linux-ext4 - RFC: "file" magic for ext4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 30 Jan 2008 11:19:59 -0600
From:	Eric Sandeen <sandeen@...hat.com>
To:	ext4 development <linux-ext4@...r.kernel.org>
Subject: RFC: "file" magic for ext4

This seems to work fine; any comments, either about
the logic, or the text descriptions, or the various
options I've shown/not shown?

To test, copy your "magic" file somewhere local, 
replace the ext2/3 section with the following,
and do something like:

# file -C -m magic; file -m ./magic -s /dev/sda1

-Eric

# ext2/ext3 filesystems - Andreas Dilger <adilger@...bolabs.com>
0x438   leshort         0xEF53          Linux
>0x44c  lelong          x               rev %d
>0x43e  leshort         x               \b.%d
# No journal?  ext2
>0x45c  lelong          ^0x0000004      ext2 filesystem data
>>0x43a leshort         ^0x0000001      (mounted or unclean)
# Has a journal?  ext3 or ext4
>0x45c  lelong          &0x0000004
#  and small INCOMPAT?
>>0x460 lelong          <0x0000040
#   and small RO_COMPAT?
>>>0x464 lelong         <0x0000008      ext3 filesystem data
#   else large RO_COMPAT?
>>>0x464 lelong         >0x0000007      ext4 filesystem data
#  else large INCOMPAT?
>>0x460 lelong          >0x000003f      ext4 filesystem data
# General flags for any ext* fs
>0x460  lelong          &0x0000004      (needs journal recovery)
>0x43a  leshort         &0x0000002      (errors)
# INCOMPAT flags
>0x460  lelong          &0x0000001      (compressed)
#>0x460 lelong          &0x0000002      (filetype)
#>0x460 lelong          &0x0000010      (meta bg)
>0x460  lelong          &0x0000040      (extents)
>0x460  lelong          &0x0000080      (64bit)
#>0x460 lelong          &0x0000100      (mmp)
#>0x460 lelong          &0x0000200      (flex bg)
# RO_INCOMPAT flags
#>0x464 lelong          &0x0000001      (sparse super)
>0x464  lelong          &0x0000002      (large files)
>0x464  lelong          &0x0000008      (huge files)
#>0x464 lelong          &0x0000010      (gdt checksum)
#>0x464 lelong          &0x0000020      (many subdirs)
#>0x463 lelong          &0x0000040      (extra isize)


-
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html