Mac Archive Type Sniffing

chrome/utility/safe_browsing/mac/udif.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_UTILITY_SAFE_BROWSING_MAC_UDIF_H_
 #define CHROME_UTILITY_SAFE_BROWSING_MAC_UDIF_H_
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <sys/types.h>
 
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "base/mac/scoped_cftyperef.h"
 #include "base/macros.h"
 
 namespace safe_browsing {
 namespace dmg {
 
 class ReadStream;
 class UDIFBlock;
 
+#pragma pack(push, 1)

[Robert Sesek, 2017/06/09 21:46:19]

Can this be left back in the .cc file now?

[mortonm, 2017/06/09 23:00:44]

I kept it in the .h since we want to maintain a private field (trailer_) that
stores the trailer for access in the future. For example, we will want to query
the DMG signature (and possibly other fields) and would rather not have to
re-parse the file if it had already been parsed. Does this make sense or is
there a better way to do this?

[mortonm, 2017/06/09 23:11:13]

I kept it in the .h since we want to maintain a private field (trailer_) that
stores the trailer for access in the future. For example, we will want to query
the DMG signature (and possibly other fields) and would rather not have to
re-parse the file if it had already been parsed. Does this make sense or is
there a better way to do this?

[Robert Sesek, 2017/06/12 16:38:39]

You can also heap-allocate it and store it as a unique_ptr member, and only
forward-declare the struct names.

[mortonm, 2017/06/12 18:31:16]

Done.

+
+// The following structures come from the analysis provided by Jonathan Levin
+// at <http://newosxbook.com/DMG.html>.
+//
+// Note that all fields are stored in big endian.
+
+struct UDIFChecksum {
+  uint32_t type;
+  uint32_t size;
+  uint32_t data[32];
+};
+
+// The trailer structure for a UDIF file.
+struct UDIFResourceFile {
+  static const uint32_t kSignature = 'koly';
+  static const uint32_t kVersion = 4;
+
+  uint32_t signature;
+  uint32_t version;
+  uint32_t header_size;  // Size of this structure.
+  uint32_t flags;
+  uint64_t running_data_fork_offset;
+  uint64_t data_fork_offset;
+  uint64_t data_fork_length;
+  uint64_t rsrc_fork_offset;
+  uint64_t rsrc_fork_length;
+  uint32_t segment_number;
+  uint32_t segment_count;
+  uuid_t segment_id;
+
+  UDIFChecksum data_checksum;
+
+  uint64_t plist_offset;  // Offset and length of the blkx plist.
+  uint64_t plist_length;
+
+  uint8_t reserved1[64];
+
+  uint64_t code_signature_offset;
+  uint64_t code_signature_length;
+
+  uint8_t reserved2[40];
+
+  UDIFChecksum master_checksum;
+
+  uint32_t image_variant;
+  uint64_t sector_count;
+
+  uint32_t reserved3;
+  uint32_t reserved4;
+  uint32_t reserved5;
+};
+
+#pragma pack(pop)
+
 // UDIFParser parses a Universal Disk Image Format file, allowing access to the
 // name, types, and data of the partitions held within the file. There is no
 // canonical documentation for UDIF, and not all disk images use UDIF (though
 // the majority do). Note that this implementation only handles UDIF and SPARSE
 // image types, not SPARSEBUNDLE.
 //
 // No guarantees are made about the position of ReadStream when using an
 // instance of this class.
 //
 // Note that this implementation relies on the UDIF blkx table to provide
 // accurate partition information. Otherwise, Apple Partition Map and
 // GUID would need to be parsed. See:
 //   - http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-182.1.1/IOApplePartitionScheme.h
 //   - http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-182.1.1/IOGUIDPartitionScheme.h
 //
 // The following references are useful for understanding the UDIF format:
 //   - http://newosxbook.com/DMG.html
 //   - http://www.macdisk.com/dmgen.php
 class UDIFParser {
  public:
   // Constructs an instance from a stream.
   explicit UDIFParser(ReadStream* stream);
   ~UDIFParser();
 
+  // Parses the trailer structure. Only actually parses data from the file the
+  // first time it is called -- after that just returns the previous result when
+  // parsing was attempted.
+  bool ParseTrailer();
+
   // Parses the UDIF file. This method must be called before any other method.
   // If this returns false, it is not legal to call any other methods.
   bool Parse();
 
   // Returns the number of partitions in this UDIF image.
   size_t GetNumberOfPartitions();
 
   // Returns the partition name for a given partition number, in the range of
   // [0,GetNumberOfPartitions()). This will include the number, name, and type
   // of partition. E.g., "disk image (Apple_HFS : 2)".
   std::string GetPartitionName(size_t part_number);
 
   // Returns the partition type as a string for the given partition number.
   // E.g., "Apple_HFS" and "Apple_Free".
   std::string GetPartitionType(size_t part_number);
 
   // Returns the size of the partition in bytes.
   size_t GetPartitionSize(size_t part_number);
 
   // Returns a stream of the raw partition data for the given partition
   // number.
   std::unique_ptr<ReadStream> GetPartitionReadStream(size_t part_number);
 
  private:
-  // Parses the blkx plist trailer structure.
+  // Parses the blkx plist structure.
   bool ParseBlkx();
 
   ReadStream* const stream_;  // The stream backing the UDIF image. Weak.
   std::vector<std::string> partition_names_;  // The names of all partitions.
   // All blocks in the UDIF image.
   std::vector<std::unique_ptr<const UDIFBlock>> blocks_;
   uint16_t block_size_;  // The image's block size, in bytes.
+  UDIFResourceFile trailer_;
+  bool trailer_successfully_parsed_;
 
   DISALLOW_COPY_AND_ASSIGN(UDIFParser);
 };
 
 }  // namespace dmg
 }  // namespace safe_browsing
 
 #endif  // CHROME_UTILITY_SAFE_BROWSING_MAC_UDIF_H_