OrcLib: VolumeReader: add virtual method Position

DFIR-ORC · May 5, 2023 · c3757de · c3757de
1 parent e737c99
commit c3757de
Show file tree

Hide file tree

Showing 7 changed files with 23 additions and 0 deletions.
diff --git a/src/OrcLib/CompleteVolumeReader.cpp b/src/OrcLib/CompleteVolumeReader.cpp
@@ -42,6 +42,11 @@ HRESULT CompleteVolumeReader::Seek(ULONGLONG offset)
     return m_Extents[0].Seek(liPosition, NULL, FILE_BEGIN);
 }
 
+uint64_t CompleteVolumeReader::Position() const
+{
+    return m_Extents[0].GetSeekOffset() + m_LocalPositionOffset;
+}
+
 HRESULT
 CompleteVolumeReader::ReadUnaligned(
     ULONGLONG offset,

diff --git a/src/OrcLib/CompleteVolumeReader.h b/src/OrcLib/CompleteVolumeReader.h
@@ -28,6 +28,8 @@ class CompleteVolumeReader : public VolumeReader
     HRESULT Seek(ULONGLONG offset);
     HRESULT Read(ULONGLONG offset, CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead);
 
+    uint64_t Position() const override;
+
     virtual std::shared_ptr<VolumeReader> ReOpen(DWORD dwDesiredAccess, DWORD dwShareMode, DWORD dwFlags);
 
     virtual ~CompleteVolumeReader();

diff --git a/src/OrcLib/OfflineMFTReader.cpp b/src/OrcLib/OfflineMFTReader.cpp
@@ -74,6 +74,11 @@ HRESULT OfflineMFTReader::Seek(ULONGLONG offset)
     return HRESULT_FROM_WIN32(ERROR_INVALID_OPERATION);
 }
 
+uint64_t OfflineMFTReader::Position() const
+{
+    return -1;
+}
+
 HRESULT OfflineMFTReader::Read(ULONGLONG offset, CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead)
 {
     DBG_UNREFERENCED_PARAMETER(offset);

diff --git a/src/OrcLib/OfflineMFTReader.h b/src/OrcLib/OfflineMFTReader.h
@@ -42,6 +42,8 @@ class OfflineMFTReader : public VolumeReader
     HRESULT Read(ULONGLONG offset, CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead);
     HRESULT Read(CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead);
 
+    uint64_t Position() const override;
+
     virtual std::shared_ptr<VolumeReader> ReOpen(DWORD dwDesiredAccess, DWORD dwShareMode, DWORD dwFlags);
 
     ~OfflineMFTReader(void);

diff --git a/src/OrcLib/VolumeReader.h b/src/OrcLib/VolumeReader.h
@@ -59,6 +59,8 @@ class VolumeReader : public std::enable_shared_from_this<VolumeReader>
 
     HRESULT Read(const LPBYTE data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead);
 
+    virtual uint64_t Position() const = 0;
+
     const CBinaryBuffer& GetBootSector() const { return m_BoostSector; }
 
     virtual std::shared_ptr<VolumeReader> ReOpen(DWORD dwDesiredAccess, DWORD dwShareMode, DWORD dwFlags) PURE;

diff --git a/tests/OrcLibTest/VolumeReaderTest.cpp b/tests/OrcLibTest/VolumeReaderTest.cpp
@@ -29,6 +29,11 @@ HRESULT VolumeReaderTest::Seek(ULONGLONG offset)
     return S_OK;
 }
 
+uint64_t VolumeReaderTest::Position() const
+{
+    return -1;
+}
+
 HRESULT VolumeReaderTest::Read(ULONGLONG offset, CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead)
 {
     data.SetCount(static_cast<size_t>(ullBytesToRead));

diff --git a/tests/OrcLibTest/VolumeReaderTest.h b/tests/OrcLibTest/VolumeReaderTest.h
@@ -34,6 +34,8 @@ class VolumeReaderTest : public VolumeReader
     virtual HANDLE GetDevice() { return INVALID_HANDLE_VALUE; }
 
     virtual HRESULT Seek(ULONGLONG offset);
+    uint64_t Position() const;
+
     virtual HRESULT Read(ULONGLONG offset, Orc::CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead);
     virtual HRESULT Read(CBinaryBuffer& data, ULONGLONG ullBytesToRead, ULONGLONG& ullBytesRead);