1 #ifndef NTFS_H 2 #define NTFS_H 3 4 #include <ntifs.h> 5 #include <pseh/pseh2.h> 6 7 #ifdef __GNUC__ 8 #define INIT_SECTION __attribute__((section ("INIT"))) 9 #else 10 #define INIT_SECTION /* Done via alloc_text for MSC */ 11 #endif 12 13 #define CACHEPAGESIZE(pDeviceExt) \ 14 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \ 15 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE) 16 17 #define TAG_NTFS '0ftN' 18 #define TAG_CCB 'CftN' 19 #define TAG_FCB 'FftN' 20 #define TAG_IRP_CTXT 'iftN' 21 #define TAG_ATT_CTXT 'aftN' 22 #define TAG_FILE_REC 'rftN' 23 24 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S)) 25 #define ROUND_DOWN(N, S) ((N) - ((N) % (S))) 26 27 #define DEVICE_NAME L"\\Ntfs" 28 29 #include <pshpack1.h> 30 typedef struct _BIOS_PARAMETERS_BLOCK 31 { 32 USHORT BytesPerSector; // 0x0B 33 UCHAR SectorsPerCluster; // 0x0D 34 UCHAR Unused0[7]; // 0x0E, checked when volume is mounted 35 UCHAR MediaId; // 0x15 36 UCHAR Unused1[2]; // 0x16 37 USHORT SectorsPerTrack; // 0x18 38 USHORT Heads; // 0x1A 39 UCHAR Unused2[4]; // 0x1C 40 UCHAR Unused3[4]; // 0x20, checked when volume is mounted 41 } BIOS_PARAMETERS_BLOCK, *PBIOS_PARAMETERS_BLOCK; 42 43 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK 44 { 45 USHORT Unknown[2]; // 0x24, always 80 00 80 00 46 ULONGLONG SectorCount; // 0x28 47 ULONGLONG MftLocation; // 0x30 48 ULONGLONG MftMirrLocation; // 0x38 49 CHAR ClustersPerMftRecord; // 0x40 50 UCHAR Unused4[3]; // 0x41 51 CHAR ClustersPerIndexRecord; // 0x44 52 UCHAR Unused5[3]; // 0x45 53 ULONGLONG SerialNumber; // 0x48 54 UCHAR Checksum[4]; // 0x50 55 } EXTENDED_BIOS_PARAMETERS_BLOCK, *PEXTENDED_BIOS_PARAMETERS_BLOCK; 56 57 typedef struct _BOOT_SECTOR 58 { 59 UCHAR Jump[3]; // 0x00 60 UCHAR OEMID[8]; // 0x03 61 BIOS_PARAMETERS_BLOCK BPB; 62 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB; 63 UCHAR BootStrap[426]; // 0x54 64 USHORT EndSector; // 0x1FE 65 } BOOT_SECTOR, *PBOOT_SECTOR; 66 #include <poppack.h> 67 68 //typedef struct _BootSector BootSector; 69 70 typedef struct _NTFS_INFO 71 { 72 ULONG BytesPerSector; 73 ULONG SectorsPerCluster; 74 ULONG BytesPerCluster; 75 ULONGLONG SectorCount; 76 ULONGLONG ClusterCount; 77 ULARGE_INTEGER MftStart; 78 ULARGE_INTEGER MftMirrStart; 79 ULONG BytesPerFileRecord; 80 ULONG BytesPerIndexRecord; 81 82 ULONGLONG SerialNumber; 83 USHORT VolumeLabelLength; 84 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]; 85 UCHAR MajorVersion; 86 UCHAR MinorVersion; 87 USHORT Flags; 88 89 ULONG MftZoneReservation; 90 } NTFS_INFO, *PNTFS_INFO; 91 92 #define NTFS_TYPE_CCB '20SF' 93 #define NTFS_TYPE_FCB '30SF' 94 #define NTFS_TYPE_VCB '50SF' 95 #define NTFS_TYPE_IRP_CONTEXT '60SF' 96 #define NTFS_TYPE_GLOBAL_DATA '70SF' 97 98 typedef struct 99 { 100 ULONG Type; 101 ULONG Size; 102 } NTFSIDENTIFIER, *PNTFSIDENTIFIER; 103 104 typedef struct 105 { 106 NTFSIDENTIFIER Identifier; 107 108 ERESOURCE DirResource; 109 // ERESOURCE FatResource; 110 111 KSPIN_LOCK FcbListLock; 112 LIST_ENTRY FcbListHead; 113 114 PVPB Vpb; 115 PDEVICE_OBJECT StorageDevice; 116 PFILE_OBJECT StreamFileObject; 117 118 struct _NTFS_ATTR_CONTEXT* MFTContext; 119 struct _FILE_RECORD_HEADER* MasterFileTable; 120 struct _FCB *VolumeFcb; 121 122 NTFS_INFO NtfsInfo; 123 124 NPAGED_LOOKASIDE_LIST FileRecLookasideList; 125 126 ULONG MftDataOffset; 127 ULONG Flags; 128 ULONG OpenHandleCount; 129 130 } DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB; 131 132 #define VCB_VOLUME_LOCKED 0x0001 133 134 typedef struct 135 { 136 NTFSIDENTIFIER Identifier; 137 LIST_ENTRY NextCCB; 138 PFILE_OBJECT PtrFileObject; 139 LARGE_INTEGER CurrentByteOffset; 140 /* for DirectoryControl */ 141 ULONG Entry; 142 /* for DirectoryControl */ 143 PWCHAR DirectorySearchPattern; 144 ULONG LastCluster; 145 ULONG LastOffset; 146 } NTFS_CCB, *PNTFS_CCB; 147 148 typedef struct 149 { 150 NTFSIDENTIFIER Identifier; 151 ERESOURCE Resource; 152 PDRIVER_OBJECT DriverObject; 153 PDEVICE_OBJECT DeviceObject; 154 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks; 155 ULONG Flags; 156 FAST_IO_DISPATCH FastIoDispatch; 157 NPAGED_LOOKASIDE_LIST IrpContextLookasideList; 158 NPAGED_LOOKASIDE_LIST FcbLookasideList; 159 NPAGED_LOOKASIDE_LIST AttrCtxtLookasideList; 160 BOOLEAN EnableWriteSupport; 161 } NTFS_GLOBAL_DATA, *PNTFS_GLOBAL_DATA; 162 163 164 typedef enum 165 { 166 AttributeStandardInformation = 0x10, 167 AttributeAttributeList = 0x20, 168 AttributeFileName = 0x30, 169 AttributeObjectId = 0x40, 170 AttributeSecurityDescriptor = 0x50, 171 AttributeVolumeName = 0x60, 172 AttributeVolumeInformation = 0x70, 173 AttributeData = 0x80, 174 AttributeIndexRoot = 0x90, 175 AttributeIndexAllocation = 0xA0, 176 AttributeBitmap = 0xB0, 177 AttributeReparsePoint = 0xC0, 178 AttributeEAInformation = 0xD0, 179 AttributeEA = 0xE0, 180 AttributePropertySet = 0xF0, 181 AttributeLoggedUtilityStream = 0x100, 182 AttributeEnd = 0xFFFFFFFF 183 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE; 184 185 // FILE_RECORD_END seems to follow AttributeEnd in every file record starting with $Quota. 186 // No clue what data is being represented here. 187 #define FILE_RECORD_END 0x11477982 188 189 #define NTFS_FILE_MFT 0 190 #define NTFS_FILE_MFTMIRR 1 191 #define NTFS_FILE_LOGFILE 2 192 #define NTFS_FILE_VOLUME 3 193 #define NTFS_FILE_ATTRDEF 4 194 #define NTFS_FILE_ROOT 5 195 #define NTFS_FILE_BITMAP 6 196 #define NTFS_FILE_BOOT 7 197 #define NTFS_FILE_BADCLUS 8 198 #define NTFS_FILE_QUOTA 9 199 #define NTFS_FILE_UPCASE 10 200 #define NTFS_FILE_EXTEND 11 201 #define NTFS_FILE_FIRST_USER_FILE 16 202 203 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL 204 205 #define COLLATION_BINARY 0x00 206 #define COLLATION_FILE_NAME 0x01 207 #define COLLATION_UNICODE_STRING 0x02 208 #define COLLATION_NTOFS_ULONG 0x10 209 #define COLLATION_NTOFS_SID 0x11 210 #define COLLATION_NTOFS_SECURITY_HASH 0x12 211 #define COLLATION_NTOFS_ULONGS 0x13 212 213 #define INDEX_ROOT_SMALL 0x0 214 #define INDEX_ROOT_LARGE 0x1 215 216 #define INDEX_NODE_SMALL 0x0 217 #define INDEX_NODE_LARGE 0x1 218 219 #define NTFS_INDEX_ENTRY_NODE 1 220 #define NTFS_INDEX_ENTRY_END 2 221 222 #define NTFS_FILE_NAME_POSIX 0 223 #define NTFS_FILE_NAME_WIN32 1 224 #define NTFS_FILE_NAME_DOS 2 225 #define NTFS_FILE_NAME_WIN32_AND_DOS 3 226 227 #define NTFS_FILE_TYPE_READ_ONLY 0x1 228 #define NTFS_FILE_TYPE_HIDDEN 0x2 229 #define NTFS_FILE_TYPE_SYSTEM 0x4 230 #define NTFS_FILE_TYPE_ARCHIVE 0x20 231 #define NTFS_FILE_TYPE_REPARSE 0x400 232 #define NTFS_FILE_TYPE_COMPRESSED 0x800 233 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000 234 235 /* Indexed Flag in Resident attributes - still somewhat speculative */ 236 #define RA_INDEXED 0x01 237 238 typedef struct 239 { 240 ULONG Type; /* Magic number 'FILE' */ 241 USHORT UsaOffset; /* Offset to the update sequence */ 242 USHORT UsaCount; /* Size in words of Update Sequence Number & Array (S) */ 243 ULONGLONG Lsn; /* $LogFile Sequence Number (LSN) */ 244 } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER; 245 246 /* NTFS_RECORD_HEADER.Type */ 247 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */ 248 #define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */ 249 250 251 typedef struct _FILE_RECORD_HEADER 252 { 253 NTFS_RECORD_HEADER Ntfs; 254 USHORT SequenceNumber; /* Sequence number */ 255 USHORT LinkCount; /* Hard link count */ 256 USHORT AttributeOffset; /* Offset to the first Attribute */ 257 USHORT Flags; /* Flags */ 258 ULONG BytesInUse; /* Real size of the FILE record */ 259 ULONG BytesAllocated; /* Allocated size of the FILE record */ 260 ULONGLONG BaseFileRecord; /* File reference to the base FILE record */ 261 USHORT NextAttributeNumber; /* Next Attribute Id */ 262 USHORT Padding; /* Align to 4 UCHAR boundary (XP) */ 263 ULONG MFTRecordNumber; /* Number of this MFT Record (XP) */ 264 } FILE_RECORD_HEADER, *PFILE_RECORD_HEADER; 265 266 /* Flags in FILE_RECORD_HEADER */ 267 268 #define FRH_IN_USE 0x0001 /* Record is in use */ 269 #define FRH_DIRECTORY 0x0002 /* Record is a directory */ 270 #define FRH_UNKNOWN1 0x0004 /* Don't know */ 271 #define FRH_UNKNOWN2 0x0008 /* Don't know */ 272 273 typedef struct 274 { 275 ULONG Type; 276 ULONG Length; 277 UCHAR IsNonResident; 278 UCHAR NameLength; 279 USHORT NameOffset; 280 USHORT Flags; 281 USHORT Instance; 282 union 283 { 284 // Resident attributes 285 struct 286 { 287 ULONG ValueLength; 288 USHORT ValueOffset; 289 UCHAR Flags; 290 UCHAR Reserved; 291 } Resident; 292 // Non-resident attributes 293 struct 294 { 295 ULONGLONG LowestVCN; 296 ULONGLONG HighestVCN; 297 USHORT MappingPairsOffset; 298 USHORT CompressionUnit; 299 UCHAR Reserved[4]; 300 LONGLONG AllocatedSize; 301 LONGLONG DataSize; 302 LONGLONG InitializedSize; 303 LONGLONG CompressedSize; 304 } NonResident; 305 }; 306 } NTFS_ATTR_RECORD, *PNTFS_ATTR_RECORD; 307 308 // The beginning and length of an attribute record are always aligned to an 8-byte boundary, 309 // relative to the beginning of the file record. 310 #define ATTR_RECORD_ALIGNMENT 8 311 312 // Data runs are aligned to a 4-byte boundary, relative to the start of the attribute record 313 #define DATA_RUN_ALIGNMENT 4 314 315 // Value offset is aligned to a 4-byte boundary, relative to the start of the attribute record 316 #define VALUE_OFFSET_ALIGNMENT 4 317 318 typedef struct 319 { 320 ULONGLONG CreationTime; 321 ULONGLONG ChangeTime; 322 ULONGLONG LastWriteTime; 323 ULONGLONG LastAccessTime; 324 ULONG FileAttribute; 325 ULONG AlignmentOrReserved[3]; 326 #if 0 327 ULONG QuotaId; 328 ULONG SecurityId; 329 ULONGLONG QuotaCharge; 330 USN Usn; 331 #endif 332 } STANDARD_INFORMATION, *PSTANDARD_INFORMATION; 333 334 335 typedef struct 336 { 337 ATTRIBUTE_TYPE AttributeType; 338 USHORT Length; 339 UCHAR NameLength; 340 UCHAR NameOffset; 341 ULONGLONG StartVcn; // LowVcn 342 ULONGLONG FileReferenceNumber; 343 USHORT AttributeNumber; 344 USHORT AlignmentOrReserved[3]; 345 } ATTRIBUTE_LIST, *PATTRIBUTE_LIST; 346 347 348 typedef struct 349 { 350 ULONGLONG DirectoryFileReferenceNumber; 351 ULONGLONG CreationTime; 352 ULONGLONG ChangeTime; 353 ULONGLONG LastWriteTime; 354 ULONGLONG LastAccessTime; 355 ULONGLONG AllocatedSize; 356 ULONGLONG DataSize; 357 ULONG FileAttributes; 358 union 359 { 360 struct 361 { 362 USHORT PackedEaSize; 363 USHORT AlignmentOrReserved; 364 } EaInfo; 365 ULONG ReparseTag; 366 } Extended; 367 UCHAR NameLength; 368 UCHAR NameType; 369 WCHAR Name[1]; 370 } FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE; 371 372 typedef struct 373 { 374 ULONG FirstEntryOffset; 375 ULONG TotalSizeOfEntries; 376 ULONG AllocatedSize; 377 UCHAR Flags; 378 UCHAR Padding[3]; 379 } INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE; 380 381 typedef struct 382 { 383 ULONG AttributeType; 384 ULONG CollationRule; 385 ULONG SizeOfEntry; 386 UCHAR ClustersPerIndexRecord; 387 UCHAR Padding[3]; 388 INDEX_HEADER_ATTRIBUTE Header; 389 } INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE; 390 391 typedef struct 392 { 393 NTFS_RECORD_HEADER Ntfs; 394 ULONGLONG VCN; 395 INDEX_HEADER_ATTRIBUTE Header; 396 } INDEX_BUFFER, *PINDEX_BUFFER; 397 398 typedef struct 399 { 400 union 401 { 402 struct 403 { 404 ULONGLONG IndexedFile; 405 } Directory; 406 struct 407 { 408 USHORT DataOffset; 409 USHORT DataLength; 410 ULONG Reserved; 411 } ViewIndex; 412 } Data; 413 USHORT Length; 414 USHORT KeyLength; 415 USHORT Flags; 416 USHORT Reserved; 417 FILENAME_ATTRIBUTE FileName; 418 } INDEX_ENTRY_ATTRIBUTE, *PINDEX_ENTRY_ATTRIBUTE; 419 420 struct _B_TREE_FILENAME_NODE; 421 typedef struct _B_TREE_FILENAME_NODE B_TREE_FILENAME_NODE; 422 423 // Keys are arranged in nodes as an ordered, linked list 424 typedef struct _B_TREE_KEY 425 { 426 struct _B_TREE_KEY *NextKey; 427 B_TREE_FILENAME_NODE *LesserChild; // Child-Node. All the keys in this node will be sorted before IndexEntry 428 PINDEX_ENTRY_ATTRIBUTE IndexEntry; // must be last member for FIELD_OFFSET 429 }B_TREE_KEY, *PB_TREE_KEY; 430 431 // Every Node is just an ordered list of keys. 432 // Sub-nodes can be found attached to a key (if they exist). 433 // A key's sub-node precedes that key in the ordered list. 434 typedef struct _B_TREE_FILENAME_NODE 435 { 436 ULONG KeyCount; 437 BOOLEAN HasValidVCN; 438 BOOLEAN DiskNeedsUpdating; 439 ULONGLONG VCN; 440 PB_TREE_KEY FirstKey; 441 } B_TREE_FILENAME_NODE, *PB_TREE_FILENAME_NODE; 442 443 typedef struct 444 { 445 PB_TREE_FILENAME_NODE RootNode; 446 } B_TREE, *PB_TREE; 447 448 typedef struct 449 { 450 ULONGLONG Unknown1; 451 UCHAR MajorVersion; 452 UCHAR MinorVersion; 453 USHORT Flags; 454 ULONG Unknown2; 455 } VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE; 456 457 typedef struct { 458 ULONG ReparseTag; 459 USHORT DataLength; 460 USHORT Reserved; 461 UCHAR Data[1]; 462 } REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE; 463 464 #define IRPCONTEXT_CANWAIT 0x1 465 #define IRPCONTEXT_COMPLETE 0x2 466 #define IRPCONTEXT_QUEUE 0x4 467 468 typedef struct 469 { 470 NTFSIDENTIFIER Identifier; 471 ULONG Flags; 472 PIO_STACK_LOCATION Stack; 473 UCHAR MajorFunction; 474 UCHAR MinorFunction; 475 WORK_QUEUE_ITEM WorkQueueItem; 476 PIRP Irp; 477 BOOLEAN IsTopLevel; 478 PDEVICE_OBJECT DeviceObject; 479 PFILE_OBJECT FileObject; 480 NTSTATUS SavedExceptionCode; 481 CCHAR PriorityBoost; 482 } NTFS_IRP_CONTEXT, *PNTFS_IRP_CONTEXT; 483 484 typedef struct _NTFS_ATTR_CONTEXT 485 { 486 PUCHAR CacheRun; 487 ULONGLONG CacheRunOffset; 488 LONGLONG CacheRunStartLCN; 489 ULONGLONG CacheRunLength; 490 LONGLONG CacheRunLastLCN; 491 ULONGLONG CacheRunCurrentOffset; 492 LARGE_MCB DataRunsMCB; 493 ULONGLONG FileMFTIndex; 494 PNTFS_ATTR_RECORD pRecord; 495 } NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT; 496 497 #define FCB_CACHE_INITIALIZED 0x0001 498 #define FCB_IS_VOLUME_STREAM 0x0002 499 #define FCB_IS_VOLUME 0x0004 500 #define MAX_PATH 260 501 502 typedef struct _FCB 503 { 504 NTFSIDENTIFIER Identifier; 505 506 FSRTL_COMMON_FCB_HEADER RFCB; 507 SECTION_OBJECT_POINTERS SectionObjectPointers; 508 509 PFILE_OBJECT FileObject; 510 PNTFS_VCB Vcb; 511 512 WCHAR Stream[MAX_PATH]; 513 WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */ 514 WCHAR PathName[MAX_PATH]; /* path+filename 260 max */ 515 516 ERESOURCE PagingIoResource; 517 ERESOURCE MainResource; 518 519 LIST_ENTRY FcbListEntry; 520 struct _FCB* ParentFcb; 521 522 ULONG DirIndex; 523 524 LONG RefCount; 525 ULONG Flags; 526 ULONG OpenHandleCount; 527 528 ULONGLONG MFTIndex; 529 USHORT LinkCount; 530 531 FILENAME_ATTRIBUTE Entry; 532 533 } NTFS_FCB, *PNTFS_FCB; 534 535 typedef struct _FIND_ATTR_CONTXT 536 { 537 PDEVICE_EXTENSION Vcb; 538 BOOLEAN OnlyResident; 539 PNTFS_ATTR_RECORD FirstAttr; 540 PNTFS_ATTR_RECORD CurrAttr; 541 PNTFS_ATTR_RECORD LastAttr; 542 PNTFS_ATTR_RECORD NonResidentStart; 543 PNTFS_ATTR_RECORD NonResidentEnd; 544 ULONG Offset; 545 } FIND_ATTR_CONTXT, *PFIND_ATTR_CONTXT; 546 547 typedef struct 548 { 549 USHORT USN; 550 USHORT Array[]; 551 } FIXUP_ARRAY, *PFIXUP_ARRAY; 552 553 extern PNTFS_GLOBAL_DATA NtfsGlobalData; 554 555 FORCEINLINE 556 NTSTATUS 557 NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext) 558 { 559 PULONG Flags = &IrpContext->Flags; 560 561 *Flags &= ~IRPCONTEXT_COMPLETE; 562 *Flags |= IRPCONTEXT_QUEUE; 563 564 return STATUS_PENDING; 565 } 566 567 /* attrib.c */ 568 569 //VOID 570 //NtfsDumpAttribute(PATTRIBUTE Attribute); 571 572 NTSTATUS 573 AddBitmap(PNTFS_VCB Vcb, 574 PFILE_RECORD_HEADER FileRecord, 575 PNTFS_ATTR_RECORD AttributeAddress, 576 PCWSTR Name, 577 USHORT NameLength); 578 579 NTSTATUS 580 AddData(PFILE_RECORD_HEADER FileRecord, 581 PNTFS_ATTR_RECORD AttributeAddress); 582 583 NTSTATUS 584 AddRun(PNTFS_VCB Vcb, 585 PNTFS_ATTR_CONTEXT AttrContext, 586 ULONG AttrOffset, 587 PFILE_RECORD_HEADER FileRecord, 588 ULONGLONG NextAssignedCluster, 589 ULONG RunLength); 590 591 NTSTATUS 592 AddIndexAllocation(PNTFS_VCB Vcb, 593 PFILE_RECORD_HEADER FileRecord, 594 PNTFS_ATTR_RECORD AttributeAddress, 595 PCWSTR Name, 596 USHORT NameLength); 597 598 NTSTATUS 599 AddIndexRoot(PNTFS_VCB Vcb, 600 PFILE_RECORD_HEADER FileRecord, 601 PNTFS_ATTR_RECORD AttributeAddress, 602 PINDEX_ROOT_ATTRIBUTE NewIndexRoot, 603 ULONG RootLength, 604 PCWSTR Name, 605 USHORT NameLength); 606 607 NTSTATUS 608 AddFileName(PFILE_RECORD_HEADER FileRecord, 609 PNTFS_ATTR_RECORD AttributeAddress, 610 PDEVICE_EXTENSION DeviceExt, 611 PFILE_OBJECT FileObject, 612 BOOLEAN CaseSensitive, 613 PULONGLONG ParentMftIndex); 614 615 NTSTATUS 616 AddStandardInformation(PFILE_RECORD_HEADER FileRecord, 617 PNTFS_ATTR_RECORD AttributeAddress); 618 619 NTSTATUS 620 ConvertDataRunsToLargeMCB(PUCHAR DataRun, 621 PLARGE_MCB DataRunsMCB, 622 PULONGLONG pNextVBN); 623 624 NTSTATUS 625 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, 626 PUCHAR RunBuffer, 627 ULONG MaxBufferSize, 628 PULONG UsedBufferSize); 629 630 PUCHAR 631 DecodeRun(PUCHAR DataRun, 632 LONGLONG *DataRunOffset, 633 ULONGLONG *DataRunLength); 634 635 ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute); 636 637 VOID 638 NtfsDumpDataRuns(PVOID StartOfRun, 639 ULONGLONG CurrentLCN); 640 641 VOID 642 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, 643 PFILE_RECORD_HEADER FileRecord); 644 645 PSTANDARD_INFORMATION 646 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, 647 PFILE_RECORD_HEADER FileRecord); 648 649 PFILENAME_ATTRIBUTE 650 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, 651 PFILE_RECORD_HEADER FileRecord, 652 UCHAR NameType); 653 654 UCHAR 655 GetPackedByteCount(LONGLONG NumberToPack, 656 BOOLEAN IsSigned); 657 658 NTSTATUS 659 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb, 660 PNTFS_ATTR_RECORD Attribute, 661 PULONGLONG LastCluster); 662 663 PFILENAME_ATTRIBUTE 664 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, 665 PFILE_RECORD_HEADER FileRecord); 666 667 NTSTATUS 668 FindFirstAttribute(PFIND_ATTR_CONTXT Context, 669 PDEVICE_EXTENSION Vcb, 670 PFILE_RECORD_HEADER FileRecord, 671 BOOLEAN OnlyResident, 672 PNTFS_ATTR_RECORD * Attribute); 673 674 NTSTATUS 675 FindNextAttribute(PFIND_ATTR_CONTXT Context, 676 PNTFS_ATTR_RECORD * Attribute); 677 678 VOID 679 FindCloseAttribute(PFIND_ATTR_CONTXT Context); 680 681 NTSTATUS 682 FreeClusters(PNTFS_VCB Vcb, 683 PNTFS_ATTR_CONTEXT AttrContext, 684 ULONG AttrOffset, 685 PFILE_RECORD_HEADER FileRecord, 686 ULONG ClustersToFree); 687 688 /* blockdev.c */ 689 690 NTSTATUS 691 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, 692 IN LONGLONG StartingOffset, 693 IN ULONG Length, 694 IN ULONG SectorSize, 695 IN OUT PUCHAR Buffer, 696 IN BOOLEAN Override); 697 698 NTSTATUS 699 NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject, 700 IN LONGLONG StartingOffset, 701 IN ULONG Length, 702 IN ULONG SectorSize, 703 IN const PUCHAR Buffer); 704 705 NTSTATUS 706 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, 707 IN ULONG DiskSector, 708 IN ULONG SectorCount, 709 IN ULONG SectorSize, 710 IN OUT PUCHAR Buffer, 711 IN BOOLEAN Override); 712 713 NTSTATUS 714 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, 715 IN ULONG ControlCode, 716 IN PVOID InputBuffer, 717 IN ULONG InputBufferSize, 718 IN OUT PVOID OutputBuffer, 719 IN OUT PULONG OutputBufferSize, 720 IN BOOLEAN Override); 721 722 723 /* btree.c */ 724 725 LONG 726 CompareTreeKeys(PB_TREE_KEY Key1, 727 PB_TREE_KEY Key2, 728 BOOLEAN CaseSensitive); 729 730 NTSTATUS 731 CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb, 732 PFILE_RECORD_HEADER FileRecordWithIndex, 733 /*PCWSTR IndexName,*/ 734 PNTFS_ATTR_CONTEXT IndexRootContext, 735 PINDEX_ROOT_ATTRIBUTE IndexRoot, 736 PB_TREE *NewTree); 737 738 NTSTATUS 739 CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, 740 PB_TREE Tree, 741 ULONG MaxIndexSize, 742 PINDEX_ROOT_ATTRIBUTE *IndexRoot, 743 ULONG *Length); 744 745 NTSTATUS 746 DemoteBTreeRoot(PB_TREE Tree); 747 748 VOID 749 DestroyBTree(PB_TREE Tree); 750 751 VOID 752 DestroyBTreeNode(PB_TREE_FILENAME_NODE Node); 753 754 VOID 755 DumpBTree(PB_TREE Tree); 756 757 VOID 758 DumpBTreeKey(PB_TREE Tree, 759 PB_TREE_KEY Key, 760 ULONG Number, 761 ULONG Depth); 762 763 VOID 764 DumpBTreeNode(PB_TREE Tree, 765 PB_TREE_FILENAME_NODE Node, 766 ULONG Number, 767 ULONG Depth); 768 769 NTSTATUS 770 CreateEmptyBTree(PB_TREE *NewTree); 771 772 ULONGLONG 773 GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt, 774 ULONG IndexBufferSize, 775 ULONGLONG Vcn); 776 777 ULONGLONG 778 GetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry); 779 780 ULONG 781 GetSizeOfIndexEntries(PB_TREE_FILENAME_NODE Node); 782 783 NTSTATUS 784 NtfsInsertKey(PB_TREE Tree, 785 ULONGLONG FileReference, 786 PFILENAME_ATTRIBUTE FileNameAttribute, 787 PB_TREE_FILENAME_NODE Node, 788 BOOLEAN CaseSensitive, 789 ULONG MaxIndexRootSize, 790 ULONG IndexRecordSize, 791 PB_TREE_KEY *MedianKey, 792 PB_TREE_FILENAME_NODE *NewRightHandSibling); 793 794 NTSTATUS 795 SplitBTreeNode(PB_TREE Tree, 796 PB_TREE_FILENAME_NODE Node, 797 PB_TREE_KEY *MedianKey, 798 PB_TREE_FILENAME_NODE *NewRightHandSibling, 799 BOOLEAN CaseSensitive); 800 801 NTSTATUS 802 UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt, 803 PB_TREE Tree, 804 ULONG IndexBufferSize, 805 PFILE_RECORD_HEADER FileRecord); 806 807 NTSTATUS 808 UpdateIndexNode(PDEVICE_EXTENSION DeviceExt, 809 PFILE_RECORD_HEADER FileRecord, 810 PB_TREE_FILENAME_NODE Node, 811 ULONG IndexBufferSize, 812 PNTFS_ATTR_CONTEXT IndexAllocationContext, 813 ULONG IndexAllocationOffset); 814 815 /* close.c */ 816 817 NTSTATUS 818 NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext); 819 820 821 /* close.c */ 822 823 NTSTATUS 824 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, 825 PFILE_OBJECT FileObject); 826 827 NTSTATUS 828 NtfsClose(PNTFS_IRP_CONTEXT IrpContext); 829 830 831 /* create.c */ 832 833 NTSTATUS 834 NtfsCreate(PNTFS_IRP_CONTEXT IrpContext); 835 836 NTSTATUS 837 NtfsCreateDirectory(PDEVICE_EXTENSION DeviceExt, 838 PFILE_OBJECT FileObject, 839 BOOLEAN CaseSensitive, 840 BOOLEAN CanWait); 841 842 PFILE_RECORD_HEADER 843 NtfsCreateEmptyFileRecord(PDEVICE_EXTENSION DeviceExt); 844 845 NTSTATUS 846 NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt, 847 PFILE_OBJECT FileObject, 848 BOOLEAN CaseSensitive, 849 BOOLEAN CanWait); 850 851 /* devctl.c */ 852 853 NTSTATUS 854 NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext); 855 856 857 /* dirctl.c */ 858 859 ULONGLONG 860 NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, 861 PFILE_RECORD_HEADER FileRecord, 862 PCWSTR Stream, 863 ULONG StreamLength, 864 PULONGLONG AllocatedSize); 865 866 NTSTATUS 867 NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext); 868 869 870 /* dispatch.c */ 871 872 DRIVER_DISPATCH NtfsFsdDispatch; 873 NTSTATUS NTAPI 874 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject, 875 PIRP Irp); 876 877 878 /* fastio.c */ 879 880 BOOLEAN NTAPI 881 NtfsAcqLazyWrite(PVOID Context, 882 BOOLEAN Wait); 883 884 VOID NTAPI 885 NtfsRelLazyWrite(PVOID Context); 886 887 BOOLEAN NTAPI 888 NtfsAcqReadAhead(PVOID Context, 889 BOOLEAN Wait); 890 891 VOID NTAPI 892 NtfsRelReadAhead(PVOID Context); 893 894 FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible; 895 FAST_IO_READ NtfsFastIoRead; 896 FAST_IO_WRITE NtfsFastIoWrite; 897 898 899 /* fcb.c */ 900 901 PNTFS_FCB 902 NtfsCreateFCB(PCWSTR FileName, 903 PCWSTR Stream, 904 PNTFS_VCB Vcb); 905 906 VOID 907 NtfsDestroyFCB(PNTFS_FCB Fcb); 908 909 BOOLEAN 910 NtfsFCBIsDirectory(PNTFS_FCB Fcb); 911 912 BOOLEAN 913 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb); 914 915 BOOLEAN 916 NtfsFCBIsCompressed(PNTFS_FCB Fcb); 917 918 BOOLEAN 919 NtfsFCBIsRoot(PNTFS_FCB Fcb); 920 921 VOID 922 NtfsGrabFCB(PNTFS_VCB Vcb, 923 PNTFS_FCB Fcb); 924 925 VOID 926 NtfsReleaseFCB(PNTFS_VCB Vcb, 927 PNTFS_FCB Fcb); 928 929 VOID 930 NtfsAddFCBToTable(PNTFS_VCB Vcb, 931 PNTFS_FCB Fcb); 932 933 PNTFS_FCB 934 NtfsGrabFCBFromTable(PNTFS_VCB Vcb, 935 PCWSTR FileName); 936 937 NTSTATUS 938 NtfsFCBInitializeCache(PNTFS_VCB Vcb, 939 PNTFS_FCB Fcb); 940 941 PNTFS_FCB 942 NtfsMakeRootFCB(PNTFS_VCB Vcb); 943 944 PNTFS_FCB 945 NtfsOpenRootFCB(PNTFS_VCB Vcb); 946 947 NTSTATUS 948 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb, 949 PNTFS_FCB Fcb, 950 PFILE_OBJECT FileObject); 951 952 NTSTATUS 953 NtfsGetFCBForFile(PNTFS_VCB Vcb, 954 PNTFS_FCB *pParentFCB, 955 PNTFS_FCB *pFCB, 956 PCWSTR pFileName, 957 BOOLEAN CaseSensitive); 958 959 NTSTATUS 960 NtfsReadFCBAttribute(PNTFS_VCB Vcb, 961 PNTFS_FCB pFCB, 962 ULONG Type, 963 PCWSTR Name, 964 ULONG NameLength, 965 PVOID * Data); 966 967 NTSTATUS 968 NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb, 969 PNTFS_FCB DirectoryFCB, 970 PUNICODE_STRING Name, 971 PCWSTR Stream, 972 PFILE_RECORD_HEADER Record, 973 ULONGLONG MFTIndex, 974 PNTFS_FCB * fileFCB); 975 976 977 /* finfo.c */ 978 979 NTSTATUS 980 NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext); 981 982 NTSTATUS 983 NtfsSetEndOfFile(PNTFS_FCB Fcb, 984 PFILE_OBJECT FileObject, 985 PDEVICE_EXTENSION DeviceExt, 986 ULONG IrpFlags, 987 BOOLEAN CaseSensitive, 988 PLARGE_INTEGER NewFileSize); 989 990 NTSTATUS 991 NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext); 992 993 /* fsctl.c */ 994 995 NTSTATUS 996 NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext); 997 998 999 /* mft.c */ 1000 NTSTATUS 1001 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt, 1002 ULONGLONG DirectoryMftIndex, 1003 ULONGLONG FileReferenceNumber, 1004 PFILENAME_ATTRIBUTE FilenameAttribute, 1005 BOOLEAN CaseSensitive); 1006 1007 NTSTATUS 1008 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, 1009 PDEVICE_EXTENSION DeviceExt, 1010 PULONGLONG DestinationIndex, 1011 BOOLEAN CanWait); 1012 1013 VOID 1014 NtfsDumpData(ULONG_PTR Buffer, ULONG Length); 1015 1016 PNTFS_ATTR_CONTEXT 1017 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord); 1018 1019 VOID 1020 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context); 1021 1022 ULONG 1023 ReadAttribute(PDEVICE_EXTENSION Vcb, 1024 PNTFS_ATTR_CONTEXT Context, 1025 ULONGLONG Offset, 1026 PCHAR Buffer, 1027 ULONG Length); 1028 1029 NTSTATUS 1030 WriteAttribute(PDEVICE_EXTENSION Vcb, 1031 PNTFS_ATTR_CONTEXT Context, 1032 ULONGLONG Offset, 1033 const PUCHAR Buffer, 1034 ULONG Length, 1035 PULONG LengthWritten, 1036 PFILE_RECORD_HEADER FileRecord); 1037 1038 ULONGLONG 1039 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord); 1040 1041 NTSTATUS 1042 InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, 1043 PNTFS_ATTR_CONTEXT AttrContext, 1044 PFILE_RECORD_HEADER FileRecord, 1045 ULONG AttrOffset, 1046 ULONG DataSize); 1047 1048 PNTFS_ATTR_RECORD 1049 MoveAttributes(PDEVICE_EXTENSION DeviceExt, 1050 PNTFS_ATTR_RECORD FirstAttributeToMove, 1051 ULONG FirstAttributeOffset, 1052 ULONG_PTR MoveTo); 1053 1054 NTSTATUS 1055 SetAttributeDataLength(PFILE_OBJECT FileObject, 1056 PNTFS_FCB Fcb, 1057 PNTFS_ATTR_CONTEXT AttrContext, 1058 ULONG AttrOffset, 1059 PFILE_RECORD_HEADER FileRecord, 1060 PLARGE_INTEGER DataSize); 1061 1062 VOID 1063 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, 1064 PNTFS_ATTR_RECORD AttrEnd, 1065 ULONG EndMarker); 1066 1067 NTSTATUS 1068 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, 1069 PNTFS_ATTR_CONTEXT AttrContext, 1070 ULONG AttrOffset, 1071 PFILE_RECORD_HEADER FileRecord, 1072 PLARGE_INTEGER DataSize); 1073 1074 NTSTATUS 1075 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, 1076 PNTFS_ATTR_CONTEXT AttrContext, 1077 ULONG AttrOffset, 1078 PFILE_RECORD_HEADER FileRecord, 1079 PLARGE_INTEGER DataSize); 1080 1081 ULONGLONG 1082 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord); 1083 1084 BOOLEAN 1085 CompareFileName(PUNICODE_STRING FileName, 1086 PINDEX_ENTRY_ATTRIBUTE IndexEntry, 1087 BOOLEAN DirSearch, 1088 BOOLEAN CaseSensitive); 1089 1090 NTSTATUS 1091 UpdateMftMirror(PNTFS_VCB Vcb); 1092 1093 NTSTATUS 1094 ReadFileRecord(PDEVICE_EXTENSION Vcb, 1095 ULONGLONG index, 1096 PFILE_RECORD_HEADER file); 1097 1098 NTSTATUS 1099 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb, 1100 PFILE_RECORD_HEADER MftRecord, 1101 PCHAR IndexRecord, 1102 ULONG IndexBlockSize, 1103 PINDEX_ENTRY_ATTRIBUTE FirstEntry, 1104 PINDEX_ENTRY_ATTRIBUTE LastEntry, 1105 PUNICODE_STRING FileName, 1106 PULONG StartEntry, 1107 PULONG CurrentEntry, 1108 BOOLEAN DirSearch, 1109 ULONGLONG NewDataSize, 1110 ULONGLONG NewAllocatedSize, 1111 BOOLEAN CaseSensitive); 1112 1113 NTSTATUS 1114 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb, 1115 ULONGLONG ParentMFTIndex, 1116 PUNICODE_STRING FileName, 1117 BOOLEAN DirSearch, 1118 ULONGLONG NewDataSize, 1119 ULONGLONG NewAllocationSize, 1120 BOOLEAN CaseSensitive); 1121 1122 NTSTATUS 1123 UpdateFileRecord(PDEVICE_EXTENSION Vcb, 1124 ULONGLONG MftIndex, 1125 PFILE_RECORD_HEADER FileRecord); 1126 1127 NTSTATUS 1128 FindAttribute(PDEVICE_EXTENSION Vcb, 1129 PFILE_RECORD_HEADER MftRecord, 1130 ULONG Type, 1131 PCWSTR Name, 1132 ULONG NameLength, 1133 PNTFS_ATTR_CONTEXT * AttrCtx, 1134 PULONG Offset); 1135 1136 VOID 1137 ReadVCN(PDEVICE_EXTENSION Vcb, 1138 PFILE_RECORD_HEADER file, 1139 ATTRIBUTE_TYPE type, 1140 ULONGLONG vcn, 1141 ULONG count, 1142 PVOID buffer); 1143 1144 NTSTATUS 1145 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, 1146 PNTFS_RECORD_HEADER Record); 1147 1148 NTSTATUS 1149 AddFixupArray(PDEVICE_EXTENSION Vcb, 1150 PNTFS_RECORD_HEADER Record); 1151 1152 NTSTATUS 1153 ReadLCN(PDEVICE_EXTENSION Vcb, 1154 ULONGLONG lcn, 1155 ULONG count, 1156 PVOID buffer); 1157 1158 VOID 1159 EnumerAttribute(PFILE_RECORD_HEADER file, 1160 PDEVICE_EXTENSION Vcb, 1161 PDEVICE_OBJECT DeviceObject); 1162 1163 NTSTATUS 1164 NtfsLookupFile(PDEVICE_EXTENSION Vcb, 1165 PUNICODE_STRING PathName, 1166 BOOLEAN CaseSensitive, 1167 PFILE_RECORD_HEADER *FileRecord, 1168 PULONGLONG MFTIndex); 1169 1170 NTSTATUS 1171 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, 1172 PUNICODE_STRING PathName, 1173 BOOLEAN CaseSensitive, 1174 PFILE_RECORD_HEADER *FileRecord, 1175 PULONGLONG MFTIndex, 1176 ULONGLONG CurrentMFTIndex); 1177 1178 VOID 1179 NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, 1180 PFILE_RECORD_HEADER FileRecord); 1181 1182 NTSTATUS 1183 NtfsFindFileAt(PDEVICE_EXTENSION Vcb, 1184 PUNICODE_STRING SearchPattern, 1185 PULONG FirstEntry, 1186 PFILE_RECORD_HEADER *FileRecord, 1187 PULONGLONG MFTIndex, 1188 ULONGLONG CurrentMFTIndex, 1189 BOOLEAN CaseSensitive); 1190 1191 NTSTATUS 1192 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb, 1193 ULONGLONG MFTIndex, 1194 PUNICODE_STRING FileName, 1195 PULONG FirstEntry, 1196 BOOLEAN DirSearch, 1197 BOOLEAN CaseSensitive, 1198 ULONGLONG *OutMFTIndex); 1199 1200 /* misc.c */ 1201 1202 BOOLEAN 1203 NtfsIsIrpTopLevel(PIRP Irp); 1204 1205 PNTFS_IRP_CONTEXT 1206 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, 1207 PIRP Irp); 1208 1209 PVOID 1210 NtfsGetUserBuffer(PIRP Irp, 1211 BOOLEAN Paging); 1212 1213 NTSTATUS 1214 NtfsLockUserBuffer(IN PIRP Irp, 1215 IN ULONG Length, 1216 IN LOCK_OPERATION Operation); 1217 1218 #if 0 1219 BOOLEAN 1220 wstrcmpjoki(PWSTR s1, PWSTR s2); 1221 1222 VOID 1223 CdfsSwapString(PWCHAR Out, 1224 PUCHAR In, 1225 ULONG Count); 1226 #endif 1227 1228 VOID 1229 NtfsFileFlagsToAttributes(ULONG NtfsAttributes, 1230 PULONG FileAttributes); 1231 1232 1233 /* rw.c */ 1234 1235 NTSTATUS 1236 NtfsRead(PNTFS_IRP_CONTEXT IrpContext); 1237 1238 NTSTATUS 1239 NtfsWrite(PNTFS_IRP_CONTEXT IrpContext); 1240 1241 1242 /* volinfo.c */ 1243 1244 NTSTATUS 1245 NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt, 1246 ULONG FirstDesiredCluster, 1247 ULONG DesiredClusters, 1248 PULONG FirstAssignedCluster, 1249 PULONG AssignedClusters); 1250 1251 ULONGLONG 1252 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt); 1253 1254 NTSTATUS 1255 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 1256 1257 NTSTATUS 1258 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 1259 1260 1261 /* ntfs.c */ 1262 1263 DRIVER_INITIALIZE DriverEntry; 1264 1265 VOID 1266 NTAPI 1267 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject); 1268 1269 #endif /* NTFS_H */ 1270