[File] [PATCH] of Magdir/filesystems for 2nd NTFS sector; update+extensions *.bin

Jörg Jenderek joerg.jen.der.ek at gmx.net
Sat Apr 20 22:11:40 UTC 2019


Hello,

some days ago i run file command version 5.36 on sets of second NTFS
file system sectors (*-2.bin). Most are identified by rules inside
Magdir/filesystems based on infos on
https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
Unfortunately some like ramdisc150MB-2.bin are not detected and i got an
output like:

hda10-2.bin:        Microsoft Windows XP/VISTA bootloader NTLDR
hda2-CMLDR-2.bin:   Microsoft Windows XP/VISTA bootloader CMLDR
hdb2-ldr-2.bin:     Microsoft Windows XP/VISTA bootloader $LDR$
hde3-peboot-2.bin:  Microsoft Windows XP/VISTA bootloader PELDR
ramdisc150MB-2.bin: data
ramdisc150MB.bin:   DOS/MBR boot sector, code offset 0x52+2,
 OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8,
 sectors/track 32, heads 64, hidden sectors 128,
 dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor)
 ; NTFS, sectors/track 32, sectors 301055, $MFT start cluster 12544,
 $MFTMirror start cluster 2, bytes/RecordSegment 2^(-1*246),
 clusters/index block 1, serial number 0809e9bb79e9ba3e6
hda10-NTLDR.bin:    DOS/MBR boot sector, code offset 0x52+2,
 OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8,
 sectors/track 63, heads 255, hidden sectors 63,
 dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor)
 ; NTFS, sectors/track 63, sectors 43712801, $MFT start cluster 786432,
 $MFTMirror start cluster 2732050, bytes/RecordSegment 2^(-1*246),
 clusters/index block 1, serial number 0de4c15b94c158d81
 ; containsMicrosoft Windows XP/VISTA bootloader NTLDR

Furthermore with --extension option only ??? is displayed.

In Microsoft's sector recognition starts with looking for byte sequences
for assembler instructions short JUMP y2;NOP;NOP
 0x056		ulelong&0xFFFF0FFF	0x909002EB
Unfortunately some are not detected, because there other jump
instructions instead Jump 12h; nop; nop (0xEB129090) is used.
I am not an assembler programmer. So i am not able to understand
what is going on in these unusual sectors.
These sectors are found on NTFS formatted RAM discs created by
software found on
http://memory.dataram.com/products-and-services/software/ramdisk
This starts with other jump instruction "JMP C000;NOP". This is
expressed by line
 0x056		ulelong			0x9000c0e9	NTFS
Afterward now print filename extension by line
 !:ext		bin
Afterwards for both call sub routine to check for more characteristics
of second NTFS sector and then display loader name
 >0		use		ntfs-sector2
 0		name		ntfs-sector2
There now first check for number of utf16 characters of loader name by line
 >0		uleshort	<8
Then again check for jump instructions, because subroutine can be called
from other places by line
 >>0x056		ulelong&0xFF0000FD	0x900000E9
Now display UTF16 loader names like NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR.
First display 5 characters by line
 >>>0x002		lestring16	x	bootstrap %-5.5s
For loader name like BOOTMGR check for 7 character length and then
display remaining 2 characters by line
 >>>0		uleshort	7
 >>>>0x0c	lestring16	x	\b%-2.2s

I also changed text to something like "bootstrap NTLDR" instead
"Microsoft Windows XP/VISTA bootloader NTLDR" because the meaning was
misleading. The code in first NTFS sectors is something like first stage
boot loader part, which then loads second stage loader like NTLDR.

Normally second NTFS sectors is not stored alone, but is comes after 512
byte sized DOS boot sector as part of NFTS file system. This was done by
 looking for jump instructions part by lines
 >>>>>>>>>0x258	ulelong&0x00009090	=0x00009090
 >>>>>>>>>>&-92		indirect	x	\b; contains
Now i changed order of recognition magic lines. So look for UTF16 loader
name termination sequences CTRL-D and $. First make a jump with boot
loader name size by
 >>>>>>>>>(0x200.s*2)	ubyte				x
Then jump 1 block forward into second NTFS sector and check for
terminating bytes sequences by line
 >>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000
If 2nd NTFS sector is found then assume whole NTFS file system.
This gets other file name extension, expressed by line
 !:ext		img/bin/ntfs
Then call new sub routine by line
 >>>>>>>>>>>0x200	use	 		ntfs-sector2

After applying the above mentioned modifications by patch
file-5.36-filesystem-ntfs2.diff then all inspected examples are now
described like:

hda10-2.bin:        NTFS bootstrap NTLDR
hda2-CMLDR-2.bin:   NTFS bootstrap CMLDR
hdb2-ldr-2.bin:     NTFS bootstrap $LDR$
hde3-peboot-2.bin:  NTFS bootstrap PELDR
ramdisc150MB-2.bin: NTFS bootstrap BOOTMGR
ramdisc150MB.bin:   DOS/MBR boot sector, code offset 0x52+2,
 OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8,
 sectors/track 32, heads 64, hidden sectors 128,
 dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor)
 ; NTFS, sectors/track 32, sectors 301055, $MFT start cluster 12544,
 $MFTMirror start cluster 2, bytes/RecordSegment 2^(-1*246),
 clusters/index block 1, serial number 0809e9bb79e9ba3e6
 ; contains bootstrap BOOTMGR
hda10-NTLDR.bin:    DOS/MBR boot sector, code offset 0x52+2,
 OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8,
 sectors/track 63, heads 255, hidden sectors 63,
 dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor)
 ; NTFS, sectors/track 63, sectors 43712801, $MFT start cluster 786432,
 $MFTMirror start cluster 2732050, bytes/RecordSegment 2^(-1*246),
 clusters/index block 1, serial number 0de4c15b94c158d81
 ; contains bootstrap NTLDR


I hope my diff file can be applied in future version of file utility.

With best wishes
Jörg Jenderek





















-------------- next part --------------
--- file-5.36/magic/Magdir/filesystems.old	2018-12-10 21:06:53 +0000
+++ file-5.36/magic/Magdir/filesystems	2019-04-20 18:58:36 +0000
@@ -1541,14 +1541,35 @@
 #>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
->>>>>>>>>0x258	ulelong&0x00009090	=0x00009090
->>>>>>>>>>&-92		indirect	x	\b; contains
-# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
+# unicode loadername size jump
+>>>>>>>>>(0x200.s*2)	ubyte				x
+# in next sector loadername terminated by unicode CTRL-D and $
+>>>>>>>>>>&0x1FF	ulequad&0x0000FFffFFffFF00	0x0000002400040000 \b; contains
+# if 2nd NTFS sectors is found then assume whole filesystem
+#!:mime		application/x-raw-disk-image
+!:ext		img/bin/ntfs
+>>>>>>>>>>>0x200	use				ntfs-sector2
+
+# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
 # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
-# unused assembler instructions JMP y2;NOP;NOP
-0x056		ulelong&0xFFFF0FFF	0x909002EB
-# unicode loadername terminated by CTRL-D
->(0.s*2)	ulelong&0xFFFFFF00	0x00040000
+# unused assembler instructions short JMP y2;NOP;NOP
+0x056		ulelong&0xFFFF0FFF	0x909002EB	NTFS
+#!:mime		application/octet-stream
+!:ext		bin
+>0		use		ntfs-sector2
+# http://memory.dataram.com/products-and-services/software/ramdisk
+# assembler instructions JMP C000;NOP
+0x056		ulelong			0x9000c0e9	NTFS
+#!:mime		application/octet-stream
+!:ext		bin
+>0		use		ntfs-sector2
+# check for characteristics of second NTFS sector and then display loader name
+0		name		ntfs-sector2
+# number of utf16 characters of loadername
+>0		uleshort	<8
+# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
+>>0x056		ulelong&0xFF0000FD	0x900000E9
 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
->>0x002		lestring16	x	Microsoft Windows XP/VISTA bootloader %-5.5s
->>0x12		string		$
->>>0x0c		lestring16	x	\b%-2.2s
+>>>0x002		lestring16	x	bootstrap %-5.5s
+# check for 7 character length of loader name like BOOTMGR
+>>>0		uleshort	7
+>>>>0x0c	lestring16	x	\b%-2.2s
 ### DOS,NTFS boot sectors end


More information about the File mailing list