6 #define CACHEPAGESIZE(pDeviceExt) \
7 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
8 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE)
10 #define TAG_NTFS 'SFTN'
12 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
13 #define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
15 #define DEVICE_NAME L"\\Ntfs"
18 typedef struct _BIOS_PARAMETERS_BLOCK
20 USHORT BytesPerSector
; // 0x0B
21 UCHAR SectorsPerCluster
; // 0x0D
22 UCHAR Unused0
[7]; // 0x0E, checked when volume is mounted
23 UCHAR MediaId
; // 0x15
24 UCHAR Unused1
[2]; // 0x16
25 USHORT SectorsPerTrack
; // 0x18
27 UCHAR Unused2
[4]; // 0x1C
28 UCHAR Unused3
[4]; // 0x20, checked when volume is mounted
29 } BIOS_PARAMETERS_BLOCK
, *PBIOS_PARAMETERS_BLOCK
;
31 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK
33 USHORT Unknown
[2]; // 0x24, always 80 00 80 00
34 ULONGLONG SectorCount
; // 0x28
35 ULONGLONG MftLocation
; // 0x30
36 ULONGLONG MftMirrLocation
; // 0x38
37 CHAR ClustersPerMftRecord
; // 0x40
38 UCHAR Unused4
[3]; // 0x41
39 CHAR ClustersPerIndexRecord
; // 0x44
40 UCHAR Unused5
[3]; // 0x45
41 ULONGLONG SerialNumber
; // 0x48
42 UCHAR Checksum
[4]; // 0x50
43 } EXTENDED_BIOS_PARAMETERS_BLOCK
, *PEXTENDED_BIOS_PARAMETERS_BLOCK
;
45 typedef struct _BOOT_SECTOR
47 UCHAR Jump
[3]; // 0x00
48 UCHAR OEMID
[8]; // 0x03
49 BIOS_PARAMETERS_BLOCK BPB
;
50 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB
;
51 UCHAR BootStrap
[426]; // 0x54
52 USHORT EndSector
; // 0x1FE
53 } BOOT_SECTOR
, *PBOOT_SECTOR
;
56 //typedef struct _BootSector BootSector;
58 typedef struct _NTFS_INFO
61 ULONG SectorsPerCluster
;
62 ULONG BytesPerCluster
;
63 ULONGLONG SectorCount
;
64 ULARGE_INTEGER MftStart
;
65 ULARGE_INTEGER MftMirrStart
;
66 ULONG BytesPerFileRecord
;
67 ULONG BytesPerIndexRecord
;
69 ULONGLONG SerialNumber
;
70 USHORT VolumeLabelLength
;
71 WCHAR VolumeLabel
[MAXIMUM_VOLUME_LABEL_LENGTH
];
76 } NTFS_INFO
, *PNTFS_INFO
;
78 #define NTFS_TYPE_CCB '20SF'
79 #define NTFS_TYPE_FCB '30SF'
80 #define NTFS_TYPE_VCB '50SF'
81 #define NTFS_TYPE_IRP_CONTEST '60SF'
82 #define NTFS_TYPE_GLOBAL_DATA '70SF'
88 } NTFSIDENTIFIER
, *PNTFSIDENTIFIER
;
92 NTFSIDENTIFIER Identifier
;
94 ERESOURCE DirResource
;
95 // ERESOURCE FatResource;
97 KSPIN_LOCK FcbListLock
;
98 LIST_ENTRY FcbListHead
;
101 PDEVICE_OBJECT StorageDevice
;
102 PFILE_OBJECT StreamFileObject
;
104 struct _NTFS_ATTR_CONTEXT
* MFTContext
;
105 struct _FILE_RECORD_HEADER
* MasterFileTable
;
106 struct _FCB
*VolumeFcb
;
110 } DEVICE_EXTENSION
, *PDEVICE_EXTENSION
, NTFS_VCB
, *PNTFS_VCB
;
114 NTFSIDENTIFIER Identifier
;
116 PFILE_OBJECT PtrFileObject
;
117 LARGE_INTEGER CurrentByteOffset
;
118 /* for DirectoryControl */
120 /* for DirectoryControl */
121 PWCHAR DirectorySearchPattern
;
124 } NTFS_CCB
, *PNTFS_CCB
;
126 #define TAG_CCB 'BCCI'
130 NTFSIDENTIFIER Identifier
;
132 PDRIVER_OBJECT DriverObject
;
133 PDEVICE_OBJECT DeviceObject
;
134 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks
;
136 } NTFS_GLOBAL_DATA
, *PNTFS_GLOBAL_DATA
;
141 AttributeStandardInformation
= 0x10,
142 AttributeAttributeList
= 0x20,
143 AttributeFileName
= 0x30,
144 AttributeObjectId
= 0x40,
145 AttributeSecurityDescriptor
= 0x50,
146 AttributeVolumeName
= 0x60,
147 AttributeVolumeInformation
= 0x70,
148 AttributeData
= 0x80,
149 AttributeIndexRoot
= 0x90,
150 AttributeIndexAllocation
= 0xA0,
151 AttributeBitmap
= 0xB0,
152 AttributeReparsePoint
= 0xC0,
153 AttributeEAInformation
= 0xD0,
155 AttributePropertySet
= 0xF0,
156 AttributeLoggedUtilityStream
= 0x100,
157 AttributeEnd
= 0xFFFFFFFF
158 } ATTRIBUTE_TYPE
, *PATTRIBUTE_TYPE
;
160 #define NTFS_FILE_MFT 0
161 #define NTFS_FILE_MFTMIRR 1
162 #define NTFS_FILE_LOGFILE 2
163 #define NTFS_FILE_VOLUME 3
164 #define NTFS_FILE_ATTRDEF 4
165 #define NTFS_FILE_ROOT 5
166 #define NTFS_FILE_BITMAP 6
167 #define NTFS_FILE_BOOT 7
168 #define NTFS_FILE_BADCLUS 8
169 #define NTFS_FILE_QUOTA 9
170 #define NTFS_FILE_UPCASE 10
171 #define NTFS_FILE_EXTEND 11
173 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
175 #define COLLATION_BINARY 0x00
176 #define COLLATION_FILE_NAME 0x01
177 #define COLLATION_UNICODE_STRING 0x02
178 #define COLLATION_NTOFS_ULONG 0x10
179 #define COLLATION_NTOFS_SID 0x11
180 #define COLLATION_NTOFS_SECURITY_HASH 0x12
181 #define COLLATION_NTOFS_ULONGS 0x13
183 #define INDEX_ROOT_SMALL 0x0
184 #define INDEX_ROOT_LARGE 0x1
186 #define NTFS_INDEX_ENTRY_NODE 1
187 #define NTFS_INDEX_ENTRY_END 2
189 #define NTFS_FILE_NAME_POSIX 0
190 #define NTFS_FILE_NAME_WIN32 1
191 #define NTFS_FILE_NAME_DOS 2
192 #define NTFS_FILE_NAME_WIN32_AND_DOS 3
194 #define NTFS_FILE_TYPE_READ_ONLY 0x1
195 #define NTFS_FILE_TYPE_HIDDEN 0x2
196 #define NTFS_FILE_TYPE_SYSTEM 0x4
197 #define NTFS_FILE_TYPE_ARCHIVE 0x20
198 #define NTFS_FILE_TYPE_REPARSE 0x400
199 #define NTFS_FILE_TYPE_COMPRESSED 0x800
200 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000
204 ULONG Type
; /* Magic number 'FILE' */
205 USHORT UsaOffset
; /* Offset to the update sequence */
206 USHORT UsaCount
; /* Size in words of Update Sequence Number & Array (S) */
207 ULONGLONG Lsn
; /* $LogFile Sequence Number (LSN) */
208 } NTFS_RECORD_HEADER
, *PNTFS_RECORD_HEADER
;
210 /* NTFS_RECORD_HEADER.Type */
211 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */
212 #define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */
215 typedef struct _FILE_RECORD_HEADER
217 NTFS_RECORD_HEADER Ntfs
;
218 USHORT SequenceNumber
; /* Sequence number */
219 USHORT LinkCount
; /* Hard link count */
220 USHORT AttributeOffset
; /* Offset to the first Attribute */
221 USHORT Flags
; /* Flags */
222 ULONG BytesInUse
; /* Real size of the FILE record */
223 ULONG BytesAllocated
; /* Allocated size of the FILE record */
224 ULONGLONG BaseFileRecord
; /* File reference to the base FILE record */
225 USHORT NextAttributeNumber
; /* Next Attribute Id */
226 USHORT Pading
; /* Align to 4 UCHAR boundary (XP) */
227 ULONG MFTRecordNumber
; /* Number of this MFT Record (XP) */
228 } FILE_RECORD_HEADER
, *PFILE_RECORD_HEADER
;
230 /* Flags in FILE_RECORD_HEADER */
232 #define FRH_IN_USE 0x0001 /* Record is in use */
233 #define FRH_DIRECTORY 0x0002 /* Record is a directory */
234 #define FRH_UNKNOWN1 0x0004 /* Don't know */
235 #define FRH_UNKNOWN2 0x0008 /* Don't know */
248 // Resident attributes
256 // Non-resident attributes
260 ULONGLONG HighestVCN
;
261 USHORT MappingPairsOffset
;
262 USHORT CompressionUnit
;
264 LONGLONG AllocatedSize
;
266 LONGLONG InitializedSize
;
267 LONGLONG CompressedSize
;
270 } NTFS_ATTR_RECORD
, *PNTFS_ATTR_RECORD
;
274 ULONGLONG CreationTime
;
275 ULONGLONG ChangeTime
;
276 ULONGLONG LastWriteTime
;
277 ULONGLONG LastAccessTime
;
279 ULONG AlignmentOrReserved
[3];
283 ULONGLONG QuotaCharge
;
286 } STANDARD_INFORMATION
, *PSTANDARD_INFORMATION
;
291 ATTRIBUTE_TYPE AttributeType
;
295 ULONGLONG StartVcn
; // LowVcn
296 ULONGLONG FileReferenceNumber
;
297 USHORT AttributeNumber
;
298 USHORT AlignmentOrReserved
[3];
299 } ATTRIBUTE_LIST
, *PATTRIBUTE_LIST
;
304 ULONGLONG DirectoryFileReferenceNumber
;
305 ULONGLONG CreationTime
;
306 ULONGLONG ChangeTime
;
307 ULONGLONG LastWriteTime
;
308 ULONGLONG LastAccessTime
;
309 ULONGLONG AllocatedSize
;
311 ULONG FileAttributes
;
317 USHORT AlignmentOrReserved
;
324 } FILENAME_ATTRIBUTE
, *PFILENAME_ATTRIBUTE
;
328 ULONG FirstEntryOffset
;
329 ULONG TotalSizeOfEntries
;
333 } INDEX_HEADER_ATTRIBUTE
, *PINDEX_HEADER_ATTRIBUTE
;
340 UCHAR ClustersPerIndexRecord
;
342 INDEX_HEADER_ATTRIBUTE Header
;
343 } INDEX_ROOT_ATTRIBUTE
, *PINDEX_ROOT_ATTRIBUTE
;
347 NTFS_RECORD_HEADER Ntfs
;
349 INDEX_HEADER_ATTRIBUTE Header
;
350 } INDEX_BUFFER
, *PINDEX_BUFFER
;
358 ULONGLONG IndexedFile
;
371 FILENAME_ATTRIBUTE FileName
;
372 } INDEX_ENTRY_ATTRIBUTE
, *PINDEX_ENTRY_ATTRIBUTE
;
381 } VOLINFO_ATTRIBUTE
, *PVOLINFO_ATTRIBUTE
;
388 } REPARSE_POINT_ATTRIBUTE
, *PREPARSE_POINT_ATTRIBUTE
;
392 NTFSIDENTIFIER Identifier
;
396 WORK_QUEUE_ITEM WorkQueueItem
;
399 PDEVICE_OBJECT DeviceObject
;
400 NTSTATUS SavedExceptionCode
;
401 } NTFS_IRP_CONTEXT
, *PNTFS_IRP_CONTEXT
;
403 typedef struct _NTFS_ATTR_CONTEXT
406 ULONGLONG CacheRunOffset
;
407 LONGLONG CacheRunStartLCN
;
408 ULONGLONG CacheRunLength
;
409 LONGLONG CacheRunLastLCN
;
410 ULONGLONG CacheRunCurrentOffset
;
411 NTFS_ATTR_RECORD Record
;
412 } NTFS_ATTR_CONTEXT
, *PNTFS_ATTR_CONTEXT
;
414 #define FCB_CACHE_INITIALIZED 0x0001
415 #define FCB_IS_VOLUME_STREAM 0x0002
416 #define FCB_IS_VOLUME 0x0004
421 NTFSIDENTIFIER Identifier
;
423 FSRTL_COMMON_FCB_HEADER RFCB
;
424 SECTION_OBJECT_POINTERS SectionObjectPointers
;
426 PFILE_OBJECT FileObject
;
429 WCHAR
*ObjectName
; /* point on filename (250 chars max) in PathName */
430 WCHAR PathName
[MAX_PATH
]; /* path+filename 260 max */
432 ERESOURCE PagingIoResource
;
433 ERESOURCE MainResource
;
435 LIST_ENTRY FcbListEntry
;
436 struct _FCB
* ParentFcb
;
445 FILENAME_ATTRIBUTE Entry
;
447 } NTFS_FCB
, *PNTFS_FCB
;
449 extern PNTFS_GLOBAL_DATA NtfsGlobalData
;
451 //int CdfsStrcmpi( wchar_t *str1, wchar_t *str2 );
452 //void CdfsWstrcpy( wchar_t *str1, wchar_t *str2, int max );
458 //NtfsDumpAttribute(PATTRIBUTE Attribute);
461 DecodeRun(PUCHAR DataRun
,
462 LONGLONG
*DataRunOffset
,
463 ULONGLONG
*DataRunLength
);
466 NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord
);
469 GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord
, UCHAR NameType
);
472 GetBestFileNameFromRecord(PFILE_RECORD_HEADER FileRecord
);
477 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject
,
478 IN LONGLONG StartingOffset
,
481 IN OUT PUCHAR Buffer
,
482 IN BOOLEAN Override
);
485 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject
,
487 IN ULONG SectorCount
,
489 IN OUT PUCHAR Buffer
,
490 IN BOOLEAN Override
);
493 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject
,
494 IN ULONG ControlCode
,
495 IN PVOID InputBuffer
,
496 IN ULONG InputBufferSize
,
497 IN OUT PVOID OutputBuffer
,
498 IN OUT PULONG OutputBufferSize
,
499 IN BOOLEAN Override
);
505 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt
,
506 PFILE_OBJECT FileObject
);
508 DRIVER_DISPATCH NtfsFsdClose
;
510 NtfsFsdClose(PDEVICE_OBJECT DeviceObject
,
516 DRIVER_DISPATCH NtfsFsdCreate
;
518 NtfsFsdCreate(PDEVICE_OBJECT DeviceObject
,
524 DRIVER_DISPATCH NtfsFsdDirectoryControl
;
526 NtfsFsdDirectoryControl(PDEVICE_OBJECT DeviceObject
,
532 DRIVER_DISPATCH NtfsFsdDispatch
;
534 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject
,
541 NtfsAcqLazyWrite(PVOID Context
,
545 NtfsRelLazyWrite(PVOID Context
);
548 NtfsAcqReadAhead(PVOID Context
,
552 NtfsRelReadAhead(PVOID Context
);
558 NtfsCreateFCB(PCWSTR FileName
,
562 NtfsDestroyFCB(PNTFS_FCB Fcb
);
565 NtfsFCBIsDirectory(PNTFS_FCB Fcb
);
568 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb
);
571 NtfsFCBIsRoot(PNTFS_FCB Fcb
);
574 NtfsGrabFCB(PNTFS_VCB Vcb
,
578 NtfsReleaseFCB(PNTFS_VCB Vcb
,
582 NtfsAddFCBToTable(PNTFS_VCB Vcb
,
586 NtfsGrabFCBFromTable(PNTFS_VCB Vcb
,
590 NtfsFCBInitializeCache(PNTFS_VCB Vcb
,
594 NtfsMakeRootFCB(PNTFS_VCB Vcb
);
597 NtfsOpenRootFCB(PNTFS_VCB Vcb
);
600 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb
,
602 PFILE_OBJECT FileObject
);
605 NtfsGetFCBForFile(PNTFS_VCB Vcb
,
606 PNTFS_FCB
*pParentFCB
,
608 const PWSTR pFileName
);
613 DRIVER_DISPATCH NtfsFsdQueryInformation
;
615 NtfsFsdQueryInformation(PDEVICE_OBJECT DeviceObject
,
621 DRIVER_DISPATCH NtfsFsdFileSystemControl
;
623 NtfsFsdFileSystemControl(PDEVICE_OBJECT DeviceObject
,
629 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context
);
632 ReadAttribute(PDEVICE_EXTENSION Vcb
,
633 PNTFS_ATTR_CONTEXT Context
,
639 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord
);
642 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord
);
645 ReadFileRecord(PDEVICE_EXTENSION Vcb
,
647 PFILE_RECORD_HEADER file
);
650 FindAttribute(PDEVICE_EXTENSION Vcb
,
651 PFILE_RECORD_HEADER MftRecord
,
655 PNTFS_ATTR_CONTEXT
* AttrCtx
);
658 ReadVCN(PDEVICE_EXTENSION Vcb
,
659 PFILE_RECORD_HEADER file
,
666 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb
,
667 PNTFS_RECORD_HEADER Record
);
670 ReadLCN(PDEVICE_EXTENSION Vcb
,
676 EnumerAttribute(PFILE_RECORD_HEADER file
,
677 PDEVICE_EXTENSION Vcb
,
678 PDEVICE_OBJECT DeviceObject
);
681 NtfsLookupFile(PDEVICE_EXTENSION Vcb
,
682 PUNICODE_STRING PathName
,
683 PFILE_RECORD_HEADER
*FileRecord
,
684 PNTFS_ATTR_CONTEXT
*DataContext
,
685 PULONGLONG MFTIndex
);
688 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb
,
689 PUNICODE_STRING PathName
,
690 PFILE_RECORD_HEADER
*FileRecord
,
691 PNTFS_ATTR_CONTEXT
*DataContext
,
693 ULONGLONG CurrentMFTIndex
);
696 NtfsFindFileAt(PDEVICE_EXTENSION Vcb
,
697 PUNICODE_STRING SearchPattern
,
699 PFILE_RECORD_HEADER
*FileRecord
,
700 PNTFS_ATTR_CONTEXT
*DataContext
,
702 ULONGLONG CurrentMFTIndex
);
707 NtfsIsIrpTopLevel(PIRP Irp
);
710 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject
,
715 wstrcmpjoki(PWSTR s1
, PWSTR s2
);
718 CdfsSwapString(PWCHAR Out
,
724 NtfsFileFlagsToAttributes(ULONG NtfsAttributes
,
725 PULONG FileAttributes
);
730 DRIVER_DISPATCH NtfsFsdRead
;
732 NtfsFsdRead(PDEVICE_OBJECT DeviceObject
,
735 DRIVER_DISPATCH NtfsFsdWrite
;
737 NtfsFsdWrite(PDEVICE_OBJECT DeviceObject
,
744 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt
);
747 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext
);
750 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext
);
755 DRIVER_INITIALIZE DriverEntry
;
759 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject
);