KBNLresearch / isolyzer

Verify size of ISO 9660 image against Volume Descriptor fields
Other
44 stars 7 forks source link

Properties are not extracted because they are beyond range of sectorsToRead #19

Closed bitsgalore closed 6 years ago

bitsgalore commented 6 years ago

Example: bewaarmachine.iso (Isolyzer 1.2.0):

<applePartitionMap>
    <signature>PM</signature>
    <numberOfPartitionEntries>2</numberOfPartitionEntries>
    <partitionBlockStart>346957</partitionBlockStart>
    <partitionBlockCount>353073</partitionBlockCount>
    <partitionName>Toast 3.0 Partition</partitionName>
    <partitionType>Apple_HFS</partitionType>
    <partitionLogicalBlockStart>0</partitionLogicalBlockStart>
    <partitionLogicalBlockCount>353073</partitionLogicalBlockCount>
    <partitionFlags>19</partitionFlags>
    <bootCodeBlockStart>0</bootCodeBlockStart>
    <bootCodeSizeInBytes>0</bootCodeSizeInBytes>
    <bootCodeLoadAddress>0</bootCodeLoadAddress>
    <bootCodeJumpAddress>0</bootCodeJumpAddress>
    <bootCodeChecksum>0</bootCodeChecksum>
    <processorType/>
</applePartitionMap>
<masterDirectoryBlock>
    <signature/>
    <blockSize>-9999</blockSize>
    <blockCount>-9999</blockCount>
    <volumeName/>
</masterDirectoryBlock>

In this case the Apple Partition Map entry refers to a HFS partition that is located at 177641984 bytes (346957×512) into the image. However by default Isolyzer only reads 2048000 bytes (1000*2048) into a file. Possible solutions:

bitsgalore commented 6 years ago

Read whole image: https://github.com/KBNLresearch/isolyzer/commit/2d994b6bca0d9db8f9188317b1960a4b4f1a5c66

Use memory map: https://github.com/KBNLresearch/isolyzer/commit/f461bf7a4c1b24f92259c86ec00f03e15518757b

Impact on performance seems to be minimal, even for large images (tested with images up to 5 GB).