3 * Copyright (C) 2002,2003 ReactOS Team
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
19 * COPYRIGHT: See COPYING in the top level directory
20 * PROJECT: ReactOS kernel
21 * FILE: drivers/filesystem/ntfs/attrib.c
22 * PURPOSE: NTFS filesystem driver
23 * PROGRAMMERS: Eric Kohl
25 * Hervé Poussineau (hpoussin@reactos.org)
26 * Pierre Schweitzer (pierre@reactos.org)
29 /* INCLUDES *****************************************************************/
36 /* FUNCTIONS ****************************************************************/
42 * Adds a $DATA attribute to a given FileRecord.
45 * Pointer to a complete file record to add the attribute to. Caller is responsible for
46 * ensuring FileRecord is large enough to contain $DATA.
48 * @param AttributeAddress
49 * Pointer to the region of memory that will receive the $DATA attribute.
50 * This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord).
53 * STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end
54 * of the given file record.
57 * Only adding the attribute to the end of the file record is supported; AttributeAddress must
58 * be of type AttributeEnd.
59 * As it's implemented, this function is only intended to assist in creating new file records. It
60 * could be made more general-purpose by considering file records with an $ATTRIBUTE_LIST.
61 * It's the caller's responsibility to ensure the given file record has enough memory allocated
65 AddData(PFILE_RECORD_HEADER FileRecord
,
66 PNTFS_ATTR_RECORD AttributeAddress
)
68 ULONG ResidentHeaderLength
= FIELD_OFFSET(NTFS_ATTR_RECORD
, Resident
.Reserved
) + sizeof(UCHAR
);
69 ULONG FileRecordEnd
= AttributeAddress
->Length
;
71 if (AttributeAddress
->Type
!= AttributeEnd
)
73 DPRINT1("FIXME: Can only add $DATA attribute to the end of a file record.\n");
74 return STATUS_NOT_IMPLEMENTED
;
77 AttributeAddress
->Type
= AttributeData
;
78 AttributeAddress
->Length
= ResidentHeaderLength
;
79 AttributeAddress
->Length
= ALIGN_UP_BY(AttributeAddress
->Length
, 8);
80 AttributeAddress
->Resident
.ValueLength
= 0;
81 AttributeAddress
->Resident
.ValueOffset
= ResidentHeaderLength
;
83 // for unnamed $DATA attributes, NameOffset equals header length
84 AttributeAddress
->NameOffset
= ResidentHeaderLength
;
85 AttributeAddress
->Instance
= FileRecord
->NextAttributeNumber
++;
87 // move the attribute-end and file-record-end markers to the end of the file record
88 AttributeAddress
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)AttributeAddress
+ AttributeAddress
->Length
);
89 SetFileRecordEnd(FileRecord
, AttributeAddress
, FileRecordEnd
);
91 return STATUS_SUCCESS
;
98 * Adds a $FILE_NAME attribute to a given FileRecord.
101 * Pointer to a complete file record to add the attribute to. Caller is responsible for
102 * ensuring FileRecord is large enough to contain $FILE_NAME.
104 * @param AttributeAddress
105 * Pointer to the region of memory that will receive the $FILE_NAME attribute.
106 * This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord).
109 * Points to the target disk's DEVICE_EXTENSION.
112 * Pointer to the FILE_OBJECT which represents the new name.
113 * This parameter is used to determine the filename and parent directory.
115 * @param CaseSensitive
116 * Boolean indicating if the function should operate in case-sensitive mode. This will be TRUE
117 * if an application opened the file with the FILE_FLAG_POSIX_SEMANTICS flag.
119 * @param ParentMftIndex
120 * Pointer to a ULONGLONG which will receive the index of the parent directory.
123 * STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end
124 * of the given file record.
127 * Only adding the attribute to the end of the file record is supported; AttributeAddress must
128 * be of type AttributeEnd.
129 * As it's implemented, this function is only intended to assist in creating new file records. It
130 * could be made more general-purpose by considering file records with an $ATTRIBUTE_LIST.
131 * It's the caller's responsibility to ensure the given file record has enough memory allocated
135 AddFileName(PFILE_RECORD_HEADER FileRecord
,
136 PNTFS_ATTR_RECORD AttributeAddress
,
137 PDEVICE_EXTENSION DeviceExt
,
138 PFILE_OBJECT FileObject
,
139 BOOLEAN CaseSensitive
,
140 PULONGLONG ParentMftIndex
)
142 ULONG ResidentHeaderLength
= FIELD_OFFSET(NTFS_ATTR_RECORD
, Resident
.Reserved
) + sizeof(UCHAR
);
143 PFILENAME_ATTRIBUTE FileNameAttribute
;
144 LARGE_INTEGER SystemTime
;
145 ULONG FileRecordEnd
= AttributeAddress
->Length
;
146 ULONGLONG CurrentMFTIndex
= NTFS_FILE_ROOT
;
147 UNICODE_STRING Current
, Remaining
, FilenameNoPath
;
148 NTSTATUS Status
= STATUS_SUCCESS
;
149 ULONG FirstEntry
= 0;
150 WCHAR Buffer
[MAX_PATH
];
152 if (AttributeAddress
->Type
!= AttributeEnd
)
154 DPRINT1("FIXME: Can only add $FILE_NAME attribute to the end of a file record.\n");
155 return STATUS_NOT_IMPLEMENTED
;
158 AttributeAddress
->Type
= AttributeFileName
;
159 AttributeAddress
->Instance
= FileRecord
->NextAttributeNumber
++;
161 FileNameAttribute
= (PFILENAME_ATTRIBUTE
)((LONG_PTR
)AttributeAddress
+ ResidentHeaderLength
);
164 KeQuerySystemTime(&SystemTime
);
165 FileNameAttribute
->CreationTime
= SystemTime
.QuadPart
;
166 FileNameAttribute
->ChangeTime
= SystemTime
.QuadPart
;
167 FileNameAttribute
->LastWriteTime
= SystemTime
.QuadPart
;
168 FileNameAttribute
->LastAccessTime
= SystemTime
.QuadPart
;
170 FileNameAttribute
->FileAttributes
= NTFS_FILE_TYPE_ARCHIVE
;
172 // we need to extract the filename from the path
173 DPRINT1("Pathname: %wZ\n", &FileObject
->FileName
);
175 RtlInitEmptyUnicodeString(&FilenameNoPath
, Buffer
, MAX_PATH
);
177 FsRtlDissectName(FileObject
->FileName
, &Current
, &Remaining
);
179 while (Current
.Length
!= 0)
181 DPRINT1("Current: %wZ\n", &Current
);
183 if(Remaining
.Length
!= 0)
184 RtlCopyUnicodeString(&FilenameNoPath
, &Remaining
);
186 Status
= NtfsFindMftRecord(DeviceExt
,
193 if (!NT_SUCCESS(Status
))
196 if (Remaining
.Length
== 0 )
198 if(Current
.Length
!= 0)
199 RtlCopyUnicodeString(&FilenameNoPath
, &Current
);
203 FsRtlDissectName(Current
, &Current
, &Remaining
);
206 DPRINT1("MFT Index of parent: %I64u\n", CurrentMFTIndex
);
208 // set reference to parent directory
209 FileNameAttribute
->DirectoryFileReferenceNumber
= CurrentMFTIndex
;
210 *ParentMftIndex
= CurrentMFTIndex
;
212 DPRINT1("SequenceNumber: 0x%02x\n", FileRecord
->SequenceNumber
);
214 // The highest 2 bytes should be the sequence number, unless the parent happens to be root
215 if (CurrentMFTIndex
== NTFS_FILE_ROOT
)
216 FileNameAttribute
->DirectoryFileReferenceNumber
|= (ULONGLONG
)NTFS_FILE_ROOT
<< 48;
218 FileNameAttribute
->DirectoryFileReferenceNumber
|= (ULONGLONG
)FileRecord
->SequenceNumber
<< 48;
220 DPRINT1("FileNameAttribute->DirectoryFileReferenceNumber: 0x%016I64x\n", FileNameAttribute
->DirectoryFileReferenceNumber
);
222 FileNameAttribute
->NameLength
= FilenameNoPath
.Length
/ sizeof(WCHAR
);
223 RtlCopyMemory(FileNameAttribute
->Name
, FilenameNoPath
.Buffer
, FilenameNoPath
.Length
);
225 // For now, we're emulating the way Windows behaves when 8.3 name generation is disabled
226 // TODO: add DOS Filename as needed
227 if (RtlIsNameLegalDOS8Dot3(&FilenameNoPath
, NULL
, NULL
))
228 FileNameAttribute
->NameType
= NTFS_FILE_NAME_WIN32_AND_DOS
;
230 FileNameAttribute
->NameType
= NTFS_FILE_NAME_POSIX
;
232 FileRecord
->LinkCount
++;
234 AttributeAddress
->Length
= ResidentHeaderLength
+
235 FIELD_OFFSET(FILENAME_ATTRIBUTE
, Name
) + FilenameNoPath
.Length
;
236 AttributeAddress
->Length
= ALIGN_UP_BY(AttributeAddress
->Length
, 8);
238 AttributeAddress
->Resident
.ValueLength
= FIELD_OFFSET(FILENAME_ATTRIBUTE
, Name
) + FilenameNoPath
.Length
;
239 AttributeAddress
->Resident
.ValueOffset
= ResidentHeaderLength
;
240 AttributeAddress
->Resident
.Flags
= 1; // indexed
242 // move the attribute-end and file-record-end markers to the end of the file record
243 AttributeAddress
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)AttributeAddress
+ AttributeAddress
->Length
);
244 SetFileRecordEnd(FileRecord
, AttributeAddress
, FileRecordEnd
);
253 * Adds a run of allocated clusters to a non-resident attribute.
256 * Pointer to an NTFS_VCB for the destination volume.
259 * Pointer to an NTFS_ATTR_CONTEXT describing the destination attribute.
262 * Byte offset of the destination attribute relative to its file record.
265 * Pointer to a complete copy of the file record containing the destination attribute. Must be at least
266 * Vcb->NtfsInfo.BytesPerFileRecord bytes long.
268 * @param NextAssignedCluster
269 * Logical cluster number of the start of the data run being added.
272 * How many clusters are in the data run being added. Can't be 0.
275 * STATUS_SUCCESS on success. STATUS_INVALID_PARAMETER if AttrContext describes a resident attribute.
276 * STATUS_INSUFFICIENT_RESOURCES if ConvertDataRunsToLargeMCB() fails or if we fail to allocate a
277 * buffer for the new data runs.
278 * STATUS_INSUFFICIENT_RESOURCES or STATUS_UNSUCCESSFUL if FsRtlAddLargeMcbEntry() fails.
279 * STATUS_BUFFER_TOO_SMALL if ConvertLargeMCBToDataRuns() fails.
280 * STATUS_NOT_IMPLEMENTED if we need to migrate the attribute to an attribute list (TODO).
283 * Clusters should have been allocated previously with NtfsAllocateClusters().
288 AddRun(PNTFS_VCB Vcb
,
289 PNTFS_ATTR_CONTEXT AttrContext
,
291 PFILE_RECORD_HEADER FileRecord
,
292 ULONGLONG NextAssignedCluster
,
296 int DataRunMaxLength
;
297 PNTFS_ATTR_RECORD DestinationAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ AttrOffset
);
298 ULONG NextAttributeOffset
= AttrOffset
+ AttrContext
->Record
.Length
;
299 ULONGLONG NextVBN
= 0;
304 if (!AttrContext
->Record
.IsNonResident
)
305 return STATUS_INVALID_PARAMETER
;
307 if (AttrContext
->Record
.NonResident
.AllocatedSize
!= 0)
308 NextVBN
= AttrContext
->Record
.NonResident
.HighestVCN
+ 1;
310 // Add newly-assigned clusters to mcb
312 if (!FsRtlAddLargeMcbEntry(&AttrContext
->DataRunsMCB
,
317 ExRaiseStatus(STATUS_UNSUCCESSFUL
);
319 } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER
) {
320 _SEH2_YIELD(_SEH2_GetExceptionCode());
323 RunBuffer
= ExAllocatePoolWithTag(NonPagedPool
, Vcb
->NtfsInfo
.BytesPerFileRecord
, TAG_NTFS
);
326 DPRINT1("ERROR: Couldn't allocate memory for data runs!\n");
327 return STATUS_INSUFFICIENT_RESOURCES
;
330 // Convert the map control block back to encoded data runs
331 ConvertLargeMCBToDataRuns(&AttrContext
->DataRunsMCB
, RunBuffer
, Vcb
->NtfsInfo
.BytesPerCluster
, &RunBufferSize
);
333 // Get the amount of free space between the start of the of the first data run and the attribute end
334 DataRunMaxLength
= AttrContext
->Record
.Length
- AttrContext
->Record
.NonResident
.MappingPairsOffset
;
336 // Do we need to extend the attribute (or convert to attribute list)?
337 if (DataRunMaxLength
< RunBufferSize
)
339 PNTFS_ATTR_RECORD NextAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ NextAttributeOffset
);
340 DataRunMaxLength
+= Vcb
->NtfsInfo
.BytesPerFileRecord
- NextAttributeOffset
- (sizeof(ULONG
) * 2);
342 // Can we move the end of the attribute?
343 if (NextAttribute
->Type
!= AttributeEnd
|| DataRunMaxLength
< RunBufferSize
- 1)
345 DPRINT1("FIXME: Need to create attribute list! Max Data Run Length available: %d\n", DataRunMaxLength
);
346 if (NextAttribute
->Type
!= AttributeEnd
)
347 DPRINT1("There's another attribute after this one with type %0xlx\n", NextAttribute
->Type
);
348 ExFreePoolWithTag(RunBuffer
, TAG_NTFS
);
349 return STATUS_NOT_IMPLEMENTED
;
352 // calculate position of end markers
353 NextAttributeOffset
= AttrOffset
+ AttrContext
->Record
.NonResident
.MappingPairsOffset
+ RunBufferSize
;
354 NextAttributeOffset
= ALIGN_UP_BY(NextAttributeOffset
, 8);
357 DestinationAttribute
->Length
= NextAttributeOffset
- AttrOffset
;
358 AttrContext
->Record
.Length
= DestinationAttribute
->Length
;
360 // End the file record
361 NextAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ NextAttributeOffset
);
362 SetFileRecordEnd(FileRecord
, NextAttribute
, FILE_RECORD_END
);
366 DestinationAttribute
->NonResident
.HighestVCN
=
367 AttrContext
->Record
.NonResident
.HighestVCN
= max(NextVBN
- 1 + RunLength
,
368 AttrContext
->Record
.NonResident
.HighestVCN
);
370 // Write data runs to destination attribute
371 RtlCopyMemory((PVOID
)((ULONG_PTR
)DestinationAttribute
+ DestinationAttribute
->NonResident
.MappingPairsOffset
),
375 // Update the file record
376 Status
= UpdateFileRecord(Vcb
, AttrContext
->FileMFTIndex
, FileRecord
);
378 ExFreePoolWithTag(RunBuffer
, TAG_NTFS
);
380 NtfsDumpDataRuns((PUCHAR
)((ULONG_PTR
)DestinationAttribute
+ DestinationAttribute
->NonResident
.MappingPairsOffset
), 0);
386 * @name AddStandardInformation
389 * Adds a $STANDARD_INFORMATION attribute to a given FileRecord.
392 * Pointer to a complete file record to add the attribute to. Caller is responsible for
393 * ensuring FileRecord is large enough to contain $STANDARD_INFORMATION.
395 * @param AttributeAddress
396 * Pointer to the region of memory that will receive the $STANDARD_INFORMATION attribute.
397 * This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord).
400 * STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end
401 * of the given file record.
404 * Only adding the attribute to the end of the file record is supported; AttributeAddress must
405 * be of type AttributeEnd.
406 * As it's implemented, this function is only intended to assist in creating new file records. It
407 * could be made more general-purpose by considering file records with an $ATTRIBUTE_LIST.
408 * It's the caller's responsibility to ensure the given file record has enough memory allocated
412 AddStandardInformation(PFILE_RECORD_HEADER FileRecord
,
413 PNTFS_ATTR_RECORD AttributeAddress
)
415 ULONG ResidentHeaderLength
= FIELD_OFFSET(NTFS_ATTR_RECORD
, Resident
.Reserved
) + sizeof(UCHAR
);
416 PSTANDARD_INFORMATION StandardInfo
= (PSTANDARD_INFORMATION
)((LONG_PTR
)AttributeAddress
+ ResidentHeaderLength
);
417 LARGE_INTEGER SystemTime
;
418 ULONG FileRecordEnd
= AttributeAddress
->Length
;
420 if (AttributeAddress
->Type
!= AttributeEnd
)
422 DPRINT1("FIXME: Can only add $STANDARD_INFORMATION attribute to the end of a file record.\n");
423 return STATUS_NOT_IMPLEMENTED
;
426 AttributeAddress
->Type
= AttributeStandardInformation
;
427 AttributeAddress
->Length
= sizeof(STANDARD_INFORMATION
) + ResidentHeaderLength
;
428 AttributeAddress
->Length
= ALIGN_UP_BY(AttributeAddress
->Length
, 8);
429 AttributeAddress
->Resident
.ValueLength
= sizeof(STANDARD_INFORMATION
);
430 AttributeAddress
->Resident
.ValueOffset
= ResidentHeaderLength
;
431 AttributeAddress
->Instance
= FileRecord
->NextAttributeNumber
++;
433 // set dates and times
434 KeQuerySystemTime(&SystemTime
);
435 StandardInfo
->CreationTime
= SystemTime
.QuadPart
;
436 StandardInfo
->ChangeTime
= SystemTime
.QuadPart
;
437 StandardInfo
->LastWriteTime
= SystemTime
.QuadPart
;
438 StandardInfo
->LastAccessTime
= SystemTime
.QuadPart
;
439 StandardInfo
->FileAttribute
= NTFS_FILE_TYPE_ARCHIVE
;
441 // move the attribute-end and file-record-end markers to the end of the file record
442 AttributeAddress
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)AttributeAddress
+ AttributeAddress
->Length
);
443 SetFileRecordEnd(FileRecord
, AttributeAddress
, FileRecordEnd
);
445 return STATUS_SUCCESS
;
449 * @name ConvertDataRunsToLargeMCB
452 * Converts binary data runs to a map control block.
455 * Pointer to the run data
458 * Pointer to an unitialized LARGE_MCB structure.
461 * STATUS_SUCCESS on success, STATUS_INSUFFICIENT_RESOURCES or STATUS_UNSUCCESSFUL if we fail to
462 * initialize the mcb or add an entry.
465 * Initializes the LARGE_MCB pointed to by DataRunsMCB. If this function succeeds, you
466 * need to call FsRtlUninitializeLargeMcb() when you're done with DataRunsMCB. This
467 * function will ensure the LargeMCB has been unitialized in case of failure.
471 ConvertDataRunsToLargeMCB(PUCHAR DataRun
,
472 PLARGE_MCB DataRunsMCB
,
475 LONGLONG DataRunOffset
;
476 ULONGLONG DataRunLength
;
477 LONGLONG DataRunStartLCN
;
478 ULONGLONG LastLCN
= 0;
480 // Initialize the MCB, potentially catch an exception
482 FsRtlInitializeLargeMcb(DataRunsMCB
, NonPagedPool
);
483 } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER
) {
484 _SEH2_YIELD(return _SEH2_GetExceptionCode());
487 while (*DataRun
!= 0)
489 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
491 if (DataRunOffset
!= -1)
494 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
495 LastLCN
= DataRunStartLCN
;
498 if (!FsRtlAddLargeMcbEntry(DataRunsMCB
,
503 ExRaiseStatus(STATUS_UNSUCCESSFUL
);
505 } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER
) {
506 FsRtlUninitializeLargeMcb(DataRunsMCB
);
507 _SEH2_YIELD(return _SEH2_GetExceptionCode());
512 *pNextVBN
+= DataRunLength
;
515 return STATUS_SUCCESS
;
519 * @name ConvertLargeMCBToDataRuns
522 * Converts a map control block to a series of encoded data runs (used by non-resident attributes).
525 * Pointer to a LARGE_MCB structure describing the data runs.
528 * Pointer to the buffer that will receive the encoded data runs.
530 * @param MaxBufferSize
531 * Size of RunBuffer, in bytes.
533 * @param UsedBufferSize
534 * Pointer to a ULONG that will receive the size of the data runs in bytes. Can't be NULL.
537 * STATUS_SUCCESS on success, STATUS_BUFFER_TOO_SMALL if RunBuffer is too small to contain the
542 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB
,
545 PULONG UsedBufferSize
)
547 NTSTATUS Status
= STATUS_SUCCESS
;
548 ULONG RunBufferOffset
= 0;
549 LONGLONG DataRunOffset
;
550 ULONGLONG LastLCN
= 0;
551 LONGLONG Vbn
, Lbn
, Count
;
555 DPRINT("\t[Vbn, Lbn, Count]\n");
557 // convert each mcb entry to a data run
558 for (i
= 0; FsRtlGetNextLargeMcbEntry(DataRunsMCB
, i
, &Vbn
, &Lbn
, &Count
); i
++)
560 UCHAR DataRunOffsetSize
= 0;
561 UCHAR DataRunLengthSize
= 0;
562 UCHAR ControlByte
= 0;
565 DPRINT("\t[%I64d, %I64d,%I64d]\n", Vbn
, Lbn
, Count
);
567 // TODO: check for holes and convert to sparse runs
568 DataRunOffset
= Lbn
- LastLCN
;
571 // now we need to determine how to represent DataRunOffset with the minimum number of bytes
572 DPRINT("Determining how many bytes needed to represent %I64x\n", DataRunOffset
);
573 DataRunOffsetSize
= GetPackedByteCount(DataRunOffset
, TRUE
);
574 DPRINT("%d bytes needed.\n", DataRunOffsetSize
);
576 // determine how to represent DataRunLengthSize with the minimum number of bytes
577 DPRINT("Determining how many bytes needed to represent %I64x\n", Count
);
578 DataRunLengthSize
= GetPackedByteCount(Count
, TRUE
);
579 DPRINT("%d bytes needed.\n", DataRunLengthSize
);
581 // ensure the next data run + end marker would be <= Max buffer size
582 if (RunBufferOffset
+ 2 + DataRunLengthSize
+ DataRunOffsetSize
> MaxBufferSize
)
584 Status
= STATUS_BUFFER_TOO_SMALL
;
585 DPRINT1("FIXME: Ran out of room in buffer for data runs!\n");
589 // pack and copy the control byte
590 ControlByte
= (DataRunOffsetSize
<< 4) + DataRunLengthSize
;
591 RunBuffer
[RunBufferOffset
++] = ControlByte
;
593 // copy DataRunLength
594 RtlCopyMemory(RunBuffer
+ RunBufferOffset
, &Count
, DataRunLengthSize
);
595 RunBufferOffset
+= DataRunLengthSize
;
597 // copy DataRunOffset
598 RtlCopyMemory(RunBuffer
+ RunBufferOffset
, &DataRunOffset
, DataRunOffsetSize
);
599 RunBufferOffset
+= DataRunOffsetSize
;
603 RunBuffer
[RunBufferOffset
++] = 0;
605 *UsedBufferSize
= RunBufferOffset
;
606 DPRINT("New Size of DataRuns: %ld\n", *UsedBufferSize
);
612 DecodeRun(PUCHAR DataRun
,
613 LONGLONG
*DataRunOffset
,
614 ULONGLONG
*DataRunLength
)
616 UCHAR DataRunOffsetSize
;
617 UCHAR DataRunLengthSize
;
620 DataRunOffsetSize
= (*DataRun
>> 4) & 0xF;
621 DataRunLengthSize
= *DataRun
& 0xF;
625 for (i
= 0; i
< DataRunLengthSize
; i
++)
627 *DataRunLength
+= ((ULONG64
)*DataRun
) << (i
* 8);
631 /* NTFS 3+ sparse files */
632 if (DataRunOffsetSize
== 0)
638 for (i
= 0; i
< DataRunOffsetSize
- 1; i
++)
640 *DataRunOffset
+= ((ULONG64
)*DataRun
) << (i
* 8);
643 /* The last byte contains sign so we must process it different way. */
644 *DataRunOffset
= ((LONG64
)(CHAR
)(*(DataRun
++)) << (i
* 8)) + *DataRunOffset
;
647 DPRINT("DataRunOffsetSize: %x\n", DataRunOffsetSize
);
648 DPRINT("DataRunLengthSize: %x\n", DataRunLengthSize
);
649 DPRINT("DataRunOffset: %x\n", *DataRunOffset
);
650 DPRINT("DataRunLength: %x\n", *DataRunLength
);
656 FindRun(PNTFS_ATTR_RECORD NresAttr
,
661 if (vcn
< NresAttr
->NonResident
.LowestVCN
|| vcn
> NresAttr
->NonResident
.HighestVCN
)
664 DecodeRun((PUCHAR
)((ULONG_PTR
)NresAttr
+ NresAttr
->NonResident
.MappingPairsOffset
), (PLONGLONG
)lcn
, count
);
673 * Shrinks the allocation size of a non-resident attribute by a given number of clusters.
674 * Frees the clusters from the volume's $BITMAP file as well as the attribute's data runs.
677 * Pointer to an NTFS_VCB for the destination volume.
680 * Pointer to an NTFS_ATTR_CONTEXT describing the attribute from which the clusters will be freed.
683 * Byte offset of the destination attribute relative to its file record.
686 * Pointer to a complete copy of the file record containing the attribute. Must be at least
687 * Vcb->NtfsInfo.BytesPerFileRecord bytes long.
689 * @param ClustersToFree
690 * Number of clusters that should be freed from the end of the data stream. Must be no more
691 * Than the number of clusters assigned to the attribute (HighestVCN + 1).
694 * STATUS_SUCCESS on success. STATUS_INVALID_PARAMETER if AttrContext describes a resident attribute,
695 * or if the caller requested more clusters be freed than the attribute has been allocated.
696 * STATUS_INSUFFICIENT_RESOURCES if allocating a buffer for the data runs fails or
697 * if ConvertDataRunsToLargeMCB() fails.
698 * STATUS_BUFFER_TOO_SMALL if ConvertLargeMCBToDataRuns() fails.
703 FreeClusters(PNTFS_VCB Vcb
,
704 PNTFS_ATTR_CONTEXT AttrContext
,
706 PFILE_RECORD_HEADER FileRecord
,
707 ULONG ClustersToFree
)
709 NTSTATUS Status
= STATUS_SUCCESS
;
710 ULONG ClustersLeftToFree
= ClustersToFree
;
712 PNTFS_ATTR_RECORD DestinationAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ AttrOffset
);
713 ULONG NextAttributeOffset
= AttrOffset
+ AttrContext
->Record
.Length
;
714 PNTFS_ATTR_RECORD NextAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ NextAttributeOffset
);
717 ULONG RunBufferSize
= 0;
719 PFILE_RECORD_HEADER BitmapRecord
;
720 PNTFS_ATTR_CONTEXT DataContext
;
721 ULONGLONG BitmapDataSize
;
726 if (!AttrContext
->Record
.IsNonResident
)
728 return STATUS_INVALID_PARAMETER
;
731 // Read the $Bitmap file
732 BitmapRecord
= ExAllocatePoolWithTag(NonPagedPool
,
733 Vcb
->NtfsInfo
.BytesPerFileRecord
,
735 if (BitmapRecord
== NULL
)
737 DPRINT1("Error: Unable to allocate memory for bitmap file record!\n");
738 return STATUS_NO_MEMORY
;
741 Status
= ReadFileRecord(Vcb
, NTFS_FILE_BITMAP
, BitmapRecord
);
742 if (!NT_SUCCESS(Status
))
744 DPRINT1("Error: Unable to read file record for bitmap!\n");
745 ExFreePoolWithTag(BitmapRecord
, TAG_NTFS
);
749 Status
= FindAttribute(Vcb
, BitmapRecord
, AttributeData
, L
"", 0, &DataContext
, NULL
);
750 if (!NT_SUCCESS(Status
))
752 DPRINT1("Error: Unable to find data attribute for bitmap file!\n");
753 ExFreePoolWithTag(BitmapRecord
, TAG_NTFS
);
757 BitmapDataSize
= AttributeDataLength(&DataContext
->Record
);
758 BitmapDataSize
= min(BitmapDataSize
, 0xffffffff);
759 ASSERT((BitmapDataSize
* 8) >= Vcb
->NtfsInfo
.ClusterCount
);
760 BitmapData
= ExAllocatePoolWithTag(NonPagedPool
, ROUND_UP(BitmapDataSize
, Vcb
->NtfsInfo
.BytesPerSector
), TAG_NTFS
);
761 if (BitmapData
== NULL
)
763 DPRINT1("Error: Unable to allocate memory for bitmap file data!\n");
764 ReleaseAttributeContext(DataContext
);
765 ExFreePoolWithTag(BitmapRecord
, TAG_NTFS
);
769 ReadAttribute(Vcb
, DataContext
, 0, (PCHAR
)BitmapData
, (ULONG
)BitmapDataSize
);
771 RtlInitializeBitMap(&Bitmap
, (PULONG
)BitmapData
, Vcb
->NtfsInfo
.ClusterCount
);
773 // free clusters in $BITMAP file
774 while (ClustersLeftToFree
> 0)
776 LONGLONG LargeVbn
, LargeLbn
;
778 if (!FsRtlLookupLastLargeMcbEntry(&AttrContext
->DataRunsMCB
, &LargeVbn
, &LargeLbn
))
780 Status
= STATUS_INVALID_PARAMETER
;
781 DPRINT1("DRIVER ERROR: FreeClusters called to free %lu clusters, which is %lu more clusters than are assigned to attribute!",
789 // deallocate this cluster
790 RtlClearBits(&Bitmap
, LargeLbn
, 1);
792 FsRtlTruncateLargeMcb(&AttrContext
->DataRunsMCB
, AttrContext
->Record
.NonResident
.HighestVCN
);
794 // decrement HighestVCN, but don't let it go below 0
795 AttrContext
->Record
.NonResident
.HighestVCN
= min(AttrContext
->Record
.NonResident
.HighestVCN
, AttrContext
->Record
.NonResident
.HighestVCN
- 1);
796 ClustersLeftToFree
--;
799 // update $BITMAP file on disk
800 Status
= WriteAttribute(Vcb
, DataContext
, 0, BitmapData
, (ULONG
)BitmapDataSize
, &LengthWritten
);
801 if (!NT_SUCCESS(Status
))
803 ReleaseAttributeContext(DataContext
);
804 ExFreePoolWithTag(BitmapData
, TAG_NTFS
);
805 ExFreePoolWithTag(BitmapRecord
, TAG_NTFS
);
809 ReleaseAttributeContext(DataContext
);
810 ExFreePoolWithTag(BitmapData
, TAG_NTFS
);
811 ExFreePoolWithTag(BitmapRecord
, TAG_NTFS
);
813 // Save updated data runs to file record
815 // Allocate some memory for a new RunBuffer
816 RunBuffer
= ExAllocatePoolWithTag(NonPagedPool
, Vcb
->NtfsInfo
.BytesPerFileRecord
, TAG_NTFS
);
819 DPRINT1("ERROR: Couldn't allocate memory for data runs!\n");
820 return STATUS_INSUFFICIENT_RESOURCES
;
823 // Convert the map control block back to encoded data runs
824 ConvertLargeMCBToDataRuns(&AttrContext
->DataRunsMCB
, RunBuffer
, Vcb
->NtfsInfo
.BytesPerCluster
, &RunBufferSize
);
827 DestinationAttribute
->NonResident
.HighestVCN
= AttrContext
->Record
.NonResident
.HighestVCN
;
829 // Write data runs to destination attribute
830 RtlCopyMemory((PVOID
)((ULONG_PTR
)DestinationAttribute
+ DestinationAttribute
->NonResident
.MappingPairsOffset
),
834 // Is DestinationAttribute the last attribute in the file record?
835 if (NextAttribute
->Type
== AttributeEnd
)
837 // update attribute length
838 AttrContext
->Record
.Length
= ALIGN_UP_BY(AttrContext
->Record
.NonResident
.MappingPairsOffset
+ RunBufferSize
, 8);
839 DestinationAttribute
->Length
= AttrContext
->Record
.Length
;
842 NextAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)DestinationAttribute
+ DestinationAttribute
->Length
);
843 SetFileRecordEnd(FileRecord
, NextAttribute
, FILE_RECORD_END
);
846 // Update the file record
847 Status
= UpdateFileRecord(Vcb
, AttrContext
->FileMFTIndex
, FileRecord
);
849 ExFreePoolWithTag(RunBuffer
, TAG_NTFS
);
851 NtfsDumpDataRuns((PUCHAR
)((ULONG_PTR
)DestinationAttribute
+ DestinationAttribute
->NonResident
.MappingPairsOffset
), 0);
858 InternalReadNonResidentAttributes(PFIND_ATTR_CONTXT Context
)
861 PNTFS_ATTR_RECORD Attribute
;
862 PNTFS_ATTR_CONTEXT ListContext
;
864 DPRINT("InternalReadNonResidentAttributes(%p)\n", Context
);
866 Attribute
= Context
->CurrAttr
;
867 ASSERT(Attribute
->Type
== AttributeAttributeList
);
869 if (Context
->OnlyResident
)
871 Context
->NonResidentStart
= NULL
;
872 Context
->NonResidentEnd
= NULL
;
873 return STATUS_SUCCESS
;
876 if (Context
->NonResidentStart
!= NULL
)
878 return STATUS_FILE_CORRUPT_ERROR
;
881 ListContext
= PrepareAttributeContext(Attribute
);
882 ListSize
= AttributeDataLength(&ListContext
->Record
);
883 if (ListSize
> 0xFFFFFFFF)
885 ReleaseAttributeContext(ListContext
);
886 return STATUS_BUFFER_OVERFLOW
;
889 Context
->NonResidentStart
= ExAllocatePoolWithTag(NonPagedPool
, (ULONG
)ListSize
, TAG_NTFS
);
890 if (Context
->NonResidentStart
== NULL
)
892 ReleaseAttributeContext(ListContext
);
893 return STATUS_INSUFFICIENT_RESOURCES
;
896 if (ReadAttribute(Context
->Vcb
, ListContext
, 0, (PCHAR
)Context
->NonResidentStart
, (ULONG
)ListSize
) != ListSize
)
898 ExFreePoolWithTag(Context
->NonResidentStart
, TAG_NTFS
);
899 Context
->NonResidentStart
= NULL
;
900 ReleaseAttributeContext(ListContext
);
901 return STATUS_FILE_CORRUPT_ERROR
;
904 ReleaseAttributeContext(ListContext
);
905 Context
->NonResidentEnd
= (PNTFS_ATTR_RECORD
)((PCHAR
)Context
->NonResidentStart
+ ListSize
);
906 return STATUS_SUCCESS
;
911 InternalGetNextAttribute(PFIND_ATTR_CONTXT Context
)
913 PNTFS_ATTR_RECORD NextAttribute
;
915 if (Context
->CurrAttr
== (PVOID
)-1)
920 if (Context
->CurrAttr
>= Context
->FirstAttr
&&
921 Context
->CurrAttr
< Context
->LastAttr
)
923 if (Context
->CurrAttr
->Length
== 0)
925 DPRINT1("Broken length!\n");
926 Context
->CurrAttr
= (PVOID
)-1;
930 NextAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)Context
->CurrAttr
+ Context
->CurrAttr
->Length
);
932 if (NextAttribute
> Context
->LastAttr
|| NextAttribute
< Context
->FirstAttr
)
934 DPRINT1("Broken length: 0x%lx!\n", Context
->CurrAttr
->Length
);
935 Context
->CurrAttr
= (PVOID
)-1;
939 Context
->Offset
+= ((ULONG_PTR
)NextAttribute
- (ULONG_PTR
)Context
->CurrAttr
);
940 Context
->CurrAttr
= NextAttribute
;
942 if (Context
->CurrAttr
< Context
->LastAttr
&&
943 Context
->CurrAttr
->Type
!= AttributeEnd
)
945 return Context
->CurrAttr
;
949 if (Context
->NonResidentStart
== NULL
)
951 Context
->CurrAttr
= (PVOID
)-1;
955 if (Context
->CurrAttr
< Context
->NonResidentStart
||
956 Context
->CurrAttr
>= Context
->NonResidentEnd
)
958 Context
->CurrAttr
= Context
->NonResidentStart
;
960 else if (Context
->CurrAttr
->Length
!= 0)
962 NextAttribute
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)Context
->CurrAttr
+ Context
->CurrAttr
->Length
);
963 Context
->Offset
+= ((ULONG_PTR
)NextAttribute
- (ULONG_PTR
)Context
->CurrAttr
);
964 Context
->CurrAttr
= NextAttribute
;
968 DPRINT1("Broken length!\n");
969 Context
->CurrAttr
= (PVOID
)-1;
973 if (Context
->CurrAttr
< Context
->NonResidentEnd
&&
974 Context
->CurrAttr
->Type
!= AttributeEnd
)
976 return Context
->CurrAttr
;
979 Context
->CurrAttr
= (PVOID
)-1;
984 FindFirstAttribute(PFIND_ATTR_CONTXT Context
,
985 PDEVICE_EXTENSION Vcb
,
986 PFILE_RECORD_HEADER FileRecord
,
987 BOOLEAN OnlyResident
,
988 PNTFS_ATTR_RECORD
* Attribute
)
992 DPRINT("FindFistAttribute(%p, %p, %p, %p, %u, %p)\n", Context
, Vcb
, FileRecord
, OnlyResident
, Attribute
);
995 Context
->OnlyResident
= OnlyResident
;
996 Context
->FirstAttr
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ FileRecord
->AttributeOffset
);
997 Context
->CurrAttr
= Context
->FirstAttr
;
998 Context
->LastAttr
= (PNTFS_ATTR_RECORD
)((ULONG_PTR
)FileRecord
+ FileRecord
->BytesInUse
);
999 Context
->NonResidentStart
= NULL
;
1000 Context
->NonResidentEnd
= NULL
;
1001 Context
->Offset
= FileRecord
->AttributeOffset
;
1003 if (Context
->FirstAttr
->Type
== AttributeEnd
)
1005 Context
->CurrAttr
= (PVOID
)-1;
1006 return STATUS_END_OF_FILE
;
1008 else if (Context
->FirstAttr
->Type
== AttributeAttributeList
)
1010 Status
= InternalReadNonResidentAttributes(Context
);
1011 if (!NT_SUCCESS(Status
))
1016 *Attribute
= InternalGetNextAttribute(Context
);
1017 if (*Attribute
== NULL
)
1019 return STATUS_END_OF_FILE
;
1024 *Attribute
= Context
->CurrAttr
;
1025 Context
->Offset
= (UCHAR
*)Context
->CurrAttr
- (UCHAR
*)FileRecord
;
1028 return STATUS_SUCCESS
;
1032 FindNextAttribute(PFIND_ATTR_CONTXT Context
,
1033 PNTFS_ATTR_RECORD
* Attribute
)
1037 DPRINT("FindNextAttribute(%p, %p)\n", Context
, Attribute
);
1039 *Attribute
= InternalGetNextAttribute(Context
);
1040 if (*Attribute
== NULL
)
1042 return STATUS_END_OF_FILE
;
1045 if (Context
->CurrAttr
->Type
!= AttributeAttributeList
)
1047 return STATUS_SUCCESS
;
1050 Status
= InternalReadNonResidentAttributes(Context
);
1051 if (!NT_SUCCESS(Status
))
1056 *Attribute
= InternalGetNextAttribute(Context
);
1057 if (*Attribute
== NULL
)
1059 return STATUS_END_OF_FILE
;
1062 return STATUS_SUCCESS
;
1066 FindCloseAttribute(PFIND_ATTR_CONTXT Context
)
1068 if (Context
->NonResidentStart
!= NULL
)
1070 ExFreePoolWithTag(Context
->NonResidentStart
, TAG_NTFS
);
1071 Context
->NonResidentStart
= NULL
;
1077 NtfsDumpFileNameAttribute(PNTFS_ATTR_RECORD Attribute
)
1079 PFILENAME_ATTRIBUTE FileNameAttr
;
1081 DbgPrint(" $FILE_NAME ");
1083 // DbgPrint(" Length %lu Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
1085 FileNameAttr
= (PFILENAME_ATTRIBUTE
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1086 DbgPrint(" (%x) '%.*S' ", FileNameAttr
->NameType
, FileNameAttr
->NameLength
, FileNameAttr
->Name
);
1087 DbgPrint(" '%x' \n", FileNameAttr
->FileAttributes
);
1088 DbgPrint(" AllocatedSize: %I64u\nDataSize: %I64u\n", FileNameAttr
->AllocatedSize
, FileNameAttr
->DataSize
);
1089 DbgPrint(" File reference: 0x%016I64x\n", FileNameAttr
->DirectoryFileReferenceNumber
);
1095 NtfsDumpStandardInformationAttribute(PNTFS_ATTR_RECORD Attribute
)
1097 PSTANDARD_INFORMATION StandardInfoAttr
;
1099 DbgPrint(" $STANDARD_INFORMATION ");
1101 // DbgPrint(" Length %lu Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
1103 StandardInfoAttr
= (PSTANDARD_INFORMATION
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1104 DbgPrint(" '%x' ", StandardInfoAttr
->FileAttribute
);
1110 NtfsDumpVolumeNameAttribute(PNTFS_ATTR_RECORD Attribute
)
1114 DbgPrint(" $VOLUME_NAME ");
1116 // DbgPrint(" Length %lu Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
1118 VolumeName
= (PWCHAR
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1119 DbgPrint(" '%.*S' ", Attribute
->Resident
.ValueLength
/ sizeof(WCHAR
), VolumeName
);
1125 NtfsDumpVolumeInformationAttribute(PNTFS_ATTR_RECORD Attribute
)
1127 PVOLINFO_ATTRIBUTE VolInfoAttr
;
1129 DbgPrint(" $VOLUME_INFORMATION ");
1131 // DbgPrint(" Length %lu Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
1133 VolInfoAttr
= (PVOLINFO_ATTRIBUTE
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1134 DbgPrint(" NTFS Version %u.%u Flags 0x%04hx ",
1135 VolInfoAttr
->MajorVersion
,
1136 VolInfoAttr
->MinorVersion
,
1137 VolInfoAttr
->Flags
);
1143 NtfsDumpIndexRootAttribute(PNTFS_ATTR_RECORD Attribute
)
1145 PINDEX_ROOT_ATTRIBUTE IndexRootAttr
;
1146 ULONG currentOffset
;
1149 IndexRootAttr
= (PINDEX_ROOT_ATTRIBUTE
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1151 if (IndexRootAttr
->AttributeType
== AttributeFileName
)
1152 ASSERT(IndexRootAttr
->CollationRule
== COLLATION_FILE_NAME
);
1154 DbgPrint(" $INDEX_ROOT (%u bytes per index record, %u clusters) ", IndexRootAttr
->SizeOfEntry
, IndexRootAttr
->ClustersPerIndexRecord
);
1156 if (IndexRootAttr
->Header
.Flags
== INDEX_ROOT_SMALL
)
1158 DbgPrint(" (small)\n");
1162 ASSERT(IndexRootAttr
->Header
.Flags
== INDEX_ROOT_LARGE
);
1163 DbgPrint(" (large)\n");
1166 DbgPrint(" Offset to first index: 0x%lx\n Total size of index entries: 0x%lx\n Allocated size of node: 0x%lx\n",
1167 IndexRootAttr
->Header
.FirstEntryOffset
,
1168 IndexRootAttr
->Header
.TotalSizeOfEntries
,
1169 IndexRootAttr
->Header
.AllocatedSize
);
1170 currentOffset
= IndexRootAttr
->Header
.FirstEntryOffset
;
1172 // print details of every node in the index
1173 while (currentOffset
< IndexRootAttr
->Header
.TotalSizeOfEntries
)
1175 PINDEX_ENTRY_ATTRIBUTE currentIndexExtry
= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)IndexRootAttr
+ 0x10 + currentOffset
);
1176 DbgPrint(" Index Node Entry %lu", currentNode
++);
1177 if (currentIndexExtry
->Flags
& NTFS_INDEX_ENTRY_NODE
)
1178 DbgPrint(" (Branch)");
1180 DbgPrint(" (Leaf)");
1181 if((currentIndexExtry
->Flags
& NTFS_INDEX_ENTRY_END
))
1183 DbgPrint(" (Dummy Key)");
1185 DbgPrint("\n File Reference: 0x%016I64x\n", currentIndexExtry
->Data
.Directory
.IndexedFile
);
1186 DbgPrint(" Index Entry Length: 0x%x\n", currentIndexExtry
->Length
);
1187 DbgPrint(" Index Key Length: 0x%x\n", currentIndexExtry
->KeyLength
);
1189 // if this isn't the final (dummy) node, print info about the key (Filename attribute)
1190 if (!(currentIndexExtry
->Flags
& NTFS_INDEX_ENTRY_END
))
1192 UNICODE_STRING Name
;
1193 DbgPrint(" Parent File Reference: 0x%016I64x\n", currentIndexExtry
->FileName
.DirectoryFileReferenceNumber
);
1194 DbgPrint(" $FILENAME indexed: ");
1195 Name
.Length
= currentIndexExtry
->FileName
.NameLength
* sizeof(WCHAR
);
1196 Name
.MaximumLength
= Name
.Length
;
1197 Name
.Buffer
= currentIndexExtry
->FileName
.Name
;
1198 DbgPrint("'%wZ'\n", &Name
);
1201 // if this node has a sub-node beneath it
1202 if (currentIndexExtry
->Flags
& NTFS_INDEX_ENTRY_NODE
)
1204 // Print the VCN of the sub-node
1205 PULONGLONG SubNodeVCN
= (PULONGLONG
)((ULONG_PTR
)currentIndexExtry
+ currentIndexExtry
->Length
- 8);
1206 DbgPrint(" VCN of sub-node: 0x%llx\n", *SubNodeVCN
);
1209 currentOffset
+= currentIndexExtry
->Length
;
1210 ASSERT(currentIndexExtry
->Length
);
1218 NtfsDumpAttribute(PDEVICE_EXTENSION Vcb
,
1219 PNTFS_ATTR_RECORD Attribute
)
1221 UNICODE_STRING Name
;
1224 ULONGLONG runcount
= 0;
1226 switch (Attribute
->Type
)
1228 case AttributeFileName
:
1229 NtfsDumpFileNameAttribute(Attribute
);
1232 case AttributeStandardInformation
:
1233 NtfsDumpStandardInformationAttribute(Attribute
);
1236 case AttributeObjectId
:
1237 DbgPrint(" $OBJECT_ID ");
1240 case AttributeSecurityDescriptor
:
1241 DbgPrint(" $SECURITY_DESCRIPTOR ");
1244 case AttributeVolumeName
:
1245 NtfsDumpVolumeNameAttribute(Attribute
);
1248 case AttributeVolumeInformation
:
1249 NtfsDumpVolumeInformationAttribute(Attribute
);
1253 DbgPrint(" $DATA ");
1254 //DataBuf = ExAllocatePool(NonPagedPool,AttributeLengthAllocated(Attribute));
1257 case AttributeIndexRoot
:
1258 NtfsDumpIndexRootAttribute(Attribute
);
1261 case AttributeIndexAllocation
:
1262 DbgPrint(" $INDEX_ALLOCATION ");
1265 case AttributeBitmap
:
1266 DbgPrint(" $BITMAP ");
1269 case AttributeReparsePoint
:
1270 DbgPrint(" $REPARSE_POINT ");
1273 case AttributeEAInformation
:
1274 DbgPrint(" $EA_INFORMATION ");
1281 case AttributePropertySet
:
1282 DbgPrint(" $PROPERTY_SET ");
1285 case AttributeLoggedUtilityStream
:
1286 DbgPrint(" $LOGGED_UTILITY_STREAM ");
1290 DbgPrint(" Attribute %lx ",
1295 if (Attribute
->Type
!= AttributeAttributeList
)
1297 if (Attribute
->NameLength
!= 0)
1299 Name
.Length
= Attribute
->NameLength
* sizeof(WCHAR
);
1300 Name
.MaximumLength
= Name
.Length
;
1301 Name
.Buffer
= (PWCHAR
)((ULONG_PTR
)Attribute
+ Attribute
->NameOffset
);
1303 DbgPrint("'%wZ' ", &Name
);
1307 Attribute
->IsNonResident
? "non-resident" : "resident");
1309 if (Attribute
->IsNonResident
)
1311 FindRun(Attribute
,0,&lcn
, &runcount
);
1313 DbgPrint(" AllocatedSize %I64u DataSize %I64u InitilizedSize %I64u\n",
1314 Attribute
->NonResident
.AllocatedSize
, Attribute
->NonResident
.DataSize
, Attribute
->NonResident
.InitializedSize
);
1315 DbgPrint(" logical clusters: %I64u - %I64u\n",
1316 lcn
, lcn
+ runcount
- 1);
1319 DbgPrint(" %u bytes of data\n", Attribute
->Resident
.ValueLength
);
1324 VOID
NtfsDumpDataRunData(PUCHAR DataRun
)
1326 UCHAR DataRunOffsetSize
;
1327 UCHAR DataRunLengthSize
;
1330 DbgPrint("%02x ", *DataRun
);
1335 DataRunOffsetSize
= (*DataRun
>> 4) & 0xF;
1336 DataRunLengthSize
= *DataRun
& 0xF;
1339 for (i
= 0; i
< DataRunLengthSize
; i
++)
1341 DbgPrint("%02x ", *DataRun
);
1345 for (i
= 0; i
< DataRunOffsetSize
; i
++)
1347 DbgPrint("%02x ", *DataRun
);
1351 NtfsDumpDataRunData(DataRun
);
1356 NtfsDumpDataRuns(PVOID StartOfRun
,
1357 ULONGLONG CurrentLCN
)
1359 PUCHAR DataRun
= StartOfRun
;
1360 LONGLONG DataRunOffset
;
1361 ULONGLONG DataRunLength
;
1363 if (CurrentLCN
== 0)
1365 DPRINT1("Dumping data runs.\n\tData:\n\t\t");
1366 NtfsDumpDataRunData(StartOfRun
);
1367 DbgPrint("\n\tRuns:\n\t\tOff\t\tLCN\t\tLength\n");
1370 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
1372 if (DataRunOffset
!= -1)
1373 CurrentLCN
+= DataRunOffset
;
1375 DbgPrint("\t\t%I64d\t", DataRunOffset
);
1376 if (DataRunOffset
< 99999)
1378 DbgPrint("%I64u\t", CurrentLCN
);
1379 if (CurrentLCN
< 99999)
1381 DbgPrint("%I64u\n", DataRunLength
);
1384 DbgPrint("\t\t00\n");
1386 NtfsDumpDataRuns(DataRun
, CurrentLCN
);
1391 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb
,
1392 PFILE_RECORD_HEADER FileRecord
)
1395 FIND_ATTR_CONTXT Context
;
1396 PNTFS_ATTR_RECORD Attribute
;
1398 Status
= FindFirstAttribute(&Context
, Vcb
, FileRecord
, FALSE
, &Attribute
);
1399 while (NT_SUCCESS(Status
))
1401 NtfsDumpAttribute(Vcb
, Attribute
);
1403 Status
= FindNextAttribute(&Context
, &Attribute
);
1406 FindCloseAttribute(&Context
);
1410 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb
,
1411 PFILE_RECORD_HEADER FileRecord
,
1414 FIND_ATTR_CONTXT Context
;
1415 PNTFS_ATTR_RECORD Attribute
;
1416 PFILENAME_ATTRIBUTE Name
;
1419 Status
= FindFirstAttribute(&Context
, Vcb
, FileRecord
, FALSE
, &Attribute
);
1420 while (NT_SUCCESS(Status
))
1422 if (Attribute
->Type
== AttributeFileName
)
1424 Name
= (PFILENAME_ATTRIBUTE
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1425 if (Name
->NameType
== NameType
||
1426 (Name
->NameType
== NTFS_FILE_NAME_WIN32_AND_DOS
&& NameType
== NTFS_FILE_NAME_WIN32
) ||
1427 (Name
->NameType
== NTFS_FILE_NAME_WIN32_AND_DOS
&& NameType
== NTFS_FILE_NAME_DOS
))
1429 FindCloseAttribute(&Context
);
1434 Status
= FindNextAttribute(&Context
, &Attribute
);
1437 FindCloseAttribute(&Context
);
1442 * GetPackedByteCount
1443 * Returns the minimum number of bytes needed to represent the value of a
1444 * 64-bit number. Used to encode data runs.
1447 GetPackedByteCount(LONGLONG NumberToPack
,
1453 if (NumberToPack
>= 0x0100000000000000)
1455 if (NumberToPack
>= 0x0001000000000000)
1457 if (NumberToPack
>= 0x0000010000000000)
1459 if (NumberToPack
>= 0x0000000100000000)
1461 if (NumberToPack
>= 0x0000000001000000)
1463 if (NumberToPack
>= 0x0000000000010000)
1465 if (NumberToPack
>= 0x0000000000000100)
1470 if (NumberToPack
> 0)
1472 // we have to make sure the number that gets encoded won't be interpreted as negative
1473 if (NumberToPack
>= 0x0080000000000000)
1475 if (NumberToPack
>= 0x0000800000000000)
1477 if (NumberToPack
>= 0x0000008000000000)
1479 if (NumberToPack
>= 0x0000000080000000)
1481 if (NumberToPack
>= 0x0000000000800000)
1483 if (NumberToPack
>= 0x0000000000008000)
1485 if (NumberToPack
>= 0x0000000000000080)
1492 if (NumberToPack
<= 0xff80000000000000)
1494 if (NumberToPack
<= 0xffff800000000000)
1496 if (NumberToPack
<= 0xffffff8000000000)
1498 if (NumberToPack
<= 0xffffffff80000000)
1500 if (NumberToPack
<= 0xffffffffff800000)
1502 if (NumberToPack
<= 0xffffffffffff8000)
1504 if (NumberToPack
<= 0xffffffffffffff80)
1512 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb
, PNTFS_ATTR_RECORD Attribute
, PULONGLONG LastCluster
)
1514 LONGLONG DataRunOffset
;
1515 ULONGLONG DataRunLength
;
1516 LONGLONG DataRunStartLCN
;
1518 ULONGLONG LastLCN
= 0;
1519 PUCHAR DataRun
= (PUCHAR
)Attribute
+ Attribute
->NonResident
.MappingPairsOffset
;
1521 if (!Attribute
->IsNonResident
)
1522 return STATUS_INVALID_PARAMETER
;
1526 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
1528 if (DataRunOffset
!= -1)
1531 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
1532 LastLCN
= DataRunStartLCN
;
1533 *LastCluster
= LastLCN
+ DataRunLength
- 1;
1540 return STATUS_SUCCESS
;
1543 PSTANDARD_INFORMATION
1544 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb
,
1545 PFILE_RECORD_HEADER FileRecord
)
1548 FIND_ATTR_CONTXT Context
;
1549 PNTFS_ATTR_RECORD Attribute
;
1550 PSTANDARD_INFORMATION StdInfo
;
1552 Status
= FindFirstAttribute(&Context
, Vcb
, FileRecord
, FALSE
, &Attribute
);
1553 while (NT_SUCCESS(Status
))
1555 if (Attribute
->Type
== AttributeStandardInformation
)
1557 StdInfo
= (PSTANDARD_INFORMATION
)((ULONG_PTR
)Attribute
+ Attribute
->Resident
.ValueOffset
);
1558 FindCloseAttribute(&Context
);
1562 Status
= FindNextAttribute(&Context
, &Attribute
);
1565 FindCloseAttribute(&Context
);
1570 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb
,
1571 PFILE_RECORD_HEADER FileRecord
)
1573 PFILENAME_ATTRIBUTE FileName
;
1575 FileName
= GetFileNameFromRecord(Vcb
, FileRecord
, NTFS_FILE_NAME_POSIX
);
1576 if (FileName
== NULL
)
1578 FileName
= GetFileNameFromRecord(Vcb
, FileRecord
, NTFS_FILE_NAME_WIN32
);
1579 if (FileName
== NULL
)
1581 FileName
= GetFileNameFromRecord(Vcb
, FileRecord
, NTFS_FILE_NAME_DOS
);