#include <ntifs.h>#include <pseh/pseh2.h>#include <section_attribs.h>#include <pshpack1.h>#include <poppack.h>
Include dependency graph for ntfs.h:
This graph shows which files directly or indirectly include this file:
Go to the source code of this file.
Classes | |
| struct | _BIOS_PARAMETERS_BLOCK |
| struct | _EXTENDED_BIOS_PARAMETERS_BLOCK |
| struct | _BOOT_SECTOR |
| struct | _NTFS_INFO |
| struct | NTFSIDENTIFIER |
| struct | DEVICE_EXTENSION |
| struct | NTFS_CCB |
| struct | NTFS_GLOBAL_DATA |
| struct | NTFS_RECORD_HEADER |
| struct | _FILE_RECORD_HEADER |
| struct | NTFS_ATTR_RECORD |
| struct | NTFS_ATTRIBUTE_LIST_ITEM |
| struct | STANDARD_INFORMATION |
| struct | ATTRIBUTE_LIST |
| struct | FILENAME_ATTRIBUTE |
| struct | INDEX_HEADER_ATTRIBUTE |
| struct | INDEX_ROOT_ATTRIBUTE |
| struct | INDEX_BUFFER |
| struct | INDEX_ENTRY_ATTRIBUTE |
| struct | _B_TREE_KEY |
| struct | _B_TREE_FILENAME_NODE |
| struct | B_TREE |
| struct | VOLINFO_ATTRIBUTE |
| struct | REPARSE_POINT_ATTRIBUTE |
| struct | _NTFS_IO_RUN |
| struct | _NTFS_IO_RUN_LIST |
| struct | _NTFS_IO_CONTEXT |
| struct | NTFS_IRP_CONTEXT |
| struct | _NTFS_ATTR_CONTEXT |
| struct | _FCB |
| struct | _FIND_ATTR_CONTXT |
| struct | FIXUP_ARRAY |
| struct | _NTFS_FILENAME_UPDATE |
Variables | |
| PNTFS_GLOBAL_DATA | NtfsGlobalData |
| DRIVER_DISPATCH | NtfsFsdDispatch |
| FAST_IO_CHECK_IF_POSSIBLE | NtfsFastIoCheckIfPossible |
| FAST_IO_READ | NtfsFastIoRead |
| FAST_IO_WRITE | NtfsFastIoWrite |
| DRIVER_INITIALIZE | DriverEntry |
Macro Definition Documentation
◆ ATTR_RECORD_ALIGNMENT
◆ CACHEPAGESIZE
| #define CACHEPAGESIZE | ( | pDeviceExt | ) |
◆ CCB_RETURNED_DOT
◆ CCB_RETURNED_DOTDOT
◆ COLLATION_BINARY
◆ COLLATION_FILE_NAME
◆ COLLATION_NTOFS_SECURITY_HASH
◆ COLLATION_NTOFS_SID
◆ COLLATION_NTOFS_ULONG
◆ COLLATION_NTOFS_ULONGS
◆ COLLATION_UNICODE_STRING
◆ DATA_RUN_ALIGNMENT
◆ DEVICE_NAME
◆ FCB_CACHE_INITIALIZED
◆ FCB_DELETE_PENDING
◆ FCB_DELETED
◆ FCB_IS_VOLUME
◆ FCB_IS_VOLUME_STREAM
◆ FILE_RECORD_END
◆ FRH_DIRECTORY
◆ FRH_IN_USE
◆ FRH_UNKNOWN1
◆ FRH_UNKNOWN2
◆ INDEX_NODE_LARGE
◆ INDEX_NODE_SMALL
◆ INDEX_ROOT_LARGE
◆ INDEX_ROOT_SMALL
◆ IRPCONTEXT_CANWAIT
◆ IRPCONTEXT_COMPLETE
◆ IRPCONTEXT_QUEUE
◆ MAX_PATH
◆ NRH_FILE_TYPE
◆ NRH_INDX_TYPE
◆ NTFS_ATTR_COMPRESSION_MASK
◆ NTFS_ATTR_SPARSE
◆ NTFS_FILE_ATTRDEF
◆ NTFS_FILE_BADCLUS
◆ NTFS_FILE_BITMAP
◆ NTFS_FILE_BOOT
◆ NTFS_FILE_EXTEND
◆ NTFS_FILE_FIRST_USER_FILE
◆ NTFS_FILE_LOGFILE
◆ NTFS_FILE_MFT
◆ NTFS_FILE_MFTMIRR
◆ NTFS_FILE_NAME_DOS
◆ NTFS_FILE_NAME_POSIX
◆ NTFS_FILE_NAME_WIN32
◆ NTFS_FILE_NAME_WIN32_AND_DOS
◆ NTFS_FILE_QUOTA
◆ NTFS_FILE_ROOT
◆ NTFS_FILE_TYPE_ARCHIVE
◆ NTFS_FILE_TYPE_COMPRESSED
◆ NTFS_FILE_TYPE_DIRECTORY
◆ NTFS_FILE_TYPE_ENCRYPTED
◆ NTFS_FILE_TYPE_HIDDEN
◆ NTFS_FILE_TYPE_OFFLINE
◆ NTFS_FILE_TYPE_READ_ONLY
◆ NTFS_FILE_TYPE_REPARSE
◆ NTFS_FILE_TYPE_SPARSE
◆ NTFS_FILE_TYPE_SYSTEM
◆ NTFS_FILE_TYPE_TEMPORARY
◆ NTFS_FILE_UPCASE
◆ NTFS_FILE_VOLUME
◆ NTFS_FILENAME_UPDATE_ATTRS
◆ NTFS_FILENAME_UPDATE_SIZES
◆ NTFS_FILENAME_UPDATE_TIMES
◆ NTFS_INDEX_ENTRY_END
◆ NTFS_INDEX_ENTRY_NODE
◆ NTFS_MAX_IO_RUNS_ON_STACK
◆ NTFS_MFT_MASK
◆ NTFS_SPARSE_LBO
◆ NTFS_TYPE_CCB
◆ NTFS_TYPE_FCB
◆ NTFS_TYPE_GLOBAL_DATA
◆ NTFS_TYPE_IRP_CONTEXT
◆ NTFS_TYPE_VCB
◆ RA_INDEXED
◆ ROUND_DOWN
◆ ROUND_UP
◆ TAG_ATT_CTXT
◆ TAG_CCB
◆ TAG_FCB
◆ TAG_FILE_REC
◆ TAG_IO_RUNS
◆ TAG_IRP_CTXT
◆ TAG_NTFS
◆ VALUE_OFFSET_ALIGNMENT
◆ VCB_VOLUME_DISMOUNTED
◆ VCB_VOLUME_LOCKED
Typedef Documentation
◆ B_TREE_FILENAME_NODE
◆ B_TREE_KEY
| typedef struct _B_TREE_KEY B_TREE_KEY |
◆ BIOS_PARAMETERS_BLOCK
◆ BOOT_SECTOR
| typedef struct _BOOT_SECTOR BOOT_SECTOR |
◆ EXTENDED_BIOS_PARAMETERS_BLOCK
◆ FILE_RECORD_HEADER
◆ FIND_ATTR_CONTXT
| typedef struct _FIND_ATTR_CONTXT FIND_ATTR_CONTXT |
◆ NTFS_ATTR_CONTEXT
◆ NTFS_FCB
◆ NTFS_FILENAME_UPDATE
◆ NTFS_INFO
| typedef struct _NTFS_INFO NTFS_INFO |
◆ NTFS_IO_CONTEXT
| typedef struct _NTFS_IO_CONTEXT NTFS_IO_CONTEXT |
◆ NTFS_IO_RUN
| typedef struct _NTFS_IO_RUN NTFS_IO_RUN |
◆ NTFS_IO_RUN_LIST
| typedef struct _NTFS_IO_RUN_LIST NTFS_IO_RUN_LIST |
◆ NTFS_VCB
| typedef struct DEVICE_EXTENSION NTFS_VCB |
◆ PATTRIBUTE_LIST
| typedef struct ATTRIBUTE_LIST * PATTRIBUTE_LIST |
◆ PATTRIBUTE_TYPE
| typedef enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE |
◆ PB_TREE
◆ PB_TREE_FILENAME_NODE
| typedef struct _B_TREE_FILENAME_NODE * PB_TREE_FILENAME_NODE |
◆ PB_TREE_KEY
| typedef struct _B_TREE_KEY * PB_TREE_KEY |
◆ PBIOS_PARAMETERS_BLOCK
◆ PBOOT_SECTOR
| typedef struct _BOOT_SECTOR * PBOOT_SECTOR |
◆ PDEVICE_EXTENSION
| typedef struct DEVICE_EXTENSION * PDEVICE_EXTENSION |
◆ PEXTENDED_BIOS_PARAMETERS_BLOCK
◆ PFILE_RECORD_HEADER
| typedef struct _FILE_RECORD_HEADER * PFILE_RECORD_HEADER |
◆ PFILENAME_ATTRIBUTE
| typedef struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE |
◆ PFIND_ATTR_CONTXT
| typedef struct _FIND_ATTR_CONTXT * PFIND_ATTR_CONTXT |
◆ PFIXUP_ARRAY
| typedef struct FIXUP_ARRAY * PFIXUP_ARRAY |
◆ PINDEX_BUFFER
| typedef struct INDEX_BUFFER * PINDEX_BUFFER |
◆ PINDEX_ENTRY_ATTRIBUTE
◆ PINDEX_HEADER_ATTRIBUTE
◆ PINDEX_ROOT_ATTRIBUTE
| typedef struct INDEX_ROOT_ATTRIBUTE * PINDEX_ROOT_ATTRIBUTE |
◆ PNTFS_ATTR_CONTEXT
| typedef struct _NTFS_ATTR_CONTEXT * PNTFS_ATTR_CONTEXT |
◆ PNTFS_ATTR_RECORD
| typedef struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD |
◆ PNTFS_ATTRIBUTE_LIST_ITEM
◆ PNTFS_CCB
◆ PNTFS_FCB
◆ PNTFS_FILENAME_UPDATE
| typedef struct _NTFS_FILENAME_UPDATE * PNTFS_FILENAME_UPDATE |
◆ PNTFS_GLOBAL_DATA
| typedef struct NTFS_GLOBAL_DATA * PNTFS_GLOBAL_DATA |
◆ PNTFS_INFO
| typedef struct _NTFS_INFO * PNTFS_INFO |
◆ PNTFS_IO_CONTEXT
| typedef struct _NTFS_IO_CONTEXT * PNTFS_IO_CONTEXT |
◆ PNTFS_IO_RUN
| typedef struct _NTFS_IO_RUN * PNTFS_IO_RUN |
◆ PNTFS_IO_RUN_LIST
| typedef struct _NTFS_IO_RUN_LIST * PNTFS_IO_RUN_LIST |
◆ PNTFS_IRP_CONTEXT
| typedef struct NTFS_IRP_CONTEXT * PNTFS_IRP_CONTEXT |
◆ PNTFS_RECORD_HEADER
| typedef struct NTFS_RECORD_HEADER * PNTFS_RECORD_HEADER |
◆ PNTFS_VCB
| typedef struct DEVICE_EXTENSION * PNTFS_VCB |
◆ PNTFSIDENTIFIER
| typedef struct NTFSIDENTIFIER * PNTFSIDENTIFIER |
◆ PREPARSE_POINT_ATTRIBUTE
◆ PSTANDARD_INFORMATION
| typedef struct STANDARD_INFORMATION * PSTANDARD_INFORMATION |
◆ PVOLINFO_ATTRIBUTE
| typedef struct VOLINFO_ATTRIBUTE * PVOLINFO_ATTRIBUTE |
Enumeration Type Documentation
◆ ATTRIBUTE_TYPE
Definition at line 186 of file ntfs.h.
187{
188 AttributeStandardInformation = 0x10,
189 AttributeAttributeList = 0x20,
190 AttributeFileName = 0x30,
191 AttributeObjectId = 0x40,
192 AttributeSecurityDescriptor = 0x50,
193 AttributeVolumeName = 0x60,
194 AttributeVolumeInformation = 0x70,
195 AttributeData = 0x80,
196 AttributeIndexRoot = 0x90,
197 AttributeIndexAllocation = 0xA0,
198 AttributeBitmap = 0xB0,
199 AttributeReparsePoint = 0xC0,
200 AttributeEAInformation = 0xD0,
201 AttributeEA = 0xE0,
202 AttributePropertySet = 0xF0,
203 AttributeLoggedUtilityStream = 0x100,
204 AttributeEnd = 0xFFFFFFFF
enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE
Function Documentation
◆ AddBitmap()
| NTSTATUS AddBitmap | ( | PNTFS_VCB | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PCWSTR | Name, | ||
| USHORT | NameLength | ||
| ) |
Definition at line 76 of file attrib.c.
81{
82 ULONG AttributeLength;
83 // Calculate the header length
86 ULONG NameOffset;
87 ULONG ValueOffset;
88 // We'll start out with 8 bytes of bitmap data
90 ULONG BytesAvailable;
91
93 {
96 }
97
98 NameOffset = ResidentHeaderLength;
99
100 // Calculate ValueOffset, which will be aligned to a 4-byte boundary
102
103 // Calculate length of attribute
104 AttributeLength = ValueOffset + ValueLength;
106
107 // Make sure the file record is large enough for the new attribute
109 if (BytesAvailable < AttributeLength)
110 {
113 }
114
115 // Set Attribute fields
116 RtlZeroMemory(AttributeAddress, AttributeLength);
117
119 AttributeAddress->Length = AttributeLength;
120 AttributeAddress->NameLength = NameLength;
121 AttributeAddress->NameOffset = NameOffset;
123
125 AttributeAddress->Resident.ValueOffset = ValueOffset;
126
127 // Set the name
128 RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
129
130 // move the attribute-end and file-record-end markers to the end of the file record
132 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
133
135}
struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD
VOID SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttrEnd, ULONG EndMarker)
Definition: mft.c:706
Definition: ntfs.h:133
struct NTFS_ATTR_RECORD::@170::@172 Resident
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
Definition: wdfregistry.h:275
Referenced by DECLARE_INTERFACE_(), CFontsDialog::InitToolbar(), and UpdateIndexAllocation().
◆ AddData()
| NTSTATUS AddData | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttributeAddress | ||
| ) |
Definition at line 164 of file attrib.c.
166{
169
171 {
174 }
175
177 AttributeAddress->Length = ResidentHeaderLength;
179 AttributeAddress->Resident.ValueLength = 0;
180 AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
181
182 // for unnamed $DATA attributes, NameOffset equals header length
183 AttributeAddress->NameOffset = ResidentHeaderLength;
185
186 // move the attribute-end and file-record-end markers to the end of the file record
188 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
189
191}
Referenced by DECLARE_INTERFACE_(), and NtfsCreateFileRecord().
◆ AddFileName()
| NTSTATUS AddFileName | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PDEVICE_EXTENSION | DeviceExt, | ||
| PFILE_OBJECT | FileObject, | ||
| BOOLEAN | CaseSensitive, | ||
| PULONGLONG | ParentMftIndex | ||
| ) |
Definition at line 234 of file attrib.c.
240{
242 PFILENAME_ATTRIBUTE FileNameAttribute;
243 LARGE_INTEGER SystemTime;
246 UNICODE_STRING Current, Remaining, FilenameNoPath;
248 ULONG FirstEntry;
249
251 {
254 }
255
258
260
261 // set timestamps
262 KeQuerySystemTime(&SystemTime);
267
268 // Is this a directory?
271 else
273
274 // we need to extract the filename from the path
276
278
280 {
282
283 FirstEntry = 0;
285 CurrentMFTIndex,
286 &Current,
287 &FirstEntry,
288 FALSE,
289 CaseSensitive,
290 &CurrentMFTIndex);
292 {
296 }
297
298 FsRtlDissectName(Remaining, &Current, &Remaining);
299 }
300
301 /* Whatever is left over is the file's own name */
302 FilenameNoPath = Current;
303
305
306 // set reference to parent directory
307 FileNameAttribute->DirectoryFileReferenceNumber = CurrentMFTIndex;
308 *ParentMftIndex = CurrentMFTIndex;
309
311
312 // The highest 2 bytes should be the sequence number, unless the parent happens to be root
315 else
317
318 DPRINT("FileNameAttribute->DirectoryFileReferenceNumber: 0x%016I64x\n", FileNameAttribute->DirectoryFileReferenceNumber);
319
322
323 // For now, we're emulating the way Windows behaves when 8.3 name generation is disabled
324 // TODO: add DOS Filename as needed
327 else
329
330 FileRecord->LinkCount++;
331
332 AttributeAddress->Length = ResidentHeaderLength +
335
336 AttributeAddress->Resident.ValueLength = FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + FilenameNoPath.Length;
337 AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
339
340 // move the attribute-end and file-record-end markers to the end of the file record
342 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
343
345}
static BOOLEAN NtfsFindMftRecord(_In_ PNTFS_VOLUME_INFO Volume, _In_ ULONGLONG MFTIndex, _In_ PCSTR FileName, _Out_ PULONGLONG OutMFTIndex, _Out_ PULONG FileAttributes)
Definition: ntfs.c:675
struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE
VOID NTAPI FsRtlDissectName(IN UNICODE_STRING Name, OUT PUNICODE_STRING FirstPart, OUT PUNICODE_STRING RemainingPart)
Definition: name.c:147
BOOLEAN NTAPI RtlIsNameLegalDOS8Dot3(_In_ PUNICODE_STRING Name, _Inout_opt_ POEM_STRING OemName, _Inout_opt_ PBOOLEAN NameContainsSpaces)
Definition: ntfs.h:390
ULONGLONG DirectoryFileReferenceNumber
Definition: ntfs.h:391
Definition: env_spec_w32.h:368
Definition: typedefs.h:103
Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ AddFixupArray()
| NTSTATUS AddFixupArray | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_RECORD_HEADER | Record | ||
| ) |
Definition at line 3575 of file mft.c.
3577{
3578 USHORT *pShortToFixUp;
3582
3584
3585 DPRINT("AddFixupArray(%p, %p)\n fixupArray->USN: %u, ArrayEntryCount: %u\n", Vcb, Record, fixupArray->USN, ArrayEntryCount);
3586
3587 fixupArray->USN++;
3588
3590 {
3592
3595 *pShortToFixUp = fixupArray->USN;
3597 }
3598
3600}
struct FIXUP_ARRAY * PFIXUP_ARRAY
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
Definition: ntfs.h:643
Referenced by CreateIndexBufferFromBTreeNode(), UpdateFileRecord(), and UpdateIndexEntryFileName().
◆ AddIndexAllocation()
| NTSTATUS AddIndexAllocation | ( | PNTFS_VCB | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PCWSTR | Name, | ||
| USHORT | NameLength | ||
| ) |
Definition at line 380 of file attrib.c.
385{
386 ULONG RecordLength;
387 ULONG FileRecordEnd;
388 ULONG NameOffset;
389 ULONG DataRunOffset;
390 ULONG BytesAvailable;
391
393 {
396 }
397
398 // Calculate the name offset
400
401 // Calculate the offset to the first data run
403 // The data run offset must be aligned to a 4-byte boundary
405
406 // Calculate the length of the new attribute; the empty data run will consist of a single byte
407 RecordLength = DataRunOffset + 1;
408
409 // The size of the attribute itself must be aligned to an 8 - byte boundary
411
412 // Back up the last 4-bytes of the file record (even though this value doesn't matter)
413 FileRecordEnd = AttributeAddress->Length;
414
415 // Make sure the file record can contain the new attribute
417 if (BytesAvailable < RecordLength)
418 {
421 }
422
423 // Set fields of attribute header
424 RtlZeroMemory(AttributeAddress, RecordLength);
425
427 AttributeAddress->Length = RecordLength;
429 AttributeAddress->NameLength = NameLength;
430 AttributeAddress->NameOffset = NameOffset;
432
433 AttributeAddress->NonResident.MappingPairsOffset = DataRunOffset;
435
436 // Set the name
437 RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
438
439 // move the attribute-end and file-record-end markers to the end of the file record
441 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
442
444}
struct NTFS_ATTR_RECORD::@170::@173 NonResident
Referenced by UpdateIndexAllocation().
◆ AddIndexRoot()
| NTSTATUS AddIndexRoot | ( | PNTFS_VCB | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PINDEX_ROOT_ATTRIBUTE | NewIndexRoot, | ||
| ULONG | RootLength, | ||
| PCWSTR | Name, | ||
| USHORT | NameLength | ||
| ) |
Definition at line 487 of file attrib.c.
494{
495 ULONG AttributeLength;
496 // Calculate the header length
498 // Back up the file record's final ULONG (even though it doesn't matter)
500 ULONG NameOffset;
501 ULONG ValueOffset;
502 ULONG BytesAvailable;
503
505 {
508 }
509
510 NameOffset = ResidentHeaderLength;
511
512 // Calculate ValueOffset, which will be aligned to a 4-byte boundary
514
515 // Calculate length of attribute
516 AttributeLength = ValueOffset + RootLength;
518
519 // Make sure the file record is large enough for the new attribute
521 if (BytesAvailable < AttributeLength)
522 {
525 }
526
527 // Set Attribute fields
528 RtlZeroMemory(AttributeAddress, AttributeLength);
529
531 AttributeAddress->Length = AttributeLength;
532 AttributeAddress->NameLength = NameLength;
533 AttributeAddress->NameOffset = NameOffset;
535
536 AttributeAddress->Resident.ValueLength = RootLength;
537 AttributeAddress->Resident.ValueOffset = ValueOffset;
538
539 // Set the name
540 RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
541
542 // Copy the index root attribute
544
545 // move the attribute-end and file-record-end markers to the end of the file record
547 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
548
550}
Referenced by NtfsCreateDirectory().
◆ AddNewMftEntry()
| NTSTATUS AddNewMftEntry | ( | PFILE_RECORD_HEADER | FileRecord, |
| PDEVICE_EXTENSION | DeviceExt, | ||
| PULONGLONG | DestinationIndex, | ||
| BOOLEAN | CanWait | ||
| ) |
Definition at line 2482 of file mft.c.
2486{
2488 ULONGLONG MftIndex;
2490 ULONGLONG BitmapDataSize;
2491 ULONGLONG AttrBytesRead;
2494 ULONG LengthWritten;
2495 PNTFS_ATTR_CONTEXT BitmapContext;
2496 LARGE_INTEGER BitmapBits;
2497 UCHAR SystemReservedBits;
2498
2499 DPRINT("AddNewMftEntry(%p, %p, %p, %s)\n", FileRecord, DeviceExt, DestinationIndex, CanWait ? "TRUE" : "FALSE");
2500
2501 // First, we have to read the mft's $Bitmap attribute
2502
2503 // Find the attribute
2504 Status = FindAttribute(DeviceExt, DeviceExt->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
2506 {
2509 }
2510
2511 // Get size of bitmap
2512 BitmapDataSize = AttributeDataLength(BitmapContext->pRecord);
2513
2514 // RtlInitializeBitmap wants a ULONG-aligned pointer, and wants the memory passed to it to be a ULONG-multiple
2515 // Allocate a buffer for the $Bitmap attribute plus enough to ensure we can get a ULONG-aligned pointer
2518 {
2519 ReleaseAttributeContext(BitmapContext);
2521 }
2523
2524 // Get a ULONG-aligned pointer for the bitmap itself
2526
2527 // read $Bitmap attribute
2529
2530 if (AttrBytesRead != BitmapDataSize)
2531 {
2534 ReleaseAttributeContext(BitmapContext);
2536 }
2537
2538 // We need to backup the bits for records 0x10 - 0x17 (3rd byte of bitmap) and mark these records
2539 // as in-use so we don't assign files to those indices. They're reserved for the system (e.g. ChkDsk).
2540 SystemReservedBits = BitmapData[2];
2541 BitmapData[2] = 0xff;
2542
2543 // Calculate bit count
2545 DeviceExt->NtfsInfo.BytesPerFileRecord;
2547 {
2548 DPRINT1("\tFIXME: bitmap sizes beyond 32bits are not yet supported! (Your NTFS volume is too large)\n");
2551 ReleaseAttributeContext(BitmapContext);
2553 }
2554
2555 // convert buffer into bitmap
2557
2558 // set next available bit, preferrably after 23rd bit
2561 {
2563
2565 ReleaseAttributeContext(BitmapContext);
2566
2567 // Couldn't find a free record in the MFT, add some blank records and try again
2570 {
2573 }
2574
2576 }
2577
2579
2580 // update file record with index
2581 FileRecord->MFTRecordNumber = MftIndex;
2582
2583 // [BitmapData should have been updated via RtlFindClearBitsAndSet()]
2584
2585 // Restore the system reserved bits
2586 BitmapData[2] = SystemReservedBits;
2587
2588 // write the bitmap back to the MFT's $Bitmap attribute
2589 Status = WriteAttribute(DeviceExt, BitmapContext, 0, BitmapData, BitmapDataSize, &LengthWritten, FileRecord);
2591 {
2594 ReleaseAttributeContext(BitmapContext);
2596 }
2597
2598 // update the file record (write it to disk)
2600
2602 {
2605 ReleaseAttributeContext(BitmapContext);
2607 }
2608
2609 *DestinationIndex = MftIndex;
2610
2612 ReleaseAttributeContext(BitmapContext);
2613
2615}
Definition: gdiplusheaders.h:379
NTSTATUS UpdateFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MftIndex, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:2391
VOID ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
Definition: mft.c:104
NTSTATUS FindAttribute(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, ULONG Type, PCWSTR Name, ULONG NameLength, PNTFS_ATTR_CONTEXT *AttrCtx, PULONG Offset)
Definition: mft.c:131
ULONG ReadAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length)
Definition: mft.c:1625
NTSTATUS WriteAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, const PUCHAR Buffer, ULONG Length, PULONG RealLengthWritten, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:1829
NTSTATUS IncreaseMftSize(PDEVICE_EXTENSION Vcb, BOOLEAN CanWait)
Definition: mft.c:293
NTSTATUS AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, PDEVICE_EXTENSION DeviceExt, PULONGLONG DestinationIndex, BOOLEAN CanWait)
Definition: mft.c:2482
Definition: gdiplusimaging.h:178
Definition: ntfs.h:239
Definition: typedefs.h:89
Referenced by AddNewMftEntry(), NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ AddRun()
| NTSTATUS AddRun | ( | PNTFS_VCB | Vcb, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONGLONG | NextAssignedCluster, | ||
| ULONG | RunLength | ||
| ) |
Definition at line 591 of file attrib.c.
597{
599 int DataRunMaxLength;
600 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
601 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
602 ULONGLONG NextVBN = 0;
603 ULONGLONG HighestVcn;
604
605 PUCHAR RunBuffer;
606 ULONG RunBufferSize;
607
608 if (!AttrContext->pRecord->IsNonResident)
610
611 if (AttrContext->pRecord->NonResident.AllocatedSize != 0)
612 NextVBN = AttrContext->pRecord->NonResident.HighestVCN + 1;
613
614 /* The run goes on the end, so it holds the new last VCN */
615 HighestVcn = NextVBN + RunLength - 1;
616
617 // Add newly-assigned clusters to mcb
618 _SEH2_TRY
619 {
621 NextVBN,
622 NextAssignedCluster,
623 RunLength))
624 {
626 }
627 }
629 {
632 }
633 _SEH2_END;
634
636 if (!RunBuffer)
637 {
640 }
641
642 // Convert the map control block back to encoded data runs.
643 Status = ConvertLargeMCBToDataRuns(&AttrContext->DataRunsMCB, HighestVcn + 1, RunBuffer, Vcb->NtfsInfo.BytesPerFileRecord, &RunBufferSize);
645 {
646 // Runs won't fit in a single record; migrating to an $ATTRIBUTE_LIST isn't supported yet.
647 DPRINT1("Data runs too large for one file record - $ATTRIBUTE_LIST needed (not implemented)\n");
650 }
652 {
656 }
657
658 // Get the amount of free space between the start of the of the first data run and the attribute end
659 DataRunMaxLength = AttrContext->pRecord->Length - AttrContext->pRecord->NonResident.MappingPairsOffset;
660
661 // Do we need to extend the attribute (or convert to attribute list)?
662 if (DataRunMaxLength < RunBufferSize)
663 {
664 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
665 PNTFS_ATTR_RECORD NewRecord;
666
667 // Add free space at the end of the file record to DataRunMaxLength
669
670 // Can we resize the attribute?
671 if (DataRunMaxLength < RunBufferSize)
672 {
673 DPRINT1("FIXME: Need to create attribute list! Max Data Run Length available: %d, RunBufferSize: %d\n", DataRunMaxLength, RunBufferSize);
676 }
677
678 // Are there more attributes after the one we're resizing?
680 {
681 PNTFS_ATTR_RECORD FinalAttribute;
682
683 // Calculate where to move the trailing attributes
684 ULONG_PTR MoveTo = (ULONG_PTR)DestinationAttribute + AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize;
686
688
689 // Move the trailing attributes; FinalAttribute will point to the end marker
691
692 // set the file record end
694 }
695
696 // calculate position of end markers
697 NextAttributeOffset = AttrOffset + AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize;
699
700 // Update the length of the destination attribute
701 DestinationAttribute->Length = NextAttributeOffset - AttrOffset;
702
703 // Create a new copy of the attribute record
705 RtlCopyMemory(NewRecord, AttrContext->pRecord, AttrContext->pRecord->Length);
707
708 // Free the old copy of the attribute record, which won't be large enough
710
711 // Set the attribute context's record to the new copy
712 AttrContext->pRecord = NewRecord;
713
714 // if NextAttribute is the AttributeEnd marker
716 {
717 // End the file record
720 }
721 }
722
723 // Update HighestVCN
724 DestinationAttribute->NonResident.HighestVCN =
725 AttrContext->pRecord->NonResident.HighestVCN = HighestVcn;
726
727 /* Sparse and compressed streams also count the clusters they really own */
729 {
730 AttrContext->pRecord->NonResident.CompressedSize += (ULONGLONG)RunLength * Vcb->NtfsInfo.BytesPerCluster;
731 DestinationAttribute->NonResident.CompressedSize = AttrContext->pRecord->NonResident.CompressedSize;
732 }
733
734 // Write data runs to destination attribute
735 RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
736 RunBuffer,
737 RunBufferSize);
738
739 // Update the attribute record in the attribute context
740 RtlCopyMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + AttrContext->pRecord->NonResident.MappingPairsOffset),
741 RunBuffer,
742 RunBufferSize);
743
744 // Update the file record
746
748
749#if NTFS_DUMP_DATA_RUNS
750 NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
751#endif
752
754}
NTSTATUS ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, ULONGLONG VcnCount, PUCHAR RunBuffer, ULONG MaxBufferSize, PULONG UsedBufferSize)
Definition: attrib.c:917
VOID NtfsDumpDataRuns(PVOID StartOfRun, ULONGLONG CurrentLCN)
Definition: attrib.c:1785
Definition: nsiface.idl:2307
BOOLEAN NTAPI FsRtlAddLargeMcbEntry(IN PLARGE_MCB Mcb, IN LONGLONG Vbn, IN LONGLONG Lbn, IN LONGLONG SectorCount)
Definition: largemcb.c:288
PNTFS_ATTR_RECORD MoveAttributes(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_RECORD FirstAttributeToMove, ULONG FirstAttributeOffset, ULONG_PTR MoveTo)
Definition: mft.c:512
Referenced by NtfsExtendAllocation().
◆ AddStandardInformation()
| NTSTATUS AddStandardInformation | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttributeAddress | ||
| ) |
Definition at line 783 of file attrib.c.
785{
787 PSTANDARD_INFORMATION StandardInfo = (PSTANDARD_INFORMATION)((LONG_PTR)AttributeAddress + ResidentHeaderLength);
788 LARGE_INTEGER SystemTime;
790
792 {
795 }
796
801 AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
803
804 // set dates and times
805 KeQuerySystemTime(&SystemTime);
811
812 // move the attribute-end and file-record-end markers to the end of the file record
814 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
815
817}
struct STANDARD_INFORMATION * PSTANDARD_INFORMATION
Definition: ntfs.h:360
Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ AttributeAllocatedLength()
| ULONGLONG AttributeAllocatedLength | ( | PNTFS_ATTR_RECORD | AttrRecord | ) |
Definition at line 249 of file mft.c.
250{
253 else
255}
Referenced by NtfsGetFileSize(), NtfsGetStreamInformation(), and NtfsReadFile().
◆ AttributeDataLength()
| ULONGLONG AttributeDataLength | ( | PNTFS_ATTR_RECORD | AttrRecord | ) |
Definition at line 259 of file mft.c.
260{
263 else
265}
Referenced by AddFilenameToDirectoryWorker(), AddNewMftEntry(), AllocateIndexNode(), BrowseIndexEntries(), FreeMftEntry(), IncreaseMftSize(), InternalReadNonResidentAttributes(), NtfsGetFileSize(), NtfsGetStreamInformation(), NtfsGetVolumeData(), NtfsIsDirectoryEmpty(), NtfsLoadVolumeBitmap(), NtfsReadFCBAttribute(), NtfsReadFile(), NtfsReadUpCaseTable(), NtfsSetEndOfFile(), NtfsWriteFile(), PrintAllVCNs(), RemoveFilenameFromDirectoryWorker(), SetAttributeDataLength(), UpdateFileNameRecordWorker(), UpdateIndexEntryFileName(), and UpdateMftMirror().
◆ CompareFileName()
| BOOLEAN CompareFileName | ( | PDEVICE_EXTENSION | Vcb, |
| PUNICODE_STRING | FileName, | ||
| PINDEX_ENTRY_ATTRIBUTE | IndexEntry, | ||
| BOOLEAN | DirSearch, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 3622 of file mft.c.
3627{
3629 UNICODE_STRING EntryName;
3630
3632 EntryName.Length =
3634
3635 if (DirSearch)
3636 {
3637 UNICODE_STRING IntFileName;
3638 if (!CaseSensitive)
3639 {
3642 }
3643 else
3644 {
3645 IntFileName = *FileName;
3646 }
3647
3648 /* With a real upcase table the matcher folds both sides through it,
3649 * which is what NTFS means by case-insensitive. */
3650 Ret = FsRtlIsNameInExpression(&IntFileName, &EntryName, !CaseSensitive,
3652
3654 {
3655 RtlFreeUnicodeString(&IntFileName);
3656 }
3657
3658 return Ret;
3659 }
3660 else
3661 {
3663 }
3664}
ULONG RtlCompareUnicodeString(PUNICODE_STRING s1, PUNICODE_STRING s2, BOOLEAN UpCase)
Definition: string_lib.cpp:31
NTSTATUS RtlUpcaseUnicodeString(PUNICODE_STRING dst, PUNICODE_STRING src, BOOLEAN Alloc)
Definition: string_lib.cpp:46
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
Definition: filecomp.c:348
Referenced by BrowseIndexEntries(), BrowseSubNodeIndexEntries(), and UpdateIndexEntryFileName().
◆ CompareTreeKeys()
| LONG CompareTreeKeys | ( | PB_TREE_KEY | Key1, |
| PB_TREE_KEY | Key2, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 422 of file btree.c.
423{
424 UNICODE_STRING Key1Name, Key2Name;
425 LONG Comparison;
426
427 // Key1 must not be the final key (AKA the dummy key)
429
430 // If Key2 is the "dummy key", key 1 will always come first
432 return -1;
433
437
441
442 // Are the two keys the same length?
445
446 // Is Key1 shorter?
448 {
449 // Truncate KeyName2 to be the same length as KeyName1
451
452 // Compare the names of the same length
453 Comparison = RtlCompareUnicodeString(&Key1Name, &Key2Name, !CaseSensitive);
454
455 // If the truncated names are the same length, the shorter one comes first
456 if (Comparison == 0)
457 return -1;
458 }
459 else
460 {
461 // Key2 is shorter
462 // Truncate KeyName1 to be the same length as KeyName2
464
465 // Compare the names of the same length
466 Comparison = RtlCompareUnicodeString(&Key1Name, &Key2Name, !CaseSensitive);
467
468 // If the truncated names are the same length, the shorter one comes first
469 if (Comparison == 0)
470 return 1;
471 }
472
473 return Comparison;
474}
Referenced by NtfsInsertKey(), and NtfsRemoveKey().
◆ ConvertDataRunsToLargeMCB()
| NTSTATUS ConvertDataRunsToLargeMCB | ( | PUCHAR | DataRun, |
| PLARGE_MCB | DataRunsMCB, | ||
| PULONGLONG | pNextVBN | ||
| ) |
Definition at line 842 of file attrib.c.
845{
846 LONGLONG DataRunOffset;
847 ULONGLONG DataRunLength;
848 LONGLONG DataRunStartLCN;
849 ULONGLONG LastLCN = 0;
850
851 // Initialize the MCB, potentially catch an exception
852 _SEH2_TRY{
856 } _SEH2_END;
857
858 while (*DataRun != 0)
859 {
860 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
861
862 if (DataRunOffset != -1)
863 {
864 // Normal data run.
865 DataRunStartLCN = LastLCN + DataRunOffset;
866 LastLCN = DataRunStartLCN;
867
868 _SEH2_TRY{
870 *pNextVBN,
871 DataRunStartLCN,
872 DataRunLength))
873 {
875 }
877 FsRtlUninitializeLargeMcb(DataRunsMCB);
879 } _SEH2_END;
880
881 }
882
883 *pNextVBN += DataRunLength;
884 }
885
887}
PUCHAR DecodeRun(PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength)
Definition: attrib.c:1010
VOID NTAPI FsRtlUninitializeLargeMcb(IN PLARGE_MCB Mcb)
Definition: largemcb.c:1096
VOID NTAPI FsRtlInitializeLargeMcb(IN PLARGE_MCB Mcb, IN POOL_TYPE PoolType)
Definition: largemcb.c:451
Referenced by PrepareAttributeContext().
◆ ConvertLargeMCBToDataRuns()
| NTSTATUS ConvertLargeMCBToDataRuns | ( | PLARGE_MCB | DataRunsMCB, |
| ULONGLONG | VcnCount, | ||
| PUCHAR | RunBuffer, | ||
| ULONG | MaxBufferSize, | ||
| PULONG | UsedBufferSize | ||
| ) |
Definition at line 917 of file attrib.c.
922{
924 ULONG RunBufferOffset = 0;
925 LONGLONG DataRunOffset = 0;
926 ULONGLONG LastLCN = 0;
927 ULONGLONG NextVcn = 0;
931
932
934
935 // convert each mcb entry to a data run, then the trailing hole if there is one
937 {
938 UCHAR DataRunOffsetSize = 0;
939 UCHAR DataRunLengthSize = 0;
940 UCHAR ControlByte = 0;
941
943 {
944 if (NextVcn >= VcnCount)
945 break;
946
947 /* The MCB only knows mapped clusters, so a hole at the end isn't in it */
948 Vbn = NextVcn;
949 Lbn = -1;
950 Count = VcnCount - NextVcn;
951 Tail = TRUE;
952 }
953
954 // [vbn, lbn, count]
956
957 // determine how to represent DataRunLengthSize with the minimum number of bytes
961
962 /* A sparse run has no offset, and the next real run is relative to the last real one */
964 {
965 DataRunOffset = Lbn - LastLCN;
966 LastLCN = Lbn;
967
968 // now we need to determine how to represent DataRunOffset with the minimum number of bytes
972 }
973
974 // ensure the next data run + end marker would be <= Max buffer size
975 if (RunBufferOffset + 2 + DataRunLengthSize + DataRunOffsetSize > MaxBufferSize)
976 {
979 break;
980 }
981
982 // pack and copy the control byte
983 ControlByte = (DataRunOffsetSize << 4) + DataRunLengthSize;
984 RunBuffer[RunBufferOffset++] = ControlByte;
985
986 // copy DataRunLength
988 RunBufferOffset += DataRunLengthSize;
989
990 // copy DataRunOffset
991 RtlCopyMemory(RunBuffer + RunBufferOffset, &DataRunOffset, DataRunOffsetSize);
992 RunBufferOffset += DataRunOffsetSize;
993
995
996 if (Tail)
997 break;
998 }
999
1000 // End of data runs
1001 RunBuffer[RunBufferOffset++] = 0;
1002
1003 *UsedBufferSize = RunBufferOffset;
1005
1007}
UCHAR GetPackedByteCount(LONGLONG NumberToPack, BOOLEAN IsSigned)
Definition: attrib.c:1876
BOOLEAN NTAPI FsRtlGetNextLargeMcbEntry(IN PLARGE_MCB Mcb, IN ULONG RunIndex, OUT PLONGLONG Vbn, OUT PLONGLONG Lbn, OUT PLONGLONG SectorCount)
Definition: largemcb.c:392
Referenced by AddRun(), FreeClusters(), and NtfsMapAttributeRuns().
◆ CreateBTreeFromIndex()
| NTSTATUS CreateBTreeFromIndex | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecordWithIndex, | ||
| PNTFS_ATTR_CONTEXT | IndexRootContext, | ||
| PINDEX_ROOT_ATTRIBUTE | IndexRoot, | ||
| PB_TREE * | NewTree | ||
| ) |
Definition at line 687 of file btree.c.
693{
694 PINDEX_ENTRY_ATTRIBUTE CurrentNodeEntry;
696 PB_TREE_FILENAME_NODE RootNode = ExAllocatePoolWithTag(NonPagedPool, sizeof(B_TREE_FILENAME_NODE), TAG_NTFS);
701
703
705 {
709 if (CurrentKey)
714 }
715
719
720 // See if the file record has an attribute allocation
722 FileRecordWithIndex,
725 4,
726 &IndexAllocationContext,
727 NULL);
729 IndexAllocationContext = NULL;
730
731 // Setup the Tree
732 RootNode->FirstKey = CurrentKey;
734
735 // Make sure we won't try reading past the attribute-end
736 if (FIELD_OFFSET(INDEX_ROOT_ATTRIBUTE, Header) + IndexRoot->Header.TotalSizeOfEntries > IndexRootContext->pRecord->Resident.ValueLength)
737 {
742 }
743
744 // Start at the first node entry
748
749 // Create a key for each entry in the node
751 {
752 // Allocate memory for the current entry
753 CurrentKey->IndexEntry = ExAllocatePoolWithTag(NonPagedPool, CurrentNodeEntry->Length, TAG_NTFS);
755 {
760 }
761
762 RootNode->KeyCount++;
763
764 // If this isn't the last entry
766 {
767 // Create the next key
769 if (!NextKey)
770 {
775 }
776
778
779 // Add NextKey to the end of the list
780 CurrentKey->NextKey = NextKey;
781
782 // Copy the current entry to its key
784
785 // Does this key have a sub-node?
787 {
788 // Create the child node
790 IndexRoot,
791 IndexAllocationContext,
792 CurrentKey->IndexEntry);
794 {
799 }
800 }
801
802 // Advance to the next entry
803 CurrentOffset += CurrentNodeEntry->Length;
804 CurrentNodeEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)CurrentNodeEntry + CurrentNodeEntry->Length);
805 CurrentKey = NextKey;
806 }
807 else
808 {
809 // Copy the final entry to its key
812
813 // Does this key have a sub-node?
815 {
816 // Create the child node
818 IndexRoot,
819 IndexAllocationContext,
820 CurrentKey->IndexEntry);
822 {
827 }
828 }
829
830 break;
831 }
832 }
833
834 *NewTree = Tree;
836
837Cleanup:
838 if (IndexAllocationContext)
839 ReleaseAttributeContext(IndexAllocationContext);
840
842}
PB_TREE_FILENAME_NODE CreateBTreeNodeFromIndexNode(PDEVICE_EXTENSION Vcb, PINDEX_ROOT_ATTRIBUTE IndexRoot, PNTFS_ATTR_CONTEXT IndexAllocationAttributeCtx, PINDEX_ENTRY_ATTRIBUTE NodeEntry)
Definition: btree.c:504
Definition: Header.h:9
struct INDEX_ENTRY_ATTRIBUTE * PINDEX_ENTRY_ATTRIBUTE
Definition: ntfs.h:485
Definition: ntfs.h:440
Definition: ntfs.h:423
Definition: ntfs.h:476
Definition: ntfs.h:466
Referenced by AddFilenameToDirectoryWorker(), and RemoveFilenameFromDirectoryWorker().
◆ CreateBTreeKeyFromFilename()
| PB_TREE_KEY CreateBTreeKeyFromFilename | ( | ULONGLONG | FileReference, |
| PFILENAME_ATTRIBUTE | FileNameAttribute | ||
| ) |
Definition at line 1466 of file btree.c.
1467{
1468 PB_TREE_KEY NewKey;
1470 ULONG EntrySize = ALIGN_UP_BY(AttributeSize + FIELD_OFFSET(INDEX_ENTRY_ATTRIBUTE, FileName), 8);
1471
1472 // Create a new Index Entry for the file
1474 if (!NewEntry)
1475 {
1478 }
1479
1480 // Setup the Index Entry
1484 NewEntry->KeyLength = AttributeSize;
1485
1486 // Copy the FileNameAttribute
1488
1489 // Setup the New Key
1491 if (!NewKey)
1492 {
1496 }
1497
1498 /* DestroyBTreeKey() follows LesserChild, it can't be left to pool garbage */
1500 NewKey->IndexEntry = NewEntry;
1501
1502 return NewKey;
1503}
ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute)
Definition: attrib.c:2008
union INDEX_ENTRY_ATTRIBUTE::@970 Data
struct INDEX_ENTRY_ATTRIBUTE::@970::@971 Directory
Referenced by NtfsInsertKey(), and RemoveFilenameFromDirectoryWorker().
◆ CreateEmptyBTree()
Definition at line 353 of file btree.c.
354{
356 PB_TREE_FILENAME_NODE RootNode = ExAllocatePoolWithTag(NonPagedPool, sizeof(B_TREE_FILENAME_NODE), TAG_NTFS);
357 PB_TREE_KEY DummyKey;
358
360
362 {
369 }
370
371 // Create the dummy key
373 if (!DummyKey)
374 {
379 }
380
383
384 // Setup the Tree
385 RootNode->FirstKey = DummyKey;
386 RootNode->KeyCount = 1;
389
390 *NewTree = Tree;
391
392 // Memory will be freed when DestroyBTree() is called
393
395}
Referenced by NtfsCreateDirectory().
◆ CreateIndexRootFromBTree()
| NTSTATUS CreateIndexRootFromBTree | ( | PDEVICE_EXTENSION | DeviceExt, |
| PB_TREE | Tree, | ||
| ULONG | MaxIndexSize, | ||
| PINDEX_ROOT_ATTRIBUTE * | IndexRoot, | ||
| ULONG * | Length | ||
| ) |
Definition at line 915 of file btree.c.
920{
922 PB_TREE_KEY CurrentKey;
923 PINDEX_ENTRY_ATTRIBUTE CurrentNodeEntry;
925 DeviceExt->NtfsInfo.BytesPerFileRecord,
926 TAG_NTFS);
927
928 DPRINT("CreateIndexRootFromBTree(%p, %p, 0x%lx, %p, %p)\n", DeviceExt, Tree, MaxIndexSize, IndexRoot, Length);
929
930#ifndef NDEBUG
932#endif
933
934 if (!NewIndexRoot)
935 {
938 }
939
940 // Setup the new index root
941 RtlZeroMemory(NewIndexRoot, DeviceExt->NtfsInfo.BytesPerFileRecord);
942
945 NewIndexRoot->SizeOfEntry = DeviceExt->NtfsInfo.BytesPerIndexRecord;
946 // If Bytes per index record is less than cluster size, clusters per index record becomes sectors per index
948 NewIndexRoot->ClustersPerIndexRecord = NewIndexRoot->SizeOfEntry / DeviceExt->NtfsInfo.BytesPerSector;
949 else
950 NewIndexRoot->ClustersPerIndexRecord = NewIndexRoot->SizeOfEntry / DeviceExt->NtfsInfo.BytesPerCluster;
951
952 // Setup the Index node header
955
956 // Start summing the total size of this node's entries
958
959 // Setup each Node Entry
960 CurrentKey = Tree->RootNode->FirstKey;
965 {
966 // Would adding the current entry to the index increase the index size beyond the limit we've set?
967 ULONG IndexSize = NewIndexRoot->Header.TotalSizeOfEntries - NewIndexRoot->Header.FirstEntryOffset + CurrentKey->IndexEntry->Length;
968 if (IndexSize > MaxIndexSize)
969 {
973 }
974
976
977 // Copy the index entry
979
981 CurrentNodeEntry->KeyLength,
982 CurrentNodeEntry->Length);
983
984 // Does the current key have any sub-nodes?
987
988 // Add Length of Current Entry to Total Size of Entries
990
991 // Go to the next node entry
992 CurrentNodeEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)CurrentNodeEntry + CurrentNodeEntry->Length);
993
994 CurrentKey = CurrentKey->NextKey;
995 }
996
998
999 *IndexRoot = NewIndexRoot;
1001
1003}
Definition: ntfs.h:414
Referenced by AddFilenameToDirectoryWorker(), NtfsCreateDirectory(), and RemoveFilenameFromDirectoryWorker().
◆ DecodeRun()
Definition at line 1010 of file attrib.c.
1013{
1014 UCHAR DataRunOffsetSize;
1015 UCHAR DataRunLengthSize;
1017
1018 DataRunOffsetSize = (*DataRun >> 4) & 0xF;
1019 DataRunLengthSize = *DataRun & 0xF;
1020 *DataRunOffset = 0;
1021 *DataRunLength = 0;
1022 DataRun++;
1024 {
1026 DataRun++;
1027 }
1028
1029 /* NTFS 3+ sparse files */
1030 if (DataRunOffsetSize == 0)
1031 {
1032 *DataRunOffset = -1;
1033 }
1034 else
1035 {
1037 {
1039 DataRun++;
1040 }
1041 /* The last byte contains sign so we must process it different way. */
1043 }
1044
1049
1050 return DataRun;
1051}
Referenced by ConvertDataRunsToLargeMCB(), FindRun(), GetLastClusterInDataRun(), NtfsDumpDataRuns(), NtfsMapAttributeRuns(), PrepareAttributeContext(), and PrintAttributeInfo().
◆ DemoteBTreeRoot()
Definition at line 1094 of file btree.c.
1095{
1096 PB_TREE_FILENAME_NODE NewSubNode, NewIndexRoot;
1097 PB_TREE_KEY DummyKey;
1098
1100
1101#ifndef NDEBUG
1103#endif
1104
1105 // Create a new node that will hold the keys currently in index root
1107 if (!NewSubNode)
1108 {
1111 }
1113
1114 // Copy the applicable data from the old index root node
1118
1119 // Create a new dummy key, and make the new node it's child
1121 if (!DummyKey)
1122 {
1126 }
1127
1128 // Make the new node a child of the dummy key
1129 DummyKey->LesserChild = NewSubNode;
1130
1131 // Create a new index root node
1133 if (!NewIndexRoot)
1134 {
1139 }
1141
1143
1144 // Insert the dummy key into the new node
1145 NewIndexRoot->FirstKey = DummyKey;
1146 NewIndexRoot->KeyCount = 1;
1148
1149 // Make the new node the Tree's root node
1150 Tree->RootNode = NewIndexRoot;
1151
1152#ifndef NDEBUG
1154#endif
1155
1157}
Referenced by AddFilenameToDirectoryWorker().
◆ DestroyBTree()
Definition at line 1549 of file btree.c.
1550{
1553}
Referenced by AddFilenameToDirectoryWorker(), CreateBTreeFromIndex(), NtfsCreateDirectory(), and RemoveFilenameFromDirectoryWorker().
◆ DestroyBTreeKey()
| VOID DestroyBTreeKey | ( | PB_TREE_KEY | Key | ) |
Definition at line 1506 of file btree.c.
Referenced by DestroyBTreeNode(), NtfsInsertKey(), RemoveFilenameFromDirectoryWorker(), and RemoveKeyFromNode().
◆ DestroyBTreeNode()
| VOID DestroyBTreeNode | ( | PB_TREE_FILENAME_NODE | Node | ) |
Definition at line 1518 of file btree.c.
1519{
1520 PB_TREE_KEY NextKey;
1524 {
1525 NT_ASSERT(CurrentKey);
1526 NextKey = CurrentKey->NextKey;
1527 DestroyBTreeKey(CurrentKey);
1528 CurrentKey = NextKey;
1529 }
1530
1532
1534}
Definition: dlist.c:348
Referenced by CreateBTreeNodeFromIndexNode(), DestroyBTree(), and DestroyBTreeKey().
◆ DumpBTree()
Definition at line 1629 of file btree.c.
1630{
1633}
VOID DumpBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, ULONG Number, ULONG Depth)
Definition: btree.c:1590
Referenced by AddFilenameToDirectoryWorker(), CreateIndexRootFromBTree(), DemoteBTreeRoot(), NtfsInsertKey(), and UpdateIndexAllocation().
◆ DumpBTreeKey()
| VOID DumpBTreeKey | ( | PB_TREE | Tree, |
| PB_TREE_KEY | Key, | ||
| ULONG | Number, | ||
| ULONG | Depth | ||
| ) |
Definition at line 1556 of file btree.c.
1557{
1562
1564 {
1570 }
1571 else
1572 {
1574 }
1575
1576 // Is there a child node?
1578 {
1581 else
1582 {
1583 // This will be an assert once nodes with arbitrary depth are debugged
1584 DPRINT1("DRIVER ERROR: No Key->LesserChild despite Key->IndexEntry->Flags indicating this is a node!\n");
1585 }
1586 }
1587}
Referenced by DumpBTreeNode().
◆ DumpBTreeNode()
| VOID DumpBTreeNode | ( | PB_TREE | Tree, |
| PB_TREE_FILENAME_NODE | Node, | ||
| ULONG | Number, | ||
| ULONG | Depth | ||
| ) |
Definition at line 1590 of file btree.c.
1594{
1595 PB_TREE_KEY CurrentKey;
1599 DbgPrint("Node #%d, Depth %d, has %d key%s", Number, Depth, Node->KeyCount, Node->KeyCount == 1 ? "" : "s");
1600
1605 else
1607
1608 CurrentKey = Node->FirstKey;
1610 {
1612 CurrentKey = CurrentKey->NextKey;
1613 }
1614}
VOID DumpBTreeKey(PB_TREE Tree, PB_TREE_KEY Key, ULONG Number, ULONG Depth)
Definition: btree.c:1556
Referenced by DumpBTree(), DumpBTreeKey(), and SplitBTreeNode().
◆ EnumerAttribute()
| VOID EnumerAttribute | ( | PFILE_RECORD_HEADER | file, |
| PDEVICE_EXTENSION | Vcb, | ||
| PDEVICE_OBJECT | DeviceObject | ||
| ) |
◆ FindAttribute()
| NTSTATUS FindAttribute | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | MftRecord, | ||
| ULONG | Type, | ||
| PCWSTR | Name, | ||
| ULONG | NameLength, | ||
| PNTFS_ATTR_CONTEXT * | AttrCtx, | ||
| PULONG | Offset | ||
| ) |
Definition at line 131 of file mft.c.
138{
142 PNTFS_ATTR_RECORD Attribute;
143 PNTFS_ATTRIBUTE_LIST_ITEM AttrListItem;
144
145 DPRINT("FindAttribute(%p, %p, 0x%x, %S, %lu, %p, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx, Offset);
146
150 {
152 {
153 if (NameLength != 0)
154 {
155 PWCHAR AttrName;
156
159 if (RtlCompareMemory(AttrName, Name, NameLength * sizeof(WCHAR)) == (NameLength * sizeof(WCHAR)))
160 {
162 }
163 }
164 else
165 {
167 }
168
170 {
171 /* Found it, fill up the context and return. */
173 *AttrCtx = PrepareAttributeContext(Attribute);
174
175 (*AttrCtx)->FileMFTIndex = MftRecord->MFTRecordNumber;
176
179
182 }
183 }
184
186 }
187
188 /* No attribute found, check if it is referenced in another file record */
191 {
193 {
194 if (NameLength != 0)
195 {
196 PWCHAR AttrName;
197
200 if (RtlCompareMemory(AttrName, Name, NameLength * sizeof(WCHAR)) == (NameLength * sizeof(WCHAR)))
201 {
203 }
204 }
205 else
206 {
208 }
209
211 {
212 /* Get the MFT Index of attribute */
213 ULONGLONG MftIndex;
214 PFILE_RECORD_HEADER RemoteHdr;
215
217 RemoteHdr = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
218
220 {
223 }
224
225 /* Check we are not reading ourselves */
227 {
229 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, RemoteHdr);
232 }
233 /* Read the new file record */
236 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, RemoteHdr);
239 }
240 }
242 }
245}
NTSTATUS FindFirstAttribute(PFIND_ATTR_CONTXT Context, PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, BOOLEAN OnlyResident, PNTFS_ATTR_RECORD *Attribute)
Definition: attrib.c:1413
NTSTATUS FindFirstAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
Definition: attrib.c:1337
NTSTATUS FindNextAttribute(PFIND_ATTR_CONTXT Context, PNTFS_ATTR_RECORD *Attribute)
Definition: attrib.c:1461
NTSTATUS FindNextAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
Definition: attrib.c:1351
NTSTATUS ReadFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG index, PFILE_RECORD_HEADER file)
Definition: mft.c:1936
PNTFS_ATTR_CONTEXT PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
Definition: mft.c:41
Definition: ntfs.h:339
Definition: ntfs.h:282
Definition: ntfs.h:630
Referenced by AddFilenameToDirectoryWorker(), AddNewMftEntry(), AllocateIndexNode(), BrowseIndexEntries(), CreateBTreeFromIndex(), tinyxml2::XMLElement::FindAttribute(), FindAttribute(), FreeMftEntry(), IncreaseMftSize(), NtfsCreateFile(), NtfsDeleteFileRecord(), NtfsDirFindFile(), NtfsFindMftRecord(), NtfsGetFileSize(), NtfsGetVolumeData(), NtfsGrowFileForWrite(), NtfsIsDirectoryEmpty(), NtfsLoadVolumeBitmap(), NtfsReadFCBAttribute(), NtfsReadFile(), NtfsReadUpCaseTable(), NtfsResizeAllocation(), NtfsSetEndOfFile(), NtfsTrimAllocation(), NtfsWriteFile(), tinyxml2::XMLElement::QueryBoolAttribute(), tinyxml2::XMLElement::QueryDoubleAttribute(), tinyxml2::XMLElement::QueryFloatAttribute(), tinyxml2::XMLElement::QueryIntAttribute(), tinyxml2::XMLElement::QueryUnsignedAttribute(), RemoveFilenameFromDirectoryWorker(), UpdateFileNameRecordWorker(), UpdateIndexAllocation(), UpdateIndexEntryFileName(), UpdateMftMirror(), and WriteAttributeFromIrp().
◆ FindCloseAttribute()
| VOID FindCloseAttribute | ( | PFIND_ATTR_CONTXT | Context | ) |
Definition at line 1495 of file attrib.c.
1496{
1498 {
1501 }
1502}
Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().
◆ FindFirstAttribute()
| NTSTATUS FindFirstAttribute | ( | PFIND_ATTR_CONTXT | Context, |
| PDEVICE_EXTENSION | Vcb, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| BOOLEAN | OnlyResident, | ||
| PNTFS_ATTR_RECORD * | Attribute | ||
| ) |
Definition at line 1413 of file attrib.c.
1418{
1420
1421 DPRINT("FindFistAttribute(%p, %p, %p, %p, %u, %p)\n", Context, Vcb, FileRecord, OnlyResident, Attribute);
1422
1424 Context->OnlyResident = OnlyResident;
1431
1433 {
1436 }
1438 {
1441 {
1443 }
1444
1447 {
1449 }
1450 }
1451 else
1452 {
1453 *Attribute = Context->CurrAttr;
1455 }
1456
1458}
static NTSTATUS InternalReadNonResidentAttributes(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1244
static PNTFS_ATTR_RECORD InternalGetNextAttribute(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1364
Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().
◆ FindFirstAttributeListItem()
| NTSTATUS FindFirstAttributeListItem | ( | PFIND_ATTR_CONTXT | Context, |
| PNTFS_ATTRIBUTE_LIST_ITEM * | Item | ||
| ) |
Definition at line 1337 of file attrib.c.
1339{
1341 {
1343 }
1344
1348}
Referenced by FindAttribute().
◆ FindNextAttribute()
| NTSTATUS FindNextAttribute | ( | PFIND_ATTR_CONTXT | Context, |
| PNTFS_ATTR_RECORD * | Attribute | ||
| ) |
Definition at line 1461 of file attrib.c.
1463{
1465
1467
1470 {
1472 }
1473
1475 {
1477 }
1478
1481 {
1483 }
1484
1487 {
1489 }
1490
1492}
Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().
◆ FindNextAttributeListItem()
| NTSTATUS FindNextAttributeListItem | ( | PFIND_ATTR_CONTXT | Context, |
| PNTFS_ATTRIBUTE_LIST_ITEM * | Item | ||
| ) |
Definition at line 1351 of file attrib.c.
1353{
1356 {
1358 }
1360}
static PNTFS_ATTRIBUTE_LIST_ITEM InternalGetNextAttributeListItem(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1297
Referenced by FindAttribute().
◆ FixupUpdateSequenceArray()
| NTSTATUS FixupUpdateSequenceArray | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_RECORD_HEADER | Record | ||
| ) |
Definition at line 2425 of file mft.c.
2427{
2428 USHORT *USA;
2429 USHORT USANumber;
2430 USHORT USACount;
2431 USHORT *Block;
2432
2434 USANumber = *(USA++);
2437
2438 DPRINT("FixupUpdateSequenceArray(%p, %p)\nUSANumber: %u\tUSACount: %u\n", Vcb, Record, USANumber, USACount);
2439
2440 while (USACount)
2441 {
2442 if (*Block != USANumber)
2443 {
2446 }
2447 *Block = *(USA++);
2449 USACount--;
2450 }
2451
2453}
Referenced by BrowseSubNodeIndexEntries(), CreateBTreeNodeFromIndexNode(), NtfsIndexNodeIsEmpty(), PrintAllVCNs(), ReadFileRecord(), UpdateFileRecord(), and UpdateIndexEntryFileName().
◆ FreeClusters()
| NTSTATUS FreeClusters | ( | PNTFS_VCB | Vcb, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONG | ClustersToFree | ||
| ) |
Definition at line 1101 of file attrib.c.
1106{
1108 ULONG ClustersLeftToFree = ClustersToFree;
1109
1110 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
1111 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
1112 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
1113
1114 PUCHAR RunBuffer;
1115 ULONG RunBufferSize = 0;
1116
1118 ULONG HighestFreed = 0;
1119 ULONG Freed = 0;
1120
1121 if (!AttrContext->pRecord->IsNonResident)
1122 {
1124 }
1125
1126 /* Same lock NtfsAllocateClusters() holds over the bitmap copy */
1127 KeEnterCriticalRegion();
1129
1130 // free clusters in $BITMAP file
1131 while (ClustersLeftToFree > 0)
1132 {
1133 ULONGLONG LastVcn = AttrContext->pRecord->NonResident.HighestVCN;
1135
1136 /* An empty stream has HighestVCN -1 */
1138 {
1140 DPRINT1("DRIVER ERROR: FreeClusters called to free %lu clusters, which is %lu more clusters than are assigned to attribute!",
1141 ClustersToFree,
1142 ClustersLeftToFree);
1143 break;
1144 }
1145
1146 /* The last VCN of a sparse stream can sit in a hole, which owns no cluster */
1147 if (FsRtlLookupLargeMcbEntry(&AttrContext->DataRunsMCB, LastVcn, &LargeLbn, NULL, NULL, NULL, NULL) &&
1148 LargeLbn != -1)
1149 {
1150 // deallocate this cluster
1154 Freed++;
1155 }
1156 FsRtlTruncateLargeMcb(&AttrContext->DataRunsMCB, LastVcn);
1157
1158 /* Freeing the last cluster leaves the -1 of an empty stream */
1159 AttrContext->pRecord->NonResident.HighestVCN = LastVcn - 1;
1160 ClustersLeftToFree--;
1161 }
1162
1164 AttrContext->pRecord->NonResident.CompressedSize -= (ULONGLONG)Freed * Vcb->NtfsInfo.BytesPerCluster;
1165
1166 if (Freed != 0)
1167 {
1168 NTSTATUS WriteStatus;
1169
1170 Vcb->FreeClusterCount += Freed;
1171
1172 // update $BITMAP file on disk
1175 Status = WriteStatus;
1176 }
1177
1179 KeLeaveCriticalRegion();
1180
1183
1184 // Save updated data runs to file record
1185
1186 // Allocate some memory for a new RunBuffer
1188 if (!RunBuffer)
1189 {
1192 }
1193
1194 // Convert the map control block back to encoded data runs.
1195 // RunBuffer is one file record long (not one cluster) - see AddRun().
1196 ConvertLargeMCBToDataRuns(&AttrContext->DataRunsMCB,
1197 AttrContext->pRecord->NonResident.HighestVCN + 1,
1198 RunBuffer,
1199 Vcb->NtfsInfo.BytesPerFileRecord,
1200 &RunBufferSize);
1201
1202 // Update HighestVCN
1203 DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
1204
1205 /* Only these headers have the field; in others its offset is the name or the runs */
1207 DestinationAttribute->NonResident.CompressedSize = AttrContext->pRecord->NonResident.CompressedSize;
1208
1209 // Write data runs to destination attribute
1210 RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
1211 RunBuffer,
1212 RunBufferSize);
1213
1214 // Is DestinationAttribute the last attribute in the file record?
1216 {
1217 // update attribute length
1218 DestinationAttribute->Length = ALIGN_UP_BY(AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize,
1219 ATTR_RECORD_ALIGNMENT);
1220
1222
1223 AttrContext->pRecord->Length = DestinationAttribute->Length;
1224
1225 // write end markers
1226 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)DestinationAttribute + DestinationAttribute->Length);
1228 }
1229
1230 // Update the file record
1232
1234
1235#if NTFS_DUMP_DATA_RUNS
1236 NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
1237#endif
1238
1240}
NTSTATUS NtfsWriteVolumeBitmap(_In_ PDEVICE_EXTENSION DeviceExt, _In_ ULONG FirstCluster, _In_ ULONG ClusterCount)
Definition: volinfo.c:167
#define ExAcquireResourceExclusiveLite(res, wait)
Definition: env_spec_w32.h:615
VOID NTAPI FsRtlTruncateLargeMcb(IN PLARGE_MCB Mcb, IN LONGLONG Vbn)
Definition: largemcb.c:1059
BOOLEAN NTAPI FsRtlLookupLargeMcbEntry(IN PLARGE_MCB Mcb, IN LONGLONG Vbn, OUT PLONGLONG Lbn OPTIONAL, OUT PLONGLONG SectorCountFromLbn OPTIONAL, OUT PLONGLONG StartingLbn OPTIONAL, OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL, OUT PULONG Index OPTIONAL)
Definition: largemcb.c:560
VOID FASTCALL ExReleaseResourceLite(IN PERESOURCE Resource)
Definition: resource.c:1822
Referenced by FatExamineFatEntries(), GetDiskFreeSpaceW(), HandleNotify(), NtfsDeleteFileRecord(), NtfsGetFreeClusters(), NtfsResizeAllocation(), NtfsTrimAllocation(), and SetNonResidentAttributeDataLength().
◆ FreeMftEntry()
| NTSTATUS FreeMftEntry | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONGLONG | MftIndex | ||
| ) |
Definition at line 3336 of file mft.c.
3338{
3341 ULONGLONG BitmapDataSize;
3342 ULONGLONG AttrBytesRead;
3345 ULONG LengthWritten;
3346 PNTFS_ATTR_CONTEXT BitmapContext;
3347 LARGE_INTEGER BitmapBits;
3348 PFILE_RECORD_HEADER FileRecord;
3349
3351
3352 // Mark the record itself as free first, so a bitmap bit is never handed out for a record
3353 // that still looks in use.
3354 FileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
3355 if (!FileRecord)
3357
3360 {
3362 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
3364 }
3365
3366 FileRecord->Flags &= ~FRH_IN_USE;
3367 FileRecord->SequenceNumber++;
3368
3369 // Sequence number zero is reserved to mean "no reference"
3371 FileRecord->SequenceNumber = 1;
3372
3374 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
3375
3377 {
3380 }
3381
3382 Status = FindAttribute(DeviceExt, DeviceExt->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
3384 {
3387 }
3388
3389 BitmapDataSize = AttributeDataLength(BitmapContext->pRecord);
3390
3391 // RtlInitializeBitmap wants a ULONG-aligned pointer and a ULONG-multiple of memory
3394 {
3395 ReleaseAttributeContext(BitmapContext);
3397 }
3399
3401
3403 if (AttrBytesRead != BitmapDataSize)
3404 {
3407 ReleaseAttributeContext(BitmapContext);
3409 }
3410
3412 DeviceExt->NtfsInfo.BytesPerFileRecord;
3414 {
3415 DPRINT1("\tFIXME: bitmap sizes beyond 32bits are not yet supported! (Your NTFS volume is too large)\n");
3417 ReleaseAttributeContext(BitmapContext);
3419 }
3420
3422 {
3425 ReleaseAttributeContext(BitmapContext);
3427 }
3428
3431
3432 Status = WriteAttribute(DeviceExt, BitmapContext, 0, BitmapData, BitmapDataSize, &LengthWritten, NULL);
3434 {
3436 }
3437
3439 ReleaseAttributeContext(BitmapContext);
3440
3442}
Referenced by NtfsDeleteFileRecord().
◆ GetAllocationOffsetFromVCN()
| ULONGLONG GetAllocationOffsetFromVCN | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONG | IndexBufferSize, | ||
| ULONGLONG | Vcn | ||
| ) |
Definition at line 1637 of file btree.c.
1640{
1641 if (IndexBufferSize < DeviceExt->NtfsInfo.BytesPerCluster)
1642 return Vcn * DeviceExt->NtfsInfo.BytesPerSector;
1643
1644 return Vcn * DeviceExt->NtfsInfo.BytesPerCluster;
1645}
Referenced by BrowseSubNodeIndexEntries(), CreateBTreeNodeFromIndexNode(), NtfsIndexNodeIsEmpty(), and UpdateIndexNode().
◆ GetBestFileNameFromRecord()
| PFILENAME_ATTRIBUTE GetBestFileNameFromRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 2015 of file attrib.c.
2017{
2019
2022 {
2025 {
2027 }
2028 }
2029
2031}
PFILENAME_ATTRIBUTE GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
Definition: attrib.c:1839
Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsGetNamesInformation(), NtfsGetParentMftIndex(), NtfsMakeFCBFromDirEntry(), NtfsMoonWalkID(), NtfsSetEndOfFile(), and NtfsUpdateDuplicatedInformation().
◆ GetFileNameAttributeLength()
| ULONG GetFileNameAttributeLength | ( | PFILENAME_ATTRIBUTE | FileNameAttribute | ) |
Definition at line 2008 of file attrib.c.
2009{
2010 ULONG Length = FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + (FileNameAttribute->NameLength * sizeof(WCHAR));
2012}
Referenced by CreateBTreeKeyFromFilename(), and ReplaceKeyIndexEntry().
◆ GetFileNameFromRecord()
| PFILENAME_ATTRIBUTE GetFileNameFromRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| UCHAR | NameType | ||
| ) |
Definition at line 1839 of file attrib.c.
1842{
1844 PNTFS_ATTR_RECORD Attribute;
1847
1850 {
1852 {
1857 {
1860 }
1861 }
1862
1864 }
1865
1868}
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 NameType
Definition: acpixf.h:658
Referenced by GetBestFileNameFromRecord(), NtfsGetBothDirectoryInformation(), and NtfsMakeRootFCB().
◆ GetIndexEntryVCN()
| ULONGLONG GetIndexEntryVCN | ( | PINDEX_ENTRY_ATTRIBUTE | IndexEntry | ) |
Definition at line 1648 of file btree.c.
1649{
1650 PULONGLONG Destination = (PULONGLONG)((ULONG_PTR)IndexEntry + IndexEntry->Length - sizeof(ULONGLONG));
1651
1653
1655}
Referenced by BrowseIndexEntries(), BrowseSubNodeIndexEntries(), NtfsIndexEntriesAreEmpty(), and SplitBTreeNode().
◆ GetLastClusterInDataRun()
| NTSTATUS GetLastClusterInDataRun | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_RECORD | Attribute, | ||
| PULONGLONG | LastCluster | ||
| ) |
Definition at line 1938 of file attrib.c.
1939{
1940 LONGLONG DataRunOffset;
1941 ULONGLONG DataRunLength;
1942 LONGLONG DataRunStartLCN;
1943
1944 ULONGLONG LastLCN = 0;
1946
1949
1950 while (1)
1951 {
1952 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1953
1954 if (DataRunOffset != -1)
1955 {
1956 // Normal data run.
1957 DataRunStartLCN = LastLCN + DataRunOffset;
1958 LastLCN = DataRunStartLCN;
1959 *LastCluster = LastLCN + DataRunLength - 1;
1960 }
1961
1962 if (*DataRun == 0)
1963 break;
1964 }
1965
1967}
◆ GetPackedByteCount()
GetPackedByteCount Returns the minimum number of bytes needed to represent the value of a 64-bit number. Used to encode data runs.
Definition at line 1876 of file attrib.c.
1878{
1879 if (!IsSigned)
1880 {
1881 if (NumberToPack >= 0x0100000000000000)
1882 return 8;
1883 if (NumberToPack >= 0x0001000000000000)
1884 return 7;
1885 if (NumberToPack >= 0x0000010000000000)
1886 return 6;
1887 if (NumberToPack >= 0x0000000100000000)
1888 return 5;
1889 if (NumberToPack >= 0x0000000001000000)
1890 return 4;
1891 if (NumberToPack >= 0x0000000000010000)
1892 return 3;
1893 if (NumberToPack >= 0x0000000000000100)
1894 return 2;
1895 return 1;
1896 }
1897
1898 if (NumberToPack > 0)
1899 {
1900 // we have to make sure the number that gets encoded won't be interpreted as negative
1901 if (NumberToPack >= 0x0080000000000000)
1902 return 8;
1903 if (NumberToPack >= 0x0000800000000000)
1904 return 7;
1905 if (NumberToPack >= 0x0000008000000000)
1906 return 6;
1907 if (NumberToPack >= 0x0000000080000000)
1908 return 5;
1909 if (NumberToPack >= 0x0000000000800000)
1910 return 4;
1911 if (NumberToPack >= 0x0000000000008000)
1912 return 3;
1913 if (NumberToPack >= 0x0000000000000080)
1914 return 2;
1915 }
1916 else
1917 {
1918 // negative number
1919 if (NumberToPack <= 0xff80000000000000)
1920 return 8;
1921 if (NumberToPack <= 0xffff800000000000)
1922 return 7;
1923 if (NumberToPack <= 0xffffff8000000000)
1924 return 6;
1925 if (NumberToPack <= 0xffffffff80000000)
1926 return 5;
1927 if (NumberToPack <= 0xffffffffff800000)
1928 return 4;
1929 if (NumberToPack <= 0xffffffffffff8000)
1930 return 3;
1931 if (NumberToPack <= 0xffffffffffffff80)
1932 return 2;
1933 }
1934 return 1;
1935}
Referenced by ConvertLargeMCBToDataRuns().
◆ GetSizeOfIndexEntries()
| ULONG GetSizeOfIndexEntries | ( | PB_TREE_FILENAME_NODE | Node | ) |
Definition at line 860 of file btree.c.
861{
862 // Start summing the total size of this node's entries
863 ULONG NodeSize = 0;
864
865 // Walk through the list of Node Entries
869 {
871
872 // Add the length of the current node
874 CurrentKey = CurrentKey->NextKey;
875 }
876
877 return NodeSize;
878}
Referenced by AddFilenameToDirectoryWorker(), and NtfsInsertKey().
◆ GetStandardInformationFromRecord()
| PSTANDARD_INFORMATION GetStandardInformationFromRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 1970 of file attrib.c.
1972{
1975 PNTFS_ATTR_RECORD Attribute;
1976 PSTANDARD_INFORMATION StdInfo;
1977
1980 {
1982 {
1985 return StdInfo;
1986 }
1987
1989 }
1990
1993}
Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsMakeFCBFromDirEntry(), NtfsSetBasicInformation(), and NtfsUpdateDuplicatedInformation().
◆ InternalSetResidentAttributeLength()
| NTSTATUS InternalSetResidentAttributeLength | ( | PDEVICE_EXTENSION | DeviceExt, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONG | AttrOffset, | ||
| ULONG | DataSize | ||
| ) |
Definition at line 542 of file mft.c.
547{
549 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Destination + Destination->Length);
550 PNTFS_ATTR_RECORD FinalAttribute;
552 ULONG NextAttributeOffset;
553
554 DPRINT("InternalSetResidentAttributeLength( %p, %p, %p, %lu, %lu )\n", DeviceExt, AttrContext, FileRecord, AttrOffset, DataSize);
555
556 ASSERT(!AttrContext->pRecord->IsNonResident);
557
558 // Update ValueLength Field
560
561 // Calculate the record length and end marker offset
562 Destination->Length = ALIGN_UP_BY(DataSize + AttrContext->pRecord->Resident.ValueOffset, ATTR_RECORD_ALIGNMENT);
564
565 // Ensure NextAttributeOffset is aligned to an 8-byte boundary
567
568 // Will the new attribute be larger than the old one?
570 {
571 // Free the old copy of the attribute in the context, as it will be the wrong length
573
574 // Create a new copy of the attribute record for the context
576 if (!AttrContext->pRecord)
577 {
580 }
581 RtlZeroMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + OldAttributeLength), Destination->Length - OldAttributeLength);
583 }
584
585 // Are there attributes after this one that need to be moved?
587 {
588 // Move the attributes after this one
589 FinalAttribute = MoveAttributes(DeviceExt, NextAttribute, NextAttributeOffset, (ULONG_PTR)Destination + Destination->Length);
590 }
591 else
592 {
593 // advance to the final "attribute," adjust for the changed length of the attribute we're resizing
594 FinalAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute - OldAttributeLength + Destination->Length);
595 }
596
597 // Update pRecord's length
599 AttrContext->pRecord->Resident.ValueLength = DataSize;
600
601 // set the file record end
603
604 //NtfsDumpFileRecord(DeviceExt, FileRecord);
605
607}
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
Definition: ndis.h:4755
Referenced by AddFilenameToDirectoryWorker(), RemoveFilenameFromDirectoryWorker(), and SetResidentAttributeDataLength().
◆ MoveAttributes()
| PNTFS_ATTR_RECORD MoveAttributes | ( | PDEVICE_EXTENSION | DeviceExt, |
| PNTFS_ATTR_RECORD | FirstAttributeToMove, | ||
| ULONG | FirstAttributeOffset, | ||
| ULONG_PTR | MoveTo | ||
| ) |
Definition at line 512 of file mft.c.
516{
517 // Get the size of all attributes after this one
518 ULONG MemBlockSize = 0;
519 PNTFS_ATTR_RECORD CurrentAttribute = FirstAttributeToMove;
520 ULONG CurrentOffset = FirstAttributeOffset;
521 PNTFS_ATTR_RECORD FinalAttribute;
522
523 while (CurrentAttribute->Type != AttributeEnd && CurrentOffset < DeviceExt->NtfsInfo.BytesPerFileRecord)
524 {
525 CurrentOffset += CurrentAttribute->Length;
526 MemBlockSize += CurrentAttribute->Length;
528 }
529
530 FinalAttribute = (PNTFS_ATTR_RECORD)(MoveTo + MemBlockSize);
532
534
535 // Move the attributes after this one
537
538 return FinalAttribute;
539}
Referenced by AddRun(), and InternalSetResidentAttributeLength().
◆ NtfsAcqLazyWrite()
◆ NtfsAcqReadAhead()
◆ NtfsAddFCBToTable()
Definition at line 250 of file fcb.c.
Referenced by NtfsMakeFCBFromDirEntry(), and NtfsMakeRootFCB().
◆ NtfsAddFilenameToDirectory()
| NTSTATUS NtfsAddFilenameToDirectory | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONGLONG | DirectoryMftIndex, | ||
| ULONGLONG | FileReferenceNumber, | ||
| PFILENAME_ATTRIBUTE | FilenameAttribute, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 3049 of file mft.c.
3054{
3056
3057 KeEnterCriticalRegion();
3059 Status = AddFilenameToDirectoryWorker(DeviceExt, DirectoryMftIndex, FileReferenceNumber, FilenameAttribute, CaseSensitive);
3060 ExReleaseResourceLite(&DeviceExt->IndexResource);
3061 KeLeaveCriticalRegion();
3062
3064}
static NTSTATUS AddFilenameToDirectoryWorker(PDEVICE_EXTENSION DeviceExt, ULONGLONG DirectoryMftIndex, ULONGLONG FileReferenceNumber, PFILENAME_ATTRIBUTE FilenameAttribute, BOOLEAN CaseSensitive)
Definition: mft.c:2704
Referenced by NtfsCommitRename(), NtfsCreateDirectory(), NtfsCreateFileRecord(), and NtfsRelinkFileNames().
◆ NtfsAddIoRun()
Definition at line 74 of file blockdev.c.
77{
78 PNTFS_IO_RUN LastRun;
79 PNTFS_IO_RUN NewRuns;
80 ULONG NewCapacity;
81
84
85 /* Does this piece simply continue the previous one? */
86 if (RunList->Count != 0)
87 {
88 LastRun = &RunList->Runs[RunList->Count - 1];
89
94 {
96 RunList->TotalLength += ByteCount;
98 }
99 }
100
101 if (RunList->Count == RunList->Capacity)
102 {
103 NewCapacity = RunList->Capacity * 2;
104
105 /* Non-paged: a run list stays live across the transfer, and a request
106 * on the paging path must not fault while walking it. */
109 TAG_IO_RUNS);
111 {
114 }
115
117
118 if (RunList->Runs != RunList->StackRuns)
119 {
121 }
122
123 RunList->Runs = NewRuns;
124 RunList->Capacity = NewCapacity;
125 }
126
127 LastRun = &RunList->Runs[RunList->Count];
129 LastRun->BufferOffset = RunList->TotalLength;
132
133 RunList->Count++;
134 RunList->TotalLength += ByteCount;
135
137}
Definition: ntfs.h:518
_Must_inspect_result_ typedef _In_ PHYSICAL_ADDRESS _In_ LARGE_INTEGER ByteCount
Definition: iotypes.h:1099
Referenced by NtfsMapAttributeRuns(), NtfsReadDisk(), NtfsReadWriteVolume(), and NtfsWriteDisk().
◆ NtfsAllocateClusters()
| NTSTATUS NtfsAllocateClusters | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONG | FirstDesiredCluster, | ||
| ULONG | DesiredClusters, | ||
| PULONG | FirstAssignedCluster, | ||
| PULONG | AssignedClusters | ||
| ) |
NtfsAllocateClusters Allocates a run of clusters. The run allocated might be smaller than DesiredClusters.
Definition at line 213 of file volinfo.c.
218{
221 ULONG AssignedRun;
222
223 DPRINT("NtfsAllocateClusters(%p, %lu, %lu, %p, %p)\n", DeviceExt, FirstDesiredCluster, DesiredClusters, FirstAssignedCluster, AssignedClusters);
224
225 *AssignedClusters = 0;
226
227 /* Files growing in parallel must not both claim the same free run */
228 KeEnterCriticalRegion();
230
231 if (DeviceExt->FreeClusterCount < DesiredClusters)
232 {
234 goto Quit;
235 }
236
237 /* The hint is just past the file's last cluster, which can be past the volume end */
239 FirstDesiredCluster = 0;
240
241 // TODO: Observe MFT reservation zone
242
243 // Can we get one contiguous run?
245
246 if (AssignedRun != 0xFFFFFFFF)
247 {
248 *FirstAssignedCluster = AssignedRun;
249 *AssignedClusters = DesiredClusters;
250 }
251 else
252 {
253 // we can't get one contiguous run
254 *AssignedClusters = RtlFindNextForwardRunClear(Bitmap, FirstDesiredCluster, FirstAssignedCluster);
255
256 if (*AssignedClusters == 0)
257 {
258 // we couldn't find any runs starting at DesiredFirstCluster
260 }
261
262 if (*AssignedClusters == 0)
263 {
265 goto Quit;
266 }
267
268 /* Hand out no more than was asked for, and mark it in use */
269 *AssignedClusters = min(*AssignedClusters, DesiredClusters);
271 }
272
275 {
276 DeviceExt->FreeClusterCount -= *AssignedClusters;
277 }
278 else
279 {
280 /* Keep the copy in step with what the disk says */
282 *AssignedClusters = 0;
283 }
284
285Quit:
286 ExReleaseResourceLite(&DeviceExt->BitmapResource);
287 KeLeaveCriticalRegion();
288
290}
NTSTATUS NtfsWriteVolumeBitmap(_In_ PDEVICE_EXTENSION DeviceExt, _In_ ULONG FirstCluster, _In_ ULONG ClusterCount)
Definition: volinfo.c:167
Referenced by NtfsExtendAllocation().
◆ NtfsAllocateIrpContext()
| PNTFS_IRP_CONTEXT NtfsAllocateIrpContext | ( | PDEVICE_OBJECT | DeviceObject, |
| PIRP | Irp | ||
| ) |
Definition at line 66 of file misc.c.
68{
69 PNTFS_IRP_CONTEXT IrpContext;
70
72
73 IrpContext = (PNTFS_IRP_CONTEXT)ExAllocateFromNPagedLookasideList(&NtfsGlobalData->IrpContextLookasideList);
76
78
90
97 {
99 }
100
101 return IrpContext;
102}
static PIO_STACK_LOCATION IoGetCurrentIrpStackLocation(PIRP Irp)
Definition: Bus_PDO_EvalMethod.c:152
struct NTFS_IRP_CONTEXT * PNTFS_IRP_CONTEXT
NPAGED_LOOKASIDE_LIST IrpContextLookasideList
Definition: ntfs.h:179
Definition: ntfs.h:554
#define IRP_MJ_FILE_SYSTEM_CONTROL
#define IRP_MJ_SHUTDOWN
#define IRP_MJ_CLEANUP
Referenced by NtfsFsdDispatch().
◆ NtfsAttachFCBToFileObject()
| NTSTATUS NtfsAttachFCBToFileObject | ( | PNTFS_VCB | Vcb, |
| PNTFS_FCB | Fcb, | ||
| PFILE_OBJECT | FileObject | ||
| ) |
Definition at line 533 of file fcb.c.
536{
537 PNTFS_CCB newCCB;
538
541 {
543 }
544
546
549
552 FileObject->FsContext2 = newCCB;
555
556 /* Directories are excluded: they have no $DATA to map, and a data section on one gives Mm
557 * pages to fault in that we can never satisfy. */
559 {
560 _SEH2_TRY
561 {
564 FALSE,
566 Fcb);
567 }
569 {
573 }
574 _SEH2_END;
575
577 }
578
579 //DPRINT("file open: fcb:%x file size: %d\n", Fcb, Fcb->Entry.DataLengthL);
580
582}
VOID NTAPI CcInitializeCacheMap(IN PFILE_OBJECT FileObject, IN PCC_FILE_SIZES FileSizes, IN BOOLEAN PinAccess, IN PCACHE_MANAGER_CALLBACKS Callbacks, IN PVOID LazyWriteContext)
Definition: fssup.c:195
Definition: ntfs.h:151
Definition: cctypes.h:14
Referenced by NtfsCreateFile(), NtfsOpenFile(), NtfsOpenFileById(), and NtfsOpenTargetDirectory().
◆ NtfsCleanup()
| NTSTATUS NtfsCleanup | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 171 of file cleanup.c.
172{
173 PDEVICE_EXTENSION DeviceExtension;
177
179
182 {
186 }
187
189 DeviceExtension = DeviceObject->DeviceExtension;
190
193 {
195 }
196
197 /* The handle is going away, and so are the locks it took */
199 {
201 FileObject,
203 NULL);
204 }
205
206 Status = NtfsCleanupFile(DeviceExtension, FileObject, BooleanFlagOn(IrpContext->Flags, IRPCONTEXT_CANWAIT));
207
208 ExReleaseResourceLite(&DeviceExtension->DirResource);
209
211 {
213 }
214
217}
NTSTATUS NtfsCleanupFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CanWait)
Definition: cleanup.c:40
FORCEINLINE NTSTATUS NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext)
Definition: ntfs.h:652
NTSTATUS NTAPI FsRtlFastUnlockAll(IN PFILE_LOCK FileLock, IN PFILE_OBJECT FileObject, IN PEPROCESS Process, IN PVOID Context OPTIONAL)
Definition: filelock.c:1027
BOOLEAN NTAPI NtfsIsRegularFileObject(_In_ PFILE_OBJECT FileObject)
Definition: fcb.c:153
Definition: beep.c:22
Definition: env_spec_w32.h:413
Definition: cdstruc.h:902
Referenced by NtfsDispatch().
◆ NtfsClose()
| NTSTATUS NtfsClose | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 87 of file close.c.
88{
89 PDEVICE_EXTENSION DeviceExtension;
93
95
98 {
102 }
103
105 DeviceExtension = DeviceObject->DeviceExtension;
106
109 {
111 }
112
114
115 ExReleaseResourceLite(&DeviceExtension->DirResource);
116
118 {
120 }
121
124}
NTSTATUS NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject)
Definition: close.c:40
◆ NtfsCloseFile()
| NTSTATUS NtfsCloseFile | ( | PDEVICE_EXTENSION | DeviceExt, |
| PFILE_OBJECT | FileObject | ||
| ) |
Definition at line 40 of file close.c.
42{
45
47 DeviceExt,
48 FileObject);
49
52
55 {
57 }
58
61
62 /* SectionObjectPointer is deliberately left alone. Mm reaches the file's section object
63 * pointers through it for as long as a section exists, which outlasts the handle. */
64
65 DeviceExt->OpenHandleCount--;
66
68 {
69 // This a FO, that was created outside from FSD.
70 // Some FO's are created with IoCreateStreamFileObject() insid from FSD.
71 // This FO's don't have a FileName.
73 }
74
76 {
78 }
79
81
83}
struct NTFS_CCB * PNTFS_CCB
struct _FCB * PNTFS_FCB
Referenced by NtfsClose(), and NtfsCreateFile().
◆ NtfsCreate()
| NTSTATUS NtfsCreate | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 824 of file create.c.
825{
826 PDEVICE_EXTENSION DeviceExt;
829
832 {
833 /* DeviceObject represents FileSystem instead of logical volume */
837 }
838
839 DeviceExt = DeviceObject->DeviceExtension;
840
842 {
844 }
845
846 ExAcquireResourceExclusiveLite(&DeviceExt->DirResource,
847 TRUE);
849 IrpContext);
850 ExReleaseResourceLite(&DeviceExt->DirResource);
851
853}
static NTSTATUS NtfsCreateFile(PDEVICE_OBJECT DeviceObject, PNTFS_IRP_CONTEXT IrpContext)
Definition: create.c:497
Referenced by NtfsDispatch().
◆ NtfsCreateDirectory()
| NTSTATUS NtfsCreateDirectory | ( | PDEVICE_EXTENSION | DeviceExt, |
| PFILE_OBJECT | FileObject, | ||
| BOOLEAN | CaseSensitive, | ||
| BOOLEAN | CanWait | ||
| ) |
Definition at line 883 of file create.c.
887{
888
890 PFILE_RECORD_HEADER FileRecord;
891 PNTFS_ATTR_RECORD NextAttribute;
892 PFILENAME_ATTRIBUTE FilenameAttribute;
893 ULONGLONG ParentMftIndex;
894 ULONGLONG FileMftIndex;
896 PINDEX_ROOT_ATTRIBUTE NewIndexRoot;
897 ULONG MaxIndexRootSize;
898 ULONG RootLength;
899
901 DeviceExt,
902 FileObject,
903 CaseSensitive ? "TRUE" : "FALSE",
904 CanWait ? "TRUE" : "FALSE");
905
906 // Start with an empty file record
907 FileRecord = NtfsCreateEmptyFileRecord(DeviceExt);
908 if (!FileRecord)
909 {
912 }
913
914 // Set the directory flag
916
917 // find where the first attribute will be added
919
920 // add first attribute, $STANDARD_INFORMATION
921 AddStandardInformation(FileRecord, NextAttribute);
922
923 // advance NextAttribute pointer to the next attribute
924 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute + (ULONG_PTR)NextAttribute->Length);
925
926 // Add the $FILE_NAME attribute
927 Status = AddFileName(FileRecord, NextAttribute, DeviceExt, FileObject, CaseSensitive, &ParentMftIndex);
929 {
931 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
933 }
934
935 // save a pointer to the filename attribute
936 FilenameAttribute = (PFILENAME_ATTRIBUTE)((ULONG_PTR)NextAttribute + NextAttribute->Resident.ValueOffset);
937
938 // advance NextAttribute pointer to the next attribute
939 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute + (ULONG_PTR)NextAttribute->Length);
940
941 // Create an empty b-tree to represent our new index
944 {
946 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
948 }
949
950 // Calculate maximum size of index root
951 MaxIndexRootSize = DeviceExt->NtfsInfo.BytesPerFileRecord
954
955 // Create a new index record from the tree
957 Tree,
958 MaxIndexRootSize,
959 &NewIndexRoot,
960 &RootLength);
962 {
965 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
967 }
968
969 // We're done with the B-Tree
971
972 // add the $INDEX_ROOT attribute
973 Status = AddIndexRoot(DeviceExt, FileRecord, NextAttribute, NewIndexRoot, RootLength, L"$I30", 4);
975 {
978 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
980 }
981
982
983#ifndef NDEBUG
984 NtfsDumpFileRecord(DeviceExt, FileRecord);
985#endif
986
987 // Now that we've built the file record in memory, we need to store it in the MFT.
990 {
991 // The highest 2 bytes should be the sequence number, unless the parent happens to be root
994 else
996
998
999 // Add the filename attribute to the filename-index of the parent directory
1001 ParentMftIndex,
1002 FileMftIndex,
1003 FilenameAttribute,
1004 CaseSensitive);
1005 }
1006
1008 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
1009
1011}
NTSTATUS CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG MaxIndexSize, PINDEX_ROOT_ATTRIBUTE *IndexRoot, ULONG *Length)
Definition: btree.c:915
NTSTATUS AddIndexRoot(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PINDEX_ROOT_ATTRIBUTE NewIndexRoot, ULONG RootLength, PCWSTR Name, USHORT NameLength)
Definition: attrib.c:487
NTSTATUS AddFileName(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, PULONGLONG ParentMftIndex)
Definition: attrib.c:234
NTSTATUS AddStandardInformation(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
Definition: attrib.c:783
PFILE_RECORD_HEADER NtfsCreateEmptyFileRecord(PDEVICE_EXTENSION DeviceExt)
Definition: create.c:1026
NTSTATUS NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt, ULONGLONG DirectoryMftIndex, ULONGLONG FileReferenceNumber, PFILENAME_ATTRIBUTE FilenameAttribute, BOOLEAN CaseSensitive)
Definition: mft.c:3049
VOID NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:4342
Referenced by NtfsCreateFile().
◆ NtfsCreateEmptyFileRecord()
| PFILE_RECORD_HEADER NtfsCreateEmptyFileRecord | ( | PDEVICE_EXTENSION | DeviceExt | ) |
Definition at line 1026 of file create.c.
1027{
1028 PFILE_RECORD_HEADER FileRecord;
1029 PNTFS_ATTR_RECORD NextAttribute;
1030
1032
1033 // allocate memory for file record
1034 FileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
1035 if (!FileRecord)
1036 {
1039 }
1040
1041 RtlZeroMemory(FileRecord, DeviceExt->NtfsInfo.BytesPerFileRecord);
1042
1044
1045 // calculate USA offset and count
1046 FileRecord->Ntfs.UsaOffset = FIELD_OFFSET(FILE_RECORD_HEADER, MFTRecordNumber) + sizeof(ULONG);
1047
1048 // size of USA (in ULONG's) will be 1 (for USA number) + 1 for every sector the file record uses
1049 FileRecord->BytesAllocated = DeviceExt->NtfsInfo.BytesPerFileRecord;
1050 FileRecord->Ntfs.UsaCount = (FileRecord->BytesAllocated / DeviceExt->NtfsInfo.BytesPerSector) + 1;
1051
1052 // setup other file record fields
1053 FileRecord->SequenceNumber = 1;
1058
1059 // find where the first attribute will be added
1061
1062 // mark the (temporary) end of the file-record
1065
1066 return FileRecord;
1067}
Referenced by IncreaseMftSize(), NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ NtfsCreateFCB()
Definition at line 67 of file fcb.c.
70{
72
75
78 {
80 }
81
83
86
88
90 {
93 {
95 }
96 else
97 {
99 }
100 }
101
103 {
105 }
106 else
107 {
109 }
110
114
117
118 /* NtfsFastIoCheckIfPossible decides per request */
120
122}
VOID NTAPI FsRtlInitializeFileLock(IN PFILE_LOCK FileLock, IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL, IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL)
Definition: filelock.c:1266
#define UNICODE_NULL
Referenced by NtfsGetVolumeData(), NtfsMakeFCBFromDirEntry(), NtfsMakeRootFCB(), and NtfsMountVolume().
◆ NtfsCreateFileRecord()
| NTSTATUS NtfsCreateFileRecord | ( | PDEVICE_EXTENSION | DeviceExt, |
| PFILE_OBJECT | FileObject, | ||
| BOOLEAN | CaseSensitive, | ||
| BOOLEAN | CanWait | ||
| ) |
Definition at line 1094 of file create.c.
1098{
1100 PFILE_RECORD_HEADER FileRecord;
1101 PNTFS_ATTR_RECORD NextAttribute;
1102 PFILENAME_ATTRIBUTE FilenameAttribute;
1103 ULONGLONG ParentMftIndex;
1104 ULONGLONG FileMftIndex;
1105
1107 DeviceExt,
1108 FileObject,
1109 CaseSensitive ? "TRUE" : "FALSE",
1110 CanWait ? "TRUE" : "FALSE");
1111
1112 // allocate memory for file record
1113 FileRecord = NtfsCreateEmptyFileRecord(DeviceExt);
1114 if (!FileRecord)
1115 {
1118 }
1119
1120 // find where the first attribute will be added
1122
1123 // add first attribute, $STANDARD_INFORMATION
1124 AddStandardInformation(FileRecord, NextAttribute);
1125
1126 // advance NextAttribute pointer to the next attribute
1127 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute + (ULONG_PTR)NextAttribute->Length);
1128
1129 // Add the $FILE_NAME attribute
1130 Status = AddFileName(FileRecord, NextAttribute, DeviceExt, FileObject, CaseSensitive, &ParentMftIndex);
1132 {
1134 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
1136 }
1137
1138 // save a pointer to the filename attribute
1139 FilenameAttribute = (PFILENAME_ATTRIBUTE)((ULONG_PTR)NextAttribute + NextAttribute->Resident.ValueOffset);
1140
1141 // advance NextAttribute pointer to the next attribute
1142 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute + (ULONG_PTR)NextAttribute->Length);
1143
1144 // add the $DATA attribute
1145 AddData(FileRecord, NextAttribute);
1146
1147#ifndef NDEBUG
1148 // dump file record in memory (for debugging)
1149 NtfsDumpFileRecord(DeviceExt, FileRecord);
1150#endif
1151
1152 // Now that we've built the file record in memory, we need to store it in the MFT.
1155 {
1156 // The highest 2 bytes should be the sequence number, unless the parent happens to be root
1159 else
1161
1163
1164 // Add the filename attribute to the filename-index of the parent directory
1166 ParentMftIndex,
1167 FileMftIndex,
1168 FilenameAttribute,
1169 CaseSensitive);
1170 }
1171
1172 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
1173
1175}
NTSTATUS AddData(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
Definition: attrib.c:164
Referenced by NtfsCreateFile().
◆ NtfsDeleteFileRecord()
| NTSTATUS NtfsDeleteFileRecord | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONGLONG | MftIndex, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 3470 of file mft.c.
3473{
3475 PFILE_RECORD_HEADER FileRecord;
3476 PNTFS_ATTR_RECORD Attribute;
3477 PNTFS_ATTR_CONTEXT AttributeContext;
3478 ULONG AttributeOffset;
3479
3480 DPRINT("NtfsDeleteFileRecord(%p, %I64u, %s)\n", DeviceExt, MftIndex, CaseSensitive ? "TRUE" : "FALSE");
3481
3482 FileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
3483 if (!FileRecord)
3485
3488 {
3490 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
3492 }
3493
3494 // Remove every name this file has from its parent's index before anything is freed, so a
3495 // failure leaves the file whole instead of an entry pointing at a released record. A file
3496 // with both a long name and an 8.3 name is indexed twice, and both parents are named by
3497 // the attributes themselves.
3499 AttributeOffset = FileRecord->AttributeOffset;
3500
3501 while (AttributeOffset < DeviceExt->NtfsInfo.BytesPerFileRecord &&
3503 {
3505 {
3508
3511 FileName,
3512 CaseSensitive);
3514 {
3516 FileName->NameLength,
3519 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
3521 }
3522 }
3523
3525 break;
3526
3527 AttributeOffset += Attribute->Length;
3529 }
3530
3531 // Release the clusters held by every non-resident attribute
3533 AttributeOffset = FileRecord->AttributeOffset;
3534
3535 while (AttributeOffset < DeviceExt->NtfsInfo.BytesPerFileRecord &&
3537 {
3539 {
3541 FileRecord,
3542 Attribute->Type,
3544 Attribute->NameLength,
3545 &AttributeContext,
3546 NULL);
3548 {
3549 ULONGLONG ClusterCount = Attribute->NonResident.HighestVCN - Attribute->NonResident.LowestVCN + 1;
3550
3551 Status = FreeClusters(DeviceExt, AttributeContext, AttributeOffset, FileRecord, (ULONG)ClusterCount);
3553 {
3555 Attribute->Type, MftIndex);
3556 }
3557
3558 ReleaseAttributeContext(AttributeContext);
3559 }
3560 }
3561
3563 break;
3564
3565 AttributeOffset += Attribute->Length;
3567 }
3568
3569 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
3570
3572}
NTSTATUS FreeClusters(PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONG ClustersToFree)
Definition: attrib.c:1101
NTSTATUS NtfsRemoveFilenameFromDirectory(PDEVICE_EXTENSION DeviceExt, ULONGLONG DirectoryMftIndex, PFILENAME_ATTRIBUTE FilenameAttribute, BOOLEAN CaseSensitive)
Definition: mft.c:3297
NTSTATUS FreeMftEntry(PDEVICE_EXTENSION DeviceExt, ULONGLONG MftIndex)
Definition: mft.c:3336
Referenced by NtfsCleanupFile(), and NtfsClearRenameTarget().
◆ NtfsDestroyFCB()
Definition at line 126 of file fcb.c.
127{
130
131 /* The volume stream belongs to the VCB */
134
138
140}
VOID NTAPI FsRtlUninitializeFileLock(IN PFILE_LOCK FileLock)
Definition: filelock.c:1283
Referenced by NtfsReleaseFCB().
◆ NtfsDeviceControl()
| NTSTATUS NtfsDeviceControl | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 36 of file devctl.c.
37{
38 PDEVICE_EXTENSION DeviceExt;
40
43
44 /* Lower driver will complete - we don't have to */
45 IrpContext->Flags &= ~IRPCONTEXT_COMPLETE;
46
48}
Definition: Bus_PDO_EvalMethod.c:107
Referenced by NtfsDispatch().
◆ NtfsDeviceIoControl()
| NTSTATUS NtfsDeviceIoControl | ( | IN PDEVICE_OBJECT | DeviceObject, |
| IN ULONG | ControlCode, | ||
| IN PVOID | InputBuffer, | ||
| IN ULONG | InputBufferSize, | ||
| IN OUT PVOID | OutputBuffer, | ||
| IN OUT PULONG | OutputBufferSize, | ||
| IN BOOLEAN | Override | ||
| ) |
Definition at line 1029 of file blockdev.c.
1036{
1042
1044
1046 IoStatus.Information = 0;
1047
1050 DeviceObject,
1051 InputBuffer,
1052 InputBufferSize,
1053 OutputBuffer,
1055 FALSE,
1056 &Event,
1057 &IoStatus);
1059 {
1062 }
1063
1064 if (Override)
1065 {
1068 }
1069
1073 {
1076 }
1077
1079 {
1081 }
1082
1084}
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
Definition: env_spec_w32.h:478
__in UCHAR __in POWER_STATE __in_opt PVOID __in PIO_STATUS_BLOCK IoStatus
Definition: mxum.h:159
PIRP NTAPI IoBuildDeviceIoControlRequest(IN ULONG IoControlCode, IN PDEVICE_OBJECT DeviceObject, IN PVOID InputBuffer, IN ULONG InputBufferLength, IN PVOID OutputBuffer, IN ULONG OutputBufferLength, IN BOOLEAN InternalDeviceIoControl, IN PKEVENT Event, IN PIO_STATUS_BLOCK IoStatusBlock)
Definition: irp.c:913
Definition: Bus_PDO_EvalMethod.c:95
Definition: env_spec_w32.h:870
Definition: ketypes.h:879
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
Definition: wdfiotarget.h:863
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
Definition: wdfiotarget.h:953
__drv_aliasesMem FORCEINLINE PIO_STACK_LOCATION IoGetNextIrpStackLocation(_In_ PIRP Irp)
Definition: iofuncs.h:2702
Referenced by NtfsGetVolumeData(), and NtfsHasFileSystem().
◆ NtfsDirectoryControl()
| NTSTATUS NtfsDirectoryControl | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 793 of file dirctl.c.
794{
796
798
799 /* Handlers that fill the caller's buffer overwrite this with the byte count */
801
803 {
806 break;
807
811 break;
812
813 default:
815 break;
816 }
817
819 {
821 }
822
824}
Referenced by NtfsDispatch().
◆ NtfsDumpData()
Definition at line 4305 of file mft.c.
4306{
4308
4309 // dump binary data, 8 bytes at a time
4311 {
4312 // display current offset, in hex
4314
4315 // display hex value of each of the next 8 bytes
4319 }
4320}
Definition: bufpool.h:45
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint GLint GLint j
Definition: glfuncs.h:250
◆ NtfsDumpDataRuns()
Definition at line 1785 of file attrib.c.
1787{
1788 PUCHAR DataRun = StartOfRun;
1789 LONGLONG DataRunOffset;
1790 ULONGLONG DataRunLength;
1791
1792 if (CurrentLCN == 0)
1793 {
1795 NtfsDumpDataRunData(StartOfRun);
1797 }
1798
1799 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1800
1801 if (DataRunOffset != -1)
1802 CurrentLCN += DataRunOffset;
1803
1805 if (DataRunOffset < 99999)
1808 if (CurrentLCN < 99999)
1811
1812 if (*DataRun == 0)
1814 else
1815 NtfsDumpDataRuns(DataRun, CurrentLCN);
1816}
Referenced by AddRun(), FreeClusters(), and NtfsDumpDataRuns().
◆ NtfsDumpFileAttributes()
| VOID NtfsDumpFileAttributes | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 1820 of file attrib.c.
1822{
1825 PNTFS_ATTR_RECORD Attribute;
1826
1829 {
1831
1833 }
1834
1836}
static VOID NtfsDumpAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_RECORD Attribute)
Definition: attrib.c:1647
Referenced by IncreaseMftSize(), NtfsDumpFileRecord(), NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsGetNamesInformation(), and NtfsGetVolumeData().
◆ NtfsDumpFileRecord()
| VOID NtfsDumpFileRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 4342 of file mft.c.
4344{
4346
4347 // dump binary data, 8 bytes at a time
4349 {
4350 // display current offset, in hex
4352
4353 // display hex value of each of the next 8 bytes
4357 }
4358
4360}
VOID NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: attrib.c:1820
Referenced by AddFilenameToDirectoryWorker(), NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ NtfsExtendAllocation()
| NTSTATUS NtfsExtendAllocation | ( | _In_ PDEVICE_EXTENSION | Vcb, |
| _In_ PNTFS_ATTR_CONTEXT | AttrContext, | ||
| _In_ ULONG | AttrOffset, | ||
| _In_ PFILE_RECORD_HEADER | FileRecord, | ||
| _In_ ULONGLONG | AllocationSize | ||
| ) |
Definition at line 753 of file mft.c.
759{
762 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
764 ULONG ClustersNeeded;
765 ULONG DesiredCluster = 0;
766 LONGLONG LastVbn;
767 LONGLONG LastLbn;
768 ULONG NextAssignedCluster;
769 ULONG AssignedClusters;
770
771 ASSERT(AttrContext->pRecord->IsNonResident);
773
776
778
779 /* Ask for the clusters right after the last one the stream owns. The
780 * tail of a sparse stream is a hole, so look at the last mapping, not
781 * at HighestVCN. */
782 if (ExistingClusters != 0 &&
783 FsRtlLookupLastLargeMcbEntry(&AttrContext->DataRunsMCB, &LastVbn, &LastLbn) &&
784 LastLbn != -1)
785 {
786 DesiredCluster = (ULONG)LastLbn + 1;
787 }
788
791
792 while (ClustersNeeded > 0)
793 {
795 DesiredCluster,
796 ClustersNeeded,
797 &NextAssignedCluster,
798 &AssignedClusters);
799
801 {
804 }
805
806 // now we need to add the clusters we allocated to the data run
807 Status = AddRun(Vcb, AttrContext, AttrOffset, FileRecord, NextAssignedCluster, AssignedClusters);
809 {
812 }
813
814 /* AddRun() places the next run after HighestVCN only once the
815 * attribute owns clusters, so count these before looping */
816 AttrContext->pRecord->NonResident.AllocatedSize += (ULONGLONG)AssignedClusters * BytesPerCluster;
817
818 ClustersNeeded -= AssignedClusters;
819 DesiredCluster = NextAssignedCluster + AssignedClusters;
820 }
821
822 DestinationAttribute->NonResident.AllocatedSize = AttrContext->pRecord->NonResident.AllocatedSize;
823 DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
824
826}
NTSTATUS AddRun(PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONGLONG NextAssignedCluster, ULONG RunLength)
Definition: attrib.c:591
NTSTATUS NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt, ULONG FirstDesiredCluster, ULONG DesiredClusters, PULONG FirstAssignedCluster, PULONG AssignedClusters)
Definition: volinfo.c:213
BOOLEAN NTAPI FsRtlLookupLastLargeMcbEntry(IN PLARGE_MCB Mcb, OUT PLONGLONG Vbn, OUT PLONGLONG Lbn)
Definition: largemcb.c:718
Referenced by NtfsGrowStream(), NtfsResizeAllocation(), and SetNonResidentAttributeDataLength().
◆ NtfsFCBInitializeCache()
Definition at line 334 of file fcb.c.
336{
339 PNTFS_CCB newCCB;
340
342
345 {
347 }
348
350
353
356 FileObject->FsContext2 = newCCB;
360
362 _SEH2_TRY
363 {
366 FALSE,
368 Fcb);
369 }
371 {
377 }
378 _SEH2_END;
379
380 /* The FCB keeps its reference, tearing down the cache map would otherwise free the stream */
382
384}
PFILE_OBJECT NTAPI IoCreateStreamFileObject(IN PFILE_OBJECT FileObject, IN PDEVICE_OBJECT DeviceObject)
Definition: file.c:3186
Referenced by NtfsMakeFCBFromDirEntry(), and NtfsMakeRootFCB().
◆ NtfsFCBIsCompressed()
Definition at line 173 of file fcb.c.
174{
176}
Referenced by NtfsCachedRead(), NtfsCachedWrite(), NtfsFastIoCheckIfPossible(), NtfsQueryDirectory(), NtfsReadFile(), and NtfsWriteFile().
◆ NtfsFCBIsDirectory()
Definition at line 144 of file fcb.c.
145{
147}
Referenced by NtfsAttachFCBToFileObject(), NtfsBuildRenamePath(), NtfsCleanupFile(), NtfsCreateFile(), NtfsGetFCBForFile(), NtfsGetStandardInformation(), NtfsIsRegularFileObject(), NtfsMakeAbsoluteFilename(), NtfsOpenTargetDirectory(), NtfsRead(), NtfsReleaseFCB(), NtfsSetAllocationInformation(), NtfsSetDispositionInformation(), and NtfsWrite().
◆ NtfsFCBIsEncrypted()
Definition at line 179 of file fcb.c.
180{
182}
Referenced by NtfsCachedRead(), NtfsFastIoCheckIfPossible(), and NtfsReadFile().
◆ NtfsFCBIsReparsePoint()
◆ NtfsFCBIsRoot()
Definition at line 185 of file fcb.c.
186{
188}
Referenced by NtfsBuildRenamePath(), NtfsMakeAbsoluteFilename(), NtfsMakeFCBFromDirEntry(), NtfsSetDispositionInformation(), and NtfsSetRenameInformation().
◆ NtfsFileFlagsToAttributes()
Definition at line 105 of file misc.c.
107{
108 *FileAttributes = NtfsAttributes;
110 {
111 *FileAttributes = NtfsAttributes & ~NTFS_FILE_TYPE_DIRECTORY;
113 }
114
115 if (NtfsAttributes == 0)
117}
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG FileAttributes
Definition: fltkernel.h:1236
Referenced by NtfsGetAttributeTagInformation(), NtfsGetBasicInformation(), NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), and NtfsGetNetworkOpenInformation().
◆ NtfsFileSystemControl()
| NTSTATUS NtfsFileSystemControl | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 1045 of file fsctl.c.
1046{
1050
1052
1056
1058 {
1062 break;
1063
1066 break;
1067
1071 break;
1072
1076 break;
1077
1078 default:
1081 break;
1082 }
1083
1085}
static NTSTATUS NtfsVerifyVolume(PDEVICE_OBJECT DeviceObject, PIRP Irp)
Definition: fsctl.c:608
static NTSTATUS NtfsMountVolume(PDEVICE_OBJECT DeviceObject, PIRP Irp)
Definition: fsctl.c:427
static NTSTATUS NtfsUserFsRequest(PDEVICE_OBJECT DeviceObject, PIRP Irp)
Definition: fsctl.c:978
Referenced by NtfsDispatch().
◆ NtfsFindFileAt()
| NTSTATUS NtfsFindFileAt | ( | PDEVICE_EXTENSION | Vcb, |
| PUNICODE_STRING | SearchPattern, | ||
| PULONG | FirstEntry, | ||
| PFILE_RECORD_HEADER * | FileRecord, | ||
| PULONGLONG | MFTIndex, | ||
| ULONGLONG | CurrentMFTIndex, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 4363 of file mft.c.
4370{
4372
4374 Vcb,
4375 SearchPattern,
4376 *FirstEntry,
4377 FileRecord,
4378 MFTIndex,
4379 CurrentMFTIndex,
4380 (CaseSensitive ? "TRUE" : "FALSE"));
4381
4382 Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, SearchPattern, FirstEntry, TRUE, CaseSensitive, &CurrentMFTIndex);
4384 {
4387 }
4388
4389 *FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
4391 {
4394 }
4395
4398 {
4400 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, *FileRecord);
4402 }
4403
4404 *MFTIndex = CurrentMFTIndex;
4405
4407}
NTSTATUS NtfsFindMftRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MFTIndex, PUNICODE_STRING FileName, PULONG FirstEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive, ULONGLONG *OutMFTIndex)
Definition: mft.c:4151
Referenced by NtfsQueryDirectory().
◆ NtfsFindMftRecord()
| NTSTATUS NtfsFindMftRecord | ( | PDEVICE_EXTENSION | Vcb, |
| ULONGLONG | MFTIndex, | ||
| PUNICODE_STRING | FileName, | ||
| PULONG | FirstEntry, | ||
| BOOLEAN | DirSearch, | ||
| BOOLEAN | CaseSensitive, | ||
| ULONGLONG * | OutMFTIndex | ||
| ) |
Definition at line 4151 of file mft.c.
4158{
4159 PFILE_RECORD_HEADER MftRecord;
4160 PNTFS_ATTR_CONTEXT IndexRootCtx;
4161 PINDEX_ROOT_ATTRIBUTE IndexRoot;
4162 PCHAR IndexRecord;
4163 PINDEX_ENTRY_ATTRIBUTE IndexEntry, IndexEntryEnd;
4165 ULONG CurrentEntry = 0;
4166
4168 Vcb,
4169 MFTIndex,
4170 FileName,
4171 *FirstEntry,
4172 DirSearch ? "TRUE" : "FALSE",
4173 CaseSensitive ? "TRUE" : "FALSE",
4174 OutMFTIndex);
4175
4176 MftRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
4178 {
4180 }
4181
4184 {
4185 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
4187 }
4188
4192 {
4193 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
4195 }
4196
4197 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerIndexRecord, TAG_NTFS);
4199 {
4200 ReleaseAttributeContext(IndexRootCtx);
4201 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
4203 }
4204
4206 IndexRoot = (PINDEX_ROOT_ATTRIBUTE)IndexRecord;
4207 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)&IndexRoot->Header + IndexRoot->Header.FirstEntryOffset);
4208 /* Index root is always resident. */
4209 /* TotalSizeOfEntries is measured from the index header, not from the
4210 * start of the attribute, and FirstEntryOffset above already is. */
4211 IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexRoot->Header + IndexRoot->Header.TotalSizeOfEntries);
4212 ReleaseAttributeContext(IndexRootCtx);
4213
4214 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb->NtfsInfo.BytesPerIndexRecord, IndexRoot->SizeOfEntry);
4215
4217 MftRecord,
4218 (PINDEX_ROOT_ATTRIBUTE)IndexRecord,
4219 IndexRoot->SizeOfEntry,
4220 IndexEntry,
4221 IndexEntryEnd,
4222 FileName,
4223 FirstEntry,
4224 &CurrentEntry,
4225 DirSearch,
4226 CaseSensitive,
4227 OutMFTIndex);
4228
4230 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
4231
4233}
struct INDEX_ROOT_ATTRIBUTE * PINDEX_ROOT_ATTRIBUTE
NTSTATUS BrowseIndexEntries(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, PINDEX_ROOT_ATTRIBUTE IndexRecord, ULONG IndexBlockSize, PINDEX_ENTRY_ATTRIBUTE FirstEntry, PINDEX_ENTRY_ATTRIBUTE LastEntry, PUNICODE_STRING FileName, PULONG StartEntry, PULONG CurrentEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive, ULONGLONG *OutMFTIndex)
Definition: mft.c:3976
Referenced by NtfsFindFileAt(), and NtfsLookupFileAt().
◆ NtfsFlushBuffers()
| NTSTATUS NtfsFlushBuffers | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 107 of file flush.c.
108{
109 PDEVICE_EXTENSION DeviceExt;
112 NTSTATUS DeviceStatus;
113
115
117
118 /* Nothing is mounted on the main device object */
120 {
122 }
123
125
127 {
129 }
130
131 /* Flushing waits on the disk */
134
135 /* Cached writes only reach the disk once the cache lets them go */
141 else
143
144 DeviceStatus = NtfsFlushDevice(DeviceExt->StorageDevice);
145
147}
static NTSTATUS NTAPI NtfsFlushVolumeFiles(_In_ PDEVICE_EXTENSION DeviceExt)
Definition: flush.c:36
static NTSTATUS NTAPI NtfsFlushFileCache(_In_ PNTFS_FCB Fcb)
Definition: flush.c:16
Referenced by NtfsDispatch().
◆ NtfsFlushDevice()
| NTSTATUS NtfsFlushDevice | ( | IN PDEVICE_OBJECT | DeviceObject | ) |
Definition at line 964 of file blockdev.c.
965{
966 NTFS_IO_CONTEXT IoContext;
970
973 {
976 }
977
981 IoContext.IrpCount = 1;
982
985
988 &IoContext,
989 TRUE,
990 TRUE,
991 TRUE);
992
994
996
998
1001 {
1003 }
1004
1006
1008}
#define IoSetCompletionRoutine(_Irp, _CompletionRoutine, _Context, _InvokeOnSuccess, _InvokeOnError, _InvokeOnCancel)
Definition: irp.cpp:490
static NTSTATUS NTAPI NtfsIoRunCompletionRoutine(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context)
Definition: blockdev.c:162
PIRP NTAPI IoAllocateIrp(IN CCHAR StackSize, IN BOOLEAN ChargeQuota)
Definition: irp.c:647
Definition: ntfs.h:538
#define IRP_MJ_FLUSH_BUFFERS
Referenced by NtfsFlushBuffers().
◆ NtfsFreeIoRunList()
| VOID NtfsFreeIoRunList | ( | IN OUT PNTFS_IO_RUN_LIST | RunList | ) |
Definition at line 140 of file blockdev.c.
141{
143 {
145 }
146
147 RunList->Runs = NULL;
148 RunList->Count = 0;
149 RunList->Capacity = 0;
150 RunList->TotalLength = 0;
151}
Referenced by NtfsReadDisk(), NtfsReadWriteVolume(), NtfsWriteDisk(), ReadAttributeToIrp(), and WriteAttributeFromIrp().
◆ NtfsFreeVolumeBitmap()
| VOID NtfsFreeVolumeBitmap | ( | _In_ PDEVICE_EXTENSION | DeviceExt | ) |
Definition at line 132 of file volinfo.c.
134{
136 {
138 DeviceExt->BitmapBuffer = NULL;
139 }
140
142 {
143 ReleaseAttributeContext(DeviceExt->BitmapContext);
144 DeviceExt->BitmapContext = NULL;
145 }
146}
Referenced by NtfsLoadVolumeBitmap().
◆ NtfsFsdDispatch()
| NTSTATUS NTAPI NtfsFsdDispatch | ( | PDEVICE_OBJECT | DeviceObject, |
| PIRP | Irp | ||
| ) |
Definition at line 197 of file dispatch.c.
199{
202
204
207 {
211 }
212 else
213 {
215 }
216
218}
PNTFS_IRP_CONTEXT NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, PIRP Irp)
Definition: misc.c:66
◆ NtfsGetFCBForFile()
| NTSTATUS NtfsGetFCBForFile | ( | PNTFS_VCB | Vcb, |
| PNTFS_FCB * | pParentFCB, | ||
| PNTFS_FCB * | pFCB, | ||
| PCWSTR | pFileName, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 674 of file fcb.c.
679{
683 PCWSTR currentElement;
685 PNTFS_FCB parentFCB;
686
688 Vcb,
689 pParentFCB,
690 pFCB,
691 pFileName,
692 CaseSensitive ? "TRUE" : "FALSE");
693
694 /* Dummy code */
695// FCB = NtfsOpenRootFCB(Vcb);
696// *pFCB = FCB;
697// *pParentFCB = NULL;
698
699#if 1
700 /* Trivial case, open of the root directory on volume */
702 {
704
706 *pFCB = FCB;
707 *pParentFCB = NULL;
708
710 }
711 else
712 {
713 currentElement = pFileName + 1;
716 }
717
718 parentFCB = NULL;
719
720 /* Parse filename and check each path element for existence and access */
722 {
723 /* Skip blank directory levels */
725 {
726 currentElement++;
727 continue;
728 }
729
732
733 /* Descend to next directory level */
734 if (parentFCB)
735 {
737 parentFCB = NULL;
738 }
739
740 /* fail if element in FCB is not a directory */
742 {
744
746 FCB = 0;
747 *pParentFCB = NULL;
748 *pFCB = NULL;
749
751 }
752
753 parentFCB = FCB;
754
755 /* Extract next directory level into dirName */
756 NtfsWSubString(pathName,
757 pFileName,
758 NtfsGetNextPathElement(currentElement) - pFileName);
760
763 {
764 NtfsWSubString(elementName,
765 currentElement,
766 NtfsGetNextPathElement(currentElement) - currentElement);
768
771 {
772 *pParentFCB = parentFCB;
773 *pFCB = NULL;
774 currentElement = NtfsGetNextPathElement(currentElement);
776 {
778 }
779 else
780 {
782 }
783 }
785 {
787 *pParentFCB = NULL;
788 *pFCB = NULL;
789
791 }
792 }
793
794 currentElement = NtfsGetNextPathElement(currentElement);
795 }
796
797 *pParentFCB = parentFCB;
798 *pFCB = FCB;
799#endif
800
802}
struct _FCB FCB
static VOID NtfsWSubString(PWCHAR pTarget, PCWSTR pSource, size_t pLength)
Definition: fcb.c:57
PNTFS_FCB NtfsGrabFCBFromTable(PNTFS_VCB Vcb, PCWSTR FileName)
Definition: fcb.c:291
static NTSTATUS NtfsDirFindFile(PNTFS_VCB Vcb, PNTFS_FCB DirectoryFcb, PWSTR FileToFind, BOOLEAN CaseSensitive, PNTFS_FCB *FoundFCB)
Definition: fcb.c:586
Referenced by NtfsOpenFile(), and NtfsOpenTargetDirectory().
◆ NtfsGetFileSize()
| ULONGLONG NtfsGetFileSize | ( | PDEVICE_EXTENSION | DeviceExt, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PCWSTR | Stream, | ||
| ULONG | StreamLength, | ||
| PULONGLONG | AllocatedSize | ||
| ) |
Definition at line 38 of file dirctl.c.
43{
47 PNTFS_ATTR_CONTEXT DataContext;
48
49 Status = FindAttribute(DeviceExt, FileRecord, AttributeData, Stream, StreamLength, &DataContext, NULL);
51 {
54 ReleaseAttributeContext(DataContext);
55 }
56
58
60}
ULONGLONG AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord)
Definition: mft.c:249
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4539
Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsMakeFCBFromDirEntry(), NtfsSetEndOfFile(), and NtfsUpdateDuplicatedInformation().
◆ NtfsGetFreeClusters()
| ULONGLONG NtfsGetFreeClusters | ( | PDEVICE_EXTENSION | DeviceExt | ) |
Definition at line 193 of file volinfo.c.
194{
196
198
199 KeEnterCriticalRegion();
201 FreeClusters = DeviceExt->FreeClusterCount;
202 ExReleaseResourceLite(&DeviceExt->BitmapResource);
203 KeLeaveCriticalRegion();
204
206}
#define ExAcquireResourceSharedLite(res, wait)
Definition: env_spec_w32.h:621
Referenced by GetNfsVolumeData(), and NtfsGetFsSizeInformation().
◆ NtfsGetUserBuffer()
Definition at line 120 of file misc.c.
122{
124 {
125 return MmGetSystemAddressForMdlSafe(Irp->MdlAddress, (Paging ? HighPagePriority : NormalPagePriority));
126 }
127 else
128 {
130 }
131}
#define MmGetSystemAddressForMdlSafe(_Mdl, _Priority)
Referenced by GetVolumeBitmap(), NtfsQueryDirectory(), NtfsRead(), and NtfsWrite().
◆ NtfsGrabFCB()
Definition at line 192 of file fcb.c.
Referenced by NtfsMakeRootFCB().
◆ NtfsGrabFCBFromTable()
Definition at line 291 of file fcb.c.
293{
294 KIRQL oldIrql;
296 PLIST_ENTRY current_entry;
297
299
301 {
307 }
308
309 current_entry = Vcb->FcbListHead.Flink;
311 {
313
316 {
320 }
321
322 //FIXME: need to compare against short name in FCB here
323
324 current_entry = current_entry->Flink;
325 }
326
328
330}
Definition: typedefs.h:120
Referenced by NtfsClearRenameTarget(), NtfsGetFCBForFile(), NtfsOpenFile(), NtfsOpenFileById(), NtfsOpenRootFCB(), and NtfsOpenTargetDirectory().
◆ NtfsInitializeFunctionPointers()
| VOID NTAPI NtfsInitializeFunctionPointers | ( | PDRIVER_OBJECT | DriverObject | ) |
Definition at line 170 of file ntfs.c.
171{
186
187 return;
188}
#define IRP_MJ_SET_VOLUME_INFORMATION
Referenced by DriverEntry().
◆ NtfsInitIoRunList()
| VOID NtfsInitIoRunList | ( | OUT PNTFS_IO_RUN_LIST | RunList | ) |
Definition at line 40 of file blockdev.c.
41{
42 RunList->Runs = RunList->StackRuns;
43 RunList->Capacity = NTFS_MAX_IO_RUNS_ON_STACK;
44 RunList->Count = 0;
45 RunList->TotalLength = 0;
46}
Referenced by NtfsReadDisk(), NtfsReadWriteVolume(), NtfsWriteDisk(), ReadAttributeToIrp(), and WriteAttributeFromIrp().
◆ NtfsInsertKey()
| NTSTATUS NtfsInsertKey | ( | PB_TREE | Tree, |
| ULONGLONG | FileReference, | ||
| PFILENAME_ATTRIBUTE | FileNameAttribute, | ||
| PB_TREE_FILENAME_NODE | Node, | ||
| BOOLEAN | CaseSensitive, | ||
| ULONG | MaxIndexRootSize, | ||
| ULONG | IndexRecordSize, | ||
| PB_TREE_KEY * | MedianKey, | ||
| PB_TREE_FILENAME_NODE * | NewRightHandSibling | ||
| ) |
Definition at line 1698 of file btree.c.
1707{
1708 PB_TREE_KEY NewKey, CurrentKey, PreviousKey;
1710 ULONG NodeSize;
1711 ULONG AllocatedNodeSize;
1712 ULONG MaxNodeSizeWithoutHeader;
1714
1715 *MedianKey = NULL;
1716 *NewRightHandSibling = NULL;
1717
1719 Tree,
1720 FileReference,
1721 FileNameAttribute,
1722 Node,
1723 CaseSensitive ? "TRUE" : "FALSE",
1724 MaxIndexRootSize,
1725 IndexRecordSize,
1726 MedianKey,
1727 NewRightHandSibling);
1728
1729 // Create the key for the filename attribute
1730 NewKey = CreateBTreeKeyFromFilename(FileReference, FileNameAttribute);
1731 if (!NewKey)
1733
1734 // Find where to insert the key
1735 CurrentKey = Node->FirstKey;
1736 PreviousKey = NULL;
1738 {
1739 // Should the New Key go before the current key?
1741
1742 /* The name is already in this index. Inserting it again would leave
1743 * two entries the lookup code can never tell apart, so refuse. */
1744 if (Comparison == 0)
1745 {
1750
1751 DestroyBTreeKey(NewKey);
1752
1754 }
1755
1756 // Is NewKey < CurrentKey?
1757 if (Comparison < 0)
1758 {
1759 // Does CurrentKey have a sub-node?
1761 {
1762 PB_TREE_KEY NewLeftKey;
1763 PB_TREE_FILENAME_NODE NewChild;
1764
1765 // Insert the key into the child node
1767 FileReference,
1768 FileNameAttribute,
1769 CurrentKey->LesserChild,
1770 CaseSensitive,
1771 MaxIndexRootSize,
1772 IndexRecordSize,
1773 &NewLeftKey,
1774 &NewChild);
1776 {
1780 }
1781
1782 // Did the child node get split?
1783 if (NewLeftKey)
1784 {
1786
1787 // Insert the new left key to the left of the current key
1788 NewLeftKey->NextKey = CurrentKey;
1789
1790 // Is CurrentKey the first key?
1791 if (!PreviousKey)
1792 Node->FirstKey = NewLeftKey;
1793 else
1794 PreviousKey->NextKey = NewLeftKey;
1795
1796 // CurrentKey->LesserChild will be the right-hand sibling
1797 CurrentKey->LesserChild = NewChild;
1798
1799 Node->KeyCount++;
1801
1802#ifndef NDEBUG
1804#endif
1805 }
1806 }
1807 else
1808 {
1809 // Insert New Key before Current Key
1810 NewKey->NextKey = CurrentKey;
1811
1812 // Increase KeyCount and mark node as dirty
1813 Node->KeyCount++;
1815
1816 // was CurrentKey the first key?
1818 Node->FirstKey = NewKey;
1819 else
1820 PreviousKey->NextKey = NewKey;
1821 }
1822 break;
1823 }
1824
1825 PreviousKey = CurrentKey;
1826 CurrentKey = CurrentKey->NextKey;
1827 }
1828
1829 // Determine how much space the index entries will need
1831
1832 // Is Node not the root node?
1834 {
1835 // Calculate maximum size of index entries without any headers
1837
1838 // TODO: Replace magic with math
1839 MaxNodeSizeWithoutHeader = AllocatedNodeSize - 0x28;
1840
1841 // Has the node grown larger than its allocated size?
1842 if (NodeSize > MaxNodeSizeWithoutHeader)
1843 {
1845
1848 {
1851 }
1852
1854 }
1855 }
1856
1857 // NewEntry and NewKey will be destroyed later by DestroyBTree()
1858
1860}
LONG CompareTreeKeys(PB_TREE_KEY Key1, PB_TREE_KEY Key2, BOOLEAN CaseSensitive)
Definition: btree.c:422
NTSTATUS SplitBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling, BOOLEAN CaseSensitive)
Definition: btree.c:2138
NTSTATUS NtfsInsertKey(PB_TREE Tree, ULONGLONG FileReference, PFILENAME_ATTRIBUTE FileNameAttribute, PB_TREE_FILENAME_NODE Node, BOOLEAN CaseSensitive, ULONG MaxIndexRootSize, ULONG IndexRecordSize, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling)
Definition: btree.c:1698
PB_TREE_KEY CreateBTreeKeyFromFilename(ULONGLONG FileReference, PFILENAME_ATTRIBUTE FileNameAttribute)
Definition: btree.c:1466
Definition: ntfs.h:433
Referenced by AddFilenameToDirectoryWorker(), and NtfsInsertKey().
◆ NtfsIsDirectoryEmpty()
| NTSTATUS NtfsIsDirectoryEmpty | ( | _In_ PDEVICE_EXTENSION | Vcb, |
| _In_ ULONGLONG | MftIndex, | ||
| _Out_ PBOOLEAN | Empty | ||
| ) |
Definition at line 4554 of file mft.c.
4558{
4559 PFILE_RECORD_HEADER FileRecord;
4563 ULONG IndexRootLength;
4565
4567
4568 FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
4571
4574 goto Quit;
4575
4576 Status = FindAttribute(Vcb, FileRecord, AttributeIndexRoot, L"$I30", 4, &IndexRootContext, NULL);
4578 goto Quit;
4579
4581 if (IndexRootLength < sizeof(*IndexRoot))
4582 {
4584 goto Quit;
4585 }
4586
4589 {
4591 goto Quit;
4592 }
4593
4594 if (ReadAttribute(Vcb, IndexRootContext, 0, (PCHAR)IndexRoot, IndexRootLength) != IndexRootLength)
4595 {
4597 goto Quit;
4598 }
4599
4600 if (FIELD_OFFSET(INDEX_ROOT_ATTRIBUTE, Header) + IndexRoot->Header.TotalSizeOfEntries > IndexRootLength)
4601 {
4603 goto Quit;
4604 }
4605
4606 /* Only a root that points down needs the allocation */
4608 {
4609 Status = FindAttribute(Vcb, FileRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationContext, NULL);
4611 {
4613 goto Quit;
4614 }
4615 }
4616
4618 IndexAllocationContext,
4619 IndexRoot->SizeOfEntry,
4620 &IndexRoot->Header,
4621 0,
4622 Empty);
4623
4624Quit:
4628 ReleaseAttributeContext(IndexAllocationContext);
4630 ReleaseAttributeContext(IndexRootContext);
4631 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
4632
4634}
static NTSTATUS NtfsIndexEntriesAreEmpty(_In_ PDEVICE_EXTENSION Vcb, _In_ PNTFS_ATTR_CONTEXT IndexAllocationContext, _In_ ULONG IndexBlockSize, _In_ PINDEX_HEADER_ATTRIBUTE Header, _In_ ULONG Depth, _Out_ PBOOLEAN Empty)
Definition: mft.c:4491
Referenced by NtfsCleanupFile(), and NtfsSetDispositionInformation().
◆ NtfsIsIrpTopLevel()
Definition at line 43 of file misc.c.
Referenced by NtfsDispatch().
◆ NtfsIsRegularFileObject()
| BOOLEAN NTAPI NtfsIsRegularFileObject | ( | _In_ PFILE_OBJECT | FileObject | ) |
Definition at line 153 of file fcb.c.
155{
157
160
162}
Referenced by NtfsCleanup(), NtfsFastIoCheckIfPossible(), NtfsFastIoRead(), NtfsFastIoWrite(), NtfsFlushBuffers(), NtfsLockControl(), NtfsRead(), and NtfsWrite().
◆ NtfsLoadUpCaseTable()
| NTSTATUS NtfsLoadUpCaseTable | ( | PDEVICE_EXTENSION | Vcb | ) |
◆ NtfsLoadVolumeBitmap()
| NTSTATUS NtfsLoadVolumeBitmap | ( | _In_ PDEVICE_EXTENSION | DeviceExt | ) |
Definition at line 49 of file volinfo.c.
51{
52 PFILE_RECORD_HEADER BitmapRecord;
53 ULONGLONG BitmapSize;
56
57 BitmapRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
60
63 {
64 /* The context keeps its own copy of the attribute record */
65 Status = FindAttribute(DeviceExt, BitmapRecord, AttributeData, L"", 0, &DeviceExt->BitmapContext, NULL);
66 }
67
68 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
69
71 {
73 DeviceExt->BitmapContext = NULL;
75 }
76
77 BitmapSize = AttributeDataLength(DeviceExt->BitmapContext->pRecord);
79 BitmapSize * 8 < DeviceExt->NtfsInfo.ClusterCount ||
80 DeviceExt->NtfsInfo.ClusterCount > MAXULONG)
81 {
83 BitmapSize, DeviceExt->NtfsInfo.ClusterCount);
86 }
87
88 /* Whole sectors, so write back never reads first */
92 {
95 }
97
98 if (ReadAttribute(DeviceExt, DeviceExt->BitmapContext, 0, (PCHAR)DeviceExt->BitmapBuffer, (ULONG)BitmapSize) != (ULONG)BitmapSize)
99 {
103 }
104
105 DeviceExt->BitmapSize = (ULONG)BitmapSize;
106
107 /* $Bitmap is rounded up to a cluster and covers a few clusters more than
108 * the volume has. Bounding by ClusterCount ignores the surplus bits, but
109 * write back still preserves them on disk. */
110 RtlInitializeBitMap(&DeviceExt->ClusterBitmap, DeviceExt->BitmapBuffer, (ULONG)DeviceExt->NtfsInfo.ClusterCount);
111 DeviceExt->FreeClusterCount = RtlNumberOfClearBits(&DeviceExt->ClusterBitmap);
112
114 DeviceExt->FreeClusterCount, DeviceExt->NtfsInfo.ClusterCount);
115
117
118Fail:
119 NtfsFreeVolumeBitmap(DeviceExt);
121}
VOID NtfsFreeVolumeBitmap(_In_ PDEVICE_EXTENSION DeviceExt)
Definition: volinfo.c:132
◆ NtfsLockControl()
| NTSTATUS NTAPI NtfsLockControl | ( | _In_ PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 19 of file lockctrl.c.
21{
23
25
28
29 /* Only the data of regular files can be locked */
32
34
35 /* FsRtl completes the IRP, or keeps it until a conflicting lock goes away */
36 IrpContext->Flags &= ~IRPCONTEXT_COMPLETE;
37
39}
NTSTATUS NTAPI FsRtlProcessFileLock(IN PFILE_LOCK FileLock, IN PIRP Irp, IN PVOID Context OPTIONAL)
Definition: filelock.c:1156
Referenced by NtfsDispatch().
◆ NtfsLockUserBuffer()
Definition at line 158 of file misc.c.
161{
163
165 {
167 }
168
170
172 {
174 }
175
176 _SEH2_TRY
177 {
179 }
181 {
185 }
186 _SEH2_END;
187
189}
VOID NTAPI MmProbeAndLockPages(IN PMDL Mdl, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
Definition: mdlsup.c:928
Referenced by NtfsCachedRead(), and NtfsWrite().
◆ NtfsLookupFile()
| NTSTATUS NtfsLookupFile | ( | PDEVICE_EXTENSION | Vcb, |
| PUNICODE_STRING | PathName, | ||
| BOOLEAN | CaseSensitive, | ||
| PFILE_RECORD_HEADER * | FileRecord, | ||
| PULONGLONG | MFTIndex | ||
| ) |
Definition at line 4295 of file mft.c.
4300{
4302}
NTSTATUS NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, PUNICODE_STRING PathName, BOOLEAN CaseSensitive, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex, ULONGLONG CurrentMFTIndex)
Definition: mft.c:4236
◆ NtfsLookupFileAt()
| NTSTATUS NtfsLookupFileAt | ( | PDEVICE_EXTENSION | Vcb, |
| PUNICODE_STRING | PathName, | ||
| BOOLEAN | CaseSensitive, | ||
| PFILE_RECORD_HEADER * | FileRecord, | ||
| PULONGLONG | MFTIndex, | ||
| ULONGLONG | CurrentMFTIndex | ||
| ) |
Definition at line 4236 of file mft.c.
4242{
4243 UNICODE_STRING Current, Remaining;
4245 ULONG FirstEntry = 0;
4246
4248 Vcb,
4249 PathName,
4250 CaseSensitive ? "TRUE" : "FALSE",
4251 FileRecord,
4252 MFTIndex,
4253 CurrentMFTIndex);
4254
4255 FsRtlDissectName(*PathName, &Current, &Remaining);
4256
4258 {
4260
4261 Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, &Current, &FirstEntry, FALSE, CaseSensitive, &CurrentMFTIndex);
4263 {
4265 }
4266
4268 break;
4269
4270 /* Split what is left of the path, not the component we just resolved */
4271 FsRtlDissectName(Remaining, &Current, &Remaining);
4272 }
4273
4274 *FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
4276 {
4279 }
4280
4283 {
4285 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, *FileRecord);
4287 }
4288
4289 *MFTIndex = CurrentMFTIndex;
4290
4292}
Referenced by NtfsDirFindFile(), and NtfsLookupFile().
◆ NtfsMakeFCBFromDirEntry()
| NTSTATUS NtfsMakeFCBFromDirEntry | ( | PNTFS_VCB | Vcb, |
| PNTFS_FCB | DirectoryFCB, | ||
| PUNICODE_STRING | Name, | ||
| PCWSTR | Stream, | ||
| PFILE_RECORD_HEADER | Record, | ||
| ULONGLONG | MFTIndex, | ||
| PNTFS_FCB * | fileFCB | ||
| ) |
Definition at line 458 of file fcb.c.
465{
468 PSTANDARD_INFORMATION StdInfo;
469 PNTFS_FCB rcFCB;
471
472 DPRINT("NtfsMakeFCBFromDirEntry(%p, %p, %wZ, %p, %p, %p)\n", Vcb, DirectoryFCB, Name, Stream, Record, fileFCB);
473
476 {
478 }
479
481 {
484 {
486 }
487
490 {
492 }
494 }
495 else
496 {
499 }
500
501 Size = NtfsGetFileSize(Vcb, Record, (Stream ? Stream : L""), (Stream ? wcslen(Stream) : 0), &AllocatedSize);
502
504 if (!rcFCB)
505 {
507 }
508
514
517 {
519 }
520
522 rcFCB->RefCount = 1;
523 rcFCB->MFTIndex = MFTIndex;
526 *fileFCB = rcFCB;
527
529}
PSTANDARD_INFORMATION GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: attrib.c:1970
PFILENAME_ATTRIBUTE GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: attrib.c:2015
ULONGLONG NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, PCWSTR Stream, ULONG StreamLength, PULONGLONG AllocatedSize)
Definition: dirctl.c:38
NTSTATUS NtfsFCBInitializeCache(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
Definition: fcb.c:334
PNTFS_FCB NtfsCreateFCB(PCWSTR FileName, PCWSTR Stream, PNTFS_VCB Vcb)
Definition: fcb.c:67
LARGE_INTEGER ValidDataLength
Definition: env_spec_w32.h:757
ActualNumberDriverObjects * sizeof(PDRIVER_OBJECT)) PDRIVER_OBJECT *DriverObjectList
Referenced by NtfsDirFindFile(), and NtfsOpenFileById().
◆ NtfsMakeRootFCB()
Definition at line 388 of file fcb.c.
389{
391 PFILE_RECORD_HEADER MftRecord;
393
394 MftRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
396 {
398 }
399
401 {
402 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
404 }
405
408 {
409 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
411 }
412
415 {
416 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
418 }
419
431
435
436 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
437
439}
Referenced by NtfsOpenRootFCB().
◆ NtfsMarkIrpContextForQueue()
| FORCEINLINE NTSTATUS NtfsMarkIrpContextForQueue | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 652 of file ntfs.h.
Referenced by NtfsCachedRead(), NtfsCleanup(), NtfsClose(), NtfsCreate(), NtfsDirectoryControl(), NtfsFlushBuffers(), NtfsQueryInformation(), NtfsQueryVolumeInformation(), NtfsSetInformation(), and NtfsWrite().
◆ NtfsOpenRootFCB()
Definition at line 443 of file fcb.c.
444{
446
449 {
451 }
452
454}
Referenced by NtfsGetFCBForFile().
◆ NtfsPerformIoRuns()
| NTSTATUS NtfsPerformIoRuns | ( | IN PDEVICE_OBJECT | DeviceObject, |
| IN UCHAR | MajorFunction, | ||
| IN ULONG | SectorSize, | ||
| IN OUT PUCHAR | Buffer, | ||
| IN PNTFS_IO_RUN_LIST | RunList, | ||
| IN BOOLEAN | Override, | ||
| OUT PULONG BytesTransferred | OPTIONAL | ||
| ) |
Definition at line 788 of file blockdev.c.
795{
797 MajorFunction,
798 SectorSize,
799 Buffer,
800 NULL,
801 RunList,
802 Override,
803 BytesTransferred);
804}
static NTSTATUS NtfsPerformIoRunsInternal(IN PDEVICE_OBJECT DeviceObject, IN UCHAR MajorFunction, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN PMDL BorrowedMdl OPTIONAL, IN PNTFS_IO_RUN_LIST RunList, IN BOOLEAN Override, OUT PULONG BytesTransferred OPTIONAL)
Definition: blockdev.c:483
_Must_inspect_result_ _In_ WDFUSBDEVICE _In_opt_ WDFREQUEST _In_opt_ PWDF_REQUEST_SEND_OPTIONS _In_ PWDF_USB_CONTROL_SETUP_PACKET _In_opt_ PWDF_MEMORY_DESCRIPTOR _Out_opt_ PULONG BytesTransferred
Definition: wdfusb.h:1342
Referenced by NtfsReadDisk(), and NtfsWriteDisk().
◆ NtfsPerformIrpIoRuns()
| NTSTATUS NtfsPerformIrpIoRuns | ( | IN PDEVICE_OBJECT | DeviceObject, |
| IN UCHAR | MajorFunction, | ||
| IN ULONG | SectorSize, | ||
| IN PIRP | Irp, | ||
| IN OUT PUCHAR | Buffer, | ||
| IN PNTFS_IO_RUN_LIST | RunList, | ||
| IN BOOLEAN | Override, | ||
| OUT PULONG | BytesTransferred | ||
| ) |
Definition at line 743 of file blockdev.c.
751{
753
757 {
758 /* Buffer maps exactly the pages this MDL describes, so it can stand
759 * in for one of our own, and on the paging path it must */
760 BorrowedMdl = Irp->MdlAddress;
761
762 /* One aligned run covering the lot goes straight down to the disk */
763 if (RunList->Count == 1 &&
764 RunList->Runs[0].Lbo != NTFS_SPARSE_LBO &&
765 (RunList->Runs[0].Lbo % SectorSize) == 0 &&
766 (RunList->Runs[0].ByteCount % SectorSize) == 0)
767 {
769 MajorFunction,
770 Irp,
771 &RunList->Runs[0],
772 Override,
773 BytesTransferred);
774 }
775 }
776
778 MajorFunction,
779 SectorSize,
780 Buffer,
781 BorrowedMdl,
782 RunList,
783 Override,
784 BytesTransferred);
785}
static NTSTATUS NtfsForwardIrpToRun(IN PDEVICE_OBJECT DeviceObject, IN UCHAR MajorFunction, IN PIRP Irp, IN PNTFS_IO_RUN Run, IN BOOLEAN Override, OUT PULONG BytesTransferred)
Definition: blockdev.c:663
#define MmGetMdlByteCount(_Mdl)
Referenced by NtfsReadWriteVolume(), ReadAttributeToIrp(), and WriteAttributeFromIrp().
◆ NtfsQueryInformation()
| NTSTATUS NtfsQueryInformation | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 470 of file finfo.c.
471{
476 PVOID SystemBuffer;
481
483
490
491 SystemBuffer = Irp->AssociatedIrp.SystemBuffer;
493
496 {
498 }
499
501 {
504 DeviceObject,
505 SystemBuffer,
506 &BufferLength);
507 break;
508
511 SystemBuffer,
512 &BufferLength);
513 break;
514
517 SystemBuffer,
518 &BufferLength);
519 break;
520
523 Fcb,
524 DeviceObject,
525 SystemBuffer,
526 &BufferLength);
527 break;
528
531 Fcb,
532 DeviceObject,
533 SystemBuffer,
534 &BufferLength);
535 break;
536
539 SystemBuffer,
540 &BufferLength);
541 break;
542
545 DeviceObject->DeviceExtension,
546 SystemBuffer,
547 &BufferLength);
548 break;
549
552 DeviceObject->DeviceExtension,
553 SystemBuffer,
554 &BufferLength);
555 break;
556
559 SystemBuffer,
560 &BufferLength);
561 break;
562
567 break;
568
569 default:
572 }
573
575
577 Irp->IoStatus.Information =
579 else
580 Irp->IoStatus.Information = 0;
581
583}
static OUT PIO_STATUS_BLOCK OUT PVOID IN ULONG IN FILE_INFORMATION_CLASS FileInformationClass
Definition: pipe.c:100
static NTSTATUS NtfsGetAttributeTagInformation(PNTFS_FCB Fcb, PFILE_ATTRIBUTE_TAG_INFORMATION AttributeTagInfo, PULONG BufferLength)
Definition: finfo.c:129
static NTSTATUS NtfsGetNameInformation(PFILE_OBJECT FileObject, PNTFS_FCB Fcb, PDEVICE_OBJECT DeviceObject, PFILE_NAME_INFORMATION NameInfo, PULONG BufferLength)
Definition: finfo.c:180
static NTSTATUS NtfsGetStreamInformation(PNTFS_FCB Fcb, PDEVICE_EXTENSION DeviceExt, PFILE_STREAM_INFORMATION StreamInfo, PULONG BufferLength)
Definition: finfo.c:276
static NTSTATUS NtfsGetPositionInformation(PFILE_OBJECT FileObject, PFILE_POSITION_INFORMATION PositionInfo, PULONG BufferLength)
Definition: finfo.c:78
const PCSTR GetInfoClassName(FILE_INFORMATION_CLASS infoClass)
Definition: finfo.c:346
static NTSTATUS NtfsGetStandardInformation(PNTFS_FCB Fcb, PDEVICE_OBJECT DeviceObject, PFILE_STANDARD_INFORMATION StandardInfo, PULONG BufferLength)
Definition: finfo.c:45
static NTSTATUS NtfsGetNetworkOpenInformation(PNTFS_FCB Fcb, PDEVICE_EXTENSION DeviceExt, PFILE_NETWORK_OPEN_INFORMATION NetworkInfo, PULONG BufferLength)
Definition: finfo.c:248
static NTSTATUS NtfsGetInternalInformation(PNTFS_FCB Fcb, PFILE_INTERNAL_INFORMATION InternalInfo, PULONG BufferLength)
Definition: finfo.c:227
static NTSTATUS NtfsGetBasicInformation(PFILE_OBJECT FileObject, PNTFS_FCB Fcb, PDEVICE_OBJECT DeviceObject, PFILE_BASIC_INFORMATION BasicInfo, PULONG BufferLength)
Definition: finfo.c:100
static NTSTATUS NtfsGetEaInformation(PNTFS_FCB Fcb, PFILE_EA_INFORMATION EaInfo, PULONG BufferLength)
Definition: finfo.c:155
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
Definition: wdfdevice.h:3777
Referenced by NtfsDispatch().
◆ NtfsQueryVolumeInformation()
| NTSTATUS NtfsQueryVolumeInformation | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 430 of file volinfo.c.
431{
437 PVOID SystemBuffer;
439 PDEVICE_EXTENSION DeviceExt;
440
442
443 ASSERT(IrpContext);
444
447 DeviceExt = DeviceObject->DeviceExtension;
449
452 {
454 }
455
458 SystemBuffer = Irp->AssociatedIrp.SystemBuffer;
460
463
465 {
468 SystemBuffer,
469 &BufferLength);
470 break;
471
474 SystemBuffer,
475 &BufferLength);
476 break;
477
480 SystemBuffer,
481 &BufferLength);
482 break;
483
486 SystemBuffer,
487 &BufferLength);
488 break;
489
490 default:
492 }
493
494 ExReleaseResourceLite(&DeviceExt->DirResource);
495
497 Irp->IoStatus.Information =
499 else
500 Irp->IoStatus.Information = 0;
501
503}
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FS_INFORMATION_CLASS FsInformationClass
Definition: fltkernel.h:1330
enum _FSINFOCLASS FS_INFORMATION_CLASS
static NTSTATUS NtfsGetFsDeviceInformation(PDEVICE_OBJECT DeviceObject, PFILE_FS_DEVICE_INFORMATION FsDeviceInfo, PULONG BufferLength)
Definition: volinfo.c:405
static NTSTATUS NtfsGetFsVolumeInformation(PDEVICE_OBJECT DeviceObject, PFILE_FS_VOLUME_INFORMATION FsVolumeInfo, PULONG BufferLength)
Definition: volinfo.c:294
static NTSTATUS NtfsGetFsAttributeInformation(PDEVICE_EXTENSION DeviceExt, PFILE_FS_ATTRIBUTE_INFORMATION FsAttributeInfo, PULONG BufferLength)
Definition: volinfo.c:340
static NTSTATUS NtfsGetFsSizeInformation(PDEVICE_OBJECT DeviceObject, PFILE_FS_SIZE_INFORMATION FsSizeInfo, PULONG BufferLength)
Definition: volinfo.c:375
Referenced by NtfsDispatch().
◆ NtfsRead()
| NTSTATUS NtfsRead | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 396 of file rw.c.
397{
398 PDEVICE_EXTENSION DeviceExt;
404 ULONG ReturnedReadLength = 0;
408
410
415
416 DeviceExt = DeviceObject->DeviceExtension;
420
421 /* Once dismounted the metadata can't be trusted; only raw volume access
422 * is still served */
425 {
426 Irp->IoStatus.Information = 0;
428 }
429
430 /* A handle on the volume itself is raw access to the partition. */
432 {
434 IRP_MJ_READ,
435 Buffer,
436 ReadLength,
437 ReadOffset.QuadPart,
438 Irp,
439 &ReturnedReadLength);
440 }
442 {
443 /* A directory has no data stream to read */
444 Irp->IoStatus.Information = 0;
446 }
449 {
450 Irp->IoStatus.Information = 0;
452 }
454 {
457 Buffer,
458 ReadLength,
459 &ReadOffset,
460 &ReturnedReadLength);
463 }
464 else
465 {
467
468 /* A non cached read must not miss what is still dirty in the cache */
471 {
473
475 }
476
478 FileObject,
479 Buffer,
480 ReadLength,
481 ReadOffset.QuadPart,
482 Irp->Flags,
483 Irp,
484 &ReturnedReadLength);
485 }
487 {
489 {
490 FileObject->CurrentByteOffset.QuadPart =
491 ReadOffset.QuadPart + ReturnedReadLength;
492 }
493
494 Irp->IoStatus.Information = ReturnedReadLength;
495 }
496 else
497 {
498 Irp->IoStatus.Information = 0;
499 }
500
502}
VOID NTAPI CcFlushCache(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN OPTIONAL PLARGE_INTEGER FileOffset, IN ULONG Length, OUT OPTIONAL PIO_STATUS_BLOCK IoStatus)
Definition: cachesub.c:222
static NTSTATUS NtfsReadFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, PUCHAR Buffer, ULONG Length, ULONGLONG ReadOffset, ULONG IrpFlags, PIRP Irp, PULONG LengthRead)
Definition: rw.c:124
static NTSTATUS NtfsReadWriteVolume(PDEVICE_EXTENSION DeviceExt, UCHAR MajorFunction, PUCHAR Buffer, ULONG Length, LONGLONG Offset, PIRP Irp, PULONG LengthTransferred)
Definition: rw.c:80
static NTSTATUS NTAPI NtfsCachedRead(_In_ PNTFS_IRP_CONTEXT IrpContext, _In_ PNTFS_FCB Fcb, _Out_writes_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _In_ PLARGE_INTEGER ReadOffset, _Out_ PULONG LengthRead)
Definition: rw.c:327
BOOLEAN NTAPI FsRtlCheckLockForReadAccess(IN PFILE_LOCK FileLock, IN PIRP Irp)
Definition: filelock.c:672
_Must_inspect_result_ _In_ WDFUSBPIPE _In_ WDFREQUEST _In_opt_ WDFMEMORY _In_opt_ PWDFMEMORY_OFFSET ReadOffset
Definition: wdfusb.h:2003
#define IRP_PAGING_IO
#define IRP_NOCACHE
◆ NtfsReadDisk()
| NTSTATUS NtfsReadDisk | ( | IN PDEVICE_OBJECT | DeviceObject, |
| IN LONGLONG | StartingOffset, | ||
| IN ULONG | Length, | ||
| IN ULONG | SectorSize, | ||
| IN OUT PUCHAR | Buffer, | ||
| IN BOOLEAN | Override | ||
| ) |
Definition at line 836 of file blockdev.c.
842{
843 NTFS_IO_RUN_LIST RunList;
845 ULONG Transferred;
846
849
852
853 NtfsInitIoRunList(&RunList);
854
858
860 IRP_MJ_READ,
861 SectorSize,
862 Buffer,
863 &RunList,
864 Override,
865 &Transferred);
866
867 NtfsFreeIoRunList(&RunList);
868
870 {
873 }
874
876
878}
NTSTATUS NtfsPerformIoRuns(IN PDEVICE_OBJECT DeviceObject, IN UCHAR MajorFunction, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN PNTFS_IO_RUN_LIST RunList, IN BOOLEAN Override, OUT PULONG BytesTransferred OPTIONAL)
Definition: blockdev.c:788
NTSTATUS NtfsAddIoRun(IN OUT PNTFS_IO_RUN_LIST RunList, IN LONGLONG Lbo, IN ULONG ByteCount)
Definition: blockdev.c:74
Definition: ntfs.h:527
Referenced by NtfsPerformIoRunsInternal(), and NtfsReadSectors().
◆ NtfsReadFCBAttribute()
| NTSTATUS NtfsReadFCBAttribute | ( | PNTFS_VCB | Vcb, |
| PNTFS_FCB | pFCB, | ||
| ULONG | Type, | ||
| PCWSTR | Name, | ||
| ULONG | NameLength, | ||
| PVOID * | Data | ||
| ) |
Definition at line 806 of file fcb.c.
812{
814 PFILE_RECORD_HEADER FileRecord;
815 PNTFS_ATTR_CONTEXT AttrCtxt;
816 ULONGLONG AttrLength;
817
818 FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
820 {
822 }
823
826 {
827 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
829 }
830
833 {
834 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
836 }
837
838 AttrLength = AttributeDataLength(AttrCtxt->pRecord);
841 {
842 ReleaseAttributeContext(AttrCtxt);
843 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
845 }
846
848
849 ReleaseAttributeContext(AttrCtxt);
850 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
851
853}
Definition: sort_test.cpp:77
Referenced by NtfsCreateFile().
◆ NtfsReadSectors()
| NTSTATUS NtfsReadSectors | ( | IN PDEVICE_OBJECT | DeviceObject, |
| IN ULONG | DiskSector, | ||
| IN ULONG | SectorCount, | ||
| IN ULONG | SectorSize, | ||
| IN OUT PUCHAR | Buffer, | ||
| IN BOOLEAN | Override | ||
| ) |
Definition at line 1011 of file blockdev.c.
1017{
1020
1023
1025}
NTSTATUS NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, IN LONGLONG StartingOffset, IN ULONG Length, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
Definition: blockdev.c:836
Referenced by NtfsGetVolumeData(), NtfsHasFileSystem(), and ReadLCN().
◆ NtfsReleaseFCB()
Definition at line 209 of file fcb.c.
211{
212 KIRQL oldIrql;
213
215 Fcb,
218
222 {
224
226
229 {
231 return;
232 }
233
234 /* A deleted FCB already left the table */
239
241 }
242 else
243 {
245 }
246}
BOOLEAN NTAPI CcUninitializeCacheMap(IN PFILE_OBJECT FileObject, IN OPTIONAL PLARGE_INTEGER TruncateSize, IN OPTIONAL PCACHE_UNINITIALIZE_EVENT UninitializeEvent)
Definition: fssup.c:286
Referenced by NtfsClearRenameTarget(), NtfsCloseFile(), NtfsFlushVolumeFiles(), NtfsGetFCBForFile(), NtfsOpenFile(), and NtfsOpenTargetDirectory().
◆ NtfsRelLazyWrite()
◆ NtfsRelReadAhead()
◆ NtfsRemoveFCBFromTable()
Definition at line 270 of file fcb.c.
273{
275
277
278 /* FCB_DELETED tells NtfsReleaseFCB() the entry is already unlinked */
280 {
284 }
285
287}
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
Definition: kefuncs.h:778
Referenced by NtfsCleanupFile().
◆ NtfsRemoveFilenameFromDirectory()
| NTSTATUS NtfsRemoveFilenameFromDirectory | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONGLONG | DirectoryMftIndex, | ||
| PFILENAME_ATTRIBUTE | FilenameAttribute, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 3297 of file mft.c.
3301{
3303
3304 KeEnterCriticalRegion();
3306 Status = RemoveFilenameFromDirectoryWorker(DeviceExt, DirectoryMftIndex, FilenameAttribute, CaseSensitive);
3307 ExReleaseResourceLite(&DeviceExt->IndexResource);
3308 KeLeaveCriticalRegion();
3309
3311}
static NTSTATUS RemoveFilenameFromDirectoryWorker(PDEVICE_EXTENSION DeviceExt, ULONGLONG DirectoryMftIndex, PFILENAME_ATTRIBUTE FilenameAttribute, BOOLEAN CaseSensitive)
Definition: mft.c:3096
Referenced by NtfsDeleteFileRecord(), and NtfsUnlinkFileNames().
◆ NtfsRemoveKey()
| NTSTATUS NtfsRemoveKey | ( | PB_TREE_FILENAME_NODE | Node, |
| PB_TREE_KEY | SearchKey, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 2067 of file btree.c.
2070{
2074
2076 {
2077 LONG Comparison;
2078
2080 break;
2081
2083 break;
2084
2085 Comparison = CompareTreeKeys(SearchKey, CurrentKey, CaseSensitive);
2086
2087 if (Comparison == 0)
2089
2090 // Everything that sorts before CurrentKey is beneath it
2091 if (Comparison < 0)
2092 break;
2093
2094 PreviousKey = CurrentKey;
2095 CurrentKey = CurrentKey->NextKey;
2096 }
2097
2100
2102}
NTSTATUS NtfsRemoveKey(PB_TREE_FILENAME_NODE Node, PB_TREE_KEY SearchKey, BOOLEAN CaseSensitive)
Definition: btree.c:2067
static NTSTATUS RemoveKeyFromNode(PB_TREE_FILENAME_NODE Node, PB_TREE_KEY PreviousKey, PB_TREE_KEY Key)
Definition: btree.c:1995
Referenced by NtfsRemoveKey(), and RemoveFilenameFromDirectoryWorker().
◆ NtfsResizeAllocation()
| NTSTATUS NtfsResizeAllocation | ( | _In_ PNTFS_FCB | Fcb, |
| _In_ PFILE_OBJECT | FileObject, | ||
| _In_ BOOLEAN | CaseSensitive, | ||
| _In_ ULONGLONG | AllocationSize | ||
| ) |
Definition at line 924 of file mft.c.
929{
932 PFILE_RECORD_HEADER FileRecord;
933 PNTFS_ATTR_CONTEXT DataContext;
934 PNTFS_ATTR_RECORD DestinationAttribute;
935 ULONG AttributeOffset;
936 ULONGLONG CurrentSize;
939
941
942 FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
945
948 goto Quit;
949
950 Status = FindAttribute(Vcb, FileRecord, AttributeData, Fcb->Stream, wcslen(Fcb->Stream), &DataContext, &AttributeOffset);
952 goto Quit;
953
954 /* Resident data lives in the record, and compressed or sparse streams
955 * round their allocation differently; there is nothing to do for those */
956 if (!DataContext->pRecord->IsNonResident ||
958 {
959 ReleaseAttributeContext(DataContext);
960 goto Quit;
961 }
962
963 AllocationSize = max(AllocationSize, ROUND_UP(DataContext->pRecord->NonResident.DataSize, BytesPerCluster));
964 CurrentSize = DataContext->pRecord->NonResident.AllocatedSize;
965
967 {
969
972 {
973 ReleaseAttributeContext(DataContext);
975 goto Quit;
976 }
977 }
978
979 /* Paging writes look the runs up again, keep them out while those change */
981
983 {
986 }
988 {
990 DataContext,
991 AttributeOffset,
992 FileRecord,
995 {
998 Changed = TRUE;
999 }
1000 }
1001
1002 if (Changed)
1003 {
1007 }
1008
1010 ReleaseAttributeContext(DataContext);
1011
1013 {
1015
1016 /* The directory entries carry the allocation too */
1018 FileRecord,
1021 CaseSensitive);
1022 }
1023
1024Quit:
1025 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1026
1028}
VOID NTAPI CcSetFileSizes(IN PFILE_OBJECT FileObject, IN PCC_FILE_SIZES FileSizes)
Definition: fssup.c:356
NTSTATUS NtfsUpdateDuplicatedInformation(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, ULONGLONG MFTIndex, ULONG Flags, BOOLEAN CaseSensitive)
Definition: mft.c:1995
NTSTATUS NtfsExtendAllocation(_In_ PDEVICE_EXTENSION Vcb, _In_ PNTFS_ATTR_CONTEXT AttrContext, _In_ ULONG AttrOffset, _In_ PFILE_RECORD_HEADER FileRecord, _In_ ULONGLONG AllocationSize)
Definition: mft.c:753
BOOLEAN NTAPI MmCanFileBeTruncated(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER NewFileSize)
Definition: section.c:4312
Referenced by NtfsSetAllocationInformation().
◆ NtfsSetEndOfFile()
| NTSTATUS NtfsSetEndOfFile | ( | PNTFS_FCB | Fcb, |
| PFILE_OBJECT | FileObject, | ||
| PDEVICE_EXTENSION | DeviceExt, | ||
| ULONG | IrpFlags, | ||
| BOOLEAN | CaseSensitive, | ||
| PLARGE_INTEGER | NewFileSize | ||
| ) |
Definition at line 625 of file finfo.c.
631{
632 LARGE_INTEGER CurrentFileSize;
633 PFILE_RECORD_HEADER FileRecord;
634 PNTFS_ATTR_CONTEXT DataContext;
635 ULONG AttributeOffset;
637 PFILENAME_ATTRIBUTE FileNameAttribute;
638
639
640 // Allocate non-paged memory for the file record
641 FileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
643 {
646 }
647
648 // read the file record
652 {
653 // We couldn't get the file's record. Free the memory and return the error
655 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
657 }
658
660
662
663 // Are we trying to decrease the file size?
665 {
666 // Is the file mapped?
668 NewFileSize))
669 {
671 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
673 }
674 }
675
676 // Find the attribute with the data stream for our file
679 FileRecord,
680 AttributeData,
683 &DataContext,
684 &AttributeOffset);
685
686 // Did we fail to find the attribute?
688 {
690 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
692 }
693
694 // Get the size of the data attribute
696
697 // Are we enlarging the attribute?
699 {
700 // is increasing the stream size not allowed?
702 (IrpFlags & IRP_PAGING_IO))
703 {
704 // TODO - just fail for now
705 ReleaseAttributeContext(DataContext);
706 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
708 }
709 }
710
711 // set the attribute data length
712 Status = SetAttributeDataLength(FileObject, Fcb, DataContext, AttributeOffset, FileRecord, NewFileSize);
714 {
715 ReleaseAttributeContext(DataContext);
716 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
718 }
719
720 // now we need to update this file's size in every directory index entry that references it
721 // TODO: expand to work with every filename / hardlink stored in the file record.
724 {
726 ReleaseAttributeContext(DataContext);
727 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
729 }
730
732 FileRecord,
735 CaseSensitive);
736
737 ReleaseAttributeContext(DataContext);
738 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
739
741}
NTSTATUS SetAttributeDataLength(PFILE_OBJECT FileObject, PNTFS_FCB Fcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
Definition: mft.c:615
Referenced by NtfsSetAllocationInformation(), and NtfsSetInformation().
◆ NtfsSetInformation()
| NTSTATUS NtfsSetInformation | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 1748 of file finfo.c.
1749{
1752 PDEVICE_EXTENSION DeviceExt;
1755 PVOID SystemBuffer;
1760
1762
1766 DeviceExt = DeviceObject->DeviceExtension;
1770
1771 SystemBuffer = Irp->AssociatedIrp.SystemBuffer;
1773
1774 /* A rename changes two directories and the FCB table, which creates rely
1775 * on under DirResource. Take it first, the same order create does. */
1777 !ExAcquireResourceExclusiveLite(&DeviceExt->DirResource,
1779 {
1781 }
1782
1783 /* Every class below rewrites the file record from a copy it reads, so
1784 * two of them at once on the same file would lose one update */
1787 {
1789 ExReleaseResourceLite(&DeviceExt->DirResource);
1790
1792 }
1793
1795 {
1796 PFILE_END_OF_FILE_INFORMATION EndOfFileInfo;
1797
1800 {
1802 break;
1803 }
1804
1805 /* A directory's record carries its index, which a create in it
1806 * could be changing; IndexResource keeps the two apart */
1807 KeEnterCriticalRegion();
1810 Fcb,
1812 (PFILE_BASIC_INFORMATION)SystemBuffer);
1813 ExReleaseResourceLite(&DeviceExt->IndexResource);
1814 KeLeaveCriticalRegion();
1815 break;
1816
1819 {
1821 break;
1822 }
1823
1825 FileObject,
1826 DeviceExt,
1829 &((PFILE_ALLOCATION_INFORMATION)SystemBuffer)->AllocationSize);
1830 break;
1831
1833 EndOfFileInfo = (PFILE_END_OF_FILE_INFORMATION)SystemBuffer;
1835 FileObject,
1836 DeviceExt,
1839 &EndOfFileInfo->EndOfFile);
1840 break;
1841
1844 {
1846 break;
1847 }
1848
1850 Fcb,
1851 FileObject,
1853 (PFILE_DISPOSITION_INFORMATION)SystemBuffer);
1854 break;
1855
1858 {
1860 break;
1861 }
1862
1864 Fcb,
1866 Stack->Parameters.SetFile.ReplaceIfExists,
1868 (PFILE_RENAME_INFORMATION)SystemBuffer,
1869 BufferLength);
1870 break;
1871
1872 // TODO: all other information classes
1873
1874 default:
1875 DPRINT1("FIXME: Unimplemented information class: %s\n", GetInfoClassName(FileInformationClass));
1877 }
1878
1880
1882 ExReleaseResourceLite(&DeviceExt->DirResource);
1883
1885 Irp->IoStatus.Information =
1887 else
1888 Irp->IoStatus.Information = 0;
1889
1891}
struct _FILE_END_OF_FILE_INFORMATION * PFILE_END_OF_FILE_INFORMATION
static NTSTATUS NtfsSetBasicInformation(PDEVICE_EXTENSION DeviceExt, PNTFS_FCB Fcb, BOOLEAN CaseSensitive, PFILE_BASIC_INFORMATION BasicInfo)
Definition: finfo.c:830
NTSTATUS NtfsSetEndOfFile(PNTFS_FCB Fcb, PFILE_OBJECT FileObject, PDEVICE_EXTENSION DeviceExt, ULONG IrpFlags, BOOLEAN CaseSensitive, PLARGE_INTEGER NewFileSize)
Definition: finfo.c:625
static NTSTATUS NTAPI NtfsSetAllocationInformation(_In_ PNTFS_FCB Fcb, _In_ PFILE_OBJECT FileObject, _In_ PDEVICE_EXTENSION DeviceExt, _In_ ULONG IrpFlags, _In_ BOOLEAN CaseSensitive, _In_ PLARGE_INTEGER AllocationSize)
Definition: finfo.c:747
static NTSTATUS NtfsSetRenameInformation(_In_ PDEVICE_EXTENSION DeviceExt, _In_ PNTFS_FCB Fcb, _In_opt_ PFILE_OBJECT TargetFileObject, _In_ BOOLEAN ReplaceIfExists, _In_ BOOLEAN CaseSensitive, _In_ PFILE_RENAME_INFORMATION RenameInfo, _In_ ULONG BufferLength)
Definition: finfo.c:1651
static NTSTATUS NtfsSetDispositionInformation(PDEVICE_EXTENSION DeviceExt, PNTFS_FCB Fcb, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, PFILE_DISPOSITION_INFORMATION DispositionInfo)
Definition: finfo.c:941
Definition: winternl.h:1666
Definition: nt_native.h:941
Definition: nt_native.h:975
Definition: nt_native.h:979
Definition: winternl.h:1596
Referenced by NtfsDispatch().
◆ NtfsSetVolumeInformation()
| NTSTATUS NtfsSetVolumeInformation | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 507 of file volinfo.c.
Referenced by NtfsDispatch().
◆ NtfsTrimAllocation()
Definition at line 842 of file mft.c.
844{
847 PFILE_RECORD_HEADER FileRecord;
848 PNTFS_ATTR_CONTEXT DataContext;
849 PNTFS_ATTR_RECORD DestinationAttribute;
850 ULONG AttributeOffset;
851 ULONGLONG NeededSize = 0;
853
854 FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
857
858 /* Paging writes look the runs up again; keep them out while the tail goes */
860
863 goto Quit;
864
865 Status = FindAttribute(Vcb, FileRecord, AttributeData, Fcb->Stream, wcslen(Fcb->Stream), &DataContext, &AttributeOffset);
867 goto Quit;
868
869 if (DataContext->pRecord->IsNonResident)
870 NeededSize = ROUND_UP(DataContext->pRecord->NonResident.DataSize, BytesPerCluster);
871
872 /* Compressed and sparse streams round their allocation differently; leave them be */
873 if (DataContext->pRecord->IsNonResident &&
875 DataContext->pRecord->NonResident.AllocatedSize > NeededSize)
876 {
878 DataContext,
879 AttributeOffset,
880 FileRecord,
881 (ULONG)((DataContext->pRecord->NonResident.AllocatedSize - NeededSize) / BytesPerCluster));
883 {
885 DestinationAttribute->NonResident.AllocatedSize = NeededSize;
886
890 }
891 }
892
893 ReleaseAttributeContext(DataContext);
894
895Quit:
897 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
898
900}
Referenced by NtfsCleanupFile().
◆ NtfsUpdateDuplicatedInformation()
| NTSTATUS NtfsUpdateDuplicatedInformation | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONGLONG | MFTIndex, | ||
| ULONG | Flags, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 1995 of file mft.c.
2000{
2002 PSTANDARD_INFORMATION StdInfo;
2005 ULONGLONG ParentMFTIndex;
2006 ULONG DirFlag;
2008
2011
2015 {
2018 }
2019
2021
2024
2026 {
2031
2036 }
2037
2039 {
2042 }
2043
2045 {
2046 /* Sizes come from the unnamed $DATA attribute, the same way the times
2047 * come from $STANDARD_INFORMATION: one source of truth per field. */
2049
2052 }
2053
2054 /* Persist the $FILE_NAME just modified. Callers have no reason to write the record again,
2055 * and leaving it unwritten would let the copy in the parent index disagree with it. */
2058 {
2061 }
2062
2063 /* Now the parent's index entry, which carries the same values */
2065
2069
2071}
NTSTATUS UpdateFileNameRecord(PDEVICE_EXTENSION Vcb, ULONGLONG ParentMFTIndex, PUNICODE_STRING FileName, BOOLEAN DirSearch, PNTFS_FILENAME_UPDATE Update, BOOLEAN CaseSensitive)
Definition: mft.c:2191
Definition: ntfs.h:1337
Referenced by NtfsGrowStream(), NtfsResizeAllocation(), NtfsSetBasicInformation(), and NtfsSetEndOfFile().
◆ NtfsWrite()
| NTSTATUS NtfsWrite | ( | PNTFS_IRP_CONTEXT | IrpContext | ) |
Definition at line 965 of file rw.c.
966{
973 ULONG ReturnedWriteLength = 0;
978 ULONG BytesPerSector;
979
981 ASSERT(IrpContext);
982
983 // get the I/O request packet
985
986 // This request is not allowed on the main device object
988 {
990
991 Irp->IoStatus.Information = 0;
993 }
994
995 // get the File control block
998
1000 DPRINT("NTFS Version: %d.%d\n", Fcb->Vcb->NtfsInfo.MajorVersion, Fcb->Vcb->NtfsInfo.MinorVersion);
1001
1002 // setup some more locals
1005 DeviceExt = DeviceObject->DeviceExtension;
1006 BytesPerSector = DeviceExt->StorageDevice->SectorSize;
1008
1009 // get the file offset we'll be writing to
1012 ByteOffset.u.HighPart == -1)
1013 {
1015 }
1016
1018 Length, BytesPerSector);
1019
1020 /* Offsets are 64 bits all the way down, only reject what can't be a file position */
1022 {
1025 }
1026
1027 // Is this a non-cached write? A non-buffered write?
1030 {
1031 // non-cached and non-buffered writes must be sector aligned
1033 {
1036 }
1037 }
1038
1039 /* A zero length write is a valid no-op */
1041 {
1042 // FIXME: Update last write time
1045 }
1046
1047 /* Is this an async request to a file? Serving a write means reading the
1048 * file record, walking its attributes and possibly growing the allocation,
1049 * all of it blocking metadata I/O, so post it to a worker thread which
1050 * runs the same path with IRPCONTEXT_CANWAIT set. Lock the user buffer
1051 * here, while we're still in the requesting thread's address space. */
1053 {
1056 {
1059 }
1060
1062 }
1063
1064 /* Byte range locks only stop other handles, never Mm or Cc */
1067 {
1068 Irp->IoStatus.Information = 0;
1070 }
1071
1072 /* Regular writes go through the cache, the lazy writer brings them to disk */
1076 {
1078 {
1079 Irp->IoStatus.Information = 0;
1081 }
1082
1084 Fcb,
1086 Length,
1087 &ByteOffset,
1089 &ReturnedWriteLength);
1091 {
1094
1096 }
1097
1100 }
1101
1102 // get the Resource
1104 {
1105 Resource = &DeviceExt->DirResource;
1106 }
1108 {
1110 }
1111 else
1112 {
1114 }
1115
1116 /* Paging writes never change the sizes, and Cc or Mm may already hold the
1117 * paging resource shared for us. Size changes take it exclusive. */
1119 {
1120 if (!ExAcquireResourceSharedLite(Resource, BooleanFlagOn(IrpContext->Flags, IRPCONTEXT_CANWAIT)))
1122 }
1123 else if (!ExAcquireResourceExclusiveLite(Resource, BooleanFlagOn(IrpContext->Flags, IRPCONTEXT_CANWAIT)))
1124 {
1126 }
1127
1128 // get the buffer of data the user is trying to write
1131
1132 // lock the buffer
1134
1135 // were we unable to lock the buffer?
1137 {
1139
1142 }
1143
1144 DPRINT("Existing File Size(Fcb->RFCB.FileSize.QuadPart): %I64u\n", Fcb->RFCB.FileSize.QuadPart);
1146
1147
1148 /* See NtfsRead() */
1151 {
1153 Irp->IoStatus.Information = 0;
1155 }
1156
1157 // write the file
1159 {
1160 /* Raw access to the partition, including after a dismount. */
1162 IRP_MJ_WRITE,
1163 Buffer,
1164 Length,
1165 ByteOffset.QuadPart,
1166 Irp,
1167 &ReturnedWriteLength);
1168 }
1170 {
1171 /* A directory has no data stream to write */
1173 Irp->IoStatus.Information = 0;
1175 }
1176 else
1177 {
1178 /* What goes straight to disk must not be overwritten by stale cached data later */
1181 {
1183
1186 }
1187
1189 FileObject,
1190 Buffer,
1191 Length,
1192 ByteOffset.QuadPart,
1195 Irp,
1196 &ReturnedWriteLength);
1197 }
1198
1200
1201 // was the write successful?
1203 {
1204 // TODO: Update timestamps
1205
1207 {
1208 // advance the file pointer
1210 }
1211
1213 }
1214 else
1215 {
1217 }
1218
1219 Irp->IoStatus.Information = ReturnedWriteLength;
1220
1221 // Note: We leave the user buffer that we locked alone, it's up to the I/O manager to unlock and free it
1222
1224
1226}
_Acquires_exclusive_lock_ Resource _Acquires_shared_lock_ Resource _Inout_ PERESOURCE Resource
Definition: cdprocs.h:843
NTSTATUS NtfsLockUserBuffer(IN PIRP Irp, IN ULONG Length, IN LOCK_OPERATION Operation)
Definition: misc.c:158
NTSTATUS NtfsWriteFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, const PUCHAR Buffer, ULONG Length, ULONGLONG WriteOffset, ULONG IrpFlags, BOOLEAN CaseSensitive, PIRP Irp, PULONG LengthWritten)
Definition: rw.c:611
static NTSTATUS NTAPI NtfsCachedWrite(_In_ PNTFS_IRP_CONTEXT IrpContext, _In_ PNTFS_FCB Fcb, _In_reads_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _In_ PLARGE_INTEGER WriteOffset, _In_ BOOLEAN CaseSensitive, _Out_ PULONG LengthWritten)
Definition: rw.c:862
IN PDCB IN PCCB IN VBO IN OUT PULONG OUT PDIRENT OUT PBCB OUT PVBO ByteOffset
Definition: fatprocs.h:732
BOOLEAN NTAPI FsRtlCheckLockForWriteAccess(IN PFILE_LOCK FileLock, IN PIRP Irp)
Definition: filelock.c:712
BOOLEAN NTAPI CcPurgeCacheSection(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN OPTIONAL PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN UninitializeCacheMaps)
Definition: fssup.c:386
struct _IO_STACK_LOCATION::@5020::@5025 Write
union _IO_STACK_LOCATION::@1814 Parameters
Referenced by NtfsDispatch().
◆ NtfsWriteDisk()
| NTSTATUS NtfsWriteDisk | ( | IN PDEVICE_OBJECT | DeviceObject, |
| IN LONGLONG | StartingOffset, | ||
| IN ULONG | Length, | ||
| IN ULONG | SectorSize, | ||
| IN const PUCHAR | Buffer | ||
| ) |
Definition at line 907 of file blockdev.c.
912{
913 NTFS_IO_RUN_LIST RunList;
915 ULONG Transferred;
916
919
922
923 NtfsInitIoRunList(&RunList);
924
928
930 IRP_MJ_WRITE,
931 SectorSize,
932 Buffer,
933 &RunList,
934 FALSE,
935 &Transferred);
936
937 NtfsFreeIoRunList(&RunList);
938
940 {
943 }
944
946
948}
◆ NtfsWriteVolumeBitmap()
| NTSTATUS NtfsWriteVolumeBitmap | ( | _In_ PDEVICE_EXTENSION | DeviceExt, |
| _In_ ULONG | FirstCluster, | ||
| _In_ ULONG | ClusterCount | ||
| ) |
Definition at line 167 of file volinfo.c.
171{
174 ULONG End;
175 ULONG LengthWritten;
176
177 ASSERT(ClusterCount != 0);
178
182
184 DeviceExt->BitmapContext,
185 Start,
187 End - Start,
188 &LengthWritten,
189 NULL);
190}
Referenced by FreeClusters(), and NtfsAllocateClusters().
◆ PrepareAttributeContext()
| PNTFS_ATTR_CONTEXT PrepareAttributeContext | ( | PNTFS_ATTR_RECORD | AttrRecord | ) |
Definition at line 41 of file mft.c.
42{
44
47 {
50 }
51
52 // Allocate memory for a copy of the attribute
55 {
59 }
60
61 // Copy the attribute
63
65 {
66 LONGLONG DataRunOffset;
67 ULONGLONG DataRunLength;
68 ULONGLONG NextVBN = 0;
69 PUCHAR DataRun = (PUCHAR)((ULONG_PTR)Context->pRecord + Context->pRecord->NonResident.MappingPairsOffset);
70
71 Context->CacheRun = DataRun;
72 Context->CacheRunOffset = 0;
74 Context->CacheRunLength = DataRunLength;
75 if (DataRunOffset != -1)
76 {
77 /* Normal run. */
78 Context->CacheRunStartLCN =
79 Context->CacheRunLastLCN = DataRunOffset;
80 }
81 else
82 {
83 /* Sparse run. */
84 Context->CacheRunStartLCN = -1;
85 Context->CacheRunLastLCN = 0;
86 }
87 Context->CacheRunCurrentOffset = 0;
88
89 // Convert the data runs to a map control block
91 {
96 }
97 }
98
100}
NTSTATUS ConvertDataRunsToLargeMCB(PUCHAR DataRun, PLARGE_MCB DataRunsMCB, PULONGLONG pNextVBN)
Definition: attrib.c:842
NPAGED_LOOKASIDE_LIST AttrCtxtLookasideList
Definition: ntfs.h:181
Referenced by FindAttribute(), and InternalReadNonResidentAttributes().
◆ ReadAttribute()
| ULONG ReadAttribute | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_CONTEXT | Context, | ||
| ULONGLONG | Offset, | ||
| PCHAR | Buffer, | ||
| ULONG | Length | ||
| ) |
Definition at line 1625 of file mft.c.
1630{
1632}
ULONG ReadAttributeToIrp(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length, PIRP Irp)
Definition: mft.c:1556
Referenced by AddFilenameToDirectoryWorker(), AddNewMftEntry(), AllocateIndexNode(), BrowseIndexEntries(), BrowseSubNodeIndexEntries(), CreateBTreeNodeFromIndexNode(), FreeMftEntry(), IncreaseMftSize(), InternalReadNonResidentAttributes(), NtfsFindMftRecord(), NtfsIndexNodeIsEmpty(), NtfsIsDirectoryEmpty(), NtfsLoadVolumeBitmap(), NtfsReadFCBAttribute(), NtfsReadUpCaseTable(), PrintAllVCNs(), ReadFileRecord(), RemoveFilenameFromDirectoryWorker(), SetResidentAttributeDataLength(), UpdateFileNameRecordWorker(), UpdateIndexEntryFileName(), and UpdateMftMirror().
◆ ReadAttributeToIrp()
| ULONG ReadAttributeToIrp | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_CONTEXT | Context, | ||
| ULONGLONG | Offset, | ||
| PCHAR | Buffer, | ||
| ULONG | Length, | ||
| PIRP | Irp | ||
| ) |
Definition at line 1556 of file mft.c.
1562{
1563 ULONG AlreadyRead = 0;
1564 ULONG Transferred = 0;
1566 NTFS_IO_RUN_LIST RunList;
1567
1569 {
1570 // We need to truncate Offset to a ULONG for pointer arithmetic
1571 // The check below should ensure that Offset is well within the range of 32 bits
1573
1574 // Ensure that offset isn't beyond the end of the attribute
1576 return 0;
1579
1580 RtlCopyMemory(Buffer, (PVOID)((ULONG_PTR)Context->pRecord + Context->pRecord->Resident.ValueOffset + LittleOffset), Length);
1582 }
1583
1584 /*
1585 * Non-resident attribute: map the requested range onto the volume, then
1586 * issue every run it spans in a single parallel batch.
1587 */
1588
1589 NtfsInitIoRunList(&RunList);
1590
1592
1594 {
1596 IRP_MJ_READ,
1597 Vcb->NtfsInfo.BytesPerSector,
1598 Irp,
1600 &RunList,
1601 FALSE,
1602 &Transferred);
1603 }
1604
1605 NtfsFreeIoRunList(&RunList);
1606
1608 {
1609 /* Our callers read the return value as a byte count and treat zero as
1610 * failure, so we cannot report a partial transfer here. */
1612 return 0;
1613 }
1614
1615 if (Transferred < AlreadyRead)
1616 {
1618 AlreadyRead = Transferred;
1619 }
1620
1621 return AlreadyRead;
1622}
static NTSTATUS NtfsMapAttributeRuns(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, ULONG Length, PNTFS_IO_RUN_LIST RunList, PULONG MappedLength)
Definition: mft.c:1362
NTSTATUS NtfsPerformIrpIoRuns(IN PDEVICE_OBJECT DeviceObject, IN UCHAR MajorFunction, IN ULONG SectorSize, IN PIRP Irp, IN OUT PUCHAR Buffer, IN PNTFS_IO_RUN_LIST RunList, IN BOOLEAN Override, OUT PULONG BytesTransferred)
Definition: blockdev.c:743
Referenced by NtfsReadFile(), and ReadAttribute().
◆ ReadFileRecord()
| NTSTATUS ReadFileRecord | ( | PDEVICE_EXTENSION | Vcb, |
| ULONGLONG | index, | ||
| PFILE_RECORD_HEADER | file | ||
| ) |
Definition at line 1936 of file mft.c.
1939{
1941
1943
1944 BytesRead = ReadAttribute(Vcb, Vcb->MFTContext, index * Vcb->NtfsInfo.BytesPerFileRecord, (PCHAR)file, Vcb->NtfsInfo.BytesPerFileRecord);
1946 {
1947 DPRINT1("ReadFileRecord failed: %I64u read, %lu expected\n", BytesRead, Vcb->NtfsInfo.BytesPerFileRecord);
1949 }
1950
1951 /* Apply update sequence array fixups. */
1954}
NTSTATUS FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, PNTFS_RECORD_HEADER Record)
Definition: mft.c:2425
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PLONGLONG _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesRead
Definition: wdfiotarget.h:870
Referenced by AddFilenameToDirectoryWorker(), FindAttribute(), FreeMftEntry(), GetNtfsFileRecord(), NtfsBuildRenamedFileName(), NtfsClearRenameTarget(), NtfsCreateFile(), NtfsDeleteFileRecord(), NtfsFindFileAt(), NtfsFindMftRecord(), NtfsGetDotEntry(), NtfsGetParentMftIndex(), NtfsGetStreamInformation(), NtfsGetVolumeData(), NtfsGrowFileForWrite(), NtfsIsDirectoryEmpty(), NtfsLoadVolumeBitmap(), NtfsLookupFileAt(), NtfsMakeRootFCB(), NtfsMoonWalkID(), NtfsOpenFileById(), NtfsReadFCBAttribute(), NtfsReadFile(), NtfsReadUpCaseTable(), NtfsResizeAllocation(), NtfsSetBasicInformation(), NtfsSetEndOfFile(), NtfsSetRenameInformation(), NtfsTrimAllocation(), NtfsWriteFile(), RemoveFilenameFromDirectoryWorker(), UpdateFileNameRecordWorker(), UpdateMftMirror(), and WriteAttributeFromIrp().
◆ ReadLCN()
| NTSTATUS ReadLCN | ( | PDEVICE_EXTENSION | Vcb, |
| ULONGLONG | lcn, | ||
| ULONG | count, | ||
| PVOID | buffer | ||
| ) |
Definition at line 3603 of file mft.c.
3607{
3608 LARGE_INTEGER DiskSector;
3609
3610 DiskSector.QuadPart = lcn;
3611
3615 Vcb->NtfsInfo.BytesPerSector,
3616 buffer,
3617 FALSE);
3618}
NTSTATUS NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, IN ULONG DiskSector, IN ULONG SectorCount, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
Definition: blockdev.c:1011
struct _LARGE_INTEGER::@2753 u
◆ ReadVCN()
| VOID ReadVCN | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | file, | ||
| ATTRIBUTE_TYPE | type, | ||
| ULONGLONG | vcn, | ||
| ULONG | count, | ||
| PVOID | buffer | ||
| ) |
◆ ReleaseAttributeContext()
| VOID ReleaseAttributeContext | ( | PNTFS_ATTR_CONTEXT | Context | ) |
Definition at line 104 of file mft.c.
105{
107 {
109 {
111 }
112
114 }
115
117}
Referenced by AddFilenameToDirectoryWorker(), AddNewMftEntry(), AllocateIndexNode(), BrowseIndexEntries(), CreateBTreeFromIndex(), FreeMftEntry(), IncreaseMftSize(), InternalReadNonResidentAttributes(), NtfsCreateFile(), NtfsDeleteFileRecord(), NtfsDirFindFile(), NtfsFindMftRecord(), NtfsFreeVolumeBitmap(), NtfsGetFileSize(), NtfsGetVolumeData(), NtfsGrowFileForWrite(), NtfsIsDirectoryEmpty(), NtfsReadFCBAttribute(), NtfsReadFile(), NtfsReadUpCaseTable(), NtfsResizeAllocation(), NtfsSetEndOfFile(), NtfsTrimAllocation(), NtfsWriteFile(), RemoveFilenameFromDirectoryWorker(), UpdateFileNameRecordWorker(), UpdateIndexAllocation(), UpdateIndexEntryFileName(), UpdateMftMirror(), and WriteAttributeFromIrp().
◆ SetAttributeDataLength()
| NTSTATUS SetAttributeDataLength | ( | PFILE_OBJECT | FileObject, |
| PNTFS_FCB | Fcb, | ||
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| PLARGE_INTEGER | DataSize | ||
| ) |
@parameter FileRecord Pointer to a file record. Must be a full record at least Fcb->Vcb->NtfsInfo.BytesPerFileRecord bytes large, not just the header.
Definition at line 615 of file mft.c.
621{
623
625 FileObject,
626 Fcb,
627 AttrContext,
628 AttrOffset,
629 FileRecord,
630 DataSize->QuadPart);
631
632 // are we truncating the file?
634 {
636 {
639 }
640 }
641
642 if (AttrContext->pRecord->IsNonResident)
643 {
645 AttrContext,
646 AttrOffset,
647 FileRecord,
648 DataSize);
649 }
650 else
651 {
652 // resident attribute
654 AttrContext,
655 AttrOffset,
656 FileRecord,
657 DataSize);
658 }
659
661 {
664 }
665
666 //NtfsDumpFileAttributes(Fcb->Vcb, FileRecord);
667
668 // write the updated file record back to disk
670
672 {
673 if (AttrContext->pRecord->IsNonResident)
675 else
680 }
681
683}
NTSTATUS SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
Definition: mft.c:1065
NTSTATUS SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
Definition: mft.c:1148
Referenced by NtfsCreateFile(), NtfsGrowStream(), and NtfsSetEndOfFile().
◆ SetFileRecordEnd()
| VOID SetFileRecordEnd | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttrEnd, | ||
| ULONG | EndMarker | ||
| ) |
Definition at line 706 of file mft.c.
709{
710 // Ensure AttrEnd is aligned on an 8-byte boundary, relative to FileRecord
712
713 // mark the end of attributes
715
716 // Restore the "file-record-end marker." The value is never checked but this behavior is consistent with Win2k3.
717 AttrEnd->Length = EndMarker;
718
719 // recalculate bytes in use
721}
Referenced by AddBitmap(), AddData(), AddFileName(), AddIndexAllocation(), AddIndexRoot(), AddRun(), AddStandardInformation(), FreeClusters(), InternalSetResidentAttributeLength(), NtfsSetFileNameAttribute(), and SetResidentAttributeDataLength().
◆ SetNonResidentAttributeDataLength()
| NTSTATUS SetNonResidentAttributeDataLength | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| PLARGE_INTEGER | DataSize | ||
| ) |
Definition at line 1065 of file mft.c.
1070{
1074 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
1075 ULONG ExistingClusters = AttrContext->pRecord->NonResident.AllocatedSize / BytesPerCluster;
1076
1077 ASSERT(AttrContext->pRecord->IsNonResident);
1078
1079 // do we need to increase the allocation size?
1081 {
1085 }
1088 {
1089 // shrink allocation size
1092 AttrContext->pRecord->NonResident.AllocatedSize = AllocationSize;
1093 }
1094
1095 // TODO: is the file compressed, encrypted, or sparse?
1096
1097 AttrContext->pRecord->NonResident.DataSize = DataSize->QuadPart;
1098 AttrContext->pRecord->NonResident.InitializedSize = DataSize->QuadPart;
1099
1100 DestinationAttribute->NonResident.AllocatedSize = AttrContext->pRecord->NonResident.AllocatedSize;
1103
1104 /* AddRun() and FreeClusters() keep HighestVCN on the last VCN the runs
1105 * describe, holes included, so it's carried over rather than recomputed */
1106 DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
1107
1109
1111}
Referenced by AllocateIndexNode(), IncreaseMftSize(), SetAttributeDataLength(), and SetResidentAttributeDataLength().
◆ SetResidentAttributeDataLength()
| NTSTATUS SetResidentAttributeDataLength | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| PLARGE_INTEGER | DataSize | ||
| ) |
Definition at line 1148 of file mft.c.
1153{
1155
1156 // find the next attribute
1157 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
1158 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((PCHAR)FileRecord + NextAttributeOffset);
1159
1160 ASSERT(!AttrContext->pRecord->IsNonResident);
1161
1162 //NtfsDumpFileAttributes(Vcb, FileRecord);
1163
1164 // Do we need to increase the data length?
1166 {
1167 // There's usually padding at the end of a record. Do we need to extend past it?
1168 ULONG MaxValueLength = AttrContext->pRecord->Length - AttrContext->pRecord->Resident.ValueOffset;
1170 {
1171 // If this is the last attribute, we could move the end marker to the very end of the file record
1172 MaxValueLength += Vcb->NtfsInfo.BytesPerFileRecord - NextAttributeOffset - (sizeof(ULONG) * 2);
1173
1175 {
1176 // convert attribute to non-resident
1178 PNTFS_ATTR_RECORD NewRecord;
1179 LARGE_INTEGER AttribDataSize;
1180 PVOID AttribData;
1181 ULONG NewRecordLength;
1182 ULONG EndAttributeOffset;
1183 ULONG LengthWritten;
1184
1186
1187 AttribDataSize.QuadPart = AttrContext->pRecord->Resident.ValueLength;
1188
1189 // Is there existing data we need to back-up?
1191 {
1194 {
1195 DPRINT1("ERROR: Couldn't allocate memory for attribute data. Can't migrate to non-resident!\n");
1197 }
1198
1199 // read data to temp buffer
1202 {
1206 }
1207 }
1208
1209 // Start by turning this attribute into a 0-length, non-resident attribute, then enlarge it.
1210
1211 // The size of a 0-length, non-resident attribute will be 0x41 + the size of the attribute name, aligned to an 8-byte boundary
1212 NewRecordLength = ALIGN_UP_BY(0x41 + (AttrContext->pRecord->NameLength * sizeof(WCHAR)), ATTR_RECORD_ALIGNMENT);
1213
1214 // Create a new attribute record that will store the 0-length, non-resident attribute
1216
1217 // Zero out the NonResident structure
1218 RtlZeroMemory(NewRecord, NewRecordLength);
1219
1220 // Copy the data that's common to both non-resident and resident attributes
1221 RtlCopyMemory(NewRecord, AttrContext->pRecord, FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.ValueLength));
1222
1223 // The name follows the non-resident header, not the resident one
1225
1226 // if there's a name
1227 if (AttrContext->pRecord->NameLength != 0)
1228 {
1229 // copy the name
1230 // An attribute name will be located at offset 0x18 for a resident attribute, 0x40 for non-resident
1234 }
1235
1236 // update the mapping pairs offset, which will be 0x40 (size of a non-resident header) + length in bytes of the name
1237 NewRecord->NonResident.MappingPairsOffset = 0x40 + (AttrContext->pRecord->NameLength * sizeof(WCHAR));
1238
1239 // update the end of the file record
1240 // calculate position of end markers (1 byte for empty data run)
1241 EndAttributeOffset = AttrOffset + NewRecord->NonResident.MappingPairsOffset + 1;
1243
1244 // Update the length
1245 NewRecord->Length = EndAttributeOffset - AttrOffset;
1246
1248
1249 // Copy the new attribute record into the file record
1251
1252 // Update the file record end
1253 SetFileRecordEnd(FileRecord,
1255 FILE_RECORD_END);
1256
1257 // Initialize the MCB, potentially catch an exception
1258 _SEH2_TRY
1259 {
1261 }
1263 {
1269 } _SEH2_END;
1270
1271 // Mark the attribute as non-resident (we wait until after we know the LargeMcb was initialized)
1273
1274 // Update file record on disk
1277 {
1283 }
1284
1285 // Now we need to free the old copy of the attribute record in the context and replace it with the new one
1287 AttrContext->pRecord = NewRecord;
1288
1289 // Now we can treat the attribute as non-resident and enlarge it normally
1290 Status = SetNonResidentAttributeDataLength(Vcb, AttrContext, AttrOffset, FileRecord, DataSize);
1292 {
1297 }
1298
1299 // restore the back-up attribute, if we made one
1301 {
1302 Status = WriteAttribute(Vcb, AttrContext, 0, AttribData, AttribDataSize.QuadPart, &LengthWritten, FileRecord);
1304 {
1306 // TODO: Reverse migration so no data is lost
1309 }
1310
1312 }
1313 }
1314 }
1315 }
1316
1317 // set the new length of the resident attribute (if we didn't migrate it)
1318 if (!AttrContext->pRecord->IsNonResident)
1319 return InternalSetResidentAttributeLength(Vcb, AttrContext, FileRecord, AttrOffset, DataSize->LowPart);
1320
1322}
NTSTATUS InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_CONTEXT AttrContext, PFILE_RECORD_HEADER FileRecord, ULONG AttrOffset, ULONG DataSize)
Definition: mft.c:542
Referenced by AllocateIndexNode(), IncreaseMftSize(), and SetAttributeDataLength().
◆ SplitBTreeNode()
| NTSTATUS SplitBTreeNode | ( | PB_TREE | Tree, |
| PB_TREE_FILENAME_NODE | Node, | ||
| PB_TREE_KEY * | MedianKey, | ||
| PB_TREE_FILENAME_NODE * | NewRightHandSibling, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 2138 of file btree.c.
2143{
2144 ULONG MedianKeyIndex;
2145 PB_TREE_KEY LastKeyBeforeMedian, FirstKeyAfterMedian;
2146 ULONG KeyCount;
2147 ULONG HalfSize;
2148 ULONG SizeSum;
2150
2152 Tree,
2153 Node,
2154 MedianKey,
2155 NewRightHandSibling,
2156 CaseSensitive ? "TRUE" : "FALSE");
2157
2158#ifndef NDEBUG
2160#endif
2161
2162 // Create the right hand sibling
2163 *NewRightHandSibling = ExAllocatePoolWithTag(NonPagedPool, sizeof(B_TREE_FILENAME_NODE), TAG_NTFS);
2165 {
2168 }
2170 (*NewRightHandSibling)->DiskNeedsUpdating = TRUE;
2171
2172
2173 // Find the last key before the median
2174
2175 // This is roughly how NTFS-3G calculates median, and it's not congruent with what Windows does:
2176 /*
2177 // find the median key index
2178 MedianKeyIndex = (Node->KeyCount + 1) / 2;
2179 MedianKeyIndex--;
2180
2181 LastKeyBeforeMedian = Node->FirstKey;
2182 for (i = 0; i < MedianKeyIndex - 1; i++)
2183 LastKeyBeforeMedian = LastKeyBeforeMedian->NextKey;*/
2184
2185 // The method we'll use is a little bit closer to how Windows determines the median but it's not identical.
2186 // What Windows does is actually more complicated than this, I think because Windows allocates more slack space to Odd-numbered
2187 // Index Records, leaving less room for index entries in these records (I haven't discovered why this is done).
2188 // (Neither Windows nor chkdsk complain if we choose a different median than Windows would have chosen, as our median will be in the ballpark)
2189
2190 // Use size to locate the median key / index
2191 LastKeyBeforeMedian = Node->FirstKey;
2192 MedianKeyIndex = 0;
2193 HalfSize = 2016; // half the allocated size after subtracting the first index entry offset (TODO: MATH)
2194 SizeSum = 0;
2196 {
2198
2199 if (SizeSum > HalfSize)
2200 break;
2201
2202 MedianKeyIndex++;
2203 LastKeyBeforeMedian = LastKeyBeforeMedian->NextKey;
2204 }
2205
2206 // Now we can get the median key and the key that follows it
2207 *MedianKey = LastKeyBeforeMedian->NextKey;
2208 FirstKeyAfterMedian = (*MedianKey)->NextKey;
2209
2211 DPRINT("\t\tMedian: %.*S\n", (*MedianKey)->IndexEntry->FileName.NameLength, (*MedianKey)->IndexEntry->FileName.Name);
2212
2213 // "Node" will be the left hand sibling after the split, containing all keys prior to the median key
2214
2215 // We need to create a dummy pointer at the end of the LHS. The dummy's child will be the median's child.
2216 LastKeyBeforeMedian->NextKey = CreateDummyKey(BooleanFlagOn((*MedianKey)->IndexEntry->Flags, NTFS_INDEX_ENTRY_NODE));
2218 {
2220 LastKeyBeforeMedian->NextKey = *MedianKey;
2223 }
2224
2225 // Did the median key have a child node?
2227 {
2228 // Set the child of the new dummy key
2229 LastKeyBeforeMedian->NextKey->LesserChild = (*MedianKey)->LesserChild;
2230
2231 // Give the dummy key's index entry the same sub-node VCN the median
2232 SetIndexEntryVCN(LastKeyBeforeMedian->NextKey->IndexEntry, GetIndexEntryVCN((*MedianKey)->IndexEntry));
2233 }
2234 else
2235 {
2236 // Median key didn't have a child node, but it will. Create a new index entry large enough to store a VCN.
2239 TAG_NTFS);
2240 if (!NewIndexEntry)
2241 {
2243 LastKeyBeforeMedian->NextKey = *MedianKey;
2246 }
2247
2248 // Copy the old index entry to the new one
2249 RtlCopyMemory(NewIndexEntry, (*MedianKey)->IndexEntry, (*MedianKey)->IndexEntry->Length);
2250
2251 // Use the new index entry after freeing the old one
2253 (*MedianKey)->IndexEntry = NewIndexEntry;
2254
2255 // Update the length for the VCN
2257
2258 // Set the node flag
2259 (*MedianKey)->IndexEntry->Flags |= NTFS_INDEX_ENTRY_NODE;
2260 }
2261
2262 // "Node" will become the child of the median key
2263 (*MedianKey)->LesserChild = Node;
2265
2266 // Update Node's KeyCount (remember to add 1 for the new dummy key)
2267 Node->KeyCount = MedianKeyIndex + 2;
2268
2271
2272 // everything to the right of MedianKey becomes the right hand sibling of Node
2273 (*NewRightHandSibling)->FirstKey = FirstKeyAfterMedian;
2274 (*NewRightHandSibling)->KeyCount = CountBTreeKeys(FirstKeyAfterMedian);
2275
2276#ifndef NDEBUG
2279
2282#endif
2283
2285}
ULONGLONG GetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry)
Definition: btree.c:1648
VOID SetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry, ULONGLONG VCN)
Definition: btree.c:1177
Referenced by NtfsInsertKey().
◆ UpdateFileNameRecord()
| NTSTATUS UpdateFileNameRecord | ( | PDEVICE_EXTENSION | Vcb, |
| ULONGLONG | ParentMFTIndex, | ||
| PUNICODE_STRING | FileName, | ||
| BOOLEAN | DirSearch, | ||
| PNTFS_FILENAME_UPDATE | Update, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 2191 of file mft.c.
2197{
2199
2200 KeEnterCriticalRegion();
2202 Status = UpdateFileNameRecordWorker(Vcb, ParentMFTIndex, FileName, DirSearch, Update, CaseSensitive);
2204 KeLeaveCriticalRegion();
2205
2207}
static NTSTATUS UpdateFileNameRecordWorker(PDEVICE_EXTENSION Vcb, ULONGLONG ParentMFTIndex, PUNICODE_STRING FileName, BOOLEAN DirSearch, PNTFS_FILENAME_UPDATE Update, BOOLEAN CaseSensitive)
Definition: mft.c:2082
Referenced by NtfsUpdateDuplicatedInformation().
◆ UpdateFileRecord()
| NTSTATUS UpdateFileRecord | ( | PDEVICE_EXTENSION | Vcb, |
| ULONGLONG | MftIndex, | ||
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 2391 of file mft.c.
2394{
2397
2399
2400 // Add the fixup array to prepare the data for writing to disk
2402
2403 // write the file record to the master file table
2405 Vcb->MFTContext,
2406 MftIndex * Vcb->NtfsInfo.BytesPerFileRecord,
2408 Vcb->NtfsInfo.BytesPerFileRecord,
2409 &BytesWritten,
2410 FileRecord);
2411
2413 {
2414 DPRINT1("UpdateFileRecord failed: %lu written, %lu expected\n", BytesWritten, Vcb->NtfsInfo.BytesPerFileRecord);
2415 }
2416
2417 // remove the fixup array (so the file record pointer can still be used)
2419
2421}
NTSTATUS AddFixupArray(PDEVICE_EXTENSION Vcb, PNTFS_RECORD_HEADER Record)
Definition: mft.c:3575
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PLONGLONG _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesWritten
Definition: wdfiotarget.h:960
Referenced by AddFilenameToDirectoryWorker(), AddNewMftEntry(), AddRun(), AllocateIndexNode(), FreeClusters(), FreeMftEntry(), IncreaseMftSize(), NtfsCommitRename(), NtfsResizeAllocation(), NtfsTrimAllocation(), NtfsUpdateDuplicatedInformation(), RemoveFilenameFromDirectoryWorker(), SetAttributeDataLength(), SetResidentAttributeDataLength(), and WriteAttributeFromIrp().
◆ UpdateIndexAllocation()
| NTSTATUS UpdateIndexAllocation | ( | PDEVICE_EXTENSION | DeviceExt, |
| PB_TREE | Tree, | ||
| ULONG | IndexBufferSize, | ||
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 1187 of file btree.c.
1191{
1192 // Find the index allocation and bitmap
1193 PNTFS_ATTR_CONTEXT IndexAllocationContext;
1194 PB_TREE_KEY CurrentKey;
1198 ULONG IndexAllocationOffset;
1199
1201
1202 Status = FindAttribute(DeviceExt, FileRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationContext, &IndexAllocationOffset);
1204 {
1205 HasIndexAllocation = TRUE;
1206
1207#ifndef NDEBUG
1208 PrintAllVCNs(DeviceExt,
1209 IndexAllocationContext,
1210 IndexBufferSize);
1211#endif
1212 }
1213 // Walk through the root node and update all the sub-nodes
1214 CurrentKey = Tree->RootNode->FirstKey;
1216 {
1218 {
1219 if (!HasIndexAllocation)
1220 {
1221 // We need to add an index allocation to the file record
1222 PNTFS_ATTR_RECORD EndMarker = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->BytesInUse - (sizeof(ULONG) * 2));
1224
1225 // Add index allocation to the very end of the file record
1227 FileRecord,
1228 EndMarker,
1230 4);
1232 {
1235 }
1236
1237 // Find the new attribute
1238 Status = FindAttribute(DeviceExt, FileRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationContext, &IndexAllocationOffset);
1240 {
1243 }
1244
1245 // Advance end marker
1247
1248 // Add index bitmap to the very end of the file record
1250 FileRecord,
1251 EndMarker,
1253 4);
1255 {
1257 ReleaseAttributeContext(IndexAllocationContext);
1259 }
1260
1261 HasIndexAllocation = TRUE;
1262 }
1263
1264 // Is the Index Entry large enough to store the VCN?
1266 {
1267 // Allocate memory for the larger index entry
1270 TAG_NTFS);
1271 if (!NewEntry)
1272 {
1274 if (HasIndexAllocation)
1275 ReleaseAttributeContext(IndexAllocationContext);
1277 }
1278
1279 // Copy the old entry to the new one
1281
1283
1284 // Free the old memory
1286
1287 CurrentKey->IndexEntry = NewEntry;
1289 }
1290
1291 // Update the sub-node
1292 Status = UpdateIndexNode(DeviceExt, FileRecord, CurrentKey->LesserChild, IndexBufferSize, IndexAllocationContext, IndexAllocationOffset);
1294 {
1296 ReleaseAttributeContext(IndexAllocationContext);
1298 }
1299
1300 // Update the VCN stored in the index entry of CurrentKey
1302 }
1303 CurrentKey = CurrentKey->NextKey;
1304 }
1305
1306#ifndef NDEBUG
1308#endif
1309
1310 if (HasIndexAllocation)
1311 {
1312#ifndef NDEBUG
1313 PrintAllVCNs(DeviceExt,
1314 IndexAllocationContext,
1315 IndexBufferSize);
1316#endif
1317 ReleaseAttributeContext(IndexAllocationContext);
1318 }
1319
1321}
VOID PrintAllVCNs(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT IndexAllocationContext, ULONG NodeSize)
Definition: btree.c:38
NTSTATUS UpdateIndexNode(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, PB_TREE_FILENAME_NODE Node, ULONG IndexBufferSize, PNTFS_ATTR_CONTEXT IndexAllocationContext, ULONG IndexAllocationOffset)
Definition: btree.c:1324
NTSTATUS AddBitmap(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
Definition: attrib.c:76
NTSTATUS AddIndexAllocation(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
Definition: attrib.c:380
Referenced by AddFilenameToDirectoryWorker(), and RemoveFilenameFromDirectoryWorker().
◆ UpdateIndexEntryFileName()
| NTSTATUS UpdateIndexEntryFileName | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | MftRecord, | ||
| PCHAR | IndexRecord, | ||
| ULONG | IndexBlockSize, | ||
| PINDEX_ENTRY_ATTRIBUTE | FirstEntry, | ||
| PINDEX_ENTRY_ATTRIBUTE | LastEntry, | ||
| PUNICODE_STRING | FileName, | ||
| PULONG | StartEntry, | ||
| PULONG | CurrentEntry, | ||
| BOOLEAN | DirSearch, | ||
| PNTFS_FILENAME_UPDATE | Update, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Recursively searches a directory index and applies the requested update to the $FILE_NAME attribute of the proper index entry. (Heavily based on BrowseIndexEntries)
Definition at line 2215 of file mft.c.
2227{
2229 ULONG RecordOffset;
2230 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
2231 PNTFS_ATTR_CONTEXT IndexAllocationCtx;
2232 ULONGLONG IndexAllocationSize;
2233 PINDEX_BUFFER IndexBuffer;
2234
2236 Vcb,
2237 MftRecord,
2238 IndexRecord,
2239 IndexBlockSize,
2240 FirstEntry,
2241 LastEntry,
2242 FileName,
2243 *StartEntry,
2244 *CurrentEntry,
2245 DirSearch ? "TRUE" : "FALSE",
2246 Update->Flags,
2247 CaseSensitive ? "TRUE" : "FALSE");
2248
2249 // find the index entry responsible for the file we're trying to update
2250 IndexEntry = FirstEntry;
2251 while (IndexEntry < LastEntry &&
2253 {
2255 *CurrentEntry >= *StartEntry &&
2258 {
2259 *StartEntry = *CurrentEntry;
2260
2262 {
2265 }
2266
2268 {
2273 }
2274
2276 {
2278 }
2279
2280 // indicate that the caller will still need to write the structure to the disk
2282 }
2283
2284 (*CurrentEntry) += 1;
2287 }
2288
2289 /* If we're already browsing a subnode */
2291 {
2293 }
2294
2295 /* If there's no subnode */
2297 {
2299 }
2300
2301 Status = FindAttribute(Vcb, MftRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationCtx, NULL);
2303 {
2306 }
2307
2308 IndexAllocationSize = AttributeDataLength(IndexAllocationCtx->pRecord);
2310 for (RecordOffset = 0; RecordOffset < IndexAllocationSize; RecordOffset += IndexBlockSize)
2311 {
2315 {
2316 break;
2317 }
2318
2319 IndexBuffer = (PINDEX_BUFFER)IndexRecord;
2321 ASSERT(IndexBuffer->Header.AllocatedSize + FIELD_OFFSET(INDEX_BUFFER, Header) == IndexBlockSize);
2322 FirstEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.FirstEntryOffset);
2323 LastEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.TotalSizeOfEntries);
2325
2327 NULL,
2328 NULL,
2329 0,
2330 FirstEntry,
2331 LastEntry,
2332 FileName,
2333 StartEntry,
2334 CurrentEntry,
2335 DirSearch,
2336 Update,
2337 CaseSensitive);
2339 {
2340 // write the index record back to disk
2341 ULONG Written;
2342
2343 // first we need to update the fixup values for the index block
2346 {
2348 break;
2349 }
2350
2351 Status = WriteAttribute(Vcb, IndexAllocationCtx, RecordOffset, (const PUCHAR)IndexRecord, IndexBlockSize, &Written, MftRecord);
2353 {
2355 break;
2356 }
2357
2359 break;
2360 }
2362 {
2363 break;
2364 }
2365 }
2366
2367 ReleaseAttributeContext(IndexAllocationCtx);
2369}
struct INDEX_BUFFER * PINDEX_BUFFER
NTSTATUS UpdateIndexEntryFileName(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, PCHAR IndexRecord, ULONG IndexBlockSize, PINDEX_ENTRY_ATTRIBUTE FirstEntry, PINDEX_ENTRY_ATTRIBUTE LastEntry, PUNICODE_STRING FileName, PULONG StartEntry, PULONG CurrentEntry, BOOLEAN DirSearch, PNTFS_FILENAME_UPDATE Update, BOOLEAN CaseSensitive)
Definition: mft.c:2215
BOOLEAN CompareFileName(PDEVICE_EXTENSION Vcb, PUNICODE_STRING FileName, PINDEX_ENTRY_ATTRIBUTE IndexEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive)
Definition: mft.c:3622
Referenced by UpdateFileNameRecordWorker(), and UpdateIndexEntryFileName().
◆ UpdateIndexNode()
| NTSTATUS UpdateIndexNode | ( | PDEVICE_EXTENSION | DeviceExt, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PB_TREE_FILENAME_NODE | Node, | ||
| ULONG | IndexBufferSize, | ||
| PNTFS_ATTR_CONTEXT | IndexAllocationContext, | ||
| ULONG | IndexAllocationOffset | ||
| ) |
Definition at line 1324 of file btree.c.
1330{
1335
1336
1338 DeviceExt,
1339 FileRecord,
1340 Node,
1341 IndexBufferSize,
1342 IndexAllocationContext,
1343 IndexAllocationOffset,
1344 Node->VCN);
1345
1346 // Walk through the node and look for children to update
1348 {
1349 ASSERT(CurrentKey);
1350
1351 // If there's a child node
1353 {
1354 HasChildren = TRUE;
1355
1356 // Update the child node on disk
1357 Status = UpdateIndexNode(DeviceExt, FileRecord, CurrentKey->LesserChild, IndexBufferSize, IndexAllocationContext, IndexAllocationOffset);
1359 {
1362 }
1363
1364 // Is the Index Entry large enough to store the VCN?
1366 {
1367 // Allocate memory for the larger index entry
1370 TAG_NTFS);
1371 if (!NewEntry)
1372 {
1375 }
1376
1377 // Copy the old entry to the new one
1379
1381
1382 // Free the old memory
1384
1385 CurrentKey->IndexEntry = NewEntry;
1386 }
1387
1388 // Update the VCN stored in the index entry of CurrentKey
1390
1392 }
1393
1394 CurrentKey = CurrentKey->NextKey;
1395 }
1396
1397
1398 // Do we need to write this node to disk?
1400 {
1401 ULONGLONG NodeOffset;
1402 ULONG LengthWritten;
1403 PINDEX_BUFFER IndexBuffer;
1404
1405 // Does the node need to be assigned a VCN?
1407 {
1408 // Allocate the node
1410 FileRecord,
1411 IndexBufferSize,
1412 IndexAllocationContext,
1413 IndexAllocationOffset,
1414 &Node->VCN);
1416 {
1419 }
1420
1422 }
1423
1424 // Allocate memory for an index buffer
1426 if (!IndexBuffer)
1427 {
1430 }
1431
1432 // Create the index buffer we'll be writing to disk to represent this node
1433 Status = CreateIndexBufferFromBTreeNode(DeviceExt, Node, IndexBufferSize, HasChildren, IndexBuffer);
1435 {
1439 }
1440
1441 // Get Offset of index buffer in index allocation
1443
1444 // Write the buffer to the index allocation
1445 Status = WriteAttribute(DeviceExt, IndexAllocationContext, NodeOffset, (const PUCHAR)IndexBuffer, IndexBufferSize, &LengthWritten, FileRecord);
1447 {
1452 else
1454 }
1455
1457
1458 // Free the index buffer
1460 }
1461
1463}
NTSTATUS AllocateIndexNode(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, ULONG IndexBufferSize, PNTFS_ATTR_CONTEXT IndexAllocationCtx, ULONG IndexAllocationOffset, PULONGLONG NewVCN)
Definition: btree.c:117
ULONGLONG GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt, ULONG IndexBufferSize, ULONGLONG Vcn)
Definition: btree.c:1637
NTSTATUS CreateIndexBufferFromBTreeNode(PDEVICE_EXTENSION DeviceExt, PB_TREE_FILENAME_NODE Node, ULONG BufferSize, BOOLEAN HasChildren, PINDEX_BUFFER IndexBuffer)
Definition: btree.c:1006
Referenced by UpdateIndexAllocation(), and UpdateIndexNode().
◆ UpdateMftMirror()
Definition at line 3690 of file mft.c.
3691{
3692 PFILE_RECORD_HEADER MirrorFileRecord;
3693 PNTFS_ATTR_CONTEXT MirrDataContext;
3694 PNTFS_ATTR_CONTEXT MftDataContext;
3695 PCHAR DataBuffer;
3699 ULONG LengthWritten;
3700
3701 // Allocate memory for the Mft mirror file record
3702 MirrorFileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
3703 if (!MirrorFileRecord)
3704 {
3707 }
3708
3709 // Read the Mft Mirror file record
3712 {
3714 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
3716 }
3717
3718 // Find the $DATA attribute of $MFTMirr
3721 {
3723 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
3725 }
3726
3727 // Find the $DATA attribute of $MFT
3728 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeData, L"", 0, &MftDataContext, NULL);
3730 {
3732 ReleaseAttributeContext(MirrDataContext);
3733 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
3735 }
3736
3737 // Get the size of the mirror's $DATA attribute
3739
3741
3742 // Create buffer for the mirror's $DATA attribute
3744 if (!DataBuffer)
3745 {
3747 ReleaseAttributeContext(MftDataContext);
3748 ReleaseAttributeContext(MirrDataContext);
3749 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
3751 }
3752
3754
3755 // Back up the first several entries of the Mft's $DATA Attribute
3758 {
3760 ReleaseAttributeContext(MftDataContext);
3761 ReleaseAttributeContext(MirrDataContext);
3763 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
3765 }
3766
3767 // Write the mirror's $DATA attribute
3769 MirrDataContext,
3770 0,
3771 (PUCHAR)DataBuffer,
3772 DataLength,
3773 &LengthWritten,
3774 MirrorFileRecord);
3776 {
3778 }
3779
3780 // Cleanup
3781 ReleaseAttributeContext(MftDataContext);
3782 ReleaseAttributeContext(MirrDataContext);
3784 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
3785
3787}
_In_ D3DDDI_VIDEO_PRESENT_TARGET_ID _In_ ULONG _In_ ULONG DataLength
Definition: dispmprt.h:233
Referenced by IncreaseMftSize().
◆ WriteAttribute()
| NTSTATUS WriteAttribute | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_CONTEXT | Context, | ||
| ULONGLONG | Offset, | ||
| const PUCHAR | Buffer, | ||
| ULONG | Length, | ||
| PULONG | LengthWritten, | ||
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 1829 of file mft.c.
1836{
1838 Context,
1839 Offset,
1840 Buffer,
1841 Length,
1842 RealLengthWritten,
1843 FileRecord,
1844 NULL);
1845}
NTSTATUS WriteAttributeFromIrp(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, const PUCHAR Buffer, ULONG Length, PULONG RealLengthWritten, PFILE_RECORD_HEADER FileRecord, PIRP Irp)
Definition: mft.c:1677
Referenced by AddFilenameToDirectoryWorker(), AddNewMftEntry(), AllocateIndexNode(), FreeMftEntry(), IncreaseMftSize(), NtfsWriteVolumeBitmap(), RemoveFilenameFromDirectoryWorker(), SetResidentAttributeDataLength(), UpdateFileNameRecordWorker(), UpdateFileRecord(), UpdateIndexEntryFileName(), UpdateIndexNode(), and UpdateMftMirror().
◆ WriteAttributeFromIrp()
| NTSTATUS WriteAttributeFromIrp | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_CONTEXT | Context, | ||
| ULONGLONG | Offset, | ||
| const PUCHAR | Buffer, | ||
| ULONG | Length, | ||
| PULONG | LengthWritten, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| PIRP | Irp | ||
| ) |
Definition at line 1677 of file mft.c.
1685{
1686 ULONG MappedLength = 0;
1687 ULONG Transferred = 0;
1690 NTFS_IO_RUN_LIST RunList;
1691
1692
1693 DPRINT("WriteAttribute(%p, %p, %I64u, %p, %lu, %p, %p)\n", Vcb, Context, Offset, Buffer, Length, RealLengthWritten, FileRecord);
1694
1695 *RealLengthWritten = 0;
1696 NtfsInitIoRunList(&RunList);
1697
1698 // is this a resident attribute?
1700 {
1701 ULONG AttributeOffset;
1702 PNTFS_ATTR_CONTEXT FoundContext;
1704
1705 // Ensure requested data is within the bounds of the attribute
1707
1709 {
1712 }
1713
1714 // Do we need to read the file record?
1716 {
1717 FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
1718 if (!FileRecord)
1719 {
1722 }
1723
1724 FileRecordAllocated = TRUE;
1725
1726 // read the file record
1728 }
1729
1730 // find where to write the attribute data to
1732 Context->pRecord->Type,
1734 Context->pRecord->NameLength,
1735 &FoundContext,
1736 &AttributeOffset);
1737
1739 {
1741 if(FileRecordAllocated)
1742 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1744 }
1745
1747
1748 DPRINT("Offset: %I64u, AttributeOffset: %u, ValueOffset: %u\n", Offset, AttributeOffset, Context->pRecord->Resident.ValueLength);
1749
1750 // Will we be writing past the end of the allocated file record?
1751 if (Offset + Length + AttributeOffset + Context->pRecord->Resident.ValueOffset > Vcb->NtfsInfo.BytesPerFileRecord)
1752 {
1754 ReleaseAttributeContext(FoundContext);
1755 if (FileRecordAllocated)
1756 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1758 }
1759
1760 // copy the data being written into the file record. We cast Offset to ULONG, which is safe because it's range has been verified.
1761 RtlCopyMemory((PCHAR)((ULONG_PTR)Destination + Context->pRecord->Resident.ValueOffset + (ULONG)Offset), Buffer, Length);
1762
1764
1765 // Update the context's copy of the resident attribute
1768
1769 ReleaseAttributeContext(FoundContext);
1770 if (FileRecordAllocated)
1771 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1772
1774 *RealLengthWritten = Length;
1775
1777 }
1778
1779 // This is a non-resident attribute: map the requested range onto the
1780 // volume, then issue every run it spans in a single parallel batch.
1781
1783
1785 {
1786 // The attribute's allocation ends before the request does.
1787 // TODO: assign new clusters to the end of the file.
1788 // [We can reach here by creating a new file record when the MFT isn't large enough]
1790 MappedLength, Length);
1792 }
1793
1795 {
1796 // Writing into a hole would mean allocating clusters, which we cannot
1797 // do here; NtfsPerformIrpIoRuns() rejects sparse runs on IRP_MJ_WRITE.
1799 IRP_MJ_WRITE,
1800 Vcb->NtfsInfo.BytesPerSector,
1801 Irp,
1802 Buffer,
1803 &RunList,
1804 FALSE,
1805 &Transferred);
1806 }
1807
1808 NtfsFreeIoRunList(&RunList);
1809
1811 {
1813 *RealLengthWritten = 0;
1815 }
1816
1817 *RealLengthWritten = Transferred;
1818
1820 {
1823 }
1824
1826}
Referenced by NtfsWriteFile(), and WriteAttribute().
Variable Documentation
◆ DriverEntry
◆ NtfsFastIoCheckIfPossible
| FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible |
Definition at line 1043 of file ntfs.h.
Referenced by DriverEntry().
◆ NtfsFastIoRead
| FAST_IO_READ NtfsFastIoRead |
Definition at line 1044 of file ntfs.h.
Referenced by DriverEntry().
◆ NtfsFastIoWrite
| FAST_IO_WRITE NtfsFastIoWrite |
Definition at line 1045 of file ntfs.h.
Referenced by DriverEntry().
◆ NtfsFsdDispatch
| DRIVER_DISPATCH NtfsFsdDispatch |
Definition at line 1021 of file ntfs.h.
Referenced by NtfsInitializeFunctionPointers().
◆ NtfsGlobalData
|
extern |
Definition at line 36 of file ntfs.c.
Referenced by AddNewMftEntry(), DriverEntry(), NtfsAllocateIrpContext(), NtfsAttachFCBToFileObject(), NtfsCleanup(), NtfsClose(), NtfsCreate(), NtfsCreateFCB(), NtfsCreateFile(), NtfsDestroyFCB(), NtfsDispatch(), NtfsEnsureCacheMap(), NtfsFastIoCheckIfPossible(), NtfsFastIoWrite(), NtfsFCBInitializeCache(), NtfsFlushBuffers(), NtfsLockControl(), NtfsMountVolume(), NtfsSetDispositionInformation(), NtfsSetRenameInformation(), NtfsWrite(), PrepareAttributeContext(), and ReleaseAttributeContext().
