module Contents#
- dissect.extfs.c_ext.ext_def = Multiline-String#
Show Value
""" #define EXT2_SBOFF 1024 // offset to superblock #define EXT2_FS_MAGIC 0xef53 #define EXT2_BAD_INO 1 // Bad blocks inode #define EXT2_ROOT_INO 2 // Root inode #define EXT4_USR_QUOTA_INO 3 // User quota inode #define EXT4_GRP_QUOTA_INO 4 // Group quota inode #define EXT2_BOOT_LOADER_INO 5 // Boot loader inode #define EXT2_UNDEL_DIR_INO 6 // Undelete directory inode #define EXT2_RESIZE_INO 7 // Reserved group descriptors inode #define EXT2_JOURNAL_INO 8 // Journal inode #define EXT2_NDIR_BLOCKS 12 // direct blocks in inode #define EXT2_NIND_BLOCKS 3 // indirect blocks in inode #define EXT2_NAME_LEN 255 #define EXT2_MIN_BLOCK_SIZE 1024 #define EXT2_MAX_BLOCK_SIZE 4096 #define EXT4_MAX_BLOCK_SIZE 65536 #define EXT2_FEATURE_COMPAT_DIR_PREALLOC 0x0001 #define EXT2_FEATURE_COMPAT_IMAGIC_INODES 0x0002 #define EXT3_FEATURE_COMPAT_HAS_JOURNAL 0x0004 #define EXT2_FEATURE_COMPAT_EXT_ATTR 0x0008 #define EXT2_FEATURE_COMPAT_RESIZE_INODE 0x0010 #define EXT2_FEATURE_COMPAT_DIR_INDEX 0x0020 #define EXT4_FEATURE_COMPAT_SPARSE_SUPER2 0x0200 #define EXT2_FEATURE_RO_COMPAT_SPARSE_SUPER 0x0001 #define EXT2_FEATURE_RO_COMPAT_LARGE_FILE 0x0002 #define EXT2_FEATURE_RO_COMPAT_BTREE_DIR 0x0004 #define EXT2_FEATURE_RO_COMPAT_HUGE_FILE 0x0008 #define EXT4_FEATURE_RO_COMPAT_GDT_CSUM 0x0010 #define EXT4_FEATURE_RO_COMPAT_DIR_NLINK 0x0020 #define EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE 0x0040 #define EXT4_FEATURE_RO_COMPAT_QUOTA 0x0100 #define EXT4_FEATURE_RO_COMPAT_BIGALLOC 0x0200 #define EXT4_FEATURE_RO_COMPAT_METADATA_CSUM 0x0400 #define EXT4_FEATURE_RO_COMPAT_READONLY 0x1000 #define EXT4_FEATURE_RO_COMPAT_PROJECT 0x2000 #define EXT2_FEATURE_INCOMPAT_COMPRESSION 0x0001 #define EXT2_FEATURE_INCOMPAT_FILETYPE 0x0002 #define EXT3_FEATURE_INCOMPAT_RECOVER 0x0004 #define EXT3_FEATURE_INCOMPAT_JOURNAL_DEV 0x0008 #define EXT2_FEATURE_INCOMPAT_META_BG 0x0010 #define EXT4_FEATURE_INCOMPAT_EXTENTS 0x0040 #define EXT4_FEATURE_INCOMPAT_64BIT 0x0080 #define EXT4_FEATURE_INCOMPAT_MMP 0x0100 #define EXT4_FEATURE_INCOMPAT_FLEX_BG 0x0200 #define EXT4_FEATURE_INCOMPAT_EA_INODE 0x0400 #define EXT4_FEATURE_INCOMPAT_DIRDATA 0x1000 #define EXT4_FEATURE_INCOMPAT_CSUM_SEED 0x2000 #define EXT4_FEATURE_INCOMPAT_LARGEDIR 0x4000 #define EXT4_FEATURE_INCOMPAT_INLINE_DATA 0x8000 // data in inode #define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000 // >2GB or 3-lvl htree #define EXT2_FT_FMT 0x0000F000 #define EXT2_FT_SOCK 0x0000C000 #define EXT2_FT_LNK 0x0000A000 #define EXT2_FT_REG 0x00008000 #define EXT2_FT_BLK 0x00006000 #define EXT2_FT_DIR 0x00004000 #define EXT2_FT_CHR 0x00002000 #define EXT2_FT_FIFO 0x00001000 #define EXT2_SECRM_FL 0x00000001 // Secure deletion #define EXT2_UNRM_FL 0x00000002 // Undelete #define EXT2_COMPR_FL 0x00000004 // Compress file #define EXT2_SYNC_FL 0x00000008 // Synchronous updates #define EXT2_IMMUTABLE_FL 0x00000010 // Immutable file #define EXT2_APPEND_FL 0x00000020 // writes to file may only append #define EXT2_NODUMP_FL 0x00000040 // do not dump file #define EXT2_NOATIME_FL 0x00000080 // do not update atime #define EXT2_DIRTY_FL 0x00000100 #define EXT2_COMPRBLK_FL 0x00000200 // One or more compressed clusters #define EXT2_NOCOMP_FL 0x00000400 // Don't compress #define EXT2_ECOMPR_FL 0x00000800 // Compression error #define EXT4_ENCRYPT_FL 0x00000800 // encrypted file #define EXT2_BTREE_FL 0x00001000 // btree format dir #define EXT4_INDEX_FL 0x00001000 // hash-indexed directory #define EXT2_IMAGIC_FL 0x00002000 // AFS directory #define EXT2_JOURNAL_DATA_FL 0x00004000 // file data should be journaled #define EXT2_NOTAIL_FL 0x00008000 // file tail should not be merged #define EXT2_DIRSYNC_FL 0x00010000 // dirsync behaviour (directories only) #define EXT2_TOPDIR_FL 0x00020000 // Top of directory hierarchies #define EXT4_HUGE_FILE_FL 0x00040000 // Set to each huge file #define EXT4_EXTENTS_FL 0x00080000 // Inode uses extents #define EXT4_EA_INODE_FL 0x00200000 // Inode used for large EA #define EXT4_EOFBLOCKS_FL 0x00400000 // Blocks allocated beyond EOF #define EXT4_INLINE_DATA_FL 0x10000000 // Inode has inline data. #define EXT4_PROJINHERIT_FL 0x20000000 // Create with parents projid #define EXT2_RESERVED_FL 0x80000000 // reserved #define EXT2_FL_USER_VISIBLE 0x304BDFFF // User visible flags #define EXT2_FL_USER_MODIFIABLE 0x204BC0FF // User modifiable flags struct ext4_super_block { uint32 s_inodes_count; /* Inodes count */ uint32 s_blocks_count_lo; /* Blocks count */ uint32 s_r_blocks_count_lo; /* Reserved blocks count */ uint32 s_free_blocks_count_lo; /* Free blocks count */ uint32 s_free_inodes_count; /* Free inodes count */ uint32 s_first_data_block; /* First Data Block */ uint32 s_log_block_size; /* Block size */ uint32 s_log_cluster_size; /* Allocation cluster size */ uint32 s_blocks_per_group; /* # Blocks per group */ uint32 s_clusters_per_group; /* # Clusters per group */ uint32 s_inodes_per_group; /* # Inodes per group */ uint32 s_mtime; /* Mount time */ uint32 s_wtime; /* Write time */ uint16 s_mnt_count; /* Mount count */ uint16 s_max_mnt_count; /* Maximal mount count */ uint16 s_magic; /* Magic signature */ uint16 s_state; /* File system state */ uint16 s_errors; /* Behaviour when detecting errors */ uint16 s_minor_rev_level; /* minor revision level */ uint32 s_lastcheck; /* time of last check */ uint32 s_checkinterval; /* max. time between checks */ uint32 s_creator_os; /* OS */ uint32 s_rev_level; /* Revision level */ uint16 s_def_resuid; /* Default uid for reserved blocks */ uint16 s_def_resgid; /* Default gid for reserved blocks */ uint32 s_first_ino; /* First non-reserved inode */ uint16 s_inode_size; /* size of inode structure */ uint16 s_block_group_nr; /* block group # of this superblock */ uint32 s_feature_compat; /* compatible feature set */ uint32 s_feature_incompat; /* incompatible feature set */ uint32 s_feature_ro_compat; /* readonly-compatible feature set */ char s_uuid[16]; /* 128-bit uuid for volume */ char s_volume_name[16]; /* volume name */ char s_last_mounted[64]; /* directory where last mounted */ uint32 s_algorithm_usage_bitmap; /* For compression */ uint8 s_prealloc_blocks; /* Nr of blocks to try to preallocate*/ uint8 s_prealloc_dir_blocks; /* Nr to preallocate for dirs */ uint16 s_reserved_gdt_blocks; /* Per group desc for online growth */ // Journaling support valid if EXT4_FEATURE_COMPAT_HAS_JOURNAL set. char s_journal_uuid[16]; /* uuid of journal superblock */ uint32 s_journal_inum; /* inode number of journal file */ uint32 s_journal_dev; /* device number of journal file */ uint32 s_last_orphan; /* start of list of inodes to delete */ char s_hash_seed[16]; /* HTREE hash seed */ uint8 s_def_hash_version; /* Default hash version to use */ uint8 s_jnl_backup_type; uint16 s_desc_size; /* size of group descriptor */ uint32 s_default_mount_opts; uint32 s_first_meta_bg; /* First metablock block group */ uint32 s_mkfs_time; /* When the filesystem was created */ uint32 s_jnl_blocks[17]; /* Backup of the journal inode */ // 64bit support valid if EXT4_FEATURE_COMPAT_64BIT uint32 s_blocks_count_hi; /* Blocks count */ uint32 s_r_blocks_count_hi; /* Reserved blocks count */ uint32 s_free_blocks_count_hi; /* Free blocks count */ uint16 s_min_extra_isize; /* All inodes have at least # bytes */ uint16 s_want_extra_isize; /* New inodes should reserve # bytes */ uint32 s_flags; /* Miscellaneous flags */ uint16 s_raid_stride; /* RAID stride */ uint16 s_mmp_update_interval; /* # seconds to wait in MMP checking */ uint64 s_mmp_block; /* Block for multi-mount protection */ uint32 s_raid_stripe_width; /* blocks on all data disks (N*stride)*/ uint8 s_log_groups_per_flex; /* FLEX_BG group size */ uint8 s_checksum_type; /* metadata checksum algorithm used */ uint8 s_encryption_level; /* versioning level for encryption */ uint8 s_reserved_pad; /* Padding to next 32bits */ uint64 s_kbytes_written; /* nr of lifetime kilobytes written */ uint32 s_snapshot_inum; /* Inode number of active snapshot */ uint32 s_snapshot_id; /* sequential ID of active snapshot */ uint64 s_snapshot_r_blocks_count; /* reserved blocks for active snapshot's future use */ uint32 s_snapshot_list; /* inode number of the head of the on-disk snapshot list */ uint32 s_error_count; /* number of fs errors */ uint32 s_first_error_time; /* first time an error happened */ uint32 s_first_error_ino; /* inode involved in first error */ uint64 s_first_error_block; /* block involved of first error */ uint8 s_first_error_func[32]; /* function where the error happened */ uint32 s_first_error_line; /* line number where error happened */ uint32 s_last_error_time; /* most recent time of an error */ uint32 s_last_error_ino; /* inode involved in last error */ uint32 s_last_error_line; /* line number where error happened */ uint64 s_last_error_block; /* block involved of last error */ uint8 s_last_error_func[32]; /* function where the error happened */ uint8 s_mount_opts[64]; uint32 s_usr_quota_inum; /* inode for tracking user quota */ uint32 s_grp_quota_inum; /* inode for tracking group quota */ uint32 s_overhead_clusters; /* overhead blocks/clusters in fs */ uint32 s_backup_bgs[2]; /* groups with sparse_super2 SBs */ uint8 s_encrypt_algos[4]; /* Encryption algorithms in use */ uint8 s_encrypt_pw_salt[16]; /* Salt used for string2key algorithm */ uint32 s_lpf_ino; /* Location of the lost+found inode */ uint32 s_prj_quota_inum; /* inode for tracking project quota */ uint32 s_checksum_seed; /* crc32c(uuid) if csum_seed set */ uint32 s_reserved[98]; /* Padding to the end of the block */ uint32 s_checksum; /* crc32c(superblock) */ }; struct ext2_group_desc { uint32 bg_block_bitmap_lo; /* Blocks bitmap block */ uint32 bg_inode_bitmap_lo; /* Inodes bitmap block */ uint32 bg_inode_table_lo; /* Inodes table block */ uint16 bg_free_blocks_count_lo; /* Free blocks count */ uint16 bg_free_inodes_count_lo; /* Free inodes count */ uint16 bg_used_dirs_count_lo; /* Directories count */ uint16 bg_pad; uint32 bg_reserved[3]; }; struct ext4_group_desc { uint32 bg_block_bitmap_lo; /* Blocks bitmap block */ uint32 bg_inode_bitmap_lo; /* Inodes bitmap block */ uint32 bg_inode_table_lo; /* Inodes table block */ uint16 bg_free_blocks_count_lo; /* Free blocks count */ uint16 bg_free_inodes_count_lo; /* Free inodes count */ uint16 bg_used_dirs_count_lo; /* Directories count */ uint16 bg_flags; /* EXT4_BG_flags (INODE_UNINIT, etc) */ uint32 bg_exclude_bitmap_lo; /* Exclude bitmap for snapshots */ uint16 bg_block_bitmap_csum_lo; /* crc32c(s_uuid+grp_num+bbitmap) LE */ uint16 bg_inode_bitmap_csum_lo; /* crc32c(s_uuid+grp_num+ibitmap) LE */ uint16 bg_itable_unused_lo; /* Unused inodes count */ uint16 bg_checksum; /* crc16(sb_uuid+group+desc) */ uint32 bg_block_bitmap_hi; /* Blocks bitmap block MSB */ uint32 bg_inode_bitmap_hi; /* Inodes bitmap block MSB */ uint32 bg_inode_table_hi; /* Inodes table block MSB */ uint16 bg_free_blocks_count_hi; /* Free blocks count MSB */ uint16 bg_free_inodes_count_hi; /* Free inodes count MSB */ uint16 bg_used_dirs_count_hi; /* Directories count MSB */ uint16 bg_itable_unused_hi; /* Unused inodes count MSB */ uint32 bg_exclude_bitmap_hi; /* Exclude bitmap block MSB */ uint16 bg_block_bitmap_csum_hi; /* crc32c(s_uuid+grp_num+bbitmap) BE */ uint16 bg_inode_bitmap_csum_hi; /* crc32c(s_uuid+grp_num+ibitmap) BE */ uint32 bg_reserved; }; struct ext4_inode { uint16 i_mode; /* File mode */ uint16 i_uid; /* Low 16 bits of Owner Uid */ uint32 i_size_lo; /* Size in bytes */ uint32 i_atime; /* Access time */ uint32 i_ctime; /* Inode Change time */ uint32 i_mtime; /* Modification time */ uint32 i_dtime; /* Deletion Time */ uint16 i_gid; /* Low 16 bits of Group Id */ uint16 i_links_count; /* Links count */ uint32 i_blocks_lo; /* Blocks count */ uint32 i_flags; /* File flags */ uint32 i_reserved_1; char i_block[60]; /* Pointers to blocks */ uint32 i_generation; /* File version (for NFS) */ uint32 i_file_acl_lo; /* File ACL */ uint32 i_size_high; uint32 i_obso_faddr; /* Obsoleted fragment address */ uint16 i_blocks_high; /* were l_i_reserved1 */ uint16 i_file_acl_high; uint16 i_uid_high; /* these 2 fields */ uint16 i_gid_high; /* were reserved2[0] */ uint16 i_checksum_lo; /* crc32c(uuid+inum+inode) LE */ uint16 i_reserved; uint16 i_extra_isize; uint16 i_checksum_hi; /* crc32c(uuid+inum+inode) BE */ uint32 i_ctime_extra; /* extra Change time (nsec << 2 | epoch) */ uint32 i_mtime_extra; /* extra Modification time (nsec << 2 | epoch) */ uint32 i_atime_extra; /* extra Access time (nsec << 2 | epoch) */ uint32 i_crtime; /* File Creation time */ uint32 i_crtime_extra; /* extra FileCreationtime (nsec << 2 | epoch) */ uint32 i_version_hi; /* high 32 bits for 64-bit version */ uint32 i_projid; /* Project ID */ char i_extra[256 - 128 - i_extra_isize]; }; struct ext2_dir_entry { uint32 inode; /* Inode number */ uint16 rec_len; /* Directory entry length */ uint16 name_len; /* Name length */ char name[0]; /* File name */ }; struct ext2_dir_entry_2 { uint32 inode; /* Inode number */ uint16 rec_len; /* Directory entry length */ uint8 name_len; /* Name length */ uint8 file_type; char name[0]; /* File name */ }; struct ext4_dir_entry_tail { uint32 det_reserved_zero1; /* Pretend to be unused */ uint16 det_rec_len; /* 12 */ uint8 det_reserved_zero2; /* Zero name length */ uint8 det_reserved_ft; /* 0xDE, fake file type */ uint32 det_checksum; /* crc32c(uuid+inum+dirblock) */ }; struct dx_root { ext2_dir_entry_2 dot; char _pad0[3]; ext2_dir_entry_2 dotdot; char _pad1[2]; uint32 reserved_zero; uint8 hash_version; uint8 info_length; uint8 indirect_levels; uint8 unused_flags; uint16 limit; uint16 count; uint32 block; }; struct dx_node { ext2_dir_entry_2 fake_direntry; uint16 limit; uint16 count; int32 block; }; struct dx_entry { uint32 hash; uint32 block; }; struct ext4_extent_header { uint16 eh_magic; /* probably will support different formats */ uint16 eh_entries; /* number of valid entries */ uint16 eh_max; /* capacity of store in entries */ uint16 eh_depth; /* has tree real underlying blocks? */ uint32 eh_generation; /* generation of the tree */ }; struct ext4_extent_idx { uint32 ei_block; /* index covers logical blocks from 'block' */ uint32 ei_leaf_lo; /* pointer to the physical block of the next level. */ /* leaf or next index could be there */ uint16 ei_leaf_hi; /* high 16 bits of physical block */ uint16 ei_unused; }; struct ext4_extent { uint32 ee_block; /* first logical block extent covers */ uint16 ee_len; /* number of blocks covered by extent */ uint16 ee_start_hi; /* high 16 bits of physical block */ uint32 ee_start_lo; /* low 32 bits of physical block */ }; #define EXT4_XATTR_MAGIC 0xEA020000 /* Name indexes */ #define EXT4_XATTR_INDEX_USER 1 #define EXT4_XATTR_INDEX_POSIX_ACL_ACCESS 2 #define EXT4_XATTR_INDEX_POSIX_ACL_DEFAULT 3 #define EXT4_XATTR_INDEX_TRUSTED 4 #define EXT4_XATTR_INDEX_LUSTRE 5 #define EXT4_XATTR_INDEX_SECURITY 6 #define EXT4_XATTR_INDEX_SYSTEM 7 #define EXT4_XATTR_INDEX_RICHACL 8 #define EXT4_XATTR_INDEX_ENCRYPTION 9 #define EXT4_XATTR_INDEX_HURD 10 /* Reserved for Hurd */ #define XATTR_HURD_PREFIX "gnu." #define XATTR_SECURITY_PREFIX "security." #define XATTR_SYSTEM_PREFIX "system." #define XATTR_TRUSTED_PREFIX "trusted." #define XATTR_USER_PREFIX "user." #define XATTR_POSIX_ACL_ACCESS "posix_acl_access" #define XATTR_POSIX_ACL_DEFAULT "posix_acl_default" #define EXT4_XATTR_PAD_BITS 2 #define EXT4_XATTR_PAD (1<<EXT4_XATTR_PAD_BITS) #define EXT4_XATTR_ROUND (EXT4_XATTR_PAD-1) struct ext4_xattr_header { uint32 h_magic; /* magic number for identification */ uint32 h_refcount; /* reference count */ uint32 h_blocks; /* number of disk blocks used */ uint32 h_hash; /* hash value of all attributes */ uint32 h_checksum; /* crc32c(uuid+id+xattrblock) */ /* id = inum if refcount=1, blknum otherwise */ uint32 h_reserved[3]; /* zero right now */ }; struct ext4_xattr_ibody_header { uint32 h_magic; /* magic number for identification */ }; struct ext4_xattr_entry { uint8 e_name_len; /* length of name */ uint8 e_name_index; /* attribute name index */ uint16 e_value_offs; /* offset in disk block of value */ uint32 e_value_inum; /* inode in which the value is stored */ uint32 e_value_size; /* size of attribute value */ uint32 e_hash; /* hash value of name and value */ char e_name[e_name_len]; /* attribute name */ }; """
- dissect.extfs.c_ext.c_ext#
- dissect.extfs.c_ext.EXT2 = 2#
- dissect.extfs.c_ext.EXT3 = 3#
- dissect.extfs.c_ext.EXT4 = 4#
- dissect.extfs.c_ext.FILETYPES#
- dissect.extfs.c_ext.XATTR_PREFIX_MAP#
- dissect.extfs.c_ext.XATTR_NAME_MAP#