6 #define CACHEPAGESIZE(pDeviceExt) \
7 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
8 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE)
10 #define TAG_NTFS 'SFTN'
12 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
14 #define DEVICE_NAME L"\\Ntfs"
17 typedef struct _BIOS_PARAMETERS_BLOCK
19 USHORT BytesPerSector
; // 0x0B
20 UCHAR SectorsPerCluster
; // 0x0D
21 UCHAR Unused0
[7]; // 0x0E, checked when volume is mounted
22 UCHAR MediaId
; // 0x15
23 UCHAR Unused1
[2]; // 0x16
24 USHORT SectorsPerTrack
; // 0x18
26 UCHAR Unused2
[4]; // 0x1C
27 UCHAR Unused3
[4]; // 0x20, checked when volume is mounted
28 } BIOS_PARAMETERS_BLOCK
, *PBIOS_PARAMETERS_BLOCK
;
30 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK
32 USHORT Unknown
[2]; // 0x24, always 80 00 80 00
33 ULONGLONG SectorCount
; // 0x28
34 ULONGLONG MftLocation
; // 0x30
35 ULONGLONG MftMirrLocation
; // 0x38
36 CHAR ClustersPerMftRecord
; // 0x40
37 UCHAR Unused4
[3]; // 0x41
38 CHAR ClustersPerIndexRecord
; // 0x44
39 UCHAR Unused5
[3]; // 0x45
40 ULONGLONG SerialNumber
; // 0x48
41 UCHAR Checksum
[4]; // 0x50
42 } EXTENDED_BIOS_PARAMETERS_BLOCK
, *PEXTENDED_BIOS_PARAMETERS_BLOCK
;
44 typedef struct _BOOT_SECTOR
46 UCHAR Jump
[3]; // 0x00
47 UCHAR OEMID
[8]; // 0x03
48 BIOS_PARAMETERS_BLOCK BPB
;
49 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB
;
50 UCHAR BootStrap
[426]; // 0x54
51 USHORT EndSector
; // 0x1FE
52 } BOOT_SECTOR
, *PBOOT_SECTOR
;
55 //typedef struct _BootSector BootSector;
57 typedef struct _NTFS_INFO
60 ULONG SectorsPerCluster
;
61 ULONG BytesPerCluster
;
62 ULONGLONG SectorCount
;
63 ULARGE_INTEGER MftStart
;
64 ULARGE_INTEGER MftMirrStart
;
65 ULONG BytesPerFileRecord
;
66 ULONG BytesPerIndexRecord
;
68 ULONGLONG SerialNumber
;
69 USHORT VolumeLabelLength
;
70 WCHAR VolumeLabel
[MAXIMUM_VOLUME_LABEL_LENGTH
];
75 } NTFS_INFO
, *PNTFS_INFO
;
77 #define NTFS_TYPE_CCB '20SF'
78 #define NTFS_TYPE_FCB '30SF'
79 #define NTFS_TYPE_VCB '50SF'
80 #define NTFS_TYPE_IRP_CONTEST '60SF'
81 #define NTFS_TYPE_GLOBAL_DATA '70SF'
87 } NTFSIDENTIFIER
, *PNTFSIDENTIFIER
;
92 NTFSIDENTIFIER Identifier
;
94 ERESOURCE DirResource
;
95 // ERESOURCE FatResource;
97 KSPIN_LOCK FcbListLock
;
98 LIST_ENTRY FcbListHead
;
101 PDEVICE_OBJECT StorageDevice
;
102 PFILE_OBJECT StreamFileObject
;
104 struct _FCB
*VolumeFcb
;
108 } DEVICE_EXTENSION
, *PDEVICE_EXTENSION
, NTFS_VCB
, *PNTFS_VCB
;
111 #define FCB_CACHE_INITIALIZED 0x0001
112 #define FCB_IS_VOLUME_STREAM 0x0002
113 #define FCB_IS_VOLUME 0x0004
118 NTFSIDENTIFIER Identifier
;
120 FSRTL_COMMON_FCB_HEADER RFCB
;
121 SECTION_OBJECT_POINTERS SectionObjectPointers
;
123 PFILE_OBJECT FileObject
;
126 WCHAR
*ObjectName
; /* point on filename (250 chars max) in PathName */
127 WCHAR PathName
[MAX_PATH
]; /* path+filename 260 max */
129 ERESOURCE PagingIoResource
;
130 ERESOURCE MainResource
;
132 LIST_ENTRY FcbListEntry
;
133 struct _FCB
* ParentFcb
;
142 } NTFS_FCB
, *PNTFS_FCB
;
147 NTFSIDENTIFIER Identifier
;
149 PFILE_OBJECT PtrFileObject
;
150 LARGE_INTEGER CurrentByteOffset
;
151 /* for DirectoryControl */
153 /* for DirectoryControl */
154 PWCHAR DirectorySearchPattern
;
157 } NTFS_CCB
, *PNTFS_CCB
;
159 #define TAG_CCB 'BCCI'
163 NTFSIDENTIFIER Identifier
;
165 PDRIVER_OBJECT DriverObject
;
166 PDEVICE_OBJECT DeviceObject
;
167 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks
;
169 } NTFS_GLOBAL_DATA
, *PNTFS_GLOBAL_DATA
;
174 AttributeStandardInformation
= 0x10,
175 AttributeAttributeList
= 0x20,
176 AttributeFileName
= 0x30,
177 AttributeObjectId
= 0x40,
178 AttributeSecurityDescriptor
= 0x50,
179 AttributeVolumeName
= 0x60,
180 AttributeVolumeInformation
= 0x70,
181 AttributeData
= 0x80,
182 AttributeIndexRoot
= 0x90,
183 AttributeIndexAllocation
= 0xA0,
184 AttributeBitmap
= 0xB0,
185 AttributeReparsePoint
= 0xC0,
186 AttributeEAInformation
= 0xD0,
188 AttributePropertySet
= 0xF0,
189 AttributeLoggedUtilityStream
= 0x100
190 } ATTRIBUTE_TYPE
, *PATTRIBUTE_TYPE
;
192 #define COLLATION_BINARY 0x00
193 #define COLLATION_FILE_NAME 0x01
194 #define COLLATION_UNICODE_STRING 0x02
195 #define COLLATION_NTOFS_ULONG 0x10
196 #define COLLATION_NTOFS_SID 0x11
197 #define COLLATION_NTOFS_SECURITY_HASH 0x12
198 #define COLLATION_NTOFS_ULONGS 0x13
200 #define INDEX_ROOT_SMALL 0x0
201 #define INDEX_ROOT_LARGE 0x1
205 ULONG Type
; /* Magic number 'FILE' */
206 USHORT UsaOffset
; /* Offset to the update sequence */
207 USHORT UsaCount
; /* Size in words of Update Sequence Number & Array (S) */
208 ULONGLONG Lsn
; /* $LogFile Sequence Number (LSN) */
209 } NTFS_RECORD_HEADER
, *PNTFS_RECORD_HEADER
;
211 /* NTFS_RECORD_HEADER.Type */
212 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */
217 NTFS_RECORD_HEADER Ntfs
;
218 USHORT SequenceNumber
; /* Sequence number */
219 USHORT LinkCount
; /* Hard link count */
220 USHORT AttributeOffset
; /* Offset to the first Attribute */
221 USHORT Flags
; /* Flags */
222 ULONG BytesInUse
; /* Real size of the FILE record */
223 ULONG BytesAllocated
; /* Allocated size of the FILE record */
224 ULONGLONG BaseFileRecord
; /* File reference to the base FILE record */
225 USHORT NextAttributeNumber
; /* Next Attribute Id */
226 USHORT Pading
; /* Align to 4 UCHAR boundary (XP) */
227 ULONG MFTRecordNumber
; /* Number of this MFT Record (XP) */
228 } FILE_RECORD_HEADER
, *PFILE_RECORD_HEADER
;
230 /* Flags in FILE_RECORD_HEADER */
232 #define FRH_IN_USE 0x0001 /* Record is in use */
233 #define FRH_DIRECTORY 0x0002 /* Record is a directory */
234 #define FRH_UNKNOWN1 0x0004 /* Don't know */
235 #define FRH_UNKNOWN2 0x0008 /* Don't know */
239 ATTRIBUTE_TYPE AttributeType
;
245 USHORT AttributeNumber
;
246 } ATTRIBUTE
, *PATTRIBUTE
;
255 } RESIDENT_ATTRIBUTE
, *PRESIDENT_ATTRIBUTE
;
260 ULONGLONG StartVcn
; // LowVcn
261 ULONGLONG LastVcn
; // HighVcn
262 USHORT RunArrayOffset
;
263 USHORT CompressionUnit
;
266 ULONGLONG AllocatedSize
;
268 ULONGLONG InitializedSize
;
269 ULONGLONG CompressedSize
;
270 } NONRESIDENT_ATTRIBUTE
, *PNONRESIDENT_ATTRIBUTE
;
275 ULONGLONG CreationTime
;
276 ULONGLONG ChangeTime
;
277 ULONGLONG LastWriteTime
;
278 ULONGLONG LastAccessTime
;
280 ULONG AlignmentOrReserved
[3];
284 ULONGLONG QuotaCharge
;
287 } STANDARD_INFORMATION
, *PSTANDARD_INFORMATION
;
292 ATTRIBUTE_TYPE AttributeType
;
296 ULONGLONG StartVcn
; // LowVcn
297 ULONGLONG FileReferenceNumber
;
298 USHORT AttributeNumber
;
299 USHORT AlignmentOrReserved
[3];
300 } ATTRIBUTE_LIST
, *PATTRIBUTE_LIST
;
305 ULONGLONG DirectoryFileReferenceNumber
;
306 ULONGLONG CreationTime
;
307 ULONGLONG ChangeTime
;
308 ULONGLONG LastWriteTime
;
309 ULONGLONG LastAccessTime
;
310 ULONGLONG AllocatedSize
;
312 ULONG FileAttributes
;
313 ULONG AlignmentOrReserved
;
317 } FILENAME_ATTRIBUTE
, *PFILENAME_ATTRIBUTE
;
321 ULONG FirstEntryOffset
;
322 ULONG TotalSizeOfEntries
;
326 } INDEX_HEADER_ATTRIBUTE
, *PINDEX_HEADER_ATTRIBUTE
;
333 UCHAR ClustersPerIndexRecord
;
335 INDEX_HEADER_ATTRIBUTE Header
;
336 } INDEX_ROOT_ATTRIBUTE
, *PINDEX_ROOT_ATTRIBUTE
;
345 } VOLINFO_ATTRIBUTE
, *PVOLINFO_ATTRIBUTE
;
349 NTFSIDENTIFIER Identifier
;
353 WORK_QUEUE_ITEM WorkQueueItem
;
356 PDEVICE_OBJECT DeviceObject
;
357 NTSTATUS SavedExceptionCode
;
358 } NTFS_IRP_CONTEXT
, *PNTFS_IRP_CONTEXT
;
361 extern PNTFS_GLOBAL_DATA NtfsGlobalData
;
363 //int CdfsStrcmpi( wchar_t *str1, wchar_t *str2 );
364 //void CdfsWstrcpy( wchar_t *str1, wchar_t *str2, int max );
370 //NtfsDumpAttribute(PATTRIBUTE Attribute);
372 //LONGLONG RunLCN(PUCHAR run);
374 //ULONG RunLength(PUCHAR run);
377 FindRun(PNONRESIDENT_ATTRIBUTE NresAttr
,
383 NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord
);
389 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject
,
391 IN ULONG SectorCount
,
393 IN OUT PUCHAR Buffer
,
394 IN BOOLEAN Override
);
397 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject
,
398 IN ULONG ControlCode
,
399 IN PVOID InputBuffer
,
400 IN ULONG InputBufferSize
,
401 IN OUT PVOID OutputBuffer
,
402 IN OUT PULONG OutputBufferSize
,
403 IN BOOLEAN Override
);
408 DRIVER_DISPATCH NtfsFsdClose
;
410 NtfsFsdClose(PDEVICE_OBJECT DeviceObject
,
416 DRIVER_DISPATCH NtfsFsdCreate
;
418 NtfsFsdCreate(PDEVICE_OBJECT DeviceObject
,
424 DRIVER_DISPATCH NtfsFsdDirectoryControl
;
426 NtfsFsdDirectoryControl(PDEVICE_OBJECT DeviceObject
,
432 DRIVER_DISPATCH NtfsFsdDispatch
;
434 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject
,
441 NtfsAcqLazyWrite(PVOID Context
,
445 NtfsRelLazyWrite(PVOID Context
);
448 NtfsAcqReadAhead(PVOID Context
,
452 NtfsRelReadAhead(PVOID Context
);
458 NtfsCreateFCB(PCWSTR FileName
,
462 NtfsDestroyFCB(PNTFS_FCB Fcb
);
465 NtfsFCBIsDirectory(PNTFS_FCB Fcb
);
468 NtfsFCBIsRoot(PNTFS_FCB Fcb
);
471 NtfsGrabFCB(PNTFS_VCB Vcb
,
475 NtfsReleaseFCB(PNTFS_VCB Vcb
,
479 NtfsAddFCBToTable(PNTFS_VCB Vcb
,
483 NtfsGrabFCBFromTable(PNTFS_VCB Vcb
,
487 NtfsFCBInitializeCache(PNTFS_VCB Vcb
,
491 NtfsMakeRootFCB(PNTFS_VCB Vcb
);
494 NtfsOpenRootFCB(PNTFS_VCB Vcb
);
497 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb
,
499 PFILE_OBJECT FileObject
);
502 NtfsGetFCBForFile(PNTFS_VCB Vcb
,
503 PNTFS_FCB
*pParentFCB
,
505 const PWSTR pFileName
);
510 DRIVER_DISPATCH NtfsFsdQueryInformation
;
512 NtfsFsdQueryInformation(PDEVICE_OBJECT DeviceObject
,
518 DRIVER_DISPATCH NtfsFsdFileSystemControl
;
520 NtfsFsdFileSystemControl(PDEVICE_OBJECT DeviceObject
,
526 NtfsOpenMft(PDEVICE_EXTENSION Vcb
);
530 ReadAttribute(PATTRIBUTE attr
,
532 PDEVICE_EXTENSION Vcb
,
533 PDEVICE_OBJECT DeviceObject
);
536 AttributeDataLength(PATTRIBUTE attr
);
539 AttributeAllocatedLength(PATTRIBUTE Attribute
);
542 ReadFileRecord(PDEVICE_EXTENSION Vcb
,
544 PFILE_RECORD_HEADER file
,
545 PFILE_RECORD_HEADER Mft
);
548 FindAttribute(PFILE_RECORD_HEADER file
,
553 AttributeLengthAllocated(PATTRIBUTE attr
);
556 ReadVCN(PDEVICE_EXTENSION Vcb
,
557 PFILE_RECORD_HEADER file
,
564 FixupUpdateSequenceArray(PFILE_RECORD_HEADER file
);
567 ReadExternalAttribute(PDEVICE_EXTENSION Vcb
,
568 PNONRESIDENT_ATTRIBUTE NresAttr
,
574 ReadLCN(PDEVICE_EXTENSION Vcb
,
580 EnumerAttribute(PFILE_RECORD_HEADER file
,
581 PDEVICE_EXTENSION Vcb
,
582 PDEVICE_OBJECT DeviceObject
);
588 NtfsIsIrpTopLevel(PIRP Irp
);
591 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject
,
596 wstrcmpjoki(PWSTR s1
, PWSTR s2
);
599 CdfsSwapString(PWCHAR Out
,
604 CdfsDateTimeToFileTime(PFCB Fcb
,
608 CdfsFileFlagsToAttributes(PFCB Fcb
,
609 PULONG FileAttributes
);
615 DRIVER_DISPATCH NtfsFsdRead
;
617 NtfsFsdRead(PDEVICE_OBJECT DeviceObject
,
620 DRIVER_DISPATCH NtfsFsdWrite
;
622 NtfsFsdWrite(PDEVICE_OBJECT DeviceObject
,
629 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext
);
632 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext
);
637 DRIVER_INITIALIZE DriverEntry
;
641 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject
);