1b6cee71dSXin LI 2b6cee71dSXin LI#------------------------------------------------------------------------------ 3*43a5ec4eSXin LI# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $ 4b6cee71dSXin LI# 5b6cee71dSXin LI# GPT Partition table patterns. 6b6cee71dSXin LI# Author: Rogier Goossens (goossens.rogier@gmail.com) 7b6cee71dSXin LI# Note that a GPT-formatted disk must contain an MBR as well. 8b6cee71dSXin LI# 9b6cee71dSXin LI 10b6cee71dSXin LI# The initial segment (up to >>>>>>>>422) was copied from the X86 11b6cee71dSXin LI# partition table code (aka MBR). 12b6cee71dSXin LI# This is kept separate, so that MBR partitions are not reported as well. 13b6cee71dSXin LI# (use -k if you do want them as well) 14b6cee71dSXin LI 15*43a5ec4eSXin LI# First, detect the MBR partition table 16b6cee71dSXin LI# If more than one GPT protective MBR partition exists, don't print anything 17b6cee71dSXin LI# (the other MBR detection code will then just print the MBR partition table) 18b6cee71dSXin LI0x1FE leshort 0xAA55 19b6cee71dSXin LI>3 string !MS 20b6cee71dSXin LI>>3 string !SYSLINUX 21b6cee71dSXin LI>>>3 string !MTOOL 22b6cee71dSXin LI>>>>3 string !NEWLDR 23b6cee71dSXin LI>>>>>5 string !DOS 24b6cee71dSXin LI# not FAT (32 bit) 25b6cee71dSXin LI>>>>>>82 string !FAT32 26b6cee71dSXin LI#not Linux kernel 27b6cee71dSXin LI>>>>>>>514 string !HdrS 28b6cee71dSXin LI#not BeOS 29b6cee71dSXin LI>>>>>>>>422 string !Be\ Boot\ Loader 30b6cee71dSXin LI# GPT with protective MBR entry in partition 1 (only) 31b6cee71dSXin LI>>>>>>>>>450 ubyte 0xee 32b6cee71dSXin LI>>>>>>>>>>466 ubyte !0xee 33b6cee71dSXin LI>>>>>>>>>>>482 ubyte !0xee 34b6cee71dSXin LI>>>>>>>>>>>>498 ubyte !0xee 35b6cee71dSXin LI#>>>>>>>>>>>>>446 use gpt-mbr-partition 36b6cee71dSXin LI>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 37b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 38b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 39b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 40b6cee71dSXin LI>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 41b6cee71dSXin LI>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 42b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 43b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 44b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 45b6cee71dSXin LI>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 46b6cee71dSXin LI>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 47b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 48b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 49b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 50b6cee71dSXin LI>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 51b6cee71dSXin LI>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 52b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 53b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 54b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 55b6cee71dSXin LI>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 56b6cee71dSXin LI>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 57b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 58b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 59b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 60b6cee71dSXin LI# GPT with protective MBR entry in partition 2 (only) 61b6cee71dSXin LI>>>>>>>>>450 ubyte !0xee 62b6cee71dSXin LI>>>>>>>>>>466 ubyte 0xee 63b6cee71dSXin LI>>>>>>>>>>>482 ubyte !0xee 64b6cee71dSXin LI>>>>>>>>>>>>498 ubyte !0xee 65b6cee71dSXin LI#>>>>>>>>>>>>>462 use gpt-mbr-partition 66b6cee71dSXin LI>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 67b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 68b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 69b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 70b6cee71dSXin LI>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 71b6cee71dSXin LI>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 72b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 73b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 74b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 75b6cee71dSXin LI>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 76b6cee71dSXin LI>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 77b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 78b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 79b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 80b6cee71dSXin LI>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 81b6cee71dSXin LI>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 82b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 83b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 84b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 85b6cee71dSXin LI>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 86b6cee71dSXin LI>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 87b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 88b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 89b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 90b6cee71dSXin LI# GPT with protective MBR entry in partition 3 (only) 91b6cee71dSXin LI>>>>>>>>>450 ubyte !0xee 92b6cee71dSXin LI>>>>>>>>>>466 ubyte !0xee 93b6cee71dSXin LI>>>>>>>>>>>482 ubyte 0xee 94b6cee71dSXin LI>>>>>>>>>>>>498 ubyte !0xee 95b6cee71dSXin LI#>>>>>>>>>>>>>478 use gpt-mbr-partition 96b6cee71dSXin LI>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 97b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 98b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 99b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 100b6cee71dSXin LI>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 101b6cee71dSXin LI>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 102b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 103b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 104b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 105b6cee71dSXin LI>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 106b6cee71dSXin LI>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 107b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 108b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 109b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 110b6cee71dSXin LI>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 111b6cee71dSXin LI>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 112b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 113b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 114b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 115b6cee71dSXin LI>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 116b6cee71dSXin LI>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 117b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 118b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 119b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 120b6cee71dSXin LI# GPT with protective MBR entry in partition 4 (only) 121b6cee71dSXin LI>>>>>>>>>450 ubyte !0xee 122b6cee71dSXin LI>>>>>>>>>>466 ubyte !0xee 123b6cee71dSXin LI>>>>>>>>>>>482 ubyte !0xee 124b6cee71dSXin LI>>>>>>>>>>>>498 ubyte 0xee 125b6cee71dSXin LI#>>>>>>>>>>>>>494 use gpt-mbr-partition 126b6cee71dSXin LI>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 127b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 128b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 129b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 130b6cee71dSXin LI>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 131b6cee71dSXin LI>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 132b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 133b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 134b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 135b6cee71dSXin LI>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 136b6cee71dSXin LI>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 137b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 138b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 139b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 140b6cee71dSXin LI>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 141b6cee71dSXin LI>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 142b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 143b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 144b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 145b6cee71dSXin LI>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 146b6cee71dSXin LI>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 147b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 148b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 149b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 150b6cee71dSXin LI 151b6cee71dSXin LI# The following code does GPT detection and processing, including 152b6cee71dSXin LI# sector size detection. 153b6cee71dSXin LI# It has to be duplicated above because the top-level pattern 154b6cee71dSXin LI# (i.e. not called using 'use') must print *something* for file 155b6cee71dSXin LI# to count it as a match. Text only printed in named patterns is 156b6cee71dSXin LI# not counted, and causes file to continue, and try and match 157b6cee71dSXin LI# other patterns. 158b6cee71dSXin LI# 159b6cee71dSXin LI# Unfortunately, when assuming sector sizes >=16k, if the sector size 160b6cee71dSXin LI# happens to be 512 instead, we may find confusing data after the GPT 161b6cee71dSXin LI# table... If the GPT table has less than 128 entries, this may even 162b6cee71dSXin LI# happen for assumed sector sizes as small as 4k 163b6cee71dSXin LI# This could be solved by checking for the presence of the backup GPT 164b6cee71dSXin LI# header as well, but that makes the logic extremely complex 165b6cee71dSXin LI##0 name gpt-mbr-partition 166b6cee71dSXin LI##>(8.l*8192) string EFI\ PART 167b6cee71dSXin LI##>>(8.l*8192) use gpt-mbr-type 168b6cee71dSXin LI##>>&-8 use gpt-table 169b6cee71dSXin LI##>>0 ubyte x of 8192 bytes 170b6cee71dSXin LI##>(8.l*8192) string !EFI\ PART 171b6cee71dSXin LI##>>(8.l*4096) string EFI\ PART GPT partition table 172b6cee71dSXin LI##>>>0 use gpt-mbr-type 173b6cee71dSXin LI##>>>&-8 use gpt-table 174b6cee71dSXin LI##>>>0 ubyte x of 4096 bytes 175b6cee71dSXin LI##>>(8.l*4096) string !EFI\ PART 176b6cee71dSXin LI##>>>(8.l*2048) string EFI\ PART GPT partition table 177b6cee71dSXin LI##>>>>0 use gpt-mbr-type 178b6cee71dSXin LI##>>>>&-8 use gpt-table 179b6cee71dSXin LI##>>>>0 ubyte x of 2048 bytes 180b6cee71dSXin LI##>>>(8.l*2048) string !EFI\ PART 181b6cee71dSXin LI##>>>>(8.l*1024) string EFI\ PART GPT partition table 182b6cee71dSXin LI##>>>>>0 use gpt-mbr-type 183b6cee71dSXin LI##>>>>>&-8 use gpt-table 184b6cee71dSXin LI##>>>>>0 ubyte x of 1024 bytes 185b6cee71dSXin LI##>>>>(8.l*1024) string !EFI\ PART 186b6cee71dSXin LI##>>>>>(8.l*512) string EFI\ PART GPT partition table 187b6cee71dSXin LI##>>>>>>0 use gpt-mbr-type 188b6cee71dSXin LI##>>>>>>&-8 use gpt-table 189b6cee71dSXin LI##>>>>>>0 ubyte x of 512 bytes 190b6cee71dSXin LI 191b6cee71dSXin LI# Print details of MBR type for a GPT-disk 192b6cee71dSXin LI# Calling code ensures that there is only one 0xee partition. 193b6cee71dSXin LI0 name gpt-mbr-type 194b6cee71dSXin LI# GPT with protective MBR entry in partition 1 195b6cee71dSXin LI>450 ubyte 0xee 196b6cee71dSXin LI>>454 ulelong 1 197b6cee71dSXin LI>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 198b6cee71dSXin LI>>454 ulelong !1 \b (nonstandard: not at LBA 1) 199b6cee71dSXin LI# GPT with protective MBR entry in partition 2 200b6cee71dSXin LI>466 ubyte 0xee 201b6cee71dSXin LI>>470 ulelong 1 202b6cee71dSXin LI>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 203b6cee71dSXin LI>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 204b6cee71dSXin LI>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 205b6cee71dSXin LI>>470 ulelong !1 \b (nonstandard: not at LBA 1) 206b6cee71dSXin LI# GPT with protective MBR entry in partition 3 207b6cee71dSXin LI>482 ubyte 0xee 208b6cee71dSXin LI>>486 ulelong 1 209b6cee71dSXin LI>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 210b6cee71dSXin LI>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 211b6cee71dSXin LI>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 212b6cee71dSXin LI>>486 ulelong !1 \b (nonstandard: not at LBA 1) 213b6cee71dSXin LI# GPT with protective MBR entry in partition 4 214b6cee71dSXin LI>498 ubyte 0xee 215b6cee71dSXin LI>>502 ulelong 1 216b6cee71dSXin LI>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 217b6cee71dSXin LI>>502 ulelong !1 \b (nonstandard: not at LBA 1) 218b6cee71dSXin LI 219b6cee71dSXin LI# Print the information from a GPT partition table structure 220b6cee71dSXin LI0 name gpt-table 221b6cee71dSXin LI>10 uleshort x \b, version %u 222b6cee71dSXin LI>8 uleshort x \b.%u 223b6cee71dSXin LI>56 ulelong x \b, GUID: %08x 224b6cee71dSXin LI>60 uleshort x \b-%04x 225b6cee71dSXin LI>62 uleshort x \b-%04x 226b6cee71dSXin LI>64 ubeshort x \b-%04x 227b6cee71dSXin LI>66 ubeshort x \b-%04x 228b6cee71dSXin LI>68 ubelong x \b%08x 229b6cee71dSXin LI#>80 uleshort x \b, %d partition entries 230b6cee71dSXin LI>32 ulequad+1 x \b, disk size: %lld sectors 231b6cee71dSXin LI 232b6cee71dSXin LI# In case a GPT data-structure is at LBA 0, report it as well 233b6cee71dSXin LI# This covers systems which are not GPT-aware, and which show 234b6cee71dSXin LI# and allow access to the protective partition. This code will 235b6cee71dSXin LI# detect the contents of such a partition. 236b6cee71dSXin LI0 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 237b6cee71dSXin LI>0 use gpt-table 238b6cee71dSXin LI>0 ubyte x (sector size unknown) 239b6cee71dSXin LI 240b6cee71dSXin LI 241