ReactOS 0.4.15-dev-7788-g1ad9096
ntfs.h
Go to the documentation of this file.
1#ifndef NTFS_H
2#define NTFS_H
3
4#include <ntifs.h>
5#include <pseh/pseh2.h>
6#include <section_attribs.h>
7
8#define CACHEPAGESIZE(pDeviceExt) \
9 ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
10 (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE)
11
12#define TAG_NTFS '0ftN'
13#define TAG_CCB 'CftN'
14#define TAG_FCB 'FftN'
15#define TAG_IRP_CTXT 'iftN'
16#define TAG_ATT_CTXT 'aftN'
17#define TAG_FILE_REC 'rftN'
18
19#define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
20#define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
21
22#define DEVICE_NAME L"\\Ntfs"
23
24#include <pshpack1.h>
26{
29 UCHAR Unused0[7]; // 0x0E, checked when volume is mounted
30 UCHAR MediaId; // 0x15
31 UCHAR Unused1[2]; // 0x16
33 USHORT Heads; // 0x1A
34 UCHAR Unused2[4]; // 0x1C
35 UCHAR Unused3[4]; // 0x20, checked when volume is mounted
37
39{
40 USHORT Unknown[2]; // 0x24, always 80 00 80 00
45 UCHAR Unused4[3]; // 0x41
47 UCHAR Unused5[3]; // 0x45
49 UCHAR Checksum[4]; // 0x50
51
52typedef struct _BOOT_SECTOR
53{
54 UCHAR Jump[3]; // 0x00
55 UCHAR OEMID[8]; // 0x03
58 UCHAR BootStrap[426]; // 0x54
59 USHORT EndSector; // 0x1FE
61#include <poppack.h>
62
63//typedef struct _BootSector BootSector;
64
65typedef struct _NTFS_INFO
66{
76
83
86
87#define NTFS_TYPE_CCB '20SF'
88#define NTFS_TYPE_FCB '30SF'
89#define NTFS_TYPE_VCB '50SF'
90#define NTFS_TYPE_IRP_CONTEXT '60SF'
91#define NTFS_TYPE_GLOBAL_DATA '70SF'
92
93typedef struct
94{
98
99typedef struct
100{
102
104// ERESOURCE FatResource;
105
108
112
116
118
120
124
126
127#define VCB_VOLUME_LOCKED 0x0001
128
129typedef struct
130{
135 /* for DirectoryControl */
137 /* for DirectoryControl */
142
143typedef struct
144{
157
158
159typedef enum
160{
177 AttributeEnd = 0xFFFFFFFF
179
180// FILE_RECORD_END seems to follow AttributeEnd in every file record starting with $Quota.
181// No clue what data is being represented here.
182#define FILE_RECORD_END 0x11477982
183
184#define NTFS_FILE_MFT 0
185#define NTFS_FILE_MFTMIRR 1
186#define NTFS_FILE_LOGFILE 2
187#define NTFS_FILE_VOLUME 3
188#define NTFS_FILE_ATTRDEF 4
189#define NTFS_FILE_ROOT 5
190#define NTFS_FILE_BITMAP 6
191#define NTFS_FILE_BOOT 7
192#define NTFS_FILE_BADCLUS 8
193#define NTFS_FILE_QUOTA 9
194#define NTFS_FILE_UPCASE 10
195#define NTFS_FILE_EXTEND 11
196#define NTFS_FILE_FIRST_USER_FILE 16
197
198#define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
199
200#define COLLATION_BINARY 0x00
201#define COLLATION_FILE_NAME 0x01
202#define COLLATION_UNICODE_STRING 0x02
203#define COLLATION_NTOFS_ULONG 0x10
204#define COLLATION_NTOFS_SID 0x11
205#define COLLATION_NTOFS_SECURITY_HASH 0x12
206#define COLLATION_NTOFS_ULONGS 0x13
207
208#define INDEX_ROOT_SMALL 0x0
209#define INDEX_ROOT_LARGE 0x1
210
211#define INDEX_NODE_SMALL 0x0
212#define INDEX_NODE_LARGE 0x1
213
214#define NTFS_INDEX_ENTRY_NODE 1
215#define NTFS_INDEX_ENTRY_END 2
216
217#define NTFS_FILE_NAME_POSIX 0
218#define NTFS_FILE_NAME_WIN32 1
219#define NTFS_FILE_NAME_DOS 2
220#define NTFS_FILE_NAME_WIN32_AND_DOS 3
221
222#define NTFS_FILE_TYPE_READ_ONLY 0x1
223#define NTFS_FILE_TYPE_HIDDEN 0x2
224#define NTFS_FILE_TYPE_SYSTEM 0x4
225#define NTFS_FILE_TYPE_ARCHIVE 0x20
226#define NTFS_FILE_TYPE_TEMPORARY 0x100
227#define NTFS_FILE_TYPE_SPARSE 0x200
228#define NTFS_FILE_TYPE_REPARSE 0x400
229#define NTFS_FILE_TYPE_COMPRESSED 0x800
230#define NTFS_FILE_TYPE_OFFLINE 0x1000
231#define NTFS_FILE_TYPE_ENCRYPTED 0x4000
232#define NTFS_FILE_TYPE_DIRECTORY 0x10000000
233
234/* Indexed Flag in Resident attributes - still somewhat speculative */
235#define RA_INDEXED 0x01
236
237typedef struct
238{
239 ULONG Type; /* Magic number 'FILE' */
240 USHORT UsaOffset; /* Offset to the update sequence */
241 USHORT UsaCount; /* Size in words of Update Sequence Number & Array (S) */
242 ULONGLONG Lsn; /* $LogFile Sequence Number (LSN) */
244
245/* NTFS_RECORD_HEADER.Type */
246#define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */
247#define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */
248
249
251{
253 USHORT SequenceNumber; /* Sequence number */
254 USHORT LinkCount; /* Hard link count */
255 USHORT AttributeOffset; /* Offset to the first Attribute */
256 USHORT Flags; /* Flags */
257 ULONG BytesInUse; /* Real size of the FILE record */
258 ULONG BytesAllocated; /* Allocated size of the FILE record */
259 ULONGLONG BaseFileRecord; /* File reference to the base FILE record */
260 USHORT NextAttributeNumber; /* Next Attribute Id */
261 USHORT Padding; /* Align to 4 UCHAR boundary (XP) */
262 ULONG MFTRecordNumber; /* Number of this MFT Record (XP) */
264
265/* Flags in FILE_RECORD_HEADER */
266
267#define FRH_IN_USE 0x0001 /* Record is in use */
268#define FRH_DIRECTORY 0x0002 /* Record is a directory */
269#define FRH_UNKNOWN1 0x0004 /* Don't know */
270#define FRH_UNKNOWN2 0x0008 /* Don't know */
271
272typedef struct
273{
274 ULONG Type;
276 UCHAR IsNonResident;
277 UCHAR NameLength;
278 USHORT NameOffset;
281 union
282 {
283 // Resident attributes
284 struct
285 {
287 USHORT ValueOffset;
288 UCHAR Flags;
290 } Resident;
291 // Non-resident attributes
292 struct
293 {
294 ULONGLONG LowestVCN;
295 ULONGLONG HighestVCN;
296 USHORT MappingPairsOffset;
297 USHORT CompressionUnit;
298 UCHAR Reserved[4];
299 LONGLONG AllocatedSize;
301 LONGLONG InitializedSize;
302 LONGLONG CompressedSize;
303 } NonResident;
304 };
306
307typedef struct
308{
317
318// The beginning and length of an attribute record are always aligned to an 8-byte boundary,
319// relative to the beginning of the file record.
320#define ATTR_RECORD_ALIGNMENT 8
321
322// Data runs are aligned to a 4-byte boundary, relative to the start of the attribute record
323#define DATA_RUN_ALIGNMENT 4
324
325// Value offset is aligned to a 4-byte boundary, relative to the start of the attribute record
326#define VALUE_OFFSET_ALIGNMENT 4
327
328typedef struct
329{
335 ULONG AlignmentOrReserved[3];
336#if 0
337 ULONG QuotaId;
338 ULONG SecurityId;
339 ULONGLONG QuotaCharge;
340 USN Usn;
341#endif
343
344
345typedef struct
346{
354 USHORT AlignmentOrReserved[3];
356
357
358typedef struct
359{
368 union
369 {
370 struct
371 {
374 } EaInfo;
376 } Extended;
381
382typedef struct
383{
388 UCHAR Padding[3];
390
391typedef struct
392{
397 UCHAR Padding[3];
400
401typedef struct
402{
407
408typedef struct
409{
410 union
411 {
412 struct
413 {
416 struct
417 {
421 } ViewIndex;
429
432
433// Keys are arranged in nodes as an ordered, linked list
434typedef struct _B_TREE_KEY
435{
437 B_TREE_FILENAME_NODE *LesserChild; // Child-Node. All the keys in this node will be sorted before IndexEntry
438 PINDEX_ENTRY_ATTRIBUTE IndexEntry; // must be last member for FIELD_OFFSET
440
441// Every Node is just an ordered list of keys.
442// Sub-nodes can be found attached to a key (if they exist).
443// A key's sub-node precedes that key in the ordered list.
445{
452
453typedef struct
454{
457
458typedef struct
459{
466
467typedef struct {
473
474#define IRPCONTEXT_CANWAIT 0x1
475#define IRPCONTEXT_COMPLETE 0x2
476#define IRPCONTEXT_QUEUE 0x4
477
478typedef struct
479{
493
494typedef struct _NTFS_ATTR_CONTEXT
495{
504 ULONGLONG FileOwnerMFTIndex; /* If attribute list attribute, reference the original file */
507
508#define FCB_CACHE_INITIALIZED 0x0001
509#define FCB_IS_VOLUME_STREAM 0x0002
510#define FCB_IS_VOLUME 0x0004
511#define MAX_PATH 260
512
513typedef struct _FCB
514{
516
519
522
524 WCHAR *ObjectName; /* point on filename (250 chars max) in PathName */
525 WCHAR PathName[MAX_PATH]; /* path+filename 260 max */
526
529
531 struct _FCB* ParentFcb;
532
534
538
541
543
545
546typedef struct _FIND_ATTR_CONTXT
547{
558
559typedef struct
560{
562 USHORT Array[];
564
566
570{
571 PULONG Flags = &IrpContext->Flags;
572
573 *Flags &= ~IRPCONTEXT_COMPLETE;
575
576 return STATUS_PENDING;
577}
578
579/* attrib.c */
580
581//VOID
582//NtfsDumpAttribute(PATTRIBUTE Attribute);
583
586 PFILE_RECORD_HEADER FileRecord,
587 PNTFS_ATTR_RECORD AttributeAddress,
588 PCWSTR Name,
589 USHORT NameLength);
590
593 PNTFS_ATTR_RECORD AttributeAddress);
594
597 PNTFS_ATTR_CONTEXT AttrContext,
598 ULONG AttrOffset,
599 PFILE_RECORD_HEADER FileRecord,
600 ULONGLONG NextAssignedCluster,
601 ULONG RunLength);
602
605 PFILE_RECORD_HEADER FileRecord,
606 PNTFS_ATTR_RECORD AttributeAddress,
607 PCWSTR Name,
608 USHORT NameLength);
609
612 PFILE_RECORD_HEADER FileRecord,
613 PNTFS_ATTR_RECORD AttributeAddress,
614 PINDEX_ROOT_ATTRIBUTE NewIndexRoot,
615 ULONG RootLength,
616 PCWSTR Name,
617 USHORT NameLength);
618
621 PNTFS_ATTR_RECORD AttributeAddress,
622 PDEVICE_EXTENSION DeviceExt,
624 BOOLEAN CaseSensitive,
625 PULONGLONG ParentMftIndex);
626
629 PNTFS_ATTR_RECORD AttributeAddress);
630
633 PLARGE_MCB DataRunsMCB,
634 PULONGLONG pNextVBN);
635
638 PUCHAR RunBuffer,
639 ULONG MaxBufferSize,
640 PULONG UsedBufferSize);
641
642PUCHAR
643DecodeRun(PUCHAR DataRun,
644 LONGLONG *DataRunOffset,
645 ULONGLONG *DataRunLength);
646
648
649VOID
650NtfsDumpDataRuns(PVOID StartOfRun,
651 ULONGLONG CurrentLCN);
652
653VOID
655 PFILE_RECORD_HEADER FileRecord);
656
659 PFILE_RECORD_HEADER FileRecord);
660
663 PFILE_RECORD_HEADER FileRecord,
665
666UCHAR
667GetPackedByteCount(LONGLONG NumberToPack,
668 BOOLEAN IsSigned);
669
672 PNTFS_ATTR_RECORD Attribute,
673 PULONGLONG LastCluster);
674
677 PFILE_RECORD_HEADER FileRecord);
678
682
686
690 PFILE_RECORD_HEADER FileRecord,
691 BOOLEAN OnlyResident,
692 PNTFS_ATTR_RECORD * Attribute);
693
696 PNTFS_ATTR_RECORD * Attribute);
697
698VOID
700
703 PNTFS_ATTR_CONTEXT AttrContext,
704 ULONG AttrOffset,
705 PFILE_RECORD_HEADER FileRecord,
706 ULONG ClustersToFree);
707
708/* blockdev.c */
709
716 IN BOOLEAN Override);
717
723 IN const PUCHAR Buffer);
724
727 IN ULONG DiskSector,
731 IN BOOLEAN Override);
732
737 IN ULONG InputBufferSize,
739 IN OUT PULONG OutputBufferSize,
740 IN BOOLEAN Override);
741
742
743/* btree.c */
744
745LONG
747 PB_TREE_KEY Key2,
748 BOOLEAN CaseSensitive);
749
752 PFILE_RECORD_HEADER FileRecordWithIndex,
753 /*PCWSTR IndexName,*/
754 PNTFS_ATTR_CONTEXT IndexRootContext,
755 PINDEX_ROOT_ATTRIBUTE IndexRoot,
756 PB_TREE *NewTree);
757
761 ULONG MaxIndexSize,
762 PINDEX_ROOT_ATTRIBUTE *IndexRoot,
763 ULONG *Length);
764
767
768VOID
770
771VOID
773
774VOID
776
777VOID
781 ULONG Depth);
782
783VOID
787 ULONG Depth);
788
790CreateEmptyBTree(PB_TREE *NewTree);
791
794 ULONG IndexBufferSize,
795 ULONGLONG Vcn);
796
799
800ULONG
802
805 ULONGLONG FileReference,
806 PFILENAME_ATTRIBUTE FileNameAttribute,
808 BOOLEAN CaseSensitive,
809 ULONG MaxIndexRootSize,
810 ULONG IndexRecordSize,
811 PB_TREE_KEY *MedianKey,
812 PB_TREE_FILENAME_NODE *NewRightHandSibling);
813
817 PB_TREE_KEY *MedianKey,
818 PB_TREE_FILENAME_NODE *NewRightHandSibling,
819 BOOLEAN CaseSensitive);
820
824 ULONG IndexBufferSize,
825 PFILE_RECORD_HEADER FileRecord);
826
829 PFILE_RECORD_HEADER FileRecord,
831 ULONG IndexBufferSize,
832 PNTFS_ATTR_CONTEXT IndexAllocationContext,
833 ULONG IndexAllocationOffset);
834
835/* close.c */
836
839
840
841/* close.c */
842
846
848NtfsClose(PNTFS_IRP_CONTEXT IrpContext);
849
850
851/* create.c */
852
854NtfsCreate(PNTFS_IRP_CONTEXT IrpContext);
855
859 BOOLEAN CaseSensitive,
860 BOOLEAN CanWait);
861
864
868 BOOLEAN CaseSensitive,
869 BOOLEAN CanWait);
870
871/* devctl.c */
872
875
876
877/* dirctl.c */
878
881 PFILE_RECORD_HEADER FileRecord,
883 ULONG StreamLength,
884 PULONGLONG AllocatedSize);
885
888
889
890/* dispatch.c */
891
895 PIRP Irp);
896
897
898/* fastio.c */
899
902 BOOLEAN Wait);
903
906
909 BOOLEAN Wait);
910
913
914FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible;
915FAST_IO_READ NtfsFastIoRead;
916FAST_IO_WRITE NtfsFastIoWrite;
917
918
919/* fcb.c */
920
924 PNTFS_VCB Vcb);
925
926VOID
928
931
934
937
940
943
944VOID
946 PNTFS_FCB Fcb);
947
948VOID
950 PNTFS_FCB Fcb);
951
952VOID
954 PNTFS_FCB Fcb);
955
959
962 PNTFS_FCB Fcb);
963
966
969
974
977 PNTFS_FCB *pParentFCB,
978 PNTFS_FCB *pFCB,
979 PCWSTR pFileName,
980 BOOLEAN CaseSensitive);
981
984 PNTFS_FCB pFCB,
985 ULONG Type,
986 PCWSTR Name,
987 ULONG NameLength,
988 PVOID * Data);
989
992 PNTFS_FCB DirectoryFCB,
996 ULONGLONG MFTIndex,
997 PNTFS_FCB * fileFCB);
998
999
1000/* finfo.c */
1001
1004
1008 PDEVICE_EXTENSION DeviceExt,
1009 ULONG IrpFlags,
1010 BOOLEAN CaseSensitive,
1012
1015
1016/* fsctl.c */
1017
1020
1021
1022/* mft.c */
1025 ULONGLONG DirectoryMftIndex,
1026 ULONGLONG FileReferenceNumber,
1027 PFILENAME_ATTRIBUTE FilenameAttribute,
1028 BOOLEAN CaseSensitive);
1029
1032 PDEVICE_EXTENSION DeviceExt,
1033 PULONGLONG DestinationIndex,
1034 BOOLEAN CanWait);
1035
1036VOID
1038
1041
1042VOID
1044
1045ULONG
1049 PCHAR Buffer,
1050 ULONG Length);
1051
1056 const PUCHAR Buffer,
1057 ULONG Length,
1058 PULONG LengthWritten,
1059 PFILE_RECORD_HEADER FileRecord);
1060
1063
1066 PNTFS_ATTR_CONTEXT AttrContext,
1067 PFILE_RECORD_HEADER FileRecord,
1068 ULONG AttrOffset,
1069 ULONG DataSize);
1070
1073 PNTFS_ATTR_RECORD FirstAttributeToMove,
1074 ULONG FirstAttributeOffset,
1075 ULONG_PTR MoveTo);
1076
1079 PNTFS_FCB Fcb,
1080 PNTFS_ATTR_CONTEXT AttrContext,
1081 ULONG AttrOffset,
1082 PFILE_RECORD_HEADER FileRecord,
1084
1085VOID
1087 PNTFS_ATTR_RECORD AttrEnd,
1088 ULONG EndMarker);
1089
1092 PNTFS_ATTR_CONTEXT AttrContext,
1093 ULONG AttrOffset,
1094 PFILE_RECORD_HEADER FileRecord,
1096
1099 PNTFS_ATTR_CONTEXT AttrContext,
1100 ULONG AttrOffset,
1101 PFILE_RECORD_HEADER FileRecord,
1103
1106
1107BOOLEAN
1109 PINDEX_ENTRY_ATTRIBUTE IndexEntry,
1110 BOOLEAN DirSearch,
1111 BOOLEAN CaseSensitive);
1112
1115
1120
1123 PFILE_RECORD_HEADER MftRecord,
1124 PCHAR IndexRecord,
1125 ULONG IndexBlockSize,
1126 PINDEX_ENTRY_ATTRIBUTE FirstEntry,
1127 PINDEX_ENTRY_ATTRIBUTE LastEntry,
1129 PULONG StartEntry,
1130 PULONG CurrentEntry,
1131 BOOLEAN DirSearch,
1132 ULONGLONG NewDataSize,
1133 ULONGLONG NewAllocatedSize,
1134 BOOLEAN CaseSensitive);
1135
1138 ULONGLONG ParentMFTIndex,
1140 BOOLEAN DirSearch,
1141 ULONGLONG NewDataSize,
1142 ULONGLONG NewAllocationSize,
1143 BOOLEAN CaseSensitive);
1144
1147 ULONGLONG MftIndex,
1148 PFILE_RECORD_HEADER FileRecord);
1149
1152 PFILE_RECORD_HEADER MftRecord,
1153 ULONG Type,
1154 PCWSTR Name,
1155 ULONG NameLength,
1156 PNTFS_ATTR_CONTEXT * AttrCtx,
1157 PULONG Offset);
1158
1159VOID
1163 ULONGLONG vcn,
1164 ULONG count,
1165 PVOID buffer);
1166
1170
1174
1177 ULONGLONG lcn,
1178 ULONG count,
1179 PVOID buffer);
1180
1181VOID
1185
1188 PUNICODE_STRING PathName,
1189 BOOLEAN CaseSensitive,
1190 PFILE_RECORD_HEADER *FileRecord,
1191 PULONGLONG MFTIndex);
1192
1195 PUNICODE_STRING PathName,
1196 BOOLEAN CaseSensitive,
1197 PFILE_RECORD_HEADER *FileRecord,
1198 PULONGLONG MFTIndex,
1199 ULONGLONG CurrentMFTIndex);
1200
1201VOID
1203 PFILE_RECORD_HEADER FileRecord);
1204
1207 PUNICODE_STRING SearchPattern,
1208 PULONG FirstEntry,
1209 PFILE_RECORD_HEADER *FileRecord,
1210 PULONGLONG MFTIndex,
1211 ULONGLONG CurrentMFTIndex,
1212 BOOLEAN CaseSensitive);
1213
1216 ULONGLONG MFTIndex,
1218 PULONG FirstEntry,
1219 BOOLEAN DirSearch,
1220 BOOLEAN CaseSensitive,
1221 ULONGLONG *OutMFTIndex);
1222
1223/* misc.c */
1224
1225BOOLEAN
1227
1230 PIRP Irp);
1231
1232PVOID
1234 BOOLEAN Paging);
1235
1238 IN ULONG Length,
1240
1241#if 0
1242BOOLEAN
1243wstrcmpjoki(PWSTR s1, PWSTR s2);
1244
1245VOID
1246CdfsSwapString(PWCHAR Out,
1247 PUCHAR In,
1248 ULONG Count);
1249#endif
1250
1251VOID
1252NtfsFileFlagsToAttributes(ULONG NtfsAttributes,
1254
1255
1256/* rw.c */
1257
1259NtfsRead(PNTFS_IRP_CONTEXT IrpContext);
1260
1262NtfsWrite(PNTFS_IRP_CONTEXT IrpContext);
1263
1264
1265/* volinfo.c */
1266
1269 ULONG FirstDesiredCluster,
1270 ULONG DesiredClusters,
1271 PULONG FirstAssignedCluster,
1272 PULONG AssignedClusters);
1273
1276
1279
1282
1283
1284/* ntfs.c */
1285
1286CODE_SEG("INIT")
1287DRIVER_INITIALIZE DriverEntry;
1288
1289CODE_SEG("INIT")
1290VOID
1291NTAPI
1293
1294#endif /* NTFS_H */
CRegistryTree Tree
unsigned char BOOLEAN
Type
Definition: Type.h:7
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 NameType
Definition: acpixf.h:658
LONG NTSTATUS
Definition: precomp.h:26
struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD
struct NTFS_ATTR_CONTEXT * PNTFS_ATTR_CONTEXT
_In_ PFCB _In_ LONGLONG StartingOffset
Definition: cdprocs.h:291
_In_ PFCB Fcb
Definition: cdprocs.h:159
Definition: bufpool.h:45
_In_ PIRP Irp
Definition: csq.h:116
@ Out
@ In
#define MAX_PATH
Definition: compat.h:34
FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible
Definition: ntfs.h:914
struct _NTFS_INFO NTFS_INFO
struct FIXUP_ARRAY * PFIXUP_ARRAY
struct DEVICE_EXTENSION * PDEVICE_EXTENSION
struct INDEX_BUFFER * PINDEX_BUFFER
FORCEINLINE NTSTATUS NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext)
Definition: ntfs.h:569
VOID NtfsDumpData(ULONG_PTR Buffer, ULONG Length)
Definition: mft.c:3297
ULONGLONG NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, PCWSTR Stream, ULONG StreamLength, PULONGLONG AllocatedSize)
Definition: dirctl.c:38
BOOLEAN NTAPI NtfsAcqReadAhead(PVOID Context, BOOLEAN Wait)
Definition: fastio.c:60
NTSTATUS AddRun(PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONGLONG NextAssignedCluster, ULONG RunLength)
Definition: attrib.c:599
NTSTATUS NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext)
Definition: devctl.c:36
PSTANDARD_INFORMATION GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: attrib.c:1940
VOID DumpBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, ULONG Number, ULONG Depth)
Definition: btree.c:1583
BOOLEAN NtfsFCBIsDirectory(PNTFS_FCB Fcb)
Definition: fcb.c:132
struct _B_TREE_KEY * PB_TREE_KEY
enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE
PNTFS_GLOBAL_DATA NtfsGlobalData
Definition: ntfs.c:36
NTSTATUS ReadFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG index, PFILE_RECORD_HEADER file)
Definition: mft.c:1631
struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE
PUCHAR DecodeRun(PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength)
Definition: attrib.c:966
NTSTATUS GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_RECORD Attribute, PULONGLONG LastCluster)
Definition: attrib.c:1908
NTSTATUS NtfsReadFCBAttribute(PNTFS_VCB Vcb, PNTFS_FCB pFCB, ULONG Type, PCWSTR Name, ULONG NameLength, PVOID *Data)
Definition: fcb.c:735
PNTFS_FCB NtfsGrabFCBFromTable(PNTFS_VCB Vcb, PCWSTR FileName)
Definition: fcb.c:222
VOID DestroyBTreeNode(PB_TREE_FILENAME_NODE Node)
Definition: btree.c:1511
NTSTATUS AddIndexRoot(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PINDEX_ROOT_ATTRIBUTE NewIndexRoot, ULONG RootLength, PCWSTR Name, USHORT NameLength)
Definition: attrib.c:495
#define IRPCONTEXT_QUEUE
Definition: ntfs.h:476
NTSTATUS ConvertDataRunsToLargeMCB(PUCHAR DataRun, PLARGE_MCB DataRunsMCB, PULONGLONG pNextVBN)
Definition: attrib.c:825
BOOLEAN NtfsFCBIsRoot(PNTFS_FCB Fcb)
Definition: fcb.c:158
NTSTATUS NtfsFCBInitializeCache(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
Definition: fcb.c:265
struct REPARSE_POINT_ATTRIBUTE * PREPARSE_POINT_ATTRIBUTE
struct INDEX_ENTRY_ATTRIBUTE * PINDEX_ENTRY_ATTRIBUTE
NTSTATUS NtfsLookupFileAt(PDEVICE_EXTENSION Vcb, PUNICODE_STRING PathName, BOOLEAN CaseSensitive, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex, ULONGLONG CurrentMFTIndex)
Definition: mft.c:3229
NTSTATUS UpdateFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MftIndex, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:1931
VOID ReadVCN(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER file, ATTRIBUTE_TYPE type, ULONGLONG vcn, ULONG count, PVOID buffer)
VOID NtfsDumpDataRuns(PVOID StartOfRun, ULONGLONG CurrentLCN)
Definition: attrib.c:1755
NTSTATUS CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecordWithIndex, PNTFS_ATTR_CONTEXT IndexRootContext, PINDEX_ROOT_ATTRIBUTE IndexRoot, PB_TREE *NewTree)
Definition: btree.c:682
NTSTATUS NtfsLookupFile(PDEVICE_EXTENSION Vcb, PUNICODE_STRING PathName, BOOLEAN CaseSensitive, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex)
Definition: mft.c:3287
VOID ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
Definition: mft.c:104
ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute)
Definition: attrib.c:1978
VOID NtfsFileFlagsToAttributes(ULONG NtfsAttributes, PULONG FileAttributes)
Definition: misc.c:105
DRIVER_DISPATCH NtfsFsdDispatch
Definition: ntfs.h:892
NTSTATUS NtfsCloseFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject)
Definition: close.c:40
FAST_IO_READ NtfsFastIoRead
Definition: ntfs.h:915
struct NTFS_CCB * PNTFS_CCB
struct _BIOS_PARAMETERS_BLOCK BIOS_PARAMETERS_BLOCK
NTSTATUS FindFirstAttribute(PFIND_ATTR_CONTXT Context, PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, BOOLEAN OnlyResident, PNTFS_ATTR_RECORD *Attribute)
Definition: attrib.c:1383
LONG CompareTreeKeys(PB_TREE_KEY Key1, PB_TREE_KEY Key2, BOOLEAN CaseSensitive)
Definition: btree.c:417
NTSTATUS SplitBTreeNode(PB_TREE Tree, PB_TREE_FILENAME_NODE Node, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling, BOOLEAN CaseSensitive)
Definition: btree.c:1883
struct NTFS_IRP_CONTEXT * PNTFS_IRP_CONTEXT
struct _FIND_ATTR_CONTXT * PFIND_ATTR_CONTXT
struct _BOOT_SECTOR * PBOOT_SECTOR
DRIVER_INITIALIZE DriverEntry
Definition: ntfs.h:1287
struct STANDARD_INFORMATION * PSTANDARD_INFORMATION
struct _B_TREE_FILENAME_NODE * PB_TREE_FILENAME_NODE
NTSTATUS FindFirstAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
Definition: attrib.c:1307
NTSTATUS FreeClusters(PNTFS_VCB Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, ULONG ClustersToFree)
Definition: attrib.c:1057
BOOLEAN NtfsIsIrpTopLevel(PIRP Irp)
Definition: misc.c:43
NTSTATUS UpdateFileNameRecord(PDEVICE_EXTENSION Vcb, ULONGLONG ParentMFTIndex, PUNICODE_STRING FileName, BOOLEAN DirSearch, ULONGLONG NewDataSize, ULONGLONG NewAllocationSize, BOOLEAN CaseSensitive)
Definition: mft.c:1660
struct DEVICE_EXTENSION NTFS_VCB
PNTFS_IRP_CONTEXT NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject, PIRP Irp)
Definition: misc.c:66
NTSTATUS AddFileName(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, PULONGLONG ParentMftIndex)
Definition: attrib.c:230
struct NTFS_RECORD_HEADER * PNTFS_RECORD_HEADER
VOID FindCloseAttribute(PFIND_ATTR_CONTXT Context)
Definition: attrib.c:1465
VOID NTAPI NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject)
Definition: ntfs.c:170
NTSTATUS UpdateMftMirror(PNTFS_VCB Vcb)
Definition: mft.c:2714
ULONGLONG GetIndexEntryVCN(PINDEX_ENTRY_ATTRIBUTE IndexEntry)
Definition: btree.c:1641
NTSTATUS NtfsInsertKey(PB_TREE Tree, ULONGLONG FileReference, PFILENAME_ATTRIBUTE FileNameAttribute, PB_TREE_FILENAME_NODE Node, BOOLEAN CaseSensitive, ULONG MaxIndexRootSize, ULONG IndexRecordSize, PB_TREE_KEY *MedianKey, PB_TREE_FILENAME_NODE *NewRightHandSibling)
Definition: btree.c:1691
NTSTATUS NtfsClose(PNTFS_IRP_CONTEXT IrpContext)
Definition: close.c:84
NTSTATUS AddBitmap(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
Definition: attrib.c:72
PNTFS_ATTR_CONTEXT PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
Definition: mft.c:41
BOOLEAN NtfsFCBIsReparsePoint(PNTFS_FCB Fcb)
Definition: fcb.c:139
ULONGLONG AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord)
Definition: mft.c:259
struct _FIND_ATTR_CONTXT FIND_ATTR_CONTXT
PFILENAME_ATTRIBUTE GetFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
Definition: attrib.c:1809
NTSTATUS AddIndexAllocation(PNTFS_VCB Vcb, PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress, PCWSTR Name, USHORT NameLength)
Definition: attrib.c:388
NTSTATUS NtfsSetEndOfFile(PNTFS_FCB Fcb, PFILE_OBJECT FileObject, PDEVICE_EXTENSION DeviceExt, ULONG IrpFlags, BOOLEAN CaseSensitive, PLARGE_INTEGER NewFileSize)
Definition: finfo.c:563
NTSTATUS FindAttribute(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, ULONG Type, PCWSTR Name, ULONG NameLength, PNTFS_ATTR_CONTEXT *AttrCtx, PULONG Offset)
Definition: mft.c:131
ULONG ReadAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length)
Definition: mft.c:1065
NTSTATUS ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB, PUCHAR RunBuffer, ULONG MaxBufferSize, PULONG UsedBufferSize)
Definition: attrib.c:896
struct VOLINFO_ATTRIBUTE * PVOLINFO_ATTRIBUTE
VOID SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttrEnd, ULONG EndMarker)
Definition: mft.c:706
NTSTATUS NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext)
Definition: finfo.c:420
ULONGLONG GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt, ULONG IndexBufferSize, ULONGLONG Vcn)
Definition: btree.c:1630
NTSTATUS UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG IndexBufferSize, PFILE_RECORD_HEADER FileRecord)
Definition: btree.c:1182
ULONGLONG NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt)
Definition: volinfo.c:37
NTSTATUS NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb, PNTFS_FCB DirectoryFCB, PUNICODE_STRING Name, PCWSTR Stream, PFILE_RECORD_HEADER Record, ULONGLONG MFTIndex, PNTFS_FCB *fileFCB)
Definition: fcb.c:389
BOOLEAN NTAPI NtfsAcqLazyWrite(PVOID Context, BOOLEAN Wait)
Definition: fastio.c:39
VOID DestroyBTree(PB_TREE Tree)
Definition: btree.c:1542
NTSTATUS NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, BOOLEAN CanWait)
Definition: create.c:886
NTSTATUS AddFixupArray(PDEVICE_EXTENSION Vcb, PNTFS_RECORD_HEADER Record)
Definition: mft.c:2603
NTSTATUS NtfsLockUserBuffer(IN PIRP Irp, IN ULONG Length, IN LOCK_OPERATION Operation)
Definition: misc.c:158
struct _BIOS_PARAMETERS_BLOCK * PBIOS_PARAMETERS_BLOCK
NTSTATUS DemoteBTreeRoot(PB_TREE Tree)
Definition: btree.c:1089
NTSTATUS SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
Definition: mft.c:756
PNTFS_ATTR_RECORD MoveAttributes(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_RECORD FirstAttributeToMove, ULONG FirstAttributeOffset, ULONG_PTR MoveTo)
Definition: mft.c:512
ULONG GetSizeOfIndexEntries(PB_TREE_FILENAME_NODE Node)
Definition: btree.c:855
struct INDEX_ROOT_ATTRIBUTE * PINDEX_ROOT_ATTRIBUTE
NTSTATUS NtfsRead(PNTFS_IRP_CONTEXT IrpContext)
Definition: rw.c:216
VOID DumpBTree(PB_TREE Tree)
Definition: btree.c:1622
NTSTATUS NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext)
Definition: fsctl.c:963
NTSTATUS NtfsWrite(PNTFS_IRP_CONTEXT IrpContext)
Definition: rw.c:537
NTSTATUS CreateEmptyBTree(PB_TREE *NewTree)
Definition: btree.c:348
VOID NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: attrib.c:1790
NTSTATUS NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt, ULONGLONG DirectoryMftIndex, ULONGLONG FileReferenceNumber, PFILENAME_ATTRIBUTE FilenameAttribute, BOOLEAN CaseSensitive)
Definition: mft.c:2192
struct DEVICE_EXTENSION * PNTFS_VCB
NTSTATUS AddData(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
Definition: attrib.c:160
struct _FCB NTFS_FCB
NTSTATUS UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, PCHAR IndexRecord, ULONG IndexBlockSize, PINDEX_ENTRY_ATTRIBUTE FirstEntry, PINDEX_ENTRY_ATTRIBUTE LastEntry, PUNICODE_STRING FileName, PULONG StartEntry, PULONG CurrentEntry, BOOLEAN DirSearch, ULONGLONG NewDataSize, ULONGLONG NewAllocatedSize, BOOLEAN CaseSensitive)
Definition: mft.c:1770
VOID NTAPI NtfsRelLazyWrite(PVOID Context)
Definition: fastio.c:51
VOID EnumerAttribute(PFILE_RECORD_HEADER file, PDEVICE_EXTENSION Vcb, PDEVICE_OBJECT DeviceObject)
ULONGLONG AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord)
Definition: mft.c:249
struct _EXTENDED_BIOS_PARAMETERS_BLOCK * PEXTENDED_BIOS_PARAMETERS_BLOCK
NTSTATUS AddNewMftEntry(PFILE_RECORD_HEADER FileRecord, PDEVICE_EXTENSION DeviceExt, PULONGLONG DestinationIndex, BOOLEAN CanWait)
Definition: mft.c:2022
struct NTFS_ATTRIBUTE_LIST_ITEM * PNTFS_ATTRIBUTE_LIST_ITEM
ATTRIBUTE_TYPE
Definition: ntfs.h:160
@ AttributeVolumeName
Definition: ntfs.h:166
@ AttributeEnd
Definition: ntfs.h:177
@ AttributeIndexRoot
Definition: ntfs.h:169
@ AttributePropertySet
Definition: ntfs.h:175
@ AttributeReparsePoint
Definition: ntfs.h:172
@ AttributeFileName
Definition: ntfs.h:163
@ AttributeEAInformation
Definition: ntfs.h:173
@ AttributeStandardInformation
Definition: ntfs.h:161
@ AttributeEA
Definition: ntfs.h:174
@ AttributeAttributeList
Definition: ntfs.h:162
@ AttributeVolumeInformation
Definition: ntfs.h:167
@ AttributeSecurityDescriptor
Definition: ntfs.h:165
@ AttributeIndexAllocation
Definition: ntfs.h:170
@ AttributeObjectId
Definition: ntfs.h:164
@ AttributeLoggedUtilityStream
Definition: ntfs.h:176
@ AttributeData
Definition: ntfs.h:168
@ AttributeBitmap
Definition: ntfs.h:171
NTSTATUS CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt, PB_TREE Tree, ULONG MaxIndexSize, PINDEX_ROOT_ATTRIBUTE *IndexRoot, ULONG *Length)
Definition: btree.c:910
BOOLEAN NtfsFCBIsEncrypted(PNTFS_FCB Fcb)
Definition: fcb.c:152
NTSTATUS NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext)
Definition: volinfo.c:343
NTSTATUS NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext)
Definition: volinfo.c:420
VOID NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:3334
NTSTATUS NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject, IN LONGLONG StartingOffset, IN ULONG Length, IN ULONG SectorSize, IN const PUCHAR Buffer)
Definition: blockdev.c:163
NTSTATUS NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext)
Definition: dirctl.c:590
PNTFS_FCB NtfsCreateFCB(PCWSTR FileName, PCWSTR Stream, PNTFS_VCB Vcb)
Definition: fcb.c:67
struct _B_TREE_KEY B_TREE_KEY
NTSTATUS NtfsAttachFCBToFileObject(PNTFS_VCB Vcb, PNTFS_FCB Fcb, PFILE_OBJECT FileObject)
Definition: fcb.c:464
NTSTATUS NtfsCreateDirectory(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject, BOOLEAN CaseSensitive, BOOLEAN CanWait)
Definition: create.c:681
struct _FCB * PNTFS_FCB
NTSTATUS NtfsCreate(PNTFS_IRP_CONTEXT IrpContext)
Definition: create.c:622
NTSTATUS NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, IN ULONG DiskSector, IN ULONG SectorCount, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
Definition: blockdev.c:308
NTSTATUS NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, IN ULONG ControlCode, IN PVOID InputBuffer, IN ULONG InputBufferSize, IN OUT PVOID OutputBuffer, IN OUT PULONG OutputBufferSize, IN BOOLEAN Override)
Definition: blockdev.c:326
NTSTATUS SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
Definition: mft.c:891
NTSTATUS NtfsFindMftRecord(PDEVICE_EXTENSION Vcb, ULONGLONG MFTIndex, PUNICODE_STRING FileName, PULONG FirstEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive, ULONGLONG *OutMFTIndex)
Definition: mft.c:3146
NTSTATUS WriteAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, const PUCHAR Buffer, ULONG Length, PULONG LengthWritten, PFILE_RECORD_HEADER FileRecord)
Definition: mft.c:1315
NTSTATUS ReadLCN(PDEVICE_EXTENSION Vcb, ULONGLONG lcn, ULONG count, PVOID buffer)
Definition: mft.c:2631
struct _FILE_RECORD_HEADER * PFILE_RECORD_HEADER
BOOLEAN NtfsFCBIsCompressed(PNTFS_FCB Fcb)
Definition: fcb.c:146
VOID NTAPI NtfsRelReadAhead(PVOID Context)
Definition: fastio.c:72
struct NTFS_GLOBAL_DATA * PNTFS_GLOBAL_DATA
NTSTATUS FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb, PNTFS_RECORD_HEADER Record)
Definition: mft.c:1965
NTSTATUS NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext)
Definition: cleanup.c:89
NTSTATUS FindNextAttribute(PFIND_ATTR_CONTXT Context, PNTFS_ATTR_RECORD *Attribute)
Definition: attrib.c:1431
NTSTATUS InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt, PNTFS_ATTR_CONTEXT AttrContext, PFILE_RECORD_HEADER FileRecord, ULONG AttrOffset, ULONG DataSize)
Definition: mft.c:542
VOID NtfsDestroyFCB(PNTFS_FCB Fcb)
Definition: fcb.c:120
NTSTATUS NtfsGetFCBForFile(PNTFS_VCB Vcb, PNTFS_FCB *pParentFCB, PNTFS_FCB *pFCB, PCWSTR pFileName, BOOLEAN CaseSensitive)
Definition: fcb.c:603
PNTFS_FCB NtfsOpenRootFCB(PNTFS_VCB Vcb)
Definition: fcb.c:374
NTSTATUS NtfsFindFileAt(PDEVICE_EXTENSION Vcb, PUNICODE_STRING SearchPattern, PULONG FirstEntry, PFILE_RECORD_HEADER *FileRecord, PULONGLONG MFTIndex, ULONGLONG CurrentMFTIndex, BOOLEAN CaseSensitive)
Definition: mft.c:3355
NTSTATUS NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext)
Definition: finfo.c:719
PVOID NtfsGetUserBuffer(PIRP Irp, BOOLEAN Paging)
Definition: misc.c:120
NTSTATUS FindNextAttributeListItem(PFIND_ATTR_CONTXT Context, PNTFS_ATTRIBUTE_LIST_ITEM *Item)
Definition: attrib.c:1321
UCHAR GetPackedByteCount(LONGLONG NumberToPack, BOOLEAN IsSigned)
Definition: attrib.c:1846
struct _EXTENDED_BIOS_PARAMETERS_BLOCK EXTENDED_BIOS_PARAMETERS_BLOCK
struct _B_TREE_FILENAME_NODE B_TREE_FILENAME_NODE
Definition: ntfs.h:431
VOID NtfsGrabFCB(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
Definition: fcb.c:165
struct NTFSIDENTIFIER * PNTFSIDENTIFIER
struct ATTRIBUTE_LIST * PATTRIBUTE_LIST
VOID NtfsAddFCBToTable(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
Definition: fcb.c:209
NTSTATUS UpdateIndexNode(PDEVICE_EXTENSION DeviceExt, PFILE_RECORD_HEADER FileRecord, PB_TREE_FILENAME_NODE Node, ULONG IndexBufferSize, PNTFS_ATTR_CONTEXT IndexAllocationContext, ULONG IndexAllocationOffset)
Definition: btree.c:1319
FAST_IO_WRITE NtfsFastIoWrite
Definition: ntfs.h:916
struct _FILE_RECORD_HEADER FILE_RECORD_HEADER
VOID NtfsReleaseFCB(PNTFS_VCB Vcb, PNTFS_FCB Fcb)
Definition: fcb.c:182
BOOLEAN CompareFileName(PUNICODE_STRING FileName, PINDEX_ENTRY_ATTRIBUTE IndexEntry, BOOLEAN DirSearch, BOOLEAN CaseSensitive)
Definition: mft.c:2650
PFILENAME_ATTRIBUTE GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
Definition: attrib.c:1985
NTSTATUS AddStandardInformation(PFILE_RECORD_HEADER FileRecord, PNTFS_ATTR_RECORD AttributeAddress)
Definition: attrib.c:766
NTSTATUS NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt, ULONG FirstDesiredCluster, ULONG DesiredClusters, PULONG FirstAssignedCluster, PULONG AssignedClusters)
Definition: volinfo.c:105
struct _BOOT_SECTOR BOOT_SECTOR
struct INDEX_HEADER_ATTRIBUTE * PINDEX_HEADER_ATTRIBUTE
PNTFS_FCB NtfsMakeRootFCB(PNTFS_VCB Vcb)
Definition: fcb.c:319
VOID DumpBTreeKey(PB_TREE Tree, PB_TREE_KEY Key, ULONG Number, ULONG Depth)
Definition: btree.c:1549
struct B_TREE * PB_TREE
NTSTATUS NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject, IN LONGLONG StartingOffset, IN ULONG Length, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
Definition: blockdev.c:37
struct _NTFS_INFO * PNTFS_INFO
PFILE_RECORD_HEADER NtfsCreateEmptyFileRecord(PDEVICE_EXTENSION DeviceExt)
Definition: create.c:818
NTSTATUS SetAttributeDataLength(PFILE_OBJECT FileObject, PNTFS_FCB Fcb, PNTFS_ATTR_CONTEXT AttrContext, ULONG AttrOffset, PFILE_RECORD_HEADER FileRecord, PLARGE_INTEGER DataSize)
Definition: mft.c:615
ULONG KSPIN_LOCK
Definition: env_spec_w32.h:72
ULONG ERESOURCE
Definition: env_spec_w32.h:594
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG FileAttributes
Definition: fltkernel.h:1236
FP_OP Operation
Definition: fpcontrol.c:150
GLuint GLuint GLsizei GLenum type
Definition: gl.h:1545
GLuint GLuint GLsizei count
Definition: gl.h:1545
GLuint buffer
Definition: glext.h:5915
GLuint index
Definition: glext.h:6031
static CODE_SEG("PAGE")
Definition: isapnp.c:1482
struct S1 s1
struct S2 s2
static IStream Stream
Definition: htmldoc.c:1115
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
Definition: ndis.h:4755
DRIVER_DISPATCH(nfs41_FsdDispatch)
int Count
Definition: noreturn.cpp:7
LONGLONG USN
Definition: ntbasedef.h:388
__GNU_EXTENSION typedef unsigned __int64 * PULONGLONG
Definition: ntbasedef.h:383
_In_ ULONG _In_ ULONG Offset
Definition: ntddpcm.h:101
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
Definition: ntpoapi.h:207
#define STATUS_PENDING
Definition: ntstatus.h:82
ULONG SectorCount
Definition: part_xbox.c:31
long LONG
Definition: pedump.c:60
unsigned short USHORT
Definition: pedump.c:61
#define Vcb
Definition: cdprocs.h:1415
ULONGLONG StartVcn
Definition: ntfs.h:351
UCHAR NameLength
Definition: ntfs.h:349
ATTRIBUTE_TYPE AttributeType
Definition: ntfs.h:347
ULONGLONG FileReferenceNumber
Definition: ntfs.h:352
USHORT Length
Definition: ntfs.h:348
UCHAR NameOffset
Definition: ntfs.h:350
USHORT AttributeNumber
Definition: ntfs.h:353
Definition: ntfs.h:454
PB_TREE_FILENAME_NODE RootNode
Definition: ntfs.h:455
struct _FILE_RECORD_HEADER * MasterFileTable
Definition: ntfs.h:114
KSPIN_LOCK FcbListLock
Definition: ntfs.h:106
struct _NTFS_ATTR_CONTEXT * MFTContext
Definition: ntfs.h:113
ULONG OpenHandleCount
Definition: ntfs.h:123
PFILE_OBJECT StreamFileObject
Definition: ntfs.h:111
NTFS_INFO NtfsInfo
Definition: ntfs.h:117
struct _FCB * VolumeFcb
Definition: ntfs.h:115
PDEVICE_OBJECT StorageDevice
Definition: ntfs.h:110
LIST_ENTRY FcbListHead
Definition: ntfs.h:107
ULONG Flags
Definition: ntfs.h:122
ULONG MftDataOffset
Definition: ntfs.h:121
NPAGED_LOOKASIDE_LIST FileRecLookasideList
Definition: ntfs.h:119
ERESOURCE DirResource
Definition: ntfs.h:103
NTFSIDENTIFIER Identifier
Definition: ntfs.h:101
base for all directory entries
Definition: entries.h:138
ULONGLONG LastWriteTime
Definition: ntfs.h:363
UCHAR NameLength
Definition: ntfs.h:377
ULONGLONG DirectoryFileReferenceNumber
Definition: ntfs.h:360
ULONGLONG DataSize
Definition: ntfs.h:366
UCHAR NameType
Definition: ntfs.h:378
ULONGLONG AllocatedSize
Definition: ntfs.h:365
ULONG FileAttributes
Definition: ntfs.h:367
ULONGLONG LastAccessTime
Definition: ntfs.h:364
USHORT AlignmentOrReserved
Definition: ntfs.h:373
ULONGLONG CreationTime
Definition: ntfs.h:361
USHORT PackedEaSize
Definition: ntfs.h:372
ULONG ReparseTag
Definition: ntfs.h:375
ULONGLONG ChangeTime
Definition: ntfs.h:362
USHORT USN
Definition: ntfs.h:561
INDEX_HEADER_ATTRIBUTE Header
Definition: ntfs.h:405
ULONGLONG VCN
Definition: ntfs.h:404
NTFS_RECORD_HEADER Ntfs
Definition: ntfs.h:403
Definition: ntfs.h:409
ULONGLONG IndexedFile
Definition: ntfs.h:414
FILENAME_ATTRIBUTE FileName
Definition: ntfs.h:427
USHORT Length
Definition: ntfs.h:423
USHORT KeyLength
Definition: ntfs.h:424
USHORT Reserved
Definition: ntfs.h:426
USHORT DataLength
Definition: ntfs.h:419
USHORT DataOffset
Definition: ntfs.h:418
ULONG Reserved
Definition: ntfs.h:420
USHORT Flags
Definition: ntfs.h:425
ULONG FirstEntryOffset
Definition: ntfs.h:384
ULONG TotalSizeOfEntries
Definition: ntfs.h:385
ULONG AttributeType
Definition: ntfs.h:393
ULONG CollationRule
Definition: ntfs.h:394
INDEX_HEADER_ATTRIBUTE Header
Definition: ntfs.h:398
UCHAR ClustersPerIndexRecord
Definition: ntfs.h:396
ULONG SizeOfEntry
Definition: ntfs.h:395
ULONG Type
Definition: ntfs.h:95
ULONG Size
Definition: ntfs.h:96
ULONGLONG StartingVCN
Definition: ntfs.h:313
ULONGLONG MFTIndex
Definition: ntfs.h:314
Definition: ntfs.h:130
PFILE_OBJECT PtrFileObject
Definition: ntfs.h:133
LIST_ENTRY NextCCB
Definition: ntfs.h:132
NTFSIDENTIFIER Identifier
Definition: ntfs.h:131
ULONG LastCluster
Definition: ntfs.h:139
PWCHAR DirectorySearchPattern
Definition: ntfs.h:138
ULONG Entry
Definition: ntfs.h:136
LARGE_INTEGER CurrentByteOffset
Definition: ntfs.h:134
ULONG LastOffset
Definition: ntfs.h:140
NPAGED_LOOKASIDE_LIST FcbLookasideList
Definition: ntfs.h:153
FAST_IO_DISPATCH FastIoDispatch
Definition: ntfs.h:151
BOOLEAN EnableWriteSupport
Definition: ntfs.h:155
ULONG Flags
Definition: ntfs.h:150
NPAGED_LOOKASIDE_LIST AttrCtxtLookasideList
Definition: ntfs.h:154
ERESOURCE Resource
Definition: ntfs.h:146
PDEVICE_OBJECT DeviceObject
Definition: ntfs.h:148
NPAGED_LOOKASIDE_LIST IrpContextLookasideList
Definition: ntfs.h:152
NTFSIDENTIFIER Identifier
Definition: ntfs.h:145
CACHE_MANAGER_CALLBACKS CacheMgrCallbacks
Definition: ntfs.h:149
PDRIVER_OBJECT DriverObject
Definition: ntfs.h:147
NTFSIDENTIFIER Identifier
Definition: ntfs.h:480
NTSTATUS SavedExceptionCode
Definition: ntfs.h:490
PFILE_OBJECT FileObject
Definition: ntfs.h:489
UCHAR MajorFunction
Definition: ntfs.h:483
ULONG Flags
Definition: ntfs.h:481
PIO_STACK_LOCATION Stack
Definition: ntfs.h:482
WORK_QUEUE_ITEM WorkQueueItem
Definition: ntfs.h:485
UCHAR MinorFunction
Definition: ntfs.h:484
CCHAR PriorityBoost
Definition: ntfs.h:491
BOOLEAN IsTopLevel
Definition: ntfs.h:487
PDEVICE_OBJECT DeviceObject
Definition: ntfs.h:488
USHORT UsaCount
Definition: ntfs.h:241
USHORT UsaOffset
Definition: ntfs.h:240
ULONGLONG Lsn
Definition: ntfs.h:242
ULONGLONG LastAccessTime
Definition: ntfs.h:333
ULONGLONG ChangeTime
Definition: ntfs.h:331
ULONGLONG LastWriteTime
Definition: ntfs.h:332
ULONG FileAttribute
Definition: ntfs.h:334
ULONGLONG CreationTime
Definition: ntfs.h:330
UCHAR MinorVersion
Definition: ntfs.h:462
UCHAR MajorVersion
Definition: ntfs.h:461
ULONG Unknown2
Definition: ntfs.h:464
ULONGLONG Unknown1
Definition: ntfs.h:460
USHORT Flags
Definition: ntfs.h:463
UCHAR SectorsPerCluster
Definition: ntfs.h:28
UCHAR Unused3[4]
Definition: ntfs.h:35
USHORT BytesPerSector
Definition: ntfs.h:27
UCHAR Unused1[2]
Definition: ntfs.h:31
USHORT SectorsPerTrack
Definition: ntfs.h:32
UCHAR Unused0[7]
Definition: ntfs.h:29
UCHAR Unused2[4]
Definition: ntfs.h:34
USHORT EndSector
Definition: ntfs.h:59
BIOS_PARAMETERS_BLOCK BPB
Definition: ntfs.h:56
UCHAR Jump[3]
Definition: ntfs.h:54
UCHAR BootStrap[426]
Definition: ntfs.h:58
EXTENDED_BIOS_PARAMETERS_BLOCK EBPB
Definition: ntfs.h:57
UCHAR OEMID[8]
Definition: ntfs.h:55
ULONGLONG VCN
Definition: ntfs.h:449
BOOLEAN HasValidVCN
Definition: ntfs.h:447
BOOLEAN DiskNeedsUpdating
Definition: ntfs.h:448
PB_TREE_KEY FirstKey
Definition: ntfs.h:450
struct _B_TREE_KEY * NextKey
Definition: ntfs.h:436
B_TREE_FILENAME_NODE * LesserChild
Definition: ntfs.h:437
PINDEX_ENTRY_ATTRIBUTE IndexEntry
Definition: ntfs.h:438
Definition: cdstruc.h:902
struct _FCB * ParentFcb
Definition: cdstruc.h:940
ULONG Flags
Definition: ntfs.h:536
FSRTL_COMMON_FCB_HEADER RFCB
Definition: ntfs.h:517
LIST_ENTRY FcbListEntry
Definition: ntfs.h:530
LONG RefCount
Definition: ntfs.h:535
PNTFS_VCB Vcb
Definition: ntfs.h:521
ULONGLONG MFTIndex
Definition: ntfs.h:539
WCHAR Stream[MAX_PATH]
Definition: ntfs.h:523
ERESOURCE PagingIoResource
Definition: ntfs.h:527
NTFSIDENTIFIER Identifier
Definition: ntfs.h:515
ULONG DirIndex
Definition: ntfs.h:533
SECTION_OBJECT_POINTERS SectionObjectPointers
Definition: ntfs.h:518
WCHAR * ObjectName
Definition: ntfs.h:524
WCHAR PathName[MAX_PATH]
Definition: ntfs.h:525
USHORT LinkCount
Definition: ntfs.h:540
ULONG OpenHandleCount
Definition: ntfs.h:537
FILENAME_ATTRIBUTE Entry
Definition: ntfs.h:542
ERESOURCE MainResource
Definition: ntfs.h:528
PFILE_OBJECT FileObject
Definition: ntfs.h:520
USHORT SequenceNumber
Definition: ntfs.h:253
USHORT Flags
Definition: ntfs.h:256
NTFS_RECORD_HEADER Ntfs
Definition: ntfs.h:252
USHORT LinkCount
Definition: ntfs.h:254
USHORT NextAttributeNumber
Definition: ntfs.h:260
USHORT Padding
Definition: ntfs.h:261
ULONG MFTRecordNumber
Definition: ntfs.h:262
USHORT AttributeOffset
Definition: ntfs.h:255
ULONG BytesInUse
Definition: ntfs.h:257
ULONGLONG BaseFileRecord
Definition: ntfs.h:259
ULONG BytesAllocated
Definition: ntfs.h:258
PNTFS_ATTRIBUTE_LIST_ITEM NonResidentStart
Definition: ntfs.h:553
PNTFS_ATTRIBUTE_LIST_ITEM NonResidentEnd
Definition: ntfs.h:554
PNTFS_ATTR_RECORD FirstAttr
Definition: ntfs.h:550
PNTFS_ATTRIBUTE_LIST_ITEM NonResidentCur
Definition: ntfs.h:555
PDEVICE_EXTENSION Vcb
Definition: ntfs.h:548
PNTFS_ATTR_RECORD LastAttr
Definition: ntfs.h:552
ULONG Offset
Definition: ntfs.h:556
PNTFS_ATTR_RECORD CurrAttr
Definition: ntfs.h:551
BOOLEAN OnlyResident
Definition: ntfs.h:549
Definition: typedefs.h:120
ULONGLONG CacheRunOffset
Definition: ntfs.h:497
LARGE_MCB DataRunsMCB
Definition: ntfs.h:502
ULONGLONG CacheRunLength
Definition: ntfs.h:499
LONGLONG CacheRunLastLCN
Definition: ntfs.h:500
PUCHAR CacheRun
Definition: ntfs.h:496
ULONGLONG FileMFTIndex
Definition: ntfs.h:503
PNTFS_ATTR_RECORD pRecord
Definition: ntfs.h:505
LONGLONG CacheRunStartLCN
Definition: ntfs.h:498
ULONGLONG FileOwnerMFTIndex
Definition: ntfs.h:504
ULONGLONG CacheRunCurrentOffset
Definition: ntfs.h:501
ULARGE_INTEGER MftStart
Definition: ntfs.h:72
ULONG BytesPerCluster
Definition: ntfs.h:69
USHORT VolumeLabelLength
Definition: ntfs.h:78
ULONG BytesPerFileRecord
Definition: ntfs.h:74
WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]
Definition: ntfs.h:79
ULONG BytesPerIndexRecord
Definition: ntfs.h:75
USHORT Flags
Definition: ntfs.h:82
ULONGLONG ClusterCount
Definition: ntfs.h:71
ULONG BytesPerSector
Definition: ntfs.h:67
ULARGE_INTEGER MftMirrStart
Definition: ntfs.h:73
UCHAR MinorVersion
Definition: ntfs.h:81
ULONGLONG SerialNumber
Definition: ntfs.h:77
ULONG MftZoneReservation
Definition: ntfs.h:84
ULONG SectorsPerCluster
Definition: ntfs.h:68
UCHAR MajorVersion
Definition: ntfs.h:80
ULONGLONG SectorCount
Definition: ntfs.h:70
Definition: iotypes.h:189
Definition: fci.c:127
uint16_t * PWSTR
Definition: typedefs.h:56
uint32_t * PULONG
Definition: typedefs.h:59
const uint16_t * PCWSTR
Definition: typedefs.h:57
int64_t LONGLONG
Definition: typedefs.h:68
#define NTAPI
Definition: typedefs.h:36
uint32_t ULONG_PTR
Definition: typedefs.h:65
#define IN
Definition: typedefs.h:39
uint16_t * PWCHAR
Definition: typedefs.h:56
unsigned char * PUCHAR
Definition: typedefs.h:53
uint32_t ULONG
Definition: typedefs.h:59
uint64_t ULONGLONG
Definition: typedefs.h:67
#define OUT
Definition: typedefs.h:40
char CCHAR
Definition: typedefs.h:51
char * PCHAR
Definition: typedefs.h:51
Definition: dlist.c:348
_In_ WDFCOLLECTION _In_ WDFOBJECT Item
_In_ PDEVICE_OBJECT DeviceObject
Definition: wdfdevice.h:2055
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
Definition: wdfdevice.h:550
_In_ WDFDPC _In_ BOOLEAN Wait
Definition: wdfdpc.h:170
_Must_inspect_result_ _In_ PDRIVER_OBJECT DriverObject
Definition: wdfdriver.h:213
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
Definition: wdfiotarget.h:863
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
Definition: wdfiotarget.h:953
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
Definition: wdfregistry.h:275
#define FORCEINLINE
Definition: wdftypes.h:67
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_WMI_INSTANCE_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_opt_ WDFWMIINSTANCE * Instance
Definition: wdfwmi.h:481
_Reserved_ PVOID Reserved
Definition: winddi.h:3974
_IRQL_requires_same_ typedef _In_ ULONG ControlCode
Definition: wmitypes.h:55
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION _In_ ULONG _In_ SIZE_T _In_ ULONG _In_ USHORT Depth
Definition: exfuncs.h:819
struct LOOKASIDE_ALIGN _NPAGED_LOOKASIDE_LIST NPAGED_LOOKASIDE_LIST
_In_ ULONG SectorSize
Definition: halfuncs.h:291
* PFILE_OBJECT
Definition: iotypes.h:1998
#define MAXIMUM_VOLUME_LABEL_LENGTH
Definition: iotypes.h:177
enum _LOCK_OPERATION LOCK_OPERATION
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
Definition: ketypes.h:268
_In_opt_ PLARGE_INTEGER NewFileSize
Definition: mmfuncs.h:608
unsigned char UCHAR
Definition: xmlstorage.h:181
__wchar_t WCHAR
Definition: xmlstorage.h:180
char CHAR
Definition: xmlstorage.h:175