search

dasec / fishy

Toolkit for Filesystem based Data Hiding Techniques.
MIT License
36 stars 1 forks source link

NTFS FileSlack: cant write into slackspace of file 'another' #3

Closed importantchoice closed 6 years ago

importantchoice commented 7 years ago

I tried to write something to file slack of an NTFS filesystem, but got this:

$ echo "Simple test" | fishy -d utils/testfs-ntfs.dd fileslack -w -d another -m /tmp/meta.json                 
filesize:12
Traceback (most recent call last):
  File "/usr/bin/fishy", line 11, in <module>
    load_entry_point('fishy==0.1', 'console_scripts', 'fishy')()
  File "/usr/lib/python3.6/site-packages/fishy-0.1-py3.6.egg/fishy/cli.py", line 127, in main
    do_fileslack(args, device)
  File "/usr/lib/python3.6/site-packages/fishy-0.1-py3.6.egg/fishy/cli.py", line 46, in do_fileslack
    slacker.write(sys.stdin.buffer, args.destination)
  File "/usr/lib/python3.6/site-packages/fishy-0.1-py3.6.egg/fishy/file_slack.py", line 75, in write
    slack_metadata = self.fs.write(instream, filepaths)
  File "/usr/lib/python3.6/site-packages/fishy-0.1-py3.6.egg/fishy/ntfs/ntfsSlackSpace.py", line 23, in write
    m = self.slackTool.write(instream, filepaths)
  File "/usr/lib/python3.6/site-packages/fishy-0.1-py3.6.egg/fishy/ntfs/ntfsSlack.py", line 121, in write
    raise Exception("Not enough slack space")
Exception: Not enough slack space

Don't know if it matters, but the actual filesize is 4 Bytes on my system...

$ ls -l utils/fs-files/another 
-rwxr-xr-x 1 xxxxx users 4 Oct 26 20:48 utils/fs-files/another

I used the ntfs-image created by running ./create_testfs.sh

Writing to other files, like 'long_file.txt', work fine.

D-Kern commented 6 years ago

Hiding data in slack space of files resident in MFT $Data attribute wasn't implemented. Should work with commit 62567c20bab04c2a2bdd952c1a5b5441290ce803.