From 6610e0e95085f46f391b9b02cd0045a0dfac0290 Mon Sep 17 00:00:00 2001 From: Shiz Date: Thu, 30 Jan 2020 23:16:42 +0100 Subject: [PATCH] fix typos and duplicate packet --- exorcise/partition/ntfs/__init__.py | 15 +++++---------- exorcise/partition/ntfs/attributes.py | 2 +- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/exorcise/partition/ntfs/__init__.py b/exorcise/partition/ntfs/__init__.py index 5a70efa..b066233 100644 --- a/exorcise/partition/ntfs/__init__.py +++ b/exorcise/partition/ntfs/__init__.py @@ -10,7 +10,10 @@ from .mft import MFTRecord class IDPacket(Struct): magic = Sig(b'\x0E') - unk1 = Sig(bytes([1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])) + type = UInt(16) + unk3 = Data(4) + id = UInt(32) + unk4 = Data(4) footer = Sig(b'\x0F') class BufferPacket(Struct, generics=['D']): @@ -29,17 +32,9 @@ class BufferChecksumPacket(Struct): unk5 = Sig(bytes([0, 0, 0, 0])) footer = Sig(b'\x0B') -class MFTPacket(Struct): - magic = Sig(b'\x0E') - type = UInt(16) - unk3 = Data(4) - id = UInt(32) - unk4 = Data(4) - footer = Sig(b'\x0F') - class NTFSIndex(Struct): - header = MFTPacket + header = IDPacket b = Data(10) data = MFTRecord # NTFSPropertyTag.SMftRecordSize diff --git a/exorcise/partition/ntfs/attributes.py b/exorcise/partition/ntfs/attributes.py index 00f5ac1..77d04ea 100644 --- a/exorcise/partition/ntfs/attributes.py +++ b/exorcise/partition/ntfs/attributes.py @@ -224,7 +224,7 @@ class IndexRootAttribute(Struct): spec.node = IndexNode[Attribute.options[self.type]] @attribute(0xA0) -class IndexAllocationAttribute(Struct, generic=['G']): +class IndexAllocationAttribute(Struct, generics=['G']): nodes = Arr(IndexNode[G]) @attribute(0xB0)