#include <ntifs.h>#include <pseh/pseh2.h>#include <section_attribs.h>#include <pshpack1.h>#include <poppack.h>
Include dependency graph for ntfs.h:
This graph shows which files directly or indirectly include this file:
Go to the source code of this file.
Classes | |
| struct | _BIOS_PARAMETERS_BLOCK |
| struct | _EXTENDED_BIOS_PARAMETERS_BLOCK |
| struct | _BOOT_SECTOR |
| struct | _NTFS_INFO |
| struct | NTFSIDENTIFIER |
| struct | DEVICE_EXTENSION |
| struct | NTFS_CCB |
| struct | NTFS_GLOBAL_DATA |
| struct | NTFS_RECORD_HEADER |
| struct | _FILE_RECORD_HEADER |
| struct | NTFS_ATTR_RECORD |
| struct | NTFS_ATTRIBUTE_LIST_ITEM |
| struct | STANDARD_INFORMATION |
| struct | ATTRIBUTE_LIST |
| struct | FILENAME_ATTRIBUTE |
| struct | INDEX_HEADER_ATTRIBUTE |
| struct | INDEX_ROOT_ATTRIBUTE |
| struct | INDEX_BUFFER |
| struct | INDEX_ENTRY_ATTRIBUTE |
| struct | _B_TREE_KEY |
| struct | _B_TREE_FILENAME_NODE |
| struct | B_TREE |
| struct | VOLINFO_ATTRIBUTE |
| struct | REPARSE_POINT_ATTRIBUTE |
| struct | NTFS_IRP_CONTEXT |
| struct | _NTFS_ATTR_CONTEXT |
| struct | _FCB |
| struct | _FIND_ATTR_CONTXT |
| struct | FIXUP_ARRAY |
Variables | |
| PNTFS_GLOBAL_DATA | NtfsGlobalData |
| DRIVER_DISPATCH | NtfsFsdDispatch |
| FAST_IO_CHECK_IF_POSSIBLE | NtfsFastIoCheckIfPossible |
| FAST_IO_READ | NtfsFastIoRead |
| FAST_IO_WRITE | NtfsFastIoWrite |
| DRIVER_INITIALIZE | DriverEntry |
Macro Definition Documentation
◆ ATTR_RECORD_ALIGNMENT
◆ CACHEPAGESIZE
| #define CACHEPAGESIZE | ( | pDeviceExt | ) |
◆ COLLATION_BINARY
◆ COLLATION_FILE_NAME
◆ COLLATION_NTOFS_SECURITY_HASH
◆ COLLATION_NTOFS_SID
◆ COLLATION_NTOFS_ULONG
◆ COLLATION_NTOFS_ULONGS
◆ COLLATION_UNICODE_STRING
◆ DATA_RUN_ALIGNMENT
◆ DEVICE_NAME
◆ FCB_CACHE_INITIALIZED
◆ FCB_IS_VOLUME
◆ FCB_IS_VOLUME_STREAM
◆ FILE_RECORD_END
◆ FRH_DIRECTORY
◆ FRH_IN_USE
◆ FRH_UNKNOWN1
◆ FRH_UNKNOWN2
◆ INDEX_NODE_LARGE
◆ INDEX_NODE_SMALL
◆ INDEX_ROOT_LARGE
◆ INDEX_ROOT_SMALL
◆ IRPCONTEXT_CANWAIT
◆ IRPCONTEXT_COMPLETE
◆ IRPCONTEXT_QUEUE
◆ MAX_PATH
◆ NRH_FILE_TYPE
◆ NRH_INDX_TYPE
◆ NTFS_FILE_ATTRDEF
◆ NTFS_FILE_BADCLUS
◆ NTFS_FILE_BITMAP
◆ NTFS_FILE_BOOT
◆ NTFS_FILE_EXTEND
◆ NTFS_FILE_FIRST_USER_FILE
◆ NTFS_FILE_LOGFILE
◆ NTFS_FILE_MFT
◆ NTFS_FILE_MFTMIRR
◆ NTFS_FILE_NAME_DOS
◆ NTFS_FILE_NAME_POSIX
◆ NTFS_FILE_NAME_WIN32
◆ NTFS_FILE_NAME_WIN32_AND_DOS
◆ NTFS_FILE_QUOTA
◆ NTFS_FILE_ROOT
◆ NTFS_FILE_TYPE_ARCHIVE
◆ NTFS_FILE_TYPE_COMPRESSED
◆ NTFS_FILE_TYPE_DIRECTORY
◆ NTFS_FILE_TYPE_ENCRYPTED
◆ NTFS_FILE_TYPE_HIDDEN
◆ NTFS_FILE_TYPE_OFFLINE
◆ NTFS_FILE_TYPE_READ_ONLY
◆ NTFS_FILE_TYPE_REPARSE
◆ NTFS_FILE_TYPE_SPARSE
◆ NTFS_FILE_TYPE_SYSTEM
◆ NTFS_FILE_TYPE_TEMPORARY
◆ NTFS_FILE_UPCASE
◆ NTFS_FILE_VOLUME
◆ NTFS_INDEX_ENTRY_END
◆ NTFS_INDEX_ENTRY_NODE
◆ NTFS_MFT_MASK
◆ NTFS_TYPE_CCB
◆ NTFS_TYPE_FCB
◆ NTFS_TYPE_GLOBAL_DATA
◆ NTFS_TYPE_IRP_CONTEXT
◆ NTFS_TYPE_VCB
◆ RA_INDEXED
◆ ROUND_DOWN
◆ ROUND_UP
◆ TAG_ATT_CTXT
◆ TAG_CCB
◆ TAG_FCB
◆ TAG_FILE_REC
◆ TAG_IRP_CTXT
◆ TAG_NTFS
◆ VALUE_OFFSET_ALIGNMENT
◆ VCB_VOLUME_LOCKED
Typedef Documentation
◆ B_TREE_FILENAME_NODE
◆ B_TREE_KEY
| typedef struct _B_TREE_KEY B_TREE_KEY |
◆ BIOS_PARAMETERS_BLOCK
◆ BOOT_SECTOR
| typedef struct _BOOT_SECTOR BOOT_SECTOR |
◆ EXTENDED_BIOS_PARAMETERS_BLOCK
◆ FILE_RECORD_HEADER
◆ FIND_ATTR_CONTXT
| typedef struct _FIND_ATTR_CONTXT FIND_ATTR_CONTXT |
◆ NTFS_ATTR_CONTEXT
◆ NTFS_FCB
◆ NTFS_INFO
| typedef struct _NTFS_INFO NTFS_INFO |
◆ NTFS_VCB
| typedef struct DEVICE_EXTENSION NTFS_VCB |
◆ PATTRIBUTE_LIST
| typedef struct ATTRIBUTE_LIST * PATTRIBUTE_LIST |
◆ PATTRIBUTE_TYPE
| typedef enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE |
◆ PB_TREE
◆ PB_TREE_FILENAME_NODE
| typedef struct _B_TREE_FILENAME_NODE * PB_TREE_FILENAME_NODE |
◆ PB_TREE_KEY
| typedef struct _B_TREE_KEY * PB_TREE_KEY |
◆ PBIOS_PARAMETERS_BLOCK
◆ PBOOT_SECTOR
| typedef struct _BOOT_SECTOR * PBOOT_SECTOR |
◆ PDEVICE_EXTENSION
| typedef struct DEVICE_EXTENSION * PDEVICE_EXTENSION |
◆ PEXTENDED_BIOS_PARAMETERS_BLOCK
◆ PFILE_RECORD_HEADER
| typedef struct _FILE_RECORD_HEADER * PFILE_RECORD_HEADER |
◆ PFILENAME_ATTRIBUTE
| typedef struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE |
◆ PFIND_ATTR_CONTXT
| typedef struct _FIND_ATTR_CONTXT * PFIND_ATTR_CONTXT |
◆ PFIXUP_ARRAY
| typedef struct FIXUP_ARRAY * PFIXUP_ARRAY |
◆ PINDEX_BUFFER
| typedef struct INDEX_BUFFER * PINDEX_BUFFER |
◆ PINDEX_ENTRY_ATTRIBUTE
◆ PINDEX_HEADER_ATTRIBUTE
◆ PINDEX_ROOT_ATTRIBUTE
| typedef struct INDEX_ROOT_ATTRIBUTE * PINDEX_ROOT_ATTRIBUTE |
◆ PNTFS_ATTR_CONTEXT
| typedef struct _NTFS_ATTR_CONTEXT * PNTFS_ATTR_CONTEXT |
◆ PNTFS_ATTR_RECORD
| typedef struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD |
◆ PNTFS_ATTRIBUTE_LIST_ITEM
◆ PNTFS_CCB
◆ PNTFS_FCB
◆ PNTFS_GLOBAL_DATA
| typedef struct NTFS_GLOBAL_DATA * PNTFS_GLOBAL_DATA |
◆ PNTFS_INFO
| typedef struct _NTFS_INFO * PNTFS_INFO |
◆ PNTFS_IRP_CONTEXT
| typedef struct NTFS_IRP_CONTEXT * PNTFS_IRP_CONTEXT |
◆ PNTFS_RECORD_HEADER
| typedef struct NTFS_RECORD_HEADER * PNTFS_RECORD_HEADER |
◆ PNTFS_VCB
| typedef struct DEVICE_EXTENSION * PNTFS_VCB |
◆ PNTFSIDENTIFIER
| typedef struct NTFSIDENTIFIER * PNTFSIDENTIFIER |
◆ PREPARSE_POINT_ATTRIBUTE
◆ PSTANDARD_INFORMATION
| typedef struct STANDARD_INFORMATION * PSTANDARD_INFORMATION |
◆ PVOLINFO_ATTRIBUTE
| typedef struct VOLINFO_ATTRIBUTE * PVOLINFO_ATTRIBUTE |
Enumeration Type Documentation
◆ ATTRIBUTE_TYPE
Definition at line 159 of file ntfs.h.
160{
161 AttributeStandardInformation = 0x10,
162 AttributeAttributeList = 0x20,
163 AttributeFileName = 0x30,
164 AttributeObjectId = 0x40,
165 AttributeSecurityDescriptor = 0x50,
166 AttributeVolumeName = 0x60,
167 AttributeVolumeInformation = 0x70,
168 AttributeData = 0x80,
169 AttributeIndexRoot = 0x90,
170 AttributeIndexAllocation = 0xA0,
171 AttributeBitmap = 0xB0,
172 AttributeReparsePoint = 0xC0,
173 AttributeEAInformation = 0xD0,
174 AttributeEA = 0xE0,
175 AttributePropertySet = 0xF0,
176 AttributeLoggedUtilityStream = 0x100,
177 AttributeEnd = 0xFFFFFFFF
enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE
Function Documentation
◆ AddBitmap()
| NTSTATUS AddBitmap | ( | PNTFS_VCB | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PCWSTR | Name, | ||
| USHORT | NameLength | ||
| ) |
Definition at line 72 of file attrib.c.
77{
78 ULONG AttributeLength;
79 // Calculate the header length
82 ULONG NameOffset;
83 ULONG ValueOffset;
84 // We'll start out with 8 bytes of bitmap data
86 ULONG BytesAvailable;
87
89 {
92 }
93
94 NameOffset = ResidentHeaderLength;
95
96 // Calculate ValueOffset, which will be aligned to a 4-byte boundary
98
99 // Calculate length of attribute
100 AttributeLength = ValueOffset + ValueLength;
102
103 // Make sure the file record is large enough for the new attribute
105 if (BytesAvailable < AttributeLength)
106 {
109 }
110
111 // Set Attribute fields
112 RtlZeroMemory(AttributeAddress, AttributeLength);
113
115 AttributeAddress->Length = AttributeLength;
116 AttributeAddress->NameLength = NameLength;
117 AttributeAddress->NameOffset = NameOffset;
119
121 AttributeAddress->Resident.ValueOffset = ValueOffset;
122
123 // Set the name
124 RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
125
126 // move the attribute-end and file-record-end markers to the end of the file record
128 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
129
131}
struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD
VOID SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttrEnd, ULONG EndMarker)
Definition: mft.c:706
Definition: ntfs.h:125
struct NTFS_ATTR_RECORD::@169::@171 Resident
Definition: apinames.c:49
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
Definition: wdfregistry.h:275
Referenced by DECLARE_INTERFACE_(), CFontsDialog::InitToolbar(), and UpdateIndexAllocation().
◆ AddData()
| NTSTATUS AddData | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttributeAddress | ||
| ) |
Definition at line 160 of file attrib.c.
162{
165
167 {
170 }
171
173 AttributeAddress->Length = ResidentHeaderLength;
175 AttributeAddress->Resident.ValueLength = 0;
176 AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
177
178 // for unnamed $DATA attributes, NameOffset equals header length
179 AttributeAddress->NameOffset = ResidentHeaderLength;
181
182 // move the attribute-end and file-record-end markers to the end of the file record
184 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
185
187}
Referenced by DECLARE_INTERFACE_(), and NtfsCreateFileRecord().
◆ AddFileName()
| NTSTATUS AddFileName | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PDEVICE_EXTENSION | DeviceExt, | ||
| PFILE_OBJECT | FileObject, | ||
| BOOLEAN | CaseSensitive, | ||
| PULONGLONG | ParentMftIndex | ||
| ) |
Definition at line 230 of file attrib.c.
236{
238 PFILENAME_ATTRIBUTE FileNameAttribute;
239 LARGE_INTEGER SystemTime;
242 UNICODE_STRING Current, Remaining, FilenameNoPath;
244 ULONG FirstEntry;
245
247 {
250 }
251
254
256
257 // set timestamps
258 KeQuerySystemTime(&SystemTime);
263
264 // Is this a directory?
267 else
269
270 // we need to extract the filename from the path
272
274
277
279 {
281
283 {
286 }
287
288 FirstEntry = 0;
290 CurrentMFTIndex,
291 &Current,
292 &FirstEntry,
293 FALSE,
294 CaseSensitive,
295 &CurrentMFTIndex);
297 break;
298
300 {
302 {
305 }
306 break;
307 }
308
309 FsRtlDissectName(Remaining, &Current, &Remaining);
310 }
311
313
314 // set reference to parent directory
315 FileNameAttribute->DirectoryFileReferenceNumber = CurrentMFTIndex;
316 *ParentMftIndex = CurrentMFTIndex;
317
319
320 // The highest 2 bytes should be the sequence number, unless the parent happens to be root
323 else
325
326 DPRINT1("FileNameAttribute->DirectoryFileReferenceNumber: 0x%016I64x\n", FileNameAttribute->DirectoryFileReferenceNumber);
327
330
331 // For now, we're emulating the way Windows behaves when 8.3 name generation is disabled
332 // TODO: add DOS Filename as needed
335 else
337
338 FileRecord->LinkCount++;
339
340 AttributeAddress->Length = ResidentHeaderLength +
343
344 AttributeAddress->Resident.ValueLength = FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + FilenameNoPath.Length;
345 AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
347
348 // move the attribute-end and file-record-end markers to the end of the file record
350 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
351
353}
static BOOLEAN NtfsFindMftRecord(PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, PCHAR FileName, ULONGLONG *OutMFTIndex)
Definition: ntfs.c:545
struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE
BOOLEAN NTAPI RtlIsNameLegalDOS8Dot3(_In_ PUNICODE_STRING Name, _Inout_opt_ POEM_STRING OemName, _Inout_opt_ PBOOLEAN NameContainsSpaces)
VOID NTAPI FsRtlDissectName(IN UNICODE_STRING Name, OUT PUNICODE_STRING FirstPart, OUT PUNICODE_STRING RemainingPart)
Definition: name.c:398
Definition: ntfs.h:359
ULONGLONG DirectoryFileReferenceNumber
Definition: ntfs.h:360
Definition: env_spec_w32.h:368
Definition: typedefs.h:103
Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ AddFixupArray()
| NTSTATUS AddFixupArray | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_RECORD_HEADER | Record | ||
| ) |
Definition at line 2603 of file mft.c.
2605{
2606 USHORT *pShortToFixUp;
2610
2612
2613 DPRINT("AddFixupArray(%p, %p)\n fixupArray->USN: %u, ArrayEntryCount: %u\n", Vcb, Record, fixupArray->USN, ArrayEntryCount);
2614
2615 fixupArray->USN++;
2616
2618 {
2620
2623 *pShortToFixUp = fixupArray->USN;
2625 }
2626
2628}
struct FIXUP_ARRAY * PFIXUP_ARRAY
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
Definition: ntfs.h:560
Referenced by CreateIndexBufferFromBTreeNode(), UpdateFileRecord(), and UpdateIndexEntryFileNameSize().
◆ AddIndexAllocation()
| NTSTATUS AddIndexAllocation | ( | PNTFS_VCB | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PCWSTR | Name, | ||
| USHORT | NameLength | ||
| ) |
Definition at line 388 of file attrib.c.
393{
394 ULONG RecordLength;
395 ULONG FileRecordEnd;
396 ULONG NameOffset;
397 ULONG DataRunOffset;
398 ULONG BytesAvailable;
399
401 {
404 }
405
406 // Calculate the name offset
408
409 // Calculate the offset to the first data run
411 // The data run offset must be aligned to a 4-byte boundary
413
414 // Calculate the length of the new attribute; the empty data run will consist of a single byte
415 RecordLength = DataRunOffset + 1;
416
417 // The size of the attribute itself must be aligned to an 8 - byte boundary
419
420 // Back up the last 4-bytes of the file record (even though this value doesn't matter)
421 FileRecordEnd = AttributeAddress->Length;
422
423 // Make sure the file record can contain the new attribute
425 if (BytesAvailable < RecordLength)
426 {
429 }
430
431 // Set fields of attribute header
432 RtlZeroMemory(AttributeAddress, RecordLength);
433
435 AttributeAddress->Length = RecordLength;
437 AttributeAddress->NameLength = NameLength;
438 AttributeAddress->NameOffset = NameOffset;
440
441 AttributeAddress->NonResident.MappingPairsOffset = DataRunOffset;
443
444 // Set the name
445 RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
446
447 // move the attribute-end and file-record-end markers to the end of the file record
449 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
450
452}
struct NTFS_ATTR_RECORD::@169::@172 NonResident
Referenced by UpdateIndexAllocation().
◆ AddIndexRoot()
| NTSTATUS AddIndexRoot | ( | PNTFS_VCB | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| PNTFS_ATTR_RECORD | AttributeAddress, | ||
| PINDEX_ROOT_ATTRIBUTE | NewIndexRoot, | ||
| ULONG | RootLength, | ||
| PCWSTR | Name, | ||
| USHORT | NameLength | ||
| ) |
Definition at line 495 of file attrib.c.
502{
503 ULONG AttributeLength;
504 // Calculate the header length
506 // Back up the file record's final ULONG (even though it doesn't matter)
508 ULONG NameOffset;
509 ULONG ValueOffset;
510 ULONG BytesAvailable;
511
513 {
516 }
517
518 NameOffset = ResidentHeaderLength;
519
520 // Calculate ValueOffset, which will be aligned to a 4-byte boundary
522
523 // Calculate length of attribute
524 AttributeLength = ValueOffset + RootLength;
526
527 // Make sure the file record is large enough for the new attribute
529 if (BytesAvailable < AttributeLength)
530 {
533 }
534
535 // Set Attribute fields
536 RtlZeroMemory(AttributeAddress, AttributeLength);
537
539 AttributeAddress->Length = AttributeLength;
540 AttributeAddress->NameLength = NameLength;
541 AttributeAddress->NameOffset = NameOffset;
543
544 AttributeAddress->Resident.ValueLength = RootLength;
545 AttributeAddress->Resident.ValueOffset = ValueOffset;
546
547 // Set the name
548 RtlCopyMemory((PCHAR)((ULONG_PTR)AttributeAddress + NameOffset), Name, NameLength * sizeof(WCHAR));
549
550 // Copy the index root attribute
552
553 // move the attribute-end and file-record-end markers to the end of the file record
555 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
556
558}
Referenced by NtfsCreateDirectory().
◆ AddNewMftEntry()
| NTSTATUS AddNewMftEntry | ( | PFILE_RECORD_HEADER | FileRecord, |
| PDEVICE_EXTENSION | DeviceExt, | ||
| PULONGLONG | DestinationIndex, | ||
| BOOLEAN | CanWait | ||
| ) |
Definition at line 2022 of file mft.c.
2026{
2028 ULONGLONG MftIndex;
2030 ULONGLONG BitmapDataSize;
2031 ULONGLONG AttrBytesRead;
2034 ULONG LengthWritten;
2035 PNTFS_ATTR_CONTEXT BitmapContext;
2036 LARGE_INTEGER BitmapBits;
2037 UCHAR SystemReservedBits;
2038
2039 DPRINT1("AddNewMftEntry(%p, %p, %p, %s)\n", FileRecord, DeviceExt, DestinationIndex, CanWait ? "TRUE" : "FALSE");
2040
2041 // First, we have to read the mft's $Bitmap attribute
2042
2043 // Find the attribute
2044 Status = FindAttribute(DeviceExt, DeviceExt->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
2046 {
2049 }
2050
2051 // Get size of bitmap
2052 BitmapDataSize = AttributeDataLength(BitmapContext->pRecord);
2053
2054 // RtlInitializeBitmap wants a ULONG-aligned pointer, and wants the memory passed to it to be a ULONG-multiple
2055 // Allocate a buffer for the $Bitmap attribute plus enough to ensure we can get a ULONG-aligned pointer
2058 {
2059 ReleaseAttributeContext(BitmapContext);
2061 }
2063
2064 // Get a ULONG-aligned pointer for the bitmap itself
2066
2067 // read $Bitmap attribute
2069
2070 if (AttrBytesRead != BitmapDataSize)
2071 {
2074 ReleaseAttributeContext(BitmapContext);
2076 }
2077
2078 // We need to backup the bits for records 0x10 - 0x17 (3rd byte of bitmap) and mark these records
2079 // as in-use so we don't assign files to those indices. They're reserved for the system (e.g. ChkDsk).
2080 SystemReservedBits = BitmapData[2];
2081 BitmapData[2] = 0xff;
2082
2083 // Calculate bit count
2085 DeviceExt->NtfsInfo.BytesPerFileRecord;
2087 {
2088 DPRINT1("\tFIXME: bitmap sizes beyond 32bits are not yet supported! (Your NTFS volume is too large)\n");
2091 ReleaseAttributeContext(BitmapContext);
2093 }
2094
2095 // convert buffer into bitmap
2097
2098 // set next available bit, preferrably after 23rd bit
2101 {
2103
2105 ReleaseAttributeContext(BitmapContext);
2106
2107 // Couldn't find a free record in the MFT, add some blank records and try again
2110 {
2113 }
2114
2116 }
2117
2119
2120 // update file record with index
2121 FileRecord->MFTRecordNumber = MftIndex;
2122
2123 // [BitmapData should have been updated via RtlFindClearBitsAndSet()]
2124
2125 // Restore the system reserved bits
2126 BitmapData[2] = SystemReservedBits;
2127
2128 // write the bitmap back to the MFT's $Bitmap attribute
2129 Status = WriteAttribute(DeviceExt, BitmapContext, 0, BitmapData, BitmapDataSize, &LengthWritten, FileRecord);
2131 {
2134 ReleaseAttributeContext(BitmapContext);
2136 }
2137
2138 // update the file record (write it to disk)
2140
2142 {
2145 ReleaseAttributeContext(BitmapContext);
2147 }
2148
2149 *DestinationIndex = MftIndex;
2150
2152 ReleaseAttributeContext(BitmapContext);
2153
2155}
Definition: gdiplusheaders.h:379
NTSTATUS UpdateFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MftIndex, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:1931
VOID ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
Definition: mft.c:104
NTSTATUS FindAttribute(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, ULONG Type, PCWSTR Name, ULONG NameLength, PNTFS_ATTR_CONTEXT *AttrCtx, PULONG Offset)
Definition: mft.c:131
ULONG ReadAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length)
Definition: mft.c:1065
NTSTATUS WriteAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, const PUCHAR Buffer, ULONG Length, PULONG RealLengthWritten, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:1315
NTSTATUS IncreaseMftSize(PDEVICE_EXTENSION Vcb, BOOLEAN CanWait)
Definition: mft.c:293
NTSTATUS AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, PDEVICE_EXTENSION DeviceExt, PULONGLONG DestinationIndex, BOOLEAN CanWait)
Definition: mft.c:2022
Definition: gdiplusimaging.h:176
Definition: ntfs.h:231
Definition: typedefs.h:89
Referenced by AddNewMftEntry(), NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ AddRun()
| NTSTATUS AddRun | ( | PNTFS_VCB | Vcb, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONGLONG | NextAssignedCluster, | ||
| ULONG | RunLength | ||
| ) |
Definition at line 599 of file attrib.c.
605{
607 int DataRunMaxLength;
608 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
609 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
610 ULONGLONG NextVBN = 0;
611
612 PUCHAR RunBuffer;
613 ULONG RunBufferSize;
614
615 if (!AttrContext->pRecord->IsNonResident)
617
618 if (AttrContext->pRecord->NonResident.AllocatedSize != 0)
619 NextVBN = AttrContext->pRecord->NonResident.HighestVCN + 1;
620
621 // Add newly-assigned clusters to mcb
622 _SEH2_TRY
623 {
625 NextVBN,
626 NextAssignedCluster,
627 RunLength))
628 {
630 }
631 }
633 {
636 }
637 _SEH2_END;
638
640 if (!RunBuffer)
641 {
644 }
645
646 // Convert the map control block back to encoded data runs
647 ConvertLargeMCBToDataRuns(&AttrContext->DataRunsMCB, RunBuffer, Vcb->NtfsInfo.BytesPerCluster, &RunBufferSize);
648
649 // Get the amount of free space between the start of the of the first data run and the attribute end
650 DataRunMaxLength = AttrContext->pRecord->Length - AttrContext->pRecord->NonResident.MappingPairsOffset;
651
652 // Do we need to extend the attribute (or convert to attribute list)?
653 if (DataRunMaxLength < RunBufferSize)
654 {
655 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
656 PNTFS_ATTR_RECORD NewRecord;
657
658 // Add free space at the end of the file record to DataRunMaxLength
660
661 // Can we resize the attribute?
662 if (DataRunMaxLength < RunBufferSize)
663 {
664 DPRINT1("FIXME: Need to create attribute list! Max Data Run Length available: %d, RunBufferSize: %d\n", DataRunMaxLength, RunBufferSize);
667 }
668
669 // Are there more attributes after the one we're resizing?
671 {
672 PNTFS_ATTR_RECORD FinalAttribute;
673
674 // Calculate where to move the trailing attributes
675 ULONG_PTR MoveTo = (ULONG_PTR)DestinationAttribute + AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize;
677
679
680 // Move the trailing attributes; FinalAttribute will point to the end marker
682
683 // set the file record end
685 }
686
687 // calculate position of end markers
688 NextAttributeOffset = AttrOffset + AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize;
690
691 // Update the length of the destination attribute
692 DestinationAttribute->Length = NextAttributeOffset - AttrOffset;
693
694 // Create a new copy of the attribute record
696 RtlCopyMemory(NewRecord, AttrContext->pRecord, AttrContext->pRecord->Length);
698
699 // Free the old copy of the attribute record, which won't be large enough
701
702 // Set the attribute context's record to the new copy
703 AttrContext->pRecord = NewRecord;
704
705 // if NextAttribute is the AttributeEnd marker
707 {
708 // End the file record
711 }
712 }
713
714 // Update HighestVCN
715 DestinationAttribute->NonResident.HighestVCN =
716 AttrContext->pRecord->NonResident.HighestVCN = max(NextVBN - 1 + RunLength,
717 AttrContext->pRecord->NonResident.HighestVCN);
718
719 // Write data runs to destination attribute
720 RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
721 RunBuffer,
722 RunBufferSize);
723
724 // Update the attribute record in the attribute context
725 RtlCopyMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + AttrContext->pRecord->NonResident.MappingPairsOffset),
726 RunBuffer,
727 RunBufferSize);
728
729 // Update the file record
731
733
734 NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
735
737}
VOID NtfsDumpDataRuns(PVOID StartOfRun, ULONGLONG CurrentLCN)
Definition: attrib.c:1755
NTSTATUS ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, PUCHAR RunBuffer, ULONG MaxBufferSize, PULONG UsedBufferSize)
Definition: attrib.c:896
Definition: nsiface.idl:2307
BOOLEAN NTAPI FsRtlAddLargeMcbEntry(IN PLARGE_MCB Mcb, IN LONGLONG Vbn, IN LONGLONG Lbn, IN LONGLONG SectorCount)
Definition: largemcb.c:288
PNTFS_ATTR_RECORD MoveAttributes(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_RECORD FirstAttributeToMove, ULONG FirstAttributeOffset, ULONG_PTR MoveTo)
Definition: mft.c:512
Referenced by SetNonResidentAttributeDataLength().
◆ AddStandardInformation()
| NTSTATUS AddStandardInformation | ( | PFILE_RECORD_HEADER | FileRecord, |
| PNTFS_ATTR_RECORD | AttributeAddress | ||
| ) |
Definition at line 766 of file attrib.c.
768{
770 PSTANDARD_INFORMATION StandardInfo = (PSTANDARD_INFORMATION)((LONG_PTR)AttributeAddress + ResidentHeaderLength);
771 LARGE_INTEGER SystemTime;
773
775 {
778 }
779
784 AttributeAddress->Resident.ValueOffset = ResidentHeaderLength;
786
787 // set dates and times
788 KeQuerySystemTime(&SystemTime);
794
795 // move the attribute-end and file-record-end markers to the end of the file record
797 SetFileRecordEnd(FileRecord, AttributeAddress, FileRecordEnd);
798
800}
struct STANDARD_INFORMATION * PSTANDARD_INFORMATION
Definition: ntfs.h:329
Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ AttributeAllocatedLength()
| ULONGLONG AttributeAllocatedLength | ( | PNTFS_ATTR_RECORD | AttrRecord | ) |
Definition at line 249 of file mft.c.
250{
253 else
255}
Referenced by NtfsGetFileSize(), NtfsGetStreamInformation(), NtfsReadFile(), NtfsSetEndOfFile(), and NtfsWriteFile().
◆ AttributeDataLength()
| ULONGLONG AttributeDataLength | ( | PNTFS_ATTR_RECORD | AttrRecord | ) |
Definition at line 259 of file mft.c.
260{
263 else
265}
Referenced by AddNewMftEntry(), AllocateIndexNode(), BrowseIndexEntries(), FreeClusters(), IncreaseMftSize(), InternalReadNonResidentAttributes(), NtfsAddFilenameToDirectory(), NtfsAllocateClusters(), NtfsGetFileSize(), NtfsGetFreeClusters(), NtfsGetStreamInformation(), NtfsGetVolumeData(), NtfsReadFCBAttribute(), NtfsReadFile(), NtfsSetEndOfFile(), NtfsWriteFile(), PrintAllVCNs(), SetAttributeDataLength(), UpdateFileNameRecord(), UpdateIndexEntryFileNameSize(), and UpdateMftMirror().
◆ CompareFileName()
| BOOLEAN CompareFileName | ( | PUNICODE_STRING | FileName, |
| PINDEX_ENTRY_ATTRIBUTE | IndexEntry, | ||
| BOOLEAN | DirSearch, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 2650 of file mft.c.
2654{
2656 UNICODE_STRING EntryName;
2657
2659 EntryName.Length =
2661
2662 if (DirSearch)
2663 {
2664 UNICODE_STRING IntFileName;
2665 if (!CaseSensitive)
2666 {
2669 }
2670 else
2671 {
2672 IntFileName = *FileName;
2673 }
2674
2676
2678 {
2679 RtlFreeUnicodeString(&IntFileName);
2680 }
2681
2682 return Ret;
2683 }
2684 else
2685 {
2687 }
2688}
ULONG RtlCompareUnicodeString(PUNICODE_STRING s1, PUNICODE_STRING s2, BOOLEAN UpCase)
Definition: string_lib.cpp:31
NTSTATUS RtlUpcaseUnicodeString(PUNICODE_STRING dst, PUNICODE_STRING src, BOOLEAN Alloc)
Definition: string_lib.cpp:46
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
BOOLEAN NTAPI FsRtlIsNameInExpression(IN PUNICODE_STRING Expression, IN PUNICODE_STRING Name, IN BOOLEAN IgnoreCase, IN PWCHAR UpcaseTable OPTIONAL)
Definition: name.c:514
Definition: filecomp.c:348
Referenced by BrowseIndexEntries(), BrowseSubNodeIndexEntries(), and UpdateIndexEntryFileNameSize().
◆ CompareTreeKeys()
| LONG CompareTreeKeys | ( | PB_TREE_KEY | Key1, |
| PB_TREE_KEY | Key2, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 417 of file btree.c.
418{
419 UNICODE_STRING Key1Name, Key2Name;
420 LONG Comparison;
421
422 // Key1 must not be the final key (AKA the dummy key)
424
425 // If Key2 is the "dummy key", key 1 will always come first
427 return -1;
428
432
436
437 // Are the two keys the same length?
440
441 // Is Key1 shorter?
443 {
444 // Truncate KeyName2 to be the same length as KeyName1
446
447 // Compare the names of the same length
448 Comparison = RtlCompareUnicodeString(&Key1Name, &Key2Name, !CaseSensitive);
449
450 // If the truncated names are the same length, the shorter one comes first
451 if (Comparison == 0)
452 return -1;
453 }
454 else
455 {
456 // Key2 is shorter
457 // Truncate KeyName1 to be the same length as KeyName2
459
460 // Compare the names of the same length
461 Comparison = RtlCompareUnicodeString(&Key1Name, &Key2Name, !CaseSensitive);
462
463 // If the truncated names are the same length, the shorter one comes first
464 if (Comparison == 0)
465 return 1;
466 }
467
468 return Comparison;
469}
Referenced by NtfsInsertKey().
◆ ConvertDataRunsToLargeMCB()
| NTSTATUS ConvertDataRunsToLargeMCB | ( | PUCHAR | DataRun, |
| PLARGE_MCB | DataRunsMCB, | ||
| PULONGLONG | pNextVBN | ||
| ) |
Definition at line 825 of file attrib.c.
828{
829 LONGLONG DataRunOffset;
830 ULONGLONG DataRunLength;
831 LONGLONG DataRunStartLCN;
832 ULONGLONG LastLCN = 0;
833
834 // Initialize the MCB, potentially catch an exception
835 _SEH2_TRY{
839 } _SEH2_END;
840
841 while (*DataRun != 0)
842 {
843 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
844
845 if (DataRunOffset != -1)
846 {
847 // Normal data run.
848 DataRunStartLCN = LastLCN + DataRunOffset;
849 LastLCN = DataRunStartLCN;
850
851 _SEH2_TRY{
853 *pNextVBN,
854 DataRunStartLCN,
855 DataRunLength))
856 {
858 }
860 FsRtlUninitializeLargeMcb(DataRunsMCB);
862 } _SEH2_END;
863
864 }
865
866 *pNextVBN += DataRunLength;
867 }
868
870}
PUCHAR DecodeRun(PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength)
Definition: attrib.c:966
VOID NTAPI FsRtlUninitializeLargeMcb(IN PLARGE_MCB Mcb)
Definition: largemcb.c:1096
VOID NTAPI FsRtlInitializeLargeMcb(IN PLARGE_MCB Mcb, IN POOL_TYPE PoolType)
Definition: largemcb.c:451
Referenced by PrepareAttributeContext().
◆ ConvertLargeMCBToDataRuns()
| NTSTATUS ConvertLargeMCBToDataRuns | ( | PLARGE_MCB | DataRunsMCB, |
| PUCHAR | RunBuffer, | ||
| ULONG | MaxBufferSize, | ||
| PULONG | UsedBufferSize | ||
| ) |
Definition at line 896 of file attrib.c.
900{
902 ULONG RunBufferOffset = 0;
903 LONGLONG DataRunOffset;
904 ULONGLONG LastLCN = 0;
907
908
910
911 // convert each mcb entry to a data run
913 {
914 UCHAR DataRunOffsetSize = 0;
915 UCHAR DataRunLengthSize = 0;
916 UCHAR ControlByte = 0;
917
918 // [vbn, lbn, count]
920
921 // TODO: check for holes and convert to sparse runs
922 DataRunOffset = Lbn - LastLCN;
923 LastLCN = Lbn;
924
925 // now we need to determine how to represent DataRunOffset with the minimum number of bytes
929
930 // determine how to represent DataRunLengthSize with the minimum number of bytes
934
935 // ensure the next data run + end marker would be <= Max buffer size
936 if (RunBufferOffset + 2 + DataRunLengthSize + DataRunOffsetSize > MaxBufferSize)
937 {
940 break;
941 }
942
943 // pack and copy the control byte
944 ControlByte = (DataRunOffsetSize << 4) + DataRunLengthSize;
945 RunBuffer[RunBufferOffset++] = ControlByte;
946
947 // copy DataRunLength
949 RunBufferOffset += DataRunLengthSize;
950
951 // copy DataRunOffset
952 RtlCopyMemory(RunBuffer + RunBufferOffset, &DataRunOffset, DataRunOffsetSize);
953 RunBufferOffset += DataRunOffsetSize;
954 }
955
956 // End of data runs
957 RunBuffer[RunBufferOffset++] = 0;
958
959 *UsedBufferSize = RunBufferOffset;
961
963}
UCHAR GetPackedByteCount(LONGLONG NumberToPack, BOOLEAN IsSigned)
Definition: attrib.c:1846
BOOLEAN NTAPI FsRtlGetNextLargeMcbEntry(IN PLARGE_MCB Mcb, IN ULONG RunIndex, OUT PLONGLONG Vbn, OUT PLONGLONG Lbn, OUT PLONGLONG SectorCount)
Definition: largemcb.c:392
Referenced by AddRun(), FreeClusters(), ReadAttribute(), and WriteAttribute().
◆ CreateBTreeFromIndex()
| NTSTATUS CreateBTreeFromIndex | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecordWithIndex, | ||
| PNTFS_ATTR_CONTEXT | IndexRootContext, | ||
| PINDEX_ROOT_ATTRIBUTE | IndexRoot, | ||
| PB_TREE * | NewTree | ||
| ) |
Definition at line 682 of file btree.c.
688{
689 PINDEX_ENTRY_ATTRIBUTE CurrentNodeEntry;
691 PB_TREE_FILENAME_NODE RootNode = ExAllocatePoolWithTag(NonPagedPool, sizeof(B_TREE_FILENAME_NODE), TAG_NTFS);
696
698
700 {
704 if (CurrentKey)
709 }
710
714
715 // See if the file record has an attribute allocation
717 FileRecordWithIndex,
720 4,
721 &IndexAllocationContext,
722 NULL);
724 IndexAllocationContext = NULL;
725
726 // Setup the Tree
727 RootNode->FirstKey = CurrentKey;
729
730 // Make sure we won't try reading past the attribute-end
731 if (FIELD_OFFSET(INDEX_ROOT_ATTRIBUTE, Header) + IndexRoot->Header.TotalSizeOfEntries > IndexRootContext->pRecord->Resident.ValueLength)
732 {
737 }
738
739 // Start at the first node entry
743
744 // Create a key for each entry in the node
746 {
747 // Allocate memory for the current entry
748 CurrentKey->IndexEntry = ExAllocatePoolWithTag(NonPagedPool, CurrentNodeEntry->Length, TAG_NTFS);
750 {
755 }
756
757 RootNode->KeyCount++;
758
759 // If this isn't the last entry
761 {
762 // Create the next key
764 if (!NextKey)
765 {
770 }
771
773
774 // Add NextKey to the end of the list
775 CurrentKey->NextKey = NextKey;
776
777 // Copy the current entry to its key
779
780 // Does this key have a sub-node?
782 {
783 // Create the child node
785 IndexRoot,
786 IndexAllocationContext,
787 CurrentKey->IndexEntry);
789 {
794 }
795 }
796
797 // Advance to the next entry
798 CurrentOffset += CurrentNodeEntry->Length;
799 CurrentNodeEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)CurrentNodeEntry + CurrentNodeEntry->Length);
800 CurrentKey = NextKey;
801 }
802 else
803 {
804 // Copy the final entry to its key
807
808 // Does this key have a sub-node?
810 {
811 // Create the child node
813 IndexRoot,
814 IndexAllocationContext,
815 CurrentKey->IndexEntry);
817 {
822 }
823 }
824
825 break;
826 }
827 }
828
829 *NewTree = Tree;
831
832Cleanup:
833 if (IndexAllocationContext)
834 ReleaseAttributeContext(IndexAllocationContext);
835
837}
PB_TREE_FILENAME_NODE CreateBTreeNodeFromIndexNode(PDEVICE_EXTENSION Vcb, PINDEX_ROOT_ATTRIBUTE IndexRoot, PNTFS_ATTR_CONTEXT IndexAllocationAttributeCtx, PINDEX_ENTRY_ATTRIBUTE NodeEntry)
Definition: btree.c:499
Definition: Header.h:9
struct INDEX_ENTRY_ATTRIBUTE * PINDEX_ENTRY_ATTRIBUTE
Definition: ntfs.h:454
Definition: ntfs.h:409
Definition: ntfs.h:392
Definition: ntfs.h:445
Definition: ntfs.h:435
Referenced by NtfsAddFilenameToDirectory().
◆ CreateEmptyBTree()
Definition at line 348 of file btree.c.
349{
351 PB_TREE_FILENAME_NODE RootNode = ExAllocatePoolWithTag(NonPagedPool, sizeof(B_TREE_FILENAME_NODE), TAG_NTFS);
352 PB_TREE_KEY DummyKey;
353
355
357 {
364 }
365
366 // Create the dummy key
368 if (!DummyKey)
369 {
374 }
375
378
379 // Setup the Tree
380 RootNode->FirstKey = DummyKey;
381 RootNode->KeyCount = 1;
384
385 *NewTree = Tree;
386
387 // Memory will be freed when DestroyBTree() is called
388
390}
Referenced by NtfsCreateDirectory().
◆ CreateIndexRootFromBTree()
| NTSTATUS CreateIndexRootFromBTree | ( | PDEVICE_EXTENSION | DeviceExt, |
| PB_TREE | Tree, | ||
| ULONG | MaxIndexSize, | ||
| PINDEX_ROOT_ATTRIBUTE * | IndexRoot, | ||
| ULONG * | Length | ||
| ) |
Definition at line 910 of file btree.c.
915{
917 PB_TREE_KEY CurrentKey;
918 PINDEX_ENTRY_ATTRIBUTE CurrentNodeEntry;
920 DeviceExt->NtfsInfo.BytesPerFileRecord,
921 TAG_NTFS);
922
923 DPRINT("CreateIndexRootFromBTree(%p, %p, 0x%lx, %p, %p)\n", DeviceExt, Tree, MaxIndexSize, IndexRoot, Length);
924
925#ifndef NDEBUG
927#endif
928
929 if (!NewIndexRoot)
930 {
933 }
934
935 // Setup the new index root
936 RtlZeroMemory(NewIndexRoot, DeviceExt->NtfsInfo.BytesPerFileRecord);
937
940 NewIndexRoot->SizeOfEntry = DeviceExt->NtfsInfo.BytesPerIndexRecord;
941 // If Bytes per index record is less than cluster size, clusters per index record becomes sectors per index
943 NewIndexRoot->ClustersPerIndexRecord = NewIndexRoot->SizeOfEntry / DeviceExt->NtfsInfo.BytesPerSector;
944 else
945 NewIndexRoot->ClustersPerIndexRecord = NewIndexRoot->SizeOfEntry / DeviceExt->NtfsInfo.BytesPerCluster;
946
947 // Setup the Index node header
950
951 // Start summing the total size of this node's entries
953
954 // Setup each Node Entry
955 CurrentKey = Tree->RootNode->FirstKey;
960 {
961 // Would adding the current entry to the index increase the index size beyond the limit we've set?
962 ULONG IndexSize = NewIndexRoot->Header.TotalSizeOfEntries - NewIndexRoot->Header.FirstEntryOffset + CurrentKey->IndexEntry->Length;
963 if (IndexSize > MaxIndexSize)
964 {
968 }
969
971
972 // Copy the index entry
974
976 CurrentNodeEntry->KeyLength,
977 CurrentNodeEntry->Length);
978
979 // Does the current key have any sub-nodes?
982
983 // Add Length of Current Entry to Total Size of Entries
985
986 // Go to the next node entry
987 CurrentNodeEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)CurrentNodeEntry + CurrentNodeEntry->Length);
988
989 CurrentKey = CurrentKey->NextKey;
990 }
991
993
994 *IndexRoot = NewIndexRoot;
996
998}
Definition: ntfs.h:383
Referenced by NtfsAddFilenameToDirectory(), and NtfsCreateDirectory().
◆ DecodeRun()
Definition at line 966 of file attrib.c.
969{
970 UCHAR DataRunOffsetSize;
971 UCHAR DataRunLengthSize;
973
974 DataRunOffsetSize = (*DataRun >> 4) & 0xF;
975 DataRunLengthSize = *DataRun & 0xF;
976 *DataRunOffset = 0;
977 *DataRunLength = 0;
978 DataRun++;
980 {
982 DataRun++;
983 }
984
985 /* NTFS 3+ sparse files */
986 if (DataRunOffsetSize == 0)
987 {
988 *DataRunOffset = -1;
989 }
990 else
991 {
993 {
995 DataRun++;
996 }
997 /* The last byte contains sign so we must process it different way. */
999 }
1000
1005
1006 return DataRun;
1007}
Referenced by ConvertDataRunsToLargeMCB(), FindRun(), GetLastClusterInDataRun(), NtfsDumpDataRuns(), PrepareAttributeContext(), PrintAttributeInfo(), ReadAttribute(), and WriteAttribute().
◆ DemoteBTreeRoot()
Definition at line 1089 of file btree.c.
1090{
1091 PB_TREE_FILENAME_NODE NewSubNode, NewIndexRoot;
1092 PB_TREE_KEY DummyKey;
1093
1095
1096#ifndef NDEBUG
1098#endif
1099
1100 // Create a new node that will hold the keys currently in index root
1102 if (!NewSubNode)
1103 {
1106 }
1108
1109 // Copy the applicable data from the old index root node
1113
1114 // Create a new dummy key, and make the new node it's child
1116 if (!DummyKey)
1117 {
1121 }
1122
1123 // Make the new node a child of the dummy key
1124 DummyKey->LesserChild = NewSubNode;
1125
1126 // Create a new index root node
1128 if (!NewIndexRoot)
1129 {
1134 }
1136
1138
1139 // Insert the dummy key into the new node
1140 NewIndexRoot->FirstKey = DummyKey;
1141 NewIndexRoot->KeyCount = 1;
1143
1144 // Make the new node the Tree's root node
1145 Tree->RootNode = NewIndexRoot;
1146
1147#ifndef NDEBUG
1149#endif
1150
1152}
Referenced by NtfsAddFilenameToDirectory().
◆ DestroyBTree()
Definition at line 1542 of file btree.c.
1543{
1546}
Referenced by CreateBTreeFromIndex(), NtfsAddFilenameToDirectory(), and NtfsCreateDirectory().
◆ DestroyBTreeNode()
| VOID DestroyBTreeNode | ( | PB_TREE_FILENAME_NODE | Node | ) |
Definition at line 1511 of file btree.c.
1512{
1513 PB_TREE_KEY NextKey;
1517 {
1518 NT_ASSERT(CurrentKey);
1519 NextKey = CurrentKey->NextKey;
1520 DestroyBTreeKey(CurrentKey);
1521 CurrentKey = NextKey;
1522 }
1523
1525
1527}
Definition: dlist.c:348
Referenced by CreateBTreeNodeFromIndexNode(), DestroyBTree(), and DestroyBTreeKey().
◆ DumpBTree()
Definition at line 1622 of file btree.c.
1623{
1626}
VOID DumpBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, ULONG Number, ULONG Depth)
Definition: btree.c:1583
Referenced by CreateIndexRootFromBTree(), DemoteBTreeRoot(), NtfsAddFilenameToDirectory(), NtfsInsertKey(), and UpdateIndexAllocation().
◆ DumpBTreeKey()
| VOID DumpBTreeKey | ( | PB_TREE | Tree, |
| PB_TREE_KEY | Key, | ||
| ULONG | Number, | ||
| ULONG | Depth | ||
| ) |
Definition at line 1549 of file btree.c.
1550{
1555
1557 {
1563 }
1564 else
1565 {
1567 }
1568
1569 // Is there a child node?
1571 {
1574 else
1575 {
1576 // This will be an assert once nodes with arbitrary depth are debugged
1577 DPRINT1("DRIVER ERROR: No Key->LesserChild despite Key->IndexEntry->Flags indicating this is a node!\n");
1578 }
1579 }
1580}
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
Definition: ntpoapi.h:207
Definition: find_test.cpp:52
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION _In_ ULONG _In_ SIZE_T _In_ ULONG _In_ USHORT Depth
Definition: exfuncs.h:819
Referenced by DumpBTreeNode().
◆ DumpBTreeNode()
| VOID DumpBTreeNode | ( | PB_TREE | Tree, |
| PB_TREE_FILENAME_NODE | Node, | ||
| ULONG | Number, | ||
| ULONG | Depth | ||
| ) |
Definition at line 1583 of file btree.c.
1587{
1588 PB_TREE_KEY CurrentKey;
1592 DbgPrint("Node #%d, Depth %d, has %d key%s", Number, Depth, Node->KeyCount, Node->KeyCount == 1 ? "" : "s");
1593
1598 else
1600
1601 CurrentKey = Node->FirstKey;
1603 {
1605 CurrentKey = CurrentKey->NextKey;
1606 }
1607}
VOID DumpBTreeKey(PB_TREE Tree, PB_TREE_KEY Key, ULONG Number, ULONG Depth)
Definition: btree.c:1549
Referenced by DumpBTree(), DumpBTreeKey(), and SplitBTreeNode().
◆ EnumerAttribute()
| VOID EnumerAttribute | ( | PFILE_RECORD_HEADER | file, |
| PDEVICE_EXTENSION | Vcb, | ||
| PDEVICE_OBJECT | DeviceObject | ||
| ) |
◆ FindAttribute()
| NTSTATUS FindAttribute | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | MftRecord, | ||
| ULONG | Type, | ||
| PCWSTR | Name, | ||
| ULONG | NameLength, | ||
| PNTFS_ATTR_CONTEXT * | AttrCtx, | ||
| PULONG | Offset | ||
| ) |
Definition at line 131 of file mft.c.
138{
142 PNTFS_ATTR_RECORD Attribute;
143 PNTFS_ATTRIBUTE_LIST_ITEM AttrListItem;
144
145 DPRINT("FindAttribute(%p, %p, 0x%x, %S, %lu, %p, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx, Offset);
146
150 {
152 {
153 if (NameLength != 0)
154 {
155 PWCHAR AttrName;
156
159 if (RtlCompareMemory(AttrName, Name, NameLength * sizeof(WCHAR)) == (NameLength * sizeof(WCHAR)))
160 {
162 }
163 }
164 else
165 {
167 }
168
170 {
171 /* Found it, fill up the context and return. */
173 *AttrCtx = PrepareAttributeContext(Attribute);
174
175 (*AttrCtx)->FileMFTIndex = MftRecord->MFTRecordNumber;
176
179
182 }
183 }
184
186 }
187
188 /* No attribute found, check if it is referenced in another file record */
191 {
193 {
194 if (NameLength != 0)
195 {
196 PWCHAR AttrName;
197
200 if (RtlCompareMemory(AttrName, Name, NameLength * sizeof(WCHAR)) == (NameLength * sizeof(WCHAR)))
201 {
203 }
204 }
205 else
206 {
208 }
209
211 {
212 /* Get the MFT Index of attribute */
213 ULONGLONG MftIndex;
214 PFILE_RECORD_HEADER RemoteHdr;
215
217 RemoteHdr = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
218
220 {
223 }
224
225 /* Check we are not reading ourselves */
227 {
229 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, RemoteHdr);
232 }
233 /* Read the new file record */
236 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, RemoteHdr);
239 }
240 }
242 }
245}
NTSTATUS FindFirstAttribute(PFIND_ATTR_CONTXT Context, PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, BOOLEAN OnlyResident, PNTFS_ATTR_RECORD *Attribute)
Definition: attrib.c:1383
NTSTATUS FindFirstAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
Definition: attrib.c:1307
NTSTATUS FindNextAttribute(PFIND_ATTR_CONTXT Context, PNTFS_ATTR_RECORD *Attribute)
Definition: attrib.c:1431
NTSTATUS FindNextAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
Definition: attrib.c:1321
NTSTATUS ReadFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG index, PFILE_RECORD_HEADER file)
Definition: mft.c:1631
PNTFS_ATTR_CONTEXT PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
Definition: mft.c:41
Definition: compobj.c:4795
Definition: ntfs.h:308
Definition: ntfs.h:251
Definition: ntfs.h:547
Referenced by AddNewMftEntry(), AllocateIndexNode(), BrowseIndexEntries(), CreateBTreeFromIndex(), tinyxml2::XMLElement::FindAttribute(), FindAttribute(), FreeClusters(), GetVolumeBitmap(), IncreaseMftSize(), NtfsAddFilenameToDirectory(), NtfsAllocateClusters(), NtfsCreateFile(), NtfsDirFindFile(), NtfsFindMftRecord(), NtfsGetFileSize(), NtfsGetFreeClusters(), NtfsGetVolumeData(), NtfsReadFCBAttribute(), NtfsReadFile(), NtfsSetEndOfFile(), NtfsWriteFile(), tinyxml2::XMLElement::QueryBoolAttribute(), tinyxml2::XMLElement::QueryDoubleAttribute(), tinyxml2::XMLElement::QueryFloatAttribute(), tinyxml2::XMLElement::QueryIntAttribute(), tinyxml2::XMLElement::QueryUnsignedAttribute(), UpdateFileNameRecord(), UpdateIndexAllocation(), UpdateIndexEntryFileNameSize(), UpdateMftMirror(), and WriteAttribute().
◆ FindCloseAttribute()
| VOID FindCloseAttribute | ( | PFIND_ATTR_CONTXT | Context | ) |
Definition at line 1465 of file attrib.c.
1466{
1468 {
1471 }
1472}
Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().
◆ FindFirstAttribute()
| NTSTATUS FindFirstAttribute | ( | PFIND_ATTR_CONTXT | Context, |
| PDEVICE_EXTENSION | Vcb, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| BOOLEAN | OnlyResident, | ||
| PNTFS_ATTR_RECORD * | Attribute | ||
| ) |
Definition at line 1383 of file attrib.c.
1388{
1390
1391 DPRINT("FindFistAttribute(%p, %p, %p, %p, %u, %p)\n", Context, Vcb, FileRecord, OnlyResident, Attribute);
1392
1394 Context->OnlyResident = OnlyResident;
1401
1403 {
1406 }
1408 {
1411 {
1413 }
1414
1417 {
1419 }
1420 }
1421 else
1422 {
1423 *Attribute = Context->CurrAttr;
1425 }
1426
1428}
static NTSTATUS InternalReadNonResidentAttributes(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1214
static PNTFS_ATTR_RECORD InternalGetNextAttribute(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1334
Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().
◆ FindFirstAttributeListItem()
| NTSTATUS FindFirstAttributeListItem | ( | PFIND_ATTR_CONTXT | Context, |
| PNTFS_ATTRIBUTE_LIST_ITEM * | Item | ||
| ) |
Definition at line 1307 of file attrib.c.
1309{
1311 {
1313 }
1314
1318}
Referenced by FindAttribute().
◆ FindNextAttribute()
| NTSTATUS FindNextAttribute | ( | PFIND_ATTR_CONTXT | Context, |
| PNTFS_ATTR_RECORD * | Attribute | ||
| ) |
Definition at line 1431 of file attrib.c.
1433{
1435
1437
1440 {
1442 }
1443
1445 {
1447 }
1448
1451 {
1453 }
1454
1457 {
1459 }
1460
1462}
Referenced by FindAttribute(), GetFileNameFromRecord(), GetNfsVolumeData(), GetStandardInformationFromRecord(), NtfsDumpFileAttributes(), NtfsGetStreamInformation(), NtfsReadFile(), and NtfsWriteFile().
◆ FindNextAttributeListItem()
| NTSTATUS FindNextAttributeListItem | ( | PFIND_ATTR_CONTXT | Context, |
| PNTFS_ATTRIBUTE_LIST_ITEM * | Item | ||
| ) |
Definition at line 1321 of file attrib.c.
1323{
1326 {
1328 }
1330}
static PNTFS_ATTRIBUTE_LIST_ITEM InternalGetNextAttributeListItem(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1267
Referenced by FindAttribute().
◆ FixupUpdateSequenceArray()
| NTSTATUS FixupUpdateSequenceArray | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_RECORD_HEADER | Record | ||
| ) |
Definition at line 1965 of file mft.c.
1967{
1968 USHORT *USA;
1969 USHORT USANumber;
1970 USHORT USACount;
1971 USHORT *Block;
1972
1974 USANumber = *(USA++);
1977
1978 DPRINT("FixupUpdateSequenceArray(%p, %p)\nUSANumber: %u\tUSACount: %u\n", Vcb, Record, USANumber, USACount);
1979
1980 while (USACount)
1981 {
1982 if (*Block != USANumber)
1983 {
1986 }
1987 *Block = *(USA++);
1989 USACount--;
1990 }
1991
1993}
Referenced by BrowseSubNodeIndexEntries(), CreateBTreeNodeFromIndexNode(), PrintAllVCNs(), ReadFileRecord(), UpdateFileRecord(), and UpdateIndexEntryFileNameSize().
◆ FreeClusters()
| NTSTATUS FreeClusters | ( | PNTFS_VCB | Vcb, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| ULONG | AttrOffset, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONG | ClustersToFree | ||
| ) |
Definition at line 1057 of file attrib.c.
1062{
1064 ULONG ClustersLeftToFree = ClustersToFree;
1065
1066 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
1067 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
1068 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + NextAttributeOffset);
1069
1070 PUCHAR RunBuffer;
1071 ULONG RunBufferSize = 0;
1072
1073 PFILE_RECORD_HEADER BitmapRecord;
1074 PNTFS_ATTR_CONTEXT DataContext;
1075 ULONGLONG BitmapDataSize;
1078 ULONG LengthWritten;
1079
1080 if (!AttrContext->pRecord->IsNonResident)
1081 {
1083 }
1084
1085 // Read the $Bitmap file
1086 BitmapRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
1088 {
1091 }
1092
1095 {
1097 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BitmapRecord);
1098 return 0;
1099 }
1100
1103 {
1105 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BitmapRecord);
1106 return 0;
1107 }
1108
1109 BitmapDataSize = AttributeDataLength(DataContext->pRecord);
1112 BitmapData = ExAllocatePoolWithTag(NonPagedPool, ROUND_UP(BitmapDataSize, Vcb->NtfsInfo.BytesPerSector), TAG_NTFS);
1114 {
1116 ReleaseAttributeContext(DataContext);
1117 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BitmapRecord);
1118 return 0;
1119 }
1120
1122
1124
1125 // free clusters in $BITMAP file
1126 while (ClustersLeftToFree > 0)
1127 {
1129
1131 {
1133 DPRINT1("DRIVER ERROR: FreeClusters called to free %lu clusters, which is %lu more clusters than are assigned to attribute!",
1134 ClustersToFree,
1135 ClustersLeftToFree);
1136 break;
1137 }
1138
1140 {
1141 // deallocate this cluster
1143 }
1144 FsRtlTruncateLargeMcb(&AttrContext->DataRunsMCB, AttrContext->pRecord->NonResident.HighestVCN);
1145
1146 // decrement HighestVCN, but don't let it go below 0
1147 AttrContext->pRecord->NonResident.HighestVCN = min(AttrContext->pRecord->NonResident.HighestVCN, AttrContext->pRecord->NonResident.HighestVCN - 1);
1148 ClustersLeftToFree--;
1149 }
1150
1151 // update $BITMAP file on disk
1152 Status = WriteAttribute(Vcb, DataContext, 0, BitmapData, (ULONG)BitmapDataSize, &LengthWritten, FileRecord);
1154 {
1155 ReleaseAttributeContext(DataContext);
1157 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BitmapRecord);
1159 }
1160
1161 ReleaseAttributeContext(DataContext);
1163 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BitmapRecord);
1164
1165 // Save updated data runs to file record
1166
1167 // Allocate some memory for a new RunBuffer
1169 if (!RunBuffer)
1170 {
1173 }
1174
1175 // Convert the map control block back to encoded data runs
1176 ConvertLargeMCBToDataRuns(&AttrContext->DataRunsMCB, RunBuffer, Vcb->NtfsInfo.BytesPerCluster, &RunBufferSize);
1177
1178 // Update HighestVCN
1179 DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
1180
1181 // Write data runs to destination attribute
1182 RtlCopyMemory((PVOID)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset),
1183 RunBuffer,
1184 RunBufferSize);
1185
1186 // Is DestinationAttribute the last attribute in the file record?
1188 {
1189 // update attribute length
1190 DestinationAttribute->Length = ALIGN_UP_BY(AttrContext->pRecord->NonResident.MappingPairsOffset + RunBufferSize,
1191 ATTR_RECORD_ALIGNMENT);
1192
1194
1195 AttrContext->pRecord->Length = DestinationAttribute->Length;
1196
1197 // write end markers
1198 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)DestinationAttribute + DestinationAttribute->Length);
1200 }
1201
1202 // Update the file record
1204
1206
1207 NtfsDumpDataRuns((PUCHAR)((ULONG_PTR)DestinationAttribute + DestinationAttribute->NonResident.MappingPairsOffset), 0);
1208
1210}
VOID NTAPI FsRtlTruncateLargeMcb(IN PLARGE_MCB Mcb, IN LONGLONG Vbn)
Definition: largemcb.c:1059
BOOLEAN NTAPI FsRtlLookupLastLargeMcbEntry(IN PLARGE_MCB Mcb, OUT PLONGLONG Vbn, OUT PLONGLONG Lbn)
Definition: largemcb.c:718
Referenced by FatExamineFatEntries(), GetDiskFreeSpaceW(), HandleNotify(), NtfsAllocateClusters(), NtfsGetFreeClusters(), and SetNonResidentAttributeDataLength().
◆ GetAllocationOffsetFromVCN()
| ULONGLONG GetAllocationOffsetFromVCN | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONG | IndexBufferSize, | ||
| ULONGLONG | Vcn | ||
| ) |
Definition at line 1630 of file btree.c.
1633{
1634 if (IndexBufferSize < DeviceExt->NtfsInfo.BytesPerCluster)
1635 return Vcn * DeviceExt->NtfsInfo.BytesPerSector;
1636
1637 return Vcn * DeviceExt->NtfsInfo.BytesPerCluster;
1638}
Referenced by CreateBTreeNodeFromIndexNode(), and UpdateIndexNode().
◆ GetBestFileNameFromRecord()
| PFILENAME_ATTRIBUTE GetBestFileNameFromRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 1985 of file attrib.c.
1987{
1989
1992 {
1995 {
1997 }
1998 }
1999
2001}
PFILENAME_ATTRIBUTE GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
Definition: attrib.c:1809
Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), NtfsGetNamesInformation(), NtfsMakeFCBFromDirEntry(), NtfsMoonWalkID(), NtfsSetEndOfFile(), and NtfsWriteFile().
◆ GetFileNameAttributeLength()
| ULONG GetFileNameAttributeLength | ( | PFILENAME_ATTRIBUTE | FileNameAttribute | ) |
Definition at line 1978 of file attrib.c.
1979{
1980 ULONG Length = FIELD_OFFSET(FILENAME_ATTRIBUTE, Name) + (FileNameAttribute->NameLength * sizeof(WCHAR));
1982}
Referenced by CreateBTreeKeyFromFilename().
◆ GetFileNameFromRecord()
| PFILENAME_ATTRIBUTE GetFileNameFromRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord, | ||
| UCHAR | NameType | ||
| ) |
Definition at line 1809 of file attrib.c.
1812{
1814 PNTFS_ATTR_RECORD Attribute;
1817
1820 {
1822 {
1827 {
1830 }
1831 }
1832
1834 }
1835
1838}
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 NameType
Definition: acpixf.h:658
Referenced by GetBestFileNameFromRecord(), NtfsGetBothDirectoryInformation(), and NtfsMakeRootFCB().
◆ GetIndexEntryVCN()
| ULONGLONG GetIndexEntryVCN | ( | PINDEX_ENTRY_ATTRIBUTE | IndexEntry | ) |
Definition at line 1641 of file btree.c.
1642{
1643 PULONGLONG Destination = (PULONGLONG)((ULONG_PTR)IndexEntry + IndexEntry->Length - sizeof(ULONGLONG));
1644
1646
1648}
Referenced by BrowseIndexEntries(), BrowseSubNodeIndexEntries(), and SplitBTreeNode().
◆ GetLastClusterInDataRun()
| NTSTATUS GetLastClusterInDataRun | ( | PDEVICE_EXTENSION | Vcb, |
| PNTFS_ATTR_RECORD | Attribute, | ||
| PULONGLONG | LastCluster | ||
| ) |
Definition at line 1908 of file attrib.c.
1909{
1910 LONGLONG DataRunOffset;
1911 ULONGLONG DataRunLength;
1912 LONGLONG DataRunStartLCN;
1913
1914 ULONGLONG LastLCN = 0;
1916
1919
1920 while (1)
1921 {
1922 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1923
1924 if (DataRunOffset != -1)
1925 {
1926 // Normal data run.
1927 DataRunStartLCN = LastLCN + DataRunOffset;
1928 LastLCN = DataRunStartLCN;
1929 *LastCluster = LastLCN + DataRunLength - 1;
1930 }
1931
1932 if (*DataRun == 0)
1933 break;
1934 }
1935
1937}
◆ GetPackedByteCount()
GetPackedByteCount Returns the minimum number of bytes needed to represent the value of a 64-bit number. Used to encode data runs.
Definition at line 1846 of file attrib.c.
1848{
1849 if (!IsSigned)
1850 {
1851 if (NumberToPack >= 0x0100000000000000)
1852 return 8;
1853 if (NumberToPack >= 0x0001000000000000)
1854 return 7;
1855 if (NumberToPack >= 0x0000010000000000)
1856 return 6;
1857 if (NumberToPack >= 0x0000000100000000)
1858 return 5;
1859 if (NumberToPack >= 0x0000000001000000)
1860 return 4;
1861 if (NumberToPack >= 0x0000000000010000)
1862 return 3;
1863 if (NumberToPack >= 0x0000000000000100)
1864 return 2;
1865 return 1;
1866 }
1867
1868 if (NumberToPack > 0)
1869 {
1870 // we have to make sure the number that gets encoded won't be interpreted as negative
1871 if (NumberToPack >= 0x0080000000000000)
1872 return 8;
1873 if (NumberToPack >= 0x0000800000000000)
1874 return 7;
1875 if (NumberToPack >= 0x0000008000000000)
1876 return 6;
1877 if (NumberToPack >= 0x0000000080000000)
1878 return 5;
1879 if (NumberToPack >= 0x0000000000800000)
1880 return 4;
1881 if (NumberToPack >= 0x0000000000008000)
1882 return 3;
1883 if (NumberToPack >= 0x0000000000000080)
1884 return 2;
1885 }
1886 else
1887 {
1888 // negative number
1889 if (NumberToPack <= 0xff80000000000000)
1890 return 8;
1891 if (NumberToPack <= 0xffff800000000000)
1892 return 7;
1893 if (NumberToPack <= 0xffffff8000000000)
1894 return 6;
1895 if (NumberToPack <= 0xffffffff80000000)
1896 return 5;
1897 if (NumberToPack <= 0xffffffffff800000)
1898 return 4;
1899 if (NumberToPack <= 0xffffffffffff8000)
1900 return 3;
1901 if (NumberToPack <= 0xffffffffffffff80)
1902 return 2;
1903 }
1904 return 1;
1905}
Referenced by ConvertLargeMCBToDataRuns().
◆ GetSizeOfIndexEntries()
| ULONG GetSizeOfIndexEntries | ( | PB_TREE_FILENAME_NODE | Node | ) |
Definition at line 855 of file btree.c.
856{
857 // Start summing the total size of this node's entries
858 ULONG NodeSize = 0;
859
860 // Walk through the list of Node Entries
864 {
866
867 // Add the length of the current node
869 CurrentKey = CurrentKey->NextKey;
870 }
871
872 return NodeSize;
873}
Referenced by NtfsAddFilenameToDirectory(), and NtfsInsertKey().
◆ GetStandardInformationFromRecord()
| PSTANDARD_INFORMATION GetStandardInformationFromRecord | ( | PDEVICE_EXTENSION | Vcb, |
| PFILE_RECORD_HEADER | FileRecord | ||
| ) |
Definition at line 1940 of file attrib.c.
1942{
1945 PNTFS_ATTR_RECORD Attribute;
1946 PSTANDARD_INFORMATION StdInfo;
1947
1950 {
1952 {
1955 return StdInfo;
1956 }
1957
1959 }
1960
1963}
Referenced by NtfsGetBothDirectoryInformation(), NtfsGetDirectoryInformation(), NtfsGetFullDirectoryInformation(), and NtfsMakeFCBFromDirEntry().
◆ InternalSetResidentAttributeLength()
| NTSTATUS InternalSetResidentAttributeLength | ( | PDEVICE_EXTENSION | DeviceExt, |
| PNTFS_ATTR_CONTEXT | AttrContext, | ||
| PFILE_RECORD_HEADER | FileRecord, | ||
| ULONG | AttrOffset, | ||
| ULONG | DataSize | ||
| ) |
Definition at line 542 of file mft.c.
547{
549 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Destination + Destination->Length);
550 PNTFS_ATTR_RECORD FinalAttribute;
552 ULONG NextAttributeOffset;
553
554 DPRINT1("InternalSetResidentAttributeLength( %p, %p, %p, %lu, %lu )\n", DeviceExt, AttrContext, FileRecord, AttrOffset, DataSize);
555
556 ASSERT(!AttrContext->pRecord->IsNonResident);
557
558 // Update ValueLength Field
560
561 // Calculate the record length and end marker offset
562 Destination->Length = ALIGN_UP_BY(DataSize + AttrContext->pRecord->Resident.ValueOffset, ATTR_RECORD_ALIGNMENT);
564
565 // Ensure NextAttributeOffset is aligned to an 8-byte boundary
567
568 // Will the new attribute be larger than the old one?
570 {
571 // Free the old copy of the attribute in the context, as it will be the wrong length
573
574 // Create a new copy of the attribute record for the context
576 if (!AttrContext->pRecord)
577 {
580 }
581 RtlZeroMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + OldAttributeLength), Destination->Length - OldAttributeLength);
583 }
584
585 // Are there attributes after this one that need to be moved?
587 {
588 // Move the attributes after this one
589 FinalAttribute = MoveAttributes(DeviceExt, NextAttribute, NextAttributeOffset, (ULONG_PTR)Destination + Destination->Length);
590 }
591 else
592 {
593 // advance to the final "attribute," adjust for the changed length of the attribute we're resizing
594 FinalAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute - OldAttributeLength + Destination->Length);
595 }
596
597 // Update pRecord's length
599 AttrContext->pRecord->Resident.ValueLength = DataSize;
600
601 // set the file record end
603
604 //NtfsDumpFileRecord(DeviceExt, FileRecord);
605
607}
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
Definition: ndis.h:4755
Referenced by NtfsAddFilenameToDirectory(), and SetResidentAttributeDataLength().
◆ MoveAttributes()
| PNTFS_ATTR_RECORD MoveAttributes | ( | PDEVICE_EXTENSION | DeviceExt, |
| PNTFS_ATTR_RECORD | FirstAttributeToMove, | ||
| ULONG | FirstAttributeOffset, | ||
| ULONG_PTR | MoveTo | ||
| ) |
Definition at line 512 of file mft.c.
516{
517 // Get the size of all attributes after this one
518 ULONG MemBlockSize = 0;
519 PNTFS_ATTR_RECORD CurrentAttribute = FirstAttributeToMove;
520 ULONG CurrentOffset = FirstAttributeOffset;
521 PNTFS_ATTR_RECORD FinalAttribute;
522
523 while (CurrentAttribute->Type != AttributeEnd && CurrentOffset < DeviceExt->NtfsInfo.BytesPerFileRecord)
524 {
525 CurrentOffset += CurrentAttribute->Length;
526 MemBlockSize += CurrentAttribute->Length;
528 }
529
530 FinalAttribute = (PNTFS_ATTR_RECORD)(MoveTo + MemBlockSize);
532
534
535 // Move the attributes after this one
537
538 return FinalAttribute;
539}
Referenced by AddRun(), and InternalSetResidentAttributeLength().
◆ NtfsAcqLazyWrite()
◆ NtfsAcqReadAhead()
◆ NtfsAddFCBToTable()
Definition at line 209 of file fcb.c.
Referenced by NtfsMakeFCBFromDirEntry(), and NtfsMakeRootFCB().
◆ NtfsAddFilenameToDirectory()
| NTSTATUS NtfsAddFilenameToDirectory | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONGLONG | DirectoryMftIndex, | ||
| ULONGLONG | FileReferenceNumber, | ||
| PFILENAME_ATTRIBUTE | FilenameAttribute, | ||
| BOOLEAN | CaseSensitive | ||
| ) |
Definition at line 2192 of file mft.c.
2197{
2199 PFILE_RECORD_HEADER ParentFileRecord;
2200 PNTFS_ATTR_CONTEXT IndexRootContext;
2201 PINDEX_ROOT_ATTRIBUTE I30IndexRoot;
2202 ULONG IndexRootOffset;
2203 ULONGLONG I30IndexRootLength;
2204 ULONG LengthWritten;
2205 PINDEX_ROOT_ATTRIBUTE NewIndexRoot;
2206 ULONG AttributeLength;
2207 PNTFS_ATTR_RECORD NextAttribute;
2208 PB_TREE NewTree;
2209 ULONG BtreeIndexLength;
2210 ULONG MaxIndexRootSize;
2211 PB_TREE_KEY NewLeftKey;
2212 PB_TREE_FILENAME_NODE NewRightHandNode;
2213 LARGE_INTEGER MinIndexRootSize;
2214 ULONG NewMaxIndexRootSize;
2215 ULONG NodeSize;
2216
2217 // Allocate memory for the parent directory
2218 ParentFileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
2219 if (!ParentFileRecord)
2220 {
2223 }
2224
2225 // Open the parent directory
2228 {
2229 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2231 DirectoryMftIndex);
2233 }
2234
2235#ifndef NDEBUG
2237 NtfsDumpFileRecord(DeviceExt, ParentFileRecord);
2238#endif
2239
2240 // Find the index root attribute for the directory
2242 ParentFileRecord,
2243 AttributeIndexRoot,
2245 4,
2246 &IndexRootContext,
2247 &IndexRootOffset);
2249 {
2250 DPRINT1("ERROR: Couldn't find $I30 $INDEX_ROOT attribute for parent directory with MFT #: %I64u!\n",
2251 DirectoryMftIndex);
2252 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2254 }
2255
2256 // Find the maximum index size given what the file record can hold
2257 // First, find the max index size assuming index root is the last attribute
2258 MaxIndexRootSize = DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2259 - IndexRootOffset // Subtract the length of everything that comes before index root
2260 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2263
2264 // Are there attributes after this one?
2265 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2267 {
2268 // Find the length of all attributes after this one, not counting the end marker
2269 ULONG LengthOfAttributes = 0;
2270 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2272 {
2273 LengthOfAttributes += CurrentAttribute->Length;
2274 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2275 }
2276
2277 // Leave room for the existing attributes
2278 MaxIndexRootSize -= LengthOfAttributes;
2279 }
2280
2281 // Allocate memory for the index root data
2282 I30IndexRootLength = AttributeDataLength(IndexRootContext->pRecord);
2284 if (!I30IndexRoot)
2285 {
2287 ReleaseAttributeContext(IndexRootContext);
2288 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2290 }
2291
2292 // Read the Index Root
2293 Status = ReadAttribute(DeviceExt, IndexRootContext, 0, (PCHAR)I30IndexRoot, I30IndexRootLength);
2295 {
2297 ReleaseAttributeContext(IndexRootContext);
2299 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2301 }
2302
2303 // Convert the index to a B*Tree
2305 ParentFileRecord,
2306 IndexRootContext,
2307 I30IndexRoot,
2308 &NewTree);
2310 {
2312 ReleaseAttributeContext(IndexRootContext);
2314 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2316 }
2317
2318#ifndef NDEBUG
2319 DumpBTree(NewTree);
2320#endif
2321
2322 // Insert the key for the file we're adding
2324 FileReferenceNumber,
2325 FilenameAttribute,
2326 NewTree->RootNode,
2327 CaseSensitive,
2328 MaxIndexRootSize,
2329 I30IndexRoot->SizeOfEntry,
2330 &NewLeftKey,
2331 &NewRightHandNode);
2333 {
2335 DestroyBTree(NewTree);
2336 ReleaseAttributeContext(IndexRootContext);
2338 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2340 }
2341
2342#ifndef NDEBUG
2343 DumpBTree(NewTree);
2344#endif
2345
2346 // The root node can't be split
2349
2350 // Convert B*Tree back to Index
2351
2352 // Updating the index allocation can change the size available for the index root,
2353 // And if the index root is demoted, the index allocation will need to be updated again,
2354 // which may change the size available for index root... etc.
2355 // My solution is to decrease index root to the size it would be if it was demoted,
2356 // then UpdateIndexAllocation will have an accurate representation of the maximum space
2357 // it can use in the file record. There's still a chance that the act of allocating an
2358 // index node after demoting the index root will increase the size of the file record beyond
2359 // it's limit, but if that happens, an attribute-list will most definitely be needed.
2360 // This a bit hacky, but it seems to be functional.
2361
2362 // Calculate the minimum size of the index root attribute, considering one dummy key and one VCN
2364 + 0x18; // Size of dummy key with a VCN for a subnode
2366
2367 // Temporarily shrink the index root to it's minimal size
2368 AttributeLength = MinIndexRootSize.LowPart;
2370
2371
2372 // FIXME: IndexRoot will probably be invalid until we're finished. If we fail before we finish, the directory will probably be toast.
2373 // The potential for catastrophic data-loss exists!!! :)
2374
2375 // Update the length of the attribute in the file record of the parent directory
2377 IndexRootContext,
2378 ParentFileRecord,
2379 IndexRootOffset,
2380 AttributeLength);
2382 {
2384 DestroyBTree(NewTree);
2385 ReleaseAttributeContext(IndexRootContext);
2387 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2389 }
2390
2391 // Update the index allocation
2392 Status = UpdateIndexAllocation(DeviceExt, NewTree, I30IndexRoot->SizeOfEntry, ParentFileRecord);
2394 {
2396 DestroyBTree(NewTree);
2397 ReleaseAttributeContext(IndexRootContext);
2399 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2401 }
2402
2403#ifndef NDEBUG
2405 DumpBTree(NewTree);
2406#endif
2407
2408 // Find the maximum index root size given what the file record can hold
2409 // First, find the max index size assuming index root is the last attribute
2410 NewMaxIndexRootSize =
2411 DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2412 - IndexRootOffset // Subtract the length of everything that comes before index root
2413 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2416
2417 // Are there attributes after this one?
2418 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2420 {
2421 // Find the length of all attributes after this one, not counting the end marker
2422 ULONG LengthOfAttributes = 0;
2423 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2425 {
2426 LengthOfAttributes += CurrentAttribute->Length;
2427 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2428 }
2429
2430 // Leave room for the existing attributes
2431 NewMaxIndexRootSize -= LengthOfAttributes;
2432 }
2433
2434 // The index allocation and index bitmap may have grown, leaving less room for the index root,
2435 // so now we need to double-check that index root isn't too large
2437 if (NodeSize > NewMaxIndexRootSize)
2438 {
2439 DPRINT1("Demoting index root.\nNodeSize: 0x%lx\nNewMaxIndexRootSize: 0x%lx\n", NodeSize, NewMaxIndexRootSize);
2440
2443 {
2445 DestroyBTree(NewTree);
2446 ReleaseAttributeContext(IndexRootContext);
2448 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2450 }
2451
2452 // We need to update the index allocation once more
2453 Status = UpdateIndexAllocation(DeviceExt, NewTree, I30IndexRoot->SizeOfEntry, ParentFileRecord);
2455 {
2457 DestroyBTree(NewTree);
2458 ReleaseAttributeContext(IndexRootContext);
2460 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2462 }
2463
2464 // re-recalculate max size of index root
2465 NewMaxIndexRootSize =
2466 // Find the maximum index size given what the file record can hold
2467 // First, find the max index size assuming index root is the last attribute
2468 DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2469 - IndexRootOffset // Subtract the length of everything that comes before index root
2470 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2473
2474 // Are there attributes after this one?
2475 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2477 {
2478 // Find the length of all attributes after this one, not counting the end marker
2479 ULONG LengthOfAttributes = 0;
2480 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2482 {
2483 LengthOfAttributes += CurrentAttribute->Length;
2484 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2485 }
2486
2487 // Leave room for the existing attributes
2488 NewMaxIndexRootSize -= LengthOfAttributes;
2489 }
2490
2491
2492 }
2493
2494 // Create the Index Root from the B*Tree
2495 Status = CreateIndexRootFromBTree(DeviceExt, NewTree, NewMaxIndexRootSize, &NewIndexRoot, &BtreeIndexLength);
2497 {
2499 DestroyBTree(NewTree);
2500 ReleaseAttributeContext(IndexRootContext);
2502 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2504 }
2505
2506 // We're done with the B-Tree now
2507 DestroyBTree(NewTree);
2508
2509 // Write back the new index root attribute to the parent directory file record
2510
2511 // First, we need to resize the attribute.
2512 // CreateIndexRootFromBTree() should have verified that the index root fits within MaxIndexSize.
2513 // We can't set the size as we normally would, because $INDEX_ROOT must always be resident.
2514 AttributeLength = NewIndexRoot->Header.AllocatedSize + FIELD_OFFSET(INDEX_ROOT_ATTRIBUTE, Header);
2515
2516 if (AttributeLength != IndexRootContext->pRecord->Resident.ValueLength)
2517 {
2518 // Update the length of the attribute in the file record of the parent directory
2520 IndexRootContext,
2521 ParentFileRecord,
2522 IndexRootOffset,
2523 AttributeLength);
2525 {
2527 ReleaseAttributeContext(IndexRootContext);
2529 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2532 }
2533
2534 }
2535
2537
2540 {
2541 DPRINT1("ERROR: Failed to update file record of directory with index: %llx\n", DirectoryMftIndex);
2542 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2544 ReleaseAttributeContext(IndexRootContext);
2547 }
2548
2549 // Write the new index root to disk
2551 IndexRootContext,
2552 0,
2553 (PUCHAR)NewIndexRoot,
2554 AttributeLength,
2555 &LengthWritten,
2556 ParentFileRecord);
2558 {
2561 ReleaseAttributeContext(IndexRootContext);
2563 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2565 }
2566
2567 // re-read the parent file record, so we can dump it
2570 {
2572 }
2573 else
2574 {
2575#ifndef NDEBUG
2577
2578 Status = CreateBTreeFromIndex(DeviceExt, ParentFileRecord, IndexRootContext, NewIndexRoot, &NewTree);
2580 {
2583 }
2584
2585 DumpBTree(NewTree);
2586
2587 DestroyBTree(NewTree);
2588
2589 NtfsDumpFileRecord(DeviceExt, ParentFileRecord);
2590#endif
2591 }
2592
2593 // Cleanup
2595 ReleaseAttributeContext(IndexRootContext);
2597 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2598
2600}
NTSTATUS CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecordWithIndex, PNTFS_ATTR_CONTEXT IndexRootContext, PINDEX_ROOT_ATTRIBUTE IndexRoot, PB_TREE *NewTree)
Definition: btree.c:682
NTSTATUS NtfsInsertKey(PB_TREE Tree, ULONGLONG FileReference, PFILENAME_ATTRIBUTE FileNameAttribute, PB_TREE_FILENAME_NODE Node, BOOLEAN CaseSensitive, ULONG MaxIndexRootSize, ULONG IndexRecordSize, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling)
Definition: btree.c:1691
NTSTATUS UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG IndexBufferSize, PFILE_RECORD_HEADER FileRecord)
Definition: btree.c:1182
NTSTATUS CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG MaxIndexSize, PINDEX_ROOT_ATTRIBUTE *IndexRoot, ULONG *Length)
Definition: btree.c:910
VOID NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:3334
NTSTATUS InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_CONTEXT AttrContext, PFILE_RECORD_HEADER FileRecord, ULONG AttrOffset, ULONG DataSize)
Definition: mft.c:542
Referenced by NtfsCreateDirectory(), and NtfsCreateFileRecord().
◆ NtfsAllocateClusters()
| NTSTATUS NtfsAllocateClusters | ( | PDEVICE_EXTENSION | DeviceExt, |
| ULONG | FirstDesiredCluster, | ||
| ULONG | DesiredClusters, | ||
| PULONG | FirstAssignedCluster, | ||
| PULONG | AssignedClusters | ||
| ) |
NtfsAllocateClusters Allocates a run of clusters. The run allocated might be smaller than DesiredClusters.
Definition at line 105 of file volinfo.c.
110{
112 PFILE_RECORD_HEADER BitmapRecord;
113 PNTFS_ATTR_CONTEXT DataContext;
114 ULONGLONG BitmapDataSize;
118 ULONG AssignedRun;
119 ULONG LengthWritten;
120
121 DPRINT("NtfsAllocateClusters(%p, %lu, %lu, %p, %p)\n", DeviceExt, FirstDesiredCluster, DesiredClusters, FirstAssignedCluster, AssignedClusters);
122
123 BitmapRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
125 {
127 }
128
131 {
132 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
134 }
135
138 {
139 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
141 }
142
143 BitmapDataSize = AttributeDataLength(DataContext->pRecord);
144 BitmapDataSize = min(BitmapDataSize, 0xffffffff);
145 ASSERT((BitmapDataSize * 8) >= DeviceExt->NtfsInfo.ClusterCount);
146 BitmapData = ExAllocatePoolWithTag(NonPagedPool, ROUND_UP(BitmapDataSize, DeviceExt->NtfsInfo.BytesPerSector), TAG_NTFS);
148 {
149 ReleaseAttributeContext(DataContext);
150 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
152 }
153
156 DPRINT("Diff in size: %I64d B\n", ((BitmapDataSize * 8) - DeviceExt->NtfsInfo.ClusterCount) * DeviceExt->NtfsInfo.SectorsPerCluster * DeviceExt->NtfsInfo.BytesPerSector);
157
159
162
164 {
165 ReleaseAttributeContext(DataContext);
166
168 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
170 }
171
172 // TODO: Observe MFT reservation zone
173
174 // Can we get one contiguous run?
176
177 if (AssignedRun != 0xFFFFFFFF)
178 {
179 *FirstAssignedCluster = AssignedRun;
180 *AssignedClusters = DesiredClusters;
181 }
182 else
183 {
184 // we can't get one contiguous run
185 *AssignedClusters = RtlFindNextForwardRunClear(&Bitmap, FirstDesiredCluster, FirstAssignedCluster);
186
187 if (*AssignedClusters == 0)
188 {
189 // we couldn't find any runs starting at DesiredFirstCluster
191 }
192
193 }
194
195 Status = WriteAttribute(DeviceExt, DataContext, 0, BitmapData, (ULONG)BitmapDataSize, &LengthWritten, BitmapRecord);
196
197 ReleaseAttributeContext(DataContext);
198