#define TAG_NTFS 'SFTN'
#define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
+#define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
#define DEVICE_NAME L"\\Ntfs"
} DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB;
-
-#define FCB_CACHE_INITIALIZED 0x0001
-#define FCB_IS_VOLUME_STREAM 0x0002
-#define FCB_IS_VOLUME 0x0004
-#define MAX_PATH 260
-
-typedef struct _FCB
-{
- NTFSIDENTIFIER Identifier;
-
- FSRTL_COMMON_FCB_HEADER RFCB;
- SECTION_OBJECT_POINTERS SectionObjectPointers;
-
- PFILE_OBJECT FileObject;
- PNTFS_VCB Vcb;
-
- WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */
- WCHAR PathName[MAX_PATH]; /* path+filename 260 max */
-
- ERESOURCE PagingIoResource;
- ERESOURCE MainResource;
-
- LIST_ENTRY FcbListEntry;
- struct _FCB* ParentFcb;
-
- ULONG DirIndex;
-
- LONG RefCount;
- ULONG Flags;
-
-// DIR_RECORD Entry;
-
-} NTFS_FCB, *PNTFS_FCB;
-
-
typedef struct
{
NTFSIDENTIFIER Identifier;
#define NTFS_FILE_UPCASE 10
#define NTFS_FILE_EXTEND 11
+#define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
+
#define COLLATION_BINARY 0x00
#define COLLATION_FILE_NAME 0x01
#define COLLATION_UNICODE_STRING 0x02
#define NTFS_FILE_NAME_DOS 2
#define NTFS_FILE_NAME_WIN32_AND_DOS 3
+#define NTFS_FILE_TYPE_READ_ONLY 0x1
+#define NTFS_FILE_TYPE_HIDDEN 0x2
+#define NTFS_FILE_TYPE_SYSTEM 0x4
+#define NTFS_FILE_TYPE_ARCHIVE 0x20
+#define NTFS_FILE_TYPE_REPARSE 0x400
+#define NTFS_FILE_TYPE_COMPRESSED 0x800
+#define NTFS_FILE_TYPE_DIRECTORY 0x10000000
+
typedef struct
{
ULONG Type; /* Magic number 'FILE' */
/* NTFS_RECORD_HEADER.Type */
#define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */
+#define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */
typedef struct _FILE_RECORD_HEADER
ULONGLONG AllocatedSize;
ULONGLONG DataSize;
ULONG FileAttributes;
- ULONG AlignmentOrReserved;
+ union
+ {
+ struct
+ {
+ USHORT PackedEaSize;
+ USHORT AlignmentOrReserved;
+ } EaInfo;
+ ULONG ReparseTag;
+ } Extended;
UCHAR NameLength;
UCHAR NameType;
WCHAR Name[1];
INDEX_HEADER_ATTRIBUTE Header;
} INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE;
+typedef struct
+{
+ NTFS_RECORD_HEADER Ntfs;
+ ULONGLONG VCN;
+ INDEX_HEADER_ATTRIBUTE Header;
+} INDEX_BUFFER, *PINDEX_BUFFER;
+
typedef struct
{
union
ULONG Unknown2;
} VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE;
+typedef struct {
+ ULONG ReparseTag;
+ USHORT DataLength;
+ USHORT Reserved;
+ UCHAR Data[1];
+} REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE;
+
typedef struct
{
NTFSIDENTIFIER Identifier;
NTFS_ATTR_RECORD Record;
} NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT;
+#define FCB_CACHE_INITIALIZED 0x0001
+#define FCB_IS_VOLUME_STREAM 0x0002
+#define FCB_IS_VOLUME 0x0004
+#define MAX_PATH 260
+
+typedef struct _FCB
+{
+ NTFSIDENTIFIER Identifier;
+
+ FSRTL_COMMON_FCB_HEADER RFCB;
+ SECTION_OBJECT_POINTERS SectionObjectPointers;
+
+ PFILE_OBJECT FileObject;
+ PNTFS_VCB Vcb;
+
+ WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */
+ WCHAR PathName[MAX_PATH]; /* path+filename 260 max */
+
+ ERESOURCE PagingIoResource;
+ ERESOURCE MainResource;
+
+ LIST_ENTRY FcbListEntry;
+ struct _FCB* ParentFcb;
+
+ ULONG DirIndex;
+
+ LONG RefCount;
+ ULONG Flags;
+
+ ULONGLONG MFTIndex;
+
+ FILENAME_ATTRIBUTE Entry;
+
+} NTFS_FCB, *PNTFS_FCB;
+
extern PNTFS_GLOBAL_DATA NtfsGlobalData;
//int CdfsStrcmpi( wchar_t *str1, wchar_t *str2 );
VOID
NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord);
+PFILENAME_ATTRIBUTE
+GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord, UCHAR NameType);
+
+PFILENAME_ATTRIBUTE
+GetBestFileNameFromRecord(PFILE_RECORD_HEADER FileRecord);
/* blockdev.c */
NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject,
IN LONGLONG StartingOffset,
IN ULONG Length,
+ IN ULONG SectorSize,
IN OUT PUCHAR Buffer,
IN BOOLEAN Override);
/* close.c */
+NTSTATUS
+NtfsCloseFile(PDEVICE_EXTENSION DeviceExt,
+ PFILE_OBJECT FileObject);
+
DRIVER_DISPATCH NtfsFsdClose;
NTSTATUS NTAPI
NtfsFsdClose(PDEVICE_OBJECT DeviceObject,
/* mft.c */
+VOID
+ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context);
+
ULONG
ReadAttribute(PDEVICE_EXTENSION Vcb,
PNTFS_ATTR_CONTEXT Context,
FindAttribute(PDEVICE_EXTENSION Vcb,
PFILE_RECORD_HEADER MftRecord,
ULONG Type,
- PUNICODE_STRING Name,
+ PCWSTR Name,
+ ULONG NameLength,
PNTFS_ATTR_CONTEXT * AttrCtx);
VOID
NtfsLookupFile(PDEVICE_EXTENSION Vcb,
PUNICODE_STRING PathName,
PFILE_RECORD_HEADER *FileRecord,
- PNTFS_ATTR_CONTEXT *DataContext);
+ PNTFS_ATTR_CONTEXT *DataContext,
+ PULONGLONG MFTIndex);
+
+NTSTATUS
+NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
+ PUNICODE_STRING PathName,
+ PFILE_RECORD_HEADER *FileRecord,
+ PNTFS_ATTR_CONTEXT *DataContext,
+ PULONGLONG MFTIndex,
+ ULONGLONG CurrentMFTIndex);
+
+NTSTATUS
+NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
+ PUNICODE_STRING SearchPattern,
+ PULONG FirstEntry,
+ PFILE_RECORD_HEADER *FileRecord,
+ PNTFS_ATTR_CONTEXT *DataContext,
+ PULONGLONG MFTIndex,
+ ULONGLONG CurrentMFTIndex);
/* misc.c */
CdfsSwapString(PWCHAR Out,
PUCHAR In,
ULONG Count);
+#endif
VOID
-CdfsDateTimeToFileTime(PFCB Fcb,
- TIME *FileTime);
-
-VOID
-CdfsFileFlagsToAttributes(PFCB Fcb,
- PULONG FileAttributes);
-#endif
+NtfsFileFlagsToAttributes(ULONG NtfsAttributes,
+ PULONG FileAttributes);
/* rw.c */
/* volinfo.c */
+ULONGLONG
+NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt);
+
NTSTATUS
NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext);