| Author | Message | ||
     Paul Mullen (Pcguru) |
I am running the attached script but when I get to the Create "C:\QBsearch.txt" command I get a message Cannot open "23770 of 12177207" Please check your path and access rights... This is under Windows 98 after I have opened a FAT32 drive, C2 is at sector 23770 and there are 12177207 sectors on the drive. So this text is part of the "Sectors" area on status line. If I insert debug before the offending line it runs. However on a Windows 2000 system I haven't yet been able to get the create command to work at all. Script I am developing follows: //Debug CloseAll //Select drive to search Open ":?" read-only //Code to read boot sector Goto 3 Read Format 4 Goto 0xb Read Bytes_sector 2 Read Sectors_cluster 1 Ifequal Format "NTFS" Goto 0x28 Read Total_sectors 4 Assign Datastart 0 Assign First_Cluster 0 Assign First_sector 0 else Goto 0x52 Read Format 5 Ifequal Format "FAT32" Goto 0xe Read First_Sector 2 //Reserved_sectors Goto 0x20 Read Total_sectors 4 Read Sectors_FAT 4 Assign First_Sector (First_sector+(2*Sectors_FAT)) Assign First_Cluster 2 Assign Datastart (First_Sector*Bytes_Sector) else Messagebox "Format Not yet supported" Exit endif endif Assign Last_cluster (((Total_sectors-First_sector)/Sectors_Cluster)+First_cluster-1) Goto Datastart debug Create "C:\QBSearch.TXT" 0x10000 Write "QBW-Search: drive format " Write Format Write 0x0d0a Write "First data sector=" IntToStr A First_sector Write A Write 0x0d0a Write "Total Sectors =" IntToStr A Total_Sectors Write A Write 0x0d0a Write "Sectors/Cluster=" IntToStr A Sectors_cluster Write A Write 0x0d0a Write "First Cluster =" IntToStr A First_Cluster Write A Write 0x0d0a Write "Last Cluster =" IntToStr A Last_Cluster Write A Write 0x0d0a Write 0x0d0a NextObj | ||
| Stefan Fleischmann (Admin) |
This script runs just fine here. Tested with WinHex 12.05 SR-11 under Windows 2000 and XP, with or without the debug command. "23770 of 12177207" should probably read "C:\QBsearch.txt". Not sure why opening that newly created file fails. | ||
| Paul Mullen (Pcguru) |
I just realized that nested If statements are illegal. Syntax checker does not catch that. But it hadn't go that far before the error. Error still occurs on SR12. Changing the Create to an Open removes problem. I was thinking that if it had created the file QBSearch.txt and then was trying to Open the file "23770 of 12177207" it would naturally have a problem. So why is it picking up this text from the status line? | ||
| Stefan Fleischmann (Admin) |
It seems something unforeseen happens in WinHex internally that changes the contents of the filename buffer before the error message is displayed. | ||
| Paul Mullen (Pcguru) |
Well I worked round the previous problem and completed a script that almost worked - once. Rerunning the script after making some apparently trivial changes caused a peculiar thing to happen - while on the first run it printed the cluster allocation of each hit correctly, on re-running the script it printed the first filepath for every hit! I changed the script to blank out the filepath after writing it to my output file and this time I got an empty filepath, just as if it were skipping over the GetclusterAlloc statements! This happens in both the part that detects QBW record headers and the part for file headers. During execution the Details Window shows correct cluster allocations. Current Script follows: ----------------------- // Winhex script to find blocks that belong to a Quickbooks QBW file. // File is divided into blocks 0x400 (1024) bytes long. // Each block has a 16 byte header: // unknown usually zero // Next-Rec#, record 0 seems to be at offset 0x400 // Previous-rec# // Unknown // Most blocks have previous value 2 less than next // So look for start 0 then Next, then Next-2 //Debug //Turbo On CloseAll //Select drive to search Open ":?" read-only //Code to read boot sector Goto 3 Read Format 4 Goto 0xb Read Bytes_sector 2 Read Sectors_cluster 1 Ifequal Format "NTFS" Goto 0x28 Read Total_sectors 4 Assign Datastart 0 Assign First_Cluster 0 Assign First_sector 0 Jumpto FoundFormat //since nested If not allowed. else Goto 0x52 Read Format 5 endif Ifequal Format "FAT32" Goto 0xe Read First_Sector 2 //Reserved_sectors Goto 0x20 Read Total_sectors 4 Read Sectors_FAT 4 Assign First_Sector (First_sector+(2*Sectors_FAT)) Assign First_Cluster 2 Assign Datastart (First_Sector*Bytes_Sector) else Messagebox "Format Not yet supported" Exit endif Label FoundFormat Assign Last_cluster (((Total_sectors-First_sector)/Sectors_Cluster)+First_cluster-1) Goto Datastart //Goto 0x4815f000 //continue while testing //Create "C:\QBSearch.TXT" 0x10000 Open "C:\QBSEARCH.TXT" //JumpTo Skipover Write "QBW-Search: drive format " Write Format Write 0x0d0a Write "First data sector=" IntToStr A First_sector Write A Write 0x0d0a Write "Total Sectors =" IntToStr A Total_Sectors Write A Write 0x0d0a Write "Sectors/Cluster=" IntToStr A Sectors_cluster Write A Write 0x0d0a Write "First Cluster =" IntToStr A First_Cluster Write A Write 0x0d0a Write "Last Cluster =" IntToStr A Last_Cluster Write A Write 0x0d0a Write 0x0d0a Label Skipover //move 0x76a60 //continue NextObj //back to QBW file //debug Assign Cluster First_cluster Turbo On //Loop through sectors { Read First 4 Read NxtPage 4 Read PrvPage 4 Ifequal First 0 Assign Test (NxtPage-PrvPage) else Assign Test 0 endif Ifequal Test 2 Turbo Off Assign MyPos CurrentPos Assign Sector (MyPos/512) GetClusterAlloc Acluster NextObj //output file Write "S# " IntToStr A Sector Write A Write " " IntToStr A (NxtPage-1) Write A Write " " Write Acluster write 0x0d0a Turbo On NextObj //back to drive to search Assign Acluster " " //what is going on? endif //See if this is QBW header Move (0x60-12) Read Text 4 Move -0x64 Ifequal Text "MAUI" Turbo Off Move 0x24 //offset 24h will have length data in pages Read NPagesUsed 4 Move 0xC //to offset 34h Read NPagesFile 4 Move -0x38 Assign MyPos CurrentPos Assign Sector (MyPos/512) GetClusterAlloc ACluster NextObj //output file Write "S# " IntToStr A Sector Write A Write " QBW Header, data pages=" IntToStr A NPagesUsed Write A Write " File Pages=" IntToStr A NPagesFile Write A Write " " Write Acluster write 0x0d0a Turbo On NextObj //back to search Assign Acluster " " //what is going on? Endif Move 128 //Next sector }[(Total_sectors-First_sector)] | ||
| Stefan Fleischmann (Admin) |
I confirm that this is an error in the scripting engine. Will be fixed in the next release. Very sorry for the trouble. |