8594f79e56c63d2c5ef0d137ddbcd2f0c98efb0c
[reactos.git] / drivers / filesystems / ntfs / mft.c
1 /*
2 * ReactOS kernel
3 * Copyright (C) 2002, 2014 ReactOS Team
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
18 *
19 * COPYRIGHT: See COPYING in the top level directory
20 * PROJECT: ReactOS kernel
21 * FILE: drivers/filesystem/ntfs/mft.c
22 * PURPOSE: NTFS filesystem driver
23 * PROGRAMMERS: Eric Kohl
24 * Valentin Verkhovsky
25 * Pierre Schweitzer (pierre@reactos.org)
26 * Hervé Poussineau (hpoussin@reactos.org)
27 * Trevor Thompson
28 */
29
30 /* INCLUDES *****************************************************************/
31
32 #include "ntfs.h"
33 #include <ntintsafe.h>
34
35 #define NDEBUG
36 #include <debug.h>
37
38 /* FUNCTIONS ****************************************************************/
39
40 PNTFS_ATTR_CONTEXT
41 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
42 {
43 PNTFS_ATTR_CONTEXT Context;
44
45 Context = ExAllocateFromNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList);
46 if(!Context)
47 {
48 DPRINT1("Error: Unable to allocate memory for context!\n");
49 return NULL;
50 }
51
52 // Allocate memory for a copy of the attribute
53 Context->pRecord = ExAllocatePoolWithTag(NonPagedPool, AttrRecord->Length, TAG_NTFS);
54 if(!Context->pRecord)
55 {
56 DPRINT1("Error: Unable to allocate memory for attribute record!\n");
57 ExFreeToNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList, Context);
58 return NULL;
59 }
60
61 // Copy the attribute
62 RtlCopyMemory(Context->pRecord, AttrRecord, AttrRecord->Length);
63
64 if (AttrRecord->IsNonResident)
65 {
66 LONGLONG DataRunOffset;
67 ULONGLONG DataRunLength;
68 ULONGLONG NextVBN = 0;
69 PUCHAR DataRun = (PUCHAR)((ULONG_PTR)Context->pRecord + Context->pRecord->NonResident.MappingPairsOffset);
70
71 Context->CacheRun = DataRun;
72 Context->CacheRunOffset = 0;
73 Context->CacheRun = DecodeRun(Context->CacheRun, &DataRunOffset, &DataRunLength);
74 Context->CacheRunLength = DataRunLength;
75 if (DataRunOffset != -1)
76 {
77 /* Normal run. */
78 Context->CacheRunStartLCN =
79 Context->CacheRunLastLCN = DataRunOffset;
80 }
81 else
82 {
83 /* Sparse run. */
84 Context->CacheRunStartLCN = -1;
85 Context->CacheRunLastLCN = 0;
86 }
87 Context->CacheRunCurrentOffset = 0;
88
89 // Convert the data runs to a map control block
90 if (!NT_SUCCESS(ConvertDataRunsToLargeMCB(DataRun, &Context->DataRunsMCB, &NextVBN)))
91 {
92 DPRINT1("Unable to convert data runs to MCB!\n");
93 ExFreePoolWithTag(Context->pRecord, TAG_NTFS);
94 ExFreeToNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList, Context);
95 return NULL;
96 }
97 }
98
99 return Context;
100 }
101
102
103 VOID
104 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
105 {
106 if (Context->pRecord)
107 {
108 if (Context->pRecord->IsNonResident)
109 {
110 FsRtlUninitializeLargeMcb(&Context->DataRunsMCB);
111 }
112
113 ExFreePoolWithTag(Context->pRecord, TAG_NTFS);
114 }
115
116 ExFreeToNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList, Context);
117 }
118
119
120 /**
121 * @name FindAttribute
122 * @implemented
123 *
124 * Searches a file record for an attribute matching the given type and name.
125 *
126 * @param Offset
127 * Optional pointer to a ULONG that will receive the offset of the found attribute
128 * from the beginning of the record. Can be set to NULL.
129 */
130 NTSTATUS
131 FindAttribute(PDEVICE_EXTENSION Vcb,
132 PFILE_RECORD_HEADER MftRecord,
133 ULONG Type,
134 PCWSTR Name,
135 ULONG NameLength,
136 PNTFS_ATTR_CONTEXT * AttrCtx,
137 PULONG Offset)
138 {
139 BOOLEAN Found;
140 NTSTATUS Status;
141 FIND_ATTR_CONTXT Context;
142 PNTFS_ATTR_RECORD Attribute;
143
144 DPRINT("FindAttribute(%p, %p, 0x%x, %S, %lu, %p, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx, Offset);
145
146 Found = FALSE;
147 Status = FindFirstAttribute(&Context, Vcb, MftRecord, FALSE, &Attribute);
148 while (NT_SUCCESS(Status))
149 {
150 if (Attribute->Type == Type && Attribute->NameLength == NameLength)
151 {
152 if (NameLength != 0)
153 {
154 PWCHAR AttrName;
155
156 AttrName = (PWCHAR)((PCHAR)Attribute + Attribute->NameOffset);
157 DPRINT("%.*S, %.*S\n", Attribute->NameLength, AttrName, NameLength, Name);
158 if (RtlCompareMemory(AttrName, Name, NameLength * sizeof(WCHAR)) == (NameLength * sizeof(WCHAR)))
159 {
160 Found = TRUE;
161 }
162 }
163 else
164 {
165 Found = TRUE;
166 }
167
168 if (Found)
169 {
170 /* Found it, fill up the context and return. */
171 DPRINT("Found context\n");
172 *AttrCtx = PrepareAttributeContext(Attribute);
173
174 (*AttrCtx)->FileMFTIndex = MftRecord->MFTRecordNumber;
175
176 if (Offset != NULL)
177 *Offset = Context.Offset;
178
179 FindCloseAttribute(&Context);
180 return STATUS_SUCCESS;
181 }
182 }
183
184 Status = FindNextAttribute(&Context, &Attribute);
185 }
186
187 FindCloseAttribute(&Context);
188 return STATUS_OBJECT_NAME_NOT_FOUND;
189 }
190
191
192 ULONGLONG
193 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord)
194 {
195 if (AttrRecord->IsNonResident)
196 return AttrRecord->NonResident.AllocatedSize;
197 else
198 return ALIGN_UP_BY(AttrRecord->Resident.ValueLength, ATTR_RECORD_ALIGNMENT);
199 }
200
201
202 ULONGLONG
203 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord)
204 {
205 if (AttrRecord->IsNonResident)
206 return AttrRecord->NonResident.DataSize;
207 else
208 return AttrRecord->Resident.ValueLength;
209 }
210
211 /**
212 * @name IncreaseMftSize
213 * @implemented
214 *
215 * Increases the size of the master file table on a volume, increasing the space available for file records.
216 *
217 * @param Vcb
218 * Pointer to the VCB (DEVICE_EXTENSION) of the target volume.
219 *
220 *
221 * @param CanWait
222 * Boolean indicating if the function is allowed to wait for exclusive access to the master file table.
223 * This will only be relevant if the MFT doesn't have any free file records and needs to be enlarged.
224 *
225 * @return
226 * STATUS_SUCCESS on success.
227 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
228 * STATUS_INVALID_PARAMETER if there was an error reading the Mft's bitmap.
229 * STATUS_CANT_WAIT if CanWait was FALSE and the function could not get immediate, exclusive access to the MFT.
230 *
231 * @remarks
232 * Increases the size of the Master File Table by 64 records. Bitmap entries for the new records are cleared,
233 * and the bitmap is also enlarged if needed. Mimicking Windows' behavior when enlarging the mft is still TODO.
234 * This function will wait for exlusive access to the volume fcb.
235 */
236 NTSTATUS
237 IncreaseMftSize(PDEVICE_EXTENSION Vcb, BOOLEAN CanWait)
238 {
239 PNTFS_ATTR_CONTEXT BitmapContext;
240 LARGE_INTEGER BitmapSize;
241 LARGE_INTEGER DataSize;
242 LONGLONG BitmapSizeDifference;
243 ULONG NewRecords = ATTR_RECORD_ALIGNMENT * 8; // Allocate one new record for every bit of every byte we'll be adding to the bitmap
244 ULONG DataSizeDifference = Vcb->NtfsInfo.BytesPerFileRecord * NewRecords;
245 ULONG BitmapOffset;
246 PUCHAR BitmapBuffer;
247 ULONGLONG BitmapBytes;
248 ULONGLONG NewBitmapSize;
249 ULONGLONG FirstNewMftIndex;
250 ULONG BytesRead;
251 ULONG LengthWritten;
252 PFILE_RECORD_HEADER BlankFileRecord;
253 ULONG i;
254 NTSTATUS Status;
255
256 DPRINT1("IncreaseMftSize(%p, %s)\n", Vcb, CanWait ? "TRUE" : "FALSE");
257
258 // We need exclusive access to the mft while we change its size
259 if (!ExAcquireResourceExclusiveLite(&(Vcb->DirResource), CanWait))
260 {
261 return STATUS_CANT_WAIT;
262 }
263
264 // Create a blank file record that will be used later
265 BlankFileRecord = NtfsCreateEmptyFileRecord(Vcb);
266 if (!BlankFileRecord)
267 {
268 DPRINT1("Error: Unable to create empty file record!\n");
269 return STATUS_INSUFFICIENT_RESOURCES;
270 }
271
272 // Clear the flags (file record is not in use)
273 BlankFileRecord->Flags = 0;
274
275 // Find the bitmap attribute of master file table
276 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
277 if (!NT_SUCCESS(Status))
278 {
279 DPRINT1("ERROR: Couldn't find $BITMAP attribute of Mft!\n");
280 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
281 ExReleaseResourceLite(&(Vcb->DirResource));
282 return Status;
283 }
284
285 // Get size of Bitmap Attribute
286 BitmapSize.QuadPart = AttributeDataLength(BitmapContext->pRecord);
287
288 // Calculate the new mft size
289 DataSize.QuadPart = AttributeDataLength(Vcb->MFTContext->pRecord) + DataSizeDifference;
290
291 // Find the index of the first Mft entry that will be created
292 FirstNewMftIndex = AttributeDataLength(Vcb->MFTContext->pRecord) / Vcb->NtfsInfo.BytesPerFileRecord;
293
294 // Determine how many bytes will make up the bitmap
295 BitmapBytes = DataSize.QuadPart / Vcb->NtfsInfo.BytesPerFileRecord / 8;
296 if ((DataSize.QuadPart / Vcb->NtfsInfo.BytesPerFileRecord) % 8 != 0)
297 BitmapBytes++;
298
299 // Windows will always keep the number of bytes in a bitmap as a multiple of 8, so no bytes are wasted on slack
300 BitmapBytes = ALIGN_UP_BY(BitmapBytes, ATTR_RECORD_ALIGNMENT);
301
302 // Determine how much we need to adjust the bitmap size (it's possible we don't)
303 BitmapSizeDifference = BitmapBytes - BitmapSize.QuadPart;
304 NewBitmapSize = max(BitmapSize.QuadPart + BitmapSizeDifference, BitmapSize.QuadPart);
305
306 // Allocate memory for the bitmap
307 BitmapBuffer = ExAllocatePoolWithTag(NonPagedPool, NewBitmapSize, TAG_NTFS);
308 if (!BitmapBuffer)
309 {
310 DPRINT1("ERROR: Unable to allocate memory for bitmap attribute!\n");
311 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
312 ExReleaseResourceLite(&(Vcb->DirResource));
313 ReleaseAttributeContext(BitmapContext);
314 return STATUS_INSUFFICIENT_RESOURCES;
315 }
316
317 // Zero the bytes we'll be adding
318 RtlZeroMemory(BitmapBuffer, NewBitmapSize);
319
320 // Read the bitmap attribute
321 BytesRead = ReadAttribute(Vcb,
322 BitmapContext,
323 0,
324 (PCHAR)BitmapBuffer,
325 BitmapSize.LowPart);
326 if (BytesRead != BitmapSize.LowPart)
327 {
328 DPRINT1("ERROR: Bytes read != Bitmap size!\n");
329 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
330 ExReleaseResourceLite(&(Vcb->DirResource));
331 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
332 ReleaseAttributeContext(BitmapContext);
333 return STATUS_INVALID_PARAMETER;
334 }
335
336 // Increase the mft size
337 Status = SetNonResidentAttributeDataLength(Vcb, Vcb->MFTContext, Vcb->MftDataOffset, Vcb->MasterFileTable, &DataSize);
338 if (!NT_SUCCESS(Status))
339 {
340 DPRINT1("ERROR: Failed to set size of $MFT data attribute!\n");
341 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
342 ExReleaseResourceLite(&(Vcb->DirResource));
343 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
344 ReleaseAttributeContext(BitmapContext);
345 return Status;
346 }
347
348 // We'll need to find the bitmap again, because its offset will have changed after resizing the data attribute
349 ReleaseAttributeContext(BitmapContext);
350 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, &BitmapOffset);
351 if (!NT_SUCCESS(Status))
352 {
353 DPRINT1("ERROR: Couldn't find $BITMAP attribute of Mft!\n");
354 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
355 ExReleaseResourceLite(&(Vcb->DirResource));
356 return Status;
357 }
358
359 // If the bitmap grew
360 if (BitmapSizeDifference > 0)
361 {
362 // Set the new bitmap size
363 BitmapSize.QuadPart = NewBitmapSize;
364 if (BitmapContext->pRecord->IsNonResident)
365 Status = SetNonResidentAttributeDataLength(Vcb, BitmapContext, BitmapOffset, Vcb->MasterFileTable, &BitmapSize);
366 else
367 Status = SetResidentAttributeDataLength(Vcb, BitmapContext, BitmapOffset, Vcb->MasterFileTable, &BitmapSize);
368
369 if (!NT_SUCCESS(Status))
370 {
371 DPRINT1("ERROR: Failed to set size of bitmap attribute!\n");
372 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
373 ExReleaseResourceLite(&(Vcb->DirResource));
374 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
375 ReleaseAttributeContext(BitmapContext);
376 return Status;
377 }
378 }
379
380 NtfsDumpFileAttributes(Vcb, Vcb->MasterFileTable);
381
382 // Update the file record with the new attribute sizes
383 Status = UpdateFileRecord(Vcb, Vcb->VolumeFcb->MFTIndex, Vcb->MasterFileTable);
384 if (!NT_SUCCESS(Status))
385 {
386 DPRINT1("ERROR: Failed to update $MFT file record!\n");
387 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
388 ExReleaseResourceLite(&(Vcb->DirResource));
389 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
390 ReleaseAttributeContext(BitmapContext);
391 return Status;
392 }
393
394 // Write out the new bitmap
395 Status = WriteAttribute(Vcb, BitmapContext, 0, BitmapBuffer, NewBitmapSize, &LengthWritten, Vcb->MasterFileTable);
396 if (!NT_SUCCESS(Status))
397 {
398 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
399 ExReleaseResourceLite(&(Vcb->DirResource));
400 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
401 ReleaseAttributeContext(BitmapContext);
402 DPRINT1("ERROR: Couldn't write to bitmap attribute of $MFT!\n");
403 return Status;
404 }
405
406 // Create blank records for the new file record entries.
407 for (i = 0; i < NewRecords; i++)
408 {
409 Status = UpdateFileRecord(Vcb, FirstNewMftIndex + i, BlankFileRecord);
410 if (!NT_SUCCESS(Status))
411 {
412 DPRINT1("ERROR: Failed to write blank file record!\n");
413 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
414 ExReleaseResourceLite(&(Vcb->DirResource));
415 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
416 ReleaseAttributeContext(BitmapContext);
417 return Status;
418 }
419 }
420
421 // Update the mft mirror
422 Status = UpdateMftMirror(Vcb);
423
424 // Cleanup
425 ExFreePoolWithTag(BlankFileRecord, TAG_NTFS);
426 ExReleaseResourceLite(&(Vcb->DirResource));
427 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
428 ReleaseAttributeContext(BitmapContext);
429
430 return Status;
431 }
432
433 /**
434 * @name MoveAttributes
435 * @implemented
436 *
437 * Moves a block of attributes to a new location in the file Record. The attribute at FirstAttributeToMove
438 * and every attribute after that will be moved to MoveTo.
439 *
440 * @param DeviceExt
441 * Pointer to the DEVICE_EXTENSION (VCB) of the target volume.
442 *
443 * @param FirstAttributeToMove
444 * Pointer to the first NTFS_ATTR_RECORD that needs to be moved. This pointer must reside within a file record.
445 *
446 * @param FirstAttributeOffset
447 * Offset of FirstAttributeToMove relative to the beginning of the file record.
448 *
449 * @param MoveTo
450 * ULONG_PTR with the memory location that will be the new location of the first attribute being moved.
451 *
452 * @return
453 * The new location of the final attribute (i.e. AttributeEnd marker).
454 */
455 PNTFS_ATTR_RECORD
456 MoveAttributes(PDEVICE_EXTENSION DeviceExt,
457 PNTFS_ATTR_RECORD FirstAttributeToMove,
458 ULONG FirstAttributeOffset,
459 ULONG_PTR MoveTo)
460 {
461 // Get the size of all attributes after this one
462 ULONG MemBlockSize = 0;
463 PNTFS_ATTR_RECORD CurrentAttribute = FirstAttributeToMove;
464 ULONG CurrentOffset = FirstAttributeOffset;
465 PNTFS_ATTR_RECORD FinalAttribute;
466
467 while (CurrentAttribute->Type != AttributeEnd && CurrentOffset < DeviceExt->NtfsInfo.BytesPerFileRecord)
468 {
469 CurrentOffset += CurrentAttribute->Length;
470 MemBlockSize += CurrentAttribute->Length;
471 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
472 }
473
474 FinalAttribute = (PNTFS_ATTR_RECORD)(MoveTo + MemBlockSize);
475 MemBlockSize += sizeof(ULONG) * 2; // Add the AttributeEnd and file record end
476
477 ASSERT(MemBlockSize % ATTR_RECORD_ALIGNMENT == 0);
478
479 // Move the attributes after this one
480 RtlMoveMemory((PCHAR)MoveTo, FirstAttributeToMove, MemBlockSize);
481
482 return FinalAttribute;
483 }
484
485 NTSTATUS
486 InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt,
487 PNTFS_ATTR_CONTEXT AttrContext,
488 PFILE_RECORD_HEADER FileRecord,
489 ULONG AttrOffset,
490 ULONG DataSize)
491 {
492 PNTFS_ATTR_RECORD Destination = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
493 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Destination + Destination->Length);
494 PNTFS_ATTR_RECORD FinalAttribute;
495 ULONG OldAttributeLength = Destination->Length;
496 ULONG NextAttributeOffset;
497
498 DPRINT1("InternalSetResidentAttributeLength( %p, %p, %p, %lu, %lu )\n", DeviceExt, AttrContext, FileRecord, AttrOffset, DataSize);
499
500 ASSERT(!AttrContext->pRecord->IsNonResident);
501
502 // Update ValueLength Field
503 Destination->Resident.ValueLength = DataSize;
504
505 // Calculate the record length and end marker offset
506 Destination->Length = ALIGN_UP_BY(DataSize + AttrContext->pRecord->Resident.ValueOffset, ATTR_RECORD_ALIGNMENT);
507 NextAttributeOffset = AttrOffset + Destination->Length;
508
509 // Ensure NextAttributeOffset is aligned to an 8-byte boundary
510 ASSERT(NextAttributeOffset % ATTR_RECORD_ALIGNMENT == 0);
511
512 // Will the new attribute be larger than the old one?
513 if (Destination->Length > OldAttributeLength)
514 {
515 // Free the old copy of the attribute in the context, as it will be the wrong length
516 ExFreePoolWithTag(AttrContext->pRecord, TAG_NTFS);
517
518 // Create a new copy of the attribute record for the context
519 AttrContext->pRecord = ExAllocatePoolWithTag(NonPagedPool, Destination->Length, TAG_NTFS);
520 if (!AttrContext->pRecord)
521 {
522 DPRINT1("Unable to allocate memory for attribute!\n");
523 return STATUS_INSUFFICIENT_RESOURCES;
524 }
525 RtlZeroMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + OldAttributeLength), Destination->Length - OldAttributeLength);
526 RtlCopyMemory(AttrContext->pRecord, Destination, OldAttributeLength);
527 }
528
529 // Are there attributes after this one that need to be moved?
530 if (NextAttribute->Type != AttributeEnd)
531 {
532 // Move the attributes after this one
533 FinalAttribute = MoveAttributes(DeviceExt, NextAttribute, NextAttributeOffset, (ULONG_PTR)Destination + Destination->Length);
534 }
535 else
536 {
537 // advance to the final "attribute," adjust for the changed length of the attribute we're resizing
538 FinalAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute - OldAttributeLength + Destination->Length);
539 }
540
541 // Update pRecord's length
542 AttrContext->pRecord->Length = Destination->Length;
543 AttrContext->pRecord->Resident.ValueLength = DataSize;
544
545 // set the file record end
546 SetFileRecordEnd(FileRecord, FinalAttribute, FILE_RECORD_END);
547
548 //NtfsDumpFileRecord(DeviceExt, FileRecord);
549
550 return STATUS_SUCCESS;
551 }
552
553 /**
554 * @parameter FileRecord
555 * Pointer to a file record. Must be a full record at least
556 * Fcb->Vcb->NtfsInfo.BytesPerFileRecord bytes large, not just the header.
557 */
558 NTSTATUS
559 SetAttributeDataLength(PFILE_OBJECT FileObject,
560 PNTFS_FCB Fcb,
561 PNTFS_ATTR_CONTEXT AttrContext,
562 ULONG AttrOffset,
563 PFILE_RECORD_HEADER FileRecord,
564 PLARGE_INTEGER DataSize)
565 {
566 NTSTATUS Status = STATUS_SUCCESS;
567
568 DPRINT1("SetAttributeDataLength(%p, %p, %p, %lu, %p, %I64u)\n",
569 FileObject,
570 Fcb,
571 AttrContext,
572 AttrOffset,
573 FileRecord,
574 DataSize->QuadPart);
575
576 // are we truncating the file?
577 if (DataSize->QuadPart < AttributeDataLength(AttrContext->pRecord))
578 {
579 if (!MmCanFileBeTruncated(FileObject->SectionObjectPointer, DataSize))
580 {
581 DPRINT1("Can't truncate a memory-mapped file!\n");
582 return STATUS_USER_MAPPED_FILE;
583 }
584 }
585
586 if (AttrContext->pRecord->IsNonResident)
587 {
588 Status = SetNonResidentAttributeDataLength(Fcb->Vcb,
589 AttrContext,
590 AttrOffset,
591 FileRecord,
592 DataSize);
593 }
594 else
595 {
596 // resident attribute
597 Status = SetResidentAttributeDataLength(Fcb->Vcb,
598 AttrContext,
599 AttrOffset,
600 FileRecord,
601 DataSize);
602 }
603
604 if (!NT_SUCCESS(Status))
605 {
606 DPRINT1("ERROR: Failed to set size of attribute!\n");
607 return Status;
608 }
609
610 //NtfsDumpFileAttributes(Fcb->Vcb, FileRecord);
611
612 // write the updated file record back to disk
613 Status = UpdateFileRecord(Fcb->Vcb, Fcb->MFTIndex, FileRecord);
614
615 if (NT_SUCCESS(Status))
616 {
617 if (AttrContext->pRecord->IsNonResident)
618 Fcb->RFCB.AllocationSize.QuadPart = AttrContext->pRecord->NonResident.AllocatedSize;
619 else
620 Fcb->RFCB.AllocationSize = *DataSize;
621 Fcb->RFCB.FileSize = *DataSize;
622 Fcb->RFCB.ValidDataLength = *DataSize;
623 CcSetFileSizes(FileObject, (PCC_FILE_SIZES)&Fcb->RFCB.AllocationSize);
624 }
625
626 return STATUS_SUCCESS;
627 }
628
629 /**
630 * @name SetFileRecordEnd
631 * @implemented
632 *
633 * This small function sets a new endpoint for the file record. It set's the final
634 * AttrEnd->Type to AttributeEnd and recalculates the bytes used by the file record.
635 *
636 * @param FileRecord
637 * Pointer to the file record whose endpoint (length) will be set.
638 *
639 * @param AttrEnd
640 * Pointer to section of memory that will receive the AttributeEnd marker. This must point
641 * to memory allocated for the FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord).
642 *
643 * @param EndMarker
644 * This value will be written after AttributeEnd but isn't critical at all. When Windows resizes
645 * a file record, it preserves the final ULONG that previously ended the record, even though this
646 * value is (to my knowledge) never used. We emulate this behavior.
647 *
648 */
649 VOID
650 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord,
651 PNTFS_ATTR_RECORD AttrEnd,
652 ULONG EndMarker)
653 {
654 // Ensure AttrEnd is aligned on an 8-byte boundary, relative to FileRecord
655 ASSERT(((ULONG_PTR)AttrEnd - (ULONG_PTR)FileRecord) % ATTR_RECORD_ALIGNMENT == 0);
656
657 // mark the end of attributes
658 AttrEnd->Type = AttributeEnd;
659
660 // Restore the "file-record-end marker." The value is never checked but this behavior is consistent with Win2k3.
661 AttrEnd->Length = EndMarker;
662
663 // recalculate bytes in use
664 FileRecord->BytesInUse = (ULONG_PTR)AttrEnd - (ULONG_PTR)FileRecord + sizeof(ULONG) * 2;
665 }
666
667 /**
668 * @name SetNonResidentAttributeDataLength
669 * @implemented
670 *
671 * Called by SetAttributeDataLength() to set the size of a non-resident attribute. Doesn't update the file record.
672 *
673 * @param Vcb
674 * Pointer to a DEVICE_EXTENSION describing the target disk.
675 *
676 * @param AttrContext
677 * PNTFS_ATTR_CONTEXT describing the location of the attribute whose size is being set.
678 *
679 * @param AttrOffset
680 * Offset, from the beginning of the record, of the attribute being sized.
681 *
682 * @param FileRecord
683 * Pointer to a file record containing the attribute to be resized. Must be a complete file record,
684 * not just the header.
685 *
686 * @param DataSize
687 * Pointer to a LARGE_INTEGER describing the new size of the attribute's data.
688 *
689 * @return
690 * STATUS_SUCCESS on success;
691 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
692 * STATUS_INVALID_PARAMETER if we can't find the last cluster in the data run.
693 *
694 * @remarks
695 * Called by SetAttributeDataLength() and IncreaseMftSize(). Use SetAttributeDataLength() unless you have a good
696 * reason to use this. Doesn't update the file record on disk. Doesn't inform the cache controller of changes with
697 * any associated files. Synchronization is the callers responsibility.
698 */
699 NTSTATUS
700 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
701 PNTFS_ATTR_CONTEXT AttrContext,
702 ULONG AttrOffset,
703 PFILE_RECORD_HEADER FileRecord,
704 PLARGE_INTEGER DataSize)
705 {
706 NTSTATUS Status = STATUS_SUCCESS;
707 ULONG BytesPerCluster = Vcb->NtfsInfo.BytesPerCluster;
708 ULONGLONG AllocationSize = ROUND_UP(DataSize->QuadPart, BytesPerCluster);
709 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
710 ULONG ExistingClusters = AttrContext->pRecord->NonResident.AllocatedSize / BytesPerCluster;
711
712 ASSERT(AttrContext->pRecord->IsNonResident);
713
714 // do we need to increase the allocation size?
715 if (AttrContext->pRecord->NonResident.AllocatedSize < AllocationSize)
716 {
717 ULONG ClustersNeeded = (AllocationSize / BytesPerCluster) - ExistingClusters;
718 LARGE_INTEGER LastClusterInDataRun;
719 ULONG NextAssignedCluster;
720 ULONG AssignedClusters;
721
722 if (ExistingClusters == 0)
723 {
724 LastClusterInDataRun.QuadPart = 0;
725 }
726 else
727 {
728 if (!FsRtlLookupLargeMcbEntry(&AttrContext->DataRunsMCB,
729 (LONGLONG)AttrContext->pRecord->NonResident.HighestVCN,
730 (PLONGLONG)&LastClusterInDataRun.QuadPart,
731 NULL,
732 NULL,
733 NULL,
734 NULL))
735 {
736 DPRINT1("Error looking up final large MCB entry!\n");
737
738 // Most likely, HighestVCN went above the largest mapping
739 DPRINT1("Highest VCN of record: %I64u\n", AttrContext->pRecord->NonResident.HighestVCN);
740 return STATUS_INVALID_PARAMETER;
741 }
742 }
743
744 DPRINT("LastClusterInDataRun: %I64u\n", LastClusterInDataRun.QuadPart);
745 DPRINT("Highest VCN of record: %I64u\n", AttrContext->pRecord->NonResident.HighestVCN);
746
747 while (ClustersNeeded > 0)
748 {
749 Status = NtfsAllocateClusters(Vcb,
750 LastClusterInDataRun.LowPart + 1,
751 ClustersNeeded,
752 &NextAssignedCluster,
753 &AssignedClusters);
754
755 if (!NT_SUCCESS(Status))
756 {
757 DPRINT1("Error: Unable to allocate requested clusters!\n");
758 return Status;
759 }
760
761 // now we need to add the clusters we allocated to the data run
762 Status = AddRun(Vcb, AttrContext, AttrOffset, FileRecord, NextAssignedCluster, AssignedClusters);
763 if (!NT_SUCCESS(Status))
764 {
765 DPRINT1("Error: Unable to add data run!\n");
766 return Status;
767 }
768
769 ClustersNeeded -= AssignedClusters;
770 LastClusterInDataRun.LowPart = NextAssignedCluster + AssignedClusters - 1;
771 }
772 }
773 else if (AttrContext->pRecord->NonResident.AllocatedSize > AllocationSize)
774 {
775 // shrink allocation size
776 ULONG ClustersToFree = ExistingClusters - (AllocationSize / BytesPerCluster);
777 Status = FreeClusters(Vcb, AttrContext, AttrOffset, FileRecord, ClustersToFree);
778 }
779
780 // TODO: is the file compressed, encrypted, or sparse?
781
782 AttrContext->pRecord->NonResident.AllocatedSize = AllocationSize;
783 AttrContext->pRecord->NonResident.DataSize = DataSize->QuadPart;
784 AttrContext->pRecord->NonResident.InitializedSize = DataSize->QuadPart;
785
786 DestinationAttribute->NonResident.AllocatedSize = AllocationSize;
787 DestinationAttribute->NonResident.DataSize = DataSize->QuadPart;
788 DestinationAttribute->NonResident.InitializedSize = DataSize->QuadPart;
789
790 // HighestVCN seems to be set incorrectly somewhere. Apply a hack-fix to reset it.
791 // HACKHACK FIXME: Fix for sparse files; this math won't work in that case.
792 AttrContext->pRecord->NonResident.HighestVCN = ((ULONGLONG)AllocationSize / Vcb->NtfsInfo.BytesPerCluster) - 1;
793 DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
794
795 DPRINT("Allocated Size: %I64u\n", DestinationAttribute->NonResident.AllocatedSize);
796
797 return Status;
798 }
799
800 /**
801 * @name SetResidentAttributeDataLength
802 * @implemented
803 *
804 * Called by SetAttributeDataLength() to set the size of a non-resident attribute. Doesn't update the file record.
805 *
806 * @param Vcb
807 * Pointer to a DEVICE_EXTENSION describing the target disk.
808 *
809 * @param AttrContext
810 * PNTFS_ATTR_CONTEXT describing the location of the attribute whose size is being set.
811 *
812 * @param AttrOffset
813 * Offset, from the beginning of the record, of the attribute being sized.
814 *
815 * @param FileRecord
816 * Pointer to a file record containing the attribute to be resized. Must be a complete file record,
817 * not just the header.
818 *
819 * @param DataSize
820 * Pointer to a LARGE_INTEGER describing the new size of the attribute's data.
821 *
822 * @return
823 * STATUS_SUCCESS on success;
824 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
825 * STATUS_INVALID_PARAMETER if AttrContext describes a non-resident attribute.
826 * STATUS_NOT_IMPLEMENTED if requested to decrease the size of an attribute that isn't the
827 * last attribute listed in the file record.
828 *
829 * @remarks
830 * Called by SetAttributeDataLength() and IncreaseMftSize(). Use SetAttributeDataLength() unless you have a good
831 * reason to use this. Doesn't update the file record on disk. Doesn't inform the cache controller of changes with
832 * any associated files. Synchronization is the callers responsibility.
833 */
834 NTSTATUS
835 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
836 PNTFS_ATTR_CONTEXT AttrContext,
837 ULONG AttrOffset,
838 PFILE_RECORD_HEADER FileRecord,
839 PLARGE_INTEGER DataSize)
840 {
841 NTSTATUS Status;
842
843 // find the next attribute
844 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
845 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((PCHAR)FileRecord + NextAttributeOffset);
846
847 ASSERT(!AttrContext->pRecord->IsNonResident);
848
849 //NtfsDumpFileAttributes(Vcb, FileRecord);
850
851 // Do we need to increase the data length?
852 if (DataSize->QuadPart > AttrContext->pRecord->Resident.ValueLength)
853 {
854 // There's usually padding at the end of a record. Do we need to extend past it?
855 ULONG MaxValueLength = AttrContext->pRecord->Length - AttrContext->pRecord->Resident.ValueOffset;
856 if (MaxValueLength < DataSize->LowPart)
857 {
858 // If this is the last attribute, we could move the end marker to the very end of the file record
859 MaxValueLength += Vcb->NtfsInfo.BytesPerFileRecord - NextAttributeOffset - (sizeof(ULONG) * 2);
860
861 if (MaxValueLength < DataSize->LowPart || NextAttribute->Type != AttributeEnd)
862 {
863 // convert attribute to non-resident
864 PNTFS_ATTR_RECORD Destination = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
865 PNTFS_ATTR_RECORD NewRecord;
866 LARGE_INTEGER AttribDataSize;
867 PVOID AttribData;
868 ULONG NewRecordLength;
869 ULONG EndAttributeOffset;
870 ULONG LengthWritten;
871
872 DPRINT1("Converting attribute to non-resident.\n");
873
874 AttribDataSize.QuadPart = AttrContext->pRecord->Resident.ValueLength;
875
876 // Is there existing data we need to back-up?
877 if (AttribDataSize.QuadPart > 0)
878 {
879 AttribData = ExAllocatePoolWithTag(NonPagedPool, AttribDataSize.QuadPart, TAG_NTFS);
880 if (AttribData == NULL)
881 {
882 DPRINT1("ERROR: Couldn't allocate memory for attribute data. Can't migrate to non-resident!\n");
883 return STATUS_INSUFFICIENT_RESOURCES;
884 }
885
886 // read data to temp buffer
887 Status = ReadAttribute(Vcb, AttrContext, 0, AttribData, AttribDataSize.QuadPart);
888 if (!NT_SUCCESS(Status))
889 {
890 DPRINT1("ERROR: Unable to read attribute before migrating!\n");
891 ExFreePoolWithTag(AttribData, TAG_NTFS);
892 return Status;
893 }
894 }
895
896 // Start by turning this attribute into a 0-length, non-resident attribute, then enlarge it.
897
898 // The size of a 0-length, non-resident attribute will be 0x41 + the size of the attribute name, aligned to an 8-byte boundary
899 NewRecordLength = ALIGN_UP_BY(0x41 + (AttrContext->pRecord->NameLength * sizeof(WCHAR)), ATTR_RECORD_ALIGNMENT);
900
901 // Create a new attribute record that will store the 0-length, non-resident attribute
902 NewRecord = ExAllocatePoolWithTag(NonPagedPool, NewRecordLength, TAG_NTFS);
903
904 // Zero out the NonResident structure
905 RtlZeroMemory(NewRecord, NewRecordLength);
906
907 // Copy the data that's common to both non-resident and resident attributes
908 RtlCopyMemory(NewRecord, AttrContext->pRecord, FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.ValueLength));
909
910 // if there's a name
911 if (AttrContext->pRecord->NameLength != 0)
912 {
913 // copy the name
914 // An attribute name will be located at offset 0x18 for a resident attribute, 0x40 for non-resident
915 RtlCopyMemory((PCHAR)((ULONG_PTR)NewRecord + 0x40),
916 (PCHAR)((ULONG_PTR)AttrContext->pRecord + 0x18),
917 AttrContext->pRecord->NameLength * sizeof(WCHAR));
918 }
919
920 // update the mapping pairs offset, which will be 0x40 (size of a non-resident header) + length in bytes of the name
921 NewRecord->NonResident.MappingPairsOffset = 0x40 + (AttrContext->pRecord->NameLength * sizeof(WCHAR));
922
923 // update the end of the file record
924 // calculate position of end markers (1 byte for empty data run)
925 EndAttributeOffset = AttrOffset + NewRecord->NonResident.MappingPairsOffset + 1;
926 EndAttributeOffset = ALIGN_UP_BY(EndAttributeOffset, ATTR_RECORD_ALIGNMENT);
927
928 // Update the length
929 NewRecord->Length = EndAttributeOffset - AttrOffset;
930
931 ASSERT(NewRecord->Length == NewRecordLength);
932
933 // Copy the new attribute record into the file record
934 RtlCopyMemory(Destination, NewRecord, NewRecord->Length);
935
936 // Update the file record end
937 SetFileRecordEnd(FileRecord,
938 (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + EndAttributeOffset),
939 FILE_RECORD_END);
940
941 // Initialize the MCB, potentially catch an exception
942 _SEH2_TRY
943 {
944 FsRtlInitializeLargeMcb(&AttrContext->DataRunsMCB, NonPagedPool);
945 }
946 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
947 {
948 DPRINT1("Unable to create LargeMcb!\n");
949 if (AttribDataSize.QuadPart > 0)
950 ExFreePoolWithTag(AttribData, TAG_NTFS);
951 _SEH2_YIELD(return _SEH2_GetExceptionCode());
952 } _SEH2_END;
953
954 // Mark the attribute as non-resident (we wait until after we know the LargeMcb was initialized)
955 NewRecord->IsNonResident = Destination->IsNonResident = 1;
956
957 // Update file record on disk
958 Status = UpdateFileRecord(Vcb, AttrContext->FileMFTIndex, FileRecord);
959 if (!NT_SUCCESS(Status))
960 {
961 DPRINT1("ERROR: Couldn't update file record to continue migration!\n");
962 if (AttribDataSize.QuadPart > 0)
963 ExFreePoolWithTag(AttribData, TAG_NTFS);
964 return Status;
965 }
966
967 // Now we need to free the old copy of the attribute record in the context and replace it with the new one
968 ExFreePoolWithTag(AttrContext->pRecord, TAG_NTFS);
969 AttrContext->pRecord = NewRecord;
970
971 // Now we can treat the attribute as non-resident and enlarge it normally
972 Status = SetNonResidentAttributeDataLength(Vcb, AttrContext, AttrOffset, FileRecord, DataSize);
973 if (!NT_SUCCESS(Status))
974 {
975 DPRINT1("ERROR: Unable to migrate resident attribute!\n");
976 if (AttribDataSize.QuadPart > 0)
977 ExFreePoolWithTag(AttribData, TAG_NTFS);
978 return Status;
979 }
980
981 // restore the back-up attribute, if we made one
982 if (AttribDataSize.QuadPart > 0)
983 {
984 Status = WriteAttribute(Vcb, AttrContext, 0, AttribData, AttribDataSize.QuadPart, &LengthWritten, FileRecord);
985 if (!NT_SUCCESS(Status))
986 {
987 DPRINT1("ERROR: Unable to write attribute data to non-resident clusters during migration!\n");
988 // TODO: Reverse migration so no data is lost
989 ExFreePoolWithTag(AttribData, TAG_NTFS);
990 return Status;
991 }
992
993 ExFreePoolWithTag(AttribData, TAG_NTFS);
994 }
995 }
996 }
997 }
998
999 // set the new length of the resident attribute (if we didn't migrate it)
1000 if (!AttrContext->pRecord->IsNonResident)
1001 return InternalSetResidentAttributeLength(Vcb, AttrContext, FileRecord, AttrOffset, DataSize->LowPart);
1002
1003 return STATUS_SUCCESS;
1004 }
1005
1006 ULONG
1007 ReadAttribute(PDEVICE_EXTENSION Vcb,
1008 PNTFS_ATTR_CONTEXT Context,
1009 ULONGLONG Offset,
1010 PCHAR Buffer,
1011 ULONG Length)
1012 {
1013 ULONGLONG LastLCN;
1014 PUCHAR DataRun;
1015 LONGLONG DataRunOffset;
1016 ULONGLONG DataRunLength;
1017 LONGLONG DataRunStartLCN;
1018 ULONGLONG CurrentOffset;
1019 ULONG ReadLength;
1020 ULONG AlreadyRead;
1021 NTSTATUS Status;
1022
1023 //TEMPTEMP
1024 PUCHAR TempBuffer;
1025
1026 if (!Context->pRecord->IsNonResident)
1027 {
1028 // We need to truncate Offset to a ULONG for pointer arithmetic
1029 // The check below should ensure that Offset is well within the range of 32 bits
1030 ULONG LittleOffset = (ULONG)Offset;
1031
1032 // Ensure that offset isn't beyond the end of the attribute
1033 if (Offset > Context->pRecord->Resident.ValueLength)
1034 return 0;
1035 if (Offset + Length > Context->pRecord->Resident.ValueLength)
1036 Length = (ULONG)(Context->pRecord->Resident.ValueLength - Offset);
1037
1038 RtlCopyMemory(Buffer, (PVOID)((ULONG_PTR)Context->pRecord + Context->pRecord->Resident.ValueOffset + LittleOffset), Length);
1039 return Length;
1040 }
1041
1042 /*
1043 * Non-resident attribute
1044 */
1045
1046 /*
1047 * I. Find the corresponding start data run.
1048 */
1049
1050 AlreadyRead = 0;
1051
1052 // FIXME: Cache seems to be non-working. Disable it for now
1053 //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
1054 if (0)
1055 {
1056 DataRun = Context->CacheRun;
1057 LastLCN = Context->CacheRunLastLCN;
1058 DataRunStartLCN = Context->CacheRunStartLCN;
1059 DataRunLength = Context->CacheRunLength;
1060 CurrentOffset = Context->CacheRunCurrentOffset;
1061 }
1062 else
1063 {
1064 //TEMPTEMP
1065 ULONG UsedBufferSize;
1066 TempBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
1067 if (TempBuffer == NULL)
1068 {
1069 return STATUS_INSUFFICIENT_RESOURCES;
1070 }
1071
1072 LastLCN = 0;
1073 CurrentOffset = 0;
1074
1075 // This will be rewritten in the next iteration to just use the DataRuns MCB directly
1076 ConvertLargeMCBToDataRuns(&Context->DataRunsMCB,
1077 TempBuffer,
1078 Vcb->NtfsInfo.BytesPerFileRecord,
1079 &UsedBufferSize);
1080
1081 DataRun = TempBuffer;
1082
1083 while (1)
1084 {
1085 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1086 if (DataRunOffset != -1)
1087 {
1088 /* Normal data run. */
1089 DataRunStartLCN = LastLCN + DataRunOffset;
1090 LastLCN = DataRunStartLCN;
1091 }
1092 else
1093 {
1094 /* Sparse data run. */
1095 DataRunStartLCN = -1;
1096 }
1097
1098 if (Offset >= CurrentOffset &&
1099 Offset < CurrentOffset + (DataRunLength * Vcb->NtfsInfo.BytesPerCluster))
1100 {
1101 break;
1102 }
1103
1104 if (*DataRun == 0)
1105 {
1106 ExFreePoolWithTag(TempBuffer, TAG_NTFS);
1107 return AlreadyRead;
1108 }
1109
1110 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1111 }
1112 }
1113
1114 /*
1115 * II. Go through the run list and read the data
1116 */
1117
1118 ReadLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset), Length);
1119 if (DataRunStartLCN == -1)
1120 {
1121 RtlZeroMemory(Buffer, ReadLength);
1122 Status = STATUS_SUCCESS;
1123 }
1124 else
1125 {
1126 Status = NtfsReadDisk(Vcb->StorageDevice,
1127 DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster + Offset - CurrentOffset,
1128 ReadLength,
1129 Vcb->NtfsInfo.BytesPerSector,
1130 (PVOID)Buffer,
1131 FALSE);
1132 }
1133 if (NT_SUCCESS(Status))
1134 {
1135 Length -= ReadLength;
1136 Buffer += ReadLength;
1137 AlreadyRead += ReadLength;
1138
1139 if (ReadLength == DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset))
1140 {
1141 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1142 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1143 if (DataRunOffset != (ULONGLONG)-1)
1144 {
1145 DataRunStartLCN = LastLCN + DataRunOffset;
1146 LastLCN = DataRunStartLCN;
1147 }
1148 else
1149 DataRunStartLCN = -1;
1150 }
1151
1152 while (Length > 0)
1153 {
1154 ReadLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster, Length);
1155 if (DataRunStartLCN == -1)
1156 RtlZeroMemory(Buffer, ReadLength);
1157 else
1158 {
1159 Status = NtfsReadDisk(Vcb->StorageDevice,
1160 DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster,
1161 ReadLength,
1162 Vcb->NtfsInfo.BytesPerSector,
1163 (PVOID)Buffer,
1164 FALSE);
1165 if (!NT_SUCCESS(Status))
1166 break;
1167 }
1168
1169 Length -= ReadLength;
1170 Buffer += ReadLength;
1171 AlreadyRead += ReadLength;
1172
1173 /* We finished this request, but there still data in this data run. */
1174 if (Length == 0 && ReadLength != DataRunLength * Vcb->NtfsInfo.BytesPerCluster)
1175 break;
1176
1177 /*
1178 * Go to next run in the list.
1179 */
1180
1181 if (*DataRun == 0)
1182 break;
1183 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1184 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1185 if (DataRunOffset != -1)
1186 {
1187 /* Normal data run. */
1188 DataRunStartLCN = LastLCN + DataRunOffset;
1189 LastLCN = DataRunStartLCN;
1190 }
1191 else
1192 {
1193 /* Sparse data run. */
1194 DataRunStartLCN = -1;
1195 }
1196 } /* while */
1197
1198 } /* if Disk */
1199
1200 // TEMPTEMP
1201 if (Context->pRecord->IsNonResident)
1202 ExFreePoolWithTag(TempBuffer, TAG_NTFS);
1203
1204 Context->CacheRun = DataRun;
1205 Context->CacheRunOffset = Offset + AlreadyRead;
1206 Context->CacheRunStartLCN = DataRunStartLCN;
1207 Context->CacheRunLength = DataRunLength;
1208 Context->CacheRunLastLCN = LastLCN;
1209 Context->CacheRunCurrentOffset = CurrentOffset;
1210
1211 return AlreadyRead;
1212 }
1213
1214
1215 /**
1216 * @name WriteAttribute
1217 * @implemented
1218 *
1219 * Writes an NTFS attribute to the disk. It presently borrows a lot of code from ReadAttribute(),
1220 * and it still needs more documentation / cleaning up.
1221 *
1222 * @param Vcb
1223 * Volume Control Block indicating which volume to write the attribute to
1224 *
1225 * @param Context
1226 * Pointer to an NTFS_ATTR_CONTEXT that has information about the attribute
1227 *
1228 * @param Offset
1229 * Offset, in bytes, from the beginning of the attribute indicating where to start
1230 * writing data
1231 *
1232 * @param Buffer
1233 * The data that's being written to the device
1234 *
1235 * @param Length
1236 * How much data will be written, in bytes
1237 *
1238 * @param RealLengthWritten
1239 * Pointer to a ULONG which will receive how much data was written, in bytes
1240 *
1241 * @param FileRecord
1242 * Optional pointer to a FILE_RECORD_HEADER that contains a copy of the file record
1243 * being written to. Can be NULL, in which case the file record will be read from disk.
1244 * If not-null, WriteAttribute() will skip reading from disk, and FileRecord
1245 * will be updated with the newly-written attribute before the function returns.
1246 *
1247 * @return
1248 * STATUS_SUCCESS if successful, an error code otherwise. STATUS_NOT_IMPLEMENTED if
1249 * writing to a sparse file.
1250 *
1251 * @remarks Note that in this context the word "attribute" isn't referring read-only, hidden,
1252 * etc. - the file's data is actually stored in an attribute in NTFS parlance.
1253 *
1254 */
1255
1256 NTSTATUS
1257 WriteAttribute(PDEVICE_EXTENSION Vcb,
1258 PNTFS_ATTR_CONTEXT Context,
1259 ULONGLONG Offset,
1260 const PUCHAR Buffer,
1261 ULONG Length,
1262 PULONG RealLengthWritten,
1263 PFILE_RECORD_HEADER FileRecord)
1264 {
1265 ULONGLONG LastLCN;
1266 PUCHAR DataRun;
1267 LONGLONG DataRunOffset;
1268 ULONGLONG DataRunLength;
1269 LONGLONG DataRunStartLCN;
1270 ULONGLONG CurrentOffset;
1271 ULONG WriteLength;
1272 NTSTATUS Status;
1273 PUCHAR SourceBuffer = Buffer;
1274 LONGLONG StartingOffset;
1275 BOOLEAN FileRecordAllocated = FALSE;
1276
1277 //TEMPTEMP
1278 PUCHAR TempBuffer;
1279
1280
1281 DPRINT("WriteAttribute(%p, %p, %I64u, %p, %lu, %p, %p)\n", Vcb, Context, Offset, Buffer, Length, RealLengthWritten, FileRecord);
1282
1283 *RealLengthWritten = 0;
1284
1285 // is this a resident attribute?
1286 if (!Context->pRecord->IsNonResident)
1287 {
1288 ULONG AttributeOffset;
1289 PNTFS_ATTR_CONTEXT FoundContext;
1290 PNTFS_ATTR_RECORD Destination;
1291
1292 // Ensure requested data is within the bounds of the attribute
1293 ASSERT(Offset + Length <= Context->pRecord->Resident.ValueLength);
1294
1295 if (Offset + Length > Context->pRecord->Resident.ValueLength)
1296 {
1297 DPRINT1("DRIVER ERROR: Attribute is too small!\n");
1298 return STATUS_INVALID_PARAMETER;
1299 }
1300
1301 // Do we need to read the file record?
1302 if (FileRecord == NULL)
1303 {
1304 FileRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
1305 if (!FileRecord)
1306 {
1307 DPRINT1("Error: Couldn't allocate file record!\n");
1308 return STATUS_NO_MEMORY;
1309 }
1310
1311 FileRecordAllocated = TRUE;
1312
1313 // read the file record
1314 ReadFileRecord(Vcb, Context->FileMFTIndex, FileRecord);
1315 }
1316
1317 // find where to write the attribute data to
1318 Status = FindAttribute(Vcb, FileRecord,
1319 Context->pRecord->Type,
1320 (PCWSTR)((ULONG_PTR)Context->pRecord + Context->pRecord->NameOffset),
1321 Context->pRecord->NameLength,
1322 &FoundContext,
1323 &AttributeOffset);
1324
1325 if (!NT_SUCCESS(Status))
1326 {
1327 DPRINT1("ERROR: Couldn't find matching attribute!\n");
1328 if(FileRecordAllocated)
1329 ExFreePoolWithTag(FileRecord, TAG_NTFS);
1330 return Status;
1331 }
1332
1333 Destination = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttributeOffset);
1334
1335 DPRINT("Offset: %I64u, AttributeOffset: %u, ValueOffset: %u\n", Offset, AttributeOffset, Context->pRecord->Resident.ValueLength);
1336
1337 // Will we be writing past the end of the allocated file record?
1338 if (Offset + Length + AttributeOffset + Context->pRecord->Resident.ValueOffset > Vcb->NtfsInfo.BytesPerFileRecord)
1339 {
1340 DPRINT1("DRIVER ERROR: Data being written extends past end of file record!\n");
1341 ReleaseAttributeContext(FoundContext);
1342 if (FileRecordAllocated)
1343 ExFreePoolWithTag(FileRecord, TAG_NTFS);
1344 return STATUS_INVALID_PARAMETER;
1345 }
1346
1347 // copy the data being written into the file record. We cast Offset to ULONG, which is safe because it's range has been verified.
1348 RtlCopyMemory((PCHAR)((ULONG_PTR)Destination + Context->pRecord->Resident.ValueOffset + (ULONG)Offset), Buffer, Length);
1349
1350 Status = UpdateFileRecord(Vcb, Context->FileMFTIndex, FileRecord);
1351
1352 // Update the context's copy of the resident attribute
1353 ASSERT(Context->pRecord->Length == Destination->Length);
1354 RtlCopyMemory((PVOID)Context->pRecord, Destination, Context->pRecord->Length);
1355
1356 ReleaseAttributeContext(FoundContext);
1357 if (FileRecordAllocated)
1358 ExFreePoolWithTag(FileRecord, TAG_NTFS);
1359
1360 if (NT_SUCCESS(Status))
1361 *RealLengthWritten = Length;
1362
1363 return Status;
1364 }
1365
1366 // This is a non-resident attribute.
1367
1368 // I. Find the corresponding start data run.
1369
1370 // FIXME: Cache seems to be non-working. Disable it for now
1371 //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
1372 /*if (0)
1373 {
1374 DataRun = Context->CacheRun;
1375 LastLCN = Context->CacheRunLastLCN;
1376 DataRunStartLCN = Context->CacheRunStartLCN;
1377 DataRunLength = Context->CacheRunLength;
1378 CurrentOffset = Context->CacheRunCurrentOffset;
1379 }
1380 else*/
1381 {
1382 ULONG UsedBufferSize;
1383 LastLCN = 0;
1384 CurrentOffset = 0;
1385
1386 // This will be rewritten in the next iteration to just use the DataRuns MCB directly
1387 TempBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
1388 if (TempBuffer == NULL)
1389 {
1390 return STATUS_INSUFFICIENT_RESOURCES;
1391 }
1392
1393 ConvertLargeMCBToDataRuns(&Context->DataRunsMCB,
1394 TempBuffer,
1395 Vcb->NtfsInfo.BytesPerFileRecord,
1396 &UsedBufferSize);
1397
1398 DataRun = TempBuffer;
1399
1400 while (1)
1401 {
1402 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1403 if (DataRunOffset != -1)
1404 {
1405 // Normal data run.
1406 // DPRINT1("Writing to normal data run, LastLCN %I64u DataRunOffset %I64d\n", LastLCN, DataRunOffset);
1407 DataRunStartLCN = LastLCN + DataRunOffset;
1408 LastLCN = DataRunStartLCN;
1409 }
1410 else
1411 {
1412 // Sparse data run. We can't support writing to sparse files yet
1413 // (it may require increasing the allocation size).
1414 DataRunStartLCN = -1;
1415 DPRINT1("FIXME: Writing to sparse files is not supported yet!\n");
1416 Status = STATUS_NOT_IMPLEMENTED;
1417 goto Cleanup;
1418 }
1419
1420 // Have we reached the data run we're trying to write to?
1421 if (Offset >= CurrentOffset &&
1422 Offset < CurrentOffset + (DataRunLength * Vcb->NtfsInfo.BytesPerCluster))
1423 {
1424 break;
1425 }
1426
1427 if (*DataRun == 0)
1428 {
1429 // We reached the last assigned cluster
1430 // TODO: assign new clusters to the end of the file.
1431 // (Presently, this code will rarely be reached, the write will usually have already failed by now)
1432 // [We can reach here by creating a new file record when the MFT isn't large enough]
1433 DPRINT1("FIXME: Master File Table needs to be enlarged.\n");
1434 Status = STATUS_END_OF_FILE;
1435 goto Cleanup;
1436 }
1437
1438 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1439 }
1440 }
1441
1442 // II. Go through the run list and write the data
1443
1444 /* REVIEWME -- As adapted from NtfsReadAttribute():
1445 We seem to be making a special case for the first applicable data run, but I'm not sure why.
1446 Does it have something to do with (not) caching? Is this strategy equally applicable to writing? */
1447
1448 WriteLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset), Length);
1449
1450 StartingOffset = DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster + Offset - CurrentOffset;
1451
1452 // Write the data to the disk
1453 Status = NtfsWriteDisk(Vcb->StorageDevice,
1454 StartingOffset,
1455 WriteLength,
1456 Vcb->NtfsInfo.BytesPerSector,
1457 (PVOID)SourceBuffer);
1458
1459 // Did the write fail?
1460 if (!NT_SUCCESS(Status))
1461 {
1462 Context->CacheRun = DataRun;
1463 Context->CacheRunOffset = Offset;
1464 Context->CacheRunStartLCN = DataRunStartLCN;
1465 Context->CacheRunLength = DataRunLength;
1466 Context->CacheRunLastLCN = LastLCN;
1467 Context->CacheRunCurrentOffset = CurrentOffset;
1468
1469 goto Cleanup;
1470 }
1471
1472 Length -= WriteLength;
1473 SourceBuffer += WriteLength;
1474 *RealLengthWritten += WriteLength;
1475
1476 // Did we write to the end of the data run?
1477 if (WriteLength == DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset))
1478 {
1479 // Advance to the next data run
1480 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1481 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1482
1483 if (DataRunOffset != (ULONGLONG)-1)
1484 {
1485 DataRunStartLCN = LastLCN + DataRunOffset;
1486 LastLCN = DataRunStartLCN;
1487 }
1488 else
1489 DataRunStartLCN = -1;
1490 }
1491
1492 // Do we have more data to write?
1493 while (Length > 0)
1494 {
1495 // Make sure we don't write past the end of the current data run
1496 WriteLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster, Length);
1497
1498 // Are we dealing with a sparse data run?
1499 if (DataRunStartLCN == -1)
1500 {
1501 DPRINT1("FIXME: Don't know how to write to sparse files yet! (DataRunStartLCN == -1)\n");
1502 Status = STATUS_NOT_IMPLEMENTED;
1503 goto Cleanup;
1504 }
1505 else
1506 {
1507 // write the data to the disk
1508 Status = NtfsWriteDisk(Vcb->StorageDevice,
1509 DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster,
1510 WriteLength,
1511 Vcb->NtfsInfo.BytesPerSector,
1512 (PVOID)SourceBuffer);
1513 if (!NT_SUCCESS(Status))
1514 break;
1515 }
1516
1517 Length -= WriteLength;
1518 SourceBuffer += WriteLength;
1519 *RealLengthWritten += WriteLength;
1520
1521 // We finished this request, but there's still data in this data run.
1522 if (Length == 0 && WriteLength != DataRunLength * Vcb->NtfsInfo.BytesPerCluster)
1523 break;
1524
1525 // Go to next run in the list.
1526
1527 if (*DataRun == 0)
1528 {
1529 // that was the last run
1530 if (Length > 0)
1531 {
1532 // Failed sanity check.
1533 DPRINT1("Encountered EOF before expected!\n");
1534 Status = STATUS_END_OF_FILE;
1535 goto Cleanup;
1536 }
1537
1538 break;
1539 }
1540
1541 // Advance to the next data run
1542 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1543 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1544 if (DataRunOffset != -1)
1545 {
1546 // Normal data run.
1547 DataRunStartLCN = LastLCN + DataRunOffset;
1548 LastLCN = DataRunStartLCN;
1549 }
1550 else
1551 {
1552 // Sparse data run.
1553 DataRunStartLCN = -1;
1554 }
1555 } // end while (Length > 0) [more data to write]
1556
1557 Context->CacheRun = DataRun;
1558 Context->CacheRunOffset = Offset + *RealLengthWritten;
1559 Context->CacheRunStartLCN = DataRunStartLCN;
1560 Context->CacheRunLength = DataRunLength;
1561 Context->CacheRunLastLCN = LastLCN;
1562 Context->CacheRunCurrentOffset = CurrentOffset;
1563
1564 Cleanup:
1565 // TEMPTEMP
1566 if (Context->pRecord->IsNonResident)
1567 ExFreePoolWithTag(TempBuffer, TAG_NTFS);
1568
1569 return Status;
1570 }
1571
1572 NTSTATUS
1573 ReadFileRecord(PDEVICE_EXTENSION Vcb,
1574 ULONGLONG index,
1575 PFILE_RECORD_HEADER file)
1576 {
1577 ULONGLONG BytesRead;
1578
1579 DPRINT("ReadFileRecord(%p, %I64x, %p)\n", Vcb, index, file);
1580
1581 BytesRead = ReadAttribute(Vcb, Vcb->MFTContext, index * Vcb->NtfsInfo.BytesPerFileRecord, (PCHAR)file, Vcb->NtfsInfo.BytesPerFileRecord);
1582 if (BytesRead != Vcb->NtfsInfo.BytesPerFileRecord)
1583 {
1584 DPRINT1("ReadFileRecord failed: %I64u read, %lu expected\n", BytesRead, Vcb->NtfsInfo.BytesPerFileRecord);
1585 return STATUS_PARTIAL_COPY;
1586 }
1587
1588 /* Apply update sequence array fixups. */
1589 DPRINT("Sequence number: %u\n", file->SequenceNumber);
1590 return FixupUpdateSequenceArray(Vcb, &file->Ntfs);
1591 }
1592
1593
1594 /**
1595 * Searches a file's parent directory (given the parent's index in the mft)
1596 * for the given file. Upon finding an index entry for that file, updates
1597 * Data Size and Allocated Size values in the $FILE_NAME attribute of that entry.
1598 *
1599 * (Most of this code was copied from NtfsFindMftRecord)
1600 */
1601 NTSTATUS
1602 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb,
1603 ULONGLONG ParentMFTIndex,
1604 PUNICODE_STRING FileName,
1605 BOOLEAN DirSearch,
1606 ULONGLONG NewDataSize,
1607 ULONGLONG NewAllocationSize,
1608 BOOLEAN CaseSensitive)
1609 {
1610 PFILE_RECORD_HEADER MftRecord;
1611 PNTFS_ATTR_CONTEXT IndexRootCtx;
1612 PINDEX_ROOT_ATTRIBUTE IndexRoot;
1613 PCHAR IndexRecord;
1614 PINDEX_ENTRY_ATTRIBUTE IndexEntry, IndexEntryEnd;
1615 NTSTATUS Status;
1616 ULONG CurrentEntry = 0;
1617
1618 DPRINT("UpdateFileNameRecord(%p, %I64d, %wZ, %s, %I64u, %I64u, %s)\n",
1619 Vcb,
1620 ParentMFTIndex,
1621 FileName,
1622 DirSearch ? "TRUE" : "FALSE",
1623 NewDataSize,
1624 NewAllocationSize,
1625 CaseSensitive ? "TRUE" : "FALSE");
1626
1627 MftRecord = ExAllocatePoolWithTag(NonPagedPool,
1628 Vcb->NtfsInfo.BytesPerFileRecord,
1629 TAG_NTFS);
1630 if (MftRecord == NULL)
1631 {
1632 return STATUS_INSUFFICIENT_RESOURCES;
1633 }
1634
1635 Status = ReadFileRecord(Vcb, ParentMFTIndex, MftRecord);
1636 if (!NT_SUCCESS(Status))
1637 {
1638 ExFreePoolWithTag(MftRecord, TAG_NTFS);
1639 return Status;
1640 }
1641
1642 ASSERT(MftRecord->Ntfs.Type == NRH_FILE_TYPE);
1643 Status = FindAttribute(Vcb, MftRecord, AttributeIndexRoot, L"$I30", 4, &IndexRootCtx, NULL);
1644 if (!NT_SUCCESS(Status))
1645 {
1646 ExFreePoolWithTag(MftRecord, TAG_NTFS);
1647 return Status;
1648 }
1649
1650 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerIndexRecord, TAG_NTFS);
1651 if (IndexRecord == NULL)
1652 {
1653 ReleaseAttributeContext(IndexRootCtx);
1654 ExFreePoolWithTag(MftRecord, TAG_NTFS);
1655 return STATUS_INSUFFICIENT_RESOURCES;
1656 }
1657
1658 Status = ReadAttribute(Vcb, IndexRootCtx, 0, IndexRecord, AttributeDataLength(IndexRootCtx->pRecord));
1659 if (!NT_SUCCESS(Status))
1660 {
1661 DPRINT1("ERROR: Failed to read Index Root!\n");
1662 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
1663 ReleaseAttributeContext(IndexRootCtx);
1664 ExFreePoolWithTag(MftRecord, TAG_NTFS);
1665 }
1666
1667 IndexRoot = (PINDEX_ROOT_ATTRIBUTE)IndexRecord;
1668 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)&IndexRoot->Header + IndexRoot->Header.FirstEntryOffset);
1669 // Index root is always resident.
1670 IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)(IndexRecord + IndexRoot->Header.TotalSizeOfEntries);
1671
1672 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb->NtfsInfo.BytesPerIndexRecord, IndexRoot->SizeOfEntry);
1673
1674 Status = UpdateIndexEntryFileNameSize(Vcb,
1675 MftRecord,
1676 IndexRecord,
1677 IndexRoot->SizeOfEntry,
1678 IndexEntry,
1679 IndexEntryEnd,
1680 FileName,
1681 &CurrentEntry,
1682 &CurrentEntry,
1683 DirSearch,
1684 NewDataSize,
1685 NewAllocationSize,
1686 CaseSensitive);
1687
1688 if (Status == STATUS_PENDING)
1689 {
1690 // we need to write the index root attribute back to disk
1691 ULONG LengthWritten;
1692 Status = WriteAttribute(Vcb, IndexRootCtx, 0, (PUCHAR)IndexRecord, AttributeDataLength(IndexRootCtx->pRecord), &LengthWritten, MftRecord);
1693 if (!NT_SUCCESS(Status))
1694 {
1695 DPRINT1("ERROR: Couldn't update Index Root!\n");
1696 }
1697
1698 }
1699
1700 ReleaseAttributeContext(IndexRootCtx);
1701 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
1702 ExFreePoolWithTag(MftRecord, TAG_NTFS);
1703
1704 return Status;
1705 }
1706
1707 /**
1708 * Recursively searches directory index and applies the size update to the $FILE_NAME attribute of the
1709 * proper index entry.
1710 * (Heavily based on BrowseIndexEntries)
1711 */
1712 NTSTATUS
1713 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb,
1714 PFILE_RECORD_HEADER MftRecord,
1715 PCHAR IndexRecord,
1716 ULONG IndexBlockSize,
1717 PINDEX_ENTRY_ATTRIBUTE FirstEntry,
1718 PINDEX_ENTRY_ATTRIBUTE LastEntry,
1719 PUNICODE_STRING FileName,
1720 PULONG StartEntry,
1721 PULONG CurrentEntry,
1722 BOOLEAN DirSearch,
1723 ULONGLONG NewDataSize,
1724 ULONGLONG NewAllocatedSize,
1725 BOOLEAN CaseSensitive)
1726 {
1727 NTSTATUS Status;
1728 ULONG RecordOffset;
1729 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
1730 PNTFS_ATTR_CONTEXT IndexAllocationCtx;
1731 ULONGLONG IndexAllocationSize;
1732 PINDEX_BUFFER IndexBuffer;
1733
1734 DPRINT("UpdateIndexEntrySize(%p, %p, %p, %lu, %p, %p, %wZ, %lu, %lu, %s, %I64u, %I64u, %s)\n",
1735 Vcb,
1736 MftRecord,
1737 IndexRecord,
1738 IndexBlockSize,
1739 FirstEntry,
1740 LastEntry,
1741 FileName,
1742 *StartEntry,
1743 *CurrentEntry,
1744 DirSearch ? "TRUE" : "FALSE",
1745 NewDataSize,
1746 NewAllocatedSize,
1747 CaseSensitive ? "TRUE" : "FALSE");
1748
1749 // find the index entry responsible for the file we're trying to update
1750 IndexEntry = FirstEntry;
1751 while (IndexEntry < LastEntry &&
1752 !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
1753 {
1754 if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) > NTFS_FILE_FIRST_USER_FILE &&
1755 *CurrentEntry >= *StartEntry &&
1756 IndexEntry->FileName.NameType != NTFS_FILE_NAME_DOS &&
1757 CompareFileName(FileName, IndexEntry, DirSearch, CaseSensitive))
1758 {
1759 *StartEntry = *CurrentEntry;
1760 IndexEntry->FileName.DataSize = NewDataSize;
1761 IndexEntry->FileName.AllocatedSize = NewAllocatedSize;
1762 // indicate that the caller will still need to write the structure to the disk
1763 return STATUS_PENDING;
1764 }
1765
1766 (*CurrentEntry) += 1;
1767 ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
1768 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
1769 }
1770
1771 /* If we're already browsing a subnode */
1772 if (IndexRecord == NULL)
1773 {
1774 return STATUS_OBJECT_PATH_NOT_FOUND;
1775 }
1776
1777 /* If there's no subnode */
1778 if (!(IndexEntry->Flags & NTFS_INDEX_ENTRY_NODE))
1779 {
1780 return STATUS_OBJECT_PATH_NOT_FOUND;
1781 }
1782
1783 Status = FindAttribute(Vcb, MftRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationCtx, NULL);
1784 if (!NT_SUCCESS(Status))
1785 {
1786 DPRINT("Corrupted filesystem!\n");
1787 return Status;
1788 }
1789
1790 IndexAllocationSize = AttributeDataLength(IndexAllocationCtx->pRecord);
1791 Status = STATUS_OBJECT_PATH_NOT_FOUND;
1792 for (RecordOffset = 0; RecordOffset < IndexAllocationSize; RecordOffset += IndexBlockSize)
1793 {
1794 ReadAttribute(Vcb, IndexAllocationCtx, RecordOffset, IndexRecord, IndexBlockSize);
1795 Status = FixupUpdateSequenceArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs);
1796 if (!NT_SUCCESS(Status))
1797 {
1798 break;
1799 }
1800
1801 IndexBuffer = (PINDEX_BUFFER)IndexRecord;
1802 ASSERT(IndexBuffer->Ntfs.Type == NRH_INDX_TYPE);
1803 ASSERT(IndexBuffer->Header.AllocatedSize + FIELD_OFFSET(INDEX_BUFFER, Header) == IndexBlockSize);
1804 FirstEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.FirstEntryOffset);
1805 LastEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.TotalSizeOfEntries);
1806 ASSERT(LastEntry <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexBuffer + IndexBlockSize));
1807
1808 Status = UpdateIndexEntryFileNameSize(NULL,
1809 NULL,
1810 NULL,
1811 0,
1812 FirstEntry,
1813 LastEntry,
1814 FileName,
1815 StartEntry,
1816 CurrentEntry,
1817 DirSearch,
1818 NewDataSize,
1819 NewAllocatedSize,
1820 CaseSensitive);
1821 if (Status == STATUS_PENDING)
1822 {
1823 // write the index record back to disk
1824 ULONG Written;
1825
1826 // first we need to update the fixup values for the index block
1827 Status = AddFixupArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs);
1828 if (!NT_SUCCESS(Status))
1829 {
1830 DPRINT1("Error: Failed to update fixup sequence array!\n");
1831 break;
1832 }
1833
1834 Status = WriteAttribute(Vcb, IndexAllocationCtx, RecordOffset, (const PUCHAR)IndexRecord, IndexBlockSize, &Written, MftRecord);
1835 if (!NT_SUCCESS(Status))
1836 {
1837 DPRINT1("ERROR Performing write!\n");
1838 break;
1839 }
1840
1841 Status = STATUS_SUCCESS;
1842 break;
1843 }
1844 if (NT_SUCCESS(Status))
1845 {
1846 break;
1847 }
1848 }
1849
1850 ReleaseAttributeContext(IndexAllocationCtx);
1851 return Status;
1852 }
1853
1854 /**
1855 * @name UpdateFileRecord
1856 * @implemented
1857 *
1858 * Writes a file record to the master file table, at a given index.
1859 *
1860 * @param Vcb
1861 * Pointer to the DEVICE_EXTENSION of the target drive being written to.
1862 *
1863 * @param MftIndex
1864 * Target index in the master file table to store the file record.
1865 *
1866 * @param FileRecord
1867 * Pointer to the complete file record which will be written to the master file table.
1868 *
1869 * @return
1870 * STATUS_SUCCESSFUL on success. An error passed from WriteAttribute() otherwise.
1871 *
1872 */
1873 NTSTATUS
1874 UpdateFileRecord(PDEVICE_EXTENSION Vcb,
1875 ULONGLONG MftIndex,
1876 PFILE_RECORD_HEADER FileRecord)
1877 {
1878 ULONG BytesWritten;
1879 NTSTATUS Status = STATUS_SUCCESS;
1880
1881 DPRINT("UpdateFileRecord(%p, 0x%I64x, %p)\n", Vcb, MftIndex, FileRecord);
1882
1883 // Add the fixup array to prepare the data for writing to disk
1884 AddFixupArray(Vcb, &FileRecord->Ntfs);
1885
1886 // write the file record to the master file table
1887 Status = WriteAttribute(Vcb,
1888 Vcb->MFTContext,
1889 MftIndex * Vcb->NtfsInfo.BytesPerFileRecord,
1890 (const PUCHAR)FileRecord,
1891 Vcb->NtfsInfo.BytesPerFileRecord,
1892 &BytesWritten,
1893 FileRecord);
1894
1895 if (!NT_SUCCESS(Status))
1896 {
1897 DPRINT1("UpdateFileRecord failed: %lu written, %lu expected\n", BytesWritten, Vcb->NtfsInfo.BytesPerFileRecord);
1898 }
1899
1900 // remove the fixup array (so the file record pointer can still be used)
1901 FixupUpdateSequenceArray(Vcb, &FileRecord->Ntfs);
1902
1903 return Status;
1904 }
1905
1906
1907 NTSTATUS
1908 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb,
1909 PNTFS_RECORD_HEADER Record)
1910 {
1911 USHORT *USA;
1912 USHORT USANumber;
1913 USHORT USACount;
1914 USHORT *Block;
1915
1916 USA = (USHORT*)((PCHAR)Record + Record->UsaOffset);
1917 USANumber = *(USA++);
1918 USACount = Record->UsaCount - 1; /* Exclude the USA Number. */
1919 Block = (USHORT*)((PCHAR)Record + Vcb->NtfsInfo.BytesPerSector - 2);
1920
1921 DPRINT("FixupUpdateSequenceArray(%p, %p)\nUSANumber: %u\tUSACount: %u\n", Vcb, Record, USANumber, USACount);
1922
1923 while (USACount)
1924 {
1925 if (*Block != USANumber)
1926 {
1927 DPRINT1("Mismatch with USA: %u read, %u expected\n" , *Block, USANumber);
1928 return STATUS_UNSUCCESSFUL;
1929 }
1930 *Block = *(USA++);
1931 Block = (USHORT*)((PCHAR)Block + Vcb->NtfsInfo.BytesPerSector);
1932 USACount--;
1933 }
1934
1935 return STATUS_SUCCESS;
1936 }
1937
1938 /**
1939 * @name AddNewMftEntry
1940 * @implemented
1941 *
1942 * Adds a file record to the master file table of a given device.
1943 *
1944 * @param FileRecord
1945 * Pointer to a complete file record which will be saved to disk.
1946 *
1947 * @param DeviceExt
1948 * Pointer to the DEVICE_EXTENSION of the target drive.
1949 *
1950 * @param DestinationIndex
1951 * Pointer to a ULONGLONG which will receive the MFT index where the file record was stored.
1952 *
1953 * @param CanWait
1954 * Boolean indicating if the function is allowed to wait for exclusive access to the master file table.
1955 * This will only be relevant if the MFT doesn't have any free file records and needs to be enlarged.
1956 *
1957 * @return
1958 * STATUS_SUCCESS on success.
1959 * STATUS_OBJECT_NAME_NOT_FOUND if we can't find the MFT's $Bitmap or if we weren't able
1960 * to read the attribute.
1961 * STATUS_INSUFFICIENT_RESOURCES if we can't allocate enough memory for a copy of $Bitmap.
1962 * STATUS_CANT_WAIT if CanWait was FALSE and the function could not get immediate, exclusive access to the MFT.
1963 */
1964 NTSTATUS
1965 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord,
1966 PDEVICE_EXTENSION DeviceExt,
1967 PULONGLONG DestinationIndex,
1968 BOOLEAN CanWait)
1969 {
1970 NTSTATUS Status = STATUS_SUCCESS;
1971 ULONGLONG MftIndex;
1972 RTL_BITMAP Bitmap;
1973 ULONGLONG BitmapDataSize;
1974 ULONGLONG AttrBytesRead;
1975 PUCHAR BitmapData;
1976 PUCHAR BitmapBuffer;
1977 ULONG LengthWritten;
1978 PNTFS_ATTR_CONTEXT BitmapContext;
1979 LARGE_INTEGER BitmapBits;
1980 UCHAR SystemReservedBits;
1981
1982 DPRINT1("AddNewMftEntry(%p, %p, %p, %s)\n", FileRecord, DeviceExt, DestinationIndex, CanWait ? "TRUE" : "FALSE");
1983
1984 // First, we have to read the mft's $Bitmap attribute
1985
1986 // Find the attribute
1987 Status = FindAttribute(DeviceExt, DeviceExt->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
1988 if (!NT_SUCCESS(Status))
1989 {
1990 DPRINT1("ERROR: Couldn't find $Bitmap attribute of master file table!\n");
1991 return Status;
1992 }
1993
1994 // Get size of bitmap
1995 BitmapDataSize = AttributeDataLength(BitmapContext->pRecord);
1996
1997 // RtlInitializeBitmap wants a ULONG-aligned pointer, and wants the memory passed to it to be a ULONG-multiple
1998 // Allocate a buffer for the $Bitmap attribute plus enough to ensure we can get a ULONG-aligned pointer
1999 BitmapBuffer = ExAllocatePoolWithTag(NonPagedPool, BitmapDataSize + sizeof(ULONG), TAG_NTFS);
2000 if (!BitmapBuffer)
2001 {
2002 ReleaseAttributeContext(BitmapContext);
2003 return STATUS_INSUFFICIENT_RESOURCES;
2004 }
2005 RtlZeroMemory(BitmapBuffer, BitmapDataSize + sizeof(ULONG));
2006
2007 // Get a ULONG-aligned pointer for the bitmap itself
2008 BitmapData = (PUCHAR)ALIGN_UP_BY((ULONG_PTR)BitmapBuffer, sizeof(ULONG));
2009
2010 // read $Bitmap attribute
2011 AttrBytesRead = ReadAttribute(DeviceExt, BitmapContext, 0, (PCHAR)BitmapData, BitmapDataSize);
2012
2013 if (AttrBytesRead != BitmapDataSize)
2014 {
2015 DPRINT1("ERROR: Unable to read $Bitmap attribute of master file table!\n");
2016 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2017 ReleaseAttributeContext(BitmapContext);
2018 return STATUS_OBJECT_NAME_NOT_FOUND;
2019 }
2020
2021 // We need to backup the bits for records 0x10 - 0x17 (3rd byte of bitmap) and mark these records
2022 // as in-use so we don't assign files to those indices. They're reserved for the system (e.g. ChkDsk).
2023 SystemReservedBits = BitmapData[2];
2024 BitmapData[2] = 0xff;
2025
2026 // Calculate bit count
2027 BitmapBits.QuadPart = AttributeDataLength(DeviceExt->MFTContext->pRecord) /
2028 DeviceExt->NtfsInfo.BytesPerFileRecord;
2029 if (BitmapBits.HighPart != 0)
2030 {
2031 DPRINT1("\tFIXME: bitmap sizes beyond 32bits are not yet supported! (Your NTFS volume is too large)\n");
2032 NtfsGlobalData->EnableWriteSupport = FALSE;
2033 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2034 ReleaseAttributeContext(BitmapContext);
2035 return STATUS_NOT_IMPLEMENTED;
2036 }
2037
2038 // convert buffer into bitmap
2039 RtlInitializeBitMap(&Bitmap, (PULONG)BitmapData, BitmapBits.LowPart);
2040
2041 // set next available bit, preferrably after 23rd bit
2042 MftIndex = RtlFindClearBitsAndSet(&Bitmap, 1, 24);
2043 if ((LONG)MftIndex == -1)
2044 {
2045 DPRINT1("Couldn't find free space in MFT for file record, increasing MFT size.\n");
2046
2047 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2048 ReleaseAttributeContext(BitmapContext);
2049
2050 // Couldn't find a free record in the MFT, add some blank records and try again
2051 Status = IncreaseMftSize(DeviceExt, CanWait);
2052 if (!NT_SUCCESS(Status))
2053 {
2054 DPRINT1("ERROR: Couldn't find space in MFT for file or increase MFT size!\n");
2055 return Status;
2056 }
2057
2058 return AddNewMftEntry(FileRecord, DeviceExt, DestinationIndex, CanWait);
2059 }
2060
2061 DPRINT1("Creating file record at MFT index: %I64u\n", MftIndex);
2062
2063 // update file record with index
2064 FileRecord->MFTRecordNumber = MftIndex;
2065
2066 // [BitmapData should have been updated via RtlFindClearBitsAndSet()]
2067
2068 // Restore the system reserved bits
2069 BitmapData[2] = SystemReservedBits;
2070
2071 // write the bitmap back to the MFT's $Bitmap attribute
2072 Status = WriteAttribute(DeviceExt, BitmapContext, 0, BitmapData, BitmapDataSize, &LengthWritten, FileRecord);
2073 if (!NT_SUCCESS(Status))
2074 {
2075 DPRINT1("ERROR encountered when writing $Bitmap attribute!\n");
2076 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2077 ReleaseAttributeContext(BitmapContext);
2078 return Status;
2079 }
2080
2081 // update the file record (write it to disk)
2082 Status = UpdateFileRecord(DeviceExt, MftIndex, FileRecord);
2083
2084 if (!NT_SUCCESS(Status))
2085 {
2086 DPRINT1("ERROR: Unable to write file record!\n");
2087 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2088 ReleaseAttributeContext(BitmapContext);
2089 return Status;
2090 }
2091
2092 *DestinationIndex = MftIndex;
2093
2094 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2095 ReleaseAttributeContext(BitmapContext);
2096
2097 return Status;
2098 }
2099
2100 /**
2101 * @name NtfsAddFilenameToDirectory
2102 * @implemented
2103 *
2104 * Adds a $FILE_NAME attribute to a given directory index.
2105 *
2106 * @param DeviceExt
2107 * Points to the target disk's DEVICE_EXTENSION.
2108 *
2109 * @param DirectoryMftIndex
2110 * Mft index of the parent directory which will receive the file.
2111 *
2112 * @param FileReferenceNumber
2113 * File reference of the file to be added to the directory. This is a combination of the
2114 * Mft index and sequence number.
2115 *
2116 * @param FilenameAttribute
2117 * Pointer to the FILENAME_ATTRIBUTE of the file being added to the directory.
2118 *
2119 * @param CaseSensitive
2120 * Boolean indicating if the function should operate in case-sensitive mode. This will be TRUE
2121 * if an application created the file with the FILE_FLAG_POSIX_SEMANTICS flag.
2122 *
2123 * @return
2124 * STATUS_SUCCESS on success.
2125 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
2126 * STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record.
2127 *
2128 * @remarks
2129 * WIP - Can only support a few files in a directory.
2130 * One FILENAME_ATTRIBUTE is added to the directory's index for each link to that file. So, each
2131 * file which contains one FILENAME_ATTRIBUTE for a long name and another for the 8.3 name, will
2132 * get both attributes added to its parent directory.
2133 */
2134 NTSTATUS
2135 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt,
2136 ULONGLONG DirectoryMftIndex,
2137 ULONGLONG FileReferenceNumber,
2138 PFILENAME_ATTRIBUTE FilenameAttribute,
2139 BOOLEAN CaseSensitive)
2140 {
2141 NTSTATUS Status = STATUS_SUCCESS;
2142 PFILE_RECORD_HEADER ParentFileRecord;
2143 PNTFS_ATTR_CONTEXT IndexRootContext;
2144 PINDEX_ROOT_ATTRIBUTE I30IndexRoot;
2145 ULONG IndexRootOffset;
2146 ULONGLONG I30IndexRootLength;
2147 ULONG LengthWritten;
2148 PINDEX_ROOT_ATTRIBUTE NewIndexRoot;
2149 ULONG AttributeLength;
2150 PNTFS_ATTR_RECORD NextAttribute;
2151 PB_TREE NewTree;
2152 ULONG BtreeIndexLength;
2153 ULONG MaxIndexRootSize;
2154 PB_TREE_KEY NewLeftKey;
2155 PB_TREE_FILENAME_NODE NewRightHandNode;
2156 LARGE_INTEGER MinIndexRootSize;
2157 ULONG NewMaxIndexRootSize;
2158 ULONG NodeSize;
2159
2160 // Allocate memory for the parent directory
2161 ParentFileRecord = ExAllocatePoolWithTag(NonPagedPool,
2162 DeviceExt->NtfsInfo.BytesPerFileRecord,
2163 TAG_NTFS);
2164 if (!ParentFileRecord)
2165 {
2166 DPRINT1("ERROR: Couldn't allocate memory for file record!\n");
2167 return STATUS_INSUFFICIENT_RESOURCES;
2168 }
2169
2170 // Open the parent directory
2171 Status = ReadFileRecord(DeviceExt, DirectoryMftIndex, ParentFileRecord);
2172 if (!NT_SUCCESS(Status))
2173 {
2174 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2175 DPRINT1("ERROR: Couldn't read parent directory with index %I64u\n",
2176 DirectoryMftIndex);
2177 return Status;
2178 }
2179
2180 #ifndef NDEBUG
2181 DPRINT1("Dumping old parent file record:\n");
2182 NtfsDumpFileRecord(DeviceExt, ParentFileRecord);
2183 #endif
2184
2185 // Find the index root attribute for the directory
2186 Status = FindAttribute(DeviceExt,
2187 ParentFileRecord,
2188 AttributeIndexRoot,
2189 L"$I30",
2190 4,
2191 &IndexRootContext,
2192 &IndexRootOffset);
2193 if (!NT_SUCCESS(Status))
2194 {
2195 DPRINT1("ERROR: Couldn't find $I30 $INDEX_ROOT attribute for parent directory with MFT #: %I64u!\n",
2196 DirectoryMftIndex);
2197 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2198 return Status;
2199 }
2200
2201 // Find the maximum index size given what the file record can hold
2202 // First, find the max index size assuming index root is the last attribute
2203 MaxIndexRootSize = DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2204 - IndexRootOffset // Subtract the length of everything that comes before index root
2205 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2206 - sizeof(INDEX_ROOT_ATTRIBUTE) // Subtract the length of the index root header
2207 - (sizeof(ULONG) * 2); // Subtract the length of the file record end marker and padding
2208
2209 // Are there attributes after this one?
2210 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2211 if (NextAttribute->Type != AttributeEnd)
2212 {
2213 // Find the length of all attributes after this one, not counting the end marker
2214 ULONG LengthOfAttributes = 0;
2215 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2216 while (CurrentAttribute->Type != AttributeEnd)
2217 {
2218 LengthOfAttributes += CurrentAttribute->Length;
2219 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2220 }
2221
2222 // Leave room for the existing attributes
2223 MaxIndexRootSize -= LengthOfAttributes;
2224 }
2225
2226 // Allocate memory for the index root data
2227 I30IndexRootLength = AttributeDataLength(IndexRootContext->pRecord);
2228 I30IndexRoot = ExAllocatePoolWithTag(NonPagedPool, I30IndexRootLength, TAG_NTFS);
2229 if (!I30IndexRoot)
2230 {
2231 DPRINT1("ERROR: Couldn't allocate memory for index root attribute!\n");
2232 ReleaseAttributeContext(IndexRootContext);
2233 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2234 return STATUS_INSUFFICIENT_RESOURCES;
2235 }
2236
2237 // Read the Index Root
2238 Status = ReadAttribute(DeviceExt, IndexRootContext, 0, (PCHAR)I30IndexRoot, I30IndexRootLength);
2239 if (!NT_SUCCESS(Status))
2240 {
2241 DPRINT1("ERROR: Couln't read index root attribute for Mft index #%I64u\n", DirectoryMftIndex);
2242 ReleaseAttributeContext(IndexRootContext);
2243 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2244 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2245 return Status;
2246 }
2247
2248 // Convert the index to a B*Tree
2249 Status = CreateBTreeFromIndex(DeviceExt,
2250 ParentFileRecord,
2251 IndexRootContext,
2252 I30IndexRoot,
2253 &NewTree);
2254 if (!NT_SUCCESS(Status))
2255 {
2256 DPRINT1("ERROR: Failed to create B-Tree from Index!\n");
2257 ReleaseAttributeContext(IndexRootContext);
2258 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2259 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2260 return Status;
2261 }
2262
2263 #ifndef NDEBUG
2264 DumpBTree(NewTree);
2265 #endif
2266
2267 // Insert the key for the file we're adding
2268 Status = NtfsInsertKey(NewTree,
2269 FileReferenceNumber,
2270 FilenameAttribute,
2271 NewTree->RootNode,
2272 CaseSensitive,
2273 MaxIndexRootSize,
2274 I30IndexRoot->SizeOfEntry,
2275 &NewLeftKey,
2276 &NewRightHandNode);
2277 if (!NT_SUCCESS(Status))
2278 {
2279 DPRINT1("ERROR: Failed to insert key into B-Tree!\n");
2280 DestroyBTree(NewTree);
2281 ReleaseAttributeContext(IndexRootContext);
2282 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2283 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2284 return Status;
2285 }
2286
2287 #ifndef NDEBUG
2288 DumpBTree(NewTree);
2289 #endif
2290
2291 // The root node can't be split
2292 ASSERT(NewLeftKey == NULL);
2293 ASSERT(NewRightHandNode == NULL);
2294
2295 // Convert B*Tree back to Index
2296
2297 // Updating the index allocation can change the size available for the index root,
2298 // And if the index root is demoted, the index allocation will need to be updated again,
2299 // which may change the size available for index root... etc.
2300 // My solution is to decrease index root to the size it would be if it was demoted,
2301 // then UpdateIndexAllocation will have an accurate representation of the maximum space
2302 // it can use in the file record. There's still a chance that the act of allocating an
2303 // index node after demoting the index root will increase the size of the file record beyond
2304 // it's limit, but if that happens, an attribute-list will most definitely be needed.
2305 // This a bit hacky, but it seems to be functional.
2306
2307 // Calculate the minimum size of the index root attribute, considering one dummy key and one VCN
2308 MinIndexRootSize.QuadPart = sizeof(INDEX_ROOT_ATTRIBUTE) // size of the index root headers
2309 + 0x18; // Size of dummy key with a VCN for a subnode
2310 ASSERT(MinIndexRootSize.QuadPart % ATTR_RECORD_ALIGNMENT == 0);
2311
2312 // Temporarily shrink the index root to it's minimal size
2313 AttributeLength = MinIndexRootSize.LowPart;
2314 AttributeLength += sizeof(INDEX_ROOT_ATTRIBUTE);
2315
2316
2317 // FIXME: IndexRoot will probably be invalid until we're finished. If we fail before we finish, the directory will probably be toast.
2318 // The potential for catastrophic data-loss exists!!! :)
2319
2320 // Update the length of the attribute in the file record of the parent directory
2321 Status = InternalSetResidentAttributeLength(DeviceExt,
2322 IndexRootContext,
2323 ParentFileRecord,
2324 IndexRootOffset,
2325 AttributeLength);
2326 if (!NT_SUCCESS(Status))
2327 {
2328 DPRINT1("ERROR: Unable to set length of index root!\n");
2329 DestroyBTree(NewTree);
2330 ReleaseAttributeContext(IndexRootContext);
2331 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2332 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2333 return Status;
2334 }
2335
2336 // Update the index allocation
2337 Status = UpdateIndexAllocation(DeviceExt, NewTree, I30IndexRoot->SizeOfEntry, ParentFileRecord);
2338 if (!NT_SUCCESS(Status))
2339 {
2340 DPRINT1("ERROR: Failed to update index allocation from B-Tree!\n");
2341 DestroyBTree(NewTree);
2342 ReleaseAttributeContext(IndexRootContext);
2343 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2344 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2345 return Status;
2346 }
2347
2348 #ifndef NDEBUG
2349 DPRINT1("Index Allocation updated\n");
2350 DumpBTree(NewTree);
2351 #endif
2352
2353 // Find the maximum index root size given what the file record can hold
2354 // First, find the max index size assuming index root is the last attribute
2355 NewMaxIndexRootSize =
2356 DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2357 - IndexRootOffset // Subtract the length of everything that comes before index root
2358 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2359 - sizeof(INDEX_ROOT_ATTRIBUTE) // Subtract the length of the index root header
2360 - (sizeof(ULONG) * 2); // Subtract the length of the file record end marker and padding
2361
2362 // Are there attributes after this one?
2363 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2364 if (NextAttribute->Type != AttributeEnd)
2365 {
2366 // Find the length of all attributes after this one, not counting the end marker
2367 ULONG LengthOfAttributes = 0;
2368 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2369 while (CurrentAttribute->Type != AttributeEnd)
2370 {
2371 LengthOfAttributes += CurrentAttribute->Length;
2372 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2373 }
2374
2375 // Leave room for the existing attributes
2376 NewMaxIndexRootSize -= LengthOfAttributes;
2377 }
2378
2379 // The index allocation and index bitmap may have grown, leaving less room for the index root,
2380 // so now we need to double-check that index root isn't too large
2381 NodeSize = GetSizeOfIndexEntries(NewTree->RootNode);
2382 if (NodeSize > NewMaxIndexRootSize)
2383 {
2384 DPRINT1("Demoting index root.\nNodeSize: 0x%lx\nNewMaxIndexRootSize: 0x%lx\n", NodeSize, NewMaxIndexRootSize);
2385
2386 Status = DemoteBTreeRoot(NewTree);
2387 if (!NT_SUCCESS(Status))
2388 {
2389 DPRINT1("ERROR: Failed to demote index root!\n");
2390 DestroyBTree(NewTree);
2391 ReleaseAttributeContext(IndexRootContext);
2392 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2393 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2394 return Status;
2395 }
2396
2397 // We need to update the index allocation once more
2398 Status = UpdateIndexAllocation(DeviceExt, NewTree, I30IndexRoot->SizeOfEntry, ParentFileRecord);
2399 if (!NT_SUCCESS(Status))
2400 {
2401 DPRINT1("ERROR: Failed to update index allocation from B-Tree!\n");
2402 DestroyBTree(NewTree);
2403 ReleaseAttributeContext(IndexRootContext);
2404 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2405 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2406 return Status;
2407 }
2408
2409 // re-recalculate max size of index root
2410 NewMaxIndexRootSize =
2411 // Find the maximum index size given what the file record can hold
2412 // First, find the max index size assuming index root is the last attribute
2413 DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2414 - IndexRootOffset // Subtract the length of everything that comes before index root
2415 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2416 - sizeof(INDEX_ROOT_ATTRIBUTE) // Subtract the length of the index root header
2417 - (sizeof(ULONG) * 2); // Subtract the length of the file record end marker and padding
2418
2419 // Are there attributes after this one?
2420 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2421 if (NextAttribute->Type != AttributeEnd)
2422 {
2423 // Find the length of all attributes after this one, not counting the end marker
2424 ULONG LengthOfAttributes = 0;
2425 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2426 while (CurrentAttribute->Type != AttributeEnd)
2427 {
2428 LengthOfAttributes += CurrentAttribute->Length;
2429 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2430 }
2431
2432 // Leave room for the existing attributes
2433 NewMaxIndexRootSize -= LengthOfAttributes;
2434 }
2435
2436
2437 }
2438
2439 // Create the Index Root from the B*Tree
2440 Status = CreateIndexRootFromBTree(DeviceExt, NewTree, NewMaxIndexRootSize, &NewIndexRoot, &BtreeIndexLength);
2441 if (!NT_SUCCESS(Status))
2442 {
2443 DPRINT1("ERROR: Failed to create Index root from B-Tree!\n");
2444 DestroyBTree(NewTree);
2445 ReleaseAttributeContext(IndexRootContext);
2446 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2447 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2448 return Status;
2449 }
2450
2451 // We're done with the B-Tree now
2452 DestroyBTree(NewTree);
2453
2454 // Write back the new index root attribute to the parent directory file record
2455
2456 // First, we need to resize the attribute.
2457 // CreateIndexRootFromBTree() should have verified that the index root fits within MaxIndexSize.
2458 // We can't set the size as we normally would, because $INDEX_ROOT must always be resident.
2459 AttributeLength = NewIndexRoot->Header.AllocatedSize + FIELD_OFFSET(INDEX_ROOT_ATTRIBUTE, Header);
2460
2461 if (AttributeLength != IndexRootContext->pRecord->Resident.ValueLength)
2462 {
2463 // Update the length of the attribute in the file record of the parent directory
2464 Status = InternalSetResidentAttributeLength(DeviceExt,
2465 IndexRootContext,
2466 ParentFileRecord,
2467 IndexRootOffset,
2468 AttributeLength);
2469 if (!NT_SUCCESS(Status))
2470 {
2471 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2472 ReleaseAttributeContext(IndexRootContext);
2473 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2474 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2475 DPRINT1("ERROR: Unable to set resident attribute length!\n");
2476 return Status;
2477 }
2478
2479 }
2480
2481 NT_ASSERT(ParentFileRecord->BytesInUse <= DeviceExt->NtfsInfo.BytesPerFileRecord);
2482
2483 Status = UpdateFileRecord(DeviceExt, DirectoryMftIndex, ParentFileRecord);
2484 if (!NT_SUCCESS(Status))
2485 {
2486 DPRINT1("ERROR: Failed to update file record of directory with index: %llx\n", DirectoryMftIndex);
2487 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2488 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2489 ReleaseAttributeContext(IndexRootContext);
2490 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2491 return Status;
2492 }
2493
2494 // Write the new index root to disk
2495 Status = WriteAttribute(DeviceExt,
2496 IndexRootContext,
2497 0,
2498 (PUCHAR)NewIndexRoot,
2499 AttributeLength,
2500 &LengthWritten,
2501 ParentFileRecord);
2502 if (!NT_SUCCESS(Status) || LengthWritten != AttributeLength)
2503 {
2504 DPRINT1("ERROR: Unable to write new index root attribute to parent directory!\n");
2505 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2506 ReleaseAttributeContext(IndexRootContext);
2507 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2508 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2509 return Status;
2510 }
2511
2512 // re-read the parent file record, so we can dump it
2513 Status = ReadFileRecord(DeviceExt, DirectoryMftIndex, ParentFileRecord);
2514 if (!NT_SUCCESS(Status))
2515 {
2516 DPRINT1("ERROR: Couldn't read parent directory after messing with it!\n");
2517 }
2518 else
2519 {
2520 #ifndef NDEBUG
2521 DPRINT1("Dumping new B-Tree:\n");
2522
2523 Status = CreateBTreeFromIndex(DeviceExt, ParentFileRecord, IndexRootContext, NewIndexRoot, &NewTree);
2524 if (!NT_SUCCESS(Status))
2525 {
2526 DPRINT1("ERROR: Couldn't re-create b-tree\n");
2527 return Status;
2528 }
2529
2530 DumpBTree(NewTree);
2531
2532 DestroyBTree(NewTree);
2533
2534 NtfsDumpFileRecord(DeviceExt, ParentFileRecord);
2535 #endif
2536 }
2537
2538 // Cleanup
2539 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2540 ReleaseAttributeContext(IndexRootContext);
2541 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2542 ExFreePoolWithTag(ParentFileRecord, TAG_NTFS);
2543
2544 return Status;
2545 }
2546
2547 NTSTATUS
2548 AddFixupArray(PDEVICE_EXTENSION Vcb,
2549 PNTFS_RECORD_HEADER Record)
2550 {
2551 USHORT *pShortToFixUp;
2552 ULONG ArrayEntryCount = Record->UsaCount - 1;
2553 ULONG Offset = Vcb->NtfsInfo.BytesPerSector - 2;
2554 ULONG i;
2555
2556 PFIXUP_ARRAY fixupArray = (PFIXUP_ARRAY)((UCHAR*)Record + Record->UsaOffset);
2557
2558 DPRINT("AddFixupArray(%p, %p)\n fixupArray->USN: %u, ArrayEntryCount: %u\n", Vcb, Record, fixupArray->USN, ArrayEntryCount);
2559
2560 fixupArray->USN++;
2561
2562 for (i = 0; i < ArrayEntryCount; i++)
2563 {
2564 DPRINT("USN: %u\tOffset: %u\n", fixupArray->USN, Offset);
2565
2566 pShortToFixUp = (USHORT*)((PCHAR)Record + Offset);
2567 fixupArray->Array[i] = *pShortToFixUp;
2568 *pShortToFixUp = fixupArray->USN;
2569 Offset += Vcb->NtfsInfo.BytesPerSector;
2570 }
2571
2572 return STATUS_SUCCESS;
2573 }
2574
2575 NTSTATUS
2576 ReadLCN(PDEVICE_EXTENSION Vcb,
2577 ULONGLONG lcn,
2578 ULONG count,
2579 PVOID buffer)
2580 {
2581 LARGE_INTEGER DiskSector;
2582
2583 DiskSector.QuadPart = lcn;
2584
2585 return NtfsReadSectors(Vcb->StorageDevice,
2586 DiskSector.u.LowPart * Vcb->NtfsInfo.SectorsPerCluster,
2587 count * Vcb->NtfsInfo.SectorsPerCluster,
2588 Vcb->NtfsInfo.BytesPerSector,
2589 buffer,
2590 FALSE);
2591 }
2592
2593
2594 BOOLEAN
2595 CompareFileName(PUNICODE_STRING FileName,
2596 PINDEX_ENTRY_ATTRIBUTE IndexEntry,
2597 BOOLEAN DirSearch,
2598 BOOLEAN CaseSensitive)
2599 {
2600 BOOLEAN Ret, Alloc = FALSE;
2601 UNICODE_STRING EntryName;
2602
2603 EntryName.Buffer = IndexEntry->FileName.Name;
2604 EntryName.Length =
2605 EntryName.MaximumLength = IndexEntry->FileName.NameLength * sizeof(WCHAR);
2606
2607 if (DirSearch)
2608 {
2609 UNICODE_STRING IntFileName;
2610 if (!CaseSensitive)
2611 {
2612 NT_VERIFY(NT_SUCCESS(RtlUpcaseUnicodeString(&IntFileName, FileName, TRUE)));
2613 Alloc = TRUE;
2614 }
2615 else
2616 {
2617 IntFileName = *FileName;
2618 }
2619
2620 Ret = FsRtlIsNameInExpression(&IntFileName, &EntryName, !CaseSensitive, NULL);
2621
2622 if (Alloc)
2623 {
2624 RtlFreeUnicodeString(&IntFileName);
2625 }
2626
2627 return Ret;
2628 }
2629 else
2630 {
2631 return (RtlCompareUnicodeString(FileName, &EntryName, !CaseSensitive) == 0);
2632 }
2633 }
2634
2635 /**
2636 * @name UpdateMftMirror
2637 * @implemented
2638 *
2639 * Backs-up the first ~4 master file table entries to the $MFTMirr file.
2640 *
2641 * @param Vcb
2642 * Pointer to an NTFS_VCB for the volume whose Mft mirror is being updated.
2643 *
2644 * @return
2645
2646 * STATUS_SUCCESS on success.
2647 * STATUS_INSUFFICIENT_RESOURCES if an allocation failed.
2648 * STATUS_UNSUCCESSFUL if we couldn't read the master file table.
2649 *
2650 * @remarks
2651 * NTFS maintains up-to-date copies of the first several mft entries in the $MFTMirr file. Usually, the first 4 file
2652 * records from the mft are stored. The exact number of entries is determined by the size of $MFTMirr's $DATA.
2653 * If $MFTMirr is not up-to-date, chkdsk will reject every change it can find prior to when $MFTMirr was last updated.
2654 * Therefore, it's recommended to call this function if the volume changes considerably. For instance, IncreaseMftSize()
2655 * relies on this function to keep chkdsk from deleting the mft entries it creates. Note that under most instances, creating
2656 * or deleting a file will not affect the first ~four mft entries, and so will not require updating the mft mirror.
2657 */
2658 NTSTATUS
2659 UpdateMftMirror(PNTFS_VCB Vcb)
2660 {
2661 PFILE_RECORD_HEADER MirrorFileRecord;
2662 PNTFS_ATTR_CONTEXT MirrDataContext;
2663 PNTFS_ATTR_CONTEXT MftDataContext;
2664 PCHAR DataBuffer;
2665 ULONGLONG DataLength;
2666 NTSTATUS Status;
2667 ULONG BytesRead;
2668 ULONG LengthWritten;
2669
2670 // Allocate memory for the Mft mirror file record
2671 MirrorFileRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
2672 if (!MirrorFileRecord)
2673 {
2674 DPRINT1("Error: Failed to allocate memory for $MFTMirr!\n");
2675 return STATUS_INSUFFICIENT_RESOURCES;
2676 }
2677
2678 // Read the Mft Mirror file record
2679 Status = ReadFileRecord(Vcb, NTFS_FILE_MFTMIRR, MirrorFileRecord);
2680 if (!NT_SUCCESS(Status))
2681 {
2682 DPRINT1("ERROR: Failed to read $MFTMirr!\n");
2683 ExFreePoolWithTag(MirrorFileRecord, TAG_NTFS);
2684 return Status;
2685 }
2686
2687 // Find the $DATA attribute of $MFTMirr
2688 Status = FindAttribute(Vcb, MirrorFileRecord, AttributeData, L"", 0, &MirrDataContext, NULL);
2689 if (!NT_SUCCESS(Status))
2690 {
2691 DPRINT1("ERROR: Couldn't find $DATA attribute!\n");
2692 ExFreePoolWithTag(MirrorFileRecord, TAG_NTFS);
2693 return Status;
2694 }
2695
2696 // Find the $DATA attribute of $MFT
2697 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeData, L"", 0, &MftDataContext, NULL);
2698 if (!NT_SUCCESS(Status))
2699 {
2700 DPRINT1("ERROR: Couldn't find $DATA attribute!\n");
2701 ReleaseAttributeContext(MirrDataContext);
2702 ExFreePoolWithTag(MirrorFileRecord, TAG_NTFS);
2703 return Status;
2704 }
2705
2706 // Get the size of the mirror's $DATA attribute
2707 DataLength = AttributeDataLength(MirrDataContext->pRecord);
2708
2709 ASSERT(DataLength % Vcb->NtfsInfo.BytesPerFileRecord == 0);
2710
2711 // Create buffer for the mirror's $DATA attribute
2712 DataBuffer = ExAllocatePoolWithTag(NonPagedPool, DataLength, TAG_NTFS);
2713 if (!DataBuffer)
2714 {
2715 DPRINT1("Error: Couldn't allocate memory for $DATA buffer!\n");
2716 ReleaseAttributeContext(MftDataContext);
2717 ReleaseAttributeContext(MirrDataContext);
2718 ExFreePoolWithTag(MirrorFileRecord, TAG_NTFS);
2719 return STATUS_INSUFFICIENT_RESOURCES;
2720 }
2721
2722 ASSERT(DataLength < ULONG_MAX);
2723
2724 // Back up the first several entries of the Mft's $DATA Attribute
2725 BytesRead = ReadAttribute(Vcb, MftDataContext, 0, DataBuffer, (ULONG)DataLength);
2726 if (BytesRead != (ULONG)DataLength)
2727 {
2728 DPRINT1("Error: Failed to read $DATA for $MFTMirr!\n");
2729 ReleaseAttributeContext(MftDataContext);
2730 ReleaseAttributeContext(MirrDataContext);
2731 ExFreePoolWithTag(DataBuffer, TAG_NTFS);
2732 ExFreePoolWithTag(MirrorFileRecord, TAG_NTFS);
2733 return STATUS_UNSUCCESSFUL;
2734 }
2735
2736 // Write the mirror's $DATA attribute
2737 Status = WriteAttribute(Vcb,
2738 MirrDataContext,
2739 0,
2740 (PUCHAR)DataBuffer,
2741 DataLength,
2742 &LengthWritten,
2743 MirrorFileRecord);
2744 if (!NT_SUCCESS(Status))
2745 {
2746 DPRINT1("ERROR: Failed to write $DATA attribute of $MFTMirr!\n");
2747 }
2748
2749 // Cleanup
2750 ReleaseAttributeContext(MftDataContext);
2751 ReleaseAttributeContext(MirrDataContext);
2752 ExFreePoolWithTag(DataBuffer, TAG_NTFS);
2753 ExFreePoolWithTag(MirrorFileRecord, TAG_NTFS);
2754
2755 return Status;
2756 }
2757
2758 #if 0
2759 static
2760 VOID
2761 DumpIndexEntry(PINDEX_ENTRY_ATTRIBUTE IndexEntry)
2762 {
2763 DPRINT1("Entry: %p\n", IndexEntry);
2764 DPRINT1("\tData.Directory.IndexedFile: %I64x\n", IndexEntry->Data.Directory.IndexedFile);
2765 DPRINT1("\tLength: %u\n", IndexEntry->Length);
2766 DPRINT1("\tKeyLength: %u\n", IndexEntry->KeyLength);
2767 DPRINT1("\tFlags: %x\n", IndexEntry->Flags);
2768 DPRINT1("\tReserved: %x\n", IndexEntry->Reserved);
2769 DPRINT1("\t\tDirectoryFileReferenceNumber: %I64x\n", IndexEntry->FileName.DirectoryFileReferenceNumber);
2770 DPRINT1("\t\tCreationTime: %I64u\n", IndexEntry->FileName.CreationTime);
2771 DPRINT1("\t\tChangeTime: %I64u\n", IndexEntry->FileName.ChangeTime);
2772 DPRINT1("\t\tLastWriteTime: %I64u\n", IndexEntry->FileName.LastWriteTime);
2773 DPRINT1("\t\tLastAccessTime: %I64u\n", IndexEntry->FileName.LastAccessTime);
2774 DPRINT1("\t\tAllocatedSize: %I64u\n", IndexEntry->FileName.AllocatedSize);
2775 DPRINT1("\t\tDataSize: %I64u\n", IndexEntry->FileName.DataSize);
2776 DPRINT1("\t\tFileAttributes: %x\n", IndexEntry->FileName.FileAttributes);
2777 DPRINT1("\t\tNameLength: %u\n", IndexEntry->FileName.NameLength);
2778 DPRINT1("\t\tNameType: %x\n", IndexEntry->FileName.NameType);
2779 DPRINT1("\t\tName: %.*S\n", IndexEntry->FileName.NameLength, IndexEntry->FileName.Name);
2780 }
2781 #endif
2782
2783 NTSTATUS
2784 BrowseSubNodeIndexEntries(PNTFS_VCB Vcb,
2785 PFILE_RECORD_HEADER MftRecord,
2786 ULONG IndexBlockSize,
2787 PUNICODE_STRING FileName,
2788 PNTFS_ATTR_CONTEXT IndexAllocationContext,
2789 PRTL_BITMAP Bitmap,
2790 ULONGLONG VCN,
2791 PULONG StartEntry,
2792 PULONG CurrentEntry,
2793 BOOLEAN DirSearch,
2794 BOOLEAN CaseSensitive,
2795 ULONGLONG *OutMFTIndex)
2796 {
2797 PINDEX_BUFFER IndexRecord;
2798 ULONGLONG Offset;
2799 ULONG BytesRead;
2800 PINDEX_ENTRY_ATTRIBUTE FirstEntry;
2801 PINDEX_ENTRY_ATTRIBUTE LastEntry;
2802 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
2803 ULONG NodeNumber;
2804 NTSTATUS Status;
2805
2806 DPRINT("BrowseSubNodeIndexEntries(%p, %p, %lu, %wZ, %p, %p, %I64d, %lu, %lu, %s, %s, %p)\n",
2807 Vcb,
2808 MftRecord,
2809 IndexBlockSize,
2810 FileName,
2811 IndexAllocationContext,
2812 Bitmap,
2813 VCN,
2814 *StartEntry,
2815 *CurrentEntry,
2816 "FALSE",
2817 DirSearch ? "TRUE" : "FALSE",
2818 CaseSensitive ? "TRUE" : "FALSE",
2819 OutMFTIndex);
2820
2821 // Calculate node number as VCN / Clusters per index record
2822 NodeNumber = VCN / (Vcb->NtfsInfo.BytesPerIndexRecord / Vcb->NtfsInfo.BytesPerCluster);
2823
2824 // Is the bit for this node clear in the bitmap?
2825 if (!RtlCheckBit(Bitmap, NodeNumber))
2826 {
2827 DPRINT1("File system corruption detected, node with VCN %I64u is being reused or is marked as deleted.\n", VCN);
2828 return STATUS_DATA_ERROR;
2829 }
2830
2831 // Clear the bit for this node so it can't be recursively referenced
2832 RtlClearBits(Bitmap, NodeNumber, 1);
2833
2834 // Allocate memory for the index record
2835 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, IndexBlockSize, TAG_NTFS);
2836 if (!IndexRecord)
2837 {
2838 DPRINT1("Unable to allocate memory for index record!\n");
2839 return STATUS_INSUFFICIENT_RESOURCES;
2840 }
2841
2842 // Calculate offset of index record
2843 Offset = VCN * Vcb->NtfsInfo.BytesPerCluster;
2844
2845 // Read the index record
2846 BytesRead = ReadAttribute(Vcb, IndexAllocationContext, Offset, (PCHAR)IndexRecord, IndexBlockSize);
2847 if (BytesRead != IndexBlockSize)
2848 {
2849 DPRINT1("Unable to read index record!\n");
2850 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2851 return STATUS_UNSUCCESSFUL;
2852 }
2853
2854 // Assert that we're dealing with an index record here
2855 ASSERT(IndexRecord->Ntfs.Type == NRH_INDX_TYPE);
2856
2857 // Apply the fixup array to the index record
2858 Status = FixupUpdateSequenceArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs);
2859 if (!NT_SUCCESS(Status))
2860 {
2861 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2862 DPRINT1("Failed to apply fixup array!\n");
2863 return Status;
2864 }
2865
2866 ASSERT(IndexRecord->Header.AllocatedSize + FIELD_OFFSET(INDEX_BUFFER, Header) == IndexBlockSize);
2867 FirstEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexRecord->Header + IndexRecord->Header.FirstEntryOffset);
2868 LastEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexRecord->Header + IndexRecord->Header.TotalSizeOfEntries);
2869 ASSERT(LastEntry <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexRecord + IndexBlockSize));
2870
2871 // Loop through all Index Entries of index, starting with FirstEntry
2872 IndexEntry = FirstEntry;
2873 while (IndexEntry <= LastEntry)
2874 {
2875 // Does IndexEntry have a sub-node?
2876 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_NODE)
2877 {
2878 if (!(IndexRecord->Header.Flags & INDEX_NODE_LARGE) || !IndexAllocationContext)
2879 {
2880 DPRINT1("Filesystem corruption detected!\n");
2881 }
2882 else
2883 {
2884 Status = BrowseSubNodeIndexEntries(Vcb,
2885 MftRecord,
2886 IndexBlockSize,
2887 FileName,
2888 IndexAllocationContext,
2889 Bitmap,
2890 GetIndexEntryVCN(IndexEntry),
2891 StartEntry,
2892 CurrentEntry,
2893 DirSearch,
2894 CaseSensitive,
2895 OutMFTIndex);
2896 if (NT_SUCCESS(Status))
2897 {
2898 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2899 return Status;
2900 }
2901 }
2902 }
2903
2904 // Are we done?
2905 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_END)
2906 break;
2907
2908 // If we've found a file whose index is greater than or equal to StartEntry that matches the search criteria
2909 if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) >= NTFS_FILE_FIRST_USER_FILE &&
2910 *CurrentEntry >= *StartEntry &&
2911 IndexEntry->FileName.NameType != NTFS_FILE_NAME_DOS &&
2912 CompareFileName(FileName, IndexEntry, DirSearch, CaseSensitive))
2913 {
2914 *StartEntry = *CurrentEntry;
2915 *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
2916 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2917 return STATUS_SUCCESS;
2918 }
2919
2920 // Advance to the next index entry
2921 (*CurrentEntry) += 1;
2922 ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
2923 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
2924 }
2925
2926 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2927
2928 return STATUS_OBJECT_PATH_NOT_FOUND;
2929 }
2930
2931 NTSTATUS
2932 BrowseIndexEntries(PDEVICE_EXTENSION Vcb,
2933 PFILE_RECORD_HEADER MftRecord,
2934 PINDEX_ROOT_ATTRIBUTE IndexRecord,
2935 ULONG IndexBlockSize,
2936 PINDEX_ENTRY_ATTRIBUTE FirstEntry,
2937 PINDEX_ENTRY_ATTRIBUTE LastEntry,
2938 PUNICODE_STRING FileName,
2939 PULONG StartEntry,
2940 PULONG CurrentEntry,
2941 BOOLEAN DirSearch,
2942 BOOLEAN CaseSensitive,
2943 ULONGLONG *OutMFTIndex)
2944 {
2945 NTSTATUS Status;
2946 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
2947 PNTFS_ATTR_CONTEXT IndexAllocationContext;
2948 PNTFS_ATTR_CONTEXT BitmapContext;
2949 PCHAR *BitmapMem;
2950 ULONG *BitmapPtr;
2951 RTL_BITMAP Bitmap;
2952
2953 DPRINT("BrowseIndexEntries(%p, %p, %p, %lu, %p, %p, %wZ, %lu, %lu, %s, %s, %p)\n",
2954 Vcb,
2955 MftRecord,
2956 IndexRecord,
2957 IndexBlockSize,
2958 FirstEntry,
2959 LastEntry,
2960 FileName,
2961 *StartEntry,
2962 *CurrentEntry,
2963 DirSearch ? "TRUE" : "FALSE",
2964 CaseSensitive ? "TRUE" : "FALSE",
2965 OutMFTIndex);
2966
2967 // Find the $I30 index allocation, if there is one
2968 Status = FindAttribute(Vcb, MftRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationContext, NULL);
2969 if (NT_SUCCESS(Status))
2970 {
2971 ULONGLONG BitmapLength;
2972 // Find the bitmap attribute for the index
2973 Status = FindAttribute(Vcb, MftRecord, AttributeBitmap, L"$I30", 4, &BitmapContext, NULL);
2974 if (!NT_SUCCESS(Status))
2975 {
2976 DPRINT1("Potential file system corruption detected!\n");
2977 ReleaseAttributeContext(IndexAllocationContext);
2978 return Status;
2979 }
2980
2981 // Get the length of the bitmap attribute
2982 BitmapLength = AttributeDataLength(BitmapContext->pRecord);
2983
2984 // Allocate memory for the bitmap, including some padding; RtlInitializeBitmap() wants a pointer
2985 // that's ULONG-aligned, and it wants the size of the memory allocated for it to be a ULONG-multiple.
2986 BitmapMem = ExAllocatePoolWithTag(NonPagedPool, BitmapLength + sizeof(ULONG), TAG_NTFS);
2987 if (!BitmapMem)
2988 {
2989 DPRINT1("Error: failed to allocate bitmap!");
2990 ReleaseAttributeContext(BitmapContext);
2991 ReleaseAttributeContext(IndexAllocationContext);
2992 return STATUS_INSUFFICIENT_RESOURCES;
2993 }
2994
2995 RtlZeroMemory(BitmapMem, BitmapLength + sizeof(ULONG));
2996
2997 // RtlInitializeBitmap() wants a pointer that's ULONG-aligned.
2998 BitmapPtr = (PULONG)ALIGN_UP_BY((ULONG_PTR)BitmapMem, sizeof(ULONG));
2999
3000 // Read the existing bitmap data
3001 Status = ReadAttribute(Vcb, BitmapContext, 0, (PCHAR)BitmapPtr, BitmapLength);
3002 if (!NT_SUCCESS(Status))
3003 {
3004 DPRINT1("ERROR: Failed to read bitmap attribute!\n");
3005 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3006 ReleaseAttributeContext(BitmapContext);
3007 ReleaseAttributeContext(IndexAllocationContext);
3008 return Status;
3009 }
3010
3011 // Initialize bitmap
3012 RtlInitializeBitMap(&Bitmap, BitmapPtr, BitmapLength * 8);
3013 }
3014 else
3015 {
3016 // Couldn't find an index allocation
3017 IndexAllocationContext = NULL;
3018 }
3019
3020
3021 // Loop through all Index Entries of index, starting with FirstEntry
3022 IndexEntry = FirstEntry;
3023 while (IndexEntry <= LastEntry)
3024 {
3025 // Does IndexEntry have a sub-node?
3026 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_NODE)
3027 {
3028 if (!(IndexRecord->Header.Flags & INDEX_ROOT_LARGE) || !IndexAllocationContext)
3029 {
3030 DPRINT1("Filesystem corruption detected!\n");
3031 }
3032 else
3033 {
3034 Status = BrowseSubNodeIndexEntries(Vcb,
3035 MftRecord,
3036 IndexBlockSize,
3037 FileName,
3038 IndexAllocationContext,
3039 &Bitmap,
3040 GetIndexEntryVCN(IndexEntry),
3041 StartEntry,
3042 CurrentEntry,
3043 DirSearch,
3044 CaseSensitive,
3045 OutMFTIndex);
3046 if (NT_SUCCESS(Status))
3047 {
3048 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3049 ReleaseAttributeContext(BitmapContext);
3050 ReleaseAttributeContext(IndexAllocationContext);
3051 return Status;
3052 }
3053 }
3054 }
3055
3056 // Are we done?
3057 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_END)
3058 break;
3059
3060 // If we've found a file whose index is greater than or equal to StartEntry that matches the search criteria
3061 if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) >= NTFS_FILE_FIRST_USER_FILE &&
3062 *CurrentEntry >= *StartEntry &&
3063 IndexEntry->FileName.NameType != NTFS_FILE_NAME_DOS &&
3064 CompareFileName(FileName, IndexEntry, DirSearch, CaseSensitive))
3065 {
3066 *StartEntry = *CurrentEntry;
3067 *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
3068 if (IndexAllocationContext)
3069 {
3070 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3071 ReleaseAttributeContext(BitmapContext);
3072 ReleaseAttributeContext(IndexAllocationContext);
3073 }
3074 return STATUS_SUCCESS;
3075 }
3076
3077 // Advance to the next index entry
3078 (*CurrentEntry) += 1;
3079 ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
3080 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
3081 }
3082
3083 if (IndexAllocationContext)
3084 {
3085 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3086 ReleaseAttributeContext(BitmapContext);
3087 ReleaseAttributeContext(IndexAllocationContext);
3088 }
3089
3090 return STATUS_OBJECT_PATH_NOT_FOUND;
3091 }
3092
3093 NTSTATUS
3094 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
3095 ULONGLONG MFTIndex,
3096 PUNICODE_STRING FileName,
3097 PULONG FirstEntry,
3098 BOOLEAN DirSearch,
3099 BOOLEAN CaseSensitive,
3100 ULONGLONG *OutMFTIndex)
3101 {
3102 PFILE_RECORD_HEADER MftRecord;
3103 PNTFS_ATTR_CONTEXT IndexRootCtx;
3104 PINDEX_ROOT_ATTRIBUTE IndexRoot;
3105 PCHAR IndexRecord;
3106 PINDEX_ENTRY_ATTRIBUTE IndexEntry, IndexEntryEnd;
3107 NTSTATUS Status;
3108 ULONG CurrentEntry = 0;
3109
3110 DPRINT("NtfsFindMftRecord(%p, %I64d, %wZ, %lu, %s, %s, %p)\n",
3111 Vcb,
3112 MFTIndex,
3113 FileName,
3114 *FirstEntry,
3115 DirSearch ? "TRUE" : "FALSE",
3116 CaseSensitive ? "TRUE" : "FALSE",
3117 OutMFTIndex);
3118
3119 MftRecord = ExAllocatePoolWithTag(NonPagedPool,
3120 Vcb->NtfsInfo.BytesPerFileRecord,
3121 TAG_NTFS);
3122 if (MftRecord == NULL)
3123 {
3124 return STATUS_INSUFFICIENT_RESOURCES;
3125 }
3126
3127 Status = ReadFileRecord(Vcb, MFTIndex, MftRecord);
3128 if (!NT_SUCCESS(Status))
3129 {
3130 ExFreePoolWithTag(MftRecord, TAG_NTFS);
3131 return Status;
3132 }
3133
3134 ASSERT(MftRecord->Ntfs.Type == NRH_FILE_TYPE);
3135 Status = FindAttribute(Vcb, MftRecord, AttributeIndexRoot, L"$I30", 4, &IndexRootCtx, NULL);
3136 if (!NT_SUCCESS(Status))
3137 {
3138 ExFreePoolWithTag(MftRecord, TAG_NTFS);
3139 return Status;
3140 }
3141
3142 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerIndexRecord, TAG_NTFS);
3143 if (IndexRecord == NULL)
3144 {
3145 ReleaseAttributeContext(IndexRootCtx);
3146 ExFreePoolWithTag(MftRecord, TAG_NTFS);
3147 return STATUS_INSUFFICIENT_RESOURCES;
3148 }
3149
3150 ReadAttribute(Vcb, IndexRootCtx, 0, IndexRecord, Vcb->NtfsInfo.BytesPerIndexRecord);
3151 IndexRoot = (PINDEX_ROOT_ATTRIBUTE)IndexRecord;
3152 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)&IndexRoot->Header + IndexRoot->Header.FirstEntryOffset);
3153 /* Index root is always resident. */
3154 IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)(IndexRecord + IndexRoot->Header.TotalSizeOfEntries);
3155 ReleaseAttributeContext(IndexRootCtx);
3156
3157 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb->NtfsInfo.BytesPerIndexRecord, IndexRoot->SizeOfEntry);
3158
3159 Status = BrowseIndexEntries(Vcb,
3160 MftRecord,
3161 (PINDEX_ROOT_ATTRIBUTE)IndexRecord,
3162 IndexRoot->SizeOfEntry,
3163 IndexEntry,
3164 IndexEntryEnd,
3165 FileName,
3166 FirstEntry,
3167 &CurrentEntry,
3168 DirSearch,
3169 CaseSensitive,
3170 OutMFTIndex);
3171
3172 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
3173 ExFreePoolWithTag(MftRecord, TAG_NTFS);
3174
3175 return Status;
3176 }
3177
3178 NTSTATUS
3179 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
3180 PUNICODE_STRING PathName,
3181 BOOLEAN CaseSensitive,
3182 PFILE_RECORD_HEADER *FileRecord,
3183 PULONGLONG MFTIndex,
3184 ULONGLONG CurrentMFTIndex)
3185 {
3186 UNICODE_STRING Current, Remaining;
3187 NTSTATUS Status;
3188 ULONG FirstEntry = 0;
3189
3190 DPRINT("NtfsLookupFileAt(%p, %wZ, %s, %p, %p, %I64x)\n",
3191 Vcb,
3192 PathName,
3193 CaseSensitive ? "TRUE" : "FALSE",
3194 FileRecord,
3195 MFTIndex,
3196 CurrentMFTIndex);
3197
3198 FsRtlDissectName(*PathName, &Current, &Remaining);
3199
3200 while (Current.Length != 0)
3201 {
3202 DPRINT("Current: %wZ\n", &Current);
3203
3204 Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, &Current, &FirstEntry, FALSE, CaseSensitive, &CurrentMFTIndex);
3205 if (!NT_SUCCESS(Status))
3206 {
3207 return Status;
3208 }
3209
3210 if (Remaining.Length == 0)
3211 break;
3212
3213 FsRtlDissectName(Current, &Current, &Remaining);
3214 }
3215
3216 *FileRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
3217 if (*FileRecord == NULL)
3218 {
3219 DPRINT("NtfsLookupFileAt: Can't allocate MFT record\n");
3220 return STATUS_INSUFFICIENT_RESOURCES;
3221 }
3222
3223 Status = ReadFileRecord(Vcb, CurrentMFTIndex, *FileRecord);
3224 if (!NT_SUCCESS(Status))
3225 {
3226 DPRINT("NtfsLookupFileAt: Can't read MFT record\n");
3227 ExFreePoolWithTag(*FileRecord, TAG_NTFS);
3228 return Status;
3229 }
3230
3231 *MFTIndex = CurrentMFTIndex;
3232
3233 return STATUS_SUCCESS;
3234 }
3235
3236 NTSTATUS
3237 NtfsLookupFile(PDEVICE_EXTENSION Vcb,
3238 PUNICODE_STRING PathName,
3239 BOOLEAN CaseSensitive,
3240 PFILE_RECORD_HEADER *FileRecord,
3241 PULONGLONG MFTIndex)
3242 {
3243 return NtfsLookupFileAt(Vcb, PathName, CaseSensitive, FileRecord, MFTIndex, NTFS_FILE_ROOT);
3244 }
3245
3246 void
3247 NtfsDumpData(ULONG_PTR Buffer, ULONG Length)
3248 {
3249 ULONG i, j;
3250
3251 // dump binary data, 8 bytes at a time
3252 for (i = 0; i < Length; i += 8)
3253 {
3254 // display current offset, in hex
3255 DbgPrint("\t%03x\t", i);
3256
3257 // display hex value of each of the next 8 bytes
3258 for (j = 0; j < 8; j++)
3259 DbgPrint("%02x ", *(PUCHAR)(Buffer + i + j));
3260 DbgPrint("\n");
3261 }
3262 }
3263
3264 /**
3265 * @name NtfsDumpFileRecord
3266 * @implemented
3267 *
3268 * Provides diagnostic information about a file record. Prints a hex dump
3269 * of the entire record (based on the size reported by FileRecord->ByesInUse),
3270 * then prints a dump of each attribute.
3271 *
3272 * @param Vcb
3273 * Pointer to a DEVICE_EXTENSION describing the volume.
3274 *
3275 * @param FileRecord
3276 * Pointer to the file record to be analyzed.
3277 *
3278 * @remarks
3279 * FileRecord must be a complete file record at least FileRecord->BytesAllocated
3280 * in size, and not just the header.
3281 *
3282 */
3283 VOID
3284 NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb,
3285 PFILE_RECORD_HEADER FileRecord)
3286 {
3287 ULONG i, j;
3288
3289 // dump binary data, 8 bytes at a time
3290 for (i = 0; i < FileRecord->BytesInUse; i += 8)
3291 {
3292 // display current offset, in hex
3293 DbgPrint("\t%03x\t", i);
3294
3295 // display hex value of each of the next 8 bytes
3296 for (j = 0; j < 8; j++)
3297 DbgPrint("%02x ", *(PUCHAR)((ULONG_PTR)FileRecord + i + j));
3298 DbgPrint("\n");
3299 }
3300
3301 NtfsDumpFileAttributes(Vcb, FileRecord);
3302 }
3303
3304 NTSTATUS
3305 NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
3306 PUNICODE_STRING SearchPattern,
3307 PULONG FirstEntry,
3308 PFILE_RECORD_HEADER *FileRecord,
3309 PULONGLONG MFTIndex,
3310 ULONGLONG CurrentMFTIndex,
3311 BOOLEAN CaseSensitive)
3312 {
3313 NTSTATUS Status;
3314
3315 DPRINT("NtfsFindFileAt(%p, %wZ, %lu, %p, %p, %I64x, %s)\n",
3316 Vcb,
3317 SearchPattern,
3318 *FirstEntry,
3319 FileRecord,
3320 MFTIndex,
3321 CurrentMFTIndex,
3322 (CaseSensitive ? "TRUE" : "FALSE"));
3323
3324 Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, SearchPattern, FirstEntry, TRUE, CaseSensitive, &CurrentMFTIndex);
3325 if (!NT_SUCCESS(Status))
3326 {
3327 DPRINT("NtfsFindFileAt: NtfsFindMftRecord() failed with status 0x%08lx\n", Status);
3328 return Status;
3329 }
3330
3331 *FileRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
3332 if (*FileRecord == NULL)
3333 {
3334 DPRINT("NtfsFindFileAt: Can't allocate MFT record\n");
3335 return STATUS_INSUFFICIENT_RESOURCES;
3336 }
3337
3338 Status = ReadFileRecord(Vcb, CurrentMFTIndex, *FileRecord);
3339 if (!NT_SUCCESS(Status))
3340 {
3341 DPRINT("NtfsFindFileAt: Can't read MFT record\n");
3342 ExFreePoolWithTag(*FileRecord, TAG_NTFS);
3343 return Status;
3344 }
3345
3346 *MFTIndex = CurrentMFTIndex;
3347
3348 return STATUS_SUCCESS;
3349 }
3350
3351 /* EOF */