wxtla 0.3.1

Wired eXploring Target Layer Accessor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

//! APFS container driver and probe registration.

mod btree;
mod container;
mod crypto;
mod datasource;
mod driver;
mod filesystem;
mod group;
mod helpers;
mod keybag;
mod ondisk;
mod records;

use container::probe_apfs_container;
pub use container::{ApfsContainer, ApfsObjectMapInfo, ApfsVolume, ApfsVolumeInfo};
pub use driver::ApfsDriver;
pub use filesystem::{
  ApfsExtendedAttribute, ApfsNodeDetails, ApfsSnapshotInfo, ApfsSpecialFileKind,
};
pub use group::{ApfsFirmlink, ApfsVolumeGroupInfo, ApfsVolumeGroupMember, ApfsVolumeGroupView};
pub use keybag::{ApfsKeybagEntryHeader, ApfsKeybagLockerHeader};
pub use ondisk::{
  ApfsChangeInfo, ApfsCheckpointMap, ApfsCheckpointMapping, ApfsIntegrityMetadata,
  ApfsMetaCryptoState, ApfsPrange,
};
pub use records::{APFS_FILE_INFO_DATA_HASH, ApfsFileInfoRecord};

use crate::{
  FormatDescriptor, FormatKind, FormatProbe, ProbeConfidence, ProbeContext, ProbeMatch,
  ProbeRegistry, ProbeResult, Result,
};

/// APFS filesystem descriptor.
pub const DESCRIPTOR: FormatDescriptor =
  FormatDescriptor::new("filesystem.apfs", FormatKind::FileSystem);

inventory::submit! {
  crate::formats::FormatInventoryEntry::new(DESCRIPTOR, register_probes)
}

fn register_probes(registry: &mut ProbeRegistry) {
  registry.register(ApfsProbe);
}

struct ApfsProbe;

impl FormatProbe for ApfsProbe {
  fn descriptor(&self) -> FormatDescriptor {
    DESCRIPTOR
  }

  fn probe(&self, context: &ProbeContext<'_>) -> Result<ProbeResult> {
    if probe_apfs_container(context.source())? {
      Ok(ProbeResult::matched(ProbeMatch::new(
        DESCRIPTOR,
        ProbeConfidence::Exact,
        "apfs container superblock layout is valid",
      )))
    } else {
      Ok(ProbeResult::rejected())
    }
  }
}

#[cfg(test)]
mod tests {
  use std::{fs::File, io::Read};

  use flate2::read::GzDecoder;

  use super::*;
  use crate::{ByteSource, BytesDataSource, formats};

  fn fixture_gzip_bytes(name: &str) -> Vec<u8> {
    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
      .join("formats")
      .join("apfs")
      .join("dissect.apfs")
      .join(name);
    let file = File::open(path).unwrap();
    let mut decoder = GzDecoder::new(file);
    let mut bytes = Vec::new();
    decoder.read_to_end(&mut bytes).unwrap();
    bytes
  }

  #[test]
  fn probe_matches_decompressed_apfs_fixture() {
    let registry = formats::probe_registry_from_inventory(formats::builtin_inventory());
    let source = BytesDataSource::new(fixture_gzip_bytes("case_insensitive.bin.gz"));

    let probe_match = registry
      .probe_best(&source as &dyn ByteSource)
      .unwrap()
      .unwrap();
    assert_eq!(probe_match.format, DESCRIPTOR);
  }
}