cgsecurity.org

Code: Select all

int search_exFAT_backup(unsigned char* buffer, disk_t* disk, partition_t* partition)
{
	if (disk->pread(disk, buffer, DEFAULT_SECTOR_SIZE, partition->part_offset) != DEFAULT_SECTOR_SIZE)
		return -1;
	{
		const struct exfat_super_block* exfat_header = (const struct exfat_super_block *)buffer;
		/* EXFAT recovery using backup sector */
		int a = exfat_header->signature;
		int b = le16(exfat_header->signature);
		int c = 0xAA55;
		int d = le16(exfat_header->signature) == 0xAA55;
// the condition from below is never TRUE at all ... why exfat_header->signature is swaping byte ? (lower/high byte) ?
		if (le16(exfat_header->signature) == 0xAA55 &&
			recover_exFAT(disk, exfat_header, partition) == 0)
		{
			/* part_offset has already been updated if found using backup sector */
			return 1;
		}
	}
	return 0;
}

Code: Select all

a = 43605; (in hexa: 0xAA55)
b = 21930; (in hexa: 0x55AA)
c = 43605;
d = 0;

Code: Select all

if (le16(exfat_header->signature) == 0xAA55)

Code: Select all

#define le16(x)  (x)