Le 19/12/2022 à 16:34, Thomas Schmitt a écrit :
Thanks Thomas for these very clear and detailed explanations! I am really not at ease using tools like hexdump, but I will try to dig into it, this is a good exercise.Hi, i wrote:dd if=cdimage.iso bs=1 count=64 | od -t cYvan Masson wrote:0000000 \0 377 377 377 377 377 377 377 377 377 377 \0 \0 002 \0 001 0000020 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0This does not give me ideas.strings cdimage.iso | head -10... CD001 MSBSOLAR WCD 1995082311483300 1995082312010100But this looks like from a ISO 9660 Primary Volume Descriptor. The text "CD001" is probably preceeded by a binary 1, which should be at byte address 32768 of the ISO 9660 filesystem. I assume that this byte and the string are displaced in cdimage.iso. "MSBSOLAR" is probably the Volume Id (Label) of the ISO filesystem. "WCD" could be the program which made the ISO. "1995082311483300" as Creation Time would mean: 1995 August 23 11:48:33 Assuming that you cope with some prepended header and an ISO 9660 filesystem, the next step would be to find out how much "\001CD001" is displaced from its normal byte position 32768. 2048 bytes later would come "\002CD001", which would be the Joliet Volume Descriptor. Again 2048 bytes later is probably the Descriptor Set Terminator with a leading byte of value 255: "\377CD001". If they are displaced by the same offset as "\001CD001", then consider to cut off the surplus bytes from the start of a copy of the image and try to mount that shortened copy. At least the signature of ISO 9660 should then be recognizable for the Linux kernel. It might of course be more complicated than just a prepended header. The inner weaving of ISO 9660 could be broken by further inserted meta-data. In that case we would need to inspect the image in more detail, which will be difficult by forth-and-back mail. Have a nice day :) Thomas
Yvan
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature