22 Jan
2013
22 Jan
'13
5:02 a.m.
Wiadomo?? napisana przez Jules Richardson w dniu 22 sty 2013, o godz. 02:36:
On 01/21/2013 06:05 PM, Toby Thain wrote:
Using
http://svnweb.freebsd.org/base/head/sys/ufs/ffs/fs.h?revision=243250&vi…
as a reference, you should be able to calculate this using cgbase().
On 21/01/13 5:00 PM, Jules Richardson wrote:
Thanks - that did let me infer the directory data block format which I'd not seen
described anywhere else. The three big unknowns I have at the moment are:
1) how to calculate the offset within the dump to each cylinder group header. I can find
them by searching for the CG magic number (which is at offset 0x4 within each) but I
don't know how their offsets are calculated, or stored in the superblock, or stored
elsewhere (at least one text that I read implied that they were stored in a lookup table
completely separate to the superblock)
Does anyone know of a good [available online] UFS filesystem technical
reference (which also covers cylinder grouping, i.e. not the original
'fs')? Google's not turning up much other than a couple of overviews
that are really too high-level.
McKusick's paper on FFS:
http://www.cs.berkeley.edu/~brewer/cs262/FFS.pdf 2) how to calculate the offset from each CG header to
the start of that CG's inode table. It seems to be 8192 bytes in all the UTek dumps
that I have, but I don't know if it's always 8192 bytes for any UFS
implementation, or even that I can assume it's always 8192 for UTek.
cgimin()
3) how inode data block pointers work. e.g. how the
address stored in each block pointer is translated to a physical offset from the start of
the partition dump. In one example that I have here, I've managed to find the data
block containing the root directory, but the address which it's at seems to have no
simple correlation that I can see to the data block pointer in the corresponding inode.
lblkno(), IIRC.
--
If you cut off my head, what would I say? Me and my head, or me and my body?