diff --git a/src/detection/physicaldisk/physicaldisk.h b/src/detection/physicaldisk/physicaldisk.h index e3889ea6a..54fa1bc48 100644 --- a/src/detection/physicaldisk/physicaldisk.h +++ b/src/detection/physicaldisk/physicaldisk.h @@ -11,7 +11,8 @@ typedef enum FFPhysicalDiskType FF_PHYSICALDISK_TYPE_FIXED = 1 << 2, FF_PHYSICALDISK_TYPE_REMOVABLE = 1 << 3, - FF_PHYSICALDISK_TYPE_READONLY = 1 << 2, + FF_PHYSICALDISK_TYPE_READWRITE = 1 << 4, + FF_PHYSICALDISK_TYPE_READONLY = 1 << 5, } FFPhysicalDiskType; typedef struct FFPhysicalDiskResult diff --git a/src/detection/physicaldisk/physicaldisk_apple.c b/src/detection/physicaldisk/physicaldisk_apple.c index bd186fab1..645dad330 100644 --- a/src/detection/physicaldisk/physicaldisk_apple.c +++ b/src/detection/physicaldisk/physicaldisk_apple.c @@ -52,6 +52,9 @@ const char* ffDetectPhysicalDisk(FFlist* result, FFPhysicalDiskOptions* options) FF_CFTYPE_AUTO_RELEASE CFBooleanRef removable = IORegistryEntryCreateCFProperty(entryPartition, CFSTR(kIOMediaRemovableKey), kCFAllocatorDefault, kNilOptions); device->type |= CFBooleanGetValue(removable) ? FF_PHYSICALDISK_TYPE_REMOVABLE : FF_PHYSICALDISK_TYPE_FIXED; + FF_CFTYPE_AUTO_RELEASE CFBooleanRef writable = IORegistryEntryCreateCFProperty(entryPartition, CFSTR(kIOMediaWritableKey), kCFAllocatorDefault, kNilOptions); + device->type |= CFBooleanGetValue(writable) ? FF_PHYSICALDISK_TYPE_READWRITE : FF_PHYSICALDISK_TYPE_READONLY; + FF_CFTYPE_AUTO_RELEASE CFStringRef bsdName = IORegistryEntryCreateCFProperty(entryPartition, CFSTR(kIOBSDNameKey), kCFAllocatorDefault, kNilOptions); if (bsdName) { diff --git a/src/detection/physicaldisk/physicaldisk_linux.c b/src/detection/physicaldisk/physicaldisk_linux.c index 3eaa74ce9..7ffb8c02a 100644 --- a/src/detection/physicaldisk/physicaldisk_linux.c +++ b/src/detection/physicaldisk/physicaldisk_linux.c @@ -113,7 +113,7 @@ const char* ffDetectPhysicalDisk(FFlist* result, FFPhysicalDiskOptions* options) char roChar = '0'; snprintf(pathSysBlock, PATH_MAX, "/sys/block/%s/ro", devName); if (ffReadFileData(pathSysBlock, 1, &roChar) > 0) - device->type |= roChar == '1' ? FF_PHYSICALDISK_TYPE_READONLY : 0; + device->type |= roChar == '1' ? FF_PHYSICALDISK_TYPE_READONLY : FF_PHYSICALDISK_TYPE_READWRITE; } { diff --git a/src/detection/physicaldisk/physicaldisk_windows.c b/src/detection/physicaldisk/physicaldisk_windows.c index d3fc246b9..f39909747 100644 --- a/src/detection/physicaldisk/physicaldisk_windows.c +++ b/src/detection/physicaldisk/physicaldisk_windows.c @@ -138,6 +138,8 @@ static bool detectPhysicalDisk(const wchar_t* szDevice, FFlist* result, FFPhysic __typeof__(gmt.MediaInfo[0].DeviceSpecific.DiskInfo)* diskInfo = &gmt.MediaInfo[0].DeviceSpecific.DiskInfo; if (diskInfo->MediaCharacteristics & MEDIA_READ_ONLY) device->type |= FF_PHYSICALDISK_TYPE_READONLY; + else if (diskInfo->MediaCharacteristics & MEDIA_READ_WRITE) + device->type |= FF_PHYSICALDISK_TYPE_READWRITE; if (device->size == 0) device->size = (uint64_t) diskInfo->NumberMediaSides * diskInfo->TracksPerCylinder * diskInfo->SectorsPerTrack * diskInfo->BytesPerSector; } diff --git a/src/modules/physicaldisk/physicaldisk.c b/src/modules/physicaldisk/physicaldisk.c index 05911eb64..d5bacd4c7 100644 --- a/src/modules/physicaldisk/physicaldisk.c +++ b/src/modules/physicaldisk/physicaldisk.c @@ -63,22 +63,31 @@ void ffPrintPhysicalDisk(FFPhysicalDiskOptions* options) : dev->type & FF_PHYSICALDISK_TYPE_FIXED ? "Fixed" : ""; + const char* readOnlyType = dev->type & FF_PHYSICALDISK_TYPE_READONLY + ? "Read-only" + : ""; if(options->moduleArgs.outputFormat.length == 0) { ffPrintLogoAndKey(key.chars, 0, &options->moduleArgs, FF_PRINT_TYPE_DEFAULT); - if (physicalType[0] || removableType[0]) + if (physicalType[0] || removableType[0] || readOnlyType[0]) { ffStrbufAppendS(&buffer, " ["); if (physicalType[0]) ffStrbufAppendS(&buffer, physicalType); if (removableType[0]) { - if (physicalType[0]) + if (buffer.chars[buffer.length - 1] != '[') ffStrbufAppendS(&buffer, ", "); ffStrbufAppendS(&buffer, removableType); } + if (readOnlyType[0]) + { + if (buffer.chars[buffer.length - 1] != '[') + ffStrbufAppendS(&buffer, ", "); + ffStrbufAppendS(&buffer, readOnlyType); + } ffStrbufAppendC(&buffer, ']'); } ffStrbufPutTo(&buffer, stdout); @@ -193,6 +202,13 @@ void ffGeneratePhysicalDiskJsonResult(FFPhysicalDiskOptions* options, yyjson_mut yyjson_mut_obj_add_bool(doc, obj, "removable", false); else yyjson_mut_obj_add_null(doc, obj, "removable"); + + if (dev->type & FF_PHYSICALDISK_TYPE_READONLY) + yyjson_mut_obj_add_bool(doc, obj, "readOnly", true); + else if (dev->type & FF_PHYSICALDISK_TYPE_READWRITE) + yyjson_mut_obj_add_bool(doc, obj, "readOnly", false); + else + yyjson_mut_obj_add_null(doc, obj, "readOnly"); } FF_LIST_FOR_EACH(FFPhysicalDiskResult, dev, result)