💾 Archived View for spam.works › mirrors › textfiles › computers › tec019.txt captured on 2024-02-05 at 11:30:17.
⬅️ Previous capture (2023-06-14)
-=-=-=-=-=-=-
Finding SSWAPed drives in C
If Stacker is installed, using the ST_PTR generated by the call to
the detect_stacker() function as shown in Appendix B of the Stacker version
2 manual, it is possible to determine what drives have been swapped using
SSWAP. At offset 0x52 from ST_PTR is a signature, which consists of the
four characters 'SWAP'. Following this four byte signature is a 26 byte
array, which contains the original drive numbers (0=A, 1=B, etc) for all
drives. Each time SSWAP performs a swap of two drives, it interchanges
the corresponding entries in this array.
Using C notation, the structure is defined as follows:
ST_PTR + 52H --> struct swapmap
{
char swapSignature[4]; /* 'SWAP' */
char swapmap[26];
}
Note that swapmap[i] (where i=0 means A:, i=1 means B:, etc) contains the
"original" drive number for drive i. That is, drive i was drive swapmap[i]
at boot time. To find the inverse function (namely, what is the current
drive number of the drive that was drive j at boot time?), you need to search
the swapmap array to find j. In other words, if swapmap[k]==j, then drive k
was drive j at boot time.