4 // Might be a good idea to have this as a shared
5 // header with FS Recognizer.
8 // Conversion types and macros taken from internal ntifs headers
19 USHORT ForceAlignment
;
28 #define CopyUchar1(Dst,Src) { \
29 *((UCHAR1 *)(Dst)) = *((UNALIGNED UCHAR1 *)(Src)); \
32 #define CopyUchar2(Dst,Src) { \
33 *((UCHAR2 *)(Dst)) = *((UNALIGNED UCHAR2 *)(Src)); \
36 #define CopyUchar4(Dst,Src) { \
37 *((UCHAR4 *)(Dst)) = *((UNALIGNED UCHAR4 *)(Src)); \
40 #define FatUnpackBios(Bios,Pbios) { \
41 CopyUchar2(&(Bios)->BytesPerSector, &(Pbios)->BytesPerSector[0] ); \
42 CopyUchar1(&(Bios)->SectorsPerCluster, &(Pbios)->SectorsPerCluster[0]); \
43 CopyUchar2(&(Bios)->ReservedSectors, &(Pbios)->ReservedSectors[0] ); \
44 CopyUchar1(&(Bios)->Fats, &(Pbios)->Fats[0] ); \
45 CopyUchar2(&(Bios)->RootEntries, &(Pbios)->RootEntries[0] ); \
46 CopyUchar2(&(Bios)->Sectors, &(Pbios)->Sectors[0] ); \
47 CopyUchar1(&(Bios)->Media, &(Pbios)->Media[0] ); \
48 CopyUchar2(&(Bios)->SectorsPerFat, &(Pbios)->SectorsPerFat[0] ); \
49 CopyUchar2(&(Bios)->SectorsPerTrack, &(Pbios)->SectorsPerTrack[0] ); \
50 CopyUchar2(&(Bios)->Heads, &(Pbios)->Heads[0] ); \
51 CopyUchar4(&(Bios)->HiddenSectors, &(Pbios)->HiddenSectors[0] ); \
52 CopyUchar4(&(Bios)->LargeSectors, &(Pbios)->LargeSectors[0] ); \
53 CopyUchar4(&(Bios)->LargeSectors, &(Pbios)->LargeSectors[0] ); \
54 CopyUchar4(&(Bios)->LargeSectorsPerFat,&((PPACKED_BIOS_PARAMETER_BLOCK_EX)Pbios)->LargeSectorsPerFat[0] ); \
55 CopyUchar2(&(Bios)->ExtendedFlags, &((PPACKED_BIOS_PARAMETER_BLOCK_EX)Pbios)->ExtendedFlags[0] ); \
56 CopyUchar2(&(Bios)->FsVersion, &((PPACKED_BIOS_PARAMETER_BLOCK_EX)Pbios)->FsVersion[0] ); \
57 CopyUchar4(&(Bios)->RootDirFirstCluster, \
58 &((PPACKED_BIOS_PARAMETER_BLOCK_EX)Pbios)->RootDirFirstCluster[0] ); \
59 CopyUchar2(&(Bios)->FsInfoSector, &((PPACKED_BIOS_PARAMETER_BLOCK_EX)Pbios)->FsInfoSector[0] ); \
60 CopyUchar2(&(Bios)->BackupBootSector, &((PPACKED_BIOS_PARAMETER_BLOCK_EX)Pbios)->BackupBootSector[0] ); \
63 // Packed versions of the BPB and Boot Sector
65 typedef struct _PACKED_BIOS_PARAMETER_BLOCK
67 UCHAR BytesPerSector
[2];
68 UCHAR SectorsPerCluster
[1];
69 UCHAR ReservedSectors
[2];
74 UCHAR SectorsPerFat
[2];
75 UCHAR SectorsPerTrack
[2];
77 UCHAR HiddenSectors
[4];
78 UCHAR LargeSectors
[4];
79 } PACKED_BIOS_PARAMETER_BLOCK
, *PPACKED_BIOS_PARAMETER_BLOCK
;
82 typedef struct _PACKED_BIOS_PARAMETER_BLOCK_EX
84 PACKED_BIOS_PARAMETER_BLOCK Block
;
85 UCHAR LargeSectorsPerFat
[4];
86 UCHAR ExtendedFlags
[2];
88 UCHAR RootDirFirstCluster
[4];
89 UCHAR FsInfoSector
[2];
90 UCHAR BackupBootSector
[2];
92 } PACKED_BIOS_PARAMETER_BLOCK_EX
, *PPACKED_BIOS_PARAMETER_BLOCK_EX
;
96 // Unpacked version of the BPB
98 typedef struct BIOS_PARAMETER_BLOCK
100 USHORT BytesPerSector
;
101 UCHAR SectorsPerCluster
;
102 USHORT ReservedSectors
;
107 USHORT SectorsPerFat
;
108 USHORT SectorsPerTrack
;
112 ULONG LargeSectorsPerFat
;
115 USHORT ExtendedFlags
;
120 ULONG MirrorDisabled
:1;
125 ULONG RootDirFirstCluster
;
127 USHORT BackupBootSector
;
128 } BIOS_PARAMETER_BLOCK
, *PBIOS_PARAMETER_BLOCK
;
130 #define FatValidBytesPerSector(xBytes) \
131 (!((xBytes) & ((xBytes)-1)) && (xBytes)>=0x80 && (xBytes)<=0x1000)
133 #define FatValidSectorsPerCluster(xSectors) \
134 (!((xSectors) & ((xSectors)-1)) && (xSectors)>0 && (xSectors)<=0x80)
136 typedef struct _PACKED_BOOT_SECTOR
140 PACKED_BIOS_PARAMETER_BLOCK PackedBpb
;
141 UCHAR PhysicalDriveNumber
;
145 UCHAR VolumeLabel
[11];
147 } PACKED_BOOT_SECTOR
, *PPACKED_BOOT_SECTOR
;
150 typedef struct _PACKED_BOOT_SECTOR_EX
154 PACKED_BIOS_PARAMETER_BLOCK_EX PackedBpb
;
155 UCHAR PhysicalDriveNumber
;
159 UCHAR VolumeLabel
[11];
161 } PACKED_BOOT_SECTOR_EX
, *PPACKED_BOOT_SECTOR_EX
;
164 #define FatBootSectorJumpValid(xMagic) \
165 ((xMagic)[0] == 0xe9 || (xMagic)[0] == 0xeb || (xMagic)[0] == 0x49)
167 typedef struct _FSINFO_SECTOR
169 ULONG SectorBeginSignature
;
171 ULONG FsInfoSignature
;
172 ULONG FreeClusterCount
;
173 ULONG NextFreeCluster
;
175 ULONG SectorEndSignature
;
176 } FSINFO_SECTOR
, *PFSINFO_SECTOR
;
178 #define FSINFO_SECTOR_BEGIN_SIGNATURE 0x41615252
179 #define FSINFO_SECTOR_END_SIGNATURE 0xaa550000
180 #define FSINFO_SIGNATURE 0x61417272
184 #define FAT_CLUSTER_AVAILABLE 0x00000000
185 #define FAT_CLUSTER_RESERVED 0x0ffffff0
186 #define FAT_CLUSTER_BAD 0x0ffffff7
187 #define FAT_CLUSTER_LAST 0x0fffffff
189 // Directory Structure:
191 typedef struct _FAT_TIME
195 USHORT DoubleSeconds
: 5;
201 } FAT_TIME
, *PFAT_TIME
;
205 typedef struct _FAT_DATE
{
210 /* Relative to 1980 */
215 } FAT_DATE
, *PFAT_DATE
;
219 typedef struct _FAT_DATETIME
{
227 } FAT_DATETIME
, *PFAT_DATETIME
;
231 typedef struct _DIR_ENTRY
236 UCHAR CreationTimeTenMs
;
237 FAT_DATETIME CreationDateTime
;
238 FAT_DATE LastAccessDate
;
240 USHORT ExtendedAttributes
;
241 USHORT FirstClusterOfFileHi
;
243 FAT_DATETIME LastWriteDateTime
;
246 } DIR_ENTRY
, *PDIR_ENTRY
;
249 typedef struct _LONG_FILE_NAME_ENTRY
{
258 } LONG_FILE_NAME_ENTRY
, *PLONG_FILE_NAME_ENTRY
;
261 #define FAT_LFN_NAME_LENGTH \
262 (RTL_FIELD_SIZE(LONG_FILE_NAME_ENTRY, NameA) \
263 + RTL_FIELD_SIZE(LONG_FILE_NAME_ENTRY, NameB) \
264 + RTL_FIELD_SIZE(LONG_FILE_NAME_ENTRY, NameC))
266 #define FAT_FN_DIR_ENTRY_LAST 0x40
267 #define FAT_FN_MAX_DIR_ENTIES 0x14
269 #define FAT_BYTES_PER_DIRENT 0x20
270 #define FAT_BYTES_PER_DIRENT_LOG 0x05
271 #define FAT_DIRENT_NEVER_USED 0x00
272 #define FAT_DIRENT_REALLY_0E5 0x05
273 #define FAT_DIRENT_DIRECTORY_ALIAS 0x2e
274 #define FAT_DIRENT_DELETED 0xe5
276 #define FAT_CASE_LOWER_BASE 0x08
277 #define FAT_CASE_LOWER_EXT 0x10
279 #define FAT_DIRENT_ATTR_READ_ONLY 0x01
280 #define FAT_DIRENT_ATTR_HIDDEN 0x02
281 #define FAT_DIRENT_ATTR_SYSTEM 0x04
282 #define FAT_DIRENT_ATTR_VOLUME_ID 0x08
283 #define FAT_DIRENT_ATTR_DIRECTORY 0x10
284 #define FAT_DIRENT_ATTR_ARCHIVE 0x20
285 #define FAT_DIRENT_ATTR_DEVICE 0x40
286 #define FAT_DIRENT_ATTR_LFN (FAT_DIRENT_ATTR_READ_ONLY | \
287 FAT_DIRENT_ATTR_HIDDEN | \
288 FAT_DIRENT_ATTR_SYSTEM | \
289 FAT_DIRENT_ATTR_VOLUME_ID)