|
00000000
|
2E
|
20
|
20
|
20
|
20 20 20
|
20
|
20
|
20
|
20
|
10 00
|
C6
|
11
|
5D .
|
..?]
|
|
00000010
|
6B
|
3B
|
6B
|
3B
|
00 00 12
|
5D
|
6B
|
3B
|
0C
|
00 00
|
00
|
00
|
00 k;k;...
|
]k;......
|
To offset 0x0A 0x10, named 0x2E ("."), Represents the current directory. Item 2:
|
00000020
|
2E
|
2E
|
20
|
20
|
20 20 20
|
20
|
20
|
20
|
20 10 00
|
C6
|
11
|
5D ..
|
..?]
|
|
00000030
|
6B
|
3B
|
6B
|
3B
|
00 00 12
|
5D
|
6B
|
3B
|
00 00 00
|
00
|
00
|
00 k;k;...
|
]k;......
|
To offset 0x0A 0x10, named 0x2E 0x2E (".."), expressed on a directory.
|
00000100
|
53
|
55
|
42
|
44
|
49 52
|
7E
|
31
|
54
|
58
|
54 20 00
|
22
|
2E
|
4F
|
SUBDIR~1TXT .".O
|
|
00000110
|
6C
|
3B
|
6D
|
3B
|
00 00
|
E9
|
84
|
6D
|
3B
|
14 00 00
|
0E
|
00
|
00
|
l;m;..閯 m;......
|
Offset 0x0A to 0x20, is a file named "SUBDIR ~ 1.TXT", the file length is 0x00000E00, file starting position in the cluster 0x00000014. In order to read the file, you also need to get it by reference FAT cluster chain. First, to solve a problem is how to know a cluster in the FAT table position? Given a cluster number N, determine its position in the table (below is FAT16/FAT32 for example, FAT12 slightly more complicated): FAT table in Sector No.: N / (BPB_BytsPerSec / fact), if it is FAT16 the fact Take 2, if the fact is taken FAT32 4. In Sector offset address is: N% (BPB_BytsPerSec / fact), that is N divided by (BPB_BytsPerSec / fact) to take the remainder. Thus, the cluster in FAT table 0x00000014 Sector for 0x14 / (512/4) = 0, in the Sector offset 0x14% (512/4) = 0x50
Here is the first 0 Sector FAT1:
|
00000000
|
F8
|
FF FF FF FF FF FF FF
|
03 00 00 00 FF FF FF 0F
|
....?
|
.
|
|
00000010
|
00
|
00 00 00 06 00 00 00
|
FF FF FF 0F 08 00 00 00
|
........
|
.....
|
|
00000020
|
09
|
00 00 00 0A 00 00 00
|
FF FF FF 0F FF FF FF 0F
|
........
|
..
|
|
00000030
|
FF FF FF 0F FF FF FF 0F
|
FF FF FF 0F FF FF FF 0F
|
....
|
|
00000040
|
FF FF FF 0F FF FF FF 0F
|
FF FF FF 0F FF FF FF 0F
|
. ...
|
|
00000050
|
15
|
00 00 00 16 00 00 00
|
17 00 00 00 18 00 00 00
|
................
|
|
|
00000060
|
19
|
00 00 00 1A 00 00 00
|
FF FF FF 0F 00 00 00 00
|
........
|
.....
|
|
00000070
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
