00001
00002
00003
00004
00005
00006
00007
00008
00009
00015 #ifndef _TSK_HDB_TOOLS_H
00016 #define _TSK_HDB_TOOLS_H
00017
00018 #include "aux_tools.h"
00019
00020 #ifdef HAVE_UNISTD
00021 #include <unistd.h>
00022 #endif
00023 #include <string.h>
00024 #include <ctype.h>
00025
00026 #include <sys/types.h>
00027 #include <sys/stat.h>
00028
00029 #include <locale.h>
00030
00031 #ifdef TSK_WIN32
00032 #include <io.h>
00033 #include <fcntl.h>
00034 #endif
00035
00036 #ifdef __cplusplus
00037 extern "C" {
00038 #endif
00039
00040
00044 enum TSK_HDB_FLAG_ENUM {
00045 TSK_HDB_FLAG_QUICK = 0x01,
00046 TSK_HDB_FLAG_EXT = 0x02
00047 };
00048 typedef enum TSK_HDB_FLAG_ENUM TSK_HDB_FLAG_ENUM;
00049
00050
00054 enum TSK_HDB_HTYPE_ENUM {
00055 TSK_HDB_HTYPE_MD5_ID = 1,
00056 TSK_HDB_HTYPE_SHA1_ID = 2,
00057 };
00058 typedef enum TSK_HDB_HTYPE_ENUM TSK_HDB_HTYPE_ENUM;
00059
00060 #define TSK_HDB_HTYPE_MD5_STR "md5"
00061 #define TSK_HDB_HTYPE_SHA1_STR "sha1"
00062
00063 #define TSK_HDB_HTYPE_SHA1_LEN 40
00064 #define TSK_HDB_HTYPE_MD5_LEN 32
00065 #define TSK_HDB_HTYPE_CRC32_LEN 8
00066
00067
00071 #define TSK_HDB_HTYPE_STR(x) \
00072 ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_STR) : ( \
00073 ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_STR : "") ) )
00074
00078 #define TSK_HDB_HTYPE_LEN(x) \
00079 ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_LEN) : ( \
00080 ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_LEN : 0) ) )
00081
00082
00083
00087 enum TSK_HDB_DBTYPE_ENUM {
00088 TSK_HDB_DBTYPE_NSRL_ID = 1,
00089 TSK_HDB_DBTYPE_MD5SUM_ID = 2,
00090 TSK_HDB_DBTYPE_HK_ID = 3,
00091 TSK_HDB_DBTYPE_IDXONLY_ID = 4
00092 };
00093 typedef enum TSK_HDB_DBTYPE_ENUM TSK_HDB_DBTYPE_ENUM;
00094
00095
00096
00097 #define TSK_HDB_DBTYPE_NSRL_STR "nsrl"
00098 #define TSK_HDB_DBTYPE_NSRL_MD5_STR "nsrl-md5"
00099 #define TSK_HDB_DBTYPE_NSRL_SHA1_STR "nsrl-sha1"
00100 #define TSK_HDB_DBTYPE_MD5SUM_STR "md5sum"
00101 #define TSK_HDB_DBTYPE_HK_STR "hk"
00102
00103 #define TSK_HDB_DBTYPE_SUPPORT_STR "nsrl-md5, nsrl-sha1, md5sum, hk"
00104
00105
00106 typedef struct TSK_HDB_INFO TSK_HDB_INFO;
00107
00108 typedef uint8_t(*TSK_HDB_LOOKUP_FN) (TSK_HDB_INFO *, char *hash,
00109 char *name, void *);
00110
00115 struct TSK_HDB_INFO {
00116
00117 TSK_TCHAR *db_fname;
00118
00119 TSK_TCHAR *uns_fname;
00120
00121 FILE *hDb;
00122 FILE *hIdxTmp;
00123 FILE *hIdx;
00124
00125 OFF_T idx_size;
00126 uint16_t idx_off;
00127 size_t idx_llen;
00128 char *idx_lbuf;
00129 TSK_TCHAR *idx_fname;
00130
00131 TSK_HDB_HTYPE_ENUM hash_type;
00132 uint16_t hash_len;
00133
00134 TSK_HDB_DBTYPE_ENUM db_type;
00135
00136 uint8_t(*getentry) (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *);
00137 uint8_t(*makeindex) (TSK_HDB_INFO *, TSK_TCHAR *);
00138 };
00139
00143 enum TSK_HDB_OPEN_ENUM {
00144 TSK_HDB_OPEN_NONE = 0,
00145 TSK_HDB_OPEN_IDXONLY = (0x1 << 0)
00146 };
00147 typedef enum TSK_HDB_OPEN_ENUM TSK_HDB_OPEN_ENUM;
00148
00149
00150 extern TSK_HDB_INFO *tsk_hdb_open(TSK_TCHAR * db_file,
00151 TSK_HDB_OPEN_ENUM flags);
00152 extern void tsk_hdb_close(TSK_HDB_INFO * hdb);
00153
00154 extern uint8_t tsk_hdb_hasindex(TSK_HDB_INFO *, uint8_t htype);
00155
00156
00157
00158 extern int8_t tsk_hdb_lookup(TSK_HDB_INFO *, char *, TSK_HDB_FLAG_ENUM,
00159 TSK_HDB_LOOKUP_FN, void *);
00160
00161 extern int8_t tsk_hdb_lookup_raw(TSK_HDB_INFO *, uint8_t * hash,
00162 uint8_t len, TSK_HDB_FLAG_ENUM,
00163 TSK_HDB_LOOKUP_FN, void *);
00164
00165 #ifdef __cplusplus
00166 }
00167 #endif
00168 #endif