linux-ext4 - Re: Which features should I implement in my ext4 reader?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 28 Aug 2013 22:09:42 +0200
From:	Felipe Monteiro de Carvalho <felipemonteiro.carvalho@...il.com>
To:	Felipe Monteiro de Carvalho <felipemonteiro.carvalho@...il.com>,
	"Theodore Ts'o" <tytso@....edu>, linux-ext4@...r.kernel.org
Subject: Re: Which features should I implement in my ext4 reader?

Hello,

Any idea where to find the extra data over 60 bytes in a very small
file (for example 120 bytes) would be greatly appreciated ... I
already tried the extra space after the inode but there was nothing
useful there! =/ Or at least nothing that matched the description of
the extended attributes. It should start with a magic number, but
started with many zeroes =/

thanks,

Felipe Monteiro de Carvalho

On Fri, Aug 23, 2013 at 2:54 PM, Felipe Monteiro de Carvalho
<felipemonteiro.carvalho@...il.com> wrote:
> Hello,
>
> I went forward trying to implement this myself, but I am having trouble.
>
> Files up to 60 bytes work great, and large files too. But a file with
> 61 bytes does not.
>
> Reading ignoring the inline results in zero on all bytes, which can't
> be right, so I guess it is inlined.
>
> After the first 60 bytes I try to get the extended attribute, but
> i_file_acl_lo == FData.l_i_file_acl_high == 0
>
> And I think that it cannot possibly have the extended attribute data
> in block zero =/ (it contains DEADBEEF or something like that)
>
> Any ideas where I got this wrong or any tips about how to figure out
> in debugfs where the data is?
>
> thanks,
> --
> Felipe Monteiro de Carvalho



-- 
Felipe Monteiro de Carvalho
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html