1 FSDB_UFS(1M) Maintenance Commands FSDB_UFS(1M)
2
3
4
5 NAME
6 fsdb_ufs - ufs file system debugger
7
8 SYNOPSIS
9 fsdb -F ufs [generic_options] [specific_options] special
10
11
12 DESCRIPTION
13 The fsdb_ufs command is an interactive tool that can be used to patch
14 up a damaged UFS file system. It has conversions to translate block and
15 i-numbers into their corresponding disk addresses. Also included are
16 mnemonic offsets to access different parts of an inode. These greatly
17 simplify the process of correcting control block entries or descending
18 the file system tree.
19
20
21 fsdb contains several error-checking routines to verify inode and block
22 addresses. These can be disabled if necessary by invoking fsdb with the
23 -o option or by the use of the o command.
24
25
26 fsdb reads a block at a time and will therefore work with raw as well
27 as block I/O devices. A buffer management routine is used to retain
28 commonly used blocks of data in order to reduce the number of read
29 system calls. All assignment operations result in an immediate write-
30 through of the corresponding block. Note that in order to modify any
31 portion of the disk, fsdb must be invoked with the w option.
32
33
34 Wherever possible, adb-like syntax was adopted to promote the use of
35 fsdb through familiarity.
36
37 OPTIONS
38 The following option is supported:
39
40 -o
41 Specify UFS file system specific options. These options can be
42 any combination of the following separated by commas (with no
43 intervening spaces). The options available are:
44
45 ?
46 Display usage
47
48
49 o
50 Override some error conditions
51
52
53 p='string'
54 set prompt to string
55
56
57 w
58 open for write
59
60
61
62 USAGE
63 Numbers are considered hexadecimal by default. However, the user has
64 control over how data is to be displayed or accepted. The base command
65 will display or set the input/output base. Once set, all input will
66 default to this base and all output will be shown in this base. The
67 base can be overridden temporarily for input by preceding hexadecimal
68 numbers with '0x', preceding decimal numbers with '0t', or octal
69 numbers with '0'. Hexadecimal numbers beginning with a-f or A-F must
70 be preceded with '0x' to distinguish them from commands.
71
72
73 Disk addressing by fsdb is at the byte level. However, fsdb offers many
74 commands to convert a desired inode, directory entry, block, superblock
75 and so forth to a byte address. Once the address has been calculated,
76 fsdb will record the result in dot (.).
77
78
79 Several global values are maintained by fsdb:
80
81 o the current base (referred to as base),
82
83 o the current address (referred to as dot),
84
85 o the current inode (referred to as inode),
86
87 o the current count (referred to as count),
88
89 o and the current type (referred to as type).
90
91
92 Most commands use the preset value of dot in their execution. For
93 example,
94
95
96 > 2:inode
97
98
99 will first set the value of dot to 2, ':', will alert the start of a
100 command, and the inode command will set inode to 2. A count is
101 specified after a ','. Once set, count will remain at this value until
102 a new command is encountered which will then reset the value back to 1
103 (the default). So, if
104
105
106 > 2000,400/X
107
108
109 is typed, 400 hex longs are listed from 2000, and when completed, the
110 value of dot will be 2000 + 400 * sizeof (long). If a RETURN is then
111 typed, the output routine will use the current values of dot, count,
112 and type and display 400 more hex longs. A '*' will cause the entire
113 block to be displayed.
114
115
116 End of fragment, block and file are maintained by fsdb. When displaying
117 data as fragments or blocks, an error message will be displayed when
118 the end of fragment or block is reached. When displaying data using the
119 db, ib, directory, or file commands an error message is displayed if
120 the end of file is reached. This is mainly needed to avoid passing the
121 end of a directory or file and getting unknown and unwanted results.
122
123
124 An example showing several commands and the use of RETURN would be:
125
126 > 2:ino; 0:dir?d
127 or
128 > 2:ino; 0:db:block?d
129
130
131
132
133 The two examples are synonymous for getting to the first directory
134 entry of the root of the file system. Once there, any subsequent
135 RETURN (or +, -) will advance to subsequent entries. Note that
136
137 > 2:inode; :ls
138 or
139 > :ls /
140
141
142
143
144 is again synonymous.
145
146 Expressions
147 The symbols recognized by fsdb are:
148
149 RETURN
150 update the value of dot by the current value of type and
151 display using the current value of count.
152
153
154 #
155 numeric expressions may be composed of +, -, *, and %
156 operators (evaluated left to right) and may use
157 parentheses. Once evaluated, the value of dot is updated.
158
159
160 , count
161 count indicator. The global value of count will be updated
162 to count. The value of count will remain until a new
163 command is run. A count specifier of '*' will attempt to
164 show a blocks's worth of information. The default for
165 count is 1.
166
167
168 ? f
169 display in structured style with format specifier f. See
170 Formatted Output.
171
172
173 / f
174 display in unstructured style with format specifier f. See
175 Formatted Output.
176
177
178 .
179 the value of dot.
180
181
182 +e
183 increment the value of dot by the expression e. The amount
184 actually incremented is dependent on the size of type:
185
186 dot = dot + e * sizeof (type)
187
188 The default for e is 1.
189
190
191 -e
192 decrement the value of dot by the expression e. See +.
193
194
195 *e
196 multiply the value of dot by the expression e.
197 Multiplication and division don't use type. In the above
198 calculation of dot, consider the sizeof(type) to be 1.
199
200
201 %e
202 divide the value of dot by the expression e. See *.
203
204
205 < name
206 restore an address saved in register name. name must be a
207 single letter or digit.
208
209
210 > name
211 save an address in register name. name must be a single
212 letter or digit.
213
214
215 = f
216 display indicator. If f is a legitimate format specifier,
217 then the value of dot is displayed using the format
218 specifier f. See Formatted Output. Otherwise, assignment
219 is assumed. See =.
220
221
222 = [s] [e]
223 assignment indicator. The address pointed to by dot has
224 its contents changed to the value of the expression e or
225 to the ASCII representation of the quoted (") string s.
226 This may be useful for changing directory names or ASCII
227 file information.
228
229
230 =+ e
231 incremental assignment. The address pointed to by dot has
232 its contents incremented by expression e.
233
234
235 =- e
236 decremental assignment. The address pointed to by dot has
237 its contents decremented by expression e.
238
239
240 Commands
241 A command must be prefixed by a ':' character. Only enough letters of
242 the command to uniquely distinguish it are needed. Multiple commands
243 may be entered on one line by separating them by a SPACE, TAB or ';'.
244
245
246 In order to view a potentially unmounted disk in a reasonable manner,
247 fsdb offers the cd, pwd, ls and find commands. The functionality of
248 these commands substantially matches those of its UNIX counterparts.
249 See individual commands for details. The '*', '?', and '[-]' wild card
250 characters are available.
251
252 base=b
253
254 display or set base. As stated above, all input and output is
255 governed by the current base. If the =b is omitted, the current
256 base is displayed. Otherwise, the current base is set to b. Note
257 that this is interpreted using the old value of base, so to ensure
258 correctness use the '0', '0t', or '0x' prefix when changing the
259 base. The default for base is hexadecimal.
260
261
262 block
263
264 convert the value of dot to a block address.
265
266
267 cd dir
268
269 change the current directory to directory dir. The current values
270 of inode and dot are also updated. If no dir is specified, then
271 change directories to inode 2 ("/").
272
273
274 cg
275
276 convert the value of dot to a cylinder group.
277
278
279 directory
280
281 If the current inode is a directory, then the value of dot is
282 converted to a directory slot offset in that directory and dot now
283 points to this entry.
284
285
286 file
287
288 the value of dot is taken as a relative block count from the
289 beginning of the file. The value of dot is updated to the first
290 byte of this block.
291
292
293 find dir [ -name n] [-inum i]
294
295 find files by name or i-number. find recursively searches directory
296 dir and below for filenames whose i-number matches i or whose name
297 matches pattern n. Note that only one of the two options (-name or
298 -inum) may be used at one time. Also, the -print is not needed or
299 accepted.
300
301
302 fill=p
303
304 fill an area of disk with pattern p. The area of disk is delimited
305 by dot and count.
306
307
308 fragment
309
310 convert the value of dot to a fragment address. The only difference
311 between the fragment command and the block command is the amount
312 that is able to be displayed.
313
314
315 inode
316
317 convert the value of dot to an inode address. If successful, the
318 current value of inode will be updated as well as the value of dot.
319 As a convenient shorthand, if ':inode' appears at the beginning of
320 the line, the value of dot is set to the current inode and that
321 inode is displayed in inode format.
322
323
324 log_chk
325
326 run through the valid log entries without printing any information
327 and verify the layout.
328
329
330 log_delta
331
332 count the number of deltas into the log, using the value of dot as
333 an offset into the log. No checking is done to make sure that
334 offset is within the head/tail offsets.
335
336
337 log_head
338
339 display the header information about the file system logging. This
340 shows the block allocation for the log and the data structures on
341 the disk.
342
343
344 log_otodb
345
346 return the physical disk block number, using the value of dot as an
347 offset into the log.
348
349
350 log_show
351
352 display all deltas between the beginning of the log (BOL) and the
353 end of the log (EOL).
354
355
356 ls
357
358 [ -R ] [ -l ] pat1 pat2... list directories or files. If no file
359 is specified, the current directory is assumed. Either or both of
360 the options may be used (but, if used, must be specified before the
361 filename specifiers). Also, as stated above, wild card characters
362 are available and multiple arguments may be given. The long listing
363 shows only the i-number and the name; use the inode command with
364 '?i' to get more information.
365
366
367 override
368
369 toggle the value of override. Some error conditions may be
370 overridden if override is toggled on.
371
372
373 prompt p
374
375 change the fsdb prompt to p. p must be surrounded by (")s.
376
377
378 pwd
379
380 display the current working directory.
381
382
383 quit
384
385 quit fsdb.
386
387
388 sb
389
390 the value of dot is taken as a cylinder group number and then
391 converted to the address of the superblock in that cylinder group.
392 As a shorthand, ':sb' at the beginning of a line will set the value
393 of dot to the superblock and display it in superblock format.
394
395
396 shadow
397
398 if the current inode is a shadow inode, then the value of dot is
399 set to the beginning of the shadow inode data.
400
401
402 !
403
404 escape to shell
405
406
407 Inode Commands
408 In addition to the above commands, there are several commands that deal
409 with inode fields and operate directly on the current inode (they still
410 require the ':'). They may be used to more easily display or change the
411 particular fields. The value of dot is only used by the ':db' and ':ib'
412 commands. Upon completion of the command, the value of dot is changed
413 to point to that particular field. For example,
414
415
416 > :ln=+1
417
418
419 would increment the link count of the current inode and set the value
420 of dot to the address of the link count field.
421
422 at
423 access time.
424
425
426 bs
427 block size.
428
429
430 ct
431 creation time.
432
433
434 db
435 use the current value of dot as a direct block index, where
436 direct blocks number from 0 - 11. In order to display the block
437 itself, you need to 'pipe' this result into the block or
438 fragment command. For example,
439
440 > 1:db:block,20/X
441
442
443 would get the contents of data block field 1 from the inode and
444 convert it to a block address. 20 longs are then displayed in
445 hexadecimal. See Formatted Output.
446
447
448 gid
449 group id.
450
451
452 ib
453 use the current value of dot as an indirect block index where
454 indirect blocks number from 0 - 2. This will only get the
455 indirect block itself (the block containing the pointers to the
456 actual blocks). Use the file command and start at block 12 to
457 get to the actual blocks.
458
459
460 ln
461 link count.
462
463
464 mt
465 modification time.
466
467
468 md
469 mode.
470
471
472 maj
473 major device number.
474
475
476 min
477 minor device number.
478
479
480 nm
481 although listed here, this command actually operates on the
482 directory name field. Once poised at the desired directory entry
483 (using the directory command), this command will allow you to
484 change or display the directory name. For example,
485
486 > 7:dir:nm="foo"
487
488 will get the 7th directory entry of the current inode and change
489 its name to foo. Note that names cannot be made larger than the
490 field is set up for. If an attempt is made, the string is
491 truncated to fit and a warning message to this effect is
492 displayed.
493
494
495 si
496 shadow inode.
497
498
499 sz
500 file size.
501
502
503 uid
504 user id.
505
506
507 Formatted Output
508 There are two styles and many format types. The two styles are
509 structured and unstructured. Structured output is used to display
510 inodes, directories, superblocks and the like. Unstructured displays
511 raw data. The following shows the different ways of displaying:
512
513 ?
514
515 c
516 display as cylinder groups
517
518
519 i
520 display as inodes
521
522
523 d
524 display as directories
525
526
527 s
528 display as superblocks
529
530
531 S
532 display as shadow inode data
533
534
535
536 /
537
538 b
539 display as bytes
540
541
542 c
543 display as characters
544
545
546 o O
547 display as octal shorts or longs
548
549
550 d D
551 display as decimal shorts or longs
552
553
554 x X
555 display as hexadecimal shorts or longs
556
557 The format specifier immediately follows the '/' or '?' character.
558 The values displayed by '/b' and all '?' formats are displayed in
559 the current base. Also, type is appropriately updated upon
560 completion.
561
562
563 EXAMPLES
564 Example 1 Displaying in Decimal
565
566
567 The following command displays 2010 in decimal (use of fsdb as a
568 calculator for complex arithmetic):
569
570
571 > 2000+400%(20+20)=D
572
573
574
575 Example 2 Displaying an i-number in Inode Format
576
577
578 The following command displays i-number 386 in an inode format. This
579 now becomes the current inode:
580
581
582 > 386:ino?i
583
584
585
586 Example 3 Changing the Link Count
587
588
589 The following command changes the link count for the current inode to
590 4:
591
592
593 > :ln=4
594
595
596
597 Example 4 Incrementing the Link Count
598
599
600 The following command increments the link count by 1:
601
602
603 > :ln=+1
604
605
606
607 Example 5 Displaying the Creation Time
608
609
610 The following command displays the creation time as a hexadecimal long:
611
612
613 > :ct=X
614
615
616
617 Example 6 Displaying the Modification Time
618
619
620 The following command displays the modification time in time format:
621
622
623 > :mt=t
624
625
626
627 Example 7 Displaying in ASCII
628
629
630 The following command displays in ASCII, block zero of the file
631 associated with the current inode:
632
633
634 > 0:file/c
635
636
637
638 Example 8 Displaying the First Block's Worth of Directorty Entries
639
640
641 The following command displays the first block's worth of directory
642 entries for the root inode of this file system. It will stop
643 prematurely if the EOF is reached:
644
645
646 > 2:ino,*?d
647
648
649
650 Example 9 Displaying Changes to the Current Inode
651
652
653 The following command displays changes the current inode to that
654 associated with the 5th directory entry (numbered from zero) of the
655 current inode. The first logical block of the file is then displayed in
656 ASCII:
657
658
659 > 5:dir:inode; 0:file,*/c
660
661
662
663 Example 10 Displaying the Superblock
664
665
666 The following command displays the superblock of this file system:
667
668
669 > :sb
670
671
672
673 Example 11 Displaying the Cylinder Group
674
675
676 The following command displays cylinder group information and summary
677 for cylinder group 1:
678
679
680 > 1:cg?c
681
682
683
684 Example 12 Changing the i-number
685
686
687 The following command changes the i-number for the seventh directory
688 slot in the root directory to 3:
689
690
691 > 2:inode; 7:dir=3
692
693
694
695 Example 13 Displaying as Directory Entries
696
697
698 The following command displays the third block of the current inode as
699 directory entries:
700
701
702 > 2:db:block,*?d
703
704
705
706 Example 14 Changing the Name Field
707
708
709 The following command changes the name field in the directory slot to
710 name:
711
712
713 > 7:dir:nm="name"
714
715
716
717 Example 15 Getting and Filling Elements
718
719
720 The following command gets fragment 3c3 and fill 20 type elements with
721 0x20:
722
723
724 > 3c3:fragment,20:fill=0x20
725
726
727
728 Example 16 Setting the Contents of an Address
729
730
731 The following command sets the contents of address 2050 to 0xffffffff.
732 0xffffffff may be truncated depending on the current type:
733
734
735 > 2050=0xffff
736
737
738
739 Example 17 Placing ASCII
740
741
742 The following command places the ASCII for the string at 1c92434:
743
744
745 > 1c92434="this is some text"
746
747
748
749 Example 18 Displaying Shadow Inode Data
750
751
752 The following command displays all of the shadow inode data in the
753 shadow inode associated with the root inode of this file system:
754
755
756 > 2:ino:si:ino;0:shadow,*?S
757
758
759
760 SEE ALSO
761 clri(1M), fsck_ufs(1M), dir_ufs(4), attributes(5), ufs(7FS)
762
763 WARNINGS
764 Since fsdb reads the disk raw, extreme caution is advised in
765 determining its availability of fsdb on the system. Suggested
766 permissions are 600 and owned by bin.
767
768 NOTES
769 The old command line syntax for clearing i-nodes using the ufs-specific
770 '-z i-number' option is still supported by the new debugger, though it
771 is obsolete and will be removed in a future release. Use of this flag
772 will result in correct operation, but an error message will be printed
773 warning of the impending obsolesence of this option to the command. The
774 equivalent functionality is available using the more flexible clri(1M)
775 command.
776
777
778
779 April 14, 2003 FSDB_UFS(1M)