1 2#------------------------------------------------------------------------------ 3# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $ 4# 5# GPT Partition table patterns. 6# Author: Rogier Goossens (goossens.rogier@gmail.com) 7# Note that a GPT-formatted disk must contain an MBR as well. 8# 9 10# The initial segment (up to >>>>>>>>422) was copied from the X86 11# partition table code (aka MBR). 12# This is kept separate, so that MBR partitions are not reported as well. 13# (use -k if you do want them as well) 14 15# First, detect the MBR partiton table 16# If more than one GPT protective MBR partition exists, don't print anything 17# (the other MBR detection code will then just print the MBR partition table) 180x1FE leshort 0xAA55 19>3 string !MS 20>>3 string !SYSLINUX 21>>>3 string !MTOOL 22>>>>3 string !NEWLDR 23>>>>>5 string !DOS 24# not FAT (32 bit) 25>>>>>>82 string !FAT32 26#not Linux kernel 27>>>>>>>514 string !HdrS 28#not BeOS 29>>>>>>>>422 string !Be\ Boot\ Loader 30# GPT with protective MBR entry in partition 1 (only) 31>>>>>>>>>450 ubyte 0xee 32>>>>>>>>>>466 ubyte !0xee 33>>>>>>>>>>>482 ubyte !0xee 34>>>>>>>>>>>>498 ubyte !0xee 35#>>>>>>>>>>>>>446 use gpt-mbr-partition 36>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 37>>>>>>>>>>>>>>0 use gpt-mbr-type 38>>>>>>>>>>>>>>&-8 use gpt-table 39>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 40>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 41>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 42>>>>>>>>>>>>>>>0 use gpt-mbr-type 43>>>>>>>>>>>>>>>&-8 use gpt-table 44>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 45>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 46>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 47>>>>>>>>>>>>>>>>0 use gpt-mbr-type 48>>>>>>>>>>>>>>>>&-8 use gpt-table 49>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 50>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 51>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 52>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 53>>>>>>>>>>>>>>>>>&-8 use gpt-table 54>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 55>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 56>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 57>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 58>>>>>>>>>>>>>>>>>>&-8 use gpt-table 59>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 60# GPT with protective MBR entry in partition 2 (only) 61>>>>>>>>>450 ubyte !0xee 62>>>>>>>>>>466 ubyte 0xee 63>>>>>>>>>>>482 ubyte !0xee 64>>>>>>>>>>>>498 ubyte !0xee 65#>>>>>>>>>>>>>462 use gpt-mbr-partition 66>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 67>>>>>>>>>>>>>>0 use gpt-mbr-type 68>>>>>>>>>>>>>>&-8 use gpt-table 69>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 70>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 71>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 72>>>>>>>>>>>>>>>0 use gpt-mbr-type 73>>>>>>>>>>>>>>>&-8 use gpt-table 74>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 75>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 76>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 77>>>>>>>>>>>>>>>>0 use gpt-mbr-type 78>>>>>>>>>>>>>>>>&-8 use gpt-table 79>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 80>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 81>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 82>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 83>>>>>>>>>>>>>>>>>&-8 use gpt-table 84>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 85>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 86>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 87>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 88>>>>>>>>>>>>>>>>>>&-8 use gpt-table 89>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 90# GPT with protective MBR entry in partition 3 (only) 91>>>>>>>>>450 ubyte !0xee 92>>>>>>>>>>466 ubyte !0xee 93>>>>>>>>>>>482 ubyte 0xee 94>>>>>>>>>>>>498 ubyte !0xee 95#>>>>>>>>>>>>>478 use gpt-mbr-partition 96>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 97>>>>>>>>>>>>>>0 use gpt-mbr-type 98>>>>>>>>>>>>>>&-8 use gpt-table 99>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 100>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 101>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 102>>>>>>>>>>>>>>>0 use gpt-mbr-type 103>>>>>>>>>>>>>>>&-8 use gpt-table 104>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 105>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 106>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 107>>>>>>>>>>>>>>>>0 use gpt-mbr-type 108>>>>>>>>>>>>>>>>&-8 use gpt-table 109>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 110>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 111>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 112>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 113>>>>>>>>>>>>>>>>>&-8 use gpt-table 114>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 115>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 116>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 117>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 118>>>>>>>>>>>>>>>>>>&-8 use gpt-table 119>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 120# GPT with protective MBR entry in partition 4 (only) 121>>>>>>>>>450 ubyte !0xee 122>>>>>>>>>>466 ubyte !0xee 123>>>>>>>>>>>482 ubyte !0xee 124>>>>>>>>>>>>498 ubyte 0xee 125#>>>>>>>>>>>>>494 use gpt-mbr-partition 126>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 127>>>>>>>>>>>>>>0 use gpt-mbr-type 128>>>>>>>>>>>>>>&-8 use gpt-table 129>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 130>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 131>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 132>>>>>>>>>>>>>>>0 use gpt-mbr-type 133>>>>>>>>>>>>>>>&-8 use gpt-table 134>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 135>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 136>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 137>>>>>>>>>>>>>>>>0 use gpt-mbr-type 138>>>>>>>>>>>>>>>>&-8 use gpt-table 139>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 140>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 141>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 142>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 143>>>>>>>>>>>>>>>>>&-8 use gpt-table 144>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 145>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 146>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 147>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 148>>>>>>>>>>>>>>>>>>&-8 use gpt-table 149>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 150 151# The following code does GPT detection and processing, including 152# sector size detection. 153# It has to be duplicated above because the top-level pattern 154# (i.e. not called using 'use') must print *something* for file 155# to count it as a match. Text only printed in named patterns is 156# not counted, and causes file to continue, and try and match 157# other patterns. 158# 159# Unfortunately, when assuming sector sizes >=16k, if the sector size 160# happens to be 512 instead, we may find confusing data after the GPT 161# table... If the GPT table has less than 128 entries, this may even 162# happen for assumed sector sizes as small as 4k 163# This could be solved by checking for the presence of the backup GPT 164# header as well, but that makes the logic extremely complex 165##0 name gpt-mbr-partition 166##>(8.l*8192) string EFI\ PART 167##>>(8.l*8192) use gpt-mbr-type 168##>>&-8 use gpt-table 169##>>0 ubyte x of 8192 bytes 170##>(8.l*8192) string !EFI\ PART 171##>>(8.l*4096) string EFI\ PART GPT partition table 172##>>>0 use gpt-mbr-type 173##>>>&-8 use gpt-table 174##>>>0 ubyte x of 4096 bytes 175##>>(8.l*4096) string !EFI\ PART 176##>>>(8.l*2048) string EFI\ PART GPT partition table 177##>>>>0 use gpt-mbr-type 178##>>>>&-8 use gpt-table 179##>>>>0 ubyte x of 2048 bytes 180##>>>(8.l*2048) string !EFI\ PART 181##>>>>(8.l*1024) string EFI\ PART GPT partition table 182##>>>>>0 use gpt-mbr-type 183##>>>>>&-8 use gpt-table 184##>>>>>0 ubyte x of 1024 bytes 185##>>>>(8.l*1024) string !EFI\ PART 186##>>>>>(8.l*512) string EFI\ PART GPT partition table 187##>>>>>>0 use gpt-mbr-type 188##>>>>>>&-8 use gpt-table 189##>>>>>>0 ubyte x of 512 bytes 190 191# Print details of MBR type for a GPT-disk 192# Calling code ensures that there is only one 0xee partition. 1930 name gpt-mbr-type 194# GPT with protective MBR entry in partition 1 195>450 ubyte 0xee 196>>454 ulelong 1 197>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 198>>454 ulelong !1 \b (nonstandard: not at LBA 1) 199# GPT with protective MBR entry in partition 2 200>466 ubyte 0xee 201>>470 ulelong 1 202>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 203>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 204>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 205>>470 ulelong !1 \b (nonstandard: not at LBA 1) 206# GPT with protective MBR entry in partition 3 207>482 ubyte 0xee 208>>486 ulelong 1 209>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 210>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 211>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 212>>486 ulelong !1 \b (nonstandard: not at LBA 1) 213# GPT with protective MBR entry in partition 4 214>498 ubyte 0xee 215>>502 ulelong 1 216>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 217>>502 ulelong !1 \b (nonstandard: not at LBA 1) 218 219# Print the information from a GPT partition table structure 2200 name gpt-table 221>10 uleshort x \b, version %u 222>8 uleshort x \b.%u 223>56 ulelong x \b, GUID: %08x 224>60 uleshort x \b-%04x 225>62 uleshort x \b-%04x 226>64 ubeshort x \b-%04x 227>66 ubeshort x \b-%04x 228>68 ubelong x \b%08x 229#>80 uleshort x \b, %d partition entries 230>32 ulequad+1 x \b, disk size: %lld sectors 231 232# In case a GPT data-structure is at LBA 0, report it as well 233# This covers systems which are not GPT-aware, and which show 234# and allow access to the protective partition. This code will 235# detect the contents of such a partition. 2360 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 237>0 use gpt-table 238>0 ubyte x (sector size unknown) 239 240 241