3

How can I modify the superblock of an ext filesystem so that I can set the field wtime (Last write time)?

I've tried with debugfs:

debugfs 1.42.9 (4-Feb-2014)
debugfs:  open /dev/sdd2 -w
debugfs:  ssv wtime "@0x64000000"
debugfs:  show_super_stats -h
debugfs:  close

When I close the filesystem wtime is set to the current system time.

Obviously I don't want to change the system time so that the wtime is set when the filesystem is closed and then to revert my system time.

My second thought was that I can change it with hexeditor, but I'm almost sure that the superblock has a checksum that is calculated over the superblock and verified.

bat_ventzi
  • 201
  • 2
  • 5

3 Answers3

2

Digging in the source code of our software isn't from the devil. I researched after them a little bit and found the following results:

  1. Debugfs is in the package e2fsprogs.
  2. E2fsprogs contains the libext2 library as well, which is the common library to handle all of the ext2 manipulation operations as well.
  3. When we see the source code of the e2fsprogs, with some greps can we found very easily the point of the the close_filesys command in it.
  4. We can see, that this call calls always ext2_close_free(), which is already in the libext2fs source code, here.
  5. In the named function we can see the updates of the wtime: ext2fs_close_free() calls ext2fs_close2(), which calls ext2fs_close(), which calls ext2fs_flush2(), which calls ext2fs_flush().
  6. As we can see in this function, the wtime field will be always updated. There is no exception.

But: you can easily disable that in the source code. If you come here again, I will explain you, how.

P.s. yes, there is a checksum in the ext2 superblock, and it is generated by crc32c which is a complex algorithm.

peterh
  • 4,914
  • 13
  • 29
  • 44
2

After I've read the answer of Peter Horvath. I looked in the sources and as he pointed out here ext2fs_flush2 writes this field and the actual code is like so:

fs->super->s_wtime = fs->now ? fs->now : time(NULL);

I've searched the sources for this fs->now and found that it is being set by do_set_current_time. I thought I had tried this the last time, but I did try once more. And actually the following code did the job.

debugfs:  open /dev/sdb2 -w
debugfs:  ssv mtime "@0x64000000"
debugfs:  set_current_time "@0x64000000"
Setting current time to Thu Mar  2 01:46:40 2023

debugfs:  close

Edit: you should touch the superblock if you want wtime to get updated. And you can't set 0 as your current_time.

bat_ventzi
  • 201
  • 2
  • 5
0

Well, possibly user-space is the solution, you can try fuse-ext2

Homepage: http://view-os.sourceforge.net

poige
  • 9,171
  • 2
  • 24
  • 50