184d9c625SLionel Sambuc 284d9c625SLionel Sambuc#------------------------------------------------------------------------------ 3*0a6a1f1dSLionel Sambuc# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $ 484d9c625SLionel Sambuc# 584d9c625SLionel Sambuc# GPT Partition table patterns. 684d9c625SLionel Sambuc# Author: Rogier Goossens (goossens.rogier@gmail.com) 784d9c625SLionel Sambuc# Note that a GPT-formatted disk must contain an MBR as well. 884d9c625SLionel Sambuc# 984d9c625SLionel Sambuc 1084d9c625SLionel Sambuc# The initial segment (up to >>>>>>>>422) was copied from the X86 1184d9c625SLionel Sambuc# partition table code (aka MBR). 1284d9c625SLionel Sambuc# This is kept separate, so that MBR partitions are not reported as well. 1384d9c625SLionel Sambuc# (use -k if you do want them as well) 1484d9c625SLionel Sambuc 1584d9c625SLionel Sambuc# First, detect the MBR partiton table 1684d9c625SLionel Sambuc# If more than one GPT protective MBR partition exists, don't print anything 1784d9c625SLionel Sambuc# (the other MBR detection code will then just print the MBR partition table) 1884d9c625SLionel Sambuc0x1FE leshort 0xAA55 1984d9c625SLionel Sambuc>3 string !MS 2084d9c625SLionel Sambuc>>3 string !SYSLINUX 2184d9c625SLionel Sambuc>>>3 string !MTOOL 2284d9c625SLionel Sambuc>>>>3 string !NEWLDR 2384d9c625SLionel Sambuc>>>>>5 string !DOS 2484d9c625SLionel Sambuc# not FAT (32 bit) 2584d9c625SLionel Sambuc>>>>>>82 string !FAT32 2684d9c625SLionel Sambuc#not Linux kernel 2784d9c625SLionel Sambuc>>>>>>>514 string !HdrS 2884d9c625SLionel Sambuc#not BeOS 2984d9c625SLionel Sambuc>>>>>>>>422 string !Be\ Boot\ Loader 3084d9c625SLionel Sambuc# GPT with protective MBR entry in partition 1 (only) 3184d9c625SLionel Sambuc>>>>>>>>>450 ubyte 0xee 3284d9c625SLionel Sambuc>>>>>>>>>>466 ubyte !0xee 3384d9c625SLionel Sambuc>>>>>>>>>>>482 ubyte !0xee 3484d9c625SLionel Sambuc>>>>>>>>>>>>498 ubyte !0xee 3584d9c625SLionel Sambuc#>>>>>>>>>>>>>446 use gpt-mbr-partition 3684d9c625SLionel Sambuc>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 3784d9c625SLionel Sambuc>>>>>>>>>>>>>>0 use gpt-mbr-type 3884d9c625SLionel Sambuc>>>>>>>>>>>>>>&-8 use gpt-table 3984d9c625SLionel Sambuc>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 4084d9c625SLionel Sambuc>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 4184d9c625SLionel Sambuc>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 4284d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 use gpt-mbr-type 4384d9c625SLionel Sambuc>>>>>>>>>>>>>>>&-8 use gpt-table 4484d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 4584d9c625SLionel Sambuc>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 4684d9c625SLionel Sambuc>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 4784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 use gpt-mbr-type 4884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>&-8 use gpt-table 4984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 5084d9c625SLionel Sambuc>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 5184d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 5284d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 5384d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>&-8 use gpt-table 5484d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 5584d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 5684d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 5784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 5884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>&-8 use gpt-table 5984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 6084d9c625SLionel Sambuc# GPT with protective MBR entry in partition 2 (only) 6184d9c625SLionel Sambuc>>>>>>>>>450 ubyte !0xee 6284d9c625SLionel Sambuc>>>>>>>>>>466 ubyte 0xee 6384d9c625SLionel Sambuc>>>>>>>>>>>482 ubyte !0xee 6484d9c625SLionel Sambuc>>>>>>>>>>>>498 ubyte !0xee 6584d9c625SLionel Sambuc#>>>>>>>>>>>>>462 use gpt-mbr-partition 6684d9c625SLionel Sambuc>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 6784d9c625SLionel Sambuc>>>>>>>>>>>>>>0 use gpt-mbr-type 6884d9c625SLionel Sambuc>>>>>>>>>>>>>>&-8 use gpt-table 6984d9c625SLionel Sambuc>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 7084d9c625SLionel Sambuc>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 7184d9c625SLionel Sambuc>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 7284d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 use gpt-mbr-type 7384d9c625SLionel Sambuc>>>>>>>>>>>>>>>&-8 use gpt-table 7484d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 7584d9c625SLionel Sambuc>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 7684d9c625SLionel Sambuc>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 7784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 use gpt-mbr-type 7884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>&-8 use gpt-table 7984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 8084d9c625SLionel Sambuc>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 8184d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 8284d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8384d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>&-8 use gpt-table 8484d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 8584d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 8684d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 8784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>&-8 use gpt-table 8984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 9084d9c625SLionel Sambuc# GPT with protective MBR entry in partition 3 (only) 9184d9c625SLionel Sambuc>>>>>>>>>450 ubyte !0xee 9284d9c625SLionel Sambuc>>>>>>>>>>466 ubyte !0xee 9384d9c625SLionel Sambuc>>>>>>>>>>>482 ubyte 0xee 9484d9c625SLionel Sambuc>>>>>>>>>>>>498 ubyte !0xee 9584d9c625SLionel Sambuc#>>>>>>>>>>>>>478 use gpt-mbr-partition 9684d9c625SLionel Sambuc>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 9784d9c625SLionel Sambuc>>>>>>>>>>>>>>0 use gpt-mbr-type 9884d9c625SLionel Sambuc>>>>>>>>>>>>>>&-8 use gpt-table 9984d9c625SLionel Sambuc>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 10084d9c625SLionel Sambuc>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 10184d9c625SLionel Sambuc>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 10284d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 use gpt-mbr-type 10384d9c625SLionel Sambuc>>>>>>>>>>>>>>>&-8 use gpt-table 10484d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 10584d9c625SLionel Sambuc>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 10684d9c625SLionel Sambuc>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 10784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>&-8 use gpt-table 10984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 11084d9c625SLionel Sambuc>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 11184d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 11284d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 11384d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>&-8 use gpt-table 11484d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 11584d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 11684d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 11784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 11884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>&-8 use gpt-table 11984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 12084d9c625SLionel Sambuc# GPT with protective MBR entry in partition 4 (only) 12184d9c625SLionel Sambuc>>>>>>>>>450 ubyte !0xee 12284d9c625SLionel Sambuc>>>>>>>>>>466 ubyte !0xee 12384d9c625SLionel Sambuc>>>>>>>>>>>482 ubyte !0xee 12484d9c625SLionel Sambuc>>>>>>>>>>>>498 ubyte 0xee 12584d9c625SLionel Sambuc#>>>>>>>>>>>>>494 use gpt-mbr-partition 12684d9c625SLionel Sambuc>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 12784d9c625SLionel Sambuc>>>>>>>>>>>>>>0 use gpt-mbr-type 12884d9c625SLionel Sambuc>>>>>>>>>>>>>>&-8 use gpt-table 12984d9c625SLionel Sambuc>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 13084d9c625SLionel Sambuc>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 13184d9c625SLionel Sambuc>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 13284d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 use gpt-mbr-type 13384d9c625SLionel Sambuc>>>>>>>>>>>>>>>&-8 use gpt-table 13484d9c625SLionel Sambuc>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 13584d9c625SLionel Sambuc>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 13684d9c625SLionel Sambuc>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 13784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>&-8 use gpt-table 13984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14084d9c625SLionel Sambuc>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 14184d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 14284d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14384d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>&-8 use gpt-table 14484d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14584d9c625SLionel Sambuc>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 14684d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 14784d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14884d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14984d9c625SLionel Sambuc>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15084d9c625SLionel Sambuc 15184d9c625SLionel Sambuc# The following code does GPT detection and processing, including 15284d9c625SLionel Sambuc# sector size detection. 15384d9c625SLionel Sambuc# It has to be duplicated above because the top-level pattern 15484d9c625SLionel Sambuc# (i.e. not called using 'use') must print *something* for file 15584d9c625SLionel Sambuc# to count it as a match. Text only printed in named patterns is 15684d9c625SLionel Sambuc# not counted, and causes file to continue, and try and match 15784d9c625SLionel Sambuc# other patterns. 15884d9c625SLionel Sambuc# 15984d9c625SLionel Sambuc# Unfortunately, when assuming sector sizes >=16k, if the sector size 16084d9c625SLionel Sambuc# happens to be 512 instead, we may find confusing data after the GPT 16184d9c625SLionel Sambuc# table... If the GPT table has less than 128 entries, this may even 16284d9c625SLionel Sambuc# happen for assumed sector sizes as small as 4k 16384d9c625SLionel Sambuc# This could be solved by checking for the presence of the backup GPT 16484d9c625SLionel Sambuc# header as well, but that makes the logic extremely complex 16584d9c625SLionel Sambuc##0 name gpt-mbr-partition 16684d9c625SLionel Sambuc##>(8.l*8192) string EFI\ PART 16784d9c625SLionel Sambuc##>>(8.l*8192) use gpt-mbr-type 16884d9c625SLionel Sambuc##>>&-8 use gpt-table 16984d9c625SLionel Sambuc##>>0 ubyte x of 8192 bytes 17084d9c625SLionel Sambuc##>(8.l*8192) string !EFI\ PART 17184d9c625SLionel Sambuc##>>(8.l*4096) string EFI\ PART GPT partition table 17284d9c625SLionel Sambuc##>>>0 use gpt-mbr-type 17384d9c625SLionel Sambuc##>>>&-8 use gpt-table 17484d9c625SLionel Sambuc##>>>0 ubyte x of 4096 bytes 17584d9c625SLionel Sambuc##>>(8.l*4096) string !EFI\ PART 17684d9c625SLionel Sambuc##>>>(8.l*2048) string EFI\ PART GPT partition table 17784d9c625SLionel Sambuc##>>>>0 use gpt-mbr-type 17884d9c625SLionel Sambuc##>>>>&-8 use gpt-table 17984d9c625SLionel Sambuc##>>>>0 ubyte x of 2048 bytes 18084d9c625SLionel Sambuc##>>>(8.l*2048) string !EFI\ PART 18184d9c625SLionel Sambuc##>>>>(8.l*1024) string EFI\ PART GPT partition table 18284d9c625SLionel Sambuc##>>>>>0 use gpt-mbr-type 18384d9c625SLionel Sambuc##>>>>>&-8 use gpt-table 18484d9c625SLionel Sambuc##>>>>>0 ubyte x of 1024 bytes 18584d9c625SLionel Sambuc##>>>>(8.l*1024) string !EFI\ PART 18684d9c625SLionel Sambuc##>>>>>(8.l*512) string EFI\ PART GPT partition table 18784d9c625SLionel Sambuc##>>>>>>0 use gpt-mbr-type 18884d9c625SLionel Sambuc##>>>>>>&-8 use gpt-table 18984d9c625SLionel Sambuc##>>>>>>0 ubyte x of 512 bytes 19084d9c625SLionel Sambuc 19184d9c625SLionel Sambuc# Print details of MBR type for a GPT-disk 19284d9c625SLionel Sambuc# Calling code ensures that there is only one 0xee partition. 19384d9c625SLionel Sambuc0 name gpt-mbr-type 19484d9c625SLionel Sambuc# GPT with protective MBR entry in partition 1 19584d9c625SLionel Sambuc>450 ubyte 0xee 19684d9c625SLionel Sambuc>>454 ulelong 1 19784d9c625SLionel Sambuc>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 19884d9c625SLionel Sambuc>>454 ulelong !1 \b (nonstandard: not at LBA 1) 19984d9c625SLionel Sambuc# GPT with protective MBR entry in partition 2 20084d9c625SLionel Sambuc>466 ubyte 0xee 20184d9c625SLionel Sambuc>>470 ulelong 1 20284d9c625SLionel Sambuc>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 20384d9c625SLionel Sambuc>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 20484d9c625SLionel Sambuc>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 20584d9c625SLionel Sambuc>>470 ulelong !1 \b (nonstandard: not at LBA 1) 20684d9c625SLionel Sambuc# GPT with protective MBR entry in partition 3 20784d9c625SLionel Sambuc>482 ubyte 0xee 20884d9c625SLionel Sambuc>>486 ulelong 1 20984d9c625SLionel Sambuc>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 21084d9c625SLionel Sambuc>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 21184d9c625SLionel Sambuc>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 21284d9c625SLionel Sambuc>>486 ulelong !1 \b (nonstandard: not at LBA 1) 21384d9c625SLionel Sambuc# GPT with protective MBR entry in partition 4 21484d9c625SLionel Sambuc>498 ubyte 0xee 21584d9c625SLionel Sambuc>>502 ulelong 1 21684d9c625SLionel Sambuc>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 21784d9c625SLionel Sambuc>>502 ulelong !1 \b (nonstandard: not at LBA 1) 21884d9c625SLionel Sambuc 21984d9c625SLionel Sambuc# Print the information from a GPT partition table structure 22084d9c625SLionel Sambuc0 name gpt-table 22184d9c625SLionel Sambuc>10 uleshort x \b, version %u 22284d9c625SLionel Sambuc>8 uleshort x \b.%u 22384d9c625SLionel Sambuc>56 ulelong x \b, GUID: %08x 22484d9c625SLionel Sambuc>60 uleshort x \b-%04x 22584d9c625SLionel Sambuc>62 uleshort x \b-%04x 22684d9c625SLionel Sambuc>64 ubeshort x \b-%04x 22784d9c625SLionel Sambuc>66 ubeshort x \b-%04x 22884d9c625SLionel Sambuc>68 ubelong x \b%08x 22984d9c625SLionel Sambuc#>80 uleshort x \b, %d partition entries 23084d9c625SLionel Sambuc>32 ulequad+1 x \b, disk size: %lld sectors 23184d9c625SLionel Sambuc 23284d9c625SLionel Sambuc# In case a GPT data-structure is at LBA 0, report it as well 23384d9c625SLionel Sambuc# This covers systems which are not GPT-aware, and which show 23484d9c625SLionel Sambuc# and allow access to the protective partition. This code will 23584d9c625SLionel Sambuc# detect the contents of such a partition. 23684d9c625SLionel Sambuc0 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 23784d9c625SLionel Sambuc>0 use gpt-table 23884d9c625SLionel Sambuc>0 ubyte x (sector size unknown) 23984d9c625SLionel Sambuc 24084d9c625SLionel Sambuc 241