def guess_block_size(image, chunk_size, oob_size, oob_offset): chunk_pairs = YaffsParser.extract_chunks(image, chunk_size, oob_size) chunks = [c for c, o in chunk_pairs[:1024]] oobs_bytes = YaffsParser.get_oob_bytes(image, chunks, oob_size) oobs = [YaffsOobTag(b, oob_offset) for b in oobs_bytes] prev = -1 counts = [] count = 0 for oob in oobs: if oob.block_seq != prev: if count > 0: counts.append(count) count = 1 prev = oob.block_seq else: count += 1 import collections size, freq = collections.Counter(counts).most_common(1)[0] if freq == 1: print "Unable to determine block size." return None print "Most likely block size: %d" % size return size
def get_headers(image, chunk_size, oob_size): chunk_pairs = YaffsParser.extract_chunks(image, chunk_size, oob_size) #First filter, The first byte should be 0x01 #Litte endian header_chunks = [YaffsHeader(c) for c, obb in chunk_pairs if c.get_bytes(4) == '\x01\00\00\00'] #Now use the second, slower filter. header_chunks = [c for c in header_chunks if YaffsHeader(c).is_valid()] return header_chunks
""" This is a quick script for trying to grab the start of the contacts2.db file by making some assumptions about the format of the oob.' The current numbers are hardcoded for the Via Forensics Droid Eris image. """ import Scanner, YaffsParser import sys # I found this manually object_id = '\xb4\x02\x00\x00' chunk_id = '\x01\x00\x00\00' image = sys.argv[1] print image chunk_pairs = YaffsParser.extract_chunks(image, 2048, 64) f = open(image, 'rb') for (chunk, oob_offset) in chunk_pairs: f.seek(oob_offset+34) if object_id == f.read(4) and chunk_id == f.read(4): print 'Found chunk 1' print chunk.get_bytes(3) f.close()