Skip to content

Instantly share code, notes, and snippets.

@futpib
Forked from countingpine/ext2scan.c
Last active September 6, 2022 12:09
Show Gist options
  • Save futpib/cfb04a9843b8f176d5c2ed3364fc8527 to your computer and use it in GitHub Desktop.
Save futpib/cfb04a9843b8f176d5c2ed3364fc8527 to your computer and use it in GitHub Desktop.
ext2scan: scan for ext2/ext3/ext4 partitions
/* ext2scan:
* Scans an input stream, sector by sector, for something that looks like an ext{2,3,4} partition.
* It does this by looking for a magic WORD, 0xEF53, at a known offset into the sector.
* For random data, this will occur by chance around once per 32MB of data, so we also
* check whether the first two sectors are all zeros, which is commonly true for ext partitions.
*
* Compile with:
* gcc ./ext2scan.c -o ./ext2scan
*
* Example usage:
* dd if=/dev/sda [skip=$START_SECTOR] | ./ext2scan [$START_SECTOR]
*
* Or for more speed, use a larger block size:
* dd if=/dev/sda bs=1M [iflag=skip_bytes skip=$(($START_SECTOR*512))] | ./ext2scan [$START_SECTOR]
*
* References:
* - http://unix.stackexchange.com/questions/103919/how-do-i-find-the-offset-of-an-ext4-filesystem
* - http://uranus.chrysocome.net/explore2fs/es2fs.htm
*/
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int main(int arg_c, char **arg_v) {
unsigned char const MAGIC[2] = {0x53, 0xef};
unsigned char const CREATOR_OS_LINUX[4] = {0x00, 0x00, 0x00, 0x00};
char buf[4][512];
long long int sector = 0;
long long int offset = 0;
if (arg_c == 2) sscanf(arg_v[1], "%lld", &offset);
while (read(STDIN_FILENO, buf[sector&3], 512) > 0) {
if (!memcmp(buf[sector&3] + 0x38, MAGIC, 2)) {
if (!memcmp(buf[sector&3] + 0x48, CREATOR_OS_LINUX, 4)) {
printf("Found a superblock (or a backup) with linux creator at sector %lld\n", ((offset+sector) * 512) / 4096);
}
}
sector++;
}
}
@jsarenik
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment