search

libyal / libewf

Libewf is a library to access the Expert Witness Compression Format (EWF)
GNU Lesser General Public License v3.0
263 stars 76 forks source link

Can't read file permissions (perms) from an L01 #156

Closed mikebbt closed 3 years ago

mikebbt commented 3 years ago

I'm attempting to read an L01 and I can't seem to get the information in the permissions category for the file(s) within. The libewf calls I'm using are:

libewf_file_entry_get_permission_id() - I'm using the file entry handle here to get the "permissions group index" (pm), this value looks ok.

libewf_handle_get_file_permission_by_id() - using the "main" handle (from call to libewf_handle_open) here along with the ID from the above call to get a filePermissions ptr to the Permissions Category, this looks valid.

libewf_file_permission_get_number_of_sub_file_permissions() - passing filePermissions ptr here along with a value to get set with the number of subs, this seems accurate as it returns the correct number of permissions for the file(s) in the L01.

Using the number of subs from the above call I'm next calling libewf_file_permission_get_sub_file_permission() which returns a subFile ptr. This is where it goes south, using the subFile ptr I try to make calls to get the permission items (name size, name, uid size, uid, access mask etc....) but none of these are valid. Using a hex editor I can see the items under "perms" in the L01 so I know they are there.

Some questions:

  1. Do these calls to extract file permission information work currently?
  2. Do my calls above look correct, perhaps I'm missing something?
  3. Would it be possible to check this sample file to see if you are able to extract any file permissions?

The sample contains 3 files, IMG_0003 & 0004 each have 5 permissions and AlbumArtSmall.jpg has 7, these numbers are consistent with what is returned after calling libewf_file_permission_get_number_of_sub_file_permissions.

Thanks, Mike SampleFiles3.L01.zip

mikebbt commented 3 years ago

Went back, did some refactor and it is now working so was a problem on my end, closing out.