1 #ifndef NTFS_H 2 #define NTFS_H 3 4 #include <ntifs.h> 5 #include <pseh/pseh2.h> 6 #include <section_attribs.h> 7 8 #define CACHEPAGESIZE(pDeviceExt) \ 9 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \ 10 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE) 11 12 #define TAG_NTFS '0ftN' 13 #define TAG_CCB 'CftN' 14 #define TAG_FCB 'FftN' 15 #define TAG_IRP_CTXT 'iftN' 16 #define TAG_ATT_CTXT 'aftN' 17 #define TAG_FILE_REC 'rftN' 18 19 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S)) 20 #define ROUND_DOWN(N, S) ((N) - ((N) % (S))) 21 22 #define DEVICE_NAME L"\\Ntfs" 23 24 #include <pshpack1.h> 25 typedef struct _BIOS_PARAMETERS_BLOCK 26 { 27 USHORT BytesPerSector; // 0x0B 28 UCHAR SectorsPerCluster; // 0x0D 29 UCHAR Unused0[7]; // 0x0E, checked when volume is mounted 30 UCHAR MediaId; // 0x15 31 UCHAR Unused1[2]; // 0x16 32 USHORT SectorsPerTrack; // 0x18 33 USHORT Heads; // 0x1A 34 UCHAR Unused2[4]; // 0x1C 35 UCHAR Unused3[4]; // 0x20, checked when volume is mounted 36 } BIOS_PARAMETERS_BLOCK, *PBIOS_PARAMETERS_BLOCK; 37 38 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK 39 { 40 USHORT Unknown[2]; // 0x24, always 80 00 80 00 41 ULONGLONG SectorCount; // 0x28 42 ULONGLONG MftLocation; // 0x30 43 ULONGLONG MftMirrLocation; // 0x38 44 CHAR ClustersPerMftRecord; // 0x40 45 UCHAR Unused4[3]; // 0x41 46 CHAR ClustersPerIndexRecord; // 0x44 47 UCHAR Unused5[3]; // 0x45 48 ULONGLONG SerialNumber; // 0x48 49 UCHAR Checksum[4]; // 0x50 50 } EXTENDED_BIOS_PARAMETERS_BLOCK, *PEXTENDED_BIOS_PARAMETERS_BLOCK; 51 52 typedef struct _BOOT_SECTOR 53 { 54 UCHAR Jump[3]; // 0x00 55 UCHAR OEMID[8]; // 0x03 56 BIOS_PARAMETERS_BLOCK BPB; 57 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB; 58 UCHAR BootStrap[426]; // 0x54 59 USHORT EndSector; // 0x1FE 60 } BOOT_SECTOR, *PBOOT_SECTOR; 61 #include <poppack.h> 62 63 //typedef struct _BootSector BootSector; 64 65 typedef struct _NTFS_INFO 66 { 67 ULONG BytesPerSector; 68 ULONG SectorsPerCluster; 69 ULONG BytesPerCluster; 70 ULONGLONG SectorCount; 71 ULONGLONG ClusterCount; 72 ULARGE_INTEGER MftStart; 73 ULARGE_INTEGER MftMirrStart; 74 ULONG BytesPerFileRecord; 75 ULONG BytesPerIndexRecord; 76 77 ULONGLONG SerialNumber; 78 USHORT VolumeLabelLength; 79 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]; 80 UCHAR MajorVersion; 81 UCHAR MinorVersion; 82 USHORT Flags; 83 84 ULONG MftZoneReservation; 85 } NTFS_INFO, *PNTFS_INFO; 86 87 #define NTFS_TYPE_CCB '20SF' 88 #define NTFS_TYPE_FCB '30SF' 89 #define NTFS_TYPE_VCB '50SF' 90 #define NTFS_TYPE_IRP_CONTEXT '60SF' 91 #define NTFS_TYPE_GLOBAL_DATA '70SF' 92 93 typedef struct 94 { 95 ULONG Type; 96 ULONG Size; 97 } NTFSIDENTIFIER, *PNTFSIDENTIFIER; 98 99 typedef struct 100 { 101 NTFSIDENTIFIER Identifier; 102 103 ERESOURCE DirResource; 104 // ERESOURCE FatResource; 105 106 KSPIN_LOCK FcbListLock; 107 LIST_ENTRY FcbListHead; 108 109 PVPB Vpb; 110 PDEVICE_OBJECT StorageDevice; 111 PFILE_OBJECT StreamFileObject; 112 113 struct _NTFS_ATTR_CONTEXT* MFTContext; 114 struct _FILE_RECORD_HEADER* MasterFileTable; 115 struct _FCB *VolumeFcb; 116 117 NTFS_INFO NtfsInfo; 118 119 NPAGED_LOOKASIDE_LIST FileRecLookasideList; 120 121 ULONG MftDataOffset; 122 ULONG Flags; 123 ULONG OpenHandleCount; 124 125 } DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB; 126 127 #define VCB_VOLUME_LOCKED 0x0001 128 129 typedef struct 130 { 131 NTFSIDENTIFIER Identifier; 132 LIST_ENTRY NextCCB; 133 PFILE_OBJECT PtrFileObject; 134 LARGE_INTEGER CurrentByteOffset; 135 /* for DirectoryControl */ 136 ULONG Entry; 137 /* for DirectoryControl */ 138 PWCHAR DirectorySearchPattern; 139 ULONG LastCluster; 140 ULONG LastOffset; 141 } NTFS_CCB, *PNTFS_CCB; 142 143 typedef struct 144 { 145 NTFSIDENTIFIER Identifier; 146 ERESOURCE Resource; 147 PDRIVER_OBJECT DriverObject; 148 PDEVICE_OBJECT DeviceObject; 149 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks; 150 ULONG Flags; 151 FAST_IO_DISPATCH FastIoDispatch; 152 NPAGED_LOOKASIDE_LIST IrpContextLookasideList; 153 NPAGED_LOOKASIDE_LIST FcbLookasideList; 154 NPAGED_LOOKASIDE_LIST AttrCtxtLookasideList; 155 BOOLEAN EnableWriteSupport; 156 } NTFS_GLOBAL_DATA, *PNTFS_GLOBAL_DATA; 157 158 159 typedef enum 160 { 161 AttributeStandardInformation = 0x10, 162 AttributeAttributeList = 0x20, 163 AttributeFileName = 0x30, 164 AttributeObjectId = 0x40, 165 AttributeSecurityDescriptor = 0x50, 166 AttributeVolumeName = 0x60, 167 AttributeVolumeInformation = 0x70, 168 AttributeData = 0x80, 169 AttributeIndexRoot = 0x90, 170 AttributeIndexAllocation = 0xA0, 171 AttributeBitmap = 0xB0, 172 AttributeReparsePoint = 0xC0, 173 AttributeEAInformation = 0xD0, 174 AttributeEA = 0xE0, 175 AttributePropertySet = 0xF0, 176 AttributeLoggedUtilityStream = 0x100, 177 AttributeEnd = 0xFFFFFFFF 178 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE; 179 180 // FILE_RECORD_END seems to follow AttributeEnd in every file record starting with $Quota. 181 // No clue what data is being represented here. 182 #define FILE_RECORD_END 0x11477982 183 184 #define NTFS_FILE_MFT 0 185 #define NTFS_FILE_MFTMIRR 1 186 #define NTFS_FILE_LOGFILE 2 187 #define NTFS_FILE_VOLUME 3 188 #define NTFS_FILE_ATTRDEF 4 189 #define NTFS_FILE_ROOT 5 190 #define NTFS_FILE_BITMAP 6 191 #define NTFS_FILE_BOOT 7 192 #define NTFS_FILE_BADCLUS 8 193 #define NTFS_FILE_QUOTA 9 194 #define NTFS_FILE_UPCASE 10 195 #define NTFS_FILE_EXTEND 11 196 #define NTFS_FILE_FIRST_USER_FILE 16 197 198 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL 199 200 #define COLLATION_BINARY 0x00 201 #define COLLATION_FILE_NAME 0x01 202 #define COLLATION_UNICODE_STRING 0x02 203 #define COLLATION_NTOFS_ULONG 0x10 204 #define COLLATION_NTOFS_SID 0x11 205 #define COLLATION_NTOFS_SECURITY_HASH 0x12 206 #define COLLATION_NTOFS_ULONGS 0x13 207 208 #define INDEX_ROOT_SMALL 0x0 209 #define INDEX_ROOT_LARGE 0x1 210 211 #define INDEX_NODE_SMALL 0x0 212 #define INDEX_NODE_LARGE 0x1 213 214 #define NTFS_INDEX_ENTRY_NODE 1 215 #define NTFS_INDEX_ENTRY_END 2 216 217 #define NTFS_FILE_NAME_POSIX 0 218 #define NTFS_FILE_NAME_WIN32 1 219 #define NTFS_FILE_NAME_DOS 2 220 #define NTFS_FILE_NAME_WIN32_AND_DOS 3 221 222 #define NTFS_FILE_TYPE_READ_ONLY 0x1 223 #define NTFS_FILE_TYPE_HIDDEN 0x2 224 #define NTFS_FILE_TYPE_SYSTEM 0x4 225 #define NTFS_FILE_TYPE_ARCHIVE 0x20 226 #define NTFS_FILE_TYPE_REPARSE 0x400 227 #define NTFS_FILE_TYPE_COMPRESSED 0x800 228 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000 229 230 /* Indexed Flag in Resident attributes - still somewhat speculative */ 231 #define RA_INDEXED 0x01 232 233 typedef struct 234 { 235 ULONG Type; /* Magic number 'FILE' */ 236 USHORT UsaOffset; /* Offset to the update sequence */ 237 USHORT UsaCount; /* Size in words of Update Sequence Number & Array (S) */ 238 ULONGLONG Lsn; /* $LogFile Sequence Number (LSN) */ 239 } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER; 240 241 /* NTFS_RECORD_HEADER.Type */ 242 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */ 243 #define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */ 244 245 246 typedef struct _FILE_RECORD_HEADER 247 { 248 NTFS_RECORD_HEADER Ntfs; 249 USHORT SequenceNumber; /* Sequence number */ 250 USHORT LinkCount; /* Hard link count */ 251 USHORT AttributeOffset; /* Offset to the first Attribute */ 252 USHORT Flags; /* Flags */ 253 ULONG BytesInUse; /* Real size of the FILE record */ 254 ULONG BytesAllocated; /* Allocated size of the FILE record */ 255 ULONGLONG BaseFileRecord; /* File reference to the base FILE record */ 256 USHORT NextAttributeNumber; /* Next Attribute Id */ 257 USHORT Padding; /* Align to 4 UCHAR boundary (XP) */ 258 ULONG MFTRecordNumber; /* Number of this MFT Record (XP) */ 259 } FILE_RECORD_HEADER, *PFILE_RECORD_HEADER; 260 261 /* Flags in FILE_RECORD_HEADER */ 262 263 #define FRH_IN_USE 0x0001 /* Record is in use */ 264 #define FRH_DIRECTORY 0x0002 /* Record is a directory */ 265 #define FRH_UNKNOWN1 0x0004 /* Don't know */ 266 #define FRH_UNKNOWN2 0x0008 /* Don't know */ 267 268 typedef struct 269 { 270 ULONG Type; 271 ULONG Length; 272 UCHAR IsNonResident; 273 UCHAR NameLength; 274 USHORT NameOffset; 275 USHORT Flags; 276 USHORT Instance; 277 union 278 { 279 // Resident attributes 280 struct 281 { 282 ULONG ValueLength; 283 USHORT ValueOffset; 284 UCHAR Flags; 285 UCHAR Reserved; 286 } Resident; 287 // Non-resident attributes 288 struct 289 { 290 ULONGLONG LowestVCN; 291 ULONGLONG HighestVCN; 292 USHORT MappingPairsOffset; 293 USHORT CompressionUnit; 294 UCHAR Reserved[4]; 295 LONGLONG AllocatedSize; 296 LONGLONG DataSize; 297 LONGLONG InitializedSize; 298 LONGLONG CompressedSize; 299 } NonResident; 300 }; 301 } NTFS_ATTR_RECORD, *PNTFS_ATTR_RECORD; 302 303 // The beginning and length of an attribute record are always aligned to an 8-byte boundary, 304 // relative to the beginning of the file record. 305 #define ATTR_RECORD_ALIGNMENT 8 306 307 // Data runs are aligned to a 4-byte boundary, relative to the start of the attribute record 308 #define DATA_RUN_ALIGNMENT 4 309 310 // Value offset is aligned to a 4-byte boundary, relative to the start of the attribute record 311 #define VALUE_OFFSET_ALIGNMENT 4 312 313 typedef struct 314 { 315 ULONGLONG CreationTime; 316 ULONGLONG ChangeTime; 317 ULONGLONG LastWriteTime; 318 ULONGLONG LastAccessTime; 319 ULONG FileAttribute; 320 ULONG AlignmentOrReserved[3]; 321 #if 0 322 ULONG QuotaId; 323 ULONG SecurityId; 324 ULONGLONG QuotaCharge; 325 USN Usn; 326 #endif 327 } STANDARD_INFORMATION, *PSTANDARD_INFORMATION; 328 329 330 typedef struct 331 { 332 ATTRIBUTE_TYPE AttributeType; 333 USHORT Length; 334 UCHAR NameLength; 335 UCHAR NameOffset; 336 ULONGLONG StartVcn; // LowVcn 337 ULONGLONG FileReferenceNumber; 338 USHORT AttributeNumber; 339 USHORT AlignmentOrReserved[3]; 340 } ATTRIBUTE_LIST, *PATTRIBUTE_LIST; 341 342 343 typedef struct 344 { 345 ULONGLONG DirectoryFileReferenceNumber; 346 ULONGLONG CreationTime; 347 ULONGLONG ChangeTime; 348 ULONGLONG LastWriteTime; 349 ULONGLONG LastAccessTime; 350 ULONGLONG AllocatedSize; 351 ULONGLONG DataSize; 352 ULONG FileAttributes; 353 union 354 { 355 struct 356 { 357 USHORT PackedEaSize; 358 USHORT AlignmentOrReserved; 359 } EaInfo; 360 ULONG ReparseTag; 361 } Extended; 362 UCHAR NameLength; 363 UCHAR NameType; 364 WCHAR Name[1]; 365 } FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE; 366 367 typedef struct 368 { 369 ULONG FirstEntryOffset; 370 ULONG TotalSizeOfEntries; 371 ULONG AllocatedSize; 372 UCHAR Flags; 373 UCHAR Padding[3]; 374 } INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE; 375 376 typedef struct 377 { 378 ULONG AttributeType; 379 ULONG CollationRule; 380 ULONG SizeOfEntry; 381 UCHAR ClustersPerIndexRecord; 382 UCHAR Padding[3]; 383 INDEX_HEADER_ATTRIBUTE Header; 384 } INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE; 385 386 typedef struct 387 { 388 NTFS_RECORD_HEADER Ntfs; 389 ULONGLONG VCN; 390 INDEX_HEADER_ATTRIBUTE Header; 391 } INDEX_BUFFER, *PINDEX_BUFFER; 392 393 typedef struct 394 { 395 union 396 { 397 struct 398 { 399 ULONGLONG IndexedFile; 400 } Directory; 401 struct 402 { 403 USHORT DataOffset; 404 USHORT DataLength; 405 ULONG Reserved; 406 } ViewIndex; 407 } Data; 408 USHORT Length; 409 USHORT KeyLength; 410 USHORT Flags; 411 USHORT Reserved; 412 FILENAME_ATTRIBUTE FileName; 413 } INDEX_ENTRY_ATTRIBUTE, *PINDEX_ENTRY_ATTRIBUTE; 414 415 struct _B_TREE_FILENAME_NODE; 416 typedef struct _B_TREE_FILENAME_NODE B_TREE_FILENAME_NODE; 417 418 // Keys are arranged in nodes as an ordered, linked list 419 typedef struct _B_TREE_KEY 420 { 421 struct _B_TREE_KEY *NextKey; 422 B_TREE_FILENAME_NODE *LesserChild; // Child-Node. All the keys in this node will be sorted before IndexEntry 423 PINDEX_ENTRY_ATTRIBUTE IndexEntry; // must be last member for FIELD_OFFSET 424 }B_TREE_KEY, *PB_TREE_KEY; 425 426 // Every Node is just an ordered list of keys. 427 // Sub-nodes can be found attached to a key (if they exist). 428 // A key's sub-node precedes that key in the ordered list. 429 typedef struct _B_TREE_FILENAME_NODE 430 { 431 ULONG KeyCount; 432 BOOLEAN HasValidVCN; 433 BOOLEAN DiskNeedsUpdating; 434 ULONGLONG VCN; 435 PB_TREE_KEY FirstKey; 436 } B_TREE_FILENAME_NODE, *PB_TREE_FILENAME_NODE; 437 438 typedef struct 439 { 440 PB_TREE_FILENAME_NODE RootNode; 441 } B_TREE, *PB_TREE; 442 443 typedef struct 444 { 445 ULONGLONG Unknown1; 446 UCHAR MajorVersion; 447 UCHAR MinorVersion; 448 USHORT Flags; 449 ULONG Unknown2; 450 } VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE; 451 452 typedef struct { 453 ULONG ReparseTag; 454 USHORT DataLength; 455 USHORT Reserved; 456 UCHAR Data[1]; 457 } REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE; 458 459 #define IRPCONTEXT_CANWAIT 0x1 460 #define IRPCONTEXT_COMPLETE 0x2 461 #define IRPCONTEXT_QUEUE 0x4 462 463 typedef struct 464 { 465 NTFSIDENTIFIER Identifier; 466 ULONG Flags; 467 PIO_STACK_LOCATION Stack; 468 UCHAR MajorFunction; 469 UCHAR MinorFunction; 470 WORK_QUEUE_ITEM WorkQueueItem; 471 PIRP Irp; 472 BOOLEAN IsTopLevel; 473 PDEVICE_OBJECT DeviceObject; 474 PFILE_OBJECT FileObject; 475 NTSTATUS SavedExceptionCode; 476 CCHAR PriorityBoost; 477 } NTFS_IRP_CONTEXT, *PNTFS_IRP_CONTEXT; 478 479 typedef struct _NTFS_ATTR_CONTEXT 480 { 481 PUCHAR CacheRun; 482 ULONGLONG CacheRunOffset; 483 LONGLONG CacheRunStartLCN; 484 ULONGLONG CacheRunLength; 485 LONGLONG CacheRunLastLCN; 486 ULONGLONG CacheRunCurrentOffset; 487 LARGE_MCB DataRunsMCB; 488 ULONGLONG FileMFTIndex; 489 PNTFS_ATTR_RECORD pRecord; 490 } NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT; 491 492 #define FCB_CACHE_INITIALIZED 0x0001 493 #define FCB_IS_VOLUME_STREAM 0x0002 494 #define FCB_IS_VOLUME 0x0004 495 #define MAX_PATH 260 496 497 typedef struct _FCB 498 { 499 NTFSIDENTIFIER Identifier; 500 501 FSRTL_COMMON_FCB_HEADER RFCB; 502 SECTION_OBJECT_POINTERS SectionObjectPointers; 503 504 PFILE_OBJECT FileObject; 505 PNTFS_VCB Vcb; 506 507 WCHAR Stream[MAX_PATH]; 508 WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */ 509 WCHAR PathName[MAX_PATH]; /* path+filename 260 max */ 510 511 ERESOURCE PagingIoResource; 512 ERESOURCE MainResource; 513 514 LIST_ENTRY FcbListEntry; 515 struct _FCB* ParentFcb; 516 517 ULONG DirIndex; 518 519 LONG RefCount; 520 ULONG Flags; 521 ULONG OpenHandleCount; 522 523 ULONGLONG MFTIndex; 524 USHORT LinkCount; 525 526 FILENAME_ATTRIBUTE Entry; 527 528 } NTFS_FCB, *PNTFS_FCB; 529 530 typedef struct _FIND_ATTR_CONTXT 531 { 532 PDEVICE_EXTENSION Vcb; 533 BOOLEAN OnlyResident; 534 PNTFS_ATTR_RECORD FirstAttr; 535 PNTFS_ATTR_RECORD CurrAttr; 536 PNTFS_ATTR_RECORD LastAttr; 537 PNTFS_ATTR_RECORD NonResidentStart; 538 PNTFS_ATTR_RECORD NonResidentEnd; 539 ULONG Offset; 540 } FIND_ATTR_CONTXT, *PFIND_ATTR_CONTXT; 541 542 typedef struct 543 { 544 USHORT USN; 545 USHORT Array[]; 546 } FIXUP_ARRAY, *PFIXUP_ARRAY; 547 548 extern PNTFS_GLOBAL_DATA NtfsGlobalData; 549 550 FORCEINLINE 551 NTSTATUS 552 NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext) 553 { 554 PULONG Flags = &IrpContext->Flags; 555 556 *Flags &= ~IRPCONTEXT_COMPLETE; 557 *Flags |= IRPCONTEXT_QUEUE; 558 559 return STATUS_PENDING; 560 } 561 562 /* attrib.c */ 563 564 //VOID 565 //NtfsDumpAttribute(PATTRIBUTE Attribute); 566 567 NTSTATUS 568 AddBitmap(PNTFS_VCB Vcb, 569 PFILE_RECORD_HEADER FileRecord, 570 PNTFS_ATTR_RECORD AttributeAddress, 571 PCWSTR Name, 572 USHORT NameLength); 573 574 NTSTATUS 575 AddData(PFILE_RECORD_HEADER FileRecord, 576 PNTFS_ATTR_RECORD AttributeAddress); 577 578 NTSTATUS 579 AddRun(PNTFS_VCB Vcb, 580 PNTFS_ATTR_CONTEXT AttrContext, 581 ULONG AttrOffset, 582 PFILE_RECORD_HEADER FileRecord, 583 ULONGLONG NextAssignedCluster, 584 ULONG RunLength); 585 586 NTSTATUS 587 AddIndexAllocation(PNTFS_VCB Vcb, 588 PFILE_RECORD_HEADER FileRecord, 589 PNTFS_ATTR_RECORD AttributeAddress, 590 PCWSTR Name, 591 USHORT NameLength); 592 593 NTSTATUS 594 AddIndexRoot(PNTFS_VCB Vcb, 595 PFILE_RECORD_HEADER FileRecord, 596 PNTFS_ATTR_RECORD AttributeAddress, 597 PINDEX_ROOT_ATTRIBUTE NewIndexRoot, 598 ULONG RootLength, 599 PCWSTR Name, 600 USHORT NameLength); 601 602 NTSTATUS 603 AddFileName(PFILE_RECORD_HEADER FileRecord, 604 PNTFS_ATTR_RECORD AttributeAddress, 605 PDEVICE_EXTENSION DeviceExt, 606 PFILE_OBJECT FileObject, 607 BOOLEAN CaseSensitive, 608 PULONGLONG ParentMftIndex); 609 610 NTSTATUS 611 AddStandardInformation(PFILE_RECORD_HEADER FileRecord, 612 PNTFS_ATTR_RECORD AttributeAddress); 613 614 NTSTATUS 615 ConvertDataRunsToLargeMCB(PUCHAR DataRun, 616 PLARGE_MCB DataRunsMCB, 617 PULONGLONG pNextVBN); 618 619 NTSTATUS 620 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, 621 PUCHAR RunBuffer, 622 ULONG MaxBufferSize, 623 PULONG UsedBufferSize); 624 625 PUCHAR 626 DecodeRun(PUCHAR DataRun, 627 LONGLONG *DataRunOffset, 628 ULONGLONG *DataRunLength); 629 630 ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute); 631 632 VOID 633 NtfsDumpDataRuns(PVOID StartOfRun, 634 ULONGLONG CurrentLCN); 635 636 VOID 637 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, 638 PFILE_RECORD_HEADER FileRecord); 639 640 PSTANDARD_INFORMATION 641 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, 642 PFILE_RECORD_HEADER FileRecord); 643 644 PFILENAME_ATTRIBUTE 645 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, 646 PFILE_RECORD_HEADER FileRecord, 647 UCHAR NameType); 648 649 UCHAR 650 GetPackedByteCount(LONGLONG NumberToPack, 651 BOOLEAN IsSigned); 652 653 NTSTATUS 654 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb, 655 PNTFS_ATTR_RECORD Attribute, 656 PULONGLONG LastCluster); 657 658 PFILENAME_ATTRIBUTE 659 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, 660 PFILE_RECORD_HEADER FileRecord); 661 662 NTSTATUS 663 FindFirstAttribute(PFIND_ATTR_CONTXT Context, 664 PDEVICE_EXTENSION Vcb, 665 PFILE_RECORD_HEADER FileRecord, 666 BOOLEAN OnlyResident, 667 PNTFS_ATTR_RECORD * Attribute); 668 669 NTSTATUS 670 FindNextAttribute(PFIND_ATTR_CONTXT Context, 671 PNTFS_ATTR_RECORD * Attribute); 672 673 VOID 674 FindCloseAttribute(PFIND_ATTR_CONTXT Context); 675 676 NTSTATUS 677 FreeClusters(PNTFS_VCB Vcb, 678 PNTFS_ATTR_CONTEXT AttrContext, 679 ULONG AttrOffset, 680 PFILE_RECORD_HEADER FileRecord, 681 ULONG ClustersToFree); 682 683 /* blockdev.c */ 684 685 NTSTATUS 686 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, 687 IN LONGLONG StartingOffset, 688 IN ULONG Length, 689 IN ULONG SectorSize, 690 IN OUT PUCHAR Buffer, 691 IN BOOLEAN Override); 692 693 NTSTATUS 694 NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject, 695 IN LONGLONG StartingOffset, 696 IN ULONG Length, 697 IN ULONG SectorSize, 698 IN const PUCHAR Buffer); 699 700 NTSTATUS 701 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, 702 IN ULONG DiskSector, 703 IN ULONG SectorCount, 704 IN ULONG SectorSize, 705 IN OUT PUCHAR Buffer, 706 IN BOOLEAN Override); 707 708 NTSTATUS 709 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, 710 IN ULONG ControlCode, 711 IN PVOID InputBuffer, 712 IN ULONG InputBufferSize, 713 IN OUT PVOID OutputBuffer, 714 IN OUT PULONG OutputBufferSize, 715 IN BOOLEAN Override); 716 717 718 /* btree.c */ 719 720 LONG 721 CompareTreeKeys(PB_TREE_KEY Key1, 722 PB_TREE_KEY Key2, 723 BOOLEAN CaseSensitive); 724 725 NTSTATUS 726 CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb, 727 PFILE_RECORD_HEADER FileRecordWithIndex, 728 /*PCWSTR IndexName,*/ 729 PNTFS_ATTR_CONTEXT IndexRootContext, 730 PINDEX_ROOT_ATTRIBUTE IndexRoot, 731 PB_TREE *NewTree); 732 733 NTSTATUS 734 CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, 735 PB_TREE Tree, 736 ULONG MaxIndexSize, 737 PINDEX_ROOT_ATTRIBUTE *IndexRoot, 738 ULONG *Length); 739 740 NTSTATUS 741 DemoteBTreeRoot(PB_TREE Tree); 742 743 VOID 744 DestroyBTree(PB_TREE Tree); 745 746 VOID 747 DestroyBTreeNode(PB_TREE_FILENAME_NODE Node); 748 749 VOID 750 DumpBTree(PB_TREE Tree); 751 752 VOID 753 DumpBTreeKey(PB_TREE Tree, 754 PB_TREE_KEY Key, 755 ULONG Number, 756 ULONG Depth); 757 758 VOID 759 DumpBTreeNode(PB_TREE Tree, 760 PB_TREE_FILENAME_NODE Node, 761 ULONG Number, 762 ULONG Depth); 763 764 NTSTATUS 765 CreateEmptyBTree(PB_TREE *NewTree); 766 767 ULONGLONG 768 GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt, 769 ULONG IndexBufferSize, 770 ULONGLONG Vcn); 771 772 ULONGLONG 773 GetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry); 774 775 ULONG 776 GetSizeOfIndexEntries(PB_TREE_FILENAME_NODE Node); 777 778 NTSTATUS 779 NtfsInsertKey(PB_TREE Tree, 780 ULONGLONG FileReference, 781 PFILENAME_ATTRIBUTE FileNameAttribute, 782 PB_TREE_FILENAME_NODE Node, 783 BOOLEAN CaseSensitive, 784 ULONG MaxIndexRootSize, 785 ULONG IndexRecordSize, 786 PB_TREE_KEY *MedianKey, 787 PB_TREE_FILENAME_NODE *NewRightHandSibling); 788 789 NTSTATUS 790 SplitBTreeNode(PB_TREE Tree, 791 PB_TREE_FILENAME_NODE Node, 792 PB_TREE_KEY *MedianKey, 793 PB_TREE_FILENAME_NODE *NewRightHandSibling, 794 BOOLEAN CaseSensitive); 795 796 NTSTATUS 797 UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt, 798 PB_TREE Tree, 799 ULONG IndexBufferSize, 800 PFILE_RECORD_HEADER FileRecord); 801 802 NTSTATUS 803 UpdateIndexNode(PDEVICE_EXTENSION DeviceExt, 804 PFILE_RECORD_HEADER FileRecord, 805 PB_TREE_FILENAME_NODE Node, 806 ULONG IndexBufferSize, 807 PNTFS_ATTR_CONTEXT IndexAllocationContext, 808 ULONG IndexAllocationOffset); 809 810 /* close.c */ 811 812 NTSTATUS 813 NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext); 814 815 816 /* close.c */ 817 818 NTSTATUS 819 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, 820 PFILE_OBJECT FileObject); 821 822 NTSTATUS 823 NtfsClose(PNTFS_IRP_CONTEXT IrpContext); 824 825 826 /* create.c */ 827 828 NTSTATUS 829 NtfsCreate(PNTFS_IRP_CONTEXT IrpContext); 830 831 NTSTATUS 832 NtfsCreateDirectory(PDEVICE_EXTENSION DeviceExt, 833 PFILE_OBJECT FileObject, 834 BOOLEAN CaseSensitive, 835 BOOLEAN CanWait); 836 837 PFILE_RECORD_HEADER 838 NtfsCreateEmptyFileRecord(PDEVICE_EXTENSION DeviceExt); 839 840 NTSTATUS 841 NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt, 842 PFILE_OBJECT FileObject, 843 BOOLEAN CaseSensitive, 844 BOOLEAN CanWait); 845 846 /* devctl.c */ 847 848 NTSTATUS 849 NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext); 850 851 852 /* dirctl.c */ 853 854 ULONGLONG 855 NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, 856 PFILE_RECORD_HEADER FileRecord, 857 PCWSTR Stream, 858 ULONG StreamLength, 859 PULONGLONG AllocatedSize); 860 861 NTSTATUS 862 NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext); 863 864 865 /* dispatch.c */ 866 867 DRIVER_DISPATCH NtfsFsdDispatch; 868 NTSTATUS NTAPI 869 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject, 870 PIRP Irp); 871 872 873 /* fastio.c */ 874 875 BOOLEAN NTAPI 876 NtfsAcqLazyWrite(PVOID Context, 877 BOOLEAN Wait); 878 879 VOID NTAPI 880 NtfsRelLazyWrite(PVOID Context); 881 882 BOOLEAN NTAPI 883 NtfsAcqReadAhead(PVOID Context, 884 BOOLEAN Wait); 885 886 VOID NTAPI 887 NtfsRelReadAhead(PVOID Context); 888 889 FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible; 890 FAST_IO_READ NtfsFastIoRead; 891 FAST_IO_WRITE NtfsFastIoWrite; 892 893 894 /* fcb.c */ 895 896 PNTFS_FCB 897 NtfsCreateFCB(PCWSTR FileName, 898 PCWSTR Stream, 899 PNTFS_VCB Vcb); 900 901 VOID 902 NtfsDestroyFCB(PNTFS_FCB Fcb); 903 904 BOOLEAN 905 NtfsFCBIsDirectory(PNTFS_FCB Fcb); 906 907 BOOLEAN 908 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb); 909 910 BOOLEAN 911 NtfsFCBIsCompressed(PNTFS_FCB Fcb); 912 913 BOOLEAN 914 NtfsFCBIsRoot(PNTFS_FCB Fcb); 915 916 VOID 917 NtfsGrabFCB(PNTFS_VCB Vcb, 918 PNTFS_FCB Fcb); 919 920 VOID 921 NtfsReleaseFCB(PNTFS_VCB Vcb, 922 PNTFS_FCB Fcb); 923 924 VOID 925 NtfsAddFCBToTable(PNTFS_VCB Vcb, 926 PNTFS_FCB Fcb); 927 928 PNTFS_FCB 929 NtfsGrabFCBFromTable(PNTFS_VCB Vcb, 930 PCWSTR FileName); 931 932 NTSTATUS 933 NtfsFCBInitializeCache(PNTFS_VCB Vcb, 934 PNTFS_FCB Fcb); 935 936 PNTFS_FCB 937 NtfsMakeRootFCB(PNTFS_VCB Vcb); 938 939 PNTFS_FCB 940 NtfsOpenRootFCB(PNTFS_VCB Vcb); 941 942 NTSTATUS 943 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb, 944 PNTFS_FCB Fcb, 945 PFILE_OBJECT FileObject); 946 947 NTSTATUS 948 NtfsGetFCBForFile(PNTFS_VCB Vcb, 949 PNTFS_FCB *pParentFCB, 950 PNTFS_FCB *pFCB, 951 PCWSTR pFileName, 952 BOOLEAN CaseSensitive); 953 954 NTSTATUS 955 NtfsReadFCBAttribute(PNTFS_VCB Vcb, 956 PNTFS_FCB pFCB, 957 ULONG Type, 958 PCWSTR Name, 959 ULONG NameLength, 960 PVOID * Data); 961 962 NTSTATUS 963 NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb, 964 PNTFS_FCB DirectoryFCB, 965 PUNICODE_STRING Name, 966 PCWSTR Stream, 967 PFILE_RECORD_HEADER Record, 968 ULONGLONG MFTIndex, 969 PNTFS_FCB * fileFCB); 970 971 972 /* finfo.c */ 973 974 NTSTATUS 975 NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext); 976 977 NTSTATUS 978 NtfsSetEndOfFile(PNTFS_FCB Fcb, 979 PFILE_OBJECT FileObject, 980 PDEVICE_EXTENSION DeviceExt, 981 ULONG IrpFlags, 982 BOOLEAN CaseSensitive, 983 PLARGE_INTEGER NewFileSize); 984 985 NTSTATUS 986 NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext); 987 988 /* fsctl.c */ 989 990 NTSTATUS 991 NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext); 992 993 994 /* mft.c */ 995 NTSTATUS 996 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt, 997 ULONGLONG DirectoryMftIndex, 998 ULONGLONG FileReferenceNumber, 999 PFILENAME_ATTRIBUTE FilenameAttribute, 1000 BOOLEAN CaseSensitive); 1001 1002 NTSTATUS 1003 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, 1004 PDEVICE_EXTENSION DeviceExt, 1005 PULONGLONG DestinationIndex, 1006 BOOLEAN CanWait); 1007 1008 VOID 1009 NtfsDumpData(ULONG_PTR Buffer, ULONG Length); 1010 1011 PNTFS_ATTR_CONTEXT 1012 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord); 1013 1014 VOID 1015 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context); 1016 1017 ULONG 1018 ReadAttribute(PDEVICE_EXTENSION Vcb, 1019 PNTFS_ATTR_CONTEXT Context, 1020 ULONGLONG Offset, 1021 PCHAR Buffer, 1022 ULONG Length); 1023 1024 NTSTATUS 1025 WriteAttribute(PDEVICE_EXTENSION Vcb, 1026 PNTFS_ATTR_CONTEXT Context, 1027 ULONGLONG Offset, 1028 const PUCHAR Buffer, 1029 ULONG Length, 1030 PULONG LengthWritten, 1031 PFILE_RECORD_HEADER FileRecord); 1032 1033 ULONGLONG 1034 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord); 1035 1036 NTSTATUS 1037 InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, 1038 PNTFS_ATTR_CONTEXT AttrContext, 1039 PFILE_RECORD_HEADER FileRecord, 1040 ULONG AttrOffset, 1041 ULONG DataSize); 1042 1043 PNTFS_ATTR_RECORD 1044 MoveAttributes(PDEVICE_EXTENSION DeviceExt, 1045 PNTFS_ATTR_RECORD FirstAttributeToMove, 1046 ULONG FirstAttributeOffset, 1047 ULONG_PTR MoveTo); 1048 1049 NTSTATUS 1050 SetAttributeDataLength(PFILE_OBJECT FileObject, 1051 PNTFS_FCB Fcb, 1052 PNTFS_ATTR_CONTEXT AttrContext, 1053 ULONG AttrOffset, 1054 PFILE_RECORD_HEADER FileRecord, 1055 PLARGE_INTEGER DataSize); 1056 1057 VOID 1058 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, 1059 PNTFS_ATTR_RECORD AttrEnd, 1060 ULONG EndMarker); 1061 1062 NTSTATUS 1063 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, 1064 PNTFS_ATTR_CONTEXT AttrContext, 1065 ULONG AttrOffset, 1066 PFILE_RECORD_HEADER FileRecord, 1067 PLARGE_INTEGER DataSize); 1068 1069 NTSTATUS 1070 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, 1071 PNTFS_ATTR_CONTEXT AttrContext, 1072 ULONG AttrOffset, 1073 PFILE_RECORD_HEADER FileRecord, 1074 PLARGE_INTEGER DataSize); 1075 1076 ULONGLONG 1077 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord); 1078 1079 BOOLEAN 1080 CompareFileName(PUNICODE_STRING FileName, 1081 PINDEX_ENTRY_ATTRIBUTE IndexEntry, 1082 BOOLEAN DirSearch, 1083 BOOLEAN CaseSensitive); 1084 1085 NTSTATUS 1086 UpdateMftMirror(PNTFS_VCB Vcb); 1087 1088 NTSTATUS 1089 ReadFileRecord(PDEVICE_EXTENSION Vcb, 1090 ULONGLONG index, 1091 PFILE_RECORD_HEADER file); 1092 1093 NTSTATUS 1094 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb, 1095 PFILE_RECORD_HEADER MftRecord, 1096 PCHAR IndexRecord, 1097 ULONG IndexBlockSize, 1098 PINDEX_ENTRY_ATTRIBUTE FirstEntry, 1099 PINDEX_ENTRY_ATTRIBUTE LastEntry, 1100 PUNICODE_STRING FileName, 1101 PULONG StartEntry, 1102 PULONG CurrentEntry, 1103 BOOLEAN DirSearch, 1104 ULONGLONG NewDataSize, 1105 ULONGLONG NewAllocatedSize, 1106 BOOLEAN CaseSensitive); 1107 1108 NTSTATUS 1109 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb, 1110 ULONGLONG ParentMFTIndex, 1111 PUNICODE_STRING FileName, 1112 BOOLEAN DirSearch, 1113 ULONGLONG NewDataSize, 1114 ULONGLONG NewAllocationSize, 1115 BOOLEAN CaseSensitive); 1116 1117 NTSTATUS 1118 UpdateFileRecord(PDEVICE_EXTENSION Vcb, 1119 ULONGLONG MftIndex, 1120 PFILE_RECORD_HEADER FileRecord); 1121 1122 NTSTATUS 1123 FindAttribute(PDEVICE_EXTENSION Vcb, 1124 PFILE_RECORD_HEADER MftRecord, 1125 ULONG Type, 1126 PCWSTR Name, 1127 ULONG NameLength, 1128 PNTFS_ATTR_CONTEXT * AttrCtx, 1129 PULONG Offset); 1130 1131 VOID 1132 ReadVCN(PDEVICE_EXTENSION Vcb, 1133 PFILE_RECORD_HEADER file, 1134 ATTRIBUTE_TYPE type, 1135 ULONGLONG vcn, 1136 ULONG count, 1137 PVOID buffer); 1138 1139 NTSTATUS 1140 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, 1141 PNTFS_RECORD_HEADER Record); 1142 1143 NTSTATUS 1144 AddFixupArray(PDEVICE_EXTENSION Vcb, 1145 PNTFS_RECORD_HEADER Record); 1146 1147 NTSTATUS 1148 ReadLCN(PDEVICE_EXTENSION Vcb, 1149 ULONGLONG lcn, 1150 ULONG count, 1151 PVOID buffer); 1152 1153 VOID 1154 EnumerAttribute(PFILE_RECORD_HEADER file, 1155 PDEVICE_EXTENSION Vcb, 1156 PDEVICE_OBJECT DeviceObject); 1157 1158 NTSTATUS 1159 NtfsLookupFile(PDEVICE_EXTENSION Vcb, 1160 PUNICODE_STRING PathName, 1161 BOOLEAN CaseSensitive, 1162 PFILE_RECORD_HEADER *FileRecord, 1163 PULONGLONG MFTIndex); 1164 1165 NTSTATUS 1166 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, 1167 PUNICODE_STRING PathName, 1168 BOOLEAN CaseSensitive, 1169 PFILE_RECORD_HEADER *FileRecord, 1170 PULONGLONG MFTIndex, 1171 ULONGLONG CurrentMFTIndex); 1172 1173 VOID 1174 NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, 1175 PFILE_RECORD_HEADER FileRecord); 1176 1177 NTSTATUS 1178 NtfsFindFileAt(PDEVICE_EXTENSION Vcb, 1179 PUNICODE_STRING SearchPattern, 1180 PULONG FirstEntry, 1181 PFILE_RECORD_HEADER *FileRecord, 1182 PULONGLONG MFTIndex, 1183 ULONGLONG CurrentMFTIndex, 1184 BOOLEAN CaseSensitive); 1185 1186 NTSTATUS 1187 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb, 1188 ULONGLONG MFTIndex, 1189 PUNICODE_STRING FileName, 1190 PULONG FirstEntry, 1191 BOOLEAN DirSearch, 1192 BOOLEAN CaseSensitive, 1193 ULONGLONG *OutMFTIndex); 1194 1195 /* misc.c */ 1196 1197 BOOLEAN 1198 NtfsIsIrpTopLevel(PIRP Irp); 1199 1200 PNTFS_IRP_CONTEXT 1201 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, 1202 PIRP Irp); 1203 1204 PVOID 1205 NtfsGetUserBuffer(PIRP Irp, 1206 BOOLEAN Paging); 1207 1208 NTSTATUS 1209 NtfsLockUserBuffer(IN PIRP Irp, 1210 IN ULONG Length, 1211 IN LOCK_OPERATION Operation); 1212 1213 #if 0 1214 BOOLEAN 1215 wstrcmpjoki(PWSTR s1, PWSTR s2); 1216 1217 VOID 1218 CdfsSwapString(PWCHAR Out, 1219 PUCHAR In, 1220 ULONG Count); 1221 #endif 1222 1223 VOID 1224 NtfsFileFlagsToAttributes(ULONG NtfsAttributes, 1225 PULONG FileAttributes); 1226 1227 1228 /* rw.c */ 1229 1230 NTSTATUS 1231 NtfsRead(PNTFS_IRP_CONTEXT IrpContext); 1232 1233 NTSTATUS 1234 NtfsWrite(PNTFS_IRP_CONTEXT IrpContext); 1235 1236 1237 /* volinfo.c */ 1238 1239 NTSTATUS 1240 NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt, 1241 ULONG FirstDesiredCluster, 1242 ULONG DesiredClusters, 1243 PULONG FirstAssignedCluster, 1244 PULONG AssignedClusters); 1245 1246 ULONGLONG 1247 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt); 1248 1249 NTSTATUS 1250 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 1251 1252 NTSTATUS 1253 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 1254 1255 1256 /* ntfs.c */ 1257 1258 INIT_FUNCTION 1259 DRIVER_INITIALIZE DriverEntry; 1260 1261 INIT_FUNCTION 1262 VOID 1263 NTAPI 1264 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject); 1265 1266 #endif /* NTFS_H */ 1267