cybersecurity · intermediate · ~15 min · safe pentest lab
Fixed-layout filename reconstruction with a sentinel-byte rule.
Reconstruct a printable 8.3 filename from the raw bytes of a FAT directory entry, applying the 0xE5 deleted-entry convention that recovery tools rely on.
Implement int recover_8_3(const uint8_t *entry, char *out).
entry points to a FAT directory entry whose bytes 0..10 hold the 8.3 short name: 8 base-name bytes then 3 extension bytes, space-padded ASCII. Build the filename in out following these rules:
entry[0] == 0xE5, render the first character as '_' (deleted-entry marker);.;out and return the number of bytes written (excluding the NUL);-1 if entry or out is NULL.entry: a pointer to the entry's bytes the grader provides (only bytes 0..10 are read). May be NULL.out: an output buffer of at least 13 bytes. May be NULL.Returns the number of bytes written excluding the NUL, or -1 if either pointer is NULL.
base "HELLO ", ext "TXT" -> "HELLO.TXT" (9)
base "README ", ext " " -> "README" (6, no ext)
entry[0]=0xE5, rest "ELLO " "TXT" -> "_ELLO.TXT" (9)
base "mixed ", ext "asm" -> "MIXED.ASM" (9, uppercased)
. is omitted.entry[0] == 0xE5): first character becomes _.entry or out is NULL: return -1.The 0xE5 deletion convention is what every FAT recovery tool uses to list deleted files. Reproducing it in C makes the rule concrete.
A pointer to the entry's bytes (only 0..10 read; may be NULL) and a >=13-byte out buffer (may be NULL).
Bytes written excluding the NUL, or -1 if entry or out is NULL.
Output up to 13 bytes (8 + 1 + 3 + 1); uppercase ASCII; read no further than byte 10.
#include <stdint.h>
int recover_8_3(const uint8_t *entry, char *out) {
/* TODO */
(void)entry; (void)out;
return -1;
}
Forgetting trailing spaces. Including the dot when extension is empty. Mishandling the 0xE5 rule (it applies only to position 0).
No extension. Maximum-length 8 + 3 name. Deleted entry that's also lowercase before deletion.
O(1) — at most 12 bytes processed.
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.