def guess_block_size(image, chunk_size, oob_size, oob_offset):
chunk_pairs = YaffsParser.extract_chunks(image, chunk_size, oob_size)
chunks = [c for c, o in chunk_pairs[:1024]]
oobs_bytes = YaffsParser.get_oob_bytes(image, chunks, oob_size)
oobs = [YaffsOobTag(b, oob_offset) for b in oobs_bytes]
prev = -1
counts = []
count = 0
for oob in oobs:
if oob.block_seq != prev:
if count > 0:
counts.append(count)
count = 1
prev = oob.block_seq
else:
count += 1
import collections
size, freq = collections.Counter(counts).most_common(1)[0]
if freq == 1:
print "Unable to determine block size."
return None
print "Most likely block size: %d" % size
return size
def get_headers(image, chunk_size, oob_size):
chunk_pairs = YaffsParser.extract_chunks(image, chunk_size, oob_size)
#First filter, The first byte should be 0x01
#Litte endian
header_chunks = [YaffsHeader(c) for c, obb in chunk_pairs
if c.get_bytes(4) == '\x01\00\00\00']
#Now use the second, slower filter.
header_chunks = [c for c in header_chunks
if YaffsHeader(c).is_valid()]
return header_chunks
"""
This is a quick script for trying to grab the start of the contacts2.db
file by making some assumptions about the format of the oob.'
The current numbers are hardcoded for the Via Forensics Droid Eris image.
"""
import Scanner, YaffsParser
import sys
# I found this manually
object_id = '\xb4\x02\x00\x00'
chunk_id = '\x01\x00\x00\00'
image = sys.argv[1]
print image
chunk_pairs = YaffsParser.extract_chunks(image, 2048, 64)
f = open(image, 'rb')
for (chunk, oob_offset) in chunk_pairs:
f.seek(oob_offset+34)
if object_id == f.read(4) and chunk_id == f.read(4):
print 'Found chunk 1'
print chunk.get_bytes(3)
f.close()
