Uses ntfswalk and sleuthkit.
Fetch MFT, find offset, update code near cluster_to_byte_offset.
Example ntfswalk usage:
ntfswalk32 -mftfile ../mft.raw -out ntfswalk-results -csv -action_include_clusterinfo
| lorne@argon$ curl -vsL -o - http://www.python.org/ftp/python/2.7.6/Python-2.7.6.tgz | file - | |
| * Adding handle: conn: 0x7fd610803a00 | |
| * Adding handle: send: 0 | |
| * Adding handle: recv: 0 | |
| * Curl_addHandleToPipeline: length: 1 | |
| * - Conn 0 (0x7fd610803a00) send_pipe: 1, recv_pipe: 0 | |
| * About to connect() to www.python.org port 80 (#0) | |
| * Trying 82.94.164.162... | |
| * Connected to www.python.org (82.94.164.162) port 80 (#0) | |
| > GET /ftp/python/2.7.6/Python-2.7.6.tgz HTTP/1.1 |
| (ns gist.monad | |
| (use [clojure.algo.monads :only [domonad]])) | |
| (def <-) | |
| (defn transform-monad-syntax [body last-was-assign] | |
| (let [[v o e & r] body] | |
| (cond (empty? body) | |
| (if last-was-assign | |
| (throw (IllegalArgumentException. "last value in m-do must be expression")) |
| lorne@illumination$ curl -vLO http://www.w3.org/Library/Distribution/w3c-libwww-5.4.0.tgz | |
| * Adding handle: conn: 0x7fca5b80b600 | |
| * Adding handle: send: 0 | |
| * Adding handle: recv: 0 | |
| * Curl_addHandleToPipeline: length: 1 | |
| * - Conn 0 (0x7fca5b80b600) send_pipe: 1, recv_pipe: 0 | |
| % Total % Received % Xferd Average Speed Time Time Time Current | |
| Dload Upload Total Spent Left Speed | |
| 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* About to connect() to www.w3.org port 80 (#0) | |
| * Trying 128.30.52.37... |
| user=> (def input (take 10000 (cycle (map char (range (int \a) (int \z)))))) | |
| #'user/input | |
| user=> (bench (reduce str input)) | |
| Evaluation count : 1800 in 60 samples of 30 calls. | |
| Execution time mean : 33.756996 ms | |
| Execution time std-deviation : 278.588482 µs | |
| Execution time lower quantile : 33.542863 ms ( 2.5%) | |
| Execution time upper quantile : 34.797430 ms (97.5%) | |
| Overhead used : 4.038278 ns |
| --- ./xpra/codecs/enc_x264/enc_x264.c.orig 2013-08-06 21:11:22.000000000 +1200 | |
| +++ ./xpra/codecs/enc_x264/enc_x264.c 2013-08-23 17:08:56.000000000 +1200 | |
| @@ -17,7 +17,7 @@ | |
| #ifdef _WIN32 | |
| #define _STDINT_H | |
| #endif | |
| -#if !defined(__APPLE__) | |
| +#if !defined(__APPLE__) && !defined(__FreeBSD__) | |
| #include <malloc.h> | |
| #endif |
| [lorne@xenon ~]$ cat crashme.c | |
| #include <gtk/gtk.h> | |
| int main() { | |
| gdk_threads_init(); | |
| gtk_main(); | |
| } | |
| [lorne@xenon ~]$ cc -g `pkg-config --cflags --libs gtk+-2.0` -o crashme crashme.c | |
| [lorne@xenon ~]$ gdb ./crashme | |
| GNU gdb 6.1.1 [FreeBSD] | |
| Copyright 2004 Free Software Foundation, Inc. |
| [lorne@xenon ~]$ cat crashme.py | |
| #!/usr/local/bin/python2.7 | |
| import gtk.gdk | |
| gtk.gdk.threads_init() | |
| gtk.main() | |
| [lorne@xenon ~]$ ./crashme.py | |
| ** (process:95092): WARNING **: Trying to register gtype 'GMountMountFlags' as enum when in fact it is of type 'GFlags' | |
| ** (process:95092): WARNING **: Trying to register gtype 'GDriveStartFlags' as enum when in fact it is of type 'GFlags' |
| [lorne@xenon ~/xpra-new/xpra-0.10.1]$ PYTHONPATH=$PWD/install/lib/python /usr/local/bin/gdb /usr/local/bin/python2.7 | |
| GNU gdb (GDB) 7.6 [GDB v7.6 for FreeBSD] | |
| Copyright (C) 2013 Free Software Foundation, Inc. | |
| License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> | |
| This is free software: you are free to change and redistribute it. | |
| There is NO WARRANTY, to the extent permitted by law. Type "show copying" | |
| and "show warranty" for details. | |
| This GDB was configured as "x86_64-portbld-freebsd9.1". | |
| For bug reporting instructions, please see: | |
| <http://www.gnu.org/software/gdb/bugs/>... |
| #!/bin/sh | |
| if [ ! -d 'xpra' ]; then | |
| echo "Could not find xpra source dir" | |
| exit 1 | |
| fi | |
| XPRA_GTK_MAIN_FILES=` | |
| grep -r . -El -e '^[[:space:]]*gtk\.main\(\)[[:space:]]*$'` |
Uses ntfswalk and sleuthkit.
Fetch MFT, find offset, update code near cluster_to_byte_offset.
Example ntfswalk usage:
ntfswalk32 -mftfile ../mft.raw -out ntfswalk-results -csv -action_include_clusterinfo