1e8af9738SPeter Avalos 2e8af9738SPeter Avalos#------------------------------------------------------------------------------ 3*970935fdSSascha Wildner# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $ 4e8af9738SPeter Avalos# 5e8af9738SPeter Avalos# GPT Partition table patterns. 6e8af9738SPeter Avalos# Author: Rogier Goossens (goossens.rogier@gmail.com) 7e8af9738SPeter Avalos# Note that a GPT-formatted disk must contain an MBR as well. 8e8af9738SPeter Avalos# 9e8af9738SPeter Avalos 10e8af9738SPeter Avalos# The initial segment (up to >>>>>>>>422) was copied from the X86 11e8af9738SPeter Avalos# partition table code (aka MBR). 12e8af9738SPeter Avalos# This is kept separate, so that MBR partitions are not reported as well. 13e8af9738SPeter Avalos# (use -k if you do want them as well) 14e8af9738SPeter Avalos 15*970935fdSSascha Wildner# First, detect the MBR partition table 16e8af9738SPeter Avalos# If more than one GPT protective MBR partition exists, don't print anything 17e8af9738SPeter Avalos# (the other MBR detection code will then just print the MBR partition table) 18e8af9738SPeter Avalos0x1FE leshort 0xAA55 19e8af9738SPeter Avalos>3 string !MS 20e8af9738SPeter Avalos>>3 string !SYSLINUX 21e8af9738SPeter Avalos>>>3 string !MTOOL 22e8af9738SPeter Avalos>>>>3 string !NEWLDR 23e8af9738SPeter Avalos>>>>>5 string !DOS 24e8af9738SPeter Avalos# not FAT (32 bit) 25e8af9738SPeter Avalos>>>>>>82 string !FAT32 26e8af9738SPeter Avalos#not Linux kernel 27e8af9738SPeter Avalos>>>>>>>514 string !HdrS 28e8af9738SPeter Avalos#not BeOS 29e8af9738SPeter Avalos>>>>>>>>422 string !Be\ Boot\ Loader 30e8af9738SPeter Avalos# GPT with protective MBR entry in partition 1 (only) 31e8af9738SPeter Avalos>>>>>>>>>450 ubyte 0xee 32e8af9738SPeter Avalos>>>>>>>>>>466 ubyte !0xee 33e8af9738SPeter Avalos>>>>>>>>>>>482 ubyte !0xee 34e8af9738SPeter Avalos>>>>>>>>>>>>498 ubyte !0xee 35e8af9738SPeter Avalos#>>>>>>>>>>>>>446 use gpt-mbr-partition 36e8af9738SPeter Avalos>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 37e8af9738SPeter Avalos>>>>>>>>>>>>>>0 use gpt-mbr-type 38e8af9738SPeter Avalos>>>>>>>>>>>>>>&-8 use gpt-table 39e8af9738SPeter Avalos>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 40e8af9738SPeter Avalos>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 41e8af9738SPeter Avalos>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 42e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 use gpt-mbr-type 43e8af9738SPeter Avalos>>>>>>>>>>>>>>>&-8 use gpt-table 44e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 45e8af9738SPeter Avalos>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 46e8af9738SPeter Avalos>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 47e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 use gpt-mbr-type 48e8af9738SPeter Avalos>>>>>>>>>>>>>>>>&-8 use gpt-table 49e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 50e8af9738SPeter Avalos>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 51e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 52e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 53e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>&-8 use gpt-table 54e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 55e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 56e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 57e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 58e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>&-8 use gpt-table 59e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 60e8af9738SPeter Avalos# GPT with protective MBR entry in partition 2 (only) 61e8af9738SPeter Avalos>>>>>>>>>450 ubyte !0xee 62e8af9738SPeter Avalos>>>>>>>>>>466 ubyte 0xee 63e8af9738SPeter Avalos>>>>>>>>>>>482 ubyte !0xee 64e8af9738SPeter Avalos>>>>>>>>>>>>498 ubyte !0xee 65e8af9738SPeter Avalos#>>>>>>>>>>>>>462 use gpt-mbr-partition 66e8af9738SPeter Avalos>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 67e8af9738SPeter Avalos>>>>>>>>>>>>>>0 use gpt-mbr-type 68e8af9738SPeter Avalos>>>>>>>>>>>>>>&-8 use gpt-table 69e8af9738SPeter Avalos>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 70e8af9738SPeter Avalos>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 71e8af9738SPeter Avalos>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 72e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 use gpt-mbr-type 73e8af9738SPeter Avalos>>>>>>>>>>>>>>>&-8 use gpt-table 74e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 75e8af9738SPeter Avalos>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 76e8af9738SPeter Avalos>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 77e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 use gpt-mbr-type 78e8af9738SPeter Avalos>>>>>>>>>>>>>>>>&-8 use gpt-table 79e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 80e8af9738SPeter Avalos>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 81e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 82e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 83e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>&-8 use gpt-table 84e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 85e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 86e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 87e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 88e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>&-8 use gpt-table 89e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 90e8af9738SPeter Avalos# GPT with protective MBR entry in partition 3 (only) 91e8af9738SPeter Avalos>>>>>>>>>450 ubyte !0xee 92e8af9738SPeter Avalos>>>>>>>>>>466 ubyte !0xee 93e8af9738SPeter Avalos>>>>>>>>>>>482 ubyte 0xee 94e8af9738SPeter Avalos>>>>>>>>>>>>498 ubyte !0xee 95e8af9738SPeter Avalos#>>>>>>>>>>>>>478 use gpt-mbr-partition 96e8af9738SPeter Avalos>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 97e8af9738SPeter Avalos>>>>>>>>>>>>>>0 use gpt-mbr-type 98e8af9738SPeter Avalos>>>>>>>>>>>>>>&-8 use gpt-table 99e8af9738SPeter Avalos>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 100e8af9738SPeter Avalos>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 101e8af9738SPeter Avalos>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 102e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 use gpt-mbr-type 103e8af9738SPeter Avalos>>>>>>>>>>>>>>>&-8 use gpt-table 104e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 105e8af9738SPeter Avalos>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 106e8af9738SPeter Avalos>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 107e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 use gpt-mbr-type 108e8af9738SPeter Avalos>>>>>>>>>>>>>>>>&-8 use gpt-table 109e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 110e8af9738SPeter Avalos>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 111e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 112e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 113e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>&-8 use gpt-table 114e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 115e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 116e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 117e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 118e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>&-8 use gpt-table 119e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 120e8af9738SPeter Avalos# GPT with protective MBR entry in partition 4 (only) 121e8af9738SPeter Avalos>>>>>>>>>450 ubyte !0xee 122e8af9738SPeter Avalos>>>>>>>>>>466 ubyte !0xee 123e8af9738SPeter Avalos>>>>>>>>>>>482 ubyte !0xee 124e8af9738SPeter Avalos>>>>>>>>>>>>498 ubyte 0xee 125e8af9738SPeter Avalos#>>>>>>>>>>>>>494 use gpt-mbr-partition 126e8af9738SPeter Avalos>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 127e8af9738SPeter Avalos>>>>>>>>>>>>>>0 use gpt-mbr-type 128e8af9738SPeter Avalos>>>>>>>>>>>>>>&-8 use gpt-table 129e8af9738SPeter Avalos>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 130e8af9738SPeter Avalos>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 131e8af9738SPeter Avalos>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 132e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 use gpt-mbr-type 133e8af9738SPeter Avalos>>>>>>>>>>>>>>>&-8 use gpt-table 134e8af9738SPeter Avalos>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 135e8af9738SPeter Avalos>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 136e8af9738SPeter Avalos>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 137e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 use gpt-mbr-type 138e8af9738SPeter Avalos>>>>>>>>>>>>>>>>&-8 use gpt-table 139e8af9738SPeter Avalos>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 140e8af9738SPeter Avalos>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 141e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 142e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 143e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>&-8 use gpt-table 144e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 145e8af9738SPeter Avalos>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 146e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 147e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 148e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>&-8 use gpt-table 149e8af9738SPeter Avalos>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 150e8af9738SPeter Avalos 151e8af9738SPeter Avalos# The following code does GPT detection and processing, including 152e8af9738SPeter Avalos# sector size detection. 153e8af9738SPeter Avalos# It has to be duplicated above because the top-level pattern 154e8af9738SPeter Avalos# (i.e. not called using 'use') must print *something* for file 155e8af9738SPeter Avalos# to count it as a match. Text only printed in named patterns is 156e8af9738SPeter Avalos# not counted, and causes file to continue, and try and match 157e8af9738SPeter Avalos# other patterns. 158e8af9738SPeter Avalos# 159e8af9738SPeter Avalos# Unfortunately, when assuming sector sizes >=16k, if the sector size 160e8af9738SPeter Avalos# happens to be 512 instead, we may find confusing data after the GPT 161e8af9738SPeter Avalos# table... If the GPT table has less than 128 entries, this may even 162e8af9738SPeter Avalos# happen for assumed sector sizes as small as 4k 163e8af9738SPeter Avalos# This could be solved by checking for the presence of the backup GPT 164e8af9738SPeter Avalos# header as well, but that makes the logic extremely complex 165e8af9738SPeter Avalos##0 name gpt-mbr-partition 166e8af9738SPeter Avalos##>(8.l*8192) string EFI\ PART 167e8af9738SPeter Avalos##>>(8.l*8192) use gpt-mbr-type 168e8af9738SPeter Avalos##>>&-8 use gpt-table 169e8af9738SPeter Avalos##>>0 ubyte x of 8192 bytes 170e8af9738SPeter Avalos##>(8.l*8192) string !EFI\ PART 171e8af9738SPeter Avalos##>>(8.l*4096) string EFI\ PART GPT partition table 172e8af9738SPeter Avalos##>>>0 use gpt-mbr-type 173e8af9738SPeter Avalos##>>>&-8 use gpt-table 174e8af9738SPeter Avalos##>>>0 ubyte x of 4096 bytes 175e8af9738SPeter Avalos##>>(8.l*4096) string !EFI\ PART 176e8af9738SPeter Avalos##>>>(8.l*2048) string EFI\ PART GPT partition table 177e8af9738SPeter Avalos##>>>>0 use gpt-mbr-type 178e8af9738SPeter Avalos##>>>>&-8 use gpt-table 179e8af9738SPeter Avalos##>>>>0 ubyte x of 2048 bytes 180e8af9738SPeter Avalos##>>>(8.l*2048) string !EFI\ PART 181e8af9738SPeter Avalos##>>>>(8.l*1024) string EFI\ PART GPT partition table 182e8af9738SPeter Avalos##>>>>>0 use gpt-mbr-type 183e8af9738SPeter Avalos##>>>>>&-8 use gpt-table 184e8af9738SPeter Avalos##>>>>>0 ubyte x of 1024 bytes 185e8af9738SPeter Avalos##>>>>(8.l*1024) string !EFI\ PART 186e8af9738SPeter Avalos##>>>>>(8.l*512) string EFI\ PART GPT partition table 187e8af9738SPeter Avalos##>>>>>>0 use gpt-mbr-type 188e8af9738SPeter Avalos##>>>>>>&-8 use gpt-table 189e8af9738SPeter Avalos##>>>>>>0 ubyte x of 512 bytes 190e8af9738SPeter Avalos 191e8af9738SPeter Avalos# Print details of MBR type for a GPT-disk 192e8af9738SPeter Avalos# Calling code ensures that there is only one 0xee partition. 193e8af9738SPeter Avalos0 name gpt-mbr-type 194e8af9738SPeter Avalos# GPT with protective MBR entry in partition 1 195e8af9738SPeter Avalos>450 ubyte 0xee 196e8af9738SPeter Avalos>>454 ulelong 1 197e8af9738SPeter Avalos>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 198e8af9738SPeter Avalos>>454 ulelong !1 \b (nonstandard: not at LBA 1) 199e8af9738SPeter Avalos# GPT with protective MBR entry in partition 2 200e8af9738SPeter Avalos>466 ubyte 0xee 201e8af9738SPeter Avalos>>470 ulelong 1 202e8af9738SPeter Avalos>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 203e8af9738SPeter Avalos>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 204e8af9738SPeter Avalos>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 205e8af9738SPeter Avalos>>470 ulelong !1 \b (nonstandard: not at LBA 1) 206e8af9738SPeter Avalos# GPT with protective MBR entry in partition 3 207e8af9738SPeter Avalos>482 ubyte 0xee 208e8af9738SPeter Avalos>>486 ulelong 1 209e8af9738SPeter Avalos>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 210e8af9738SPeter Avalos>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 211e8af9738SPeter Avalos>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 212e8af9738SPeter Avalos>>486 ulelong !1 \b (nonstandard: not at LBA 1) 213e8af9738SPeter Avalos# GPT with protective MBR entry in partition 4 214e8af9738SPeter Avalos>498 ubyte 0xee 215e8af9738SPeter Avalos>>502 ulelong 1 216e8af9738SPeter Avalos>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 217e8af9738SPeter Avalos>>502 ulelong !1 \b (nonstandard: not at LBA 1) 218e8af9738SPeter Avalos 219e8af9738SPeter Avalos# Print the information from a GPT partition table structure 220e8af9738SPeter Avalos0 name gpt-table 221e8af9738SPeter Avalos>10 uleshort x \b, version %u 222e8af9738SPeter Avalos>8 uleshort x \b.%u 223e8af9738SPeter Avalos>56 ulelong x \b, GUID: %08x 224e8af9738SPeter Avalos>60 uleshort x \b-%04x 225e8af9738SPeter Avalos>62 uleshort x \b-%04x 226e8af9738SPeter Avalos>64 ubeshort x \b-%04x 227e8af9738SPeter Avalos>66 ubeshort x \b-%04x 228e8af9738SPeter Avalos>68 ubelong x \b%08x 229e8af9738SPeter Avalos#>80 uleshort x \b, %d partition entries 230e8af9738SPeter Avalos>32 ulequad+1 x \b, disk size: %lld sectors 231e8af9738SPeter Avalos 232e8af9738SPeter Avalos# In case a GPT data-structure is at LBA 0, report it as well 233e8af9738SPeter Avalos# This covers systems which are not GPT-aware, and which show 234e8af9738SPeter Avalos# and allow access to the protective partition. This code will 235e8af9738SPeter Avalos# detect the contents of such a partition. 236e8af9738SPeter Avalos0 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 237e8af9738SPeter Avalos>0 use gpt-table 238e8af9738SPeter Avalos>0 ubyte x (sector size unknown) 239e8af9738SPeter Avalos 240e8af9738SPeter Avalos 241