[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-80473":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":15,"stars7d":15,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":16,"compositeScore":17,"rankGlobal":9,"rankLanguage":9,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":21,"hasPages":19,"topics":22,"createdAt":9,"pushedAt":9,"updatedAt":30,"readmeContent":31,"aiSummary":32,"trendingCount":14,"starSnapshotCount":14,"syncStatus":33,"lastSyncTime":34,"discoverSource":35},80473,"gho","nyarime\u002Fgho","nyarime","Pure Go Norton Ghost GHO disk image parser — no CGo, single binary",null,"Go",87,6,86,0,1,3,2.54,"MIT License",false,"main",true,[23,24,25,5,26,27,28,29],"disk-image","firmware","forensics","ghost","golang","norton-ghost","reverse-engineering","2026-06-12 02:04:02","# gho\n\n[![Go Reference](https:\u002F\u002Fpkg.go.dev\u002Fbadge\u002Fgithub.com\u002Fnyarime\u002Fgho.svg)](https:\u002F\u002Fpkg.go.dev\u002Fgithub.com\u002Fnyarime\u002Fgho)\n[![Go Report Card](https:\u002F\u002Fgoreportcard.com\u002Fbadge\u002Fgithub.com\u002Fnyarime\u002Fgho)](https:\u002F\u002Fgoreportcard.com\u002Freport\u002Fgithub.com\u002Fnyarime\u002Fgho)\n[![License: MIT](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-MIT-yellow.svg)](https:\u002F\u002Fopensource.org\u002Flicenses\u002FMIT)\n\nPure Go library and CLI tool for parsing **Norton Ghost GHO** disk image files.\n\nNo C dependencies. No CGo. Single binary.\n\n## Features\n\n- Parse GHO file\u002Fpartition headers and record structure\n- Decompress **Fast LZ (Z1)** compressed partitions\n- **Create** GHO images from raw partition data\n- **Fixup** GHO headers (ghofixup.exe equivalent — CD\u002Fspan flag modification with PRNG cipher)\n- Extract MBR\u002FTrack 0 data and partition table\n- Stream decompression (constant memory, arbitrary image sizes)\n- Supports Ghost 11.x–12.x format\n\n## Install\n\n```bash\n# Library\ngo get github.com\u002Fnyarime\u002Fgho\n\n# CLI tool\ngo install github.com\u002Fnyarime\u002Fgho\u002Fcmd\u002Fgho@latest\n```\n\n## CLI Usage\n\n```bash\n# Show image info\ngho info disk.gho\n\n# Extract all partitions to a directory\ngho extract disk.gho output\u002F\n\n# Create a GHO image from a partition image (+ optional MBR)\ngho create output.gho partition.img mbr.bin\n\n# Modify header flags (ghofixup.exe equivalent)\ngho fixup disk.gho cd      # Set spanned\u002FCD bit\ngho fixup disk.gho cd-     # Clear spanned\u002FCD bit\ngho fixup disk.gho span    # Toggle CD flag\n```\n\nExample output:\n\n```\nGHO Image Summary\n  File Type:   1 (1=single, 9=span)\n  Compression: 2 (Fast\u002FZ1)\n  Image ID:    0x12345678\n  MBR Partitions: 1\n    P0: type=0x83 LBA=2016 size=102240 (49.9 MB)\n  Data Partitions: 1\n    Partition 0: 3 spans, 42816212 bytes compressed data\n\nDecompressing partition 0...\nSaved partition 0: output\u002Fpartition-0.img (51.4 MB)\n```\n\n## Library Usage\n\n```go\npackage main\n\nimport (\n    \"bytes\"\n    \"fmt\"\n    \"log\"\n\n    \"github.com\u002Fnyarime\u002Fgho\"\n)\n\nfunc main() {\n    img, err := gho.Open(\"disk.gho\")\n    if err != nil {\n        log.Fatal(err)\n    }\n    defer img.Close()\n\n    \u002F\u002F Print summary\n    fmt.Print(img.Summary())\n\n    \u002F\u002F Access MBR partition table\n    for i, p := range img.MBRPartitions() {\n        fmt.Printf(\"Partition %d: type=%#x, LBA=%d, size=%d sectors\\n\",\n            i, p.Type, p.LBAStart, p.LBASize)\n    }\n\n    \u002F\u002F Decompress partition 0 to memory\n    var buf bytes.Buffer\n    if err := img.DecompressPartition(0, &buf); err != nil {\n        log.Fatal(err)\n    }\n    fmt.Printf(\"Decompressed: %d bytes\\n\", buf.Len())\n}\n```\n\n### Create a GHO Image\n\n```go\nw, _ := gho.Create(\"output.gho\", gho.CompressionNone)\nw.WriteTrack0(mbrData, 63)  \u002F\u002F MBR + boot sectors\nw.WritePartition(partFile)    \u002F\u002F raw partition data (io.Reader)\nw.Close()\n```\n\n### Modify Header Flags (ghofixup)\n\n```go\n\u002F\u002F Set CD\u002Fspanned bit (like ghofixup.exe cd)\ngho.ModifyHeader(\"disk.gho\", gho.FixupCD)\n\n\u002F\u002F Toggle span flag\ngho.ModifyHeader(\"disk.gho\", gho.FixupSpan)\n```\n\n## GHO Format\n\nNorton Ghost GHO files store disk\u002Fpartition images with the following structure:\n\n```\n┌──────────────────────────────────────┐\n│  File Header (512 bytes)             │  Magic: FE EF, compression type, ID\n├──────────────────────────────────────┤\n│  Record: Track 0 (type 0x0006)       │  6-byte header + MBR + boot sectors\n├──────────────────────────────────────┤\n│  Record: Partition (type 0x0603)     │  20-byte partition descriptor\n├──────────────────────────────────────┤\n│  FEEF Partition Header (512 bytes)   │  Per-partition compression settings\n├──────────────────────────────────────┤\n│  Compressed Blocks                   │  [2B len][block data]...\n│  ├─ Block: 2B stored_len + data      │  32KB decompressed per block\n│  ├─ Block: ...                       │\n│  └─ Block: ...                       │\n├──────────────────────────────────────┤\n│  Record: Continuation (type 0x0703)  │  Additional data spans\n├──────────────────────────────────────┤\n│  (optional FEEF + more blocks)       │\n├──────────────────────────────────────┤\n│  Record: End (type 0x0023)           │  End of image marker\n└──────────────────────────────────────┘\n```\n\n**Compression**: Each block is 32KB decompressed. The first byte of block data indicates the type:\n- `0x01` → Uncompressed (raw data at offset 4)\n- Other → Fast LZ compressed (custom LZ77 variant with 4096-entry hash table)\n\n**Records**: Every record has a 10-byte header: `[4B type][4B magic 0x012F18D8][2B body_len]`\n\n## Fast LZ Algorithm\n\nThe Fast LZ decompressor was reverse-engineered from Norton Ghost 11.5.1. It's a custom LZ77 variant using:\n\n- 16-bit control words (bit 0 = literal, bit 1 = match reference)\n- 4096-entry hash table with the hash function: `h = ((-24993 * (b2 ^ (16 * (b1 ^ (16 * b0))))) >> 4) & 0xFFF`\n- 2-byte match tokens encoding hash index + extra length\n- Minimum match length of 3 bytes\n\n## Supported Formats\n\n| Ghost Version | Compression | Status |\n|---|---|---|\n| 11.x–12.x | None (Z0) | ✅ Read + Write |\n|| 11.x–12.x | Fast LZ (Z1) | ✅ Read + Write |\n| 11.x–12.x | High\u002Fzlib (Z3–Z9) | ✅ Read + Write |\n| Encrypted images | CRC-16 cipher | ✅ Read + Write |\n| Span files (.ghs) | Multi-file | ✅ Read |\n\n## Contributing\n\nContributions welcome! Areas that need work:\n\n- **Span file writing**: Creating multi-file (.ghs) span images\n- **Full disk images**: Currently supports partition-level images; whole-disk with MBR rebuild is planned\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n\n## Credits\n\nReverse-engineered from Norton Ghost 11.5.1 by [Nyarime](https:\u002F\u002Fgithub.com\u002Fnyarime).\n\nPart of the [Nyarc](https:\u002F\u002Fnyarc.bbie.net) firmware analysis toolkit.\n","nyarime\u002Fgho 是一个纯 Go 语言编写的 Norton Ghost GHO 磁盘镜像解析库及命令行工具。其核心功能包括解析 GHO 文件和分区头、解压缩 Fast LZ (Z1) 压缩的分区、创建 GHO 镜像以及修改 GHO 头文件等，无需任何 C 依赖且为单一可执行文件。该工具支持流式解压缩，能够处理任意大小的镜像，并兼容 Ghost 11.x-12.x 格式。适用于需要对旧版 Norton Ghost 创建的磁盘或分区镜像进行分析、修复或转换的场景，特别适合于数据恢复、取证分析等领域。",2,"2026-06-11 04:00:54","CREATED_QUERY"]