Ultimate: My image file browser

[BenLunt]

Hi guys,

I recently have been working with my EFI image files and was reaching around for various utilities. I found myself wanting a single utility. Therefore over the past week or so, I (quickly) drew up a single utility.

It will open and let you view/edit/modify a single image file with multiple partitions with various file systems.

If you wish, have a look at http://www.fysnet.net/ultimate/index.htm.

It is not really ready for release yet, it needs a lot of work, but I do need testing. Once I finish it, along with lots of tests to make sure it is okay, I will release it for all to use.

I mention it here only for feedback and if you wish to test it for me. As for the feedback, I am looking for extra capabilities. What do you wish you could do to an image file in this aspect?

It is only for Windows (sorry to those who use Linux, I don't have a Linux box), and use WinXP though I quickly tested it on later versions of windows and it seemed to work fine.

It is a single file, easy to install and delete. Using the Windows GUI, execute it and open an existing image file (EFI GPT, MBR, EMBR, FAT, LEAN, ISO, others). It can be a single partitioned image, a multi-partitioned image using MBR, eMBR, or GPT, or an ISO image.

Again, please note that it is not complete, nor working 100% to my expectations. However, since it only reads from a single file, and you can easily mark this file as read-only via the app, it can only damage (though not intended) a single file. This is why we have backups, right?

I do need to mention that it is in really early stages of release, so please use at your own risk. Also, there isn't any documentation yet, though it is really self explanatory.

If you find that it causes an error, crash, or whatever on a specific image file, I would appreciate an email, private message, or a reply in this thread on where I can get that image so that I may produce the same error.

Thank you,
Ben
- http://www.fysnet.net/osdesign_book_series.htm

[BenLunt]

Just a follow-up. I have done quite a bit of work on this project and it is now (somewhat) usable.

It still needs some work in some areas, but it should help you with your image files.

Again, it is only Windows (sorry to those *nix users), but seams to work well on WinXP and Win 8.1 (I only have those two versions on active machines).

Please let me know if you find anything in error or wish a feature to be added.

I hope it helps with your OS development.

Ben
- http://www.fysnet.net/ultimate/index.htm

[jankowalski25]

http://www.fysnet.net/fysos_embr.htm

since 01Jan1980

since the Epoch date

Is it 1980 or 1970? Your specification says 1980, but commonly used Unix Epoch time starts from 1970.

[BenLunt]

I chose 1980. Back when I chose that date, I was investigating the internals of DOS, which uses/used 1980. It was a few years later that I noticed Linux and others used 1970. The 1980 stuck.

It really doesn't matter once you know how many seconds there are between 1 Jan 1970 and 1 Jan 1980. You simply have to add or subtract in your calculation when using ready-made code that uses 1970.

Thanks though for the comment,

Ben

[jankowalski25]

Trying to run ultimate.exe in Wine: it crashed. But it is probably bug in Wine, so we can ignore this for now.
Trying to run it in Windows 10: it works.
Opening raw 160 GB image copied from real device. Message box appeared:

Trying to insert too many items.
To keep it under control and incase of invalid entries,
I limit the count of entries to 10240.

Pressed OK button. Then application closed immediately without any message.
Any ideas?

[BenLunt]

Hi,

I limit the amount of entries in the directory listing in case there is an error in the image's listing. Things like recursion errors; a directory pointing to itself, etc.

I would normally ask that you post or send the image to me so that I can do some tests, but at 160Gig, I think I'll pass.

How about a little more information? When you say raw, does it have a File System already installed? Which one?

Thanks,
Ben

[jankowalski25]

It is raw from the system point of view. It means it is just a binary dump from disk with no compression or something like this. I used "dd" program to create 16 files 10 GB each and then copied it using 16 GB USB stick. Then I joined all parts again into one big 160 GB image file. I noticed that your program correctly read MBR partition, I can also mount this image or for example run it under QEMU. It has NTFS and ext4 partitions.
Screenshot:

Your program detected also ext4 partition, but it exits too fast to create additional screenshot after clicking OK.
First 512 bytes from disk:

Code: Select all

+-----+-------------------------------------------------+------------------+
| Pos | Data                                            | ASCII            |
+-----+-------------------------------------------------+------------------+
| 000 | eb 63 90 d0 bc 00 7c 8e c0 8e d8 be 00 7c bf 00 |  c    |      |   |
| 010 | 06 b9 00 02 fc f3 a4 50 68 1c 06 cb fb b9 04 00 |        Ph        |
| 020 | bd be 07 80 7e 00 00 7c 0b 0f 85 0e 01 83 c5 10 |     ~  |         |
| 030 | e2 f1 cd 18 88 56 00 55 c6 46 11 05 c6 46 10 00 |      V U F   F   |
| 040 | b4 41 bb aa 55 cd 13 5d 72 0f 81 fb 55 aa 75 09 |  A  U  ]r   U u  |
| 050 | f7 c1 01 00 74 03 fe 46 10 66 00 80 01 00 00 00 |     t  F f       |
| 060 | 00 00 00 00 ff fa 90 90 f6 c2 80 74 05 f6 c2 70 |            t   p |
| 070 | 74 02 b2 80 ea 79 7c 00 00 31 c0 8e d8 8e d0 bc | t    y|  1       |
| 080 | 00 20 fb a0 64 7c 3c ff 74 02 88 c2 52 be 05 7c |     d|< t   R  | |
| 090 | b4 41 bb aa 55 cd 13 5a 52 72 3d 81 fb 55 aa 75 |  A  U  ZRr=  U u |
| 0a0 | 37 83 e1 01 74 32 31 c0 89 44 04 40 88 44 ff 89 | 7   t21  D @ D   |
| 0b0 | 44 02 c7 04 10 00 66 8b 1e 5c 7c 66 89 5c 08 66 | D     f  \|f \ f |
| 0c0 | 8b 1e 60 7c 66 89 5c 0c c7 44 06 00 70 b4 42 cd |   `|f \  D  p B  |
| 0d0 | 13 72 05 bb 00 70 eb 76 b4 08 cd 13 73 0d 5a 84 |  r   p v    s Z  |
| 0e0 | d2 0f 83 de 00 be 85 7d e9 82 00 66 0f b6 c6 88 |        }   f     |
| 0f0 | 64 ff 40 66 89 44 04 0f b6 d1 c1 e2 02 88 e8 88 | d @f D           |
| 100 | f4 40 89 44 08 0f b6 c2 c0 e8 02 66 89 04 66 a1 |  @ D       f  f  |
| 110 | 60 7c 66 09 c0 75 4e 66 a1 5c 7c 66 31 d2 66 f7 | `|f  uNf \|f1 f  |
| 120 | 34 88 d1 31 d2 66 f7 74 04 3b 44 08 7d 37 fe c1 | 4  1 f t ;D }7   |
| 130 | 88 c5 30 c0 c1 e8 02 08 c1 88 d0 5a 88 c6 bb 00 |   0        Z     |
| 140 | 70 8e c3 31 db b8 01 02 cd 13 72 1e 8c c3 60 1e | p  1      r   `  |
| 150 | b9 00 01 8e db 31 f6 bf 00 80 8e c6 fc f3 a5 1f |      1           |
| 160 | 61 ff 26 5a 7c be 80 7d eb 03 be 8f 7d e8 34 00 | a &Z|  }    } 4  |
| 170 | be 94 7d e8 2e 00 cd 18 eb fe 47 52 55 42 20 00 |   } .     GRUB   |
| 180 | 47 65 6f 6d 00 48 61 72 64 20 44 69 73 6b 00 52 | Geom Hard Disk R |
| 190 | 65 61 64 00 20 45 72 72 6f 72 0d 0a 00 bb 01 00 | ead  Error       |
| 1a0 | b4 0e cd 10 ac 3c 00 75 f4 c3 00 00 00 00 00 00 |      < u         |
| 1b0 | 00 00 00 00 00 00 00 00 4d 20 b5 62 00 00 80 20 |         M  b     |
| 1c0 | 21 00 07 dd 1e 3f 00 08 00 00 00 a0 0f 00 00 dd | !    ?           |
| 1d0 | 1f 3f 07 fe ff ff 00 a8 0f 00 00 00 00 0a 00 fe |  ?               |
| 1e0 | ff ff 83 fe ff ff 00 a8 0f 0a 00 e8 51 08 00 fe |             Q    |
| 1f0 | ff ff 82 fe ff ff 00 98 61 12 00 00 40 00 55 aa |         a   @ U  |
+-----+-------------------------------------------------+------------------+

[BenLunt]

Thank you for those screen shots. You have version 00.35.00 probably, or maybe even before that. I made a modification to the NTFS code last night and made it version 00.35.10. I think this modification fixes the issue you are seeing. I had the same issue before that.

It also fixes the displaying of the Record Size. Notice that the display of your record size is 246/10076x. The record size for the app is correct, it was just displaying it wrong.

I am still working on the NTFS stuff. I am wondering if there is an issue with memory. For example, I read in the whole MFT. The largest image I have used so far requires 70+ Meg of RAM to do this. Your 160gig might require a bit more. I think I need to re-write it so that I only read in so many clusters of the MFT and keep (somewhat of) a cache of the MFT instead of all of it. It will slow it down slightly, but it only has to read it once.

Watch for a new version within the next few days.

Thanks again for your help,
Ben