1 #ifndef NTFS_H 2 #define NTFS_H 3 4 #include <ntifs.h> 5 #include <pseh/pseh2.h> 6 7 #ifdef __GNUC__ 8 #define INIT_SECTION __attribute__((section ("INIT"))) 9 #else 10 #define INIT_SECTION /* Done via alloc_text for MSC */ 11 #endif 12 13 #define CACHEPAGESIZE(pDeviceExt) \ 14 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \ 15 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE) 16 17 #define TAG_NTFS 'SFTN' 18 19 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S)) 20 #define ROUND_DOWN(N, S) ((N) - ((N) % (S))) 21 22 #define DEVICE_NAME L"\\Ntfs" 23 24 #include <pshpack1.h> 25 typedef struct _BIOS_PARAMETERS_BLOCK 26 { 27 USHORT BytesPerSector; // 0x0B 28 UCHAR SectorsPerCluster; // 0x0D 29 UCHAR Unused0[7]; // 0x0E, checked when volume is mounted 30 UCHAR MediaId; // 0x15 31 UCHAR Unused1[2]; // 0x16 32 USHORT SectorsPerTrack; // 0x18 33 USHORT Heads; // 0x1A 34 UCHAR Unused2[4]; // 0x1C 35 UCHAR Unused3[4]; // 0x20, checked when volume is mounted 36 } BIOS_PARAMETERS_BLOCK, *PBIOS_PARAMETERS_BLOCK; 37 38 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK 39 { 40 USHORT Unknown[2]; // 0x24, always 80 00 80 00 41 ULONGLONG SectorCount; // 0x28 42 ULONGLONG MftLocation; // 0x30 43 ULONGLONG MftMirrLocation; // 0x38 44 CHAR ClustersPerMftRecord; // 0x40 45 UCHAR Unused4[3]; // 0x41 46 CHAR ClustersPerIndexRecord; // 0x44 47 UCHAR Unused5[3]; // 0x45 48 ULONGLONG SerialNumber; // 0x48 49 UCHAR Checksum[4]; // 0x50 50 } EXTENDED_BIOS_PARAMETERS_BLOCK, *PEXTENDED_BIOS_PARAMETERS_BLOCK; 51 52 typedef struct _BOOT_SECTOR 53 { 54 UCHAR Jump[3]; // 0x00 55 UCHAR OEMID[8]; // 0x03 56 BIOS_PARAMETERS_BLOCK BPB; 57 EXTENDED_BIOS_PARAMETERS_BLOCK EBPB; 58 UCHAR BootStrap[426]; // 0x54 59 USHORT EndSector; // 0x1FE 60 } BOOT_SECTOR, *PBOOT_SECTOR; 61 #include <poppack.h> 62 63 //typedef struct _BootSector BootSector; 64 65 typedef struct _NTFS_INFO 66 { 67 ULONG BytesPerSector; 68 ULONG SectorsPerCluster; 69 ULONG BytesPerCluster; 70 ULONGLONG SectorCount; 71 ULONGLONG ClusterCount; 72 ULARGE_INTEGER MftStart; 73 ULARGE_INTEGER MftMirrStart; 74 ULONG BytesPerFileRecord; 75 ULONG BytesPerIndexRecord; 76 77 ULONGLONG SerialNumber; 78 USHORT VolumeLabelLength; 79 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]; 80 UCHAR MajorVersion; 81 UCHAR MinorVersion; 82 USHORT Flags; 83 84 ULONG MftZoneReservation; 85 } NTFS_INFO, *PNTFS_INFO; 86 87 #define NTFS_TYPE_CCB '20SF' 88 #define NTFS_TYPE_FCB '30SF' 89 #define NTFS_TYPE_VCB '50SF' 90 #define NTFS_TYPE_IRP_CONTEXT '60SF' 91 #define NTFS_TYPE_GLOBAL_DATA '70SF' 92 93 typedef struct 94 { 95 ULONG Type; 96 ULONG Size; 97 } NTFSIDENTIFIER, *PNTFSIDENTIFIER; 98 99 typedef struct 100 { 101 NTFSIDENTIFIER Identifier; 102 103 ERESOURCE DirResource; 104 // ERESOURCE FatResource; 105 106 KSPIN_LOCK FcbListLock; 107 LIST_ENTRY FcbListHead; 108 109 PVPB Vpb; 110 PDEVICE_OBJECT StorageDevice; 111 PFILE_OBJECT StreamFileObject; 112 113 struct _NTFS_ATTR_CONTEXT* MFTContext; 114 struct _FILE_RECORD_HEADER* MasterFileTable; 115 struct _FCB *VolumeFcb; 116 117 NTFS_INFO NtfsInfo; 118 119 ULONG Flags; 120 ULONG OpenHandleCount; 121 122 } DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB; 123 124 #define VCB_VOLUME_LOCKED 0x0001 125 126 typedef struct 127 { 128 NTFSIDENTIFIER Identifier; 129 LIST_ENTRY NextCCB; 130 PFILE_OBJECT PtrFileObject; 131 LARGE_INTEGER CurrentByteOffset; 132 /* for DirectoryControl */ 133 ULONG Entry; 134 /* for DirectoryControl */ 135 PWCHAR DirectorySearchPattern; 136 ULONG LastCluster; 137 ULONG LastOffset; 138 } NTFS_CCB, *PNTFS_CCB; 139 140 #define TAG_CCB 'BCCI' 141 #define TAG_FCB 'BCFI' 142 143 typedef struct 144 { 145 NTFSIDENTIFIER Identifier; 146 ERESOURCE Resource; 147 PDRIVER_OBJECT DriverObject; 148 PDEVICE_OBJECT DeviceObject; 149 CACHE_MANAGER_CALLBACKS CacheMgrCallbacks; 150 ULONG Flags; 151 FAST_IO_DISPATCH FastIoDispatch; 152 NPAGED_LOOKASIDE_LIST IrpContextLookasideList; 153 NPAGED_LOOKASIDE_LIST FcbLookasideList; 154 } NTFS_GLOBAL_DATA, *PNTFS_GLOBAL_DATA; 155 156 157 typedef enum 158 { 159 AttributeStandardInformation = 0x10, 160 AttributeAttributeList = 0x20, 161 AttributeFileName = 0x30, 162 AttributeObjectId = 0x40, 163 AttributeSecurityDescriptor = 0x50, 164 AttributeVolumeName = 0x60, 165 AttributeVolumeInformation = 0x70, 166 AttributeData = 0x80, 167 AttributeIndexRoot = 0x90, 168 AttributeIndexAllocation = 0xA0, 169 AttributeBitmap = 0xB0, 170 AttributeReparsePoint = 0xC0, 171 AttributeEAInformation = 0xD0, 172 AttributeEA = 0xE0, 173 AttributePropertySet = 0xF0, 174 AttributeLoggedUtilityStream = 0x100, 175 AttributeEnd = 0xFFFFFFFF 176 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE; 177 178 #define NTFS_FILE_MFT 0 179 #define NTFS_FILE_MFTMIRR 1 180 #define NTFS_FILE_LOGFILE 2 181 #define NTFS_FILE_VOLUME 3 182 #define NTFS_FILE_ATTRDEF 4 183 #define NTFS_FILE_ROOT 5 184 #define NTFS_FILE_BITMAP 6 185 #define NTFS_FILE_BOOT 7 186 #define NTFS_FILE_BADCLUS 8 187 #define NTFS_FILE_QUOTA 9 188 #define NTFS_FILE_UPCASE 10 189 #define NTFS_FILE_EXTEND 11 190 191 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL 192 193 #define COLLATION_BINARY 0x00 194 #define COLLATION_FILE_NAME 0x01 195 #define COLLATION_UNICODE_STRING 0x02 196 #define COLLATION_NTOFS_ULONG 0x10 197 #define COLLATION_NTOFS_SID 0x11 198 #define COLLATION_NTOFS_SECURITY_HASH 0x12 199 #define COLLATION_NTOFS_ULONGS 0x13 200 201 #define INDEX_ROOT_SMALL 0x0 202 #define INDEX_ROOT_LARGE 0x1 203 204 #define NTFS_INDEX_ENTRY_NODE 1 205 #define NTFS_INDEX_ENTRY_END 2 206 207 #define NTFS_FILE_NAME_POSIX 0 208 #define NTFS_FILE_NAME_WIN32 1 209 #define NTFS_FILE_NAME_DOS 2 210 #define NTFS_FILE_NAME_WIN32_AND_DOS 3 211 212 #define NTFS_FILE_TYPE_READ_ONLY 0x1 213 #define NTFS_FILE_TYPE_HIDDEN 0x2 214 #define NTFS_FILE_TYPE_SYSTEM 0x4 215 #define NTFS_FILE_TYPE_ARCHIVE 0x20 216 #define NTFS_FILE_TYPE_REPARSE 0x400 217 #define NTFS_FILE_TYPE_COMPRESSED 0x800 218 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000 219 220 typedef struct 221 { 222 ULONG Type; /* Magic number 'FILE' */ 223 USHORT UsaOffset; /* Offset to the update sequence */ 224 USHORT UsaCount; /* Size in words of Update Sequence Number & Array (S) */ 225 ULONGLONG Lsn; /* $LogFile Sequence Number (LSN) */ 226 } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER; 227 228 /* NTFS_RECORD_HEADER.Type */ 229 #define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */ 230 #define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */ 231 232 233 typedef struct _FILE_RECORD_HEADER 234 { 235 NTFS_RECORD_HEADER Ntfs; 236 USHORT SequenceNumber; /* Sequence number */ 237 USHORT LinkCount; /* Hard link count */ 238 USHORT AttributeOffset; /* Offset to the first Attribute */ 239 USHORT Flags; /* Flags */ 240 ULONG BytesInUse; /* Real size of the FILE record */ 241 ULONG BytesAllocated; /* Allocated size of the FILE record */ 242 ULONGLONG BaseFileRecord; /* File reference to the base FILE record */ 243 USHORT NextAttributeNumber; /* Next Attribute Id */ 244 USHORT Padding; /* Align to 4 UCHAR boundary (XP) */ 245 ULONG MFTRecordNumber; /* Number of this MFT Record (XP) */ 246 } FILE_RECORD_HEADER, *PFILE_RECORD_HEADER; 247 248 /* Flags in FILE_RECORD_HEADER */ 249 250 #define FRH_IN_USE 0x0001 /* Record is in use */ 251 #define FRH_DIRECTORY 0x0002 /* Record is a directory */ 252 #define FRH_UNKNOWN1 0x0004 /* Don't know */ 253 #define FRH_UNKNOWN2 0x0008 /* Don't know */ 254 255 typedef struct 256 { 257 ULONG Type; 258 ULONG Length; 259 UCHAR IsNonResident; 260 UCHAR NameLength; 261 USHORT NameOffset; 262 USHORT Flags; 263 USHORT Instance; 264 union 265 { 266 // Resident attributes 267 struct 268 { 269 ULONG ValueLength; 270 USHORT ValueOffset; 271 UCHAR Flags; 272 UCHAR Reserved; 273 } Resident; 274 // Non-resident attributes 275 struct 276 { 277 ULONGLONG LowestVCN; 278 ULONGLONG HighestVCN; 279 USHORT MappingPairsOffset; 280 USHORT CompressionUnit; 281 UCHAR Reserved[4]; 282 LONGLONG AllocatedSize; 283 LONGLONG DataSize; 284 LONGLONG InitializedSize; 285 LONGLONG CompressedSize; 286 } NonResident; 287 }; 288 } NTFS_ATTR_RECORD, *PNTFS_ATTR_RECORD; 289 290 typedef struct 291 { 292 ULONGLONG CreationTime; 293 ULONGLONG ChangeTime; 294 ULONGLONG LastWriteTime; 295 ULONGLONG LastAccessTime; 296 ULONG FileAttribute; 297 ULONG AlignmentOrReserved[3]; 298 #if 0 299 ULONG QuotaId; 300 ULONG SecurityId; 301 ULONGLONG QuotaCharge; 302 USN Usn; 303 #endif 304 } STANDARD_INFORMATION, *PSTANDARD_INFORMATION; 305 306 307 typedef struct 308 { 309 ATTRIBUTE_TYPE AttributeType; 310 USHORT Length; 311 UCHAR NameLength; 312 UCHAR NameOffset; 313 ULONGLONG StartVcn; // LowVcn 314 ULONGLONG FileReferenceNumber; 315 USHORT AttributeNumber; 316 USHORT AlignmentOrReserved[3]; 317 } ATTRIBUTE_LIST, *PATTRIBUTE_LIST; 318 319 320 typedef struct 321 { 322 ULONGLONG DirectoryFileReferenceNumber; 323 ULONGLONG CreationTime; 324 ULONGLONG ChangeTime; 325 ULONGLONG LastWriteTime; 326 ULONGLONG LastAccessTime; 327 ULONGLONG AllocatedSize; 328 ULONGLONG DataSize; 329 ULONG FileAttributes; 330 union 331 { 332 struct 333 { 334 USHORT PackedEaSize; 335 USHORT AlignmentOrReserved; 336 } EaInfo; 337 ULONG ReparseTag; 338 } Extended; 339 UCHAR NameLength; 340 UCHAR NameType; 341 WCHAR Name[1]; 342 } FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE; 343 344 typedef struct 345 { 346 ULONG FirstEntryOffset; 347 ULONG TotalSizeOfEntries; 348 ULONG AllocatedSize; 349 UCHAR Flags; 350 UCHAR Padding[3]; 351 } INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE; 352 353 typedef struct 354 { 355 ULONG AttributeType; 356 ULONG CollationRule; 357 ULONG SizeOfEntry; 358 UCHAR ClustersPerIndexRecord; 359 UCHAR Padding[3]; 360 INDEX_HEADER_ATTRIBUTE Header; 361 } INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE; 362 363 typedef struct 364 { 365 NTFS_RECORD_HEADER Ntfs; 366 ULONGLONG VCN; 367 INDEX_HEADER_ATTRIBUTE Header; 368 } INDEX_BUFFER, *PINDEX_BUFFER; 369 370 typedef struct 371 { 372 union 373 { 374 struct 375 { 376 ULONGLONG IndexedFile; 377 } Directory; 378 struct 379 { 380 USHORT DataOffset; 381 USHORT DataLength; 382 ULONG Reserved; 383 } ViewIndex; 384 } Data; 385 USHORT Length; 386 USHORT KeyLength; 387 USHORT Flags; 388 USHORT Reserved; 389 FILENAME_ATTRIBUTE FileName; 390 } INDEX_ENTRY_ATTRIBUTE, *PINDEX_ENTRY_ATTRIBUTE; 391 392 typedef struct 393 { 394 ULONGLONG Unknown1; 395 UCHAR MajorVersion; 396 UCHAR MinorVersion; 397 USHORT Flags; 398 ULONG Unknown2; 399 } VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE; 400 401 typedef struct { 402 ULONG ReparseTag; 403 USHORT DataLength; 404 USHORT Reserved; 405 UCHAR Data[1]; 406 } REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE; 407 408 #define IRPCONTEXT_CANWAIT 0x1 409 #define IRPCONTEXT_COMPLETE 0x2 410 #define IRPCONTEXT_QUEUE 0x4 411 412 typedef struct 413 { 414 NTFSIDENTIFIER Identifier; 415 ULONG Flags; 416 PIO_STACK_LOCATION Stack; 417 UCHAR MajorFunction; 418 UCHAR MinorFunction; 419 WORK_QUEUE_ITEM WorkQueueItem; 420 PIRP Irp; 421 BOOLEAN IsTopLevel; 422 PDEVICE_OBJECT DeviceObject; 423 PFILE_OBJECT FileObject; 424 NTSTATUS SavedExceptionCode; 425 CCHAR PriorityBoost; 426 } NTFS_IRP_CONTEXT, *PNTFS_IRP_CONTEXT; 427 428 typedef struct _NTFS_ATTR_CONTEXT 429 { 430 PUCHAR CacheRun; 431 ULONGLONG CacheRunOffset; 432 LONGLONG CacheRunStartLCN; 433 ULONGLONG CacheRunLength; 434 LONGLONG CacheRunLastLCN; 435 ULONGLONG CacheRunCurrentOffset; 436 NTFS_ATTR_RECORD Record; 437 } NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT; 438 439 #define FCB_CACHE_INITIALIZED 0x0001 440 #define FCB_IS_VOLUME_STREAM 0x0002 441 #define FCB_IS_VOLUME 0x0004 442 #define MAX_PATH 260 443 444 typedef struct _FCB 445 { 446 NTFSIDENTIFIER Identifier; 447 448 FSRTL_COMMON_FCB_HEADER RFCB; 449 SECTION_OBJECT_POINTERS SectionObjectPointers; 450 451 PFILE_OBJECT FileObject; 452 PNTFS_VCB Vcb; 453 454 WCHAR Stream[MAX_PATH]; 455 WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */ 456 WCHAR PathName[MAX_PATH]; /* path+filename 260 max */ 457 458 ERESOURCE PagingIoResource; 459 ERESOURCE MainResource; 460 461 LIST_ENTRY FcbListEntry; 462 struct _FCB* ParentFcb; 463 464 ULONG DirIndex; 465 466 LONG RefCount; 467 ULONG Flags; 468 ULONG OpenHandleCount; 469 470 ULONGLONG MFTIndex; 471 USHORT LinkCount; 472 473 FILENAME_ATTRIBUTE Entry; 474 475 } NTFS_FCB, *PNTFS_FCB; 476 477 typedef struct _FIND_ATTR_CONTXT 478 { 479 PDEVICE_EXTENSION Vcb; 480 BOOLEAN OnlyResident; 481 PNTFS_ATTR_RECORD FirstAttr; 482 PNTFS_ATTR_RECORD CurrAttr; 483 PNTFS_ATTR_RECORD LastAttr; 484 PNTFS_ATTR_RECORD NonResidentStart; 485 PNTFS_ATTR_RECORD NonResidentEnd; 486 } FIND_ATTR_CONTXT, *PFIND_ATTR_CONTXT; 487 488 extern PNTFS_GLOBAL_DATA NtfsGlobalData; 489 490 FORCEINLINE 491 NTSTATUS 492 NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext) 493 { 494 PULONG Flags = &IrpContext->Flags; 495 496 *Flags &= ~IRPCONTEXT_COMPLETE; 497 *Flags |= IRPCONTEXT_QUEUE; 498 499 return STATUS_PENDING; 500 } 501 502 /* attrib.c */ 503 504 //VOID 505 //NtfsDumpAttribute(PATTRIBUTE Attribute); 506 507 PUCHAR 508 DecodeRun(PUCHAR DataRun, 509 LONGLONG *DataRunOffset, 510 ULONGLONG *DataRunLength); 511 512 VOID 513 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, 514 PFILE_RECORD_HEADER FileRecord); 515 516 PSTANDARD_INFORMATION 517 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, 518 PFILE_RECORD_HEADER FileRecord); 519 520 PFILENAME_ATTRIBUTE 521 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, 522 PFILE_RECORD_HEADER FileRecord, 523 UCHAR NameType); 524 525 PFILENAME_ATTRIBUTE 526 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, 527 PFILE_RECORD_HEADER FileRecord); 528 529 NTSTATUS 530 FindFirstAttribute(PFIND_ATTR_CONTXT Context, 531 PDEVICE_EXTENSION Vcb, 532 PFILE_RECORD_HEADER FileRecord, 533 BOOLEAN OnlyResident, 534 PNTFS_ATTR_RECORD * Attribute); 535 536 NTSTATUS 537 FindNextAttribute(PFIND_ATTR_CONTXT Context, 538 PNTFS_ATTR_RECORD * Attribute); 539 540 VOID 541 FindCloseAttribute(PFIND_ATTR_CONTXT Context); 542 543 /* blockdev.c */ 544 545 NTSTATUS 546 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, 547 IN LONGLONG StartingOffset, 548 IN ULONG Length, 549 IN ULONG SectorSize, 550 IN OUT PUCHAR Buffer, 551 IN BOOLEAN Override); 552 553 NTSTATUS 554 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, 555 IN ULONG DiskSector, 556 IN ULONG SectorCount, 557 IN ULONG SectorSize, 558 IN OUT PUCHAR Buffer, 559 IN BOOLEAN Override); 560 561 NTSTATUS 562 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, 563 IN ULONG ControlCode, 564 IN PVOID InputBuffer, 565 IN ULONG InputBufferSize, 566 IN OUT PVOID OutputBuffer, 567 IN OUT PULONG OutputBufferSize, 568 IN BOOLEAN Override); 569 570 571 /* close.c */ 572 573 NTSTATUS 574 NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext); 575 576 577 /* close.c */ 578 579 NTSTATUS 580 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, 581 PFILE_OBJECT FileObject); 582 583 NTSTATUS 584 NtfsClose(PNTFS_IRP_CONTEXT IrpContext); 585 586 587 /* create.c */ 588 589 NTSTATUS 590 NtfsCreate(PNTFS_IRP_CONTEXT IrpContext); 591 592 593 /* devctl.c */ 594 595 NTSTATUS 596 NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext); 597 598 599 /* dirctl.c */ 600 601 ULONGLONG 602 NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, 603 PFILE_RECORD_HEADER FileRecord, 604 PCWSTR Stream, 605 ULONG StreamLength, 606 PULONGLONG AllocatedSize); 607 608 NTSTATUS 609 NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext); 610 611 612 /* dispatch.c */ 613 614 DRIVER_DISPATCH NtfsFsdDispatch; 615 NTSTATUS NTAPI 616 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject, 617 PIRP Irp); 618 619 620 /* fastio.c */ 621 622 BOOLEAN NTAPI 623 NtfsAcqLazyWrite(PVOID Context, 624 BOOLEAN Wait); 625 626 VOID NTAPI 627 NtfsRelLazyWrite(PVOID Context); 628 629 BOOLEAN NTAPI 630 NtfsAcqReadAhead(PVOID Context, 631 BOOLEAN Wait); 632 633 VOID NTAPI 634 NtfsRelReadAhead(PVOID Context); 635 636 FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible; 637 FAST_IO_READ NtfsFastIoRead; 638 FAST_IO_WRITE NtfsFastIoWrite; 639 640 641 /* fcb.c */ 642 643 PNTFS_FCB 644 NtfsCreateFCB(PCWSTR FileName, 645 PCWSTR Stream, 646 PNTFS_VCB Vcb); 647 648 VOID 649 NtfsDestroyFCB(PNTFS_FCB Fcb); 650 651 BOOLEAN 652 NtfsFCBIsDirectory(PNTFS_FCB Fcb); 653 654 BOOLEAN 655 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb); 656 657 BOOLEAN 658 NtfsFCBIsCompressed(PNTFS_FCB Fcb); 659 660 BOOLEAN 661 NtfsFCBIsRoot(PNTFS_FCB Fcb); 662 663 VOID 664 NtfsGrabFCB(PNTFS_VCB Vcb, 665 PNTFS_FCB Fcb); 666 667 VOID 668 NtfsReleaseFCB(PNTFS_VCB Vcb, 669 PNTFS_FCB Fcb); 670 671 VOID 672 NtfsAddFCBToTable(PNTFS_VCB Vcb, 673 PNTFS_FCB Fcb); 674 675 PNTFS_FCB 676 NtfsGrabFCBFromTable(PNTFS_VCB Vcb, 677 PCWSTR FileName); 678 679 NTSTATUS 680 NtfsFCBInitializeCache(PNTFS_VCB Vcb, 681 PNTFS_FCB Fcb); 682 683 PNTFS_FCB 684 NtfsMakeRootFCB(PNTFS_VCB Vcb); 685 686 PNTFS_FCB 687 NtfsOpenRootFCB(PNTFS_VCB Vcb); 688 689 NTSTATUS 690 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb, 691 PNTFS_FCB Fcb, 692 PFILE_OBJECT FileObject); 693 694 NTSTATUS 695 NtfsGetFCBForFile(PNTFS_VCB Vcb, 696 PNTFS_FCB *pParentFCB, 697 PNTFS_FCB *pFCB, 698 const PWSTR pFileName); 699 700 NTSTATUS 701 NtfsReadFCBAttribute(PNTFS_VCB Vcb, 702 PNTFS_FCB pFCB, 703 ULONG Type, 704 PCWSTR Name, 705 ULONG NameLength, 706 PVOID * Data); 707 708 NTSTATUS 709 NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb, 710 PNTFS_FCB DirectoryFCB, 711 PUNICODE_STRING Name, 712 PCWSTR Stream, 713 PFILE_RECORD_HEADER Record, 714 ULONGLONG MFTIndex, 715 PNTFS_FCB * fileFCB); 716 717 718 /* finfo.c */ 719 720 NTSTATUS 721 NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext); 722 723 724 /* fsctl.c */ 725 726 NTSTATUS 727 NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext); 728 729 730 /* mft.c */ 731 PNTFS_ATTR_CONTEXT 732 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord); 733 734 VOID 735 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context); 736 737 ULONG 738 ReadAttribute(PDEVICE_EXTENSION Vcb, 739 PNTFS_ATTR_CONTEXT Context, 740 ULONGLONG Offset, 741 PCHAR Buffer, 742 ULONG Length); 743 744 ULONGLONG 745 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord); 746 747 ULONG 748 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord); 749 750 NTSTATUS 751 ReadFileRecord(PDEVICE_EXTENSION Vcb, 752 ULONGLONG index, 753 PFILE_RECORD_HEADER file); 754 755 NTSTATUS 756 FindAttribute(PDEVICE_EXTENSION Vcb, 757 PFILE_RECORD_HEADER MftRecord, 758 ULONG Type, 759 PCWSTR Name, 760 ULONG NameLength, 761 PNTFS_ATTR_CONTEXT * AttrCtx); 762 763 VOID 764 ReadVCN(PDEVICE_EXTENSION Vcb, 765 PFILE_RECORD_HEADER file, 766 ATTRIBUTE_TYPE type, 767 ULONGLONG vcn, 768 ULONG count, 769 PVOID buffer); 770 771 NTSTATUS 772 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, 773 PNTFS_RECORD_HEADER Record); 774 775 NTSTATUS 776 ReadLCN(PDEVICE_EXTENSION Vcb, 777 ULONGLONG lcn, 778 ULONG count, 779 PVOID buffer); 780 781 VOID 782 EnumerAttribute(PFILE_RECORD_HEADER file, 783 PDEVICE_EXTENSION Vcb, 784 PDEVICE_OBJECT DeviceObject); 785 786 NTSTATUS 787 NtfsLookupFile(PDEVICE_EXTENSION Vcb, 788 PUNICODE_STRING PathName, 789 PFILE_RECORD_HEADER *FileRecord, 790 PULONGLONG MFTIndex); 791 792 NTSTATUS 793 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, 794 PUNICODE_STRING PathName, 795 PFILE_RECORD_HEADER *FileRecord, 796 PULONGLONG MFTIndex, 797 ULONGLONG CurrentMFTIndex); 798 799 NTSTATUS 800 NtfsFindFileAt(PDEVICE_EXTENSION Vcb, 801 PUNICODE_STRING SearchPattern, 802 PULONG FirstEntry, 803 PFILE_RECORD_HEADER *FileRecord, 804 PULONGLONG MFTIndex, 805 ULONGLONG CurrentMFTIndex); 806 807 /* misc.c */ 808 809 BOOLEAN 810 NtfsIsIrpTopLevel(PIRP Irp); 811 812 PNTFS_IRP_CONTEXT 813 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, 814 PIRP Irp); 815 816 PVOID 817 NtfsGetUserBuffer(PIRP Irp, 818 BOOLEAN Paging); 819 820 VOID 821 NtfsFileFlagsToAttributes(ULONG NtfsAttributes, 822 PULONG FileAttributes); 823 824 825 /* rw.c */ 826 827 NTSTATUS 828 NtfsRead(PNTFS_IRP_CONTEXT IrpContext); 829 830 NTSTATUS 831 NtfsWrite(PNTFS_IRP_CONTEXT IrpContext); 832 833 834 /* volinfo.c */ 835 836 ULONGLONG 837 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt); 838 839 NTSTATUS 840 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 841 842 NTSTATUS 843 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext); 844 845 846 /* ntfs.c */ 847 848 DRIVER_INITIALIZE DriverEntry; 849 850 VOID 851 NTAPI 852 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject); 853 854 #endif /* NTFS_H */ 855