import struct
import sys

def carve_ramdrive(dump_file):
    with open(dump_file, 'rb') as f:
        data = f.read()

    print("Searching for FAT Boot Sectors...")
    # FAT filesystem identifiers in the boot sector
    for fs_type in [b'FAT12   ', b'FAT16   ']:
        idx = 0
        while True:
            idx = data.find(fs_type, idx)
            if idx == -1: break
            
            # The fs_type string is at offset 0x36 in the boot sector
            boot_start = idx - 0x36
            
            # Check for the jump instruction that starts all FAT boot sectors (EB xx 90 or E9 xx xx)
            if boot_start >= 0 and data[boot_start] in [0xEB, 0xE9]:
                try:
                    # Parse the exact size of the drive from the boot sector header
                    bps = struct.unpack('<H', data[boot_start+11:boot_start+13])[0]
                    sectors = struct.unpack('<H', data[boot_start+19:boot_start+21])[0]
                    if sectors == 0: # If 0, it uses the 32-bit sector count
                        sectors = struct.unpack('<I', data[boot_start+32:boot_start+36])[0]
                    
                    size = bps * sectors
                    
                    if 0 < size < len(data):
                        print(f"\n[+] Found {fs_type.decode().strip()} RAM Drive at offset {boot_start}!")
                        print(f"    Size: {size} bytes ({size/1024/1024:.2f} MB)")
                        out_name = f"ramdrive_{boot_start}.img"
                        
                        with open(out_name, 'wb') as out:
                            out.write(data[boot_start:boot_start+size])
                        print(f"    Saved clean image as {out_name}")
                except Exception as e:
                    pass
            idx += 1

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 extract_ramdrive.py <memory_dump.bin>")
    else:
        carve_ramdrive(sys.argv[1])