1267843Sdelphij 2267843Sdelphij#------------------------------------------------------------------------------ 3267843Sdelphij# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $ 4267843Sdelphij# 5267843Sdelphij# GPT Partition table patterns. 6267843Sdelphij# Author: Rogier Goossens (goossens.rogier@gmail.com) 7267843Sdelphij# Note that a GPT-formatted disk must contain an MBR as well. 8267843Sdelphij# 9267843Sdelphij 10267843Sdelphij# The initial segment (up to >>>>>>>>422) was copied from the X86 11267843Sdelphij# partition table code (aka MBR). 12267843Sdelphij# This is kept separate, so that MBR partitions are not reported as well. 13267843Sdelphij# (use -k if you do want them as well) 14267843Sdelphij 15267843Sdelphij# First, detect the MBR partiton table 16267843Sdelphij# If more than one GPT protective MBR partition exists, don't print anything 17267843Sdelphij# (the other MBR detection code will then just print the MBR partition table) 18267843Sdelphij0x1FE leshort 0xAA55 19267843Sdelphij>3 string !MS 20267843Sdelphij>>3 string !SYSLINUX 21267843Sdelphij>>>3 string !MTOOL 22267843Sdelphij>>>>3 string !NEWLDR 23267843Sdelphij>>>>>5 string !DOS 24267843Sdelphij# not FAT (32 bit) 25267843Sdelphij>>>>>>82 string !FAT32 26267843Sdelphij#not Linux kernel 27267843Sdelphij>>>>>>>514 string !HdrS 28267843Sdelphij#not BeOS 29267843Sdelphij>>>>>>>>422 string !Be\ Boot\ Loader 30267843Sdelphij# GPT with protective MBR entry in partition 1 (only) 31267843Sdelphij>>>>>>>>>450 ubyte 0xee 32267843Sdelphij>>>>>>>>>>466 ubyte !0xee 33267843Sdelphij>>>>>>>>>>>482 ubyte !0xee 34267843Sdelphij>>>>>>>>>>>>498 ubyte !0xee 35267843Sdelphij#>>>>>>>>>>>>>446 use gpt-mbr-partition 36267843Sdelphij>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 37267843Sdelphij>>>>>>>>>>>>>>0 use gpt-mbr-type 38267843Sdelphij>>>>>>>>>>>>>>&-8 use gpt-table 39267843Sdelphij>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 40267843Sdelphij>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 41267843Sdelphij>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 42267843Sdelphij>>>>>>>>>>>>>>>0 use gpt-mbr-type 43267843Sdelphij>>>>>>>>>>>>>>>&-8 use gpt-table 44267843Sdelphij>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 45267843Sdelphij>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 46267843Sdelphij>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 47267843Sdelphij>>>>>>>>>>>>>>>>0 use gpt-mbr-type 48267843Sdelphij>>>>>>>>>>>>>>>>&-8 use gpt-table 49267843Sdelphij>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 50267843Sdelphij>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 51267843Sdelphij>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 52267843Sdelphij>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 53267843Sdelphij>>>>>>>>>>>>>>>>>&-8 use gpt-table 54267843Sdelphij>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 55267843Sdelphij>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 56267843Sdelphij>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 57267843Sdelphij>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 58267843Sdelphij>>>>>>>>>>>>>>>>>>&-8 use gpt-table 59267843Sdelphij>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 60267843Sdelphij# GPT with protective MBR entry in partition 2 (only) 61267843Sdelphij>>>>>>>>>450 ubyte !0xee 62267843Sdelphij>>>>>>>>>>466 ubyte 0xee 63267843Sdelphij>>>>>>>>>>>482 ubyte !0xee 64267843Sdelphij>>>>>>>>>>>>498 ubyte !0xee 65267843Sdelphij#>>>>>>>>>>>>>462 use gpt-mbr-partition 66267843Sdelphij>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 67267843Sdelphij>>>>>>>>>>>>>>0 use gpt-mbr-type 68267843Sdelphij>>>>>>>>>>>>>>&-8 use gpt-table 69267843Sdelphij>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 70267843Sdelphij>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 71267843Sdelphij>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 72267843Sdelphij>>>>>>>>>>>>>>>0 use gpt-mbr-type 73267843Sdelphij>>>>>>>>>>>>>>>&-8 use gpt-table 74267843Sdelphij>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 75267843Sdelphij>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 76267843Sdelphij>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 77267843Sdelphij>>>>>>>>>>>>>>>>0 use gpt-mbr-type 78267843Sdelphij>>>>>>>>>>>>>>>>&-8 use gpt-table 79267843Sdelphij>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 80267843Sdelphij>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 81267843Sdelphij>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 82267843Sdelphij>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 83267843Sdelphij>>>>>>>>>>>>>>>>>&-8 use gpt-table 84267843Sdelphij>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 85267843Sdelphij>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 86267843Sdelphij>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 87267843Sdelphij>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 88267843Sdelphij>>>>>>>>>>>>>>>>>>&-8 use gpt-table 89267843Sdelphij>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 90267843Sdelphij# GPT with protective MBR entry in partition 3 (only) 91267843Sdelphij>>>>>>>>>450 ubyte !0xee 92267843Sdelphij>>>>>>>>>>466 ubyte !0xee 93267843Sdelphij>>>>>>>>>>>482 ubyte 0xee 94267843Sdelphij>>>>>>>>>>>>498 ubyte !0xee 95267843Sdelphij#>>>>>>>>>>>>>478 use gpt-mbr-partition 96267843Sdelphij>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 97267843Sdelphij>>>>>>>>>>>>>>0 use gpt-mbr-type 98267843Sdelphij>>>>>>>>>>>>>>&-8 use gpt-table 99267843Sdelphij>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 100267843Sdelphij>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 101267843Sdelphij>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 102267843Sdelphij>>>>>>>>>>>>>>>0 use gpt-mbr-type 103267843Sdelphij>>>>>>>>>>>>>>>&-8 use gpt-table 104267843Sdelphij>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 105267843Sdelphij>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 106267843Sdelphij>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 107267843Sdelphij>>>>>>>>>>>>>>>>0 use gpt-mbr-type 108267843Sdelphij>>>>>>>>>>>>>>>>&-8 use gpt-table 109267843Sdelphij>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 110267843Sdelphij>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 111267843Sdelphij>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 112267843Sdelphij>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 113267843Sdelphij>>>>>>>>>>>>>>>>>&-8 use gpt-table 114267843Sdelphij>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 115267843Sdelphij>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 116267843Sdelphij>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 117267843Sdelphij>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 118267843Sdelphij>>>>>>>>>>>>>>>>>>&-8 use gpt-table 119267843Sdelphij>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 120267843Sdelphij# GPT with protective MBR entry in partition 4 (only) 121267843Sdelphij>>>>>>>>>450 ubyte !0xee 122267843Sdelphij>>>>>>>>>>466 ubyte !0xee 123267843Sdelphij>>>>>>>>>>>482 ubyte !0xee 124267843Sdelphij>>>>>>>>>>>>498 ubyte 0xee 125267843Sdelphij#>>>>>>>>>>>>>494 use gpt-mbr-partition 126267843Sdelphij>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 127267843Sdelphij>>>>>>>>>>>>>>0 use gpt-mbr-type 128267843Sdelphij>>>>>>>>>>>>>>&-8 use gpt-table 129267843Sdelphij>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 130267843Sdelphij>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 131267843Sdelphij>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 132267843Sdelphij>>>>>>>>>>>>>>>0 use gpt-mbr-type 133267843Sdelphij>>>>>>>>>>>>>>>&-8 use gpt-table 134267843Sdelphij>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 135267843Sdelphij>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 136267843Sdelphij>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 137267843Sdelphij>>>>>>>>>>>>>>>>0 use gpt-mbr-type 138267843Sdelphij>>>>>>>>>>>>>>>>&-8 use gpt-table 139267843Sdelphij>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 140267843Sdelphij>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 141267843Sdelphij>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 142267843Sdelphij>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 143267843Sdelphij>>>>>>>>>>>>>>>>>&-8 use gpt-table 144267843Sdelphij>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 145267843Sdelphij>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 146267843Sdelphij>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 147267843Sdelphij>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 148267843Sdelphij>>>>>>>>>>>>>>>>>>&-8 use gpt-table 149267843Sdelphij>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 150267843Sdelphij 151267843Sdelphij# The following code does GPT detection and processing, including 152267843Sdelphij# sector size detection. 153267843Sdelphij# It has to be duplicated above because the top-level pattern 154267843Sdelphij# (i.e. not called using 'use') must print *something* for file 155267843Sdelphij# to count it as a match. Text only printed in named patterns is 156267843Sdelphij# not counted, and causes file to continue, and try and match 157267843Sdelphij# other patterns. 158267843Sdelphij# 159267843Sdelphij# Unfortunately, when assuming sector sizes >=16k, if the sector size 160267843Sdelphij# happens to be 512 instead, we may find confusing data after the GPT 161267843Sdelphij# table... If the GPT table has less than 128 entries, this may even 162267843Sdelphij# happen for assumed sector sizes as small as 4k 163267843Sdelphij# This could be solved by checking for the presence of the backup GPT 164267843Sdelphij# header as well, but that makes the logic extremely complex 165267843Sdelphij##0 name gpt-mbr-partition 166267843Sdelphij##>(8.l*8192) string EFI\ PART 167267843Sdelphij##>>(8.l*8192) use gpt-mbr-type 168267843Sdelphij##>>&-8 use gpt-table 169267843Sdelphij##>>0 ubyte x of 8192 bytes 170267843Sdelphij##>(8.l*8192) string !EFI\ PART 171267843Sdelphij##>>(8.l*4096) string EFI\ PART GPT partition table 172267843Sdelphij##>>>0 use gpt-mbr-type 173267843Sdelphij##>>>&-8 use gpt-table 174267843Sdelphij##>>>0 ubyte x of 4096 bytes 175267843Sdelphij##>>(8.l*4096) string !EFI\ PART 176267843Sdelphij##>>>(8.l*2048) string EFI\ PART GPT partition table 177267843Sdelphij##>>>>0 use gpt-mbr-type 178267843Sdelphij##>>>>&-8 use gpt-table 179267843Sdelphij##>>>>0 ubyte x of 2048 bytes 180267843Sdelphij##>>>(8.l*2048) string !EFI\ PART 181267843Sdelphij##>>>>(8.l*1024) string EFI\ PART GPT partition table 182267843Sdelphij##>>>>>0 use gpt-mbr-type 183267843Sdelphij##>>>>>&-8 use gpt-table 184267843Sdelphij##>>>>>0 ubyte x of 1024 bytes 185267843Sdelphij##>>>>(8.l*1024) string !EFI\ PART 186267843Sdelphij##>>>>>(8.l*512) string EFI\ PART GPT partition table 187267843Sdelphij##>>>>>>0 use gpt-mbr-type 188267843Sdelphij##>>>>>>&-8 use gpt-table 189267843Sdelphij##>>>>>>0 ubyte x of 512 bytes 190267843Sdelphij 191267843Sdelphij# Print details of MBR type for a GPT-disk 192267843Sdelphij# Calling code ensures that there is only one 0xee partition. 193267843Sdelphij0 name gpt-mbr-type 194267843Sdelphij# GPT with protective MBR entry in partition 1 195267843Sdelphij>450 ubyte 0xee 196267843Sdelphij>>454 ulelong 1 197267843Sdelphij>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 198267843Sdelphij>>454 ulelong !1 \b (nonstandard: not at LBA 1) 199267843Sdelphij# GPT with protective MBR entry in partition 2 200267843Sdelphij>466 ubyte 0xee 201267843Sdelphij>>470 ulelong 1 202267843Sdelphij>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 203267843Sdelphij>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 204267843Sdelphij>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 205267843Sdelphij>>470 ulelong !1 \b (nonstandard: not at LBA 1) 206267843Sdelphij# GPT with protective MBR entry in partition 3 207267843Sdelphij>482 ubyte 0xee 208267843Sdelphij>>486 ulelong 1 209267843Sdelphij>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 210267843Sdelphij>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 211267843Sdelphij>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 212267843Sdelphij>>486 ulelong !1 \b (nonstandard: not at LBA 1) 213267843Sdelphij# GPT with protective MBR entry in partition 4 214267843Sdelphij>498 ubyte 0xee 215267843Sdelphij>>502 ulelong 1 216267843Sdelphij>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 217267843Sdelphij>>502 ulelong !1 \b (nonstandard: not at LBA 1) 218267843Sdelphij 219267843Sdelphij# Print the information from a GPT partition table structure 220267843Sdelphij0 name gpt-table 221267843Sdelphij>10 uleshort x \b, version %u 222267843Sdelphij>8 uleshort x \b.%u 223267843Sdelphij>56 ulelong x \b, GUID: %08x 224267843Sdelphij>60 uleshort x \b-%04x 225267843Sdelphij>62 uleshort x \b-%04x 226267843Sdelphij>64 ubeshort x \b-%04x 227267843Sdelphij>66 ubeshort x \b-%04x 228267843Sdelphij>68 ubelong x \b%08x 229267843Sdelphij#>80 uleshort x \b, %d partition entries 230267843Sdelphij>32 ulequad+1 x \b, disk size: %lld sectors 231267843Sdelphij 232267843Sdelphij# In case a GPT data-structure is at LBA 0, report it as well 233267843Sdelphij# This covers systems which are not GPT-aware, and which show 234267843Sdelphij# and allow access to the protective partition. This code will 235267843Sdelphij# detect the contents of such a partition. 236267843Sdelphij0 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 237267843Sdelphij>0 use gpt-table 238267843Sdelphij>0 ubyte x (sector size unknown) 239267843Sdelphij 240267843Sdelphij 241