c - do-while 循环是无限的并且不断 append 文件

Question

我正在尝试从 SD 卡镜像恢复已删除的镜像。一切看起来都很好，直到我的 do-while 循环，特别是第 55 行(我认为是问题所在)。该循环是无限的，并重复 append 到它创建的最后一个文件。我尝试用蛮力的方式让它发挥作用，有时会得到稍微好一点的结果，有时会得到更糟糕的结果。简直输了。

/**
 * recover.c
 *
 * Recovers JPEGs from a forensic image.
 */

 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>

 #define BUFFER 512

int main(int argc, char* argv[])
{
    // jpeg signatures
    char sig1[] = {0xff, 0xd8, 0xff, 0xe0};
    char sig2[] = {0xff, 0xd8, 0xff, 0xe1};

    // buffer of 512 bytes
    char buffer[BUFFER];

    // counter for titles of jpgs
    int counter = 0;
    char title[8];

    // define and open card.raw
    FILE* card = fopen("card.raw", "r");
    if (card == NULL)
        {
            printf("Invalid file\n");
            return 1;
        }

    // read card.raw into buffer
    fread(&buffer, sizeof(unsigned char), 512, card);

    while (!feof(card))
    {        
        // compare first 4 bytes of buffer and signatures
        if (memcmp(buffer, sig1, 4) == 0 || memcmp(buffer, sig2, 4 == 0))
        {
            // format title, open image, write img, then reload buffer
            do
            {
                sprintf(title, "%03d.jpg", counter);
                FILE* img = fopen(title, "a");
                fwrite(&buffer, sizeof(unsigned char), 512, img);
                fread(&buffer, sizeof(unsigned char), 512, card);
                fclose(img);
            }
                // until buffer and a signature are equal
                while (memcmp(buffer, sig1, 4) != 0 && memcmp(buffer, sig2, 4) != 0);           

            // increase counter
            counter++;       
        }
        // if not jpg, read next block
        else
        fread(&buffer, sizeof(unsigned char), 512, card);        
    }   

    // close card.raw
    fclose(card);
    return 0;
}

Answer 1

我做了很多更改，但未经测试，因为我没有原始数据。主要的变化是读取循环，它假设每个 jpeg 文件位于连续的扇区中，并继续读/写扇区，直到找到另一个签名或文件末尾。

一些小的更改是测试读取的字节数而不是使用 feof()，以及使用 #define BUFFER 512 而不是硬编码 512 ，以及@RaphaelSantos 提到的错误。

您还可以尝试采纳他后来测试文件结尾的建议。

/* recover.c    Recovers JPEGs from a forensic image. */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#define BUFFER 512

int main(int argc, char* argv[])
{
    // jpeg signatures
    unsigned char sig1[] = {0xff, 0xd8, 0xff, 0xe0};
    unsigned char sig2[] = {0xff, 0xd8, 0xff, 0xe1};
    // buffer of 512 bytes
    unsigned char buffer[BUFFER];
    // counter for titles of jpgs
    int counter = 0;
    unsigned bytes;
    char title[8];
    FILE *card, *img;

    // define and open card.raw
    if ((card = fopen("card.raw", "r")) == NULL) {
        printf("Invalid input file\n");
        return 1;
    }

    // read card.raw into buffer
    bytes = fread(buffer, 1, BUFFER, card);
    while (bytes) {
        // compare first 4 bytes of buffer and signatures
        if (memcmp(buffer, sig1, 4) == 0 || memcmp(buffer, sig2, 4 == 0)) {
            // format title, open image, write img
            sprintf(title, "%03d.jpg", counter);
            if ((img = fopen(title, "w")) == NULL) {
                printf("Invalid output file\n");
                return 1;
            }
            do {
                fwrite(buffer, 1, bytes, img);
                bytes = fread(buffer, 1, BUFFER, card);
            } while (bytes && memcmp(buffer, sig1, 4) != 0 && memcmp(buffer, sig2, 4 != 0));
            fclose(img);
            counter++;
        }
        else
            bytes = fread(buffer, 1, BUFFER, card);
    }
    fclose(card);
    return 0;
}