Re: Cannot Find the Root Inode of a JFS Disk

On 04/15/2015 04:27 AM, Felipe Monteiro de Carvalho wrote:
> Hello,
> 
> I am implementing a software to read JFS partitions in Windows/Mac OS
> X. Only reading, no writing involved.
> 
> It works already for many partitions, but someone sent me a disk, and
> this is something wrong with my interpretation of the JFS
> documentation or something like that, because for this particular
> disk, it doesn't work =(
> 
> I read in this order:
> 
> 1> Aggregate Map -> Always from offset A000
> 
> 2> Fileset zero inode -> Always from offset D000
> 
> Here I read _xtroot: xtpage_t; in this inode to obtain the next
> address. See the screenshot:
> 
> http://magnifier.sourceforge.net/tmp/jfs_fileset_zero_inode.png
> 
> And the data that I read here (data in the comments):
> 
> xtpage_t->xtpage_t = packed record
> xtpage_t->case Integer of 0: (
> // struct xtheader {
> xtpage_t->next: le64; //  0
> xtpage_t->prev: le64; //  0
> xtpage_t->flag: Byte; //  $85

flag = 0x85 - DXD_INDEX | BT_INTERNAL | BT_ROOT

This is an internal node of the xtree. This node is pointing to other
xtree nodes.

> xtpage_t->rsrvd1: Byte; //  0
> xtpage_t->nextindex: le16; //  3

slot 3 is the first unused slot. Only slot 2 is valid.

> xtpage_t->maxentry: le16; //  $12
> xtpage_t->rsrvd2: le16; //  0
> xtpage_t->self: pxd_t; // 0
> xtpage_t-> );
> 
> xtpage_t->xad[2] => xad_t
> xad_t->flag: Byte; //  0
> xad_t->rsvrd: uint16; //  0
> xad_t->off1: Byte; //  0
> xad_t->off2: le32; //  0
> xad_t->len: array[0..2] of Byte; // 1
> xad_t->addr1: Byte; //  0
> xad_t->addr2: le32; // 2754
> xad_t->addr calculated: 0x2754000

Look for another xtree page at block 0x2754000

> 
> xtpage_t->xad[3] => xad_t = packed record
> xad_t->flag: Byte; // 1: flag */ 0
> xad_t->rsvrd: uint16; // 2: reserved */ 0
> xad_t->off1: Byte; // 1: offset in unit of fsblksize */ 0
> xad_t->off2: le32; // 4: offset in unit of fsblksize */ 2
> xad_t->len: array[0..2] of Byte; // 3: length in unit of fsblksize */ 1
> xad_t->addr1: Byte; // 1: address in unit of fsblksize */ 0
> xad_t->addr2: le32; // 4: address in unit of fsblksize */ } 2000
> xad_t->addr calculated: 0x2000000
> 
> xtpage_t->xad[4] => xad_t = packed record
> brings addr 0x4000000
> etc
> 
> So my interpretation of the data is:
> 
> A> xad[2] is the control page
> B> xad[3] is the Fileset Zero Inode Allocation Map
> 
> Wierd that xad[2] has len=1 and xad[3] has offset=2 ... very wierd, as
> if the actual data is missing....
> 
> 3> So now I am at the Fileset Zero Inode Allocation Map at offset 0x2000000
> 
> Screenshots:
> 
> http://magnifier.sourceforge.net/tmp/jfs_fileset_zero_map_1.png
> http://magnifier.sourceforge.net/tmp/jfs_fileset_zero_map_2.png
> 
>>From it I read the following structures:
> 
> inoext[0]
> ->pxd_t.len: array[0..2] of Byte;// 4
> ->pxd_t.addr1: Byte;// 0
> ->pxd_t.addr2: le32; // 0x2004
> inoext[1]
> ->pxd_t.len: array[0..2] of Byte; // 4
> ->pxd_t.addr1: Byte; // 0
> ->pxd_t.addr2: le32; // 0x200C
> inoext[2]
> ->pxd_t.len: array[0..2] of Byte; // 4
> ->pxd_t.addr1: Byte; // 0
> ->pxd_t.addr2: le32; // 0x37B4
> 
> My conclusion is:
> 
> A> The root inode is located at the address given by inoext[0] which
> is: 0x2004400
> 
> Now the problem:
> 
> 0x2004400 is *not* the root inode =( It is an empty inode
> 
> I manually searched the disk and I found the real Root Inode at 0x26400!
> 
> Using this information I manually searched the disk and I concluded
> that 0x2000000 is probably also not Fileset Zero Inode Map =( I found
> an Inode Map candidate at 0x2B000 which has: inoext[0].pxd_t.addr2 =
> 0x26
> 
> But then I look again at the Fileset Zero inode D000 and I cannot find
> anything wrong with my reading of its data =( It doesn't feature the
> hex value 0x2B at all.
> 
> Any ideas what I did wrong here? It must be something simple that I am
> getting wrong, but after hours and hours reading the hex data, I just
> cannot find =) Any tips appreciated.
> 
> thanks,
> 

------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF