1 #ifndef NTFS_H 2 #define NTFS_H 3 4 #include <ntifs.h> 5 #include <pseh/pseh2.h> 6 #include <section_attribs.h> 7 8 #define CACHEPAGESIZE(pDeviceExt) \ 9 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \ 10 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE) 11 12 #define TAG_NTFS '0ftN' 13 #define TAG_CCB 'CftN' 14 #define TAG_FCB 'FftN' 15 #define TAG_IRP_CTXT 'iftN' 16 #define TAG_ATT_CTXT 'aftN' 17 #define TAG_FILE_REC 'rftN' 18 19 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S)) 20 #define ROUND_DOWN(N, S) ((N) - ((N) % (S))) 21 22 #define DEVICE_NAME L"\\Ntfs" 23 24 #include <pshpack1.h> 25 typedef struct _BIOS_PARAMETERS_BLOCK 26 { 27 USHORT BytesPerSector; // 0x0B 28 UCHAR SectorsPerCluster; // 0x0D 29 UCHAR Unused0[7]; // 0x0E, checked when volume is mounted 30 UCHAR MediaId; // 0x15 31 UCHAR Unused1[2]; // 0x16 32 USHORT SectorsPerTrack; // 0x18 33 USHORT Heads; // 0x1A 34 UCHAR Unused2[4]; // 0x1C 35 UCHAR Unused3[4]; // 0x20, checked when volume is mounted 36 } BIOS_PARAMETERS_BLOCK, *PBIOS_PARAMETERS_BLOCK; 37 38 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK 39 { 40 USHORT Unknown[2]; // 0x24, always 80 00 80 00 41 ULONGLONG SectorCount; // 0x28 42 ULONGLONG MftLocation; // 0x30 43 ULONGLONG MftMirrLocation; // 0x38 44 CHAR ClustersPerMftRecord; // 0x40 45 UCHAR Unused4[3]; // 0x41 46 CHAR ClustersPerIndexRecord; // 0x44 47 UCHAR Unused5[3]; // 0x45 48 ULONGLONG SerialNumber; // 0x48 49 UCHAR Checksum[4]; // 0x50 50 } EXTENDED_BIOS_PARAMETERS_BLOCK, *PEXTENDED_BIOS_PARAMETERS_BLOCK; 51 52 typedef struct _BOOT_SECTOR 53 { 54 UCHAR Jump[3]; // 0x00 55 UCHAR OEMID[8]; // 0x03 56 BIOS_PARAMETERS_BLOCK BPB; 57 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB; 58 UCHAR BootStrap[426]; // 0x54 59 USHORT EndSector; // 0x1FE 60 } BOOT_SECTOR, *PBOOT_SECTOR; 61 #include <poppack.h> 62 63 //typedef struct _BootSector BootSector; 64 65 typedef struct _NTFS_INFO 66 { 67 ULONG BytesPerSector; 68 ULONG SectorsPerCluster; 69 ULONG BytesPerCluster; 70 ULONGLONG SectorCount; 71 ULONGLONG ClusterCount; 72 ULARGE_INTEGER MftStart; 73 ULARGE_INTEGER MftMirrStart; 74 ULONG BytesPerFileRecord; 75 ULONG BytesPerIndexRecord; 76 77 ULONGLONG SerialNumber; 78 USHORT VolumeLabelLength; 79 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]; 80 UCHAR MajorVersion; 81 UCHAR MinorVersion; 82 USHORT Flags; 83 84 ULONG MftZoneReservation; 85 } NTFS_INFO, *PNTFS_INFO; 86 87 #define NTFS_TYPE_CCB '20SF' 88 #define NTFS_TYPE_FCB '30SF' 89 #define NTFS_TYPE_VCB '50SF' 90 #define NTFS_TYPE_IRP_CONTEXT '60SF' 91 #define NTFS_TYPE_GLOBAL_DATA '70SF' 92 93 typedef struct 94 { 95 ULONG Type; 96 ULONG Size; 97 } NTFSIDENTIFIER, *PNTFSIDENTIFIER; 98 99 typedef struct 100 { 101 NTFSIDENTIFIER Identifier; 102 103 ERESOURCE DirResource; 104 // ERESOURCE FatResource; 105 106 KSPIN_LOCK FcbListLock; 107 LIST_ENTRY FcbListHead; 108 109 PVPB Vpb; 110 PDEVICE_OBJECT StorageDevice; 111 PFILE_OBJECT StreamFileObject; 112 113 struct _NTFS_ATTR_CONTEXT* MFTContext; 114 struct _FILE_RECORD_HEADER* MasterFileTable; 115 struct _FCB *VolumeFcb; 116 117 NTFS_INFO NtfsInfo; 118 119 NPAGED_LOOKASIDE_LIST FileRecLookasideList; 120 121 ULONG MftDataOffset; 122 ULONG Flags; 123 ULONG OpenHandleCount; 124 125 } DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB; 126 127 #define VCB_VOLUME_LOCKED 0x0001 128 129 typedef struct 130 { 131 NTFSIDENTIFIER Identifier; 132 LIST_ENTRY NextCCB; 133 PFILE_OBJECT PtrFileObject; 134 LARGE_INTEGER CurrentByteOffset; 135 /* for DirectoryControl */ 136 ULONG Entry; 137 /* for DirectoryControl */ 138 PWCHAR DirectorySearchPattern; 139 ULONG LastCluster; 140 ULONG LastOffset; 141 } NTFS_CCB, *PNTFS_CCB; 142 143 typedef struct 144 { 145 NTFSIDENTIFIER Identifier; 146 ERESOURCE Resource; 147 PDRIVER_OBJECT DriverObject; 148 PDEVICE_OBJECT DeviceObject; 149 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks; 150 ULONG Flags; 151 FAST_IO_DISPATCH FastIoDispatch; 152 NPAGED_LOOKASIDE_LIST IrpContextLookasideList; 153 NPAGED_LOOKASIDE_LIST FcbLookasideList; 154 NPAGED_LOOKASIDE_LIST AttrCtxtLookasideList; 155 BOOLEAN EnableWriteSupport; 156 } NTFS_GLOBAL_DATA, *PNTFS_GLOBAL_DATA; 157 158 159 typedef enum 160 { 161 AttributeStandardInformation = 0x10, 162 AttributeAttributeList = 0x20, 163 AttributeFileName = 0x30, 164 AttributeObjectId = 0x40, 165 AttributeSecurityDescriptor = 0x50, 166 AttributeVolumeName = 0x60, 167 AttributeVolumeInformation = 0x70, 168 AttributeData = 0x80, 169 AttributeIndexRoot = 0x90, 170 AttributeIndexAllocation = 0xA0, 171 AttributeBitmap = 0xB0, 172 AttributeReparsePoint = 0xC0, 173 AttributeEAInformation = 0xD0, 174 AttributeEA = 0xE0, 175 AttributePropertySet = 0xF0, 176 AttributeLoggedUtilityStream = 0x100, 177 AttributeEnd = 0xFFFFFFFF 178 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE; 179 180 // FILE_RECORD_END seems to follow AttributeEnd in every file record starting with $Quota. 181 // No clue what data is being represented here. 182 #define FILE_RECORD_END 0x11477982 183 184 #define NTFS_FILE_MFT 0 185 #define NTFS_FILE_MFTMIRR 1 186 #define NTFS_FILE_LOGFILE 2 187 #define NTFS_FILE_VOLUME 3 188 #define NTFS_FILE_ATTRDEF 4 189 #define NTFS_FILE_ROOT 5 190 #define NTFS_FILE_BITMAP 6 191 #define NTFS_FILE_BOOT 7 192 #define NTFS_FILE_BADCLUS 8 193 #define NTFS_FILE_QUOTA 9 194 #define NTFS_FILE_UPCASE 10 195 #define NTFS_FILE_EXTEND 11 196 #define NTFS_FILE_FIRST_USER_FILE 16 197 198 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL 199 200 #define COLLATION_BINARY 0x00 201 #define COLLATION_FILE_NAME 0x01 202 #define COLLATION_UNICODE_STRING 0x02 203 #define COLLATION_NTOFS_ULONG 0x10 204 #define COLLATION_NTOFS_SID 0x11 205 #define COLLATION_NTOFS_SECURITY_HASH 0x12 206 #define COLLATION_NTOFS_ULONGS 0x13 207 208 #define INDEX_ROOT_SMALL 0x0 209 #define INDEX_ROOT_LARGE 0x1 210 211 #define INDEX_NODE_SMALL 0x0 212 #define INDEX_NODE_LARGE 0x1 213 214 #define NTFS_INDEX_ENTRY_NODE 1 215 #define NTFS_INDEX_ENTRY_END 2 216 217 #define NTFS_FILE_NAME_POSIX 0 218 #define NTFS_FILE_NAME_WIN32 1 219 #define NTFS_FILE_NAME_DOS 2 220 #define NTFS_FILE_NAME_WIN32_AND_DOS 3 221 222 #define NTFS_FILE_TYPE_READ_ONLY 0x1 223 #define NTFS_FILE_TYPE_HIDDEN 0x2 224 #define NTFS_FILE_TYPE_SYSTEM 0x4 225 #define NTFS_FILE_TYPE_ARCHIVE 0x20 226 #define NTFS_FILE_TYPE_REPARSE 0x400 227 #define NTFS_FILE_TYPE_COMPRESSED 0x800 228 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000 229 230 /* Indexed Flag in Resident attributes - still somewhat speculative */ 231 #define RA_INDEXED 0x01 232 233 typedef struct 234 { 235 ULONG Type; /* Magic number 'FILE' */ 236 USHORT UsaOffset; /* Offset to the update sequence */ 237 USHORT UsaCount; /* Size in words of Update Sequence Number & Array (S) */ 238 ULONGLONG Lsn; /* $LogFile Sequence Number (LSN) */ 239 } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER; 240 241 /* NTFS_RECORD_HEADER.Type */ 242 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */ 243 #define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */ 244 245 246 typedef struct _FILE_RECORD_HEADER 247 { 248 NTFS_RECORD_HEADER Ntfs; 249 USHORT SequenceNumber; /* Sequence number */ 250 USHORT LinkCount; /* Hard link count */ 251 USHORT AttributeOffset; /* Offset to the first Attribute */ 252 USHORT Flags; /* Flags */ 253 ULONG BytesInUse; /* Real size of the FILE record */ 254 ULONG BytesAllocated; /* Allocated size of the FILE record */ 255 ULONGLONG BaseFileRecord; /* File reference to the base FILE record */ 256 USHORT NextAttributeNumber; /* Next Attribute Id */ 257 USHORT Padding; /* Align to 4 UCHAR boundary (XP) */ 258 ULONG MFTRecordNumber; /* Number of this MFT Record (XP) */ 259 } FILE_RECORD_HEADER, *PFILE_RECORD_HEADER; 260 261 /* Flags in FILE_RECORD_HEADER */ 262 263 #define FRH_IN_USE 0x0001 /* Record is in use */ 264 #define FRH_DIRECTORY 0x0002 /* Record is a directory */ 265 #define FRH_UNKNOWN1 0x0004 /* Don't know */ 266 #define FRH_UNKNOWN2 0x0008 /* Don't know */ 267 268 typedef struct 269 { 270 ULONG Type; 271 ULONG Length; 272 UCHAR IsNonResident; 273 UCHAR NameLength; 274 USHORT NameOffset; 275 USHORT Flags; 276 USHORT Instance; 277 union 278 { 279 // Resident attributes 280 struct 281 { 282 ULONG ValueLength; 283 USHORT ValueOffset; 284 UCHAR Flags; 285 UCHAR Reserved; 286 } Resident; 287 // Non-resident attributes 288 struct 289 { 290 ULONGLONG LowestVCN; 291 ULONGLONG HighestVCN; 292 USHORT MappingPairsOffset; 293 USHORT CompressionUnit; 294 UCHAR Reserved[4]; 295 LONGLONG AllocatedSize; 296 LONGLONG DataSize; 297 LONGLONG InitializedSize; 298 LONGLONG CompressedSize; 299 } NonResident; 300 }; 301 } NTFS_ATTR_RECORD, *PNTFS_ATTR_RECORD; 302 303 typedef struct 304 { 305 ULONG Type; 306 USHORT Length; 307 UCHAR NameLength; 308 UCHAR NameOffset; 309 ULONGLONG StartingVCN; 310 ULONGLONG MFTIndex; 311 USHORT Instance; 312 } NTFS_ATTRIBUTE_LIST_ITEM, *PNTFS_ATTRIBUTE_LIST_ITEM; 313 314 // The beginning and length of an attribute record are always aligned to an 8-byte boundary, 315 // relative to the beginning of the file record. 316 #define ATTR_RECORD_ALIGNMENT 8 317 318 // Data runs are aligned to a 4-byte boundary, relative to the start of the attribute record 319 #define DATA_RUN_ALIGNMENT 4 320 321 // Value offset is aligned to a 4-byte boundary, relative to the start of the attribute record 322 #define VALUE_OFFSET_ALIGNMENT 4 323 324 typedef struct 325 { 326 ULONGLONG CreationTime; 327 ULONGLONG ChangeTime; 328 ULONGLONG LastWriteTime; 329 ULONGLONG LastAccessTime; 330 ULONG FileAttribute; 331 ULONG AlignmentOrReserved[3]; 332 #if 0 333 ULONG QuotaId; 334 ULONG SecurityId; 335 ULONGLONG QuotaCharge; 336 USN Usn; 337 #endif 338 } STANDARD_INFORMATION, *PSTANDARD_INFORMATION; 339 340 341 typedef struct 342 { 343 ATTRIBUTE_TYPE AttributeType; 344 USHORT Length; 345 UCHAR NameLength; 346 UCHAR NameOffset; 347 ULONGLONG StartVcn; // LowVcn 348 ULONGLONG FileReferenceNumber; 349 USHORT AttributeNumber; 350 USHORT AlignmentOrReserved[3]; 351 } ATTRIBUTE_LIST, *PATTRIBUTE_LIST; 352 353 354 typedef struct 355 { 356 ULONGLONG DirectoryFileReferenceNumber; 357 ULONGLONG CreationTime; 358 ULONGLONG ChangeTime; 359 ULONGLONG LastWriteTime; 360 ULONGLONG LastAccessTime; 361 ULONGLONG AllocatedSize; 362 ULONGLONG DataSize; 363 ULONG FileAttributes; 364 union 365 { 366 struct 367 { 368 USHORT PackedEaSize; 369 USHORT AlignmentOrReserved; 370 } EaInfo; 371 ULONG ReparseTag; 372 } Extended; 373 UCHAR NameLength; 374 UCHAR NameType; 375 WCHAR Name[1]; 376 } FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE; 377 378 typedef struct 379 { 380 ULONG FirstEntryOffset; 381 ULONG TotalSizeOfEntries; 382 ULONG AllocatedSize; 383 UCHAR Flags; 384 UCHAR Padding[3]; 385 } INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE; 386 387 typedef struct 388 { 389 ULONG AttributeType; 390 ULONG CollationRule; 391 ULONG SizeOfEntry; 392 UCHAR ClustersPerIndexRecord; 393 UCHAR Padding[3]; 394 INDEX_HEADER_ATTRIBUTE Header; 395 } INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE; 396 397 typedef struct 398 { 399 NTFS_RECORD_HEADER Ntfs; 400 ULONGLONG VCN; 401 INDEX_HEADER_ATTRIBUTE Header; 402 } INDEX_BUFFER, *PINDEX_BUFFER; 403 404 typedef struct 405 { 406 union 407 { 408 struct 409 { 410 ULONGLONG IndexedFile; 411 } Directory; 412 struct 413 { 414 USHORT DataOffset; 415 USHORT DataLength; 416 ULONG Reserved; 417 } ViewIndex; 418 } Data; 419 USHORT Length; 420 USHORT KeyLength; 421 USHORT Flags; 422 USHORT Reserved; 423 FILENAME_ATTRIBUTE FileName; 424 } INDEX_ENTRY_ATTRIBUTE, *PINDEX_ENTRY_ATTRIBUTE; 425 426 struct _B_TREE_FILENAME_NODE; 427 typedef struct _B_TREE_FILENAME_NODE B_TREE_FILENAME_NODE; 428 429 // Keys are arranged in nodes as an ordered, linked list 430 typedef struct _B_TREE_KEY 431 { 432 struct _B_TREE_KEY *NextKey; 433 B_TREE_FILENAME_NODE *LesserChild; // Child-Node. All the keys in this node will be sorted before IndexEntry 434 PINDEX_ENTRY_ATTRIBUTE IndexEntry; // must be last member for FIELD_OFFSET 435 }B_TREE_KEY, *PB_TREE_KEY; 436 437 // Every Node is just an ordered list of keys. 438 // Sub-nodes can be found attached to a key (if they exist). 439 // A key's sub-node precedes that key in the ordered list. 440 typedef struct _B_TREE_FILENAME_NODE 441 { 442 ULONG KeyCount; 443 BOOLEAN HasValidVCN; 444 BOOLEAN DiskNeedsUpdating; 445 ULONGLONG VCN; 446 PB_TREE_KEY FirstKey; 447 } B_TREE_FILENAME_NODE, *PB_TREE_FILENAME_NODE; 448 449 typedef struct 450 { 451 PB_TREE_FILENAME_NODE RootNode; 452 } B_TREE, *PB_TREE; 453 454 typedef struct 455 { 456 ULONGLONG Unknown1; 457 UCHAR MajorVersion; 458 UCHAR MinorVersion; 459 USHORT Flags; 460 ULONG Unknown2; 461 } VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE; 462 463 typedef struct { 464 ULONG ReparseTag; 465 USHORT DataLength; 466 USHORT Reserved; 467 UCHAR Data[1]; 468 } REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE; 469 470 #define IRPCONTEXT_CANWAIT 0x1 471 #define IRPCONTEXT_COMPLETE 0x2 472 #define IRPCONTEXT_QUEUE 0x4 473 474 typedef struct 475 { 476 NTFSIDENTIFIER Identifier; 477 ULONG Flags; 478 PIO_STACK_LOCATION Stack; 479 UCHAR MajorFunction; 480 UCHAR MinorFunction; 481 WORK_QUEUE_ITEM WorkQueueItem; 482 PIRP Irp; 483 BOOLEAN IsTopLevel; 484 PDEVICE_OBJECT DeviceObject; 485 PFILE_OBJECT FileObject; 486 NTSTATUS SavedExceptionCode; 487 CCHAR PriorityBoost; 488 } NTFS_IRP_CONTEXT, *PNTFS_IRP_CONTEXT; 489 490 typedef struct _NTFS_ATTR_CONTEXT 491 { 492 PUCHAR CacheRun; 493 ULONGLONG CacheRunOffset; 494 LONGLONG CacheRunStartLCN; 495 ULONGLONG CacheRunLength; 496 LONGLONG CacheRunLastLCN; 497 ULONGLONG CacheRunCurrentOffset; 498 LARGE_MCB DataRunsMCB; 499 ULONGLONG FileMFTIndex; 500 ULONGLONG FileOwnerMFTIndex; /* If attribute list attribute, reference the original file */ 501 PNTFS_ATTR_RECORD pRecord; 502 } NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT; 503 504 #define FCB_CACHE_INITIALIZED 0x0001 505 #define FCB_IS_VOLUME_STREAM 0x0002 506 #define FCB_IS_VOLUME 0x0004 507 #define MAX_PATH 260 508 509 typedef struct _FCB 510 { 511 NTFSIDENTIFIER Identifier; 512 513 FSRTL_COMMON_FCB_HEADER RFCB; 514 SECTION_OBJECT_POINTERS SectionObjectPointers; 515 516 PFILE_OBJECT FileObject; 517 PNTFS_VCB Vcb; 518 519 WCHAR Stream[MAX_PATH]; 520 WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */ 521 WCHAR PathName[MAX_PATH]; /* path+filename 260 max */ 522 523 ERESOURCE PagingIoResource; 524 ERESOURCE MainResource; 525 526 LIST_ENTRY FcbListEntry; 527 struct _FCB* ParentFcb; 528 529 ULONG DirIndex; 530 531 LONG RefCount; 532 ULONG Flags; 533 ULONG OpenHandleCount; 534 535 ULONGLONG MFTIndex; 536 USHORT LinkCount; 537 538 FILENAME_ATTRIBUTE Entry; 539 540 } NTFS_FCB, *PNTFS_FCB; 541 542 typedef struct _FIND_ATTR_CONTXT 543 { 544 PDEVICE_EXTENSION Vcb; 545 BOOLEAN OnlyResident; 546 PNTFS_ATTR_RECORD FirstAttr; 547 PNTFS_ATTR_RECORD CurrAttr; 548 PNTFS_ATTR_RECORD LastAttr; 549 PNTFS_ATTRIBUTE_LIST_ITEM NonResidentStart; 550 PNTFS_ATTRIBUTE_LIST_ITEM NonResidentEnd; 551 PNTFS_ATTRIBUTE_LIST_ITEM NonResidentCur; 552 ULONG Offset; 553 } FIND_ATTR_CONTXT, *PFIND_ATTR_CONTXT; 554 555 typedef struct 556 { 557 USHORT USN; 558 USHORT Array[]; 559 } FIXUP_ARRAY, *PFIXUP_ARRAY; 560 561 extern PNTFS_GLOBAL_DATA NtfsGlobalData; 562 563 FORCEINLINE 564 NTSTATUS 565 NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext) 566 { 567 PULONG Flags = &IrpContext->Flags; 568 569 *Flags &= ~IRPCONTEXT_COMPLETE; 570 *Flags |= IRPCONTEXT_QUEUE; 571 572 return STATUS_PENDING; 573 } 574 575 /* attrib.c */ 576 577 //VOID 578 //NtfsDumpAttribute(PATTRIBUTE Attribute); 579 580 NTSTATUS 581 AddBitmap(PNTFS_VCB Vcb, 582 PFILE_RECORD_HEADER FileRecord, 583 PNTFS_ATTR_RECORD AttributeAddress, 584 PCWSTR Name, 585 USHORT NameLength); 586 587 NTSTATUS 588 AddData(PFILE_RECORD_HEADER FileRecord, 589 PNTFS_ATTR_RECORD AttributeAddress); 590 591 NTSTATUS 592 AddRun(PNTFS_VCB Vcb, 593 PNTFS_ATTR_CONTEXT AttrContext, 594 ULONG AttrOffset, 595 PFILE_RECORD_HEADER FileRecord, 596 ULONGLONG NextAssignedCluster, 597 ULONG RunLength); 598 599 NTSTATUS 600 AddIndexAllocation(PNTFS_VCB Vcb, 601 PFILE_RECORD_HEADER FileRecord, 602 PNTFS_ATTR_RECORD AttributeAddress, 603 PCWSTR Name, 604 USHORT NameLength); 605 606 NTSTATUS 607 AddIndexRoot(PNTFS_VCB Vcb, 608 PFILE_RECORD_HEADER FileRecord, 609 PNTFS_ATTR_RECORD AttributeAddress, 610 PINDEX_ROOT_ATTRIBUTE NewIndexRoot, 611 ULONG RootLength, 612 PCWSTR Name, 613 USHORT NameLength); 614 615 NTSTATUS 616 AddFileName(PFILE_RECORD_HEADER FileRecord, 617 PNTFS_ATTR_RECORD AttributeAddress, 618 PDEVICE_EXTENSION DeviceExt, 619 PFILE_OBJECT FileObject, 620 BOOLEAN CaseSensitive, 621 PULONGLONG ParentMftIndex); 622 623 NTSTATUS 624 AddStandardInformation(PFILE_RECORD_HEADER FileRecord, 625 PNTFS_ATTR_RECORD AttributeAddress); 626 627 NTSTATUS 628 ConvertDataRunsToLargeMCB(PUCHAR DataRun, 629 PLARGE_MCB DataRunsMCB, 630 PULONGLONG pNextVBN); 631 632 NTSTATUS 633 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, 634 PUCHAR RunBuffer, 635 ULONG MaxBufferSize, 636 PULONG UsedBufferSize); 637 638 PUCHAR 639 DecodeRun(PUCHAR DataRun, 640 LONGLONG *DataRunOffset, 641 ULONGLONG *DataRunLength); 642 643 ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute); 644 645 VOID 646 NtfsDumpDataRuns(PVOID StartOfRun, 647 ULONGLONG CurrentLCN); 648 649 VOID 650 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, 651 PFILE_RECORD_HEADER FileRecord); 652 653 PSTANDARD_INFORMATION 654 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, 655 PFILE_RECORD_HEADER FileRecord); 656 657 PFILENAME_ATTRIBUTE 658 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, 659 PFILE_RECORD_HEADER FileRecord, 660 UCHAR NameType); 661 662 UCHAR 663 GetPackedByteCount(LONGLONG NumberToPack, 664 BOOLEAN IsSigned); 665 666 NTSTATUS 667 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb, 668 PNTFS_ATTR_RECORD Attribute, 669 PULONGLONG LastCluster); 670 671 PFILENAME_ATTRIBUTE 672 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, 673 PFILE_RECORD_HEADER FileRecord); 674 675 NTSTATUS 676 FindFirstAttributeListItem(PFIND_ATTR_CONTXT Context, 677 PNTFS_ATTRIBUTE_LIST_ITEM *Item); 678 679 NTSTATUS 680 FindNextAttributeListItem(PFIND_ATTR_CONTXT Context, 681 PNTFS_ATTRIBUTE_LIST_ITEM *Item); 682 683 NTSTATUS 684 FindFirstAttribute(PFIND_ATTR_CONTXT Context, 685 PDEVICE_EXTENSION Vcb, 686 PFILE_RECORD_HEADER FileRecord, 687 BOOLEAN OnlyResident, 688 PNTFS_ATTR_RECORD * Attribute); 689 690 NTSTATUS 691 FindNextAttribute(PFIND_ATTR_CONTXT Context, 692 PNTFS_ATTR_RECORD * Attribute); 693 694 VOID 695 FindCloseAttribute(PFIND_ATTR_CONTXT Context); 696 697 NTSTATUS 698 FreeClusters(PNTFS_VCB Vcb, 699 PNTFS_ATTR_CONTEXT AttrContext, 700 ULONG AttrOffset, 701 PFILE_RECORD_HEADER FileRecord, 702 ULONG ClustersToFree); 703 704 /* blockdev.c */ 705 706 NTSTATUS 707 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, 708 IN LONGLONG StartingOffset, 709 IN ULONG Length, 710 IN ULONG SectorSize, 711 IN OUT PUCHAR Buffer, 712 IN BOOLEAN Override); 713 714 NTSTATUS 715 NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject, 716 IN LONGLONG StartingOffset, 717 IN ULONG Length, 718 IN ULONG SectorSize, 719 IN const PUCHAR Buffer); 720 721 NTSTATUS 722 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, 723 IN ULONG DiskSector, 724 IN ULONG SectorCount, 725 IN ULONG SectorSize, 726 IN OUT PUCHAR Buffer, 727 IN BOOLEAN Override); 728 729 NTSTATUS 730 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, 731 IN ULONG ControlCode, 732 IN PVOID InputBuffer, 733 IN ULONG InputBufferSize, 734 IN OUT PVOID OutputBuffer, 735 IN OUT PULONG OutputBufferSize, 736 IN BOOLEAN Override); 737 738 739 /* btree.c */ 740 741 LONG 742 CompareTreeKeys(PB_TREE_KEY Key1, 743 PB_TREE_KEY Key2, 744 BOOLEAN CaseSensitive); 745 746 NTSTATUS 747 CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb, 748 PFILE_RECORD_HEADER FileRecordWithIndex, 749 /*PCWSTR IndexName,*/ 750 PNTFS_ATTR_CONTEXT IndexRootContext, 751 PINDEX_ROOT_ATTRIBUTE IndexRoot, 752 PB_TREE *NewTree); 753 754 NTSTATUS 755 CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, 756 PB_TREE Tree, 757 ULONG MaxIndexSize, 758 PINDEX_ROOT_ATTRIBUTE *IndexRoot, 759 ULONG *Length); 760 761 NTSTATUS 762 DemoteBTreeRoot(PB_TREE Tree); 763 764 VOID 765 DestroyBTree(PB_TREE Tree); 766 767 VOID 768 DestroyBTreeNode(PB_TREE_FILENAME_NODE Node); 769 770 VOID 771 DumpBTree(PB_TREE Tree); 772 773 VOID 774 DumpBTreeKey(PB_TREE Tree, 775 PB_TREE_KEY Key, 776 ULONG Number, 777 ULONG Depth); 778 779 VOID 780 DumpBTreeNode(PB_TREE Tree, 781 PB_TREE_FILENAME_NODE Node, 782 ULONG Number, 783 ULONG Depth); 784 785 NTSTATUS 786 CreateEmptyBTree(PB_TREE *NewTree); 787 788 ULONGLONG 789 GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt, 790 ULONG IndexBufferSize, 791 ULONGLONG Vcn); 792 793 ULONGLONG 794 GetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry); 795 796 ULONG 797 GetSizeOfIndexEntries(PB_TREE_FILENAME_NODE Node); 798 799 NTSTATUS 800 NtfsInsertKey(PB_TREE Tree, 801 ULONGLONG FileReference, 802 PFILENAME_ATTRIBUTE FileNameAttribute, 803 PB_TREE_FILENAME_NODE Node, 804 BOOLEAN CaseSensitive, 805 ULONG MaxIndexRootSize, 806 ULONG IndexRecordSize, 807 PB_TREE_KEY *MedianKey, 808 PB_TREE_FILENAME_NODE *NewRightHandSibling); 809 810 NTSTATUS 811 SplitBTreeNode(PB_TREE Tree, 812 PB_TREE_FILENAME_NODE Node, 813 PB_TREE_KEY *MedianKey, 814 PB_TREE_FILENAME_NODE *NewRightHandSibling, 815 BOOLEAN CaseSensitive); 816 817 NTSTATUS 818 UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt, 819 PB_TREE Tree, 820 ULONG IndexBufferSize, 821 PFILE_RECORD_HEADER FileRecord); 822 823 NTSTATUS 824 UpdateIndexNode(PDEVICE_EXTENSION DeviceExt, 825 PFILE_RECORD_HEADER FileRecord, 826 PB_TREE_FILENAME_NODE Node, 827 ULONG IndexBufferSize, 828 PNTFS_ATTR_CONTEXT IndexAllocationContext, 829 ULONG IndexAllocationOffset); 830 831 /* close.c */ 832 833 NTSTATUS 834 NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext); 835 836 837 /* close.c */ 838 839 NTSTATUS 840 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, 841 PFILE_OBJECT FileObject); 842 843 NTSTATUS 844 NtfsClose(PNTFS_IRP_CONTEXT IrpContext); 845 846 847 /* create.c */ 848 849 NTSTATUS 850 NtfsCreate(PNTFS_IRP_CONTEXT IrpContext); 851 852 NTSTATUS 853 NtfsCreateDirectory(PDEVICE_EXTENSION DeviceExt, 854 PFILE_OBJECT FileObject, 855 BOOLEAN CaseSensitive, 856 BOOLEAN CanWait); 857 858 PFILE_RECORD_HEADER 859 NtfsCreateEmptyFileRecord(PDEVICE_EXTENSION DeviceExt); 860 861 NTSTATUS 862 NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt, 863 PFILE_OBJECT FileObject, 864 BOOLEAN CaseSensitive, 865 BOOLEAN CanWait); 866 867 /* devctl.c */ 868 869 NTSTATUS 870 NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext); 871 872 873 /* dirctl.c */ 874 875 ULONGLONG 876 NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, 877 PFILE_RECORD_HEADER FileRecord, 878 PCWSTR Stream, 879 ULONG StreamLength, 880 PULONGLONG AllocatedSize); 881 882 NTSTATUS 883 NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext); 884 885 886 /* dispatch.c */ 887 888 DRIVER_DISPATCH NtfsFsdDispatch; 889 NTSTATUS NTAPI 890 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject, 891 PIRP Irp); 892 893 894 /* fastio.c */ 895 896 BOOLEAN NTAPI 897 NtfsAcqLazyWrite(PVOID Context, 898 BOOLEAN Wait); 899 900 VOID NTAPI 901 NtfsRelLazyWrite(PVOID Context); 902 903 BOOLEAN NTAPI 904 NtfsAcqReadAhead(PVOID Context, 905 BOOLEAN Wait); 906 907 VOID NTAPI 908 NtfsRelReadAhead(PVOID Context); 909 910 FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible; 911 FAST_IO_READ NtfsFastIoRead; 912 FAST_IO_WRITE NtfsFastIoWrite; 913 914 915 /* fcb.c */ 916 917 PNTFS_FCB 918 NtfsCreateFCB(PCWSTR FileName, 919 PCWSTR Stream, 920 PNTFS_VCB Vcb); 921 922 VOID 923 NtfsDestroyFCB(PNTFS_FCB Fcb); 924 925 BOOLEAN 926 NtfsFCBIsDirectory(PNTFS_FCB Fcb); 927 928 BOOLEAN 929 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb); 930 931 BOOLEAN 932 NtfsFCBIsCompressed(PNTFS_FCB Fcb); 933 934 BOOLEAN 935 NtfsFCBIsRoot(PNTFS_FCB Fcb); 936 937 VOID 938 NtfsGrabFCB(PNTFS_VCB Vcb, 939 PNTFS_FCB Fcb); 940 941 VOID 942 NtfsReleaseFCB(PNTFS_VCB Vcb, 943 PNTFS_FCB Fcb); 944 945 VOID 946 NtfsAddFCBToTable(PNTFS_VCB Vcb, 947 PNTFS_FCB Fcb); 948 949 PNTFS_FCB 950 NtfsGrabFCBFromTable(PNTFS_VCB Vcb, 951 PCWSTR FileName); 952 953 NTSTATUS 954 NtfsFCBInitializeCache(PNTFS_VCB Vcb, 955 PNTFS_FCB Fcb); 956 957 PNTFS_FCB 958 NtfsMakeRootFCB(PNTFS_VCB Vcb); 959 960 PNTFS_FCB 961 NtfsOpenRootFCB(PNTFS_VCB Vcb); 962 963 NTSTATUS 964 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb, 965 PNTFS_FCB Fcb, 966 PFILE_OBJECT FileObject); 967 968 NTSTATUS 969 NtfsGetFCBForFile(PNTFS_VCB Vcb, 970 PNTFS_FCB *pParentFCB, 971 PNTFS_FCB *pFCB, 972 PCWSTR pFileName, 973 BOOLEAN CaseSensitive); 974 975 NTSTATUS 976 NtfsReadFCBAttribute(PNTFS_VCB Vcb, 977 PNTFS_FCB pFCB, 978 ULONG Type, 979 PCWSTR Name, 980 ULONG NameLength, 981 PVOID * Data); 982 983 NTSTATUS 984 NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb, 985 PNTFS_FCB DirectoryFCB, 986 PUNICODE_STRING Name, 987 PCWSTR Stream, 988 PFILE_RECORD_HEADER Record, 989 ULONGLONG MFTIndex, 990 PNTFS_FCB * fileFCB); 991 992 993 /* finfo.c */ 994 995 NTSTATUS 996 NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext); 997 998 NTSTATUS 999 NtfsSetEndOfFile(PNTFS_FCB Fcb, 1000 PFILE_OBJECT FileObject, 1001 PDEVICE_EXTENSION DeviceExt, 1002 ULONG IrpFlags, 1003 BOOLEAN CaseSensitive, 1004 PLARGE_INTEGER NewFileSize); 1005 1006 NTSTATUS 1007 NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext); 1008 1009 /* fsctl.c */ 1010 1011 NTSTATUS 1012 NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext); 1013 1014 1015 /* mft.c */ 1016 NTSTATUS 1017 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt, 1018 ULONGLONG DirectoryMftIndex, 1019 ULONGLONG FileReferenceNumber, 1020 PFILENAME_ATTRIBUTE FilenameAttribute, 1021 BOOLEAN CaseSensitive); 1022 1023 NTSTATUS 1024 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, 1025 PDEVICE_EXTENSION DeviceExt, 1026 PULONGLONG DestinationIndex, 1027 BOOLEAN CanWait); 1028 1029 VOID 1030 NtfsDumpData(ULONG_PTR Buffer, ULONG Length); 1031 1032 PNTFS_ATTR_CONTEXT 1033 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord); 1034 1035 VOID 1036 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context); 1037 1038 ULONG 1039 ReadAttribute(PDEVICE_EXTENSION Vcb, 1040 PNTFS_ATTR_CONTEXT Context, 1041 ULONGLONG Offset, 1042 PCHAR Buffer, 1043 ULONG Length); 1044 1045 NTSTATUS 1046 WriteAttribute(PDEVICE_EXTENSION Vcb, 1047 PNTFS_ATTR_CONTEXT Context, 1048 ULONGLONG Offset, 1049 const PUCHAR Buffer, 1050 ULONG Length, 1051 PULONG LengthWritten, 1052 PFILE_RECORD_HEADER FileRecord); 1053 1054 ULONGLONG 1055 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord); 1056 1057 NTSTATUS 1058 InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, 1059 PNTFS_ATTR_CONTEXT AttrContext, 1060 PFILE_RECORD_HEADER FileRecord, 1061 ULONG AttrOffset, 1062 ULONG DataSize); 1063 1064 PNTFS_ATTR_RECORD 1065 MoveAttributes(PDEVICE_EXTENSION DeviceExt, 1066 PNTFS_ATTR_RECORD FirstAttributeToMove, 1067 ULONG FirstAttributeOffset, 1068 ULONG_PTR MoveTo); 1069 1070 NTSTATUS 1071 SetAttributeDataLength(PFILE_OBJECT FileObject, 1072 PNTFS_FCB Fcb, 1073 PNTFS_ATTR_CONTEXT AttrContext, 1074 ULONG AttrOffset, 1075 PFILE_RECORD_HEADER FileRecord, 1076 PLARGE_INTEGER DataSize); 1077 1078 VOID 1079 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, 1080 PNTFS_ATTR_RECORD AttrEnd, 1081 ULONG EndMarker); 1082 1083 NTSTATUS 1084 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, 1085 PNTFS_ATTR_CONTEXT AttrContext, 1086 ULONG AttrOffset, 1087 PFILE_RECORD_HEADER FileRecord, 1088 PLARGE_INTEGER DataSize); 1089 1090 NTSTATUS 1091 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, 1092 PNTFS_ATTR_CONTEXT AttrContext, 1093 ULONG AttrOffset, 1094 PFILE_RECORD_HEADER FileRecord, 1095 PLARGE_INTEGER DataSize); 1096 1097 ULONGLONG 1098 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord); 1099 1100 BOOLEAN 1101 CompareFileName(PUNICODE_STRING FileName, 1102 PINDEX_ENTRY_ATTRIBUTE IndexEntry, 1103 BOOLEAN DirSearch, 1104 BOOLEAN CaseSensitive); 1105 1106 NTSTATUS 1107 UpdateMftMirror(PNTFS_VCB Vcb); 1108 1109 NTSTATUS 1110 ReadFileRecord(PDEVICE_EXTENSION Vcb, 1111 ULONGLONG index, 1112 PFILE_RECORD_HEADER file); 1113 1114 NTSTATUS 1115 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb, 1116 PFILE_RECORD_HEADER MftRecord, 1117 PCHAR IndexRecord, 1118 ULONG IndexBlockSize, 1119 PINDEX_ENTRY_ATTRIBUTE FirstEntry, 1120 PINDEX_ENTRY_ATTRIBUTE LastEntry, 1121 PUNICODE_STRING FileName, 1122 PULONG StartEntry, 1123 PULONG CurrentEntry, 1124 BOOLEAN DirSearch, 1125 ULONGLONG NewDataSize, 1126 ULONGLONG NewAllocatedSize, 1127 BOOLEAN CaseSensitive); 1128 1129 NTSTATUS 1130 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb, 1131 ULONGLONG ParentMFTIndex, 1132 PUNICODE_STRING FileName, 1133 BOOLEAN DirSearch, 1134 ULONGLONG NewDataSize, 1135 ULONGLONG NewAllocationSize, 1136 BOOLEAN CaseSensitive); 1137 1138 NTSTATUS 1139 UpdateFileRecord(PDEVICE_EXTENSION Vcb, 1140 ULONGLONG MftIndex, 1141 PFILE_RECORD_HEADER FileRecord); 1142 1143 NTSTATUS 1144 FindAttribute(PDEVICE_EXTENSION Vcb, 1145 PFILE_RECORD_HEADER MftRecord, 1146 ULONG Type, 1147 PCWSTR Name, 1148 ULONG NameLength, 1149 PNTFS_ATTR_CONTEXT * AttrCtx, 1150 PULONG Offset); 1151 1152 VOID 1153 ReadVCN(PDEVICE_EXTENSION Vcb, 1154 PFILE_RECORD_HEADER file, 1155 ATTRIBUTE_TYPE type, 1156 ULONGLONG vcn, 1157 ULONG count, 1158 PVOID buffer); 1159 1160 NTSTATUS 1161 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, 1162 PNTFS_RECORD_HEADER Record); 1163 1164 NTSTATUS 1165 AddFixupArray(PDEVICE_EXTENSION Vcb, 1166 PNTFS_RECORD_HEADER Record); 1167 1168 NTSTATUS 1169 ReadLCN(PDEVICE_EXTENSION Vcb, 1170 ULONGLONG lcn, 1171 ULONG count, 1172 PVOID buffer); 1173 1174 VOID 1175 EnumerAttribute(PFILE_RECORD_HEADER file, 1176 PDEVICE_EXTENSION Vcb, 1177 PDEVICE_OBJECT DeviceObject); 1178 1179 NTSTATUS 1180 NtfsLookupFile(PDEVICE_EXTENSION Vcb, 1181 PUNICODE_STRING PathName, 1182 BOOLEAN CaseSensitive, 1183 PFILE_RECORD_HEADER *FileRecord, 1184 PULONGLONG MFTIndex); 1185 1186 NTSTATUS 1187 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, 1188 PUNICODE_STRING PathName, 1189 BOOLEAN CaseSensitive, 1190 PFILE_RECORD_HEADER *FileRecord, 1191 PULONGLONG MFTIndex, 1192 ULONGLONG CurrentMFTIndex); 1193 1194 VOID 1195 NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, 1196 PFILE_RECORD_HEADER FileRecord); 1197 1198 NTSTATUS 1199 NtfsFindFileAt(PDEVICE_EXTENSION Vcb, 1200 PUNICODE_STRING SearchPattern, 1201 PULONG FirstEntry, 1202 PFILE_RECORD_HEADER *FileRecord, 1203 PULONGLONG MFTIndex, 1204 ULONGLONG CurrentMFTIndex, 1205 BOOLEAN CaseSensitive); 1206 1207 NTSTATUS 1208 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb, 1209 ULONGLONG MFTIndex, 1210 PUNICODE_STRING FileName, 1211 PULONG FirstEntry, 1212 BOOLEAN DirSearch, 1213 BOOLEAN CaseSensitive, 1214 ULONGLONG *OutMFTIndex); 1215 1216 /* misc.c */ 1217 1218 BOOLEAN 1219 NtfsIsIrpTopLevel(PIRP Irp); 1220 1221 PNTFS_IRP_CONTEXT 1222 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, 1223 PIRP Irp); 1224 1225 PVOID 1226 NtfsGetUserBuffer(PIRP Irp, 1227 BOOLEAN Paging); 1228 1229 NTSTATUS 1230 NtfsLockUserBuffer(IN PIRP Irp, 1231 IN ULONG Length, 1232 IN LOCK_OPERATION Operation); 1233 1234 #if 0 1235 BOOLEAN 1236 wstrcmpjoki(PWSTR s1, PWSTR s2); 1237 1238 VOID 1239 CdfsSwapString(PWCHAR Out, 1240 PUCHAR In, 1241 ULONG Count); 1242 #endif 1243 1244 VOID 1245 NtfsFileFlagsToAttributes(ULONG NtfsAttributes, 1246 PULONG FileAttributes); 1247 1248 1249 /* rw.c */ 1250 1251 NTSTATUS 1252 NtfsRead(PNTFS_IRP_CONTEXT IrpContext); 1253 1254 NTSTATUS 1255 NtfsWrite(PNTFS_IRP_CONTEXT IrpContext); 1256 1257 1258 /* volinfo.c */ 1259 1260 NTSTATUS 1261 NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt, 1262 ULONG FirstDesiredCluster, 1263 ULONG DesiredClusters, 1264 PULONG FirstAssignedCluster, 1265 PULONG AssignedClusters); 1266 1267 ULONGLONG 1268 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt); 1269 1270 NTSTATUS 1271 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 1272 1273 NTSTATUS 1274 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 1275 1276 1277 /* ntfs.c */ 1278 1279 INIT_FUNCTION 1280 DRIVER_INITIALIZE DriverEntry; 1281 1282 INIT_FUNCTION 1283 VOID 1284 NTAPI 1285 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject); 1286 1287 #endif /* NTFS_H */ 1288