mstoeck3/fscalc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix ntfs, bundle cyberchef

Browse Source
This commit is contained in:
overcuriousity
2025-10-27 17:21:12 +01:00
parent 8fdb737ea8
commit 425206cd37
130 changed files with 24927 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
webroot/js/filesystems/ntfs.js
View File

@@ -46,8 +46,7 @@ export class NTFSFilesystem extends BaseFilesystem {
name: 'Spezifischer MFT-Eintrag',
results: [
{ id: 'mftEntryOffsetNTFS', label: 'MFT-Eintrag Offset', dependencies: ['baseOffsetNTFS', 'mftStartClusterNTFS', 'sectorSizeNTFS', 'clusterSizeSectorsNTFS', 'mftEntrySizeRawNTFS', 'mftEntryNumberNTFS'], formula: 'MFT Start + (MFT-Eintrags-Nummer × MFT-Eintrag Größe)' },
{ id: 'mftHeaderAttributeListPtrNTFS', label: 'Position 0x14 im MFT-Header (wo zu lesen)', dependencies: ['baseOffsetNTFS', 'mftStartClusterNTFS', 'sectorSizeNTFS', 'clusterSizeSectorsNTFS', 'mftEntrySizeRawNTFS', 'mftEntryNumberNTFS'], formula: 'MFT-Eintrag Offset + 0x14' },
{ id: 'calculatedAttributeStartNTFS', label: 'Tatsächlicher Attribut-Start (berechnet)', dependencies: ['baseOffsetNTFS', 'mftStartClusterNTFS', 'sectorSizeNTFS', 'clusterSizeSectorsNTFS', 'mftEntrySizeRawNTFS', 'mftEntryNumberNTFS', 'attributeListPosValueNTFS'], formula: 'MFT-Eintrag Offset + (gelesener Wert)' },
{ id: 'calculatedAttributeStartNTFS', label: 'Attribut-Liste', dependencies: ['baseOffsetNTFS', 'mftStartClusterNTFS', 'sectorSizeNTFS', 'clusterSizeSectorsNTFS', 'mftEntrySizeRawNTFS', 'mftEntryNumberNTFS', 'attributeListPosValueNTFS'], formula: 'MFT-Eintrag Offset + (gelesener Wert)' },
{ id: 'specificAttributeOffsetNTFS', label: 'Spezifisches Attribut Offset', dependencies: ['baseOffsetNTFS', 'mftStartClusterNTFS', 'sectorSizeNTFS', 'clusterSizeSectorsNTFS', 'mftEntrySizeRawNTFS', 'mftEntryNumberNTFS', 'attributeOffsetNTFS'], formula: 'MFT-Eintrag Offset + Attribut-Offset' }
]
},
@@ -218,11 +217,6 @@ export class NTFSFilesystem extends BaseFilesystem {
updateResultItem('mftEntryOffsetNTFS', { bytes: results.mftEntryOffset, sectors: results.mftEntryOffsetSector }, true,
`0x${results.mftStartOffset.toString(16).toUpperCase()} + (0x${values.mftEntryNumberNTFS.toString(16).toUpperCase()} × 0x${results.mftEntrySizeBytes.toString(16).toUpperCase()}) = 0x${results.mftEntryOffset.toString(16).toUpperCase()}`);
// Offset 0x14: Address of the pointer to attribute list
results.mftHeaderAttributeListPtr = results.mftEntryOffset + 0x14;
updateResultItem('mftHeaderAttributeListPtrNTFS', results.mftHeaderAttributeListPtr, true,
`0x${results.mftEntryOffset.toString(16).toUpperCase()} + 0x14 = 0x${results.mftHeaderAttributeListPtr.toString(16).toUpperCase()} (lies 2 Bytes an dieser Adresse)`);
// Calculated Attribute Start (if user provides the value read from 0x14)
if (checkDependencies(['attributeListPosValueNTFS'])) {
results.calculatedAttributeStart = results.mftEntryOffset + values.attributeListPosValueNTFS;
@@ -246,7 +240,6 @@ export class NTFSFilesystem extends BaseFilesystem {
}
} else {
updateResultItem('mftEntryOffsetNTFS', 0, false);
updateResultItem('mftHeaderAttributeListPtrNTFS', 0, false);
updateResultItem('calculatedAttributeStartNTFS', 0, false);
updateResultItem('specificAttributeOffsetNTFS', 0, false);
}