# -*-coding:cp949 -*- import sys import zlib def str_to_hex(strs): f = lambda x:x[2:] tmp = map(hex,map(ord,strs)) return ' '.join(map(f,tmp)) def chr_to_num(strs): tmp=list(strs) tmp.reverse() set_hex=lambda x:"%.2x"%x return eval("0x"+''.join(map(set_hex,map(ord,tmp)))) try: f = open(sys.argv[1],'rb') except: print "usage : evf_parse.py file_name" sys.exit(0) fout = open('result.txt','wb') fout.write("----- evf parsing -----\r\n") tmp = f.read(8) fout.write("signature : " + str_to_hex(tmp) + "\t| (45 56 46 09 0d 0a ff 00)\r\n") tmp = f.read(5) fout.write("fields : " + str_to_hex(tmp) + "\t| (0x01 [1 or higher] 0x00 0x00)\r\n") header_cnt = 1 volume_cnt = 1 sectors_cnt = 1 while True: try: tmp = f.read(76) header_type = tmp[:16] fout.write("section type : " + tmp[:16] + "\r\n") fout.write("64-bit offset in current file to the next section : " + str(chr_to_num(tmp[16:24])) + "\r\n") header_len = chr_to_num(tmp[24:32]) fout.write("64-bit byte-size of the section : " + str(header_len) + "\r\n") fout.write("padding : " + str_to_hex(tmp[32:72]) + "\r\n") fout.write("CRC of all previous section data : " + str_to_hex(tmp[72:])+"\r\n\r\n") if 'header' in header_type: tmp = f.read(header_len-76) ftout = open('header'+str(header_cnt)+'.txt','wb') ftout.write(zlib.decompress(tmp)) ftout.close() header_cnt += 1 elif 'volume' in header_type: tmp = f.read(header_len-76) ftout = open('volume'+str(volume_cnt)+'.txt','wb') ftout.write("Reserved : " + str_to_hex(tmp[:4]) + "\r\n") ftout.write("Chunk Count : " + str(chr_to_num(tmp[4:8])) + "\r\n") ftout.write("Sectors per Chunk : " + str(chr_to_num(tmp[8:12])) + "\r\n") ftout.write("Bytes per Sector : " + str(chr_to_num(tmp[12:16])) + "\r\n") ftout.write("Sector Count : " + str(chr_to_num(tmp[16:20])) + "\r\n") ftout.write("Reserved : " + str_to_hex(tmp[20:40]) + "\r\n") ftout.write("Padding : " +str_to_hex(tmp[40:85]) + "\r\n") ftout.write("Reserved (signature) : " + str_to_hex(tmp[85:90]) + "\r\n") ftout.write("CRC of all previous 'volume' : " + str_to_hex(tmp[90:]) + "\r\n") ftout.close() elif 'sectors' in header_type: tmp = f.read(header_len - 76) ftout = open('sectors'+str(sectors_cnt)+'.txt','wb') ftout.write(zlib.decompress(tmp)) ftout.close() else: tmp = f.read(header_len - 76) except: f.close() fout.close() break print "parsing end"