-1

我有一个包含多个测试文件的 NTFS 文件的图像。当我到达 Windows Bin 时，我遇到数据运行：1 个集群 => 4096 / 0x1000 字节

22 BD 00 42 01 21 56 67 FF 11 03 97 11 13 D7 00。

通常这意味着我有 4 次运行：

22 BD 00 42 01 => 0xBD 簇 @ 0x142 簇偏移

21 56 67 FF => 0x56 簇 @ 0xFF67 簇偏移

11 03 97 => 0x3 簇 @ 0x97 簇偏移

11 13 D7 => 0x13 簇 @ 0xD7 簇偏移

问题是，没有足够的簇来达到 0xFF67，你会越界。

在 0x97 偏移处的 3 个集群中找到的原始数据也不匹配文件中的任何数据。

任何人都知道问题可能是什么？

这里是整个条目的代码，它从偏移量 0x14400 开始

46 49 4C 45 30 00 03 00 00 00 00 00 00 00 00 00 01 00 01 00 38 00 01 00 B0 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 06 00 00 00 41 00 00 00 5B 02 00 00 00 00 00 00 10 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 18 00 00 00 C3 CD AA 79 E0 48 D6 01 00 A6 A1 73 74 AE D4 01 4F DA 03 E7 40 60 D6 01 AA B7 DF 77 40 60 D6 01 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 70 00 00 00 00 00 00 00 00 00 05 00 58 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 C3 CD AA 79 E0 48 D6 01 00 A6 A1 73 74 AE D4 01 B0 33 8A E4 40 60 D6 01 AA B7 DF 77 40 60 D6 01 00 90 12 00 00 00 00 00 F8 83 12 00 00 00 00 00 20 00 00 00 00 00 00 00 0B 00 74 00 65 00 73 00 74 00 42 00 49 00 4E 00 2E 00 62 00 69 00 6E 00 50 00 00 00 68 00 00 00 00 00 00 00 00 00 01 00 50 00 00 00 18 00 00 00 01 00 04 80 14 00 00 00 24 00 00 00 00 00 00 00 34 00 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 02 00 1C 00 01 00 00 00 00 03 14 00 FF 01 1F 00 01 01 00 00 00 00 00 01 00 00 00 00 80 00 00 00 50 00 00 00 01 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 28 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 90 12 00 00 00 00 00 F8 83 12 00 00 00 00 00 F8 83 12 00 00 00 00 00 22 BD 00 42 01 21 56 67 FF 11 03 97 11 13 D7 00 FF FF FF FF 00 00 00 00 01 00 00 00 00 03 14 00 FF 01 1F 00 01 01 00 00 00 00 00 01 00 00 00 00 80 00 00 00 50 00 00 00 01 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 28 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 90 12 00 00 00 00 00 F8 83 12 00 00 00 5B 02 F8 83 12 00 00 00 00 00 22 BD 00 42 01 21 56 67 FF 11 03 97 11 13 D7 00 FF FF FF FF
4

1 回答 1

0

事实上，答案相当简单。每个偏移量都是有符号的 8 位、16 位或 32 位，具体取决于给定的字节大小。请注意，这是为数不多的在系统十六进制中带有带符号数字的位置之一。

FF67 => 1111111101100111 => -153 / - 0x99 => 0x142 - 0x99 = 0xA9 作为第二次数据运行的偏移量。

于 2020-08-06T18:36:06.813 回答