Difference between revisions of "Truxton child file get disk offset"
Jump to navigation
Jump to search
| Line 1: | Line 1: | ||
This retrieves the offset in the physical disk where the first byte of the file contents was stored. | This retrieves the offset in the physical disk where the first byte of the file contents was stored. | ||
| − | This corresponds to the <code>PhysicalDiskOffset</code> column of the <code>[[File Table | File]]</code> table. | + | This corresponds to the <code>[PhysicalDiskOffset]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table. |
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="C"> |
uint64_t truxton_child_file_get_disk_offset( uint64_t child_handle ); | uint64_t truxton_child_file_get_disk_offset( uint64_t child_handle ); | ||
| − | </ | + | </source> |
=Parameters= | =Parameters= | ||
==<code>child_handle</code>== | ==<code>child_handle</code>== | ||
| − | |||
The handle created by the [[truxton_child_file_create]] or [[truxton_file_create_child]] call. | The handle created by the [[truxton_child_file_create]] or [[truxton_file_create_child]] call. | ||
=Return value= | =Return value= | ||
| − | The offset, in bytes, where the first byte of file contents was | + | The offset, in bytes, where the first byte of file contents was found in the source media. |
=Remarks= | =Remarks= | ||
| Line 20: | Line 19: | ||
=Sample= | =Sample= | ||
| − | + | <source lang="C" highlight="35"> | |
| − | < | ||
void add_folder(uint64_t truxton, uint64_t parent_file) | void add_folder(uint64_t truxton, uint64_t parent_file) | ||
{ | { | ||
| Line 37: | Line 35: | ||
FILETIME now; | FILETIME now; | ||
| − | + | GetSystemTimePreciseAsFileTime(&now); | |
ULARGE_INTEGER ticks; | ULARGE_INTEGER ticks; | ||
| Line 62: | Line 60: | ||
truxton_child_file_destroy(child); | truxton_child_file_destroy(child); | ||
} | } | ||
| − | </ | + | </source> |
Note, the <code>PRIu64</code> in the sample code above is the new standard way of [https://en.wikipedia.org/wiki/C_data_types#Printf_and_scanf_format_specifiers formatting] a 64-bit integer in C. | Note, the <code>PRIu64</code> in the sample code above is the new standard way of [https://en.wikipedia.org/wiki/C_data_types#Printf_and_scanf_format_specifiers formatting] a 64-bit integer in C. | ||
Over the years, different compilers on different operating systems used different format specifiers for things, these <code>PRI</code> macros, along with some tricky string concatenation the compilers perform for you, allow you to maintain a single code base without a bunch of macro magic. | Over the years, different compilers on different operating systems used different format specifiers for things, these <code>PRI</code> macros, along with some tricky string concatenation the compilers perform for you, allow you to maintain a single code base without a bunch of macro magic. | ||
Revision as of 06:35, 13 November 2020
This retrieves the offset in the physical disk where the first byte of the file contents was stored.
This corresponds to the [PhysicalDiskOffset] column of the [File] table.
Syntax
uint64_t truxton_child_file_get_disk_offset( uint64_t child_handle );
Parameters
child_handle
The handle created by the truxton_child_file_create or truxton_file_create_child call.
Return value
The offset, in bytes, where the first byte of file contents was found in the source media.
Remarks
If the media being loaded was not some form of raw storage, this will return a non-zero value. Zero will be returned if the media wasn't a storage device (like a logical files).
Sample
void add_folder(uint64_t truxton, uint64_t parent_file)
{
truxton_start_adding_files(truxton);
uint64_t child = truxton_child_file_create(truxton);
char id[40];
truxton_file_get_id(parent_file, id, sizeof(id));
truxton_child_file_set_parent_id(child, id);
truxton_child_file_set_type(child, Type_Directory);
truxton_child_file_set_name(child, "Custom Exploits Folder");
FILETIME now;
GetSystemTimePreciseAsFileTime(&now);
ULARGE_INTEGER ticks;
ticks.LowPart = now.dwLowDateTime;
ticks.HighPart = now.dwHighDateTime;
truxton_child_file_set_created(child, ticks.QuadPart);
truxton_child_file_set_accessed(child, ticks.QuadPart);
truxton_child_file_set_modified(child, ticks.QuadPart);
truxton_child_file_set_origin(child, ORIGIN_GENERATED);
if ( truxton_child_file_save(child) == 0 )
{
printf( "Failed to add child to Truxton\n" );
}
else
{
ticks.QuadPart = truxton_child_file_get_disk_offset(child_file);
printf( "Physical Disk Offset was %" PRIu64 "\n", ticks.QuadPart );
}
truxton_child_file_destroy(child);
}
Note, the PRIu64 in the sample code above is the new standard way of formatting a 64-bit integer in C.
Over the years, different compilers on different operating systems used different format specifiers for things, these PRI macros, along with some tricky string concatenation the compilers perform for you, allow you to maintain a single code base without a bunch of macro magic.
