gpt 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240
  1. #------------------------------------------------------------------------------
  2. # $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
  3. #
  4. # GPT Partition table patterns.
  5. # Author: Rogier Goossens (goossens.rogier@gmail.com)
  6. # Note that a GPT-formatted disk must contain an MBR as well.
  7. #
  8. # The initial segment (up to >>>>>>>>422) was copied from the X86
  9. # partition table code (aka MBR).
  10. # This is kept separate, so that MBR partitions are not reported as well.
  11. # (use -k if you do want them as well)
  12. # First, detect the MBR partiton table
  13. # If more than one GPT protective MBR partition exists, don't print anything
  14. # (the other MBR detection code will then just print the MBR partition table)
  15. 0x1FE leshort 0xAA55
  16. >3 string !MS
  17. >>3 string !SYSLINUX
  18. >>>3 string !MTOOL
  19. >>>>3 string !NEWLDR
  20. >>>>>5 string !DOS
  21. # not FAT (32 bit)
  22. >>>>>>82 string !FAT32
  23. #not Linux kernel
  24. >>>>>>>514 string !HdrS
  25. #not BeOS
  26. >>>>>>>>422 string !Be\ Boot\ Loader
  27. # GPT with protective MBR entry in partition 1 (only)
  28. >>>>>>>>>450 ubyte 0xee
  29. >>>>>>>>>>466 ubyte !0xee
  30. >>>>>>>>>>>482 ubyte !0xee
  31. >>>>>>>>>>>>498 ubyte !0xee
  32. #>>>>>>>>>>>>>446 use gpt-mbr-partition
  33. >>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
  34. >>>>>>>>>>>>>>0 use gpt-mbr-type
  35. >>>>>>>>>>>>>>&-8 use gpt-table
  36. >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
  37. >>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
  38. >>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
  39. >>>>>>>>>>>>>>>0 use gpt-mbr-type
  40. >>>>>>>>>>>>>>>&-8 use gpt-table
  41. >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
  42. >>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART
  43. >>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table
  44. >>>>>>>>>>>>>>>>0 use gpt-mbr-type
  45. >>>>>>>>>>>>>>>>&-8 use gpt-table
  46. >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
  47. >>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART
  48. >>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table
  49. >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  50. >>>>>>>>>>>>>>>>>&-8 use gpt-table
  51. >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
  52. >>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART
  53. >>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table
  54. >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  55. >>>>>>>>>>>>>>>>>>&-8 use gpt-table
  56. >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
  57. # GPT with protective MBR entry in partition 2 (only)
  58. >>>>>>>>>450 ubyte !0xee
  59. >>>>>>>>>>466 ubyte 0xee
  60. >>>>>>>>>>>482 ubyte !0xee
  61. >>>>>>>>>>>>498 ubyte !0xee
  62. #>>>>>>>>>>>>>462 use gpt-mbr-partition
  63. >>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
  64. >>>>>>>>>>>>>>0 use gpt-mbr-type
  65. >>>>>>>>>>>>>>&-8 use gpt-table
  66. >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
  67. >>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
  68. >>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
  69. >>>>>>>>>>>>>>>0 use gpt-mbr-type
  70. >>>>>>>>>>>>>>>&-8 use gpt-table
  71. >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
  72. >>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART
  73. >>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table
  74. >>>>>>>>>>>>>>>>0 use gpt-mbr-type
  75. >>>>>>>>>>>>>>>>&-8 use gpt-table
  76. >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
  77. >>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART
  78. >>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table
  79. >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  80. >>>>>>>>>>>>>>>>>&-8 use gpt-table
  81. >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
  82. >>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART
  83. >>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table
  84. >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  85. >>>>>>>>>>>>>>>>>>&-8 use gpt-table
  86. >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
  87. # GPT with protective MBR entry in partition 3 (only)
  88. >>>>>>>>>450 ubyte !0xee
  89. >>>>>>>>>>466 ubyte !0xee
  90. >>>>>>>>>>>482 ubyte 0xee
  91. >>>>>>>>>>>>498 ubyte !0xee
  92. #>>>>>>>>>>>>>478 use gpt-mbr-partition
  93. >>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
  94. >>>>>>>>>>>>>>0 use gpt-mbr-type
  95. >>>>>>>>>>>>>>&-8 use gpt-table
  96. >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
  97. >>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
  98. >>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
  99. >>>>>>>>>>>>>>>0 use gpt-mbr-type
  100. >>>>>>>>>>>>>>>&-8 use gpt-table
  101. >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
  102. >>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART
  103. >>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table
  104. >>>>>>>>>>>>>>>>0 use gpt-mbr-type
  105. >>>>>>>>>>>>>>>>&-8 use gpt-table
  106. >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
  107. >>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART
  108. >>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table
  109. >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  110. >>>>>>>>>>>>>>>>>&-8 use gpt-table
  111. >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
  112. >>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART
  113. >>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table
  114. >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  115. >>>>>>>>>>>>>>>>>>&-8 use gpt-table
  116. >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
  117. # GPT with protective MBR entry in partition 4 (only)
  118. >>>>>>>>>450 ubyte !0xee
  119. >>>>>>>>>>466 ubyte !0xee
  120. >>>>>>>>>>>482 ubyte !0xee
  121. >>>>>>>>>>>>498 ubyte 0xee
  122. #>>>>>>>>>>>>>494 use gpt-mbr-partition
  123. >>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
  124. >>>>>>>>>>>>>>0 use gpt-mbr-type
  125. >>>>>>>>>>>>>>&-8 use gpt-table
  126. >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
  127. >>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
  128. >>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
  129. >>>>>>>>>>>>>>>0 use gpt-mbr-type
  130. >>>>>>>>>>>>>>>&-8 use gpt-table
  131. >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
  132. >>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART
  133. >>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table
  134. >>>>>>>>>>>>>>>>0 use gpt-mbr-type
  135. >>>>>>>>>>>>>>>>&-8 use gpt-table
  136. >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
  137. >>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART
  138. >>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table
  139. >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  140. >>>>>>>>>>>>>>>>>&-8 use gpt-table
  141. >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
  142. >>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART
  143. >>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table
  144. >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
  145. >>>>>>>>>>>>>>>>>>&-8 use gpt-table
  146. >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
  147. # The following code does GPT detection and processing, including
  148. # sector size detection.
  149. # It has to be duplicated above because the top-level pattern
  150. # (i.e. not called using 'use') must print *something* for file
  151. # to count it as a match. Text only printed in named patterns is
  152. # not counted, and causes file to continue, and try and match
  153. # other patterns.
  154. #
  155. # Unfortunately, when assuming sector sizes >=16k, if the sector size
  156. # happens to be 512 instead, we may find confusing data after the GPT
  157. # table... If the GPT table has less than 128 entries, this may even
  158. # happen for assumed sector sizes as small as 4k
  159. # This could be solved by checking for the presence of the backup GPT
  160. # header as well, but that makes the logic extremely complex
  161. ##0 name gpt-mbr-partition
  162. ##>(8.l*8192) string EFI\ PART
  163. ##>>(8.l*8192) use gpt-mbr-type
  164. ##>>&-8 use gpt-table
  165. ##>>0 ubyte x of 8192 bytes
  166. ##>(8.l*8192) string !EFI\ PART
  167. ##>>(8.l*4096) string EFI\ PART GPT partition table
  168. ##>>>0 use gpt-mbr-type
  169. ##>>>&-8 use gpt-table
  170. ##>>>0 ubyte x of 4096 bytes
  171. ##>>(8.l*4096) string !EFI\ PART
  172. ##>>>(8.l*2048) string EFI\ PART GPT partition table
  173. ##>>>>0 use gpt-mbr-type
  174. ##>>>>&-8 use gpt-table
  175. ##>>>>0 ubyte x of 2048 bytes
  176. ##>>>(8.l*2048) string !EFI\ PART
  177. ##>>>>(8.l*1024) string EFI\ PART GPT partition table
  178. ##>>>>>0 use gpt-mbr-type
  179. ##>>>>>&-8 use gpt-table
  180. ##>>>>>0 ubyte x of 1024 bytes
  181. ##>>>>(8.l*1024) string !EFI\ PART
  182. ##>>>>>(8.l*512) string EFI\ PART GPT partition table
  183. ##>>>>>>0 use gpt-mbr-type
  184. ##>>>>>>&-8 use gpt-table
  185. ##>>>>>>0 ubyte x of 512 bytes
  186. # Print details of MBR type for a GPT-disk
  187. # Calling code ensures that there is only one 0xee partition.
  188. 0 name gpt-mbr-type
  189. # GPT with protective MBR entry in partition 1
  190. >450 ubyte 0xee
  191. >>454 ulelong 1
  192. >>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
  193. >>454 ulelong !1 \b (nonstandard: not at LBA 1)
  194. # GPT with protective MBR entry in partition 2
  195. >466 ubyte 0xee
  196. >>470 ulelong 1
  197. >>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
  198. >>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
  199. >>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
  200. >>470 ulelong !1 \b (nonstandard: not at LBA 1)
  201. # GPT with protective MBR entry in partition 3
  202. >482 ubyte 0xee
  203. >>486 ulelong 1
  204. >>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
  205. >>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
  206. >>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
  207. >>486 ulelong !1 \b (nonstandard: not at LBA 1)
  208. # GPT with protective MBR entry in partition 4
  209. >498 ubyte 0xee
  210. >>502 ulelong 1
  211. >>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
  212. >>502 ulelong !1 \b (nonstandard: not at LBA 1)
  213. # Print the information from a GPT partition table structure
  214. 0 name gpt-table
  215. >10 uleshort x \b, version %u
  216. >8 uleshort x \b.%u
  217. >56 ulelong x \b, GUID: %08x
  218. >60 uleshort x \b-%04x
  219. >62 uleshort x \b-%04x
  220. >64 ubeshort x \b-%04x
  221. >66 ubeshort x \b-%04x
  222. >68 ubelong x \b%08x
  223. #>80 uleshort x \b, %d partition entries
  224. >32 ulequad+1 x \b, disk size: %lld sectors
  225. # In case a GPT data-structure is at LBA 0, report it as well
  226. # This covers systems which are not GPT-aware, and which show
  227. # and allow access to the protective partition. This code will
  228. # detect the contents of such a partition.
  229. 0 string EFI\ PART GPT data structure (nonstandard: at LBA 0)
  230. >0 use gpt-table
  231. >0 ubyte x (sector size unknown)