ULONGLONG CacheRunLength;
LONGLONG CacheRunLastLCN;
ULONGLONG CacheRunCurrentOffset;
+ LARGE_MCB DataRunsMCB;
ULONGLONG FileMFTIndex;
NTFS_ATTR_RECORD Record;
} NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT;
//NtfsDumpAttribute(PATTRIBUTE Attribute);
NTSTATUS
-AddRun(PNTFS_ATTR_CONTEXT AttrContext,
+AddData(PFILE_RECORD_HEADER FileRecord,
+ PNTFS_ATTR_RECORD AttributeAddress);
+
+NTSTATUS
+AddRun(PNTFS_VCB Vcb,
+ PNTFS_ATTR_CONTEXT AttrContext,
+ ULONG AttrOffset,
+ PFILE_RECORD_HEADER FileRecord,
ULONGLONG NextAssignedCluster,
ULONG RunLength);
+NTSTATUS
+AddFileName(PFILE_RECORD_HEADER FileRecord,
+ PNTFS_ATTR_RECORD AttributeAddress,
+ PDEVICE_EXTENSION DeviceExt,
+ PFILE_OBJECT FileObject);
+
+NTSTATUS
+AddStandardInformation(PFILE_RECORD_HEADER FileRecord,
+ PNTFS_ATTR_RECORD AttributeAddress);
+
+NTSTATUS
+ConvertDataRunsToLargeMCB(PUCHAR DataRun,
+ PLARGE_MCB DataRunsMCB,
+ PULONGLONG pNextVBN);
+
+NTSTATUS
+ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB,
+ PUCHAR RunBuffer,
+ ULONG MaxBufferSize,
+ PULONG UsedBufferSize);
+
PUCHAR
DecodeRun(PUCHAR DataRun,
LONGLONG *DataRunOffset,
ULONGLONG *DataRunLength);
+VOID
+NtfsDumpDataRuns(PVOID StartOfRun,
+ ULONGLONG CurrentLCN);
+
VOID
NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb,
PFILE_RECORD_HEADER FileRecord);
PFILE_RECORD_HEADER FileRecord,
UCHAR NameType);
+UCHAR
+GetPackedByteCount(LONGLONG NumberToPack,
+ BOOLEAN IsSigned);
+
NTSTATUS
GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb,
PNTFS_ATTR_RECORD Attribute,
VOID
FindCloseAttribute(PFIND_ATTR_CONTXT Context);
+NTSTATUS
+FreeClusters(PNTFS_VCB Vcb,
+ PNTFS_ATTR_CONTEXT AttrContext,
+ ULONG AttrOffset,
+ PFILE_RECORD_HEADER FileRecord,
+ ULONG ClustersToFree);
+
/* blockdev.c */
NTSTATUS
NTSTATUS
NtfsCreate(PNTFS_IRP_CONTEXT IrpContext);
+NTSTATUS
+NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt,
+ PFILE_OBJECT FileObject);
/* devctl.c */
NTSTATUS
NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext);
+NTSTATUS
+NtfsSetEndOfFile(PNTFS_FCB Fcb,
+ PFILE_OBJECT FileObject,
+ PDEVICE_EXTENSION DeviceExt,
+ ULONG IrpFlags,
+ PLARGE_INTEGER NewFileSize);
+
+NTSTATUS
+NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext);
/* fsctl.c */
/* mft.c */
+NTSTATUS
+AddNewMftEntry(PFILE_RECORD_HEADER FileRecord,
+ PDEVICE_EXTENSION DeviceExt);
+
PNTFS_ATTR_CONTEXT
PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord);
PFILE_RECORD_HEADER FileRecord,
PLARGE_INTEGER DataSize);
+VOID
+SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord,
+ PNTFS_ATTR_RECORD AttrEnd,
+ ULONG EndMarker);
+
ULONGLONG
AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord);
NTSTATUS
UpdateFileRecord(PDEVICE_EXTENSION Vcb,
- ULONGLONG index,
- PFILE_RECORD_HEADER file);
+ ULONGLONG MftIndex,
+ PFILE_RECORD_HEADER FileRecord);
NTSTATUS
FindAttribute(PDEVICE_EXTENSION Vcb,
PULONGLONG MFTIndex,
ULONGLONG CurrentMFTIndex);
+VOID
+NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb,
+ PFILE_RECORD_HEADER FileRecord);
+
NTSTATUS
NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
PUNICODE_STRING SearchPattern,
PULONGLONG MFTIndex,
ULONGLONG CurrentMFTIndex);
+NTSTATUS
+NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
+ ULONGLONG MFTIndex,
+ PUNICODE_STRING FileName,
+ PULONG FirstEntry,
+ BOOLEAN DirSearch,
+ ULONGLONG *OutMFTIndex);
+
/* misc.c */
BOOLEAN