8 #define CACHEPAGESIZE(pDeviceExt) \ 9 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \ 10 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE) 12 #define TAG_NTFS '0ftN' 13 #define TAG_CCB 'CftN' 14 #define TAG_FCB 'FftN' 15 #define TAG_IRP_CTXT 'iftN' 16 #define TAG_ATT_CTXT 'aftN' 17 #define TAG_FILE_REC 'rftN' 19 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S)) 20 #define ROUND_DOWN(N, S) ((N) - ((N) % (S))) 22 #define DEVICE_NAME L"\\Ntfs" 87 #define NTFS_TYPE_CCB '20SF' 88 #define NTFS_TYPE_FCB '30SF' 89 #define NTFS_TYPE_VCB '50SF' 90 #define NTFS_TYPE_IRP_CONTEXT '60SF' 91 #define NTFS_TYPE_GLOBAL_DATA '70SF' 127 #define VCB_VOLUME_LOCKED 0x0001 182 #define FILE_RECORD_END 0x11477982 184 #define NTFS_FILE_MFT 0 185 #define NTFS_FILE_MFTMIRR 1 186 #define NTFS_FILE_LOGFILE 2 187 #define NTFS_FILE_VOLUME 3 188 #define NTFS_FILE_ATTRDEF 4 189 #define NTFS_FILE_ROOT 5 190 #define NTFS_FILE_BITMAP 6 191 #define NTFS_FILE_BOOT 7 192 #define NTFS_FILE_BADCLUS 8 193 #define NTFS_FILE_QUOTA 9 194 #define NTFS_FILE_UPCASE 10 195 #define NTFS_FILE_EXTEND 11 196 #define NTFS_FILE_FIRST_USER_FILE 16 198 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL 200 #define COLLATION_BINARY 0x00 201 #define COLLATION_FILE_NAME 0x01 202 #define COLLATION_UNICODE_STRING 0x02 203 #define COLLATION_NTOFS_ULONG 0x10 204 #define COLLATION_NTOFS_SID 0x11 205 #define COLLATION_NTOFS_SECURITY_HASH 0x12 206 #define COLLATION_NTOFS_ULONGS 0x13 208 #define INDEX_ROOT_SMALL 0x0 209 #define INDEX_ROOT_LARGE 0x1 211 #define INDEX_NODE_SMALL 0x0 212 #define INDEX_NODE_LARGE 0x1 214 #define NTFS_INDEX_ENTRY_NODE 1 215 #define NTFS_INDEX_ENTRY_END 2 217 #define NTFS_FILE_NAME_POSIX 0 218 #define NTFS_FILE_NAME_WIN32 1 219 #define NTFS_FILE_NAME_DOS 2 220 #define NTFS_FILE_NAME_WIN32_AND_DOS 3 222 #define NTFS_FILE_TYPE_READ_ONLY 0x1 223 #define NTFS_FILE_TYPE_HIDDEN 0x2 224 #define NTFS_FILE_TYPE_SYSTEM 0x4 225 #define NTFS_FILE_TYPE_ARCHIVE 0x20 226 #define NTFS_FILE_TYPE_TEMPORARY 0x100 227 #define NTFS_FILE_TYPE_SPARSE 0x200 228 #define NTFS_FILE_TYPE_REPARSE 0x400 229 #define NTFS_FILE_TYPE_COMPRESSED 0x800 230 #define NTFS_FILE_TYPE_OFFLINE 0x1000 231 #define NTFS_FILE_TYPE_ENCRYPTED 0x4000 232 #define NTFS_FILE_TYPE_DIRECTORY 0x10000000 235 #define RA_INDEXED 0x01 246 #define NRH_FILE_TYPE 0x454C4946 247 #define NRH_INDX_TYPE 0x58444E49 267 #define FRH_IN_USE 0x0001 268 #define FRH_DIRECTORY 0x0002 269 #define FRH_UNKNOWN1 0x0004 270 #define FRH_UNKNOWN2 0x0008 296 USHORT MappingPairsOffset;
320 #define ATTR_RECORD_ALIGNMENT 8 323 #define DATA_RUN_ALIGNMENT 4 326 #define VALUE_OFFSET_ALIGNMENT 4 474 #define IRPCONTEXT_CANWAIT 0x1 475 #define IRPCONTEXT_COMPLETE 0x2 476 #define IRPCONTEXT_QUEUE 0x4 508 #define FCB_CACHE_INITIALIZED 0x0001 509 #define FCB_IS_VOLUME_STREAM 0x0002 510 #define FCB_IS_VOLUME 0x0004 706 ULONG ClustersToFree);
794 ULONG IndexBufferSize,
809 ULONG MaxIndexRootSize,
810 ULONG IndexRecordSize,
824 ULONG IndexBufferSize,
831 ULONG IndexBufferSize,
833 ULONG IndexAllocationOffset);
1074 ULONG FirstAttributeOffset,
1125 ULONG IndexBlockSize,
1269 ULONG FirstDesiredCluster,
1270 ULONG DesiredClusters,
1271 PULONG FirstAssignedCluster,
1272 PULONG AssignedClusters);
NTSTATUS SplitBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling, BOOLEAN CaseSensitive)
FAST_IO_WRITE NtfsFastIoWrite
PNTFS_ATTR_RECORD MoveAttributes(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_RECORD FirstAttributeToMove, ULONG FirstAttributeOffset, ULONG_PTR MoveTo)
PNTFS_ATTR_RECORD LastAttr
NTSTATUS AddRun(PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONGLONG NextAssignedCluster, ULONG RunLength)
NTSTATUS NtfsSetEndOfFile(PNTFS_FCB Fcb, PFILE_OBJECT FileObject, PDEVICE_EXTENSION DeviceExt, ULONG IrpFlags, BOOLEAN CaseSensitive, PLARGE_INTEGER NewFileSize)
PNTFS_ATTRIBUTE_LIST_ITEM NonResidentStart
struct NTFS_RECORD_HEADER * PNTFS_RECORD_HEADER
VOID NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
ULONG GetSizeOfIndexEntries(PB_TREE_FILENAME_NODE Node)
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION _In_ ULONG _In_ SIZE_T _In_ ULONG _In_ USHORT Depth
PDRIVER_OBJECT DriverObject
PDEVICE_OBJECT DeviceObject
struct NTFS_IRP_CONTEXT * PNTFS_IRP_CONTEXT
struct LOOKASIDE_ALIGN _NPAGED_LOOKASIDE_LIST NPAGED_LOOKASIDE_LIST
_In_ ULONG _In_ ULONG _In_ ULONG Length
NTFSIDENTIFIER Identifier
NTSTATUS NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb, PNTFS_FCB DirectoryFCB, PUNICODE_STRING Name, PCWSTR Stream, PFILE_RECORD_HEADER Record, ULONGLONG MFTIndex, PNTFS_FCB *fileFCB)
NPAGED_LOOKASIDE_LIST AttrCtxtLookasideList
_In_ PFCB _In_ LONGLONG StartingOffset
NPAGED_LOOKASIDE_LIST FcbLookasideList
FILENAME_ATTRIBUTE FileName
PFILENAME_ATTRIBUTE GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
NTSTATUS UpdateIndexNode(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, PB_TREE_FILENAME_NODE Node, ULONG IndexBufferSize, PNTFS_ATTR_CONTEXT IndexAllocationContext, ULONG IndexAllocationOffset)
struct NTFSIDENTIFIER * PNTFSIDENTIFIER
struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD
PFILE_OBJECT StreamFileObject
struct FIXUP_ARRAY * PFIXUP_ARRAY
ULONG ReadAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length)
#define IRPCONTEXT_COMPLETE
struct _NTFS_INFO NTFS_INFO
NTSTATUS UpdateFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MftIndex, PFILE_RECORD_HEADER FileRecord)
BOOLEAN NtfsFCBIsRoot(PNTFS_FCB Fcb)
CHAR ClustersPerIndexRecord
FORCEINLINE NTSTATUS NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext)
_In_ WDFDPC _In_ BOOLEAN Wait
NTSTATUS FindNextAttribute(PFIND_ATTR_CONTXT Context, PNTFS_ATTR_RECORD *Attribute)
PNTFS_FCB NtfsMakeRootFCB(PNTFS_VCB Vcb)
GLuint GLuint GLsizei count
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG _In_opt_ PVOID Data
NTSTATUS NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext)
struct NTFS_ATTR_CONTEXT * PNTFS_ATTR_CONTEXT
BOOLEAN NtfsFCBIsDirectory(PNTFS_FCB Fcb)
NTSTATUS NtfsLookupFile(PDEVICE_EXTENSION Vcb, PUNICODE_STRING PathName, BOOLEAN CaseSensitive, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex)
NPAGED_LOOKASIDE_LIST FileRecLookasideList
NTSTATUS NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext)
ULONGLONG GetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry)
NTSTATUS SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
ULONGLONG CacheRunCurrentOffset
PNTFS_FCB NtfsGrabFCBFromTable(PNTFS_VCB Vcb, PCWSTR FileName)
ULONGLONG NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, PCWSTR Stream, ULONG StreamLength, PULONGLONG AllocatedSize)
PFILE_RECORD_HEADER NtfsCreateEmptyFileRecord(PDEVICE_EXTENSION DeviceExt)
NTSTATUS NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, IN ULONG DiskSector, IN ULONG SectorCount, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
NTSTATUS NtfsLockUserBuffer(IN PIRP Irp, IN ULONG Length, IN LOCK_OPERATION Operation)
struct _FIND_ATTR_CONTXT FIND_ATTR_CONTXT
DRIVER_DISPATCH NtfsFsdDispatch
WORK_QUEUE_ITEM WorkQueueItem
struct _BIOS_PARAMETERS_BLOCK * PBIOS_PARAMETERS_BLOCK
PB_TREE_FILENAME_NODE RootNode
NTSTATUS NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext)
VOID DumpBTreeKey(PB_TREE Tree, PB_TREE_KEY Key, ULONG Number, ULONG Depth)
NTSTATUS FindNextAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
PNTFS_ATTR_CONTEXT PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
NTSTATUS ConvertDataRunsToLargeMCB(PUCHAR DataRun, PLARGE_MCB DataRunsMCB, PULONGLONG pNextVBN)
struct _B_TREE_KEY * PB_TREE_KEY
ULONGLONG NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt)
struct VOLINFO_ATTRIBUTE * PVOLINFO_ATTRIBUTE
NTSTATUS DemoteBTreeRoot(PB_TREE Tree)
VOID NTAPI NtfsRelLazyWrite(PVOID Context)
NTSTATUS NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext)
PNTFS_ATTRIBUTE_LIST_ITEM NonResidentCur
NTSTATUS UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, PCHAR IndexRecord, ULONG IndexBlockSize, PINDEX_ENTRY_ATTRIBUTE FirstEntry, PINDEX_ENTRY_ATTRIBUTE LastEntry, PUNICODE_STRING FileName, PULONG StartEntry, PULONG CurrentEntry, BOOLEAN DirSearch, ULONGLONG NewDataSize, ULONGLONG NewAllocatedSize, BOOLEAN CaseSensitive)
VOID NtfsDumpDataRuns(PVOID StartOfRun, ULONGLONG CurrentLCN)
NTSTATUS NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext)
struct _B_TREE_FILENAME_NODE * PB_TREE_FILENAME_NODE
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
_In_ PDEVICE_OBJECT DeviceObject
NTFSIDENTIFIER Identifier
VOID SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttrEnd, ULONG EndMarker)
struct _EXTENDED_BIOS_PARAMETERS_BLOCK EXTENDED_BIOS_PARAMETERS_BLOCK
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE
struct NTFS_ATTRIBUTE_LIST_ITEM * PNTFS_ATTRIBUTE_LIST_ITEM
INDEX_HEADER_ATTRIBUTE Header
NTSTATUS NtfsCreateDirectory(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, BOOLEAN CanWait)
PNTFS_FCB NtfsCreateFCB(PCWSTR FileName, PCWSTR Stream, PNTFS_VCB Vcb)
ULARGE_INTEGER MftMirrStart
struct _B_TREE_KEY B_TREE_KEY
NTSTATUS NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt, ULONGLONG DirectoryMftIndex, ULONGLONG FileReferenceNumber, PFILENAME_ATTRIBUTE FilenameAttribute, BOOLEAN CaseSensitive)
NTSTATUS ReadLCN(PDEVICE_EXTENSION Vcb, ULONGLONG lcn, ULONG count, PVOID buffer)
NTSTATUS NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject)
BOOLEAN NtfsFCBIsReparsePoint(PNTFS_FCB Fcb)
PNTFS_IRP_CONTEXT NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, PIRP Irp)
VOID NTAPI NtfsRelReadAhead(PVOID Context)
NTSTATUS UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG IndexBufferSize, PFILE_RECORD_HEADER FileRecord)
#define MAXIMUM_VOLUME_LABEL_LENGTH
_Reserved_ PVOID Reserved
_IRQL_requires_same_ typedef _In_ ULONG ControlCode
struct _B_TREE_KEY * NextKey
struct _FILE_RECORD_HEADER * PFILE_RECORD_HEADER
ULONG BytesPerIndexRecord
B_TREE_FILENAME_NODE * LesserChild
NTSTATUS NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext)
struct STANDARD_INFORMATION * PSTANDARD_INFORMATION
NTSTATUS CreateEmptyBTree(PB_TREE *NewTree)
NTSTATUS NtfsRead(PNTFS_IRP_CONTEXT IrpContext)
BOOLEAN NTAPI NtfsAcqReadAhead(PVOID Context, BOOLEAN Wait)
NTSTATUS FindFirstAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
VOID NtfsDestroyFCB(PNTFS_FCB Fcb)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG FileAttributes
struct DEVICE_EXTENSION * PDEVICE_EXTENSION
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
NTSTATUS NtfsInsertKey(PB_TREE Tree, ULONGLONG FileReference, PFILENAME_ATTRIBUTE FileNameAttribute, PB_TREE_FILENAME_NODE Node, BOOLEAN CaseSensitive, ULONG MaxIndexRootSize, ULONG IndexRecordSize, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling)
FSRTL_COMMON_FCB_HEADER RFCB
_Must_inspect_result_ _In_ PDRIVER_OBJECT DriverObject
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
NTSTATUS NtfsReadFCBAttribute(PNTFS_VCB Vcb, PNTFS_FCB pFCB, ULONG Type, PCWSTR Name, ULONG NameLength, PVOID *Data)
NTSTATUS ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, PUCHAR RunBuffer, ULONG MaxBufferSize, PULONG UsedBufferSize)
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
BOOLEAN NtfsIsIrpTopLevel(PIRP Irp)
ULONGLONG GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt, ULONG IndexBufferSize, ULONGLONG Vcn)
USHORT AlignmentOrReserved
NTSTATUS FindFirstAttribute(PFIND_ATTR_CONTXT Context, PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, BOOLEAN OnlyResident, PNTFS_ATTR_RECORD *Attribute)
_Must_inspect_result_ _In_ ULONG Flags
FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible
NTSTATUS AddFileName(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, PULONGLONG ParentMftIndex)
BOOLEAN DiskNeedsUpdating
VOID EnumerAttribute(PFILE_RECORD_HEADER file, PDEVICE_EXTENSION Vcb, PDEVICE_OBJECT DeviceObject)
struct _BOOT_SECTOR * PBOOT_SECTOR
struct _FILE_RECORD_HEADER FILE_RECORD_HEADER
NTSTATUS NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, BOOLEAN CanWait)
NTSTATUS AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, PDEVICE_EXTENSION DeviceExt, PULONGLONG DestinationIndex, BOOLEAN CanWait)
struct _FILE_RECORD_HEADER * MasterFileTable
PFILE_OBJECT PtrFileObject
BOOLEAN NtfsFCBIsEncrypted(PNTFS_FCB Fcb)
VOID NtfsFileFlagsToAttributes(ULONG NtfsAttributes, PULONG FileAttributes)
struct _NTFS_ATTR_CONTEXT NTFS_ATTR_CONTEXT
PNTFS_ATTR_RECORD FirstAttr
NTSTATUS SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
BIOS_PARAMETERS_BLOCK BPB
BOOLEAN NtfsFCBIsCompressed(PNTFS_FCB Fcb)
CHAR ClustersPerMftRecord
ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute)
VOID NTAPI NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject)
INDEX_HEADER_ATTRIBUTE Header
enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE
NTSTATUS FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, PNTFS_RECORD_HEADER Record)
struct DEVICE_EXTENSION NTFS_VCB
struct INDEX_HEADER_ATTRIBUTE * PINDEX_HEADER_ATTRIBUTE
_In_opt_ PLARGE_INTEGER NewFileSize
NTSTATUS AddFixupArray(PDEVICE_EXTENSION Vcb, PNTFS_RECORD_HEADER Record)
VOID DestroyBTree(PB_TREE Tree)
ULONGLONG AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord)
PWCHAR DirectorySearchPattern
BOOLEAN CompareFileName(PUNICODE_STRING FileName, PINDEX_ENTRY_ATTRIBUTE IndexEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive)
struct NTFS_CCB * PNTFS_CCB
NTSTATUS NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, PUNICODE_STRING PathName, BOOLEAN CaseSensitive, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex, ULONGLONG CurrentMFTIndex)
NTSTATUS AddData(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
NTSTATUS NtfsAttachFCBToFileObject(PNTFS_VCB Vcb, PNTFS_FCB Fcb, PFILE_OBJECT FileObject)
PNTFS_ATTR_RECORD CurrAttr
VOID ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
BOOLEAN NTAPI NtfsAcqLazyWrite(PVOID Context, BOOLEAN Wait)
FAST_IO_READ NtfsFastIoRead
NTFSIDENTIFIER Identifier
ULONGLONG DirectoryFileReferenceNumber
VOID ReadVCN(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER file, ATTRIBUTE_TYPE type, ULONGLONG vcn, ULONG count, PVOID buffer)
DRIVER_DISPATCH(nfs41_FsdDispatch)
UCHAR ClustersPerIndexRecord
NTSTATUS AddIndexRoot(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PINDEX_ROOT_ATTRIBUTE NewIndexRoot, ULONG RootLength, PCWSTR Name, USHORT NameLength)
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
VOID FindCloseAttribute(PFIND_ATTR_CONTXT Context)
struct REPARSE_POINT_ATTRIBUTE * PREPARSE_POINT_ATTRIBUTE
PSTANDARD_INFORMATION GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
PDEVICE_OBJECT DeviceObject
NTSTATUS SetAttributeDataLength(PFILE_OBJECT FileObject, PNTFS_FCB Fcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
NTSTATUS NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, IN ULONG ControlCode, IN PVOID InputBuffer, IN ULONG InputBufferSize, IN OUT PVOID OutputBuffer, IN OUT PULONG OutputBufferSize, IN BOOLEAN Override)
LONG CompareTreeKeys(PB_TREE_KEY Key1, PB_TREE_KEY Key2, BOOLEAN CaseSensitive)
_In_ ULONG _In_ ULONG Offset
VOID NtfsGrabFCB(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
NTSTATUS SavedExceptionCode
NTSTATUS NtfsCreate(PNTFS_IRP_CONTEXT IrpContext)
NTSTATUS UpdateFileNameRecord(PDEVICE_EXTENSION Vcb, ULONGLONG ParentMFTIndex, PUNICODE_STRING FileName, BOOLEAN DirSearch, ULONGLONG NewDataSize, ULONGLONG NewAllocationSize, BOOLEAN CaseSensitive)
NTSTATUS ReadFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG index, PFILE_RECORD_HEADER file)
VOID NtfsAddFCBToTable(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
enum _LOCK_OPERATION LOCK_OPERATION
NPAGED_LOOKASIDE_LIST IrpContextLookasideList
UCHAR GetPackedByteCount(LONGLONG NumberToPack, BOOLEAN IsSigned)
CACHE_MANAGER_CALLBACKS CacheMgrCallbacks
NTSTATUS NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject, IN LONGLONG StartingOffset, IN ULONG Length, IN ULONG SectorSize, IN const PUCHAR Buffer)
EXTENDED_BIOS_PARAMETERS_BLOCK EBPB
NTSTATUS GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_RECORD Attribute, PULONGLONG LastCluster)
WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]
struct DEVICE_EXTENSION * PNTFS_VCB
NTSTATUS CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG MaxIndexSize, PINDEX_ROOT_ATTRIBUTE *IndexRoot, ULONG *Length)
struct _BIOS_PARAMETERS_BLOCK BIOS_PARAMETERS_BLOCK
LARGE_INTEGER CurrentByteOffset
NTSTATUS CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecordWithIndex, PNTFS_ATTR_CONTEXT IndexRootContext, PINDEX_ROOT_ATTRIBUTE IndexRoot, PB_TREE *NewTree)
ATTRIBUTE_TYPE AttributeType
struct _FIND_ATTR_CONTXT * PFIND_ATTR_CONTXT
struct _NTFS_ATTR_CONTEXT * MFTContext
struct ATTRIBUTE_LIST * PATTRIBUTE_LIST
struct _EXTENDED_BIOS_PARAMETERS_BLOCK * PEXTENDED_BIOS_PARAMETERS_BLOCK
struct INDEX_BUFFER * PINDEX_BUFFER
NTSTATUS NtfsFindFileAt(PDEVICE_EXTENSION Vcb, PUNICODE_STRING SearchPattern, PULONG FirstEntry, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex, ULONGLONG CurrentMFTIndex, BOOLEAN CaseSensitive)
NTSTATUS AddBitmap(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
_In_ WDFCOLLECTION _In_ WDFOBJECT Item
NTSTATUS InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_CONTEXT AttrContext, PFILE_RECORD_HEADER FileRecord, ULONG AttrOffset, ULONG DataSize)
NTSTATUS NtfsFCBInitializeCache(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
VOID DumpBTree(PB_TREE Tree)
struct _BEEP_DEVICE_EXTENSION DEVICE_EXTENSION
NTFSIDENTIFIER Identifier
PNTFS_ATTR_RECORD pRecord
VOID DestroyBTreeNode(PB_TREE_FILENAME_NODE Node)
VOID DumpBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, ULONG Number, ULONG Depth)
VOID NtfsDumpData(ULONG_PTR Buffer, ULONG Length)
__GNU_EXTENSION typedef unsigned __int64 * PULONGLONG
NTSTATUS NtfsGetFCBForFile(PNTFS_VCB Vcb, PNTFS_FCB *pParentFCB, PNTFS_FCB *pFCB, PCWSTR pFileName, BOOLEAN CaseSensitive)
FAST_IO_DISPATCH FastIoDispatch
NTSTATUS WriteAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, const PUCHAR Buffer, ULONG Length, PULONG LengthWritten, PFILE_RECORD_HEADER FileRecord)
DRIVER_INITIALIZE DriverEntry
PUCHAR DecodeRun(PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength)
PVOID NtfsGetUserBuffer(PIRP Irp, BOOLEAN Paging)
ERESOURCE PagingIoResource
NTSTATUS AddIndexAllocation(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
PNTFS_GLOBAL_DATA NtfsGlobalData
_In_ FLT_SET_CONTEXT_OPERATION Operation
LONGLONG CacheRunStartLCN
struct INDEX_ROOT_ATTRIBUTE * PINDEX_ROOT_ATTRIBUTE
PFILENAME_ATTRIBUTE GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
struct NTFS_GLOBAL_DATA * PNTFS_GLOBAL_DATA
NTSTATUS FindAttribute(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, ULONG Type, PCWSTR Name, ULONG NameLength, PNTFS_ATTR_CONTEXT *AttrCtx, PULONG Offset)
NTSTATUS AddStandardInformation(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
NTSTATUS NtfsClose(PNTFS_IRP_CONTEXT IrpContext)
PINDEX_ENTRY_ATTRIBUTE IndexEntry
ULONGLONG MftMirrLocation
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn BOOLEAN Physical UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 NameType
GLuint GLuint GLsizei GLenum type
NTSTATUS FreeClusters(PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONG ClustersToFree)
struct _B_TREE_FILENAME_NODE B_TREE_FILENAME_NODE
ULONGLONG FileOwnerMFTIndex
ULONGLONG AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord)
NTSTATUS NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, IN LONGLONG StartingOffset, IN ULONG Length, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
PNTFS_ATTRIBUTE_LIST_ITEM NonResidentEnd
_In_ BOOLEAN _In_ USHORT Directory
BOOLEAN EnableWriteSupport
SECTION_OBJECT_POINTERS SectionObjectPointers
NTSTATUS NtfsFindMftRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MFTIndex, PUNICODE_STRING FileName, PULONG FirstEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive, ULONGLONG *OutMFTIndex)
ULONGLONG FileReferenceNumber
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
PNTFS_FCB NtfsOpenRootFCB(PNTFS_VCB Vcb)
_Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING Stream
struct _NTFS_INFO * PNTFS_INFO
NTSTATUS NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt, ULONG FirstDesiredCluster, ULONG DesiredClusters, PULONG FirstAssignedCluster, PULONG AssignedClusters)
struct INDEX_ENTRY_ATTRIBUTE * PINDEX_ENTRY_ATTRIBUTE
NTSTATUS NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext)
NTSTATUS UpdateMftMirror(PNTFS_VCB Vcb)
NTFSIDENTIFIER Identifier
NTSTATUS NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext)
NTSTATUS NtfsWrite(PNTFS_IRP_CONTEXT IrpContext)
VOID NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
VOID NtfsReleaseFCB(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
struct _BOOT_SECTOR BOOT_SECTOR