ext4rewind/ext4extent.py at main · bjangelo/ext4rewind · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
#!/usr/bin/python3

import ctypes
import sys

EXT4_EXT_MAGIC = 0xF30A


class ExtentHeader(ctypes.LittleEndianStructure):
    _fields_ = [
        ("magic", ctypes.c_ushort),
        ("entries", ctypes.c_ushort),
        ("max", ctypes.c_ushort),
        ("depth", ctypes.c_ushort),
        ("generation", ctypes.c_uint),
    ]

    def __str__(self):
        return buffer(self)[:]

    def __new__(self, b=None):
        if b:
            return self.from_buffer_copy(b)
        else:
            return ctypes.LittleEndianStructure.__new__(self)

    def __init__(self, b=None):
        pass


class ExtentIndex(ctypes.LittleEndianStructure):
    _fields_ = [
        ("block", ctypes.c_uint),
        ("leaf_lo", ctypes.c_uint),
        ("leaf_hi", ctypes.c_ushort),
        ("unused", ctypes.c_ushort),
    ]

    def __str__(self):
        return buffer(self)[:]

    def __new__(self, b=None):
        if b:
            return self.from_buffer_copy(b)
        else:
            return ctypes.LittleEndianStructure.__new__(self)

    def __init__(self, b=None):
        pass

    def leaf_block(self):
        return self.leaf_lo + (self.leaf_hi << 32)


class Extent(ctypes.LittleEndianStructure):
    _fields_ = [
        ("block", ctypes.c_uint),
        ("len", ctypes.c_ushort),
        ("start_hi", ctypes.c_ushort),
        ("start_lo", ctypes.c_uint),
    ]

    def __str__(self):
        return buffer(self)[:]

    def __new__(self, b=None):
        if b:
            return self.from_buffer_copy(b)
        else:
            return ctypes.LittleEndianStructure.__new__(self)

    def __init__(self, b=None):
        pass

    def blocks(self):
        blocks = []
        block = self.start_lo + (self.start_hi << 32)
        for i in range(0, self.len):
            blocks.append(block + i)
        return blocks


def parse_extent(f):
    n = ctypes.sizeof(ExtentHeader)
    hdr = ExtentHeader(f.read(n))
    if hdr.magic != EXT4_EXT_MAGIC:
        raise ValueError(f"Invalid extent header magic: {hdr.magic:x}")

    extent_blocks = []
    data_blocks = []

    for i in range(hdr.entries):
        if hdr.depth > 0:
            n = ctypes.sizeof(ExtentIndex)
            idx = ExtentIndex(f.read(n))
            extent_blocks.append(idx)
        else:
            n = ctypes.sizeof(Extent)
            ext = Extent(f.read(n))
            data_blocks.append(ext)

    extent_blocks.sort(key=lambda idx: idx.block)
    data_blocks.sort(key=lambda ext: ext.block)

    return extent_blocks, data_blocks


if __name__ == "__main__":
    f = sys.stdin.buffer

    extent_blocks, data_blocks = parse_extent(f)

    if data_blocks:
        print(f"Direct Blocks:")
        for ext in data_blocks:
            blocks = ext.blocks()
            if len(blocks) == 1:
                print(f"{blocks[0]}")
            else:
                print(f"{blocks[0]}-{blocks[-1]} ({len(blocks)})")
    if extent_blocks:
        print(f"Extent Blocks:")
        for idx in extent_blocks:
            print(f"{idx.leaf_block()}")