drivers/filesystems/ntfs/attrib.c

   1 /*
   2  *  ReactOS kernel
   3  *  Copyright (C) 2002,2003 ReactOS Team
   4  *
   5  *  This program is free software; you can redistribute it and/or modify
   6  *  it under the terms of the GNU General Public License as published by
   7  *  the Free Software Foundation; either version 2 of the License, or
   8  *  (at your option) any later version.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, write to the Free Software
  17  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
  18  *
  19  * COPYRIGHT:        See COPYING in the top level directory
  20  * PROJECT:          ReactOS kernel
  21  * FILE:             drivers/filesystem/ntfs/attrib.c
  22  * PURPOSE:          NTFS filesystem driver
  23  * PROGRAMMERS:      Eric Kohl
  24  *                   Valentin Verkhovsky
  25  *                   Hervé Poussineau (hpoussin@reactos.org)
  26  *                   Pierre Schweitzer (pierre@reactos.org)
  27  */
  28
  29 /* INCLUDES *****************************************************************/
  30
  31 #include "ntfs.h"
  32
  33 #define NDEBUG
  34 #include <debug.h>
  35
  36 /* FUNCTIONS ****************************************************************/
  37
  38 /**
  39 * @name AddRun
  40 * @implemented
  41 *
  42 * Adds a run of allocated clusters to a non-resident attribute.
  43 *
  44 * @param Vcb
  45 * Pointer to an NTFS_VCB for the destination volume.
  46 *
  47 * @param AttrContext
  48 * Pointer to an NTFS_ATTR_CONTEXT describing the destination attribute.
  49 *
  50 * @param AttrOffset
  51 * Byte offset of the destination attribute relative to its file record.
  52 *
  53 * @param FileRecord
  54 * Pointer to a complete copy of the file record containing the destination attribute. Must be at least
  55 * Vcb->NtfsInfo.BytesPerFileRecord bytes long.
  56 *
  57 * @param NextAssignedCluster
  58 * Logical cluster number of the start of the data run being added.
  59 *
  60 * @param RunLength
  61 * How many clusters are in the data run being added. Can't be 0.
  62 *
  63 * @return
  64 * STATUS_SUCCESS on success. STATUS_INVALID_PARAMETER if AttrContext describes a resident attribute.
  65 * STATUS_INSUFFICIENT_RESOURCES if ConvertDataRunsToLargeMCB() fails or if we fail to allocate a
  66 * buffer for the new data runs.
  67 * STATUS_INSUFFICIENT_RESOURCES or STATUS_UNSUCCESSFUL if FsRtlAddLargeMcbEntry() fails.
  68 * STATUS_BUFFER_TOO_SMALL if ConvertLargeMCBToDataRuns() fails.
  69 * STATUS_NOT_IMPLEMENTED if we need to migrate the attribute to an attribute list (TODO).
  70 *
  71 * @remarks
  72 * Clusters should have been allocated previously with NtfsAllocateClusters().
  73 *
  74 *
  75 */
  76 NTSTATUS
  77 AddRun(PNTFS_VCB Vcb,
  78        PNTFS_ATTR_CONTEXT AttrContext,
  79        ULONG AttrOffset,
  80        PFILE_RECORD_HEADER FileRecord,
  81        ULONGLONG NextAssignedCluster,
  82        ULONG RunLength)
  83 {
  84     NTSTATUS Status;
  85     PUCHAR DataRun = (PUCHAR)&AttrContext->Record + AttrContext->Record.NonResident.MappingPairsOffset;
  86     int DataRunMaxLength;
  87     PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
  88     LARGE_MCB DataRunsMCB;
  89     ULONG NextAttributeOffset = AttrOffset + AttrContext->Record.Length;
  90     ULONGLONG NextVBN = AttrContext->Record.NonResident.LowestVCN;
  91
  92     // Allocate some memory for the RunBuffer
  93     PUCHAR RunBuffer;
  94     ULONG RunBufferOffset = 0;
  95
  96     if (!AttrContext->Record.IsNonResident)
  97         return STATUS_INVALID_PARAMETER;
  98
  99     RunBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
 100     if (!RunBuffer)
 101     {
 102         DPRINT1("ERROR: Couldn't allocate memory for data runs!\n");
 103         return STATUS_INSUFFICIENT_RESOURCES;
 104     }
 105
 106     // Convert the data runs to a map control block
 107     Status = ConvertDataRunsToLargeMCB(DataRun, &DataRunsMCB, &NextVBN);
 108     if (!NT_SUCCESS(Status))
 109     {
 110         DPRINT1("Unable to convert data runs to MCB (probably ran out of memory)!\n");
 111         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 112         return Status;
 113     }
 114
 115     // Add newly-assigned clusters to mcb
 116     _SEH2_TRY{
 117         if (!FsRtlAddLargeMcbEntry(&DataRunsMCB,
 118                                    NextVBN,
 119                                    NextAssignedCluster,
 120                                    RunLength))
 121         {
 122             ExRaiseStatus(STATUS_UNSUCCESSFUL);
 123         }
 124     } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {
 125         FsRtlUninitializeLargeMcb(&DataRunsMCB);
 126         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 127         _SEH2_YIELD(_SEH2_GetExceptionCode());
 128     } _SEH2_END;
 129
 130
 131     // Convert the map control block back to encoded data runs
 132     ConvertLargeMCBToDataRuns(&DataRunsMCB, RunBuffer, Vcb->NtfsInfo.BytesPerCluster, &RunBufferOffset);
 133
 134     // Get the amount of free space between the start of the of the first data run and the attribute end
 135     DataRunMaxLength = AttrContext->Record.Length - AttrContext->Record.NonResident.MappingPairsOffset;
 136
 137     // Do we need to extend the attribute (or convert to attribute list)?
 138     if (DataRunMaxLength < RunBufferOffset)
 139     {
 140         PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
 141         DataRunMaxLength += Vcb->NtfsInfo.BytesPerFileRecord - NextAttributeOffset - (sizeof(ULONG) * 2);
 142
 143         // Can we move the end of the attribute?
 144         if (NextAttribute->Type != AttributeEnd || DataRunMaxLength < RunBufferOffset - 1)
 145         {
 146             DPRINT1("FIXME: Need to create attribute list! Max Data Run Length available: %d\n", DataRunMaxLength);
 147             if (NextAttribute->Type != AttributeEnd)
 148                 DPRINT1("There's another attribute after this one with type %0xlx\n", NextAttribute->Type);
 149             ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 150             FsRtlUninitializeLargeMcb(&DataRunsMCB);
 151             return STATUS_NOT_IMPLEMENTED;
 152         }
 153
 154         // calculate position of end markers
 155         NextAttributeOffset = AttrOffset + AttrContext->Record.NonResident.MappingPairsOffset + RunBufferOffset;
 156         NextAttributeOffset = ALIGN_UP_BY(NextAttributeOffset, 8);
 157
 158         // Write the end markers
 159         NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
 160         NextAttribute->Type = AttributeEnd;
 161         NextAttribute->Length = FILE_RECORD_END;
 162
 163         // Update the length
 164         DestinationAttribute->Length = NextAttributeOffset - AttrOffset;
 165         AttrContext->Record.Length = DestinationAttribute->Length;
 166
 167         // We need to increase the FileRecord size
 168         FileRecord->BytesInUse = NextAttributeOffset + (sizeof(ULONG) * 2);
 169     }
 170
 171     // NOTE: from this point on the original attribute record will contain invalid data in it's runbuffer
 172     // TODO: Elegant fix? Could we free the old Record and allocate a new one without issue?
 173
 174     // Update HighestVCN
 175     DestinationAttribute->NonResident.HighestVCN =
 176     AttrContext->Record.NonResident.HighestVCN = max(NextVBN - 1 + RunLength,
 177                                                      AttrContext->Record.NonResident.HighestVCN);
 178
 179     // Write data runs to destination attribute
 180     RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
 181                   RunBuffer,
 182                   RunBufferOffset);
 183
 184     // Update the file record
 185     Status = UpdateFileRecord(Vcb, AttrContext->FileMFTIndex, FileRecord);
 186
 187     ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 188     FsRtlUninitializeLargeMcb(&DataRunsMCB);
 189
 190     NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
 191
 192     return Status;
 193 }
 194
 195 /**
 196 * @name ConvertDataRunsToLargeMCB
 197 * @implemented
 198 *
 199 * Converts binary data runs to a map control block.
 200 *
 201 * @param DataRun
 202 * Pointer to the run data
 203 *
 204 * @param DataRunsMCB
 205 * Pointer to an unitialized LARGE_MCB structure.
 206 *
 207 * @return
 208 * STATUS_SUCCESS on success, STATUS_INSUFFICIENT_RESOURCES or STATUS_UNSUCCESSFUL if we fail to
 209 * initialize the mcb or add an entry.
 210 *
 211 * @remarks
 212 * Initializes the LARGE_MCB pointed to by DataRunsMCB. If this function succeeds, you
 213 * need to call FsRtlUninitializeLargeMcb() when you're done with DataRunsMCB. This
 214 * function will ensure the LargeMCB has been unitialized in case of failure.
 215 *
 216 */
 217 NTSTATUS
 218 ConvertDataRunsToLargeMCB(PUCHAR DataRun,
 219                           PLARGE_MCB DataRunsMCB,
 220                           PULONGLONG pNextVBN)
 221 {
 222     LONGLONG  DataRunOffset;
 223     ULONGLONG DataRunLength;
 224     LONGLONG  DataRunStartLCN;
 225     ULONGLONG LastLCN = 0;
 226
 227     // Initialize the MCB, potentially catch an exception
 228     _SEH2_TRY{
 229         FsRtlInitializeLargeMcb(DataRunsMCB, NonPagedPool);
 230     } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {
 231         _SEH2_YIELD(return _SEH2_GetExceptionCode());
 232     } _SEH2_END;
 233
 234     while (*DataRun != 0)
 235     {
 236         DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 237
 238         if (DataRunOffset != -1)
 239         {
 240             // Normal data run.
 241             DataRunStartLCN = LastLCN + DataRunOffset;
 242             LastLCN = DataRunStartLCN;
 243
 244             _SEH2_TRY{
 245                 if (!FsRtlAddLargeMcbEntry(DataRunsMCB,
 246                                            *pNextVBN,
 247                                            DataRunStartLCN,
 248                                            DataRunLength))
 249                 {
 250                     ExRaiseStatus(STATUS_UNSUCCESSFUL);
 251                 }
 252             } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {
 253                 FsRtlUninitializeLargeMcb(DataRunsMCB);
 254                 _SEH2_YIELD(return _SEH2_GetExceptionCode());
 255             } _SEH2_END;
 256
 257         }
 258
 259         *pNextVBN += DataRunLength;
 260     }
 261
 262     return STATUS_SUCCESS;
 263 }
 264
 265 /**
 266 * @name ConvertLargeMCBToDataRuns
 267 * @implemented
 268 *
 269 * Converts a map control block to a series of encoded data runs (used by non-resident attributes).
 270 *
 271 * @param DataRunsMCB
 272 * Pointer to a LARGE_MCB structure describing the data runs.
 273 *
 274 * @param RunBuffer
 275 * Pointer to the buffer that will receive the encoded data runs.
 276 *
 277 * @param MaxBufferSize
 278 * Size of RunBuffer, in bytes.
 279 *
 280 * @param UsedBufferSize
 281 * Pointer to a ULONG that will receive the size of the data runs in bytes. Can't be NULL.
 282 *
 283 * @return
 284 * STATUS_SUCCESS on success, STATUS_BUFFER_TOO_SMALL if RunBuffer is too small to contain the
 285 * complete output.
 286 *
 287 */
 288 NTSTATUS
 289 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB,
 290                           PUCHAR RunBuffer,
 291                           ULONG MaxBufferSize,
 292                           PULONG UsedBufferSize)
 293 {
 294     NTSTATUS Status = STATUS_SUCCESS;
 295     ULONG RunBufferOffset = 0;
 296     LONGLONG  DataRunOffset;
 297     ULONGLONG LastLCN = 0;
 298     LONGLONG Vbn, Lbn, Count;
 299     ULONG i;
 300
 301
 302     DPRINT("\t[Vbn, Lbn, Count]\n");
 303
 304     // convert each mcb entry to a data run
 305     for (i = 0; FsRtlGetNextLargeMcbEntry(DataRunsMCB, i, &Vbn, &Lbn, &Count); i++)
 306     {
 307         UCHAR DataRunOffsetSize = 0;
 308         UCHAR DataRunLengthSize = 0;
 309         UCHAR ControlByte = 0;
 310
 311         // [vbn, lbn, count]
 312         DPRINT("\t[%I64d, %I64d,%I64d]\n", Vbn, Lbn, Count);
 313
 314         // TODO: check for holes and convert to sparse runs
 315         DataRunOffset = Lbn - LastLCN;
 316         LastLCN = Lbn;
 317
 318         // now we need to determine how to represent DataRunOffset with the minimum number of bytes
 319         DPRINT("Determining how many bytes needed to represent %I64x\n", DataRunOffset);
 320         DataRunOffsetSize = GetPackedByteCount(DataRunOffset, TRUE);
 321         DPRINT("%d bytes needed.\n", DataRunOffsetSize);
 322
 323         // determine how to represent DataRunLengthSize with the minimum number of bytes
 324         DPRINT("Determining how many bytes needed to represent %I64x\n", Count);
 325         DataRunLengthSize = GetPackedByteCount(Count, TRUE);
 326         DPRINT("%d bytes needed.\n", DataRunLengthSize);
 327
 328         // ensure the next data run + end marker would be > Max buffer size
 329         if (RunBufferOffset + 2 + DataRunLengthSize + DataRunOffsetSize > MaxBufferSize)
 330         {
 331             Status = STATUS_BUFFER_TOO_SMALL;
 332             DPRINT1("FIXME: Ran out of room in buffer for data runs!\n");
 333             break;
 334         }
 335
 336         // pack and copy the control byte
 337         ControlByte = (DataRunOffsetSize << 4) + DataRunLengthSize;
 338         RunBuffer[RunBufferOffset++] = ControlByte;
 339
 340         // copy DataRunLength
 341         RtlCopyMemory(RunBuffer + RunBufferOffset, &Count, DataRunLengthSize);
 342         RunBufferOffset += DataRunLengthSize;
 343
 344         // copy DataRunOffset
 345         RtlCopyMemory(RunBuffer + RunBufferOffset, &DataRunOffset, DataRunOffsetSize);
 346         RunBufferOffset += DataRunOffsetSize;
 347     }
 348
 349     // End of data runs
 350     RunBuffer[RunBufferOffset++] = 0;
 351
 352     *UsedBufferSize = RunBufferOffset;
 353     DPRINT("New Size of DataRuns: %ld\n", *UsedBufferSize);
 354
 355     return Status;
 356 }
 357
 358 PUCHAR
 359 DecodeRun(PUCHAR DataRun,
 360           LONGLONG *DataRunOffset,
 361           ULONGLONG *DataRunLength)
 362 {
 363     UCHAR DataRunOffsetSize;
 364     UCHAR DataRunLengthSize;
 365     CHAR i;
 366
 367     DataRunOffsetSize = (*DataRun >> 4) & 0xF;
 368     DataRunLengthSize = *DataRun & 0xF;
 369     *DataRunOffset = 0;
 370     *DataRunLength = 0;
 371     DataRun++;
 372     for (i = 0; i < DataRunLengthSize; i++)
 373     {
 374         *DataRunLength += ((ULONG64)*DataRun) << (i * 8);
 375         DataRun++;
 376     }
 377
 378     /* NTFS 3+ sparse files */
 379     if (DataRunOffsetSize == 0)
 380     {
 381         *DataRunOffset = -1;
 382     }
 383     else
 384     {
 385         for (i = 0; i < DataRunOffsetSize - 1; i++)
 386         {
 387             *DataRunOffset += ((ULONG64)*DataRun) << (i * 8);
 388             DataRun++;
 389         }
 390         /* The last byte contains sign so we must process it different way. */
 391         *DataRunOffset = ((LONG64)(CHAR)(*(DataRun++)) << (i * 8)) + *DataRunOffset;
 392     }
 393
 394     DPRINT("DataRunOffsetSize: %x\n", DataRunOffsetSize);
 395     DPRINT("DataRunLengthSize: %x\n", DataRunLengthSize);
 396     DPRINT("DataRunOffset: %x\n", *DataRunOffset);
 397     DPRINT("DataRunLength: %x\n", *DataRunLength);
 398
 399     return DataRun;
 400 }
 401
 402 BOOLEAN
 403 FindRun(PNTFS_ATTR_RECORD NresAttr,
 404         ULONGLONG vcn,
 405         PULONGLONG lcn,
 406         PULONGLONG count)
 407 {
 408     if (vcn < NresAttr->NonResident.LowestVCN || vcn > NresAttr->NonResident.HighestVCN)
 409         return FALSE;
 410
 411     DecodeRun((PUCHAR)((ULONG_PTR)NresAttr + NresAttr->NonResident.MappingPairsOffset), (PLONGLONG)lcn, count);
 412
 413     return TRUE;
 414 }
 415
 416 /**
 417 * @name FreeClusters
 418 * @implemented
 419 *
 420 * Shrinks the allocation size of a non-resident attribute by a given number of clusters.
 421 * Frees the clusters from the volume's $BITMAP file as well as the attribute's data runs.
 422 *
 423 * @param Vcb
 424 * Pointer to an NTFS_VCB for the destination volume.
 425 *
 426 * @param AttrContext
 427 * Pointer to an NTFS_ATTR_CONTEXT describing the attribute from which the clusters will be freed.
 428 *
 429 * @param AttrOffset
 430 * Byte offset of the destination attribute relative to its file record.
 431 *
 432 * @param FileRecord
 433 * Pointer to a complete copy of the file record containing the attribute. Must be at least
 434 * Vcb->NtfsInfo.BytesPerFileRecord bytes long.
 435 *
 436 * @param ClustersToFree
 437 * Number of clusters that should be freed from the end of the data stream. Must be no more
 438 * Than the number of clusters assigned to the attribute (HighestVCN + 1).
 439 *
 440 * @return
 441 * STATUS_SUCCESS on success. STATUS_INVALID_PARAMETER if AttrContext describes a resident attribute,
 442 * or if the caller requested more clusters be freed than the attribute has been allocated.
 443 * STATUS_INSUFFICIENT_RESOURCES if allocating a buffer for the data runs fails or
 444 * if ConvertDataRunsToLargeMCB() fails.
 445 * STATUS_BUFFER_TOO_SMALL if ConvertLargeMCBToDataRuns() fails.
 446 *
 447 *
 448 */
 449 NTSTATUS
 450 FreeClusters(PNTFS_VCB Vcb,
 451              PNTFS_ATTR_CONTEXT AttrContext,
 452              ULONG AttrOffset,
 453              PFILE_RECORD_HEADER FileRecord,
 454              ULONG ClustersToFree)
 455 {
 456     NTSTATUS Status = STATUS_SUCCESS;
 457     ULONG ClustersLeftToFree = ClustersToFree;
 458
 459     // convert data runs to mcb
 460     PUCHAR DataRun = (PUCHAR)&AttrContext->Record + AttrContext->Record.NonResident.MappingPairsOffset;
 461     PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
 462     LARGE_MCB DataRunsMCB;
 463     ULONG NextAttributeOffset = AttrOffset + AttrContext->Record.Length;
 464     PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
 465     ULONGLONG NextVBN = AttrContext->Record.NonResident.LowestVCN;
 466
 467     // Allocate some memory for the RunBuffer
 468     PUCHAR RunBuffer;
 469     ULONG RunBufferOffset = 0;
 470
 471     PFILE_RECORD_HEADER BitmapRecord;
 472     PNTFS_ATTR_CONTEXT DataContext;
 473     ULONGLONG BitmapDataSize;
 474     PUCHAR BitmapData;
 475     RTL_BITMAP Bitmap;
 476     ULONG LengthWritten;
 477
 478     if (!AttrContext->Record.IsNonResident)
 479     {
 480         return STATUS_INVALID_PARAMETER;
 481     }
 482
 483     RunBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
 484     if (!RunBuffer)
 485     {
 486         DPRINT1("ERROR: Couldn't allocate memory for data runs!\n");
 487         return STATUS_INSUFFICIENT_RESOURCES;
 488     }
 489
 490     // Convert the data runs to a map control block
 491     Status = ConvertDataRunsToLargeMCB(DataRun, &DataRunsMCB, &NextVBN);
 492     if (!NT_SUCCESS(Status))
 493     {
 494         DPRINT1("Unable to convert data runs to MCB (probably ran out of memory)!\n");
 495         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 496         return Status;
 497     }
 498
 499     BitmapRecord = ExAllocatePoolWithTag(NonPagedPool,
 500                                          Vcb->NtfsInfo.BytesPerFileRecord,
 501                                          TAG_NTFS);
 502     if (BitmapRecord == NULL)
 503     {
 504         DPRINT1("Error: Unable to allocate memory for bitmap file record!\n");
 505         FsRtlUninitializeLargeMcb(&DataRunsMCB);
 506         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 507         return STATUS_NO_MEMORY;
 508     }
 509
 510     Status = ReadFileRecord(Vcb, NTFS_FILE_BITMAP, BitmapRecord);
 511     if (!NT_SUCCESS(Status))
 512     {
 513         DPRINT1("Error: Unable to read file record for bitmap!\n");
 514         FsRtlUninitializeLargeMcb(&DataRunsMCB);
 515         ExFreePoolWithTag(BitmapRecord, TAG_NTFS);
 516         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 517         return 0;
 518     }
 519
 520     Status = FindAttribute(Vcb, BitmapRecord, AttributeData, L"", 0, &DataContext, NULL);
 521     if (!NT_SUCCESS(Status))
 522     {
 523         DPRINT1("Error: Unable to find data attribute for bitmap file!\n");
 524         FsRtlUninitializeLargeMcb(&DataRunsMCB);
 525         ExFreePoolWithTag(BitmapRecord, TAG_NTFS);
 526         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 527         return 0;
 528     }
 529
 530     BitmapDataSize = AttributeDataLength(&DataContext->Record);
 531     BitmapDataSize = min(BitmapDataSize, 0xffffffff);
 532     ASSERT((BitmapDataSize * 8) >= Vcb->NtfsInfo.ClusterCount);
 533     BitmapData = ExAllocatePoolWithTag(NonPagedPool, ROUND_UP(BitmapDataSize, Vcb->NtfsInfo.BytesPerSector), TAG_NTFS);
 534     if (BitmapData == NULL)
 535     {
 536         DPRINT1("Error: Unable to allocate memory for bitmap file data!\n");
 537         ReleaseAttributeContext(DataContext);
 538         FsRtlUninitializeLargeMcb(&DataRunsMCB);
 539         ExFreePoolWithTag(BitmapRecord, TAG_NTFS);
 540         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 541         return 0;
 542     }
 543
 544     ReadAttribute(Vcb, DataContext, 0, (PCHAR)BitmapData, (ULONG)BitmapDataSize);
 545
 546     RtlInitializeBitMap(&Bitmap, (PULONG)BitmapData, Vcb->NtfsInfo.ClusterCount);
 547
 548     // free clusters in $BITMAP file
 549     while (ClustersLeftToFree > 0)
 550     {
 551         LONGLONG LargeVbn, LargeLbn;
 552
 553         if (!FsRtlLookupLastLargeMcbEntry(&DataRunsMCB, &LargeVbn, &LargeLbn))
 554         {
 555             Status = STATUS_INVALID_PARAMETER;
 556             DPRINT1("DRIVER ERROR: FreeClusters called to free %lu clusters, which is %lu more clusters than are assigned to attribute!",
 557                     ClustersToFree,
 558                     ClustersLeftToFree);
 559             break;
 560         }
 561
 562         if( LargeLbn != -1)
 563         {
 564             // deallocate this cluster
 565             RtlClearBits(&Bitmap, LargeLbn, 1);
 566         }
 567         FsRtlTruncateLargeMcb(&DataRunsMCB, AttrContext->Record.NonResident.HighestVCN);
 568         AttrContext->Record.NonResident.HighestVCN = min(AttrContext->Record.NonResident.HighestVCN, AttrContext->Record.NonResident.HighestVCN - 1);
 569         ClustersLeftToFree--;
 570     }
 571
 572     // update $BITMAP file on disk
 573     Status = WriteAttribute(Vcb, DataContext, 0, BitmapData, (ULONG)BitmapDataSize, &LengthWritten);
 574     if (!NT_SUCCESS(Status))
 575     {
 576         ReleaseAttributeContext(DataContext);
 577         FsRtlUninitializeLargeMcb(&DataRunsMCB);
 578         ExFreePoolWithTag(BitmapData, TAG_NTFS);
 579         ExFreePoolWithTag(BitmapRecord, TAG_NTFS);
 580         ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 581         return Status;
 582     }
 583
 584     ReleaseAttributeContext(DataContext);
 585     ExFreePoolWithTag(BitmapData, TAG_NTFS);
 586     ExFreePoolWithTag(BitmapRecord, TAG_NTFS);
 587
 588     // Convert the map control block back to encoded data runs
 589     ConvertLargeMCBToDataRuns(&DataRunsMCB, RunBuffer, Vcb->NtfsInfo.BytesPerCluster, &RunBufferOffset);
 590
 591     // Update HighestVCN
 592     DestinationAttribute->NonResident.HighestVCN = AttrContext->Record.NonResident.HighestVCN;
 593
 594     // Write data runs to destination attribute
 595     RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
 596                   RunBuffer,
 597                   RunBufferOffset);
 598
 599     if (NextAttribute->Type == AttributeEnd)
 600     {
 601         // update attribute length
 602         AttrContext->Record.Length = ALIGN_UP_BY(AttrContext->Record.NonResident.MappingPairsOffset + RunBufferOffset, 8);
 603         DestinationAttribute->Length = AttrContext->Record.Length;
 604
 605         // write end markers
 606         NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)DestinationAttribute + DestinationAttribute->Length);
 607         NextAttribute->Type = AttributeEnd;
 608         NextAttribute->Length = FILE_RECORD_END;
 609
 610         // update file record length
 611         FileRecord->BytesInUse = AttrOffset + DestinationAttribute->Length + (sizeof(ULONG) * 2);
 612     }
 613
 614     // Update the file record
 615     Status = UpdateFileRecord(Vcb, AttrContext->FileMFTIndex, FileRecord);
 616
 617     FsRtlUninitializeLargeMcb(&DataRunsMCB);
 618     ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 619
 620     NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
 621
 622     return Status;
 623 }
 624
 625 static
 626 NTSTATUS
 627 InternalReadNonResidentAttributes(PFIND_ATTR_CONTXT Context)
 628 {
 629     ULONGLONG ListSize;
 630     PNTFS_ATTR_RECORD Attribute;
 631     PNTFS_ATTR_CONTEXT ListContext;
 632
 633     DPRINT("InternalReadNonResidentAttributes(%p)\n", Context);
 634
 635     Attribute = Context->CurrAttr;
 636     ASSERT(Attribute->Type == AttributeAttributeList);
 637
 638     if (Context->OnlyResident)
 639     {
 640         Context->NonResidentStart = NULL;
 641         Context->NonResidentEnd = NULL;
 642         return STATUS_SUCCESS;
 643     }
 644
 645     if (Context->NonResidentStart != NULL)
 646     {
 647         return STATUS_FILE_CORRUPT_ERROR;
 648     }
 649
 650     ListContext = PrepareAttributeContext(Attribute);
 651     ListSize = AttributeDataLength(&ListContext->Record);
 652     if (ListSize > 0xFFFFFFFF)
 653     {
 654         ReleaseAttributeContext(ListContext);
 655         return STATUS_BUFFER_OVERFLOW;
 656     }
 657
 658     Context->NonResidentStart = ExAllocatePoolWithTag(NonPagedPool, (ULONG)ListSize, TAG_NTFS);
 659     if (Context->NonResidentStart == NULL)
 660     {
 661         ReleaseAttributeContext(ListContext);
 662         return STATUS_INSUFFICIENT_RESOURCES;
 663     }
 664
 665     if (ReadAttribute(Context->Vcb, ListContext, 0, (PCHAR)Context->NonResidentStart, (ULONG)ListSize) != ListSize)
 666     {
 667         ExFreePoolWithTag(Context->NonResidentStart, TAG_NTFS);
 668         Context->NonResidentStart = NULL;
 669         ReleaseAttributeContext(ListContext);
 670         return STATUS_FILE_CORRUPT_ERROR;
 671     }
 672
 673     ReleaseAttributeContext(ListContext);
 674     Context->NonResidentEnd = (PNTFS_ATTR_RECORD)((PCHAR)Context->NonResidentStart + ListSize);
 675     return STATUS_SUCCESS;
 676 }
 677
 678 static
 679 PNTFS_ATTR_RECORD
 680 InternalGetNextAttribute(PFIND_ATTR_CONTXT Context)
 681 {
 682     PNTFS_ATTR_RECORD NextAttribute;
 683
 684     if (Context->CurrAttr == (PVOID)-1)
 685     {
 686         return NULL;
 687     }
 688
 689     if (Context->CurrAttr >= Context->FirstAttr &&
 690         Context->CurrAttr < Context->LastAttr)
 691     {
 692         if (Context->CurrAttr->Length == 0)
 693         {
 694             DPRINT1("Broken length!\n");
 695             Context->CurrAttr = (PVOID)-1;
 696             return NULL;
 697         }
 698
 699         NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Context->CurrAttr + Context->CurrAttr->Length);
 700
 701         if (NextAttribute > Context->LastAttr || NextAttribute < Context->FirstAttr)
 702         {
 703             DPRINT1("Broken length: 0x%lx!\n", Context->CurrAttr->Length);
 704             Context->CurrAttr = (PVOID)-1;
 705             return NULL;
 706         }
 707
 708         Context->Offset += ((ULONG_PTR)NextAttribute - (ULONG_PTR)Context->CurrAttr);
 709         Context->CurrAttr = NextAttribute;
 710
 711         if (Context->CurrAttr < Context->LastAttr &&
 712             Context->CurrAttr->Type != AttributeEnd)
 713         {
 714             return Context->CurrAttr;
 715         }
 716     }
 717
 718     if (Context->NonResidentStart == NULL)
 719     {
 720         Context->CurrAttr = (PVOID)-1;
 721         return NULL;
 722     }
 723
 724     if (Context->CurrAttr < Context->NonResidentStart ||
 725         Context->CurrAttr >= Context->NonResidentEnd)
 726     {
 727         Context->CurrAttr = Context->NonResidentStart;
 728     }
 729     else if (Context->CurrAttr->Length != 0)
 730     {
 731         NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Context->CurrAttr + Context->CurrAttr->Length);
 732         Context->Offset += ((ULONG_PTR)NextAttribute - (ULONG_PTR)Context->CurrAttr);
 733         Context->CurrAttr = NextAttribute;
 734     }
 735     else
 736     {
 737         DPRINT1("Broken length!\n");
 738         Context->CurrAttr = (PVOID)-1;
 739         return NULL;
 740     }
 741
 742     if (Context->CurrAttr < Context->NonResidentEnd &&
 743         Context->CurrAttr->Type != AttributeEnd)
 744     {
 745         return Context->CurrAttr;
 746     }
 747
 748     Context->CurrAttr = (PVOID)-1;
 749     return NULL;
 750 }
 751
 752 NTSTATUS
 753 FindFirstAttribute(PFIND_ATTR_CONTXT Context,
 754                    PDEVICE_EXTENSION Vcb,
 755                    PFILE_RECORD_HEADER FileRecord,
 756                    BOOLEAN OnlyResident,
 757                    PNTFS_ATTR_RECORD * Attribute)
 758 {
 759     NTSTATUS Status;
 760
 761     DPRINT("FindFistAttribute(%p, %p, %p, %p, %u, %p)\n", Context, Vcb, FileRecord, OnlyResident, Attribute);
 762
 763     Context->Vcb = Vcb;
 764     Context->OnlyResident = OnlyResident;
 765     Context->FirstAttr = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->AttributeOffset);
 766     Context->CurrAttr = Context->FirstAttr;
 767     Context->LastAttr = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->BytesInUse);
 768     Context->NonResidentStart = NULL;
 769     Context->NonResidentEnd = NULL;
 770     Context->Offset = FileRecord->AttributeOffset;
 771
 772     if (Context->FirstAttr->Type == AttributeEnd)
 773     {
 774         Context->CurrAttr = (PVOID)-1;
 775         return STATUS_END_OF_FILE;
 776     }
 777     else if (Context->FirstAttr->Type == AttributeAttributeList)
 778     {
 779         Status = InternalReadNonResidentAttributes(Context);
 780         if (!NT_SUCCESS(Status))
 781         {
 782             return Status;
 783         }
 784
 785         *Attribute = InternalGetNextAttribute(Context);
 786         if (*Attribute == NULL)
 787         {
 788             return STATUS_END_OF_FILE;
 789         }
 790     }
 791     else
 792     {
 793         *Attribute = Context->CurrAttr;
 794         Context->Offset = (UCHAR*)Context->CurrAttr - (UCHAR*)FileRecord;
 795     }
 796
 797     return STATUS_SUCCESS;
 798 }
 799
 800 NTSTATUS
 801 FindNextAttribute(PFIND_ATTR_CONTXT Context,
 802                   PNTFS_ATTR_RECORD * Attribute)
 803 {
 804     NTSTATUS Status;
 805
 806     DPRINT("FindNextAttribute(%p, %p)\n", Context, Attribute);
 807
 808     *Attribute = InternalGetNextAttribute(Context);
 809     if (*Attribute == NULL)
 810     {
 811         return STATUS_END_OF_FILE;
 812     }
 813
 814     if (Context->CurrAttr->Type != AttributeAttributeList)
 815     {
 816         return STATUS_SUCCESS;
 817     }
 818
 819     Status = InternalReadNonResidentAttributes(Context);
 820     if (!NT_SUCCESS(Status))
 821     {
 822         return Status;
 823     }
 824
 825     *Attribute = InternalGetNextAttribute(Context);
 826     if (*Attribute == NULL)
 827     {
 828         return STATUS_END_OF_FILE;
 829     }
 830
 831     return STATUS_SUCCESS;
 832 }
 833
 834 VOID
 835 FindCloseAttribute(PFIND_ATTR_CONTXT Context)
 836 {
 837     if (Context->NonResidentStart != NULL)
 838     {
 839         ExFreePoolWithTag(Context->NonResidentStart, TAG_NTFS);
 840         Context->NonResidentStart = NULL;
 841     }
 842 }
 843
 844 static
 845 VOID
 846 NtfsDumpFileNameAttribute(PNTFS_ATTR_RECORD Attribute)
 847 {
 848     PFILENAME_ATTRIBUTE FileNameAttr;
 849
 850     DbgPrint("  $FILE_NAME ");
 851
 852 //    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 853
 854     FileNameAttr = (PFILENAME_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
 855     DbgPrint(" (%x) '%.*S' ", FileNameAttr->NameType, FileNameAttr->NameLength, FileNameAttr->Name);
 856     DbgPrint(" '%x' \n", FileNameAttr->FileAttributes);
 857     DbgPrint(" AllocatedSize: %I64u\nDataSize: %I64u\n", FileNameAttr->AllocatedSize, FileNameAttr->DataSize);
 858 }
 859
 860
 861 static
 862 VOID
 863 NtfsDumpStandardInformationAttribute(PNTFS_ATTR_RECORD Attribute)
 864 {
 865     PSTANDARD_INFORMATION StandardInfoAttr;
 866
 867     DbgPrint("  $STANDARD_INFORMATION ");
 868
 869 //    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 870
 871     StandardInfoAttr = (PSTANDARD_INFORMATION)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
 872     DbgPrint(" '%x' ", StandardInfoAttr->FileAttribute);
 873 }
 874
 875
 876 static
 877 VOID
 878 NtfsDumpVolumeNameAttribute(PNTFS_ATTR_RECORD Attribute)
 879 {
 880     PWCHAR VolumeName;
 881
 882     DbgPrint("  $VOLUME_NAME ");
 883
 884 //    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 885
 886     VolumeName = (PWCHAR)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
 887     DbgPrint(" '%.*S' ", Attribute->Resident.ValueLength / sizeof(WCHAR), VolumeName);
 888 }
 889
 890
 891 static
 892 VOID
 893 NtfsDumpVolumeInformationAttribute(PNTFS_ATTR_RECORD Attribute)
 894 {
 895     PVOLINFO_ATTRIBUTE VolInfoAttr;
 896
 897     DbgPrint("  $VOLUME_INFORMATION ");
 898
 899 //    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 900
 901     VolInfoAttr = (PVOLINFO_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
 902     DbgPrint(" NTFS Version %u.%u  Flags 0x%04hx ",
 903              VolInfoAttr->MajorVersion,
 904              VolInfoAttr->MinorVersion,
 905              VolInfoAttr->Flags);
 906 }
 907
 908
 909 static
 910 VOID
 911 NtfsDumpIndexRootAttribute(PNTFS_ATTR_RECORD Attribute)
 912 {
 913     PINDEX_ROOT_ATTRIBUTE IndexRootAttr;
 914
 915     IndexRootAttr = (PINDEX_ROOT_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
 916
 917     if (IndexRootAttr->AttributeType == AttributeFileName)
 918         ASSERT(IndexRootAttr->CollationRule == COLLATION_FILE_NAME);
 919
 920     DbgPrint("  $INDEX_ROOT (%uB, %u) ", IndexRootAttr->SizeOfEntry, IndexRootAttr->ClustersPerIndexRecord);
 921
 922     if (IndexRootAttr->Header.Flags == INDEX_ROOT_SMALL)
 923     {
 924         DbgPrint(" (small) ");
 925     }
 926     else
 927     {
 928         ASSERT(IndexRootAttr->Header.Flags == INDEX_ROOT_LARGE);
 929         DbgPrint(" (large) ");
 930     }
 931 }
 932
 933
 934 static
 935 VOID
 936 NtfsDumpAttribute(PDEVICE_EXTENSION Vcb,
 937                   PNTFS_ATTR_RECORD Attribute)
 938 {
 939     UNICODE_STRING Name;
 940
 941     ULONGLONG lcn = 0;
 942     ULONGLONG runcount = 0;
 943
 944     switch (Attribute->Type)
 945     {
 946         case AttributeFileName:
 947             NtfsDumpFileNameAttribute(Attribute);
 948             break;
 949
 950         case AttributeStandardInformation:
 951             NtfsDumpStandardInformationAttribute(Attribute);
 952             break;
 953
 954         case AttributeObjectId:
 955             DbgPrint("  $OBJECT_ID ");
 956             break;
 957
 958         case AttributeSecurityDescriptor:
 959             DbgPrint("  $SECURITY_DESCRIPTOR ");
 960             break;
 961
 962         case AttributeVolumeName:
 963             NtfsDumpVolumeNameAttribute(Attribute);
 964             break;
 965
 966         case AttributeVolumeInformation:
 967             NtfsDumpVolumeInformationAttribute(Attribute);
 968             break;
 969
 970         case AttributeData:
 971             DbgPrint("  $DATA ");
 972             //DataBuf = ExAllocatePool(NonPagedPool,AttributeLengthAllocated(Attribute));
 973             break;
 974
 975         case AttributeIndexRoot:
 976             NtfsDumpIndexRootAttribute(Attribute);
 977             break;
 978
 979         case AttributeIndexAllocation:
 980             DbgPrint("  $INDEX_ALLOCATION ");
 981             break;
 982
 983         case AttributeBitmap:
 984             DbgPrint("  $BITMAP ");
 985             break;
 986
 987         case AttributeReparsePoint:
 988             DbgPrint("  $REPARSE_POINT ");
 989             break;
 990
 991         case AttributeEAInformation:
 992             DbgPrint("  $EA_INFORMATION ");
 993             break;
 994
 995         case AttributeEA:
 996             DbgPrint("  $EA ");
 997             break;
 998
 999         case AttributePropertySet:
1000             DbgPrint("  $PROPERTY_SET ");
1001             break;
1002
1003         case AttributeLoggedUtilityStream:
1004             DbgPrint("  $LOGGED_UTILITY_STREAM ");
1005             break;
1006
1007         default:
1008             DbgPrint("  Attribute %lx ",
1009                      Attribute->Type);
1010             break;
1011     }
1012
1013     if (Attribute->Type != AttributeAttributeList)
1014     {
1015         if (Attribute->NameLength != 0)
1016         {
1017             Name.Length = Attribute->NameLength * sizeof(WCHAR);
1018             Name.MaximumLength = Name.Length;
1019             Name.Buffer = (PWCHAR)((ULONG_PTR)Attribute + Attribute->NameOffset);
1020
1021             DbgPrint("'%wZ' ", &Name);
1022         }
1023
1024         DbgPrint("(%s)\n",
1025                  Attribute->IsNonResident ? "non-resident" : "resident");
1026
1027         if (Attribute->IsNonResident)
1028         {
1029             FindRun(Attribute,0,&lcn, &runcount);
1030
1031             DbgPrint("  AllocatedSize %I64u  DataSize %I64u InitilizedSize %I64u\n",
1032                      Attribute->NonResident.AllocatedSize, Attribute->NonResident.DataSize, Attribute->NonResident.InitializedSize);
1033             DbgPrint("  logical clusters: %I64u - %I64u\n",
1034                      lcn, lcn + runcount - 1);
1035         }
1036         else
1037             DbgPrint("    %u bytes of data\n", Attribute->Resident.ValueLength);
1038     }
1039 }
1040
1041
1042 VOID NtfsDumpDataRunData(PUCHAR DataRun)
1043 {
1044     UCHAR DataRunOffsetSize;
1045     UCHAR DataRunLengthSize;
1046     CHAR i;
1047
1048     DbgPrint("%02x ", *DataRun);
1049
1050     if (*DataRun == 0)
1051         return;
1052
1053     DataRunOffsetSize = (*DataRun >> 4) & 0xF;
1054     DataRunLengthSize = *DataRun & 0xF;
1055
1056     DataRun++;
1057     for (i = 0; i < DataRunLengthSize; i++)
1058     {
1059         DbgPrint("%02x ", *DataRun);
1060         DataRun++;
1061     }
1062
1063     for (i = 0; i < DataRunOffsetSize; i++)
1064     {
1065         DbgPrint("%02x ", *DataRun);
1066         DataRun++;
1067     }
1068
1069     NtfsDumpDataRunData(DataRun);
1070 }
1071
1072
1073 VOID
1074 NtfsDumpDataRuns(PVOID StartOfRun,
1075                  ULONGLONG CurrentLCN)
1076 {
1077     PUCHAR DataRun = StartOfRun;
1078     LONGLONG DataRunOffset;
1079     ULONGLONG DataRunLength;
1080
1081     if (CurrentLCN == 0)
1082     {
1083         DPRINT1("Dumping data runs.\n\tData:\n\t\t");
1084         NtfsDumpDataRunData(StartOfRun);
1085         DbgPrint("\n\tRuns:\n\t\tOff\t\tLCN\t\tLength\n");
1086     }
1087
1088     DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1089
1090     if (DataRunOffset != -1)
1091         CurrentLCN += DataRunOffset;
1092
1093     DbgPrint("\t\t%I64d\t", DataRunOffset);
1094     if (DataRunOffset < 99999)
1095         DbgPrint("\t");
1096     DbgPrint("%I64u\t", CurrentLCN);
1097     if (CurrentLCN < 99999)
1098         DbgPrint("\t");
1099     DbgPrint("%I64u\n", DataRunLength);
1100
1101     if (*DataRun == 0)
1102         DbgPrint("\t\t00\n");
1103     else
1104         NtfsDumpDataRuns(DataRun, CurrentLCN);
1105 }
1106
1107
1108 VOID
1109 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb,
1110                        PFILE_RECORD_HEADER FileRecord)
1111 {
1112     NTSTATUS Status;
1113     FIND_ATTR_CONTXT Context;
1114     PNTFS_ATTR_RECORD Attribute;
1115
1116     Status = FindFirstAttribute(&Context, Vcb, FileRecord, FALSE, &Attribute);
1117     while (NT_SUCCESS(Status))
1118     {
1119         NtfsDumpAttribute(Vcb, Attribute);
1120
1121         Status = FindNextAttribute(&Context, &Attribute);
1122     }
1123
1124     FindCloseAttribute(&Context);
1125 }
1126
1127 PFILENAME_ATTRIBUTE
1128 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb,
1129                       PFILE_RECORD_HEADER FileRecord,
1130                       UCHAR NameType)
1131 {
1132     FIND_ATTR_CONTXT Context;
1133     PNTFS_ATTR_RECORD Attribute;
1134     PFILENAME_ATTRIBUTE Name;
1135     NTSTATUS Status;
1136
1137     Status = FindFirstAttribute(&Context, Vcb, FileRecord, FALSE, &Attribute);
1138     while (NT_SUCCESS(Status))
1139     {
1140         if (Attribute->Type == AttributeFileName)
1141         {
1142             Name = (PFILENAME_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
1143             if (Name->NameType == NameType ||
1144                 (Name->NameType == NTFS_FILE_NAME_WIN32_AND_DOS && NameType == NTFS_FILE_NAME_WIN32) ||
1145                 (Name->NameType == NTFS_FILE_NAME_WIN32_AND_DOS && NameType == NTFS_FILE_NAME_DOS))
1146             {
1147                 FindCloseAttribute(&Context);
1148                 return Name;
1149             }
1150         }
1151
1152         Status = FindNextAttribute(&Context, &Attribute);
1153     }
1154
1155     FindCloseAttribute(&Context);
1156     return NULL;
1157 }
1158
1159 /**
1160 * GetPackedByteCount
1161 * Returns the minimum number of bytes needed to represent the value of a
1162 * 64-bit number. Used to encode data runs.
1163 */
1164 UCHAR
1165 GetPackedByteCount(LONGLONG NumberToPack,
1166                    BOOLEAN IsSigned)
1167 {
1168     int bytes = 0;
1169     if (!IsSigned)
1170     {
1171         if (NumberToPack >= 0x0100000000000000)
1172             return 8;
1173         if (NumberToPack >= 0x0001000000000000)
1174             return 7;
1175         if (NumberToPack >= 0x0000010000000000)
1176             return 6;
1177         if (NumberToPack >= 0x0000000100000000)
1178             return 5;
1179         if (NumberToPack >= 0x0000000001000000)
1180             return 4;
1181         if (NumberToPack >= 0x0000000000010000)
1182             return 3;
1183         if (NumberToPack >= 0x0000000000000100)
1184             return 2;
1185         return 1;
1186     }
1187
1188     if (NumberToPack > 0)
1189     {
1190         // we have to make sure the number that gets encoded won't be interpreted as negative
1191         if (NumberToPack >= 0x0080000000000000)
1192             return 8;
1193         if (NumberToPack >= 0x0000800000000000)
1194             return 7;
1195         if (NumberToPack >= 0x0000008000000000)
1196             return 6;
1197         if (NumberToPack >= 0x0000000080000000)
1198             return 5;
1199         if (NumberToPack >= 0x0000000000800000)
1200             return 4;
1201         if (NumberToPack >= 0x0000000000008000)
1202             return 3;
1203         if (NumberToPack >= 0x0000000000000080)
1204             return 2;
1205         return 1;
1206     }
1207     else
1208     {
1209         // negative number
1210         if (NumberToPack <= 0xff80000000000000)
1211             return 8;
1212         if (NumberToPack <= 0xffff800000000000)
1213             return 7;
1214         if (NumberToPack <= 0xffffff8000000000)
1215             return 6;
1216         if (NumberToPack <= 0xffffffff80000000)
1217             return 5;
1218         if (NumberToPack <= 0xffffffffff800000)
1219             return 4;
1220         if (NumberToPack <= 0xffffffffffff8000)
1221             return 3;
1222         if (NumberToPack <= 0xffffffffffffff80)
1223             return 2;
1224         return 1;
1225     }
1226     return bytes;
1227 }
1228
1229 NTSTATUS
1230 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_RECORD Attribute, PULONGLONG LastCluster)
1231 {
1232     LONGLONG DataRunOffset;
1233     ULONGLONG DataRunLength;
1234     LONGLONG DataRunStartLCN;
1235
1236     ULONGLONG LastLCN = 0;
1237     PUCHAR DataRun = (PUCHAR)Attribute + Attribute->NonResident.MappingPairsOffset;
1238
1239     if (!Attribute->IsNonResident)
1240         return STATUS_INVALID_PARAMETER;
1241
1242     while (1)
1243     {
1244         DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1245
1246         if (DataRunOffset != -1)
1247         {
1248             // Normal data run.
1249             DataRunStartLCN = LastLCN + DataRunOffset;
1250             LastLCN = DataRunStartLCN;
1251             *LastCluster = LastLCN + DataRunLength - 1;
1252         }
1253
1254         if (*DataRun == 0)
1255             break;
1256     }
1257
1258     return STATUS_SUCCESS;
1259 }
1260
1261 PSTANDARD_INFORMATION
1262 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb,
1263                                  PFILE_RECORD_HEADER FileRecord)
1264 {
1265     NTSTATUS Status;
1266     FIND_ATTR_CONTXT Context;
1267     PNTFS_ATTR_RECORD Attribute;
1268     PSTANDARD_INFORMATION StdInfo;
1269
1270     Status = FindFirstAttribute(&Context, Vcb, FileRecord, FALSE, &Attribute);
1271     while (NT_SUCCESS(Status))
1272     {
1273         if (Attribute->Type == AttributeStandardInformation)
1274         {
1275             StdInfo = (PSTANDARD_INFORMATION)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
1276             FindCloseAttribute(&Context);
1277             return StdInfo;
1278         }
1279
1280         Status = FindNextAttribute(&Context, &Attribute);
1281     }
1282
1283     FindCloseAttribute(&Context);
1284     return NULL;
1285 }
1286
1287 PFILENAME_ATTRIBUTE
1288 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb,
1289                           PFILE_RECORD_HEADER FileRecord)
1290 {
1291     PFILENAME_ATTRIBUTE FileName;
1292
1293     FileName = GetFileNameFromRecord(Vcb, FileRecord, NTFS_FILE_NAME_POSIX);
1294     if (FileName == NULL)
1295     {
1296         FileName = GetFileNameFromRecord(Vcb, FileRecord, NTFS_FILE_NAME_WIN32);
1297         if (FileName == NULL)
1298         {
1299             FileName = GetFileNameFromRecord(Vcb, FileRecord, NTFS_FILE_NAME_DOS);
1300         }
1301     }
1302
1303     return FileName;
1304 }
1305
1306 /* EOF */