attrib.c File Reference

#include "ntfs.h"
#include <ntintsafe.h>
#include <debug.h>

Include dependency graph for attrib.c:

Go to the source code of this file.

Macros
#define	NDEBUG
#define	NTFS_DUMP_DATA_RUNS   0

Functions
AddBitmap
@implemented Adds a $BITMAP attribute to a given FileRecord. Parameters Vcb Pointer to an NTFS_VCB for the destination volume. FileRecord Pointer to a complete file record to add the attribute to. AttributeAddress Pointer to the region of memory that will receive the $INDEX_ALLOCATION attribute. This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord). Name Pointer to a string of 16-bit Unicode characters naming the attribute. Most often L"$I30". NameLength The number of wide-characters in the name. L"$I30" Would use 4 here. Returns STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record, or if the file record isn't large enough for the attribute. Remarks Only adding the attribute to the end of the file record is supported; AttributeAddress must be of type AttributeEnd. This could be improved by adding an $ATTRIBUTE_LIST to the file record if there's not enough space.
NTSTATUS	AddBitmap (PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
AddData
@implemented Adds a $DATA attribute to a given FileRecord. Parameters FileRecord Pointer to a complete file record to add the attribute to. Caller is responsible for ensuring FileRecord is large enough to contain $DATA. AttributeAddress Pointer to the region of memory that will receive the $DATA attribute. This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord). Returns STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record. Remarks Only adding the attribute to the end of the file record is supported; AttributeAddress must be of type AttributeEnd. As it's implemented, this function is only intended to assist in creating new file records. It could be made more general-purpose by considering file records with an $ATTRIBUTE_LIST. It's the caller's responsibility to ensure the given file record has enough memory allocated for the attribute.
NTSTATUS	AddData (PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
AddFileName
@implemented Adds a $FILE_NAME attribute to a given FileRecord. Parameters FileRecord Pointer to a complete file record to add the attribute to. Caller is responsible for ensuring FileRecord is large enough to contain $FILE_NAME. AttributeAddress Pointer to the region of memory that will receive the $FILE_NAME attribute. This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord). DeviceExt Points to the target disk's DEVICE_EXTENSION. FileObject Pointer to the FILE_OBJECT which represents the new name. This parameter is used to determine the filename and parent directory. CaseSensitive Boolean indicating if the function should operate in case-sensitive mode. This will be TRUE if an application opened the file with the FILE_FLAG_POSIX_SEMANTICS flag. ParentMftIndex Pointer to a ULONGLONG which will receive the index of the parent directory. Returns STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record. Remarks Only adding the attribute to the end of the file record is supported; AttributeAddress must be of type AttributeEnd. As it's implemented, this function is only intended to assist in creating new file records. It could be made more general-purpose by considering file records with an $ATTRIBUTE_LIST. It's the caller's responsibility to ensure the given file record has enough memory allocated for the attribute.
NTSTATUS	AddFileName (PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, PULONGLONG ParentMftIndex)
AddIndexAllocation
@implemented Adds an $INDEX_ALLOCATION attribute to a given FileRecord. Parameters Vcb Pointer to an NTFS_VCB for the destination volume. FileRecord Pointer to a complete file record to add the attribute to. AttributeAddress Pointer to the region of memory that will receive the $INDEX_ALLOCATION attribute. This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord). Name Pointer to a string of 16-bit Unicode characters naming the attribute. Most often, this will be L"$I30". NameLength The number of wide-characters in the name. L"$I30" Would use 4 here. Returns STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record, or if the file record isn't large enough for the attribute. Remarks Only adding the attribute to the end of the file record is supported; AttributeAddress must be of type AttributeEnd. This could be improved by adding an $ATTRIBUTE_LIST to the file record if there's not enough space.
NTSTATUS	AddIndexAllocation (PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
AddIndexRoot
@implemented Adds an $INDEX_ROOT attribute to a given FileRecord. Parameters Vcb Pointer to an NTFS_VCB for the destination volume. FileRecord Pointer to a complete file record to add the attribute to. Caller is responsible for ensuring FileRecord is large enough to contain $INDEX_ROOT. AttributeAddress Pointer to the region of memory that will receive the $INDEX_ROOT attribute. This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord). NewIndexRoot Pointer to an INDEX_ROOT_ATTRIBUTE containing the index root that will be copied to the new attribute. RootLength The length of NewIndexRoot, in bytes. Name Pointer to a string of 16-bit Unicode characters naming the attribute. Most often, this will be L"$I30". NameLength The number of wide-characters in the name. L"$I30" Would use 4 here. Returns STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record. Remarks This function is intended to assist in creating new folders. Only adding the attribute to the end of the file record is supported; AttributeAddress must be of type AttributeEnd. It's the caller's responsibility to ensure the given file record has enough memory allocated for the attribute, and this memory must have been zeroed.
NTSTATUS	AddIndexRoot (PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PINDEX_ROOT_ATTRIBUTE NewIndexRoot, ULONG RootLength, PCWSTR Name, USHORT NameLength)
AddRun
@implemented Adds a run of allocated clusters to a non-resident attribute. Parameters Vcb Pointer to an NTFS_VCB for the destination volume. AttrContext Pointer to an NTFS_ATTR_CONTEXT describing the destination attribute. AttrOffset Byte offset of the destination attribute relative to its file record. FileRecord Pointer to a complete copy of the file record containing the destination attribute. Must be at least Vcb->NtfsInfo.BytesPerFileRecord bytes long. NextAssignedCluster Logical cluster number of the start of the data run being added. RunLength How many clusters are in the data run being added. Can't be 0. Returns STATUS_SUCCESS on success. STATUS_INVALID_PARAMETER if AttrContext describes a resident attribute. STATUS_INSUFFICIENT_RESOURCES if ConvertDataRunsToLargeMCB() fails or if we fail to allocate a buffer for the new data runs. STATUS_INSUFFICIENT_RESOURCES or STATUS_UNSUCCESSFUL if FsRtlAddLargeMcbEntry() fails. STATUS_NOT_IMPLEMENTED if we need to migrate the attribute to an attribute list (TODO). Any other failure from ConvertLargeMCBToDataRuns() is returned as-is. Remarks Clusters should have been allocated previously with NtfsAllocateClusters().
NTSTATUS	AddRun (PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONGLONG NextAssignedCluster, ULONG RunLength)
AddStandardInformation
@implemented Adds a $STANDARD_INFORMATION attribute to a given FileRecord. Parameters FileRecord Pointer to a complete file record to add the attribute to. Caller is responsible for ensuring FileRecord is large enough to contain $STANDARD_INFORMATION. AttributeAddress Pointer to the region of memory that will receive the $STANDARD_INFORMATION attribute. This address must reside within FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord). Returns STATUS_SUCCESS on success. STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record. Remarks Only adding the attribute to the end of the file record is supported; AttributeAddress must be of type AttributeEnd. As it's implemented, this function is only intended to assist in creating new file records. It could be made more general-purpose by considering file records with an $ATTRIBUTE_LIST. It's the caller's responsibility to ensure the given file record has enough memory allocated for the attribute.
NTSTATUS	AddStandardInformation (PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
ConvertDataRunsToLargeMCB
@implemented Converts binary data runs to a map control block. Parameters DataRun Pointer to the run data DataRunsMCB Pointer to an unitialized LARGE_MCB structure. Returns STATUS_SUCCESS on success, STATUS_INSUFFICIENT_RESOURCES or STATUS_UNSUCCESSFUL if we fail to initialize the mcb or add an entry. Remarks Initializes the LARGE_MCB pointed to by DataRunsMCB. If this function succeeds, you need to call FsRtlUninitializeLargeMcb() when you're done with DataRunsMCB. This function will ensure the LargeMCB has been unitialized in case of failure.
NTSTATUS	ConvertDataRunsToLargeMCB (PUCHAR DataRun, PLARGE_MCB DataRunsMCB, PULONGLONG pNextVBN)
ConvertLargeMCBToDataRuns
@implemented Converts a map control block to a series of encoded data runs (used by non-resident attributes). Parameters DataRunsMCB Pointer to a LARGE_MCB structure describing the data runs. VcnCount Number of VCNs the runs must describe, HighestVCN + 1. A hole the MCB doesn't reach, at the end of a sparse stream, is encoded up to this point. RunBuffer Pointer to the buffer that will receive the encoded data runs. MaxBufferSize Size of RunBuffer, in bytes. UsedBufferSize Pointer to a ULONG that will receive the size of the data runs in bytes. Can't be NULL. Returns STATUS_SUCCESS on success, STATUS_BUFFER_TOO_SMALL if RunBuffer is too small to contain the complete output.
NTSTATUS	ConvertLargeMCBToDataRuns (PLARGE_MCB DataRunsMCB, ULONGLONG VcnCount, PUCHAR RunBuffer, ULONG MaxBufferSize, PULONG UsedBufferSize)
PUCHAR	DecodeRun (PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength)
BOOLEAN	FindRun (PNTFS_ATTR_RECORD NresAttr, ULONGLONG vcn, PULONGLONG lcn, PULONGLONG count)
FreeClusters
@implemented Shrinks the allocation size of a non-resident attribute by a given number of clusters. Frees the clusters from the volume's $BITMAP file as well as the attribute's data runs. Parameters Vcb Pointer to an NTFS_VCB for the destination volume. AttrContext Pointer to an NTFS_ATTR_CONTEXT describing the attribute from which the clusters will be freed. AttrOffset Byte offset of the destination attribute relative to its file record. FileRecord Pointer to a complete copy of the file record containing the attribute. Must be at least Vcb->NtfsInfo.BytesPerFileRecord bytes long. ClustersToFree Number of clusters that should be freed from the end of the data stream. Must be no more Than the number of clusters assigned to the attribute (HighestVCN + 1). Returns STATUS_SUCCESS on success. STATUS_INVALID_PARAMETER if AttrContext describes a resident attribute, or if the caller requested more clusters be freed than the attribute has been allocated. STATUS_INSUFFICIENT_RESOURCES if allocating a buffer for the data runs fails or if ConvertDataRunsToLargeMCB() fails. STATUS_BUFFER_TOO_SMALL if ConvertLargeMCBToDataRuns() fails.
NTSTATUS	FreeClusters (PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONG ClustersToFree)
static NTSTATUS	InternalReadNonResidentAttributes (PFIND_ATTR_CONTXT Context)
static PNTFS_ATTRIBUTE_LIST_ITEM	InternalGetNextAttributeListItem (PFIND_ATTR_CONTXT Context)
NTSTATUS	FindFirstAttributeListItem (PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
NTSTATUS	FindNextAttributeListItem (PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
static PNTFS_ATTR_RECORD	InternalGetNextAttribute (PFIND_ATTR_CONTXT Context)
NTSTATUS	FindFirstAttribute (PFIND_ATTR_CONTXT Context, PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, BOOLEAN OnlyResident, PNTFS_ATTR_RECORD *Attribute)
NTSTATUS	FindNextAttribute (PFIND_ATTR_CONTXT Context, PNTFS_ATTR_RECORD *Attribute)
VOID	FindCloseAttribute (PFIND_ATTR_CONTXT Context)
static VOID	NtfsDumpFileNameAttribute (PNTFS_ATTR_RECORD Attribute)
static VOID	NtfsDumpStandardInformationAttribute (PNTFS_ATTR_RECORD Attribute)
static VOID	NtfsDumpVolumeNameAttribute (PNTFS_ATTR_RECORD Attribute)
static VOID	NtfsDumpVolumeInformationAttribute (PNTFS_ATTR_RECORD Attribute)
static VOID	NtfsDumpIndexRootAttribute (PNTFS_ATTR_RECORD Attribute)
static VOID	NtfsDumpAttribute (PDEVICE_EXTENSION Vcb, PNTFS_ATTR_RECORD Attribute)
VOID	NtfsDumpDataRunData (PUCHAR DataRun)
VOID	NtfsDumpDataRuns (PVOID StartOfRun, ULONGLONG CurrentLCN)
VOID	NtfsDumpFileAttributes (PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
PFILENAME_ATTRIBUTE	GetFileNameFromRecord (PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
UCHAR	GetPackedByteCount (LONGLONG NumberToPack, BOOLEAN IsSigned)
NTSTATUS	GetLastClusterInDataRun (PDEVICE_EXTENSION Vcb, PNTFS_ATTR_RECORD Attribute, PULONGLONG LastCluster)
PSTANDARD_INFORMATION	GetStandardInformationFromRecord (PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
GetFileNameAttributeLength
@implemented Returns the size of a given FILENAME_ATTRIBUTE, in bytes. Parameters FileNameAttribute Pointer to a FILENAME_ATTRIBUTE to determine the size of. Remarks The length of a FILENAME_ATTRIBUTE is variable and is dependent on the length of the file name stored at the end. This function operates on the FILENAME_ATTRIBUTE proper, so don't try to pass it a PNTFS_ATTR_RECORD.
ULONG	GetFileNameAttributeLength (PFILENAME_ATTRIBUTE FileNameAttribute)
PFILENAME_ATTRIBUTE	GetBestFileNameFromRecord (PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 34 of file attrib.c.

NTFS_DUMP_DATA_RUNS

#define NTFS_DUMP_DATA_RUNS   0

Definition at line 39 of file attrib.c.

Function Documentation

AddBitmap()

NTSTATUS AddBitmap	(	PNTFS_VCB	Vcb,
		PFILE_RECORD_HEADER	FileRecord,
		PNTFS_ATTR_RECORD	AttributeAddress,
		PCWSTR	Name,
		USHORT	NameLength
	)

Definition at line 76 of file attrib.c.

{
    ULONG AttributeLength;
    // Calculate the header length
    ULONG ResidentHeaderLength = FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.Reserved) + sizeof(UCHAR);
    ULONG FileRecordEnd = AttributeAddress->Length;
    ULONG NameOffset;
    ULONG ValueOffset;
    // We'll start out with 8 bytes of bitmap data
    ULONG ValueLength = 8;
    ULONG BytesAvailable;
 
    if (AttributeAddress->Type != AttributeEnd)
    {
        DPRINT1("FIXME: Can only add $BITMAP attribute to the end of a file record.\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    NameOffset = ResidentHeaderLength;
 
    // Calculate ValueOffset, which will be aligned to a 4-byte boundary
    ValueOffset = ALIGN_UP_BY(NameOffset + (sizeof(WCHAR) * NameLength), VALUE_OFFSET_ALIGNMENT);
 
    // Calculate length of attribute
    AttributeLength = ValueOffset + ValueLength;
    AttributeLength = ALIGN_UP_BY(AttributeLength, ATTR_RECORD_ALIGNMENT);
 
    // Make sure the file record is large enough for the new attribute
    BytesAvailable = Vcb->NtfsInfo.BytesPerFileRecord - FileRecord->BytesInUse;
    if (BytesAvailable < AttributeLength)
    {
        DPRINT1("FIXME: Not enough room in file record for index allocation attribute!\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    // Set Attribute fields
    RtlZeroMemory(AttributeAddress, AttributeLength);
 
    AttributeAddress->Type = AttributeBitmap;
    AttributeAddress->Length = AttributeLength;
    AttributeAddress->NameLength = NameLength;
    AttributeAddress->NameOffset = NameOffset;
    AttributeAddress->Instance = FileRecord->NextAttributeNumber++;
 
    AttributeAddress->Resident.ValueLength = ValueLength;
    AttributeAddress->Resident.ValueOffset = ValueOffset;
 
    // Set the name
    RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
 
    // move the attribute-end and file-record-end markers to the end of the file record
    AttributeAddress = (PNTFS_ATTR_RECORD)((ULONG_PTR)AttributeAddress + AttributeAddress->Length);
    SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
 
    return STATUS_SUCCESS;
}

Referenced by DECLARE_INTERFACE_(), CFontsDialog::InitToolbar(), and UpdateIndexAllocation().

AddData()

NTSTATUS AddData	(	PFILE_RECORD_HEADER	FileRecord,
		PNTFS_ATTR_RECORD	AttributeAddress
	)

Definition at line 164 of file attrib.c.

{
    ULONG ResidentHeaderLength = FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.Reserved) + sizeof(UCHAR);
    ULONG FileRecordEnd = AttributeAddress->Length;
 
    if (AttributeAddress->Type != AttributeEnd)
    {
        DPRINT1("FIXME: Can only add $DATA attribute to the end of a file record.\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    AttributeAddress->Type = AttributeData;
    AttributeAddress->Length = ResidentHeaderLength;
    AttributeAddress->Length = ALIGN_UP_BY(AttributeAddress->Length, ATTR_RECORD_ALIGNMENT);
    AttributeAddress->Resident.ValueLength = 0;
    AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
 
    // for unnamed $DATA attributes, NameOffset equals header length
    AttributeAddress->NameOffset = ResidentHeaderLength;
    AttributeAddress->Instance = FileRecord->NextAttributeNumber++;
 
    // move the attribute-end and file-record-end markers to the end of the file record
    AttributeAddress = (PNTFS_ATTR_RECORD)((ULONG_PTR)AttributeAddress + AttributeAddress->Length);
    SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
 
    return STATUS_SUCCESS;
}

Referenced by DECLARE_INTERFACE_(), and NtfsCreateFileRecord().

AddFileName()

NTSTATUS AddFileName	(	PFILE_RECORD_HEADER	FileRecord,
		PNTFS_ATTR_RECORD	AttributeAddress,
		PDEVICE_EXTENSION	DeviceExt,
		PFILE_OBJECT	FileObject,
		BOOLEAN	CaseSensitive,
		PULONGLONG	ParentMftIndex
	)

Definition at line 234 of file attrib.c.

{
    ULONG ResidentHeaderLength = FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.Reserved) + sizeof(UCHAR);
    PFILENAME_ATTRIBUTE FileNameAttribute;
    LARGE_INTEGER SystemTime;
    ULONG FileRecordEnd = AttributeAddress->Length;
    ULONGLONG CurrentMFTIndex = NTFS_FILE_ROOT;
    UNICODE_STRING Current, Remaining, FilenameNoPath;
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG FirstEntry;
 
    if (AttributeAddress->Type != AttributeEnd)
    {
        DPRINT1("FIXME: Can only add $FILE_NAME attribute to the end of a file record.\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    AttributeAddress->Type = AttributeFileName;
    AttributeAddress->Instance = FileRecord->NextAttributeNumber++;
 
    FileNameAttribute = (PFILENAME_ATTRIBUTE)((LONG_PTR)AttributeAddress + ResidentHeaderLength);
 
    // set timestamps
    KeQuerySystemTime(&SystemTime);
    FileNameAttribute->CreationTime = SystemTime.QuadPart;
    FileNameAttribute->ChangeTime = SystemTime.QuadPart;
    FileNameAttribute->LastWriteTime = SystemTime.QuadPart;
    FileNameAttribute->LastAccessTime = SystemTime.QuadPart;
 
    // Is this a directory?
    if(FileRecord->Flags & FRH_DIRECTORY)
        FileNameAttribute->FileAttributes = NTFS_FILE_TYPE_DIRECTORY;
    else
        FileNameAttribute->FileAttributes = NTFS_FILE_TYPE_ARCHIVE;
 
    // we need to extract the filename from the path
    DPRINT("Pathname: %wZ\n", &FileObject->FileName);
 
    FsRtlDissectName(FileObject->FileName, &Current, &Remaining);
 
    while (Remaining.Length != 0)
    {
        DPRINT("Current: %wZ\n", &Current);
 
        FirstEntry = 0;
        Status = NtfsFindMftRecord(DeviceExt,
                                   CurrentMFTIndex,
                                   &Current,
                                   &FirstEntry,
                                   FALSE,
                                   CaseSensitive,
                                   &CurrentMFTIndex);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("Path component '%wZ' of '%wZ' not found (Status %lx)\n",
                    &Current, &FileObject->FileName, Status);
            return Status;
        }
 
        FsRtlDissectName(Remaining, &Current, &Remaining);
    }
 
    /* Whatever is left over is the file's own name */
    FilenameNoPath = Current;
 
    DPRINT("MFT Index of parent: %I64u\n", CurrentMFTIndex);
 
    // set reference to parent directory
    FileNameAttribute->DirectoryFileReferenceNumber = CurrentMFTIndex;
    *ParentMftIndex = CurrentMFTIndex;
 
    DPRINT("SequenceNumber: 0x%02x\n", FileRecord->SequenceNumber);
 
    // The highest 2 bytes should be the sequence number, unless the parent happens to be root
    if (CurrentMFTIndex == NTFS_FILE_ROOT)
        FileNameAttribute->DirectoryFileReferenceNumber |= (ULONGLONG)NTFS_FILE_ROOT << 48;
    else
        FileNameAttribute->DirectoryFileReferenceNumber |= (ULONGLONG)FileRecord->SequenceNumber << 48;
 
    DPRINT("FileNameAttribute->DirectoryFileReferenceNumber: 0x%016I64x\n", FileNameAttribute->DirectoryFileReferenceNumber);
 
    FileNameAttribute->NameLength = FilenameNoPath.Length / sizeof(WCHAR);
    RtlCopyMemory(FileNameAttribute->Name, FilenameNoPath.Buffer, FilenameNoPath.Length);
 
    // For now, we're emulating the way Windows behaves when 8.3 name generation is disabled
    // TODO: add DOS Filename as needed
    if (!CaseSensitive && RtlIsNameLegalDOS8Dot3(&FilenameNoPath, NULL, NULL))
        FileNameAttribute->NameType = NTFS_FILE_NAME_WIN32_AND_DOS;
    else
        FileNameAttribute->NameType = NTFS_FILE_NAME_POSIX;
 
    FileRecord->LinkCount++;
 
    AttributeAddress->Length = ResidentHeaderLength +
        FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + FilenameNoPath.Length;
    AttributeAddress->Length = ALIGN_UP_BY(AttributeAddress->Length, ATTR_RECORD_ALIGNMENT);
 
    AttributeAddress->Resident.ValueLength = FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + FilenameNoPath.Length;
    AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
    AttributeAddress->Resident.Flags = RA_INDEXED;
 
    // move the attribute-end and file-record-end markers to the end of the file record
    AttributeAddress = (PNTFS_ATTR_RECORD)((ULONG_PTR)AttributeAddress + AttributeAddress->Length);
    SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
 
    return Status;
}

Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().

AddIndexAllocation()

NTSTATUS AddIndexAllocation	(	PNTFS_VCB	Vcb,
		PFILE_RECORD_HEADER	FileRecord,
		PNTFS_ATTR_RECORD	AttributeAddress,
		PCWSTR	Name,
		USHORT	NameLength
	)

Definition at line 380 of file attrib.c.

{
    ULONG RecordLength;
    ULONG FileRecordEnd;
    ULONG NameOffset;
    ULONG DataRunOffset;
    ULONG BytesAvailable;
 
    if (AttributeAddress->Type != AttributeEnd)
    {
        DPRINT1("FIXME: Can only add $INDEX_ALLOCATION attribute to the end of a file record.\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    // Calculate the name offset
    NameOffset = FIELD_OFFSET(NTFS_ATTR_RECORD, NonResident.CompressedSize);
 
    // Calculate the offset to the first data run
    DataRunOffset = (sizeof(WCHAR) * NameLength) + NameOffset;
    // The data run offset must be aligned to a 4-byte boundary
    DataRunOffset = ALIGN_UP_BY(DataRunOffset, DATA_RUN_ALIGNMENT);
 
    // Calculate the length of the new attribute; the empty data run will consist of a single byte
    RecordLength = DataRunOffset + 1;
 
    // The size of the attribute itself must be aligned to an 8 - byte boundary
    RecordLength = ALIGN_UP_BY(RecordLength, ATTR_RECORD_ALIGNMENT);
 
    // Back up the last 4-bytes of the file record (even though this value doesn't matter)
    FileRecordEnd = AttributeAddress->Length;
 
    // Make sure the file record can contain the new attribute
    BytesAvailable = Vcb->NtfsInfo.BytesPerFileRecord - FileRecord->BytesInUse;
    if (BytesAvailable < RecordLength)
    {
        DPRINT1("FIXME: Not enough room in file record for index allocation attribute!\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    // Set fields of attribute header
    RtlZeroMemory(AttributeAddress, RecordLength);
 
    AttributeAddress->Type = AttributeIndexAllocation;
    AttributeAddress->Length = RecordLength;
    AttributeAddress->IsNonResident = TRUE;
    AttributeAddress->NameLength = NameLength;
    AttributeAddress->NameOffset = NameOffset;
    AttributeAddress->Instance = FileRecord->NextAttributeNumber++;
 
    AttributeAddress->NonResident.MappingPairsOffset = DataRunOffset;
    AttributeAddress->NonResident.HighestVCN = (LONGLONG)-1;
 
    // Set the name
    RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
 
    // move the attribute-end and file-record-end markers to the end of the file record
    AttributeAddress = (PNTFS_ATTR_RECORD)((ULONG_PTR)AttributeAddress + AttributeAddress->Length);
    SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
 
    return STATUS_SUCCESS;
}

Referenced by UpdateIndexAllocation().

AddIndexRoot()

NTSTATUS AddIndexRoot	(	PNTFS_VCB	Vcb,
		PFILE_RECORD_HEADER	FileRecord,
		PNTFS_ATTR_RECORD	AttributeAddress,
		PINDEX_ROOT_ATTRIBUTE	NewIndexRoot,
		ULONG	RootLength,
		PCWSTR	Name,
		USHORT	NameLength
	)

Definition at line 487 of file attrib.c.

{
    ULONG AttributeLength;
    // Calculate the header length
    ULONG ResidentHeaderLength = FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.Reserved) + sizeof(UCHAR);
    // Back up the file record's final ULONG (even though it doesn't matter)
    ULONG FileRecordEnd = AttributeAddress->Length;
    ULONG NameOffset;
    ULONG ValueOffset;
    ULONG BytesAvailable;
 
    if (AttributeAddress->Type != AttributeEnd)
    {
        DPRINT1("FIXME: Can only add $DATA attribute to the end of a file record.\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    NameOffset = ResidentHeaderLength;
 
    // Calculate ValueOffset, which will be aligned to a 4-byte boundary
    ValueOffset = ALIGN_UP_BY(NameOffset + (sizeof(WCHAR) * NameLength), VALUE_OFFSET_ALIGNMENT);
 
    // Calculate length of attribute
    AttributeLength = ValueOffset + RootLength;
    AttributeLength = ALIGN_UP_BY(AttributeLength, ATTR_RECORD_ALIGNMENT);
 
    // Make sure the file record is large enough for the new attribute
    BytesAvailable = Vcb->NtfsInfo.BytesPerFileRecord - FileRecord->BytesInUse;
    if (BytesAvailable < AttributeLength)
    {
        DPRINT1("FIXME: Not enough room in file record for index allocation attribute!\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    // Set Attribute fields
    RtlZeroMemory(AttributeAddress, AttributeLength);
 
    AttributeAddress->Type = AttributeIndexRoot;
    AttributeAddress->Length = AttributeLength;
    AttributeAddress->NameLength = NameLength;
    AttributeAddress->NameOffset = NameOffset;
    AttributeAddress->Instance = FileRecord->NextAttributeNumber++;
 
    AttributeAddress->Resident.ValueLength = RootLength;
    AttributeAddress->Resident.ValueOffset = ValueOffset;
 
    // Set the name
    RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
 
    // Copy the index root attribute
    RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + ValueOffset), NewIndexRoot, RootLength);
 
    // move the attribute-end and file-record-end markers to the end of the file record
    AttributeAddress = (PNTFS_ATTR_RECORD)((ULONG_PTR)AttributeAddress + AttributeAddress->Length);
    SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
 
    return STATUS_SUCCESS;
}

Referenced by NtfsCreateDirectory().

AddRun()

NTSTATUS AddRun	(	PNTFS_VCB	Vcb,
		PNTFS_ATTR_CONTEXT	AttrContext,
		ULONG	AttrOffset,
		PFILE_RECORD_HEADER	FileRecord,
		ULONGLONG	NextAssignedCluster,
		ULONG	RunLength
	)

Definition at line 591 of file attrib.c.

{
    NTSTATUS Status;
    int DataRunMaxLength;
    PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
    ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
    ULONGLONG NextVBN = 0;
    ULONGLONG HighestVcn;
 
    PUCHAR RunBuffer;
    ULONG RunBufferSize;
 
    if (!AttrContext->pRecord->IsNonResident)
        return STATUS_INVALID_PARAMETER;
 
    if (AttrContext->pRecord->NonResident.AllocatedSize != 0)
        NextVBN = AttrContext->pRecord->NonResident.HighestVCN + 1;
 
    /* The run goes on the end, so it holds the new last VCN */
    HighestVcn = NextVBN + RunLength - 1;
 
    // Add newly-assigned clusters to mcb
    _SEH2_TRY
    {
        if (!FsRtlAddLargeMcbEntry(&AttrContext->DataRunsMCB,
                                   NextVBN,
                                   NextAssignedCluster,
                                   RunLength))
        {
            ExRaiseStatus(STATUS_UNSUCCESSFUL);
        }
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        DPRINT1("Failed to add LargeMcb Entry!\n");
        _SEH2_YIELD(return _SEH2_GetExceptionCode());
    }
    _SEH2_END;
 
    RunBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
    if (!RunBuffer)
    {
        DPRINT1("ERROR: Couldn't allocate memory for data runs!\n");
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    // Convert the map control block back to encoded data runs.
    Status = ConvertLargeMCBToDataRuns(&AttrContext->DataRunsMCB, HighestVcn + 1, RunBuffer, Vcb->NtfsInfo.BytesPerFileRecord, &RunBufferSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
        // Runs won't fit in a single record; migrating to an $ATTRIBUTE_LIST isn't supported yet.
        DPRINT1("Data runs too large for one file record - $ATTRIBUTE_LIST needed (not implemented)\n");
        ExFreePoolWithTag(RunBuffer, TAG_NTFS);
        return STATUS_NOT_IMPLEMENTED;
    }
    else if (!NT_SUCCESS(Status))
    {
        DPRINT1("ERROR: Failed to convert data runs! (Status %lx)\n", Status);
        ExFreePoolWithTag(RunBuffer, TAG_NTFS);
        return Status;
    }
 
    // Get the amount of free space between the start of the of the first data run and the attribute end
    DataRunMaxLength = AttrContext->pRecord->Length - AttrContext->pRecord->NonResident.MappingPairsOffset;
 
    // Do we need to extend the attribute (or convert to attribute list)?
    if (DataRunMaxLength < RunBufferSize)
    {
        PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
        PNTFS_ATTR_RECORD NewRecord;
 
        // Add free space at the end of the file record to DataRunMaxLength
        DataRunMaxLength += Vcb->NtfsInfo.BytesPerFileRecord - FileRecord->BytesInUse;
 
        // Can we resize the attribute?
        if (DataRunMaxLength < RunBufferSize)
        {
            DPRINT1("FIXME: Need to create attribute list! Max Data Run Length available: %d, RunBufferSize: %d\n", DataRunMaxLength, RunBufferSize);
            ExFreePoolWithTag(RunBuffer, TAG_NTFS);
            return STATUS_NOT_IMPLEMENTED;
        }
 
        // Are there more attributes after the one we're resizing?
        if (NextAttribute->Type != AttributeEnd)
        {
            PNTFS_ATTR_RECORD FinalAttribute;
 
            // Calculate where to move the trailing attributes
            ULONG_PTR MoveTo = (ULONG_PTR)DestinationAttribute + AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize;
            MoveTo = ALIGN_UP_BY(MoveTo, ATTR_RECORD_ALIGNMENT);
 
            DPRINT("Moving attribute(s) after this one starting with type 0x%lx\n", NextAttribute->Type);
 
            // Move the trailing attributes; FinalAttribute will point to the end marker
            FinalAttribute = MoveAttributes(Vcb, NextAttribute, NextAttributeOffset, MoveTo);
 
            // set the file record end
            SetFileRecordEnd(FileRecord, FinalAttribute, FILE_RECORD_END);
        }
 
        // calculate position of end markers
        NextAttributeOffset = AttrOffset + AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize;
        NextAttributeOffset = ALIGN_UP_BY(NextAttributeOffset, ATTR_RECORD_ALIGNMENT);
 
        // Update the length of the destination attribute
        DestinationAttribute->Length = NextAttributeOffset - AttrOffset;
 
        // Create a new copy of the attribute record
        NewRecord = ExAllocatePoolWithTag(NonPagedPool, DestinationAttribute->Length, TAG_NTFS);
        RtlCopyMemory(NewRecord, AttrContext->pRecord, AttrContext->pRecord->Length);
        NewRecord->Length = DestinationAttribute->Length;
 
        // Free the old copy of the attribute record, which won't be large enough
        ExFreePoolWithTag(AttrContext->pRecord, TAG_NTFS);
 
        // Set the attribute context's record to the new copy
        AttrContext->pRecord = NewRecord;
 
        // if NextAttribute is the AttributeEnd marker
        if (NextAttribute->Type == AttributeEnd)
        {
            // End the file record
            NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
            SetFileRecordEnd(FileRecord, NextAttribute, FILE_RECORD_END);
        }
    }
 
    // Update HighestVCN
    DestinationAttribute->NonResident.HighestVCN =
    AttrContext->pRecord->NonResident.HighestVCN = HighestVcn;
 
    /* Sparse and compressed streams also count the clusters they really own */
    if (AttrContext->pRecord->Flags & (NTFS_ATTR_COMPRESSION_MASK | NTFS_ATTR_SPARSE))
    {
        AttrContext->pRecord->NonResident.CompressedSize += (ULONGLONG)RunLength * Vcb->NtfsInfo.BytesPerCluster;
        DestinationAttribute->NonResident.CompressedSize = AttrContext->pRecord->NonResident.CompressedSize;
    }
 
    // Write data runs to destination attribute
    RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
                  RunBuffer,
                  RunBufferSize);
 
    // Update the attribute record in the attribute context
    RtlCopyMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + AttrContext->pRecord->NonResident.MappingPairsOffset),
                  RunBuffer,
                  RunBufferSize);
 
    // Update the file record
    Status = UpdateFileRecord(Vcb, AttrContext->FileMFTIndex, FileRecord);
 
    ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 
#if NTFS_DUMP_DATA_RUNS
    NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
#endif
 
    return Status;
}

Referenced by NtfsExtendAllocation().

AddStandardInformation()

NTSTATUS AddStandardInformation	(	PFILE_RECORD_HEADER	FileRecord,
		PNTFS_ATTR_RECORD	AttributeAddress
	)

Definition at line 783 of file attrib.c.

{
    ULONG ResidentHeaderLength = FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.Reserved) + sizeof(UCHAR);
    PSTANDARD_INFORMATION StandardInfo = (PSTANDARD_INFORMATION)((LONG_PTR)AttributeAddress + ResidentHeaderLength);
    LARGE_INTEGER SystemTime;
    ULONG FileRecordEnd = AttributeAddress->Length;
 
    if (AttributeAddress->Type != AttributeEnd)
    {
        DPRINT1("FIXME: Can only add $STANDARD_INFORMATION attribute to the end of a file record.\n");
        return STATUS_NOT_IMPLEMENTED;
    }
 
    AttributeAddress->Type = AttributeStandardInformation;
    AttributeAddress->Length = sizeof(STANDARD_INFORMATION) + ResidentHeaderLength;
    AttributeAddress->Length = ALIGN_UP_BY(AttributeAddress->Length, ATTR_RECORD_ALIGNMENT);
    AttributeAddress->Resident.ValueLength = sizeof(STANDARD_INFORMATION);
    AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
    AttributeAddress->Instance = FileRecord->NextAttributeNumber++;
 
    // set dates and times
    KeQuerySystemTime(&SystemTime);
    StandardInfo->CreationTime = SystemTime.QuadPart;
    StandardInfo->ChangeTime = SystemTime.QuadPart;
    StandardInfo->LastWriteTime = SystemTime.QuadPart;
    StandardInfo->LastAccessTime = SystemTime.QuadPart;
    StandardInfo->FileAttribute = NTFS_FILE_TYPE_ARCHIVE;
 
    // move the attribute-end and file-record-end markers to the end of the file record
    AttributeAddress = (PNTFS_ATTR_RECORD)((ULONG_PTR)AttributeAddress + AttributeAddress->Length);
    SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
 
    return STATUS_SUCCESS;
}

Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().

ConvertDataRunsToLargeMCB()

NTSTATUS ConvertDataRunsToLargeMCB	(	PUCHAR	DataRun,
		PLARGE_MCB	DataRunsMCB,
		PULONGLONG	pNextVBN
	)

Definition at line 842 of file attrib.c.

{
    LONGLONG  DataRunOffset;
    ULONGLONG DataRunLength;
    LONGLONG  DataRunStartLCN;
    ULONGLONG LastLCN = 0;
 
    // Initialize the MCB, potentially catch an exception
    _SEH2_TRY{
        FsRtlInitializeLargeMcb(DataRunsMCB, NonPagedPool);
    } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {
        _SEH2_YIELD(return _SEH2_GetExceptionCode());
    } _SEH2_END;
 
    while (*DataRun != 0)
    {
        DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 
        if (DataRunOffset != -1)
        {
            // Normal data run.
            DataRunStartLCN = LastLCN + DataRunOffset;
            LastLCN = DataRunStartLCN;
 
            _SEH2_TRY{
                if (!FsRtlAddLargeMcbEntry(DataRunsMCB,
                                           *pNextVBN,
                                           DataRunStartLCN,
                                           DataRunLength))
                {
                    ExRaiseStatus(STATUS_UNSUCCESSFUL);
                }
            } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {
                FsRtlUninitializeLargeMcb(DataRunsMCB);
                _SEH2_YIELD(return _SEH2_GetExceptionCode());
            } _SEH2_END;
 
        }
 
        *pNextVBN += DataRunLength;
    }
 
    return STATUS_SUCCESS;
}

Referenced by PrepareAttributeContext().

ConvertLargeMCBToDataRuns()

NTSTATUS ConvertLargeMCBToDataRuns	(	PLARGE_MCB	DataRunsMCB,
		ULONGLONG	VcnCount,
		PUCHAR	RunBuffer,
		ULONG	MaxBufferSize,
		PULONG	UsedBufferSize
	)

Definition at line 917 of file attrib.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG RunBufferOffset = 0;
    LONGLONG  DataRunOffset = 0;
    ULONGLONG LastLCN = 0;
    ULONGLONG NextVcn = 0;
    LONGLONG Vbn, Lbn, Count;
    ULONG i;
    BOOLEAN Tail = FALSE;
 
 
    DPRINT("\t[Vbn, Lbn, Count]\n");
 
    // convert each mcb entry to a data run, then the trailing hole if there is one
    for (i = 0; ; i++)
    {
        UCHAR DataRunOffsetSize = 0;
        UCHAR DataRunLengthSize = 0;
        UCHAR ControlByte = 0;
 
        if (!FsRtlGetNextLargeMcbEntry(DataRunsMCB, i, &Vbn, &Lbn, &Count))
        {
            if (NextVcn >= VcnCount)
                break;
 
            /* The MCB only knows mapped clusters, so a hole at the end isn't in it */
            Vbn = NextVcn;
            Lbn = -1;
            Count = VcnCount - NextVcn;
            Tail = TRUE;
        }
 
        // [vbn, lbn, count]
        DPRINT("\t[%I64d, %I64d,%I64d]\n", Vbn, Lbn, Count);
 
        // determine how to represent DataRunLengthSize with the minimum number of bytes
        DPRINT("Determining how many bytes needed to represent %I64x\n", Count);
        DataRunLengthSize = GetPackedByteCount(Count, TRUE);
        DPRINT("%d bytes needed.\n", DataRunLengthSize);
 
        /* A sparse run has no offset, and the next real run is relative to the last real one */
        if (Lbn != -1)
        {
            DataRunOffset = Lbn - LastLCN;
            LastLCN = Lbn;
 
            // now we need to determine how to represent DataRunOffset with the minimum number of bytes
            DPRINT("Determining how many bytes needed to represent %I64x\n", DataRunOffset);
            DataRunOffsetSize = GetPackedByteCount(DataRunOffset, TRUE);
            DPRINT("%d bytes needed.\n", DataRunOffsetSize);
        }
 
        // ensure the next data run + end marker would be <= Max buffer size
        if (RunBufferOffset + 2 + DataRunLengthSize + DataRunOffsetSize > MaxBufferSize)
        {
            Status = STATUS_BUFFER_TOO_SMALL;
            DPRINT1("FIXME: Ran out of room in buffer for data runs!\n");
            break;
        }
 
        // pack and copy the control byte
        ControlByte = (DataRunOffsetSize << 4) + DataRunLengthSize;
        RunBuffer[RunBufferOffset++] = ControlByte;
 
        // copy DataRunLength
        RtlCopyMemory(RunBuffer + RunBufferOffset, &Count, DataRunLengthSize);
        RunBufferOffset += DataRunLengthSize;
 
        // copy DataRunOffset
        RtlCopyMemory(RunBuffer + RunBufferOffset, &DataRunOffset, DataRunOffsetSize);
        RunBufferOffset += DataRunOffsetSize;
 
        NextVcn = Vbn + Count;
 
        if (Tail)
            break;
    }
 
    // End of data runs
    RunBuffer[RunBufferOffset++] = 0;
 
    *UsedBufferSize = RunBufferOffset;
    DPRINT("New Size of DataRuns: %ld\n", *UsedBufferSize);
 
    return Status;
}

Referenced by AddRun(), FreeClusters(), and NtfsMapAttributeRuns().

DecodeRun()

PUCHAR DecodeRun	(	PUCHAR	DataRun,
		LONGLONG *	DataRunOffset,
		ULONGLONG *	DataRunLength
	)

Definition at line 1010 of file attrib.c.

{
    UCHAR DataRunOffsetSize;
    UCHAR DataRunLengthSize;
    CHAR i;
 
    DataRunOffsetSize = (*DataRun >> 4) & 0xF;
    DataRunLengthSize = *DataRun & 0xF;
    *DataRunOffset = 0;
    *DataRunLength = 0;
    DataRun++;
    for (i = 0; i < DataRunLengthSize; i++)
    {
        *DataRunLength += ((ULONG64)*DataRun) << (i * 8);
        DataRun++;
    }
 
    /* NTFS 3+ sparse files */
    if (DataRunOffsetSize == 0)
    {
        *DataRunOffset = -1;
    }
    else
    {
        for (i = 0; i < DataRunOffsetSize - 1; i++)
        {
            *DataRunOffset += ((ULONG64)*DataRun) << (i * 8);
            DataRun++;
        }
        /* The last byte contains sign so we must process it different way. */
        *DataRunOffset = ((LONG64)(CHAR)(*(DataRun++)) << (i * 8)) + *DataRunOffset;
    }
 
    DPRINT("DataRunOffsetSize: %x\n", DataRunOffsetSize);
    DPRINT("DataRunLengthSize: %x\n", DataRunLengthSize);
    DPRINT("DataRunOffset: %x\n", *DataRunOffset);
    DPRINT("DataRunLength: %x\n", *DataRunLength);
 
    return DataRun;
}

Referenced by ConvertDataRunsToLargeMCB(), FindRun(), GetLastClusterInDataRun(), NtfsDumpDataRuns(), NtfsMapAttributeRuns(), and PrepareAttributeContext().

FindCloseAttribute()

VOID FindCloseAttribute

(

PFIND_ATTR_CONTXT

Context

)

Definition at line 1495 of file attrib.c.

{
    if (Context->NonResidentStart != NULL)
    {
        ExFreePoolWithTag(Context->NonResidentStart, TAG_NTFS);
        Context->NonResidentStart = NULL;
    }
}

Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().

FindFirstAttribute()

NTSTATUS FindFirstAttribute	(	PFIND_ATTR_CONTXT	Context,
		PDEVICE_EXTENSION	Vcb,
		PFILE_RECORD_HEADER	FileRecord,
		BOOLEAN	OnlyResident,
		PNTFS_ATTR_RECORD *	Attribute
	)

Definition at line 1413 of file attrib.c.

{
    NTSTATUS Status;
 
    DPRINT("FindFistAttribute(%p, %p, %p, %p, %u, %p)\n", Context, Vcb, FileRecord, OnlyResident, Attribute);
 
    Context->Vcb = Vcb;
    Context->OnlyResident = OnlyResident;
    Context->FirstAttr = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->AttributeOffset);
    Context->CurrAttr = Context->FirstAttr;
    Context->LastAttr = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->BytesInUse);
    Context->NonResidentStart = NULL;
    Context->NonResidentEnd = NULL;
    Context->Offset = FileRecord->AttributeOffset;
 
    if (Context->FirstAttr->Type == AttributeEnd)
    {
        Context->CurrAttr = (PVOID)-1;
        return STATUS_END_OF_FILE;
    }
    else if (Context->FirstAttr->Type == AttributeAttributeList)
    {
        Status = InternalReadNonResidentAttributes(Context);
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
 
        *Attribute = InternalGetNextAttribute(Context);
        if (*Attribute == NULL)
        {
            return STATUS_END_OF_FILE;
        }
    }
    else
    {
        *Attribute = Context->CurrAttr;
        Context->Offset = (UCHAR*)Context->CurrAttr - (UCHAR*)FileRecord;
    }
 
    return STATUS_SUCCESS;
}

Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().

FindFirstAttributeListItem()

NTSTATUS FindFirstAttributeListItem	(	PFIND_ATTR_CONTXT	Context,
		PNTFS_ATTRIBUTE_LIST_ITEM *	Item
	)

Definition at line 1337 of file attrib.c.

{
    if (Context->NonResidentStart == NULL || Context->NonResidentStart->Type == AttributeEnd)
    {
        return STATUS_UNSUCCESSFUL;
    }
 
    Context->NonResidentCur = Context->NonResidentStart;
    *Item = Context->NonResidentCur;
    return STATUS_SUCCESS;
}

Referenced by FindAttribute().

FindNextAttribute()

NTSTATUS FindNextAttribute	(	PFIND_ATTR_CONTXT	Context,
		PNTFS_ATTR_RECORD *	Attribute
	)

Definition at line 1461 of file attrib.c.

{
    NTSTATUS Status;
 
    DPRINT("FindNextAttribute(%p, %p)\n", Context, Attribute);
 
    *Attribute = InternalGetNextAttribute(Context);
    if (*Attribute == NULL)
    {
        return STATUS_END_OF_FILE;
    }
 
    if (Context->CurrAttr->Type != AttributeAttributeList)
    {
        return STATUS_SUCCESS;
    }
 
    Status = InternalReadNonResidentAttributes(Context);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    *Attribute = InternalGetNextAttribute(Context);
    if (*Attribute == NULL)
    {
        return STATUS_END_OF_FILE;
    }
 
    return STATUS_SUCCESS;
}

Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().

FindNextAttributeListItem()

NTSTATUS FindNextAttributeListItem	(	PFIND_ATTR_CONTXT	Context,
		PNTFS_ATTRIBUTE_LIST_ITEM *	Item
	)

Definition at line 1351 of file attrib.c.

{
    *Item = InternalGetNextAttributeListItem(Context);
    if (*Item == NULL)
    {
        return STATUS_UNSUCCESSFUL;
    }
    return STATUS_SUCCESS;
}

Referenced by FindAttribute().

FindRun()

BOOLEAN FindRun	(	PNTFS_ATTR_RECORD	NresAttr,
		ULONGLONG	vcn,
		PULONGLONG	lcn,
		PULONGLONG	count
	)

Definition at line 1054 of file attrib.c.

{
    if (vcn < NresAttr->NonResident.LowestVCN || vcn > NresAttr->NonResident.HighestVCN)
        return FALSE;
 
    DecodeRun((PUCHAR)((ULONG_PTR)NresAttr + NresAttr->NonResident.MappingPairsOffset), (PLONGLONG)lcn, count);
 
    return TRUE;
}

Referenced by NtfsDumpAttribute().

FreeClusters()

NTSTATUS FreeClusters	(	PNTFS_VCB	Vcb,
		PNTFS_ATTR_CONTEXT	AttrContext,
		ULONG	AttrOffset,
		PFILE_RECORD_HEADER	FileRecord,
		ULONG	ClustersToFree
	)

Definition at line 1101 of file attrib.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG ClustersLeftToFree = ClustersToFree;
 
    PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
    ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
    PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
 
    PUCHAR RunBuffer;
    ULONG RunBufferSize = 0;
 
    ULONG LowestFreed = MAXULONG;
    ULONG HighestFreed = 0;
    ULONG Freed = 0;
 
    if (!AttrContext->pRecord->IsNonResident)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Same lock NtfsAllocateClusters() holds over the bitmap copy */
    KeEnterCriticalRegion();
    ExAcquireResourceExclusiveLite(&Vcb->BitmapResource, TRUE);
 
    // free clusters in $BITMAP file
    while (ClustersLeftToFree > 0)
    {
        ULONGLONG LastVcn = AttrContext->pRecord->NonResident.HighestVCN;
        LONGLONG LargeLbn;
 
        /* An empty stream has HighestVCN -1 */
        if (LastVcn == (ULONGLONG)-1)
        {
            Status = STATUS_INVALID_PARAMETER;
            DPRINT1("DRIVER ERROR: FreeClusters called to free %lu clusters, which is %lu more clusters than are assigned to attribute!",
                    ClustersToFree,
                    ClustersLeftToFree);
            break;
        }
 
        /* The last VCN of a sparse stream can sit in a hole, which owns no cluster */
        if (FsRtlLookupLargeMcbEntry(&AttrContext->DataRunsMCB, LastVcn, &LargeLbn, NULL, NULL, NULL, NULL) &&
            LargeLbn != -1)
        {
            // deallocate this cluster
            RtlClearBits(&Vcb->ClusterBitmap, (ULONG)LargeLbn, 1);
            LowestFreed = min(LowestFreed, (ULONG)LargeLbn);
            HighestFreed = max(HighestFreed, (ULONG)LargeLbn);
            Freed++;
        }
        FsRtlTruncateLargeMcb(&AttrContext->DataRunsMCB, LastVcn);
 
        /* Freeing the last cluster leaves the -1 of an empty stream */
        AttrContext->pRecord->NonResident.HighestVCN = LastVcn - 1;
        ClustersLeftToFree--;
    }
 
    if (AttrContext->pRecord->Flags & (NTFS_ATTR_COMPRESSION_MASK | NTFS_ATTR_SPARSE))
        AttrContext->pRecord->NonResident.CompressedSize -= (ULONGLONG)Freed * Vcb->NtfsInfo.BytesPerCluster;
 
    if (Freed != 0)
    {
        NTSTATUS WriteStatus;
 
        Vcb->FreeClusterCount += Freed;
 
        // update $BITMAP file on disk
        WriteStatus = NtfsWriteVolumeBitmap(Vcb, LowestFreed, HighestFreed - LowestFreed + 1);
        if (NT_SUCCESS(Status))
            Status = WriteStatus;
    }
 
    ExReleaseResourceLite(&Vcb->BitmapResource);
    KeLeaveCriticalRegion();
 
    if (!NT_SUCCESS(Status))
        return Status;
 
    // Save updated data runs to file record
 
    // Allocate some memory for a new RunBuffer
    RunBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
    if (!RunBuffer)
    {
        DPRINT1("ERROR: Couldn't allocate memory for data runs!\n");
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    // Convert the map control block back to encoded data runs.
    // RunBuffer is one file record long (not one cluster) - see AddRun().
    ConvertLargeMCBToDataRuns(&AttrContext->DataRunsMCB,
                              AttrContext->pRecord->NonResident.HighestVCN + 1,
                              RunBuffer,
                              Vcb->NtfsInfo.BytesPerFileRecord,
                              &RunBufferSize);
 
    // Update HighestVCN
    DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
 
    /* Only these headers have the field; in others its offset is the name or the runs */
    if (AttrContext->pRecord->Flags & (NTFS_ATTR_COMPRESSION_MASK | NTFS_ATTR_SPARSE))
        DestinationAttribute->NonResident.CompressedSize = AttrContext->pRecord->NonResident.CompressedSize;
 
    // Write data runs to destination attribute
    RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
                  RunBuffer,
                  RunBufferSize);
 
    // Is DestinationAttribute the last attribute in the file record?
    if (NextAttribute->Type == AttributeEnd)
    {
        // update attribute length
        DestinationAttribute->Length = ALIGN_UP_BY(AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize,
                                                 ATTR_RECORD_ALIGNMENT);
 
        ASSERT(DestinationAttribute->Length <= AttrContext->pRecord->Length);
 
        AttrContext->pRecord->Length = DestinationAttribute->Length;
 
        // write end markers
        NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)DestinationAttribute + DestinationAttribute->Length);
        SetFileRecordEnd(FileRecord, NextAttribute, FILE_RECORD_END);
    }
 
    // Update the file record
    Status = UpdateFileRecord(Vcb, AttrContext->FileMFTIndex, FileRecord);
 
    ExFreePoolWithTag(RunBuffer, TAG_NTFS);
 
#if NTFS_DUMP_DATA_RUNS
    NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
#endif
 
    return Status;
}

Referenced by FatExamineFatEntries(), GetDiskFreeSpaceW(), HandleNotify(), NtfsDeleteFileRecord(), NtfsGetFreeClusters(), NtfsResizeAllocation(), NtfsTrimAllocation(), and SetNonResidentAttributeDataLength().

GetBestFileNameFromRecord()

PFILENAME_ATTRIBUTE GetBestFileNameFromRecord	(	PDEVICE_EXTENSION	Vcb,
		PFILE_RECORD_HEADER	FileRecord
	)

Definition at line 2015 of file attrib.c.

{
    PFILENAME_ATTRIBUTE FileName;
 
    FileName = GetFileNameFromRecord(Vcb, FileRecord, NTFS_FILE_NAME_POSIX);
    if (FileName == NULL)
    {
        FileName = GetFileNameFromRecord(Vcb, FileRecord, NTFS_FILE_NAME_WIN32);
        if (FileName == NULL)
        {
            FileName = GetFileNameFromRecord(Vcb, FileRecord, NTFS_FILE_NAME_DOS);
        }
    }
 
    return FileName;
}

Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsGetNamesInformation(), NtfsGetParentMftIndex(), NtfsMakeFCBFromDirEntry(), NtfsMoonWalkID(), NtfsSetEndOfFile(), and NtfsUpdateDuplicatedInformation().

GetFileNameAttributeLength()

ULONG GetFileNameAttributeLength

(

PFILENAME_ATTRIBUTE

FileNameAttribute

)

Definition at line 2008 of file attrib.c.

{
    ULONG Length = FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + (FileNameAttribute->NameLength * sizeof(WCHAR));
    return Length;
}

Referenced by CreateBTreeKeyFromFilename(), and ReplaceKeyIndexEntry().

GetFileNameFromRecord()

PFILENAME_ATTRIBUTE GetFileNameFromRecord	(	PDEVICE_EXTENSION	Vcb,
		PFILE_RECORD_HEADER	FileRecord,
		UCHAR	NameType
	)

Definition at line 1839 of file attrib.c.

{
    FIND_ATTR_CONTXT Context;
    PNTFS_ATTR_RECORD Attribute;
    PFILENAME_ATTRIBUTE Name;
    NTSTATUS Status;
 
    Status = FindFirstAttribute(&Context, Vcb, FileRecord, FALSE, &Attribute);
    while (NT_SUCCESS(Status))
    {
        if (Attribute->Type == AttributeFileName)
        {
            Name = (PFILENAME_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
            if (Name->NameType == NameType ||
                (Name->NameType == NTFS_FILE_NAME_WIN32_AND_DOS && NameType == NTFS_FILE_NAME_WIN32) ||
                (Name->NameType == NTFS_FILE_NAME_WIN32_AND_DOS && NameType == NTFS_FILE_NAME_DOS))
            {
                FindCloseAttribute(&Context);
                return Name;
            }
        }
 
        Status = FindNextAttribute(&Context, &Attribute);
    }
 
    FindCloseAttribute(&Context);
    return NULL;
}

Referenced by GetBestFileNameFromRecord(), NtfsGetBothDirectoryInformation(), and NtfsMakeRootFCB().

GetLastClusterInDataRun()

NTSTATUS GetLastClusterInDataRun	(	PDEVICE_EXTENSION	Vcb,
		PNTFS_ATTR_RECORD	Attribute,
		PULONGLONG	LastCluster
	)

Definition at line 1938 of file attrib.c.

{
    LONGLONG DataRunOffset;
    ULONGLONG DataRunLength;
    LONGLONG DataRunStartLCN;
 
    ULONGLONG LastLCN = 0;
    PUCHAR DataRun = (PUCHAR)Attribute + Attribute->NonResident.MappingPairsOffset;
 
    if (!Attribute->IsNonResident)
        return STATUS_INVALID_PARAMETER;
 
    while (1)
    {
        DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 
        if (DataRunOffset != -1)
        {
            // Normal data run.
            DataRunStartLCN = LastLCN + DataRunOffset;
            LastLCN = DataRunStartLCN;
            *LastCluster = LastLCN + DataRunLength - 1;
        }
 
        if (*DataRun == 0)
            break;
    }
 
    return STATUS_SUCCESS;
}

GetPackedByteCount()

UCHAR GetPackedByteCount	(	LONGLONG	NumberToPack,
		BOOLEAN	IsSigned
	)

GetPackedByteCount Returns the minimum number of bytes needed to represent the value of a 64-bit number. Used to encode data runs.

Definition at line 1876 of file attrib.c.

{
    if (!IsSigned)
    {
        if (NumberToPack >= 0x0100000000000000)
            return 8;
        if (NumberToPack >= 0x0001000000000000)
            return 7;
        if (NumberToPack >= 0x0000010000000000)
            return 6;
        if (NumberToPack >= 0x0000000100000000)
            return 5;
        if (NumberToPack >= 0x0000000001000000)
            return 4;
        if (NumberToPack >= 0x0000000000010000)
            return 3;
        if (NumberToPack >= 0x0000000000000100)
            return 2;
        return 1;
    }
 
    if (NumberToPack > 0)
    {
        // we have to make sure the number that gets encoded won't be interpreted as negative
        if (NumberToPack >= 0x0080000000000000)
            return 8;
        if (NumberToPack >= 0x0000800000000000)
            return 7;
        if (NumberToPack >= 0x0000008000000000)
            return 6;
        if (NumberToPack >= 0x0000000080000000)
            return 5;
        if (NumberToPack >= 0x0000000000800000)
            return 4;
        if (NumberToPack >= 0x0000000000008000)
            return 3;
        if (NumberToPack >= 0x0000000000000080)
            return 2;
    }
    else
    {
        // negative number
        if (NumberToPack <= 0xff80000000000000)
            return 8;
        if (NumberToPack <= 0xffff800000000000)
            return 7;
        if (NumberToPack <= 0xffffff8000000000)
            return 6;
        if (NumberToPack <= 0xffffffff80000000)
            return 5;
        if (NumberToPack <= 0xffffffffff800000)
            return 4;
        if (NumberToPack <= 0xffffffffffff8000)
            return 3;
        if (NumberToPack <= 0xffffffffffffff80)
            return 2;
    }
    return 1;
}

Referenced by ConvertLargeMCBToDataRuns().

GetStandardInformationFromRecord()

PSTANDARD_INFORMATION GetStandardInformationFromRecord	(	PDEVICE_EXTENSION	Vcb,
		PFILE_RECORD_HEADER	FileRecord
	)

Definition at line 1970 of file attrib.c.

{
    NTSTATUS Status;
    FIND_ATTR_CONTXT Context;
    PNTFS_ATTR_RECORD Attribute;
    PSTANDARD_INFORMATION StdInfo;
 
    Status = FindFirstAttribute(&Context, Vcb, FileRecord, FALSE, &Attribute);
    while (NT_SUCCESS(Status))
    {
        if (Attribute->Type == AttributeStandardInformation)
        {
            StdInfo = (PSTANDARD_INFORMATION)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
            FindCloseAttribute(&Context);
            return StdInfo;
        }
 
        Status = FindNextAttribute(&Context, &Attribute);
    }
 
    FindCloseAttribute(&Context);
    return NULL;
}

Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsMakeFCBFromDirEntry(), NtfsSetBasicInformation(), and NtfsUpdateDuplicatedInformation().

InternalGetNextAttribute()

static PNTFS_ATTR_RECORD InternalGetNextAttribute ( PFIND_ATTR_CONTXT  Context )

static

Definition at line 1364 of file attrib.c.

{
    PNTFS_ATTR_RECORD NextAttribute;
 
    if (Context->CurrAttr == (PVOID)-1)
    {
        return NULL;
    }
 
    if (Context->CurrAttr >= Context->FirstAttr &&
        Context->CurrAttr < Context->LastAttr)
    {
        if (Context->CurrAttr->Length == 0)
        {
            DPRINT1("Broken length!\n");
            Context->CurrAttr = (PVOID)-1;
            return NULL;
        }
 
        NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Context->CurrAttr + Context->CurrAttr->Length);
 
        if (NextAttribute > Context->LastAttr || NextAttribute < Context->FirstAttr)
        {
            DPRINT1("Broken length: 0x%lx!\n", Context->CurrAttr->Length);
            Context->CurrAttr = (PVOID)-1;
            return NULL;
        }
 
        Context->Offset += ((ULONG_PTR)NextAttribute - (ULONG_PTR)Context->CurrAttr);
        Context->CurrAttr = NextAttribute;
 
        if (Context->CurrAttr < Context->LastAttr &&
            Context->CurrAttr->Type != AttributeEnd)
        {
            return Context->CurrAttr;
        }
    }
 
    if (Context->NonResidentStart == NULL)
    {
        Context->CurrAttr = (PVOID)-1;
        return NULL;
    }
 
    Context->CurrAttr = (PVOID)-1;
    return NULL;
}

Referenced by FindFirstAttribute(), and FindNextAttribute().

InternalGetNextAttributeListItem()

static PNTFS_ATTRIBUTE_LIST_ITEM InternalGetNextAttributeListItem ( PFIND_ATTR_CONTXT  Context )

static

Definition at line 1297 of file attrib.c.

{
    PNTFS_ATTRIBUTE_LIST_ITEM NextItem;
 
    if (Context->NonResidentCur == (PVOID)-1)
    {
        return NULL;
    }
 
    if (Context->NonResidentCur == NULL || Context->NonResidentCur->Type == AttributeEnd)
    {
        Context->NonResidentCur = (PVOID)-1;
        return NULL;
    }
 
    if (Context->NonResidentCur->Length == 0)
    {
        DPRINT1("Broken length list entry length !");
        Context->NonResidentCur = (PVOID)-1;
        return NULL;
    }
 
    NextItem = (PNTFS_ATTRIBUTE_LIST_ITEM)((PCHAR)Context->NonResidentCur + Context->NonResidentCur->Length);
    if (NextItem->Length == 0 || NextItem->Type == AttributeEnd)
    {
        Context->NonResidentCur = (PVOID)-1;
        return NULL;
    }
 
    if (NextItem < Context->NonResidentStart || NextItem > Context->NonResidentEnd)
    {
        Context->NonResidentCur = (PVOID)-1;
        return NULL;
    }
 
    Context->NonResidentCur = NextItem;
    return NextItem;
}

Referenced by FindNextAttributeListItem().

InternalReadNonResidentAttributes()

static NTSTATUS InternalReadNonResidentAttributes ( PFIND_ATTR_CONTXT  Context )

static

Definition at line 1244 of file attrib.c.

{
    ULONGLONG ListSize;
    PNTFS_ATTR_RECORD Attribute;
    PNTFS_ATTR_CONTEXT ListContext;
 
    DPRINT("InternalReadNonResidentAttributes(%p)\n", Context);
 
    Attribute = Context->CurrAttr;
    ASSERT(Attribute->Type == AttributeAttributeList);
 
    if (Context->OnlyResident)
    {
        Context->NonResidentStart = NULL;
        Context->NonResidentEnd = NULL;
        return STATUS_SUCCESS;
    }
 
    if (Context->NonResidentStart != NULL)
    {
        return STATUS_FILE_CORRUPT_ERROR;
    }
 
    ListContext = PrepareAttributeContext(Attribute);
    ListSize = AttributeDataLength(ListContext->pRecord);
    if (ListSize > 0xFFFFFFFF)
    {
        ReleaseAttributeContext(ListContext);
        return STATUS_BUFFER_OVERFLOW;
    }
 
    Context->NonResidentStart = ExAllocatePoolWithTag(NonPagedPool, (ULONG)ListSize, TAG_NTFS);
    if (Context->NonResidentStart == NULL)
    {
        ReleaseAttributeContext(ListContext);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    if (ReadAttribute(Context->Vcb, ListContext, 0, (PCHAR)Context->NonResidentStart, (ULONG)ListSize) != ListSize)
    {
        ExFreePoolWithTag(Context->NonResidentStart, TAG_NTFS);
        Context->NonResidentStart = NULL;
        ReleaseAttributeContext(ListContext);
        return STATUS_FILE_CORRUPT_ERROR;
    }
 
    ReleaseAttributeContext(ListContext);
    Context->NonResidentEnd = (PNTFS_ATTRIBUTE_LIST_ITEM)((PCHAR)Context->NonResidentStart + ListSize);
    return STATUS_SUCCESS;
}

Referenced by FindFirstAttribute(), and FindNextAttribute().

NtfsDumpAttribute()

static VOID NtfsDumpAttribute ( PDEVICE_EXTENSION  Vcb, PNTFS_ATTR_RECORD  Attribute  )

static

Definition at line 1647 of file attrib.c.

{
    UNICODE_STRING Name;
 
    ULONGLONG lcn = 0;
    ULONGLONG runcount = 0;
 
    switch (Attribute->Type)
    {
        case AttributeFileName:
            NtfsDumpFileNameAttribute(Attribute);
            break;
 
        case AttributeStandardInformation:
            NtfsDumpStandardInformationAttribute(Attribute);
            break;
 
        case AttributeObjectId:
            DbgPrint("  $OBJECT_ID ");
            break;
 
        case AttributeSecurityDescriptor:
            DbgPrint("  $SECURITY_DESCRIPTOR ");
            break;
 
        case AttributeVolumeName:
            NtfsDumpVolumeNameAttribute(Attribute);
            break;
 
        case AttributeVolumeInformation:
            NtfsDumpVolumeInformationAttribute(Attribute);
            break;
 
        case AttributeData:
            DbgPrint("  $DATA ");
            //DataBuf = ExAllocatePool(NonPagedPool,AttributeLengthAllocated(Attribute));
            break;
 
        case AttributeIndexRoot:
            NtfsDumpIndexRootAttribute(Attribute);
            break;
 
        case AttributeIndexAllocation:
            DbgPrint("  $INDEX_ALLOCATION ");
            break;
 
        case AttributeBitmap:
            DbgPrint("  $BITMAP ");
            break;
 
        case AttributeReparsePoint:
            DbgPrint("  $REPARSE_POINT ");
            break;
 
        case AttributeEAInformation:
            DbgPrint("  $EA_INFORMATION ");
            break;
 
        case AttributeEA:
            DbgPrint("  $EA ");
            break;
 
        case AttributePropertySet:
            DbgPrint("  $PROPERTY_SET ");
            break;
 
        case AttributeLoggedUtilityStream:
            DbgPrint("  $LOGGED_UTILITY_STREAM ");
            break;
 
        default:
            DbgPrint("  Attribute %lx ",
                     Attribute->Type);
            break;
    }
 
    if (Attribute->Type != AttributeAttributeList)
    {
        if (Attribute->NameLength != 0)
        {
            Name.Length = Attribute->NameLength * sizeof(WCHAR);
            Name.MaximumLength = Name.Length;
            Name.Buffer = (PWCHAR)((ULONG_PTR)Attribute + Attribute->NameOffset);
 
            DbgPrint("'%wZ' ", &Name);
        }
 
        DbgPrint("(%s)\n",
                 Attribute->IsNonResident ? "non-resident" : "resident");
 
        if (Attribute->IsNonResident)
        {
            FindRun(Attribute,0,&lcn, &runcount);
 
            DbgPrint("  AllocatedSize %I64u  DataSize %I64u InitilizedSize %I64u\n",
                     Attribute->NonResident.AllocatedSize, Attribute->NonResident.DataSize, Attribute->NonResident.InitializedSize);
            DbgPrint("  logical clusters: %I64u - %I64u\n",
                     lcn, lcn + runcount - 1);
        }
        else
            DbgPrint("    %u bytes of data\n", Attribute->Resident.ValueLength);
    }
}

Referenced by NtfsDumpFileAttributes().

NtfsDumpDataRunData()

VOID NtfsDumpDataRunData

(

PUCHAR

DataRun

)

Definition at line 1753 of file attrib.c.

{
    UCHAR DataRunOffsetSize;
    UCHAR DataRunLengthSize;
    CHAR i;
 
    DbgPrint("%02x ", *DataRun);
 
    if (*DataRun == 0)
        return;
 
    DataRunOffsetSize = (*DataRun >> 4) & 0xF;
    DataRunLengthSize = *DataRun & 0xF;
 
    DataRun++;
    for (i = 0; i < DataRunLengthSize; i++)
    {
        DbgPrint("%02x ", *DataRun);
        DataRun++;
    }
 
    for (i = 0; i < DataRunOffsetSize; i++)
    {
        DbgPrint("%02x ", *DataRun);
        DataRun++;
    }
 
    NtfsDumpDataRunData(DataRun);
}

Referenced by NtfsDumpDataRunData(), and NtfsDumpDataRuns().

NtfsDumpDataRuns()

VOID NtfsDumpDataRuns	(	PVOID	StartOfRun,
		ULONGLONG	CurrentLCN
	)

Definition at line 1785 of file attrib.c.

{
    PUCHAR DataRun = StartOfRun;
    LONGLONG DataRunOffset;
    ULONGLONG DataRunLength;
 
    if (CurrentLCN == 0)
    {
        DPRINT("Dumping data runs.\n\tData:\n\t\t");
        NtfsDumpDataRunData(StartOfRun);
        DbgPrint("\n\tRuns:\n\t\tOff\t\tLCN\t\tLength\n");
    }
 
    DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 
    if (DataRunOffset != -1)
        CurrentLCN += DataRunOffset;
 
    DbgPrint("\t\t%I64d\t", DataRunOffset);
    if (DataRunOffset < 99999)
        DbgPrint("\t");
    DbgPrint("%I64u\t", CurrentLCN);
    if (CurrentLCN < 99999)
        DbgPrint("\t");
    DbgPrint("%I64u\n", DataRunLength);
 
    if (*DataRun == 0)
        DbgPrint("\t\t00\n");
    else
        NtfsDumpDataRuns(DataRun, CurrentLCN);
}

Referenced by AddRun(), FreeClusters(), and NtfsDumpDataRuns().

NtfsDumpFileAttributes()

VOID NtfsDumpFileAttributes	(	PDEVICE_EXTENSION	Vcb,
		PFILE_RECORD_HEADER	FileRecord
	)

Definition at line 1820 of file attrib.c.

{
    NTSTATUS Status;
    FIND_ATTR_CONTXT Context;
    PNTFS_ATTR_RECORD Attribute;
 
    Status = FindFirstAttribute(&Context, Vcb, FileRecord, FALSE, &Attribute);
    while (NT_SUCCESS(Status))
    {
        NtfsDumpAttribute(Vcb, Attribute);
 
        Status = FindNextAttribute(&Context, &Attribute);
    }
 
    FindCloseAttribute(&Context);
}

Referenced by IncreaseMftSize(), NtfsDumpFileRecord(), NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsGetNamesInformation(), and NtfsGetVolumeData().

NtfsDumpFileNameAttribute()

static VOID NtfsDumpFileNameAttribute ( PNTFS_ATTR_RECORD  Attribute )

static

Definition at line 1506 of file attrib.c.

{
    PFILENAME_ATTRIBUTE FileNameAttr;
 
    DbgPrint("  $FILE_NAME ");
 
//    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 
    FileNameAttr = (PFILENAME_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
    DbgPrint(" (%x) '%.*S' ", FileNameAttr->NameType, FileNameAttr->NameLength, FileNameAttr->Name);
    DbgPrint(" '%x' \n", FileNameAttr->FileAttributes);
    DbgPrint(" AllocatedSize: %I64u\nDataSize: %I64u\n", FileNameAttr->AllocatedSize, FileNameAttr->DataSize);
    DbgPrint(" File reference: 0x%016I64x\n", FileNameAttr->DirectoryFileReferenceNumber);
}

Referenced by NtfsDumpAttribute().

NtfsDumpIndexRootAttribute()

static VOID NtfsDumpIndexRootAttribute ( PNTFS_ATTR_RECORD  Attribute )

static

Definition at line 1572 of file attrib.c.

{
    PINDEX_ROOT_ATTRIBUTE IndexRootAttr;
    ULONG CurrentOffset;
    ULONG CurrentNode;
 
    IndexRootAttr = (PINDEX_ROOT_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
 
    if (IndexRootAttr->AttributeType == AttributeFileName)
        ASSERT(IndexRootAttr->CollationRule == COLLATION_FILE_NAME);
 
    DbgPrint("  $INDEX_ROOT (%u bytes per index record, %u clusters) ", IndexRootAttr->SizeOfEntry, IndexRootAttr->ClustersPerIndexRecord);
 
    if (IndexRootAttr->Header.Flags == INDEX_ROOT_SMALL)
    {
        DbgPrint(" (small)\n");
    }
    else
    {
        ASSERT(IndexRootAttr->Header.Flags == INDEX_ROOT_LARGE);
        DbgPrint(" (large)\n");
    }
 
    DbgPrint("   Offset to first index: 0x%lx\n   Total size of index entries: 0x%lx\n   Allocated size of node: 0x%lx\n",
             IndexRootAttr->Header.FirstEntryOffset,
             IndexRootAttr->Header.TotalSizeOfEntries,
             IndexRootAttr->Header.AllocatedSize);
    CurrentOffset = IndexRootAttr->Header.FirstEntryOffset;
    CurrentNode = 0;
    // print details of every node in the index
    while (CurrentOffset < IndexRootAttr->Header.TotalSizeOfEntries)
    {
        PINDEX_ENTRY_ATTRIBUTE currentIndexExtry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexRootAttr + 0x10 + CurrentOffset);
        DbgPrint("   Index Node Entry %lu", CurrentNode++);
        if (BooleanFlagOn(currentIndexExtry->Flags, NTFS_INDEX_ENTRY_NODE))
            DbgPrint(" (Branch)");
        else
            DbgPrint(" (Leaf)");
        if (BooleanFlagOn(currentIndexExtry->Flags, NTFS_INDEX_ENTRY_END))
        {
            DbgPrint(" (Dummy Key)");
        }
        DbgPrint("\n    File Reference: 0x%016I64x\n", currentIndexExtry->Data.Directory.IndexedFile);
        DbgPrint("    Index Entry Length: 0x%x\n", currentIndexExtry->Length);
        DbgPrint("    Index Key Length: 0x%x\n", currentIndexExtry->KeyLength);
 
        // if this isn't the final (dummy) node, print info about the key (Filename attribute)
        if (!(currentIndexExtry->Flags & NTFS_INDEX_ENTRY_END))
        {
            UNICODE_STRING Name;
            DbgPrint("     Parent File Reference: 0x%016I64x\n", currentIndexExtry->FileName.DirectoryFileReferenceNumber);
            DbgPrint("     $FILENAME indexed: ");
            Name.Length = currentIndexExtry->FileName.NameLength * sizeof(WCHAR);
            Name.MaximumLength = Name.Length;
            Name.Buffer = currentIndexExtry->FileName.Name;
            DbgPrint("'%wZ'\n", &Name);
        }
 
        // if this node has a sub-node beneath it
        if (currentIndexExtry->Flags & NTFS_INDEX_ENTRY_NODE)
        {
            // Print the VCN of the sub-node
            PULONGLONG SubNodeVCN = (PULONGLONG)((ULONG_PTR)currentIndexExtry + currentIndexExtry->Length - sizeof(ULONGLONG));
            DbgPrint("    VCN of sub-node: 0x%llx\n", *SubNodeVCN);
        }
 
        CurrentOffset += currentIndexExtry->Length;
        ASSERT(currentIndexExtry->Length);
    }
 
}

Referenced by NtfsDumpAttribute().

NtfsDumpStandardInformationAttribute()

static VOID NtfsDumpStandardInformationAttribute ( PNTFS_ATTR_RECORD  Attribute )

static

Definition at line 1524 of file attrib.c.

{
    PSTANDARD_INFORMATION StandardInfoAttr;
 
    DbgPrint("  $STANDARD_INFORMATION ");
 
//    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 
    StandardInfoAttr = (PSTANDARD_INFORMATION)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
    DbgPrint(" '%x' ", StandardInfoAttr->FileAttribute);
}

Referenced by NtfsDumpAttribute().

NtfsDumpVolumeInformationAttribute()

static VOID NtfsDumpVolumeInformationAttribute ( PNTFS_ATTR_RECORD  Attribute )

static

Definition at line 1554 of file attrib.c.

{
    PVOLINFO_ATTRIBUTE VolInfoAttr;
 
    DbgPrint("  $VOLUME_INFORMATION ");
 
//    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 
    VolInfoAttr = (PVOLINFO_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
    DbgPrint(" NTFS Version %u.%u  Flags 0x%04hx ",
             VolInfoAttr->MajorVersion,
             VolInfoAttr->MinorVersion,
             VolInfoAttr->Flags);
}

Referenced by NtfsDumpAttribute().

NtfsDumpVolumeNameAttribute()

static VOID NtfsDumpVolumeNameAttribute ( PNTFS_ATTR_RECORD  Attribute )

static

Definition at line 1539 of file attrib.c.

{
    PWCHAR VolumeName;
 
    DbgPrint("  $VOLUME_NAME ");
 
//    DbgPrint(" Length %lu  Offset %hu ", Attribute->Resident.ValueLength, Attribute->Resident.ValueOffset);
 
    VolumeName = (PWCHAR)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
    DbgPrint(" '%.*S' ", Attribute->Resident.ValueLength / sizeof(WCHAR), VolumeName);
}

Referenced by NtfsDumpAttribute().