nlitsme / extfstools

Tools for extracting files from ext2,3,4 filesystem images
MIT License
121 stars 39 forks source link

Incorrect offset for block group descriptors when the block size is 1k #4

Closed atkdef closed 5 years ago

atkdef commented 5 years ago

On parsing one ext2 dump with a block size of 1024, this tool outputs "#2 is not a dir" and exits without generating any results. The offset for the block group descriptors is actually 0x800 but this tool thinks it's on 0x400. I found this comment on the source code.

https://github.com/nlitsme/extfstools/blob/2a7e65bdf8cf43f6e3dbf75a95386760902b0371/ext2rd.cpp#L809-L811

So, I did some searching and found this.

https://www.kernel.org/doc/html/latest/filesystems/ext4/overview.html#layout

For the special case of block group 0, the first 1024 bytes are unused, to allow for the installation of x86 boot sectors and other oddities. The superblock will start at offset 1024 bytes, whichever block that happens to be (usually 0). However, if for some reason the block size = 1024, then block 0 is marked in use and the superblock goes in block 1.

My understanding is that, if the block size is equal or greater than 2k, this tool should work fine as the first block is large enough to hold the first 2k data, and the second block can be used to hold block group descriptors. When the block size is 1k, it needs two blocks; the first to hold the first 1k data, and the second to hold the super block. As the block group descriptors follow the super block, in this case the third block is used to store block group descriptors.

If my understanding is correct, the offset for the block group descriptors should be determined by where the super block locates; the block for block group descriptors follows the super block and may not be the second block.

I'm not really familiar with ext. Don't be hesitate to tell me if there's any mistake :)

nlitsme commented 5 years ago

I think you are right. just tested, and 1k blocksize does not work currently ... i will make a fix soon.

nlitsme commented 5 years ago

https://github.com/nlitsme/extfstools/commit/bd231380949d50e6fe4adba5d9b091ef40b2c84f should solve this.

atkdef commented 5 years ago

Works fine; thanks for the fix!