Package: qnxmount
QNX Filesystems MounterProject DiscriptionThis project contains code to parse and mount (read only) QNX filesystems in non-standard images (HDD / SSD / eMMC).Existing tools were not able to handle the exotic configurations of some of the filesystems that we encountered in vehicle forensics, for instance on blocksizes greater than 4K on qnx6 filesystems, or non-standard allignment on qnx efs filesystems.The description of the binary data structure of these filesystems is done withkaitaiand this description can be found in the.ksyfiles in the folders for each respective qnx filesystem (qnx6,etfs, andefs). With Kaitai, a Python based parser was generated. Mounting with these parsers is based on fuse.This project is only tested on Linux machines.Getting startedSet up your Python virtual environment and activate the environment:python3 -m venv venv
source ./venv/bin/activateInstall qnxmount and fuse in the virtual environment:pip install qnxmount
sudo apt install fuseUsageGeneral use of the module is as follows:python3-mqnxmount{fs_type}[options]/image/mountpointwherefs_typeis the filesystem type (qnx6, etfs, or efs) and options are the options for that filesystem type.The options are different for each filesystem type. An overview is given below. For more information use the help option.python3-mqnxmountqnx6[-oOFFSET]/image/mountpoint
python3-mqnxmountetfs[-oOFFSET][-sPAGE_SIZE]/image/mountpoint
python3-mqnxmountefs/image/mountpointNote that the offset and page size can be entered in decimal, octal, binary, or hexadecimal format. For example, we can mount an image with a qnx6 filesystem at offset 0x1000 with:python3-mqnxmountqnx6-o0x1000/image/mountpointUsing the option-o 4096would give the same result.If mounting succeeds you will see the log message"Mounting image /image on mount point /mountpoint"appear and the process will hang. Navigate to the given mount point with another terminal session or a file browser to access the file system.Unmounting can be done from the terminal with:sudoumount/mountpointThe logs will show show that the image was successfully unmounted and qnxmount will exit.Contributing and TestingIf you want develop the tool and run tests, first fork the repository. Contributions can be submitted as a merge request.To get started clone the forked repository and create a virtual environment. Install the test dependencies and fuse into the environment.pip install .[test]
sudo apt install fuseThe foldertestscontains functional tests to test the different parsers.
To run these tests you need a file system image and an accompanying tar archive.
The tests run are functional tests that check whether the parsed data from the test image is equal to the data stored in the archive.
Default test_images are located in the folderstest_data.
If you want to test your own image replace the filestest_image.binandtest_image.tar.gzwith your own.A test image can be created by running the scriptmake_test_fs.shinside a QNX Virtual Machine.
Update the script with the (edge) cases you want to check and run the command below.
This should create animage.binandimage.tar.gzinto the specified directory.
These can be used as test files.make_test_fs.sh/path/to/output/directoryTo run the tests in this repo navigate to the main directory of the repo and run:pytest