File I/O, Command Line Parameters, Endian-ness

Slides:



Advertisements
Similar presentations
DAT2343 File Storage and Access © Alan T. Pinck / Algonquin College; 2003.
Advertisements

1 Week 11 FAT32 Boot Sector, Locating Files and Dirs Classes COP4610 / CGS5765 Florida State University.
Utilizing the GDB debugger to analyze programs Background and application.
Assembly 01. Outline Binary vs. Text Files Compiler vs. Assembler Mnemonic Assembly Process Development Process Debugging Example 1 this analogy will.
Recap – Intro to Project 3 and FAT32
1 Week 12 FAT32 Utility Operations Guide Classes COP4610 / CGS5765 Florida State University.
The FAT File System CSC 414. Objectives  Understand the structure and components of the FAT (12/16/32) File Systems  Understand what happens when a.
Guide to Computer Forensics and Investigations Fourth Edition
Wince File systems. File system on embedded File system choice on embedded is important –File system size can be an issue –Different media are used –
Basic File Recovery Techniques BACS 371 Computer Forensics.
Week 10 Project 3: An Introduction to File Systems
MIPS coding. SPIM Some links can be found such as:
Files CS Spring Overview Example: FAT File System File Organization File System Organization –File Directories and File Sharing –Record Blocking.
1 Project 3: An Introduction to File Systems CS3430 Operating Systems University of Northern Iowa.
IT253: Computer Organization Lecture 3: Memory and Bit Operations Tonga Institute of Higher Education.
ENGI 3655 Lab Sessions 1Richard Khoury.  Linked Allocation ◦ Section Richard Khoury2.
File Systems in Real-Time Embedded Applications March 5th Eric Julien Understanding How the File Allocation Table (FAT) Operates 1.
Introduction to Unix (CA263) File Editing By Tariq Ibn Aziz.
Isecur1ty training center Presented by : Eng. Mohammad Khreesha.
1 Week 13 FAT32 Utility Operations Guide: rm and rmdir Classes COP4610 / CGS5765 Florida State University.
OPERATING SYSTEMS Frans Sanen.  Analyze a FAT file system manually  FAT12 first and simplest version  Still used on smaller disks (e.g. floppies) 
NTFS Filing System CHAPTER 9. New Technology File System (NTFS) Started with Window NT in 1993, Windows XP, 2000, Server 2003, 2008, and Window 7 also.
Chapter 8 File Systems FAT 12/16/32. Defragmentation Defrag a hard drive – Control Panel  System and Security  Administration tools  Defrag hard drive.
1 FAT32 Boot Sector, Locating Files and Dirs Operating Systems CS3430 Sarah Diesburg.
BITS Pilani Pilani Campus Pawan Sharma Lecture ES C263 INSTR/CS/EEE F241 Microprocessor Programming and Interfacing.
Master Boot Record (MBR)
1 Chapter 1: Introduction Appendix A: Binary and Hexadecimal Tutorial Assembly Language for Intel-Based Computers, 3rd edition Kip R. Irvine.
Chapter 3: Mastering Editors Chapter 3 Mastering Editors (Emacs)
More File Input and Output
EXT in Detail High-Performance Database Research Center
UMBC CMSC 421 Spring 2017 The FAT Filesystem.
Efficient Drive forensics – and it’s free!
CSE451 More File Systems Autumn 2002
Winter 2009 Tutorial #6 Arrays Part 2, Structures, Debugger
FAT32 Directory Entries and Operations Guide
Topics Introduction to Repetition Structures
FAT32 Directory Entries and Operations Guide
File System Structure How do I organize a disk into a file system?
A “Walk Through” Experiment
Slide design: Dr. Mark L. Hornick
Guide To UNIX Using Linux Third Edition
Project 3: An Introduction to File Systems
Vim.
Introduction to Computers
Using Tweak to Study Ccrypt
File Management.
File I/O, Command Line Parameters, Endian-ness
File Managements.
Slide design: Dr. Mark L. Hornick
Introduction to Database Systems
Chapter 3: Windows7 Part 3.
CS222: Principles of Data Management Notes #8 Static Hashing, Extendible Hashing, Linear Hashing Instructor: Chen Li.
CS222P: Principles of Data Management Notes #8 Static Hashing, Extendible Hashing, Linear Hashing Instructor: Chen Li.
Fundamentals of Data Structures
Microsoft Visual Source Safe How & Why
Introduction Paul Flynn
Project 3: An Introduction to File Systems
Index tuning Hash Index.
Homework Applied for cs240? (If not, keep at it!) 8/10 Done with HW1?
File Analysis with MicroSoft DEBUG
FAT32 Directory Entries and Operations Guide
Disk Structure Analysis
Understanding Hex “I hope you have the worst headache of your life, then you will begin to understand” ~unknown.
CSCI N207 Data Analysis Using Spreadsheet
Sector 25 from the Root Directory (in 32 byte chunks)
Real-World File Structures
Internal Representation of Files
Recap – Intro to Project 3 and FAT32
FAT File System.
Chapter 5 File Systems -Compiled for MCA, PU
Presentation transcript:

File I/O, Command Line Parameters, Endian-ness Operating Systems CS3430 Sarah Diesburg

Main Structure of our Utility Our utility will Prompt the user for a command Perform the command (or quit) Repeat Need a main loop and a way to compare input to commands fat32_reader.c - C starter code

Additional Reserved Sectors (Optional) Reserved Region Reserved Region – Includes the boot sector, the extended boot sector, the file system information sector, and a few other reserved sectors Reserved Region FAT Data Boot Sector FS Information Sector Additional Reserved Sectors (Optional)

Additional Reserved Sectors (Optional) Beginning Project 3 Start by reading boot sector fat32 information As you work, it might make sense to first take a look at the raw file system image Hexedit to the rescue! Reserved Region FAT Data Boot Sector FS Information Sector Additional Reserved Sectors (Optional)

Hexedit To install (run once): To run: $> hexedit [filename] $> sudo apt-get update $> sudo apt-get install hexedit To run: $> hexedit [filename] View files in hexadecimal or ASCII Why wouldn’t you want to view the file system image file in your regular editor?

Hexedit

Hexedit Line numbers in hex

Hexedit Content in hex

Content in printable ASCII Hexedit Content in printable ASCII

Hexadecimal Hints Hex is base 16 – one hexadecimal can represent 0-15 It takes 4 binary bits to represent values 0-15 0000 = 0 1111 = 15

Hexadecimal Hints If it takes 4 bits to represent one hexadecimal number, it takes 8 bits to represent two hexadecimal numbers 8 bits = 1 byte Two hex numbers together symbolize one byte That’s why hex numbers are in groups of two

Endianness FAT32 is represented in little endian byte order Reading left to right, you encounter least-significant byte first What 32-bit number is this? 0x0000040 or 0x40000000?

Endianness You must account for little endianness across bytes when reading in numbers of size larger than one byte Characters are only one byte, no re-ordering necessary Use only safe functions when reading, to make sure to adjust for the endian-ness of your architecture Ex. le16toh(num), le32toh(num)

Parse the Boot Sector We need to gather important information about the file system in the boot sector

Important Boot Sector Information Size of each region BPB_BytesPerSec BPB_SecPerClus BPB_RsvdSecCnt BPB_NumFATS BPB_FATSz32 Root directory (first directory in tree) BPB_RootClus Warning: this list is not exhaustive!

Important Boot Sector Information BPB_BytesPerSector Offset 11, size 2 bytes 0x0200 = 512

Next Steps After you have parsed the boot sector and saved key values, you may want to find the root directory Everything starts here…

Finding the Root Directory Figure out the root directory cluster number from the boot sector

Finding the Root Directory BPB_RootClus Offset 44, size 4 bytes 0x00000002 = 2

Finding the Root Directory Figure out where the root directory starts in the data region, where N=cluster number (We just found N=2) FirstSectorofCluster = ((N – 2) * BPB_SecPerClus) + FirstDataSector;

Finding the Root Directory Read in the root directory structure located at the first sector of the root directory cluster

Finding the Root Directory Does the root directory span more than one cluster? Look up the next cluster number in the FAT. Find ThisFATSecNum and ThisFATEntOffset for the current cluster number Go to ThisFATSecNum and read the 32-bit unsigned value starting at offset ThisFATEntOffset FAT will either give you the next cluster number in the directory or the End of Cluster Chain value

What exactly is the FAT? Files and directories may span multiple clusters FAT is a database or array of pointers to the next cluster number of the file or directory

Finding the Root Directory Next cluster number of root directory in FAT EoC=0x0FFFFFF8 – directory does not go on

Finding the Root Directory Next cluster number of root directory in FAT EoC=0x0FFFFFF8 – directory does not go on …otherwise this would be the next cluster number…

Directory Structure Each directory is made up of one or more directory entries that contain File name (or sub-directory name) Attributes First cluster number Cluster number where file or directory in question starts More…

Finding Files and Directories Files and sub-directory entries can be found by going to their first cluster number Found in the directory entry

Finding Files and Directories NOTE: The following file I find and image are different than what is in your current image. It is an example only

Finding fatgen103.pdf Suppose we have read in the root direcotry and want to find the file ‘fatgen103.pdf’

Directory entry for fatgen103.pdf Finding fatgen103.pdf Suppose we have read in the root direcotry and want to find the file ‘fatgen103.pdf’ Directory entry for fatgen103.pdf

Finding fatgen103.pdf Entry’s first cluster number 0x000011 = 17 High word Low word

Finding fatgen103.pdf Plug N=17 into FirstSectorofCluster equation, go to that sector…

Continues to cluster 0x12=18! Finding fatgen103.pdf Does the file continue after this cluster? Look up current cluster number 17 in FAT… Continues to cluster 0x12=18!

Summary of Finding Files/Dirs Find first cluster number in directory entry of interesting file or directory Figure out the sector to read using cluster number and FirstSectorofCluster equation Read that cluster Figure out if file or directory continues past cluster by looking up FAT[current cluster number] If EoC mark stop Else go to 3 with cluster=FAT[current cluster number]