cybersecurity · beginner · ~15 min · safe pentest lab
Recognise the MFT record signature.
Validate an NTFS MFT record by its signature — a valid entry begins with FILE, while a corrupt one reads BAAD.
Implement int is_mft_record(const unsigned char *b) that returns 1 if the first four bytes are 'F','I','L','E', else 0.
b: a byte buffer of at least 4 bytes holding a (mock) MFT record. The grader passes a fixed buffer.Returns int: 1 if b[0..3] spell FILE, else 0.
b = 'F' 'I' 'L' 'E' ... -> 1
b = 'B' 'A' 'A' 'D' -> 0
A byte buffer b of at least 4 bytes.
An int: 1 if the first four bytes are 'F','I','L','E', else 0.
The MFT signature is the ASCII bytes FILE.
int is_mft_record(const unsigned char *b) {
/* TODO */
return 0;
}
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.