Avoid detecting FAT VBR as an MBR

The 1980s FAT filesystem has a VBR in the first sector, which looks
almost exactly like an MBR with zero partitions. To avoid detecting
these as MBRs, look for some extra attributes that indicate that the
structure is a VBR and avoid matching it as a GPT/MBR in that case.

We can add an inspector for this as a separate thing, but at the
moment we don't have that immediate need.

Closes-Bug: #2079850
Change-Id: Ibad87743b5a3b6469bd708d4caafe7911b045855
This commit is contained in:
Dan Smith
2024-09-06 07:51:13 -07:00
parent d37a161b7c
commit 3c33e37d64

View File

@@ -1214,6 +1214,7 @@ class GPTInspector(FileInspector):
NAME = 'gpt'
MBR_SIGNATURE = 0xAA55
MBR_PTE_START = 446
MEDIA_TYPE_FDISK = 0xF8
def _initialize(self):
self.new_region('mbr', CaptureRegion(0, 512))
@@ -1224,12 +1225,28 @@ class GPTInspector(FileInspector):
# self.new_region('gpt_backup', EndCaptureRegion(512))
self.add_safety_check(SafetyCheck('mbr', self.check_mbr_partitions))
def _check_for_fat(self):
# A FAT filesystem looks like an MBR, but actually starts with a VBR,
# which has the same signature as an MBR, but with more specifics in
# the BPB (BIOS Parameter Block).
boot_sector = self.region('mbr').data
# num_fats is almost always 2 (never more or less) for any filesystem
# not super tiny (think 1980s ramdisk)
num_fats = boot_sector[0x10]
# Media descriptor will basically always be "a fixed disk" for any of
# our purposes, not a floppy disk
media_desc = boot_sector[0x15]
return (num_fats == 2 and media_desc == self.MEDIA_TYPE_FDISK)
@property
def format_match(self):
if not self.region('mbr').complete:
return False
# Check to see if this looks like a VBR from a FAT filesystem so we
# can exclude it
is_fat = self._check_for_fat()
mbr_sig, = struct.unpack('<H', self.region('mbr').data[510:512])
return mbr_sig == self.MBR_SIGNATURE
return mbr_sig == self.MBR_SIGNATURE and not is_fat
def check_mbr_partitions(self):
valid_partitions = []