--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
+#
+# GPT Partition table patterns.
+# Author: Rogier Goossens (goossens.rogier@gmail.com)
+# Note that a GPT-formatted disk must contain an MBR as well.
+#
+
+# The initial segment (up to >>>>>>>>422) was copied from the X86
+# partition table code (aka MBR).
+# This is kept separate, so that MBR partitions are not reported as well.
+# (use -k if you do want them as well)
+
+# First, detect the MBR partiton table
+# If more than one GPT protective MBR partition exists, don't print anything
+# (the other MBR detection code will then just print the MBR partition table)
+0x1FE leshort 0xAA55
+>3 string !MS
+>>3 string !SYSLINUX
+>>>3 string !MTOOL
+>>>>3 string !NEWLDR
+>>>>>5 string !DOS
+# not FAT (32 bit)
+>>>>>>82 string !FAT32
+#not Linux kernel
+>>>>>>>514 string !HdrS
+#not BeOS
+>>>>>>>>422 string !Be\ Boot\ Loader
+# GPT with protective MBR entry in partition 1 (only)
+>>>>>>>>>450 ubyte 0xee
+>>>>>>>>>>466 ubyte !0xee
+>>>>>>>>>>>482 ubyte !0xee
+>>>>>>>>>>>>498 ubyte !0xee
+#>>>>>>>>>>>>>446 use gpt-mbr-partition
+>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+# GPT with protective MBR entry in partition 2 (only)
+>>>>>>>>>450 ubyte !0xee
+>>>>>>>>>>466 ubyte 0xee
+>>>>>>>>>>>482 ubyte !0xee
+>>>>>>>>>>>>498 ubyte !0xee
+#>>>>>>>>>>>>>462 use gpt-mbr-partition
+>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+# GPT with protective MBR entry in partition 3 (only)
+>>>>>>>>>450 ubyte !0xee
+>>>>>>>>>>466 ubyte !0xee
+>>>>>>>>>>>482 ubyte 0xee
+>>>>>>>>>>>>498 ubyte !0xee
+#>>>>>>>>>>>>>478 use gpt-mbr-partition
+>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+# GPT with protective MBR entry in partition 4 (only)
+>>>>>>>>>450 ubyte !0xee
+>>>>>>>>>>466 ubyte !0xee
+>>>>>>>>>>>482 ubyte !0xee
+>>>>>>>>>>>>498 ubyte 0xee
+#>>>>>>>>>>>>>494 use gpt-mbr-partition
+>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+
+# The following code does GPT detection and processing, including
+# sector size detection.
+# It has to be duplicated above because the top-level pattern
+# (i.e. not called using 'use') must print *something* for file
+# to count it as a match. Text only printed in named patterns is
+# not counted, and causes file to continue, and try and match
+# other patterns.
+#
+# Unfortunately, when assuming sector sizes >=16k, if the sector size
+# happens to be 512 instead, we may find confusing data after the GPT
+# table... If the GPT table has less than 128 entries, this may even
+# happen for assumed sector sizes as small as 4k
+# This could be solved by checking for the presence of the backup GPT
+# header as well, but that makes the logic extremely complex
+##0 name gpt-mbr-partition
+##>(8.l*8192) string EFI\ PART
+##>>(8.l*8192) use gpt-mbr-type
+##>>&-8 use gpt-table
+##>>0 ubyte x of 8192 bytes
+##>(8.l*8192) string !EFI\ PART
+##>>(8.l*4096) string EFI\ PART GPT partition table
+##>>>0 use gpt-mbr-type
+##>>>&-8 use gpt-table
+##>>>0 ubyte x of 4096 bytes
+##>>(8.l*4096) string !EFI\ PART
+##>>>(8.l*2048) string EFI\ PART GPT partition table
+##>>>>0 use gpt-mbr-type
+##>>>>&-8 use gpt-table
+##>>>>0 ubyte x of 2048 bytes
+##>>>(8.l*2048) string !EFI\ PART
+##>>>>(8.l*1024) string EFI\ PART GPT partition table
+##>>>>>0 use gpt-mbr-type
+##>>>>>&-8 use gpt-table
+##>>>>>0 ubyte x of 1024 bytes
+##>>>>(8.l*1024) string !EFI\ PART
+##>>>>>(8.l*512) string EFI\ PART GPT partition table
+##>>>>>>0 use gpt-mbr-type
+##>>>>>>&-8 use gpt-table
+##>>>>>>0 ubyte x of 512 bytes
+
+# Print details of MBR type for a GPT-disk
+# Calling code ensures that there is only one 0xee partition.
+0 name gpt-mbr-type
+# GPT with protective MBR entry in partition 1
+>450 ubyte 0xee
+>>454 ulelong 1
+>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>454 ulelong !1 \b (nonstandard: not at LBA 1)
+# GPT with protective MBR entry in partition 2
+>466 ubyte 0xee
+>>470 ulelong 1
+>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>470 ulelong !1 \b (nonstandard: not at LBA 1)
+# GPT with protective MBR entry in partition 3
+>482 ubyte 0xee
+>>486 ulelong 1
+>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>486 ulelong !1 \b (nonstandard: not at LBA 1)
+# GPT with protective MBR entry in partition 4
+>498 ubyte 0xee
+>>502 ulelong 1
+>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>502 ulelong !1 \b (nonstandard: not at LBA 1)
+
+# Print the information from a GPT partition table structure
+0 name gpt-table
+>10 uleshort x \b, version %u
+>8 uleshort x \b.%u
+# a GUID is just like a UUID, except it's displayed mixed-endian.
+>56 ulelong x \b, GUID: %08x
+>60 uleshort x \b-%04x
+>62 uleshort x \b-%04x
+>64 ubeshort x \b-%04x
+>66 ubeshort x \b-%04x
+>68 ubelong x \b%08x
+#>80 uleshort x \b, %d partition entries
+>32 ulequad+1 x \b, disk size: %lld sectors
+
+# In case a GPT data-structure is at LBA 0, report it as well
+# This covers systems which are not GPT-aware, and which show
+# and allow access to the protective partition. This code will
+# detect the contents of such a partition.
+0 string EFI\ PART GPT data structure (nonstandard: at LBA 0)
+>0 use gpt-table
+>0 ubyte x (sector size unknown)
+
+
projects / file / commitdiff