[File] [PATCH] of Magdir/windows for Microsoft System Deployment Image (boot.sdi)
Jörg Jenderek
joerg.jen.der.ek at gmx.net
Wed May 1 16:37:50 UTC 2019
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello,
some days ago i run version 5.36 on Windows recovery drive inside boot
directory. The boot loader file "boot.sdi" is only described as "data".
So i add lines to Magdir/windows. Unfortunately there exist no official
documentation about file format by Microsoft, but some information is
found on Wikipedia. So add comment line like
# URL: http://en.wikipedia.org/wiki/System_Deployment_Image
There a link to Sergii Kolisnyk "SDI file format specification" is
mentioned. So use that as reference, expressed by comment line
# Reference: http://skolk.livejournal.com/1320.html
According to that side SDI files start with magic+version bytes. That is
expressed by lines
0 string $SDI
>4 string 0001 System Deployment Image
Afterwards display file name extension and user defined mime type by lin
es:
!:mime application/x-ms-sdi
!:ext sdi
Unfortunately i myself found only one SDI example. So i can not verify
what fields are important. For my example many field are empty. So print
values only in not empty like
>>8 ulequad !0 \b, MDBtype 0x%llx
>>112 ulequad !0 \b, PageAlignment %llu
Of interest is the table of contents starting at offset 0x400. Each
entry for a blob occupies 0x40 bytes. Each entry start with a 8 byte
null padded type identifier like PART, WIM , BOOT, LOAD or DISK. So for
first blob this is shown by line
>>0x400 string >\0 \b, type %-3.8s
The numeric typ ( where 0 means non-file-system, 7 means NTFS file
system and 6 means BIGFAT) is shown by line like
>>>0x420 ulequad !0 (0x%llx)
The offset and size of first blob is shown by lines like
>>>0x410 ulequad x at 0x%llx
>>>0x418 ulequad >0 %llu bytes
For my example first blob was NTFS file system. So inspect this embedded
part by calling Magdir/filesystems by pointer expression like:
>>>>(0x410.l) indirect x
Then repeat procedure for second blob starting with line like
>>0x440 string >\0 \b, type %-3.8s
For my example this was an empty zero sized WIM image.
A possible third embedded blob is shown by magics starting
with line like:
>>0x480 string >\0 \b, type %-3.8s
After applying the above mentioned modifications by patch
file-5.36-windows-sdi.diff then SDI example is described like:
boot.sdi: System Deployment Image, PageAlignment 2, checksum 0x39,
type PART (0x7) at 0x2000 3161088 bytes DOS/MBR boot sector, code
offset 0x52+2, OEM-ID "NTFS ",
Media descriptor 0xf8, sectors/track 2, heads 16, hidden sectors 2,
dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor);
NTFS, sectors/track 2, sectors 6173, $MFT start cluster 2058, $MFTMirror
start cluster 5162, clusters/RecordSegment 2, clusters/index block 8,
serial number 050d60a27d60a0dc2; contains bootstrap NTLDR,
type WIM at 0x306000
I hope my diff file can be applied in future version of
file utility.
With best wishes
Jörg Jenderek
- --
Jörg Jenderek
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCXMnLVQAKCRCv8rHJQhrU
1vN+AJ9AhNIhEPTqlt4b2H4Ud9bP/yb1pQCfQAbuxslxjHiqOBlKRPF8Wm5C2io=
=sKat
-----END PGP SIGNATURE-----
-------------- next part --------------
--- file-5.36/magic/Magdir/windows.old 2019-01-11 21:00:26 +0000
+++ file-5.36/magic/Magdir/windows 2019-05-01 15:09:09 +0000
@@ -58,2 +58,65 @@
+# Summary: Windows System Deployment Image
+# Created by: Joerg Jenderek
+# URL: http://en.wikipedia.org/wiki/System_Deployment_Image
+# Reference: http://skolk.livejournal.com/1320.html
+0 string $SDI
+>4 string 0001 System Deployment Image
+!:mime application/x-ms-sdi
+#!:mime application/octet-stream
+# \Boot\boot.sdi
+!:ext sdi
+# MDBtype: 0~Unspecified 1~RAM 2~ROM
+>>8 ulequad !0 \b, MDBtype 0x%llx
+# BootCodeOffset
+>>16 ulequad !0 \b, BootCodeOffset 0x%llx
+# BootCodeSize
+>>24 ulequad !0 \b, BootCodeSize 0x%llx
+# VendorID
+>>32 ulequad !0 \b, VendorID 0x%llx
+# DeviceID
+>>40 ulequad !0 \b, DeviceID 0x%llx
+# DeviceModel
+>>48 ulequad !0 \b, DeviceModel 0x%llx
+>>>56 ulequad !0 \b%llx
+# DeviceRole
+>>64 ulequad !0 \b, DeviceRole 0x%llx
+# Reserved1; reserved fields and gaps between BLOBs are padded with \0
+#>>72 ulequad !0 \b, Reserved1 0x%llx
+# RuntimeGUID
+>>80 ulequad !0 \b, RuntimeGUID 0x%llx
+>>>88 ulequad !0 \b%llx
+# RuntimeOEMrev
+>>96 ulequad !0 \b, RuntimeOEMrev 0x%llx
+# Reserved2
+#>>104 ulequad !0 \b, Reserved2 0x%llx
+# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k
+>>112 ulequad !0 \b, PageAlignment %llu
+# Reserved3[48]
+#>>120 ulequad !0 \b, Reserved3 0x%llx
+# SDI checksum 39h
+>>0x1f8 ulequad x \b, checksum 0x%llx
+# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
+>>0x400 string >\0 \b, type %-3.8s
+# 0~non-filesystem 7~NTFS 6~BIGFAT
+>>>0x420 ulequad !0 (0x%llx)
+# ATTRibutes
+>>>0x408 ulequad !0 0x%llx attributes
+# Offset
+>>>0x410 ulequad x at 0x%llx
+# print 1 space after size and then handles NTFS boot sector by ./filesystems
+>>>0x418 ulequad >0 %llu bytes
+>>>>(0x410.l) indirect x
+# 2nd BLOB: WIM
+>>0x440 string >\0 \b, type %-3.8s
+>>>0x428 ulequad !0 (0x%llx)
+# ATTRibutes
+>>>0x448 ulequad !0 0x%llx attributes
+# Offset
+>>>0x450 ulequad x at 0x%llx
+>>>0x458 ulequad >0 %llu bytes
+>>>>(0x450.l) indirect x
+# 3rd BLOB
+>>0x480 string >\0 \b, type %-3.8s
+
# Summary: Windows Error Report text files
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.36-windows-sdi.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190501/360c2128/attachment.obj>
More information about the File
mailing list