1*b6cee71dSXin LI 2*b6cee71dSXin LI#------------------------------------------------------------------------------ 3*b6cee71dSXin LI# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $ 4*b6cee71dSXin LI# 5*b6cee71dSXin LI# GPT Partition table patterns. 6*b6cee71dSXin LI# Author: Rogier Goossens (goossens.rogier@gmail.com) 7*b6cee71dSXin LI# Note that a GPT-formatted disk must contain an MBR as well. 8*b6cee71dSXin LI# 9*b6cee71dSXin LI 10*b6cee71dSXin LI# The initial segment (up to >>>>>>>>422) was copied from the X86 11*b6cee71dSXin LI# partition table code (aka MBR). 12*b6cee71dSXin LI# This is kept separate, so that MBR partitions are not reported as well. 13*b6cee71dSXin LI# (use -k if you do want them as well) 14*b6cee71dSXin LI 15*b6cee71dSXin LI# First, detect the MBR partiton table 16*b6cee71dSXin LI# If more than one GPT protective MBR partition exists, don't print anything 17*b6cee71dSXin LI# (the other MBR detection code will then just print the MBR partition table) 18*b6cee71dSXin LI0x1FE leshort 0xAA55 19*b6cee71dSXin LI>3 string !MS 20*b6cee71dSXin LI>>3 string !SYSLINUX 21*b6cee71dSXin LI>>>3 string !MTOOL 22*b6cee71dSXin LI>>>>3 string !NEWLDR 23*b6cee71dSXin LI>>>>>5 string !DOS 24*b6cee71dSXin LI# not FAT (32 bit) 25*b6cee71dSXin LI>>>>>>82 string !FAT32 26*b6cee71dSXin LI#not Linux kernel 27*b6cee71dSXin LI>>>>>>>514 string !HdrS 28*b6cee71dSXin LI#not BeOS 29*b6cee71dSXin LI>>>>>>>>422 string !Be\ Boot\ Loader 30*b6cee71dSXin LI# GPT with protective MBR entry in partition 1 (only) 31*b6cee71dSXin LI>>>>>>>>>450 ubyte 0xee 32*b6cee71dSXin LI>>>>>>>>>>466 ubyte !0xee 33*b6cee71dSXin LI>>>>>>>>>>>482 ubyte !0xee 34*b6cee71dSXin LI>>>>>>>>>>>>498 ubyte !0xee 35*b6cee71dSXin LI#>>>>>>>>>>>>>446 use gpt-mbr-partition 36*b6cee71dSXin LI>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 37*b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 38*b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 39*b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 40*b6cee71dSXin LI>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 41*b6cee71dSXin LI>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 42*b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 43*b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 44*b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 45*b6cee71dSXin LI>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 46*b6cee71dSXin LI>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 47*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 48*b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 49*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 50*b6cee71dSXin LI>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 51*b6cee71dSXin LI>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 52*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 53*b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 54*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 55*b6cee71dSXin LI>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 56*b6cee71dSXin LI>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 57*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 58*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 59*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 60*b6cee71dSXin LI# GPT with protective MBR entry in partition 2 (only) 61*b6cee71dSXin LI>>>>>>>>>450 ubyte !0xee 62*b6cee71dSXin LI>>>>>>>>>>466 ubyte 0xee 63*b6cee71dSXin LI>>>>>>>>>>>482 ubyte !0xee 64*b6cee71dSXin LI>>>>>>>>>>>>498 ubyte !0xee 65*b6cee71dSXin LI#>>>>>>>>>>>>>462 use gpt-mbr-partition 66*b6cee71dSXin LI>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 67*b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 68*b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 69*b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 70*b6cee71dSXin LI>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 71*b6cee71dSXin LI>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 72*b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 73*b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 74*b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 75*b6cee71dSXin LI>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 76*b6cee71dSXin LI>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 77*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 78*b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 79*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 80*b6cee71dSXin LI>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 81*b6cee71dSXin LI>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 82*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 83*b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 84*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 85*b6cee71dSXin LI>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 86*b6cee71dSXin LI>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 87*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 88*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 89*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 90*b6cee71dSXin LI# GPT with protective MBR entry in partition 3 (only) 91*b6cee71dSXin LI>>>>>>>>>450 ubyte !0xee 92*b6cee71dSXin LI>>>>>>>>>>466 ubyte !0xee 93*b6cee71dSXin LI>>>>>>>>>>>482 ubyte 0xee 94*b6cee71dSXin LI>>>>>>>>>>>>498 ubyte !0xee 95*b6cee71dSXin LI#>>>>>>>>>>>>>478 use gpt-mbr-partition 96*b6cee71dSXin LI>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 97*b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 98*b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 99*b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 100*b6cee71dSXin LI>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 101*b6cee71dSXin LI>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 102*b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 103*b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 104*b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 105*b6cee71dSXin LI>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 106*b6cee71dSXin LI>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 107*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 108*b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 109*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 110*b6cee71dSXin LI>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 111*b6cee71dSXin LI>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 112*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 113*b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 114*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 115*b6cee71dSXin LI>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 116*b6cee71dSXin LI>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 117*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 118*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 119*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 120*b6cee71dSXin LI# GPT with protective MBR entry in partition 4 (only) 121*b6cee71dSXin LI>>>>>>>>>450 ubyte !0xee 122*b6cee71dSXin LI>>>>>>>>>>466 ubyte !0xee 123*b6cee71dSXin LI>>>>>>>>>>>482 ubyte !0xee 124*b6cee71dSXin LI>>>>>>>>>>>>498 ubyte 0xee 125*b6cee71dSXin LI#>>>>>>>>>>>>>494 use gpt-mbr-partition 126*b6cee71dSXin LI>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 127*b6cee71dSXin LI>>>>>>>>>>>>>>0 use gpt-mbr-type 128*b6cee71dSXin LI>>>>>>>>>>>>>>&-8 use gpt-table 129*b6cee71dSXin LI>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 130*b6cee71dSXin LI>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 131*b6cee71dSXin LI>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 132*b6cee71dSXin LI>>>>>>>>>>>>>>>0 use gpt-mbr-type 133*b6cee71dSXin LI>>>>>>>>>>>>>>>&-8 use gpt-table 134*b6cee71dSXin LI>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 135*b6cee71dSXin LI>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 136*b6cee71dSXin LI>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 137*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 use gpt-mbr-type 138*b6cee71dSXin LI>>>>>>>>>>>>>>>>&-8 use gpt-table 139*b6cee71dSXin LI>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 140*b6cee71dSXin LI>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 141*b6cee71dSXin LI>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 142*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 143*b6cee71dSXin LI>>>>>>>>>>>>>>>>>&-8 use gpt-table 144*b6cee71dSXin LI>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 145*b6cee71dSXin LI>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 146*b6cee71dSXin LI>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 147*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 148*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>&-8 use gpt-table 149*b6cee71dSXin LI>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 150*b6cee71dSXin LI 151*b6cee71dSXin LI# The following code does GPT detection and processing, including 152*b6cee71dSXin LI# sector size detection. 153*b6cee71dSXin LI# It has to be duplicated above because the top-level pattern 154*b6cee71dSXin LI# (i.e. not called using 'use') must print *something* for file 155*b6cee71dSXin LI# to count it as a match. Text only printed in named patterns is 156*b6cee71dSXin LI# not counted, and causes file to continue, and try and match 157*b6cee71dSXin LI# other patterns. 158*b6cee71dSXin LI# 159*b6cee71dSXin LI# Unfortunately, when assuming sector sizes >=16k, if the sector size 160*b6cee71dSXin LI# happens to be 512 instead, we may find confusing data after the GPT 161*b6cee71dSXin LI# table... If the GPT table has less than 128 entries, this may even 162*b6cee71dSXin LI# happen for assumed sector sizes as small as 4k 163*b6cee71dSXin LI# This could be solved by checking for the presence of the backup GPT 164*b6cee71dSXin LI# header as well, but that makes the logic extremely complex 165*b6cee71dSXin LI##0 name gpt-mbr-partition 166*b6cee71dSXin LI##>(8.l*8192) string EFI\ PART 167*b6cee71dSXin LI##>>(8.l*8192) use gpt-mbr-type 168*b6cee71dSXin LI##>>&-8 use gpt-table 169*b6cee71dSXin LI##>>0 ubyte x of 8192 bytes 170*b6cee71dSXin LI##>(8.l*8192) string !EFI\ PART 171*b6cee71dSXin LI##>>(8.l*4096) string EFI\ PART GPT partition table 172*b6cee71dSXin LI##>>>0 use gpt-mbr-type 173*b6cee71dSXin LI##>>>&-8 use gpt-table 174*b6cee71dSXin LI##>>>0 ubyte x of 4096 bytes 175*b6cee71dSXin LI##>>(8.l*4096) string !EFI\ PART 176*b6cee71dSXin LI##>>>(8.l*2048) string EFI\ PART GPT partition table 177*b6cee71dSXin LI##>>>>0 use gpt-mbr-type 178*b6cee71dSXin LI##>>>>&-8 use gpt-table 179*b6cee71dSXin LI##>>>>0 ubyte x of 2048 bytes 180*b6cee71dSXin LI##>>>(8.l*2048) string !EFI\ PART 181*b6cee71dSXin LI##>>>>(8.l*1024) string EFI\ PART GPT partition table 182*b6cee71dSXin LI##>>>>>0 use gpt-mbr-type 183*b6cee71dSXin LI##>>>>>&-8 use gpt-table 184*b6cee71dSXin LI##>>>>>0 ubyte x of 1024 bytes 185*b6cee71dSXin LI##>>>>(8.l*1024) string !EFI\ PART 186*b6cee71dSXin LI##>>>>>(8.l*512) string EFI\ PART GPT partition table 187*b6cee71dSXin LI##>>>>>>0 use gpt-mbr-type 188*b6cee71dSXin LI##>>>>>>&-8 use gpt-table 189*b6cee71dSXin LI##>>>>>>0 ubyte x of 512 bytes 190*b6cee71dSXin LI 191*b6cee71dSXin LI# Print details of MBR type for a GPT-disk 192*b6cee71dSXin LI# Calling code ensures that there is only one 0xee partition. 193*b6cee71dSXin LI0 name gpt-mbr-type 194*b6cee71dSXin LI# GPT with protective MBR entry in partition 1 195*b6cee71dSXin LI>450 ubyte 0xee 196*b6cee71dSXin LI>>454 ulelong 1 197*b6cee71dSXin LI>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 198*b6cee71dSXin LI>>454 ulelong !1 \b (nonstandard: not at LBA 1) 199*b6cee71dSXin LI# GPT with protective MBR entry in partition 2 200*b6cee71dSXin LI>466 ubyte 0xee 201*b6cee71dSXin LI>>470 ulelong 1 202*b6cee71dSXin LI>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 203*b6cee71dSXin LI>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 204*b6cee71dSXin LI>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 205*b6cee71dSXin LI>>470 ulelong !1 \b (nonstandard: not at LBA 1) 206*b6cee71dSXin LI# GPT with protective MBR entry in partition 3 207*b6cee71dSXin LI>482 ubyte 0xee 208*b6cee71dSXin LI>>486 ulelong 1 209*b6cee71dSXin LI>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 210*b6cee71dSXin LI>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 211*b6cee71dSXin LI>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 212*b6cee71dSXin LI>>486 ulelong !1 \b (nonstandard: not at LBA 1) 213*b6cee71dSXin LI# GPT with protective MBR entry in partition 4 214*b6cee71dSXin LI>498 ubyte 0xee 215*b6cee71dSXin LI>>502 ulelong 1 216*b6cee71dSXin LI>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 217*b6cee71dSXin LI>>502 ulelong !1 \b (nonstandard: not at LBA 1) 218*b6cee71dSXin LI 219*b6cee71dSXin LI# Print the information from a GPT partition table structure 220*b6cee71dSXin LI0 name gpt-table 221*b6cee71dSXin LI>10 uleshort x \b, version %u 222*b6cee71dSXin LI>8 uleshort x \b.%u 223*b6cee71dSXin LI>56 ulelong x \b, GUID: %08x 224*b6cee71dSXin LI>60 uleshort x \b-%04x 225*b6cee71dSXin LI>62 uleshort x \b-%04x 226*b6cee71dSXin LI>64 ubeshort x \b-%04x 227*b6cee71dSXin LI>66 ubeshort x \b-%04x 228*b6cee71dSXin LI>68 ubelong x \b%08x 229*b6cee71dSXin LI#>80 uleshort x \b, %d partition entries 230*b6cee71dSXin LI>32 ulequad+1 x \b, disk size: %lld sectors 231*b6cee71dSXin LI 232*b6cee71dSXin LI# In case a GPT data-structure is at LBA 0, report it as well 233*b6cee71dSXin LI# This covers systems which are not GPT-aware, and which show 234*b6cee71dSXin LI# and allow access to the protective partition. This code will 235*b6cee71dSXin LI# detect the contents of such a partition. 236*b6cee71dSXin LI0 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 237*b6cee71dSXin LI>0 use gpt-table 238*b6cee71dSXin LI>0 ubyte x (sector size unknown) 239*b6cee71dSXin LI 240*b6cee71dSXin LI 241