From 8ec7c6e37cb8ebf4c273463b9ad0b23127e8f29d Mon Sep 17 00:00:00 2001
From: Kam Woods <kamwoods@gmail.com>
Date: Sat, 8 Nov 2014 23:27:06 -0500
Subject: [PATCH] Added exfat support in detect.c and dos.c

---
 src/detect.c |  2 ++
 src/dos.c    | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/src/detect.c b/src/detect.c
index 8a36038..a081f29 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -47,6 +47,7 @@ void detect_atari_partmap(SECTION *section, int level);
 void detect_dos_partmap(SECTION *section, int level);
 void detect_gpt_partmap(SECTION *section, int level);
 void detect_fat(SECTION *section, int level);
+void detect_exfat(SECTION *section, int level);
 void detect_ntfs(SECTION *section, int level);
 void detect_hpfs(SECTION *section, int level);
 void detect_dos_loader(SECTION *section, int level);
@@ -131,6 +132,7 @@ DETECTOR detectors[] = {
   detect_amiga_fs,
   detect_apple_volume,
   detect_fat,
+  detect_exfat,
   detect_ntfs,
   detect_hpfs,
   detect_udf,
diff --git a/src/dos.c b/src/dos.c
index 6d6d959..c04625f 100644
--- a/src/dos.c
+++ b/src/dos.c
@@ -429,6 +429,8 @@ void detect_fat(SECTION *section, int level)
   /* since the above is also present on NTFS, make sure it's not NTFS... */
   if (memcmp(buf + 3, "NTFS    ", 8) == 0)
     return;
+  if (memcmp(buf + 3, "EXFAT    ", 8) == 0)
+    return;
 
   /* next, some soft tests, taking score */
   score = 0;
@@ -515,6 +517,25 @@ void detect_fat(SECTION *section, int level)
   }
 }
 
+/*
+ * exFAT file system
+ */
+
+void detect_exfat(SECTION *section, int level)
+{
+  unsigned char *buf;
+
+  if (get_buffer(section, 0, 512, (void **)&buf) < 512)
+    return;
+
+  /* check signatures */
+  if (memcmp(buf + 3, "EXFAT ", 8) != 0)
+    return;
+
+  /* tell the user */
+    print_line(level, "exFAT file system");
+}
+
 /*
  * NTFS file system
  */