6 #define CACHEPAGESIZE(pDeviceExt) \
7 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
8 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE)
10 #define TAG_NTFS 'SFTN'
12 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
14 #define DEVICE_NAME L"\\Ntfs"
17 typedef struct _BIOS_PARAMETERS_BLOCK
19 USHORT BytesPerSector
; // 0x0B
20 UCHAR SectorsPerCluster
; // 0x0D
21 UCHAR Unused0
[7]; // 0x0E, checked when volume is mounted
22 UCHAR MediaId
; // 0x15
23 UCHAR Unused1
[2]; // 0x16
24 USHORT SectorsPerTrack
; // 0x18
26 UCHAR Unused2
[4]; // 0x1C
27 UCHAR Unused3
[4]; // 0x20, checked when volume is mounted
28 } BIOS_PARAMETERS_BLOCK
, *PBIOS_PARAMETERS_BLOCK
;
30 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK
32 USHORT Unknown
[2]; // 0x24, always 80 00 80 00
33 ULONGLONG SectorCount
; // 0x28
34 ULONGLONG MftLocation
; // 0x30
35 ULONGLONG MftMirrLocation
; // 0x38
36 CHAR ClustersPerMftRecord
; // 0x40
37 UCHAR Unused4
[3]; // 0x41
38 CHAR ClustersPerIndexRecord
; // 0x44
39 UCHAR Unused5
[3]; // 0x45
40 ULONGLONG SerialNumber
; // 0x48
41 UCHAR Checksum
[4]; // 0x50
42 } EXTENDED_BIOS_PARAMETERS_BLOCK
, *PEXTENDED_BIOS_PARAMETERS_BLOCK
;
44 typedef struct _BOOT_SECTOR
46 UCHAR Jump
[3]; // 0x00
47 UCHAR OEMID
[8]; // 0x03
48 BIOS_PARAMETERS_BLOCK BPB
;
49 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB
;
50 UCHAR BootStrap
[426]; // 0x54
51 USHORT EndSector
; // 0x1FE
52 } BOOT_SECTOR
, *PBOOT_SECTOR
;
55 //typedef struct _BootSector BootSector;
57 typedef struct _NTFS_INFO
60 ULONG SectorsPerCluster
;
61 ULONG BytesPerCluster
;
62 ULONGLONG SectorCount
;
63 ULARGE_INTEGER MftStart
;
64 ULARGE_INTEGER MftMirrStart
;
65 ULONG BytesPerFileRecord
;
66 ULONG BytesPerIndexRecord
;
68 ULONGLONG SerialNumber
;
69 USHORT VolumeLabelLength
;
70 WCHAR VolumeLabel
[MAXIMUM_VOLUME_LABEL_LENGTH
];
75 } NTFS_INFO
, *PNTFS_INFO
;
77 #define NTFS_TYPE_CCB '20SF'
78 #define NTFS_TYPE_FCB '30SF'
79 #define NTFS_TYPE_VCB '50SF'
80 #define NTFS_TYPE_IRP_CONTEST '60SF'
81 #define NTFS_TYPE_GLOBAL_DATA '70SF'
87 } NTFSIDENTIFIER
, *PNTFSIDENTIFIER
;
91 NTFSIDENTIFIER Identifier
;
93 ERESOURCE DirResource
;
94 // ERESOURCE FatResource;
96 KSPIN_LOCK FcbListLock
;
97 LIST_ENTRY FcbListHead
;
100 PDEVICE_OBJECT StorageDevice
;
101 PFILE_OBJECT StreamFileObject
;
103 struct _NTFS_ATTR_CONTEXT
* MFTContext
;
104 struct _FILE_RECORD_HEADER
* MasterFileTable
;
105 struct _FCB
*VolumeFcb
;
109 } DEVICE_EXTENSION
, *PDEVICE_EXTENSION
, NTFS_VCB
, *PNTFS_VCB
;
113 NTFSIDENTIFIER Identifier
;
115 PFILE_OBJECT PtrFileObject
;
116 LARGE_INTEGER CurrentByteOffset
;
117 /* for DirectoryControl */
119 /* for DirectoryControl */
120 PWCHAR DirectorySearchPattern
;
123 } NTFS_CCB
, *PNTFS_CCB
;
125 #define TAG_CCB 'BCCI'
129 NTFSIDENTIFIER Identifier
;
131 PDRIVER_OBJECT DriverObject
;
132 PDEVICE_OBJECT DeviceObject
;
133 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks
;
135 } NTFS_GLOBAL_DATA
, *PNTFS_GLOBAL_DATA
;
140 AttributeStandardInformation
= 0x10,
141 AttributeAttributeList
= 0x20,
142 AttributeFileName
= 0x30,
143 AttributeObjectId
= 0x40,
144 AttributeSecurityDescriptor
= 0x50,
145 AttributeVolumeName
= 0x60,
146 AttributeVolumeInformation
= 0x70,
147 AttributeData
= 0x80,
148 AttributeIndexRoot
= 0x90,
149 AttributeIndexAllocation
= 0xA0,
150 AttributeBitmap
= 0xB0,
151 AttributeReparsePoint
= 0xC0,
152 AttributeEAInformation
= 0xD0,
154 AttributePropertySet
= 0xF0,
155 AttributeLoggedUtilityStream
= 0x100,
156 AttributeEnd
= 0xFFFFFFFF
157 } ATTRIBUTE_TYPE
, *PATTRIBUTE_TYPE
;
159 #define NTFS_FILE_MFT 0
160 #define NTFS_FILE_MFTMIRR 1
161 #define NTFS_FILE_LOGFILE 2
162 #define NTFS_FILE_VOLUME 3
163 #define NTFS_FILE_ATTRDEF 4
164 #define NTFS_FILE_ROOT 5
165 #define NTFS_FILE_BITMAP 6
166 #define NTFS_FILE_BOOT 7
167 #define NTFS_FILE_BADCLUS 8
168 #define NTFS_FILE_QUOTA 9
169 #define NTFS_FILE_UPCASE 10
170 #define NTFS_FILE_EXTEND 11
172 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
174 #define COLLATION_BINARY 0x00
175 #define COLLATION_FILE_NAME 0x01
176 #define COLLATION_UNICODE_STRING 0x02
177 #define COLLATION_NTOFS_ULONG 0x10
178 #define COLLATION_NTOFS_SID 0x11
179 #define COLLATION_NTOFS_SECURITY_HASH 0x12
180 #define COLLATION_NTOFS_ULONGS 0x13
182 #define INDEX_ROOT_SMALL 0x0
183 #define INDEX_ROOT_LARGE 0x1
185 #define NTFS_INDEX_ENTRY_NODE 1
186 #define NTFS_INDEX_ENTRY_END 2
188 #define NTFS_FILE_NAME_POSIX 0
189 #define NTFS_FILE_NAME_WIN32 1
190 #define NTFS_FILE_NAME_DOS 2
191 #define NTFS_FILE_NAME_WIN32_AND_DOS 3
193 #define NTFS_FILE_TYPE_READ_ONLY 0x1
194 #define NTFS_FILE_TYPE_HIDDEN 0x2
195 #define NTFS_FILE_TYPE_SYSTEM 0x4
196 #define NTFS_FILE_TYPE_ARCHIVE 0x20
197 #define NTFS_FILE_TYPE_COMPRESSED 0x800
198 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000
202 ULONG Type
; /* Magic number 'FILE' */
203 USHORT UsaOffset
; /* Offset to the update sequence */
204 USHORT UsaCount
; /* Size in words of Update Sequence Number & Array (S) */
205 ULONGLONG Lsn
; /* $LogFile Sequence Number (LSN) */
206 } NTFS_RECORD_HEADER
, *PNTFS_RECORD_HEADER
;
208 /* NTFS_RECORD_HEADER.Type */
209 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */
212 typedef struct _FILE_RECORD_HEADER
214 NTFS_RECORD_HEADER Ntfs
;
215 USHORT SequenceNumber
; /* Sequence number */
216 USHORT LinkCount
; /* Hard link count */
217 USHORT AttributeOffset
; /* Offset to the first Attribute */
218 USHORT Flags
; /* Flags */
219 ULONG BytesInUse
; /* Real size of the FILE record */
220 ULONG BytesAllocated
; /* Allocated size of the FILE record */
221 ULONGLONG BaseFileRecord
; /* File reference to the base FILE record */
222 USHORT NextAttributeNumber
; /* Next Attribute Id */
223 USHORT Pading
; /* Align to 4 UCHAR boundary (XP) */
224 ULONG MFTRecordNumber
; /* Number of this MFT Record (XP) */
225 } FILE_RECORD_HEADER
, *PFILE_RECORD_HEADER
;
227 /* Flags in FILE_RECORD_HEADER */
229 #define FRH_IN_USE 0x0001 /* Record is in use */
230 #define FRH_DIRECTORY 0x0002 /* Record is a directory */
231 #define FRH_UNKNOWN1 0x0004 /* Don't know */
232 #define FRH_UNKNOWN2 0x0008 /* Don't know */
245 // Resident attributes
253 // Non-resident attributes
257 ULONGLONG HighestVCN
;
258 USHORT MappingPairsOffset
;
259 USHORT CompressionUnit
;
261 LONGLONG AllocatedSize
;
263 LONGLONG InitializedSize
;
264 LONGLONG CompressedSize
;
267 } NTFS_ATTR_RECORD
, *PNTFS_ATTR_RECORD
;
271 ULONGLONG CreationTime
;
272 ULONGLONG ChangeTime
;
273 ULONGLONG LastWriteTime
;
274 ULONGLONG LastAccessTime
;
276 ULONG AlignmentOrReserved
[3];
280 ULONGLONG QuotaCharge
;
283 } STANDARD_INFORMATION
, *PSTANDARD_INFORMATION
;
288 ATTRIBUTE_TYPE AttributeType
;
292 ULONGLONG StartVcn
; // LowVcn
293 ULONGLONG FileReferenceNumber
;
294 USHORT AttributeNumber
;
295 USHORT AlignmentOrReserved
[3];
296 } ATTRIBUTE_LIST
, *PATTRIBUTE_LIST
;
301 ULONGLONG DirectoryFileReferenceNumber
;
302 ULONGLONG CreationTime
;
303 ULONGLONG ChangeTime
;
304 ULONGLONG LastWriteTime
;
305 ULONGLONG LastAccessTime
;
306 ULONGLONG AllocatedSize
;
308 ULONG FileAttributes
;
309 ULONG AlignmentOrReserved
;
313 } FILENAME_ATTRIBUTE
, *PFILENAME_ATTRIBUTE
;
317 ULONG FirstEntryOffset
;
318 ULONG TotalSizeOfEntries
;
322 } INDEX_HEADER_ATTRIBUTE
, *PINDEX_HEADER_ATTRIBUTE
;
329 UCHAR ClustersPerIndexRecord
;
331 INDEX_HEADER_ATTRIBUTE Header
;
332 } INDEX_ROOT_ATTRIBUTE
, *PINDEX_ROOT_ATTRIBUTE
;
336 NTFS_RECORD_HEADER Ntfs
;
338 INDEX_HEADER_ATTRIBUTE Header
;
339 } INDEX_BUFFER
, *PINDEX_BUFFER
;
347 ULONGLONG IndexedFile
;
360 FILENAME_ATTRIBUTE FileName
;
361 } INDEX_ENTRY_ATTRIBUTE
, *PINDEX_ENTRY_ATTRIBUTE
;
370 } VOLINFO_ATTRIBUTE
, *PVOLINFO_ATTRIBUTE
;
374 NTFSIDENTIFIER Identifier
;
378 WORK_QUEUE_ITEM WorkQueueItem
;
381 PDEVICE_OBJECT DeviceObject
;
382 NTSTATUS SavedExceptionCode
;
383 } NTFS_IRP_CONTEXT
, *PNTFS_IRP_CONTEXT
;
385 typedef struct _NTFS_ATTR_CONTEXT
388 ULONGLONG CacheRunOffset
;
389 LONGLONG CacheRunStartLCN
;
390 ULONGLONG CacheRunLength
;
391 LONGLONG CacheRunLastLCN
;
392 ULONGLONG CacheRunCurrentOffset
;
393 NTFS_ATTR_RECORD Record
;
394 } NTFS_ATTR_CONTEXT
, *PNTFS_ATTR_CONTEXT
;
396 #define FCB_CACHE_INITIALIZED 0x0001
397 #define FCB_IS_VOLUME_STREAM 0x0002
398 #define FCB_IS_VOLUME 0x0004
403 NTFSIDENTIFIER Identifier
;
405 FSRTL_COMMON_FCB_HEADER RFCB
;
406 SECTION_OBJECT_POINTERS SectionObjectPointers
;
408 PFILE_OBJECT FileObject
;
411 WCHAR
*ObjectName
; /* point on filename (250 chars max) in PathName */
412 WCHAR PathName
[MAX_PATH
]; /* path+filename 260 max */
414 ERESOURCE PagingIoResource
;
415 ERESOURCE MainResource
;
417 LIST_ENTRY FcbListEntry
;
418 struct _FCB
* ParentFcb
;
427 FILENAME_ATTRIBUTE Entry
;
429 } NTFS_FCB
, *PNTFS_FCB
;
431 extern PNTFS_GLOBAL_DATA NtfsGlobalData
;
433 //int CdfsStrcmpi( wchar_t *str1, wchar_t *str2 );
434 //void CdfsWstrcpy( wchar_t *str1, wchar_t *str2, int max );
440 //NtfsDumpAttribute(PATTRIBUTE Attribute);
443 DecodeRun(PUCHAR DataRun
,
444 LONGLONG
*DataRunOffset
,
445 ULONGLONG
*DataRunLength
);
448 NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord
);
451 GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord
, UCHAR NameType
);
456 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject
,
457 IN LONGLONG StartingOffset
,
459 IN OUT PUCHAR Buffer
,
460 IN BOOLEAN Override
);
463 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject
,
465 IN ULONG SectorCount
,
467 IN OUT PUCHAR Buffer
,
468 IN BOOLEAN Override
);
471 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject
,
472 IN ULONG ControlCode
,
473 IN PVOID InputBuffer
,
474 IN ULONG InputBufferSize
,
475 IN OUT PVOID OutputBuffer
,
476 IN OUT PULONG OutputBufferSize
,
477 IN BOOLEAN Override
);
483 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt
,
484 PFILE_OBJECT FileObject
);
486 DRIVER_DISPATCH NtfsFsdClose
;
488 NtfsFsdClose(PDEVICE_OBJECT DeviceObject
,
494 DRIVER_DISPATCH NtfsFsdCreate
;
496 NtfsFsdCreate(PDEVICE_OBJECT DeviceObject
,
502 DRIVER_DISPATCH NtfsFsdDirectoryControl
;
504 NtfsFsdDirectoryControl(PDEVICE_OBJECT DeviceObject
,
510 DRIVER_DISPATCH NtfsFsdDispatch
;
512 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject
,
519 NtfsAcqLazyWrite(PVOID Context
,
523 NtfsRelLazyWrite(PVOID Context
);
526 NtfsAcqReadAhead(PVOID Context
,
530 NtfsRelReadAhead(PVOID Context
);
536 NtfsCreateFCB(PCWSTR FileName
,
540 NtfsDestroyFCB(PNTFS_FCB Fcb
);
543 NtfsFCBIsDirectory(PNTFS_FCB Fcb
);
546 NtfsFCBIsRoot(PNTFS_FCB Fcb
);
549 NtfsGrabFCB(PNTFS_VCB Vcb
,
553 NtfsReleaseFCB(PNTFS_VCB Vcb
,
557 NtfsAddFCBToTable(PNTFS_VCB Vcb
,
561 NtfsGrabFCBFromTable(PNTFS_VCB Vcb
,
565 NtfsFCBInitializeCache(PNTFS_VCB Vcb
,
569 NtfsMakeRootFCB(PNTFS_VCB Vcb
);
572 NtfsOpenRootFCB(PNTFS_VCB Vcb
);
575 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb
,
577 PFILE_OBJECT FileObject
);
580 NtfsGetFCBForFile(PNTFS_VCB Vcb
,
581 PNTFS_FCB
*pParentFCB
,
583 const PWSTR pFileName
);
588 DRIVER_DISPATCH NtfsFsdQueryInformation
;
590 NtfsFsdQueryInformation(PDEVICE_OBJECT DeviceObject
,
596 DRIVER_DISPATCH NtfsFsdFileSystemControl
;
598 NtfsFsdFileSystemControl(PDEVICE_OBJECT DeviceObject
,
604 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context
);
607 ReadAttribute(PDEVICE_EXTENSION Vcb
,
608 PNTFS_ATTR_CONTEXT Context
,
614 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord
);
617 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord
);
620 ReadFileRecord(PDEVICE_EXTENSION Vcb
,
622 PFILE_RECORD_HEADER file
);
625 FindAttribute(PDEVICE_EXTENSION Vcb
,
626 PFILE_RECORD_HEADER MftRecord
,
630 PNTFS_ATTR_CONTEXT
* AttrCtx
);
633 ReadVCN(PDEVICE_EXTENSION Vcb
,
634 PFILE_RECORD_HEADER file
,
641 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb
,
642 PNTFS_RECORD_HEADER Record
);
645 ReadLCN(PDEVICE_EXTENSION Vcb
,
651 EnumerAttribute(PFILE_RECORD_HEADER file
,
652 PDEVICE_EXTENSION Vcb
,
653 PDEVICE_OBJECT DeviceObject
);
656 NtfsLookupFile(PDEVICE_EXTENSION Vcb
,
657 PUNICODE_STRING PathName
,
658 PFILE_RECORD_HEADER
*FileRecord
,
659 PNTFS_ATTR_CONTEXT
*DataContext
,
660 PULONGLONG MFTIndex
);
663 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb
,
664 PUNICODE_STRING PathName
,
665 PFILE_RECORD_HEADER
*FileRecord
,
666 PNTFS_ATTR_CONTEXT
*DataContext
,
668 ULONGLONG CurrentMFTIndex
);
671 NtfsFindFileAt(PDEVICE_EXTENSION Vcb
,
672 PUNICODE_STRING SearchPattern
,
674 PFILE_RECORD_HEADER
*FileRecord
,
675 PNTFS_ATTR_CONTEXT
*DataContext
,
677 ULONGLONG CurrentMFTIndex
);
682 NtfsIsIrpTopLevel(PIRP Irp
);
685 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject
,
690 wstrcmpjoki(PWSTR s1
, PWSTR s2
);
693 CdfsSwapString(PWCHAR Out
,
699 NtfsFileFlagsToAttributes(ULONG NtfsAttributes
,
700 PULONG FileAttributes
);
705 DRIVER_DISPATCH NtfsFsdRead
;
707 NtfsFsdRead(PDEVICE_OBJECT DeviceObject
,
710 DRIVER_DISPATCH NtfsFsdWrite
;
712 NtfsFsdWrite(PDEVICE_OBJECT DeviceObject
,
719 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt
);
722 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext
);
725 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext
);
730 DRIVER_INITIALIZE DriverEntry
;
734 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject
);