The line below is wrong:
|
int ut_type; // defined as short at man page but I have seen 4 byte type on real system |
ut_type is indeed 16bits, however the next value pid_t ut_pid needs to be aligned, so gcc will insert 2 empty bytes because the value isn't packed.
This is not an issue as is on little endian systems (02 00 00 00 stays the same whether the value is 32bits or 16bits followed by padding), but this will fail on big endian systems as value will appear at 00 02 00 00 in the file and read as 0x20000 and considered invalid (I don't know if you support big endian at all, I do and while looking for anyone who may have done a carver for utmp I found your code, but unfortunately I won't be able to use it, but I thought I'd still leave a comment on that so you know why it's defined as a short int but appears to take 4 bytes).
The line below is wrong:
bulk_extractor-rec/src/scan_utmp.cpp
Line 31 in 1964395
ut_typeis indeed 16bits, however the next valuepid_t ut_pidneeds to be aligned, so gcc will insert 2 empty bytes because the value isn't packed.This is not an issue as is on little endian systems (
02 00 00 00stays the same whether the value is 32bits or 16bits followed by padding), but this will fail on big endian systems as value will appear at00 02 00 00in the file and read as 0x20000 and considered invalid (I don't know if you support big endian at all, I do and while looking for anyone who may have done a carver for utmp I found your code, but unfortunately I won't be able to use it, but I thought I'd still leave a comment on that so you know why it's defined as ashort intbut appears to take 4 bytes).