ReactOS 0.4.17-dev-1133-gc25e4fd
files.c
Go to the documentation of this file.
1/*
2 * COPYRIGHT: See COPYING in the top level directory
3 * PROJECT: ReactOS NTFS FS library
4 * FILE: lib/fslib/ntfslib/files.c
5 * PURPOSE: NTFS metadata builder
6 *
7 * Builds MFT records 0..35 into one buffer, then writes the MFT and the
8 * auxiliary streams ($LogFile, $AttrDef, $UpCase, $Secure:$SDS/$SDH,
9 * $MFT:$BITMAP, the cluster $Bitmap, the root $I30 index, the TxF payloads).
10 * Records 0..15 are the reserved system files; 24..35 are the $Extend subtree.
11 * Directory index entries are copied from each child's own $FILE_NAME in the
12 * buffer, so the two copies always agree.
13 *
14 * The $MFT is reserved large and contiguous (LAYOUT.MftClusters): the NTFS VBR
15 * assumes a contiguous MFT, and a full install must not fragment it.
16 */
17
18/* INCLUDES ******************************************************************/
19
20#include "ntfslib.h"
21#include "data.h" /* ATTRIBUTES_TABLE, UPCASE_TABLE */
22#include "refdata.h" /* DefaultSds, RootSdValue, TxfDataValue, TopsData, ... */
23
24#define NDEBUG
25#include <debug.h>
26
27
28/* CONSTANTS *****************************************************************/
29
30/* MFT record numbers. 0..11 system files, 12..15 reserved stubs; the $Extend
31 * children sit at 24..35, above the reserved 0..15 range. */
32#define MREC_MFT 0
33#define MREC_MFTMIRR 1
34#define MREC_LOGFILE 2
35#define MREC_VOLUME 3
36#define MREC_ATTRDEF 4
37#define MREC_ROOT 5
38#define MREC_BITMAP 6
39#define MREC_BOOT 7
40#define MREC_BADCLUS 8
41#define MREC_SECURE 9
42#define MREC_UPCASE 10
43#define MREC_EXTEND 11
44#define MREC_QUOTA 24
45#define MREC_OBJID 25
46#define MREC_REPARSE 26
47#define MREC_RMMETA 27 /* $Extend/$RmMetadata */
48#define MREC_REPAIR 28 /* $RmMetadata/$Repair */
49#define MREC_DELETED 29 /* $Extend/$Deleted */
50#define MREC_TXFLOG 30 /* $RmMetadata/$TxfLog */
51#define MREC_TXF 31 /* $RmMetadata/$Txf */
52#define MREC_TOPS 32 /* $TxfLog/$Tops */
53#define MREC_TXFBLF 33 /* $TxfLog/$TxfLog.blf */
54#define MREC_CONT1 34 /* $TxfLog/$TxfLogContainer...0001 */
55#define MREC_CONT2 35 /* $TxfLog/$TxfLogContainer...0002 */
56#define MREC_COUNT 36 /* records materialized in the build buffer */
57
58/* File attribute (STD_INFO / FILE_NAME) flags. */
59#define FA_HIDDEN 0x0002u
60#define FA_SYSTEM 0x0004u
61#define FA_ARCHIVE 0x0020u
62#define FA_DIR 0x10000000u /* directory (has $I30) */
63#define FA_VIEW 0x20000000u /* carries a view index ($Extend children / $Secure) */
64
65/* Collation rules not already in ntfslib.h. */
66#define COLL_SID 0x11
67#define COLL_ULONGS 0x13
68
69/* Update-sequence check value (any value except 0x0000 / 0xFFFF). */
70#define USN_VALUE 1
71
72#define HOLE_LCN (~0ULL)
73
74
75/* UNALIGNED ACCESS HELPERS **************************************************/
76
77#define WR16(p, o, v) (*(PUSHORT)((PBYTE)(p) + (o)) = (USHORT)(v))
78#define WR32(p, o, v) (*(PULONG)((PBYTE)(p) + (o)) = (ULONG)(v))
79#define WR64(p, o, v) (*(PULONGLONG)((PBYTE)(p) + (o)) = (ULONGLONG)(v))
80#define RD16(p, o) (*(PUSHORT)((PBYTE)(p) + (o)))
81#define RD32(p, o) (*(PULONG)((PBYTE)(p) + (o)))
82
83#define ALIGN8(x) (((x) + 7u) & ~7u)
84
85
86/* STRUCTURES ****************************************************************/
87
88typedef struct
89{
90 ULONGLONG Lcn; /* HOLE_LCN for a sparse hole */
91 ULONGLONG Len; /* in clusters */
92} MK_RUN;
93
94typedef struct
95{
96 PBYTE Buf;
97 ULONG Offset; /* current append offset */
98 USHORT NextAttrId;
99} MK_REC;
100
101typedef struct
102{
103 const BYTE *Key;
104 USHORT KeyLen;
105 const BYTE *Data;
106 USHORT DataLen;
107} MK_VIEW_ENTRY;
108
109
110/* RUN-LIST (MAPPING PAIRS) ENCODER ******************************************/
111
112/* Minimal *signed* byte count for Value (both run length and LCN delta are
113 * stored as signed values in NTFS mapping pairs). */
114static
115ULONG
116MkSignBytes(IN LONGLONG Value)
117{
118 ULONG Bytes;
119 LONGLONG V;
120
121 if (Value == 0)
122 return 0;
123
124 Bytes = 0;
125 V = Value;
126 do
127 {
128 Bytes++;
129 V >>= 8;
130 }
131 while (!((V == 0) && (((Value >> (Bytes * 8 - 1)) & 1) == 0)) &&
132 !((V == -1) && (((Value >> (Bytes * 8 - 1)) & 1) == 1)));
133
134 return Bytes;
135}
136
137/* Encodes a runlist into NTFS mapping pairs (plus terminator). Returns length. */
138static
139ULONG
140MkEncodeRuns(IN const MK_RUN *Runs,
141 IN ULONG RunCount,
142 OUT PBYTE Out)
143{
144 ULONG Pos = 0;
145 ULONG Index;
146 ULONGLONG PrevLcn = 0;
147
148 for (Index = 0; Index < RunCount; Index++)
149 {
150 ULONG LenBytes;
151 ULONG OffBytes;
152 LONGLONG LcnDelta;
153 ULONG B;
154 ULONGLONG Len = Runs[Index].Len;
155
156 /* Length is unsigned but stored minimally-signed with a clear top bit. */
157 LenBytes = MkSignBytes((LONGLONG)Len);
158 if (LenBytes == 0)
159 LenBytes = 1;
160 if ((Len >> (LenBytes * 8 - 1)) & 1)
161 LenBytes++;
162
163 if (Runs[Index].Lcn == HOLE_LCN)
164 {
165 OffBytes = 0;
166 LcnDelta = 0;
167 }
168 else
169 {
170 LcnDelta = (LONGLONG)Runs[Index].Lcn - (LONGLONG)PrevLcn;
171 OffBytes = MkSignBytes(LcnDelta);
172 if (OffBytes == 0)
173 OffBytes = 1;
174 PrevLcn = Runs[Index].Lcn;
175 }
176
177 Out[Pos++] = (BYTE)((OffBytes << 4) | (LenBytes & 0x0F));
178 for (B = 0; B < LenBytes; B++)
179 Out[Pos++] = (BYTE)(Len >> (B * 8));
180 for (B = 0; B < OffBytes; B++)
181 Out[Pos++] = (BYTE)((ULONGLONG)LcnDelta >> (B * 8));
182 }
183
184 Out[Pos++] = 0; /* terminator */
185 return Pos;
186}
187
188
189/* MFT RECORD BUILDER ********************************************************/
190
191static
192VOID
193MkInit(OUT MK_REC *Rec,
194 IN PBYTE Buf,
195 IN ULONG RecordNumber,
196 IN USHORT Flags)
197{
198 USHORT UsaCount = (USHORT)(MFT_RECORD_SIZE / BYTES_PER_SECTOR + 1);
199
200 RtlZeroMemory(Buf, MFT_RECORD_SIZE);
201 Rec->Buf = Buf;
202 Rec->NextAttrId = 0;
203
204 RtlCopyMemory(Buf + 0x00, "FILE", 4);
205 WR16(Buf, 0x04, 0x30); /* USA offset */
206 WR16(Buf, 0x06, UsaCount); /* USA count */
207 WR64(Buf, 0x08, 0); /* $LogFile LSN */
208 WR16(Buf, 0x10, RECORD_SEQUENCE(RecordNumber)); /* sequence number */
209 WR16(Buf, 0x12, 1); /* hard link count */
210 WR16(Buf, 0x14, 0x38); /* first attribute offset */
211 WR16(Buf, 0x16, Flags);
212 WR32(Buf, 0x1C, MFT_RECORD_SIZE); /* allocated size */
213 WR64(Buf, 0x20, 0); /* base record */
214 WR16(Buf, 0x28, 0); /* next attr id (set at finalize) */
215 WR32(Buf, 0x2C, RecordNumber); /* this record number */
216
217 Rec->Offset = 0x38;
218}
219
220static
221VOID
222MkSetHardLinks(IN MK_REC *Rec,
223 IN USHORT Count)
224{
225 WR16(Rec->Buf, 0x12, Count);
226}
227
228/* Appends a resident attribute. Name is UTF-16 (NameChars units, may be 0). */
229static
230VOID
231MkAddResident(IN OUT MK_REC *Rec,
232 IN ULONG Type,
233 IN LPCWSTR Name,
234 IN BYTE NameChars,
235 IN BYTE ResidentFlags,
236 IN const VOID *Value,
237 IN ULONG ValueLen)
238{
239 PBYTE A = Rec->Buf + Rec->Offset;
240 USHORT ValueOff = (USHORT)ALIGN8(0x18u + (ULONG)NameChars * 2);
241 ULONG AttrLen = ALIGN8(ValueOff + ValueLen);
242 ULONG I;
243
244 WR32(A, 0x00, Type);
245 WR32(A, 0x04, AttrLen);
246 A[0x08] = 0; /* resident */
247 A[0x09] = NameChars;
248 WR16(A, 0x0A, 0x18); /* name offset (Windows sets it even if unnamed) */
249 WR16(A, 0x0C, 0); /* flags */
250 WR16(A, 0x0E, Rec->NextAttrId++);
251 WR32(A, 0x10, ValueLen);
252 WR16(A, 0x14, ValueOff);
253 A[0x16] = ResidentFlags;
254 A[0x17] = 0;
255
256 for (I = 0; I < NameChars; I++)
257 WR16(A, 0x18 + I * 2, Name[I]);
258 if (ValueLen > 0)
259 RtlCopyMemory(A + ValueOff, Value, ValueLen);
260
261 Rec->Offset += AttrLen;
262}
263
264/* Appends a non-resident attribute with an explicit runlist. */
265static
266VOID
267MkAddNonResident(IN OUT MK_REC *Rec,
268 IN ULONG Type,
269 IN LPCWSTR Name,
270 IN BYTE NameChars,
271 IN USHORT Flags,
272 IN const MK_RUN *Runs,
273 IN ULONG RunCount,
274 IN ULONGLONG HighVcn,
275 IN ULONGLONG AllocSize,
276 IN ULONGLONG RealSize,
277 IN ULONGLONG InitSize)
278{
279 PBYTE A = Rec->Buf + Rec->Offset;
280 BYTE MapBuf[64];
281 ULONG MapLen;
282 USHORT DataBase;
283 USHORT MapOff;
284 ULONG AttrLen;
285 ULONG I;
286 BOOLEAN HasCompSize;
287
288 MapLen = MkEncodeRuns(Runs, RunCount, MapBuf);
289
290 /* A compressed (0x0001) or sparse (0x8000) attribute carries an extra
291 * 8-byte "compressed size" field at 0x40, pushing name/runs to 0x48. */
292 HasCompSize = (Flags & (ATTR_IS_COMPRESSED | ATTR_IS_SPARSE)) != 0;
293 DataBase = (USHORT)(HasCompSize ? 0x48 : 0x40);
294
295 MapOff = (USHORT)ALIGN8((ULONG)DataBase + (ULONG)NameChars * 2);
296 AttrLen = ALIGN8(MapOff + MapLen);
297
298 WR32(A, 0x00, Type);
299 WR32(A, 0x04, AttrLen);
300 A[0x08] = 1; /* non-resident */
301 A[0x09] = NameChars;
302 WR16(A, 0x0A, DataBase); /* name offset */
303 WR16(A, 0x0C, Flags);
304 WR16(A, 0x0E, Rec->NextAttrId++);
305 WR64(A, 0x10, 0); /* starting VCN */
306 WR64(A, 0x18, HighVcn); /* last VCN */
307 WR16(A, 0x20, MapOff);
308 WR16(A, 0x22, 0); /* compression unit */
309 WR32(A, 0x24, 0); /* padding */
310 WR64(A, 0x28, AllocSize);
311 WR64(A, 0x30, RealSize);
312 WR64(A, 0x38, InitSize);
313 if (HasCompSize)
314 WR64(A, 0x40, 0); /* compressed/allocated size (our only sparse stream is all holes) */
315
316 for (I = 0; I < NameChars; I++)
317 WR16(A, DataBase + I * 2, Name[I]);
318 RtlCopyMemory(A + MapOff, MapBuf, MapLen);
319
320 Rec->Offset += AttrLen;
321}
322
323/* Terminates the attribute list, records bytes-in-use / next attr id, and
324 * applies the update-sequence (fixup) so the record is ready to write. */
325static
326VOID
327MkFinalize(IN MK_REC *Rec)
328{
329 PBYTE Buf = Rec->Buf;
330 ULONG Used;
331 USHORT UsaOff;
332 USHORT UsaCount;
333 ULONG Sector;
334
335 WR32(Buf, Rec->Offset, AttributeEnd); /* end marker */
336 WR32(Buf, Rec->Offset + 4, 0);
337 Used = Rec->Offset + 8;
338
339 WR32(Buf, 0x18, Used); /* bytes in use */
340 WR16(Buf, 0x28, Rec->NextAttrId); /* next attr id */
341
342 UsaOff = RD16(Buf, 0x04);
343 UsaCount = RD16(Buf, 0x06);
344 WR16(Buf, UsaOff, USN_VALUE);
345 for (Sector = 0; Sector + 1 < UsaCount; Sector++)
346 {
347 PBYTE Tail = Buf + (Sector + 1) * BYTES_PER_SECTOR - 2;
348
349 WR16(Buf, UsaOff + (Sector + 1) * 2, RD16(Tail, 0));
350 WR16(Tail, 0, USN_VALUE);
351 }
352}
353
354
355/* ATTRIBUTE VALUE BUILDERS **************************************************/
356
357static
358VOID
359MkStdInfo(OUT PBYTE Out,
360 IN ULONG FileAttributes,
361 IN ULONGLONG Now,
362 IN ULONG SecurityId)
363{
364 RtlZeroMemory(Out, 72);
365 WR64(Out, 0x00, Now); /* creation */
366 WR64(Out, 0x08, Now); /* modified */
367 WR64(Out, 0x10, Now); /* mft changed */
368 WR64(Out, 0x18, Now); /* accessed */
369 WR32(Out, 0x20, FileAttributes);
370 WR32(Out, 0x34, SecurityId);
371}
372
373/* Short (v1.2, 48-byte) STANDARD_INFORMATION with no SecurityId. Used by the
374 * files that carry an embedded $SECURITY_DESCRIPTOR: root, $Boot, recs 12..15. */
375static
376VOID
377MkStdInfoShort(OUT PBYTE Out,
378 IN ULONG FileAttributes,
379 IN ULONGLONG Now)
380{
381 RtlZeroMemory(Out, 48);
382 WR64(Out, 0x00, Now);
383 WR64(Out, 0x08, Now);
384 WR64(Out, 0x10, Now);
385 WR64(Out, 0x18, Now);
386 WR32(Out, 0x20, FileAttributes);
387}
388
389static
390ULONG
391MkFileName(OUT PBYTE Out,
392 IN ULONGLONG ParentRef,
393 IN ULONG FileAttributes,
394 IN ULONGLONG AllocSize,
395 IN ULONGLONG RealSize,
396 IN ULONGLONG Now,
397 IN LPCWSTR Name,
398 IN BYTE Namespace)
399{
400 BYTE NameLen = 0;
401 ULONG I;
402
403 while (Name[NameLen] != L'\0')
404 NameLen++;
405
406 RtlZeroMemory(Out, 0x42 + (ULONG)NameLen * 2);
407 WR64(Out, 0x00, ParentRef);
408 WR64(Out, 0x08, Now);
409 WR64(Out, 0x10, Now);
410 WR64(Out, 0x18, Now);
411 WR64(Out, 0x20, Now);
412 WR64(Out, 0x28, AllocSize);
413 WR64(Out, 0x30, RealSize);
414 WR32(Out, 0x38, FileAttributes);
415 Out[0x40] = NameLen;
416 Out[0x41] = Namespace;
417 for (I = 0; I < NameLen; I++)
418 WR16(Out, 0x42 + I * 2, Name[I]);
419
420 return 0x42 + (ULONG)NameLen * 2;
421}
422
423/* Copies the resident $FILE_NAME (0x30) value out of a built MFT record.
424 * Safe on a finalized record: the FILE_NAME sits far from the fixup bytes. */
425static
426USHORT
427MkExtractFileName(IN const BYTE *RecBuf,
428 OUT PBYTE Out)
429{
430 ULONG P = RD16(RecBuf, 0x14);
431
432 while ((P + 4) <= MFT_RECORD_SIZE)
433 {
434 ULONG Type = RD32(RecBuf, P);
435 ULONG Len;
436
437 if (Type == (ULONG)AttributeEnd)
438 break;
439 Len = RD32(RecBuf, P + 4);
440 if (Len == 0)
441 break;
442 if ((Type == (ULONG)AttributeFileName) && (RecBuf[P + 8] == 0))
443 {
444 ULONG ValLen = RD32(RecBuf, P + 0x10);
445 USHORT ValOff = RD16(RecBuf, P + 0x14);
446
447 RtlCopyMemory(Out, RecBuf + P + ValOff, ValLen);
448 return (USHORT)ValLen;
449 }
450 P += Len;
451 }
452 return 0;
453}
454
455/* Empty ($I30) directory INDEX_ROOT (header + end marker). Returns 0x30. */
456static
457ULONG
458MkEmptyI30Root(OUT PBYTE Out)
459{
460 RtlZeroMemory(Out, 0x30);
461 WR32(Out, 0x00, AttributeFileName);
462 WR32(Out, 0x04, COLLATION_FILE_NAME);
463 WR32(Out, 0x08, INDEX_RECORD_SIZE);
464 Out[0x0C] = (BYTE)LAYOUT.ClustersPerIndexRecord;
465 WR32(Out, 0x10, 0x10); /* entries offset */
466 WR32(Out, 0x14, 0x10 + 0x10); /* index length */
467 WR32(Out, 0x18, 0x10 + 0x10); /* allocated */
468 Out[0x1C] = 0; /* small index */
469 WR16(Out, 0x28, 0x10); /* end entry length */
470 WR16(Out, 0x2C, INDEX_ENTRY_END);
471 return 0x30;
472}
473
474/* Large ($I30) directory INDEX_ROOT: no inline entries, end marker flagged
475 * LAST|HAS_SUBNODE pointing at INDX VCN 0. Returns 0x38. */
476static
477ULONG
478MkLargeI30Root(OUT PBYTE Out)
479{
480 RtlZeroMemory(Out, 0x38);
481 WR32(Out, 0x00, AttributeFileName);
482 WR32(Out, 0x04, COLLATION_FILE_NAME);
483 WR32(Out, 0x08, INDEX_RECORD_SIZE);
484 Out[0x0C] = (BYTE)LAYOUT.ClustersPerIndexRecord;
485 WR32(Out, 0x10, 0x10);
486 WR32(Out, 0x14, 0x10 + 0x18);
487 WR32(Out, 0x18, 0x10 + 0x18);
488 Out[0x1C] = INDEX_NODE_LARGE;
489 WR16(Out, 0x28, 0x18); /* entry length */
490 WR16(Out, 0x2C, INDEX_ENTRY_END | INDEX_ENTRY_NODE);
491 WR64(Out, 0x30, 0); /* subnode VCN */
492 return 0x38;
493}
494
495/* Small resident $I30 INDEX_ROOT holding filename entries for the given records
496 * (collation order), plus the end marker. Returns the value length. */
497static
498ULONG
499MkI30RootWithEntries(OUT PBYTE Out,
500 IN const BYTE *Mft,
501 IN const ULONG *Order,
502 IN ULONG Count)
503{
504 ULONG P;
505 ULONG Index;
506 ULONG IndexLen;
507
508 RtlZeroMemory(Out, 0x20);
509 WR32(Out, 0x00, AttributeFileName);
510 WR32(Out, 0x04, COLLATION_FILE_NAME);
511 WR32(Out, 0x08, INDEX_RECORD_SIZE);
512 Out[0x0C] = (BYTE)LAYOUT.ClustersPerIndexRecord;
513 WR32(Out, 0x10, 0x10); /* entries offset */
514 Out[0x1C] = 0; /* small index */
515
516 P = 0x20;
517 for (Index = 0; Index < Count; Index++)
518 {
519 BYTE Fn[256];
520 USHORT FnLen = MkExtractFileName(Mft + (ULONG_PTR)Order[Index] * MFT_RECORD_SIZE, Fn);
521 ULONG EntryLen = ALIGN8(0x10u + FnLen);
522
523 RtlZeroMemory(Out + P, EntryLen);
524 WR64(Out, P + 0x00, MFT_REFERENCE(Order[Index]));
525 WR16(Out, P + 0x08, EntryLen);
526 WR16(Out, P + 0x0A, FnLen);
527 WR16(Out, P + 0x0C, 0);
528 WR16(Out, P + 0x0E, 0);
529 RtlCopyMemory(Out + P + 0x10, Fn, FnLen);
530 P += EntryLen;
531 }
532
533 /* End marker */
534 RtlZeroMemory(Out + P, 0x10);
535 WR16(Out, P + 0x08, 0x10);
536 WR16(Out, P + 0x0C, INDEX_ENTRY_END);
537 P += 0x10;
538
539 IndexLen = P - 0x10;
540 WR32(Out, 0x14, IndexLen);
541 WR32(Out, 0x18, IndexLen);
542 return P;
543}
544
545/* Empty view-index INDEX_ROOT (header + end marker). Returns 0x30. */
546static
547ULONG
548MkEmptyViewRoot(OUT PBYTE Out,
549 IN ULONG CollationRule)
550{
551 RtlZeroMemory(Out, 0x30);
552 WR32(Out, 0x00, 0); /* view index (indexed attr type 0) */
553 WR32(Out, 0x04, CollationRule);
554 WR32(Out, 0x08, INDEX_RECORD_SIZE);
555 Out[0x0C] = (BYTE)LAYOUT.ClustersPerIndexRecord;
556 WR32(Out, 0x10, 0x10);
557 WR32(Out, 0x14, 0x10 + 0x10);
558 WR32(Out, 0x18, 0x10 + 0x10);
559 Out[0x1C] = 0;
560 WR16(Out, 0x28, 0x10);
561 WR16(Out, 0x2C, INDEX_ENTRY_END);
562 return 0x30;
563}
564
565/* Large view-index INDEX_ROOT: entries live in the $INDEX_ALLOCATION. Returns 0x38. */
566static
567ULONG
568MkLargeViewRoot(OUT PBYTE Out,
569 IN ULONG CollationRule)
570{
571 RtlZeroMemory(Out, 0x38);
572 WR32(Out, 0x00, 0);
573 WR32(Out, 0x04, CollationRule);
574 WR32(Out, 0x08, INDEX_RECORD_SIZE);
575 Out[0x0C] = (BYTE)LAYOUT.ClustersPerIndexRecord;
576 WR32(Out, 0x10, 0x10);
577 WR32(Out, 0x14, 0x10 + 0x18);
578 WR32(Out, 0x18, 0x10 + 0x18);
579 Out[0x1C] = INDEX_NODE_LARGE;
580 WR16(Out, 0x28, 0x18);
581 WR16(Out, 0x2C, INDEX_ENTRY_END | INDEX_ENTRY_NODE);
582 WR64(Out, 0x30, 0);
583 return 0x38;
584}
585
586/* Resident view-index INDEX_ROOT with N entries (collation order) plus the end
587 * marker. Data follows each key immediately at 0x10 + KeyLen (the key itself is
588 * not padded to 8 bytes; only the whole entry is). Returns the length. */
589static
590ULONG
591MkViewRootN(OUT PBYTE Out,
592 IN ULONG CollationRule,
593 IN const MK_VIEW_ENTRY *Entries,
594 IN ULONG Count)
595{
596 ULONG P;
597 ULONG Index;
598 ULONG IndexLen;
599
600 RtlZeroMemory(Out, 0x20);
601 WR32(Out, 0x00, 0);
602 WR32(Out, 0x04, CollationRule);
603 WR32(Out, 0x08, INDEX_RECORD_SIZE);
604 Out[0x0C] = (BYTE)LAYOUT.ClustersPerIndexRecord;
605 WR32(Out, 0x10, 0x10);
606 Out[0x1C] = 0;
607
608 P = 0x20;
609 for (Index = 0; Index < Count; Index++)
610 {
611 USHORT DataOff = (USHORT)(0x10 + Entries[Index].KeyLen);
612 ULONG EntryLen = ALIGN8((ULONG)DataOff + Entries[Index].DataLen);
613
614 RtlZeroMemory(Out + P, EntryLen);
615 WR16(Out, P + 0x00, DataOff);
616 WR16(Out, P + 0x02, Entries[Index].DataLen);
617 WR16(Out, P + 0x08, EntryLen);
618 WR16(Out, P + 0x0A, Entries[Index].KeyLen);
619 WR16(Out, P + 0x0C, 0);
620 RtlCopyMemory(Out + P + 0x10, Entries[Index].Key, Entries[Index].KeyLen);
621 RtlCopyMemory(Out + P + DataOff, Entries[Index].Data, Entries[Index].DataLen);
622 P += EntryLen;
623 }
624
625 RtlZeroMemory(Out + P, 0x10);
626 WR16(Out, P + 0x08, 0x10);
627 WR16(Out, P + 0x0C, INDEX_ENTRY_END);
628 P += 0x10;
629
630 IndexLen = P - 0x10;
631 WR32(Out, 0x14, IndexLen);
632 WR32(Out, 0x18, IndexLen);
633 return P;
634}
635
636/* NTFS security-descriptor hash: rol32(hash,3) + dword over the descriptor. */
637static
638ULONG
639MkSecHash(IN const BYTE *Sd,
640 IN ULONG Len)
641{
642 ULONG Hash = 0;
643 ULONG I;
644
645 for (I = 0; I + 4 <= Len; I += 4)
646 {
647 ULONG Dword = RD32(Sd, I);
648 Hash = Dword + ((Hash << 3) | (Hash >> 29));
649 }
650 return Hash;
651}
652
653/* Applies the update sequence (fixup) to an INDX block spanning the whole buffer. */
654static
655VOID
656MkIndxFixup(IN OUT PBYTE Blk,
657 IN ULONG BlkSize)
658{
659 USHORT UsaCount = (USHORT)(BlkSize / BYTES_PER_SECTOR + 1);
660 ULONG Sector;
661
662 WR16(Blk, 0x28, USN_VALUE);
663 for (Sector = 0; Sector + 1 < UsaCount; Sector++)
664 {
665 PBYTE Tail = Blk + (Sector + 1) * BYTES_PER_SECTOR - 2;
666
667 WR16(Blk, 0x28 + (Sector + 1) * 2, RD16(Tail, 0));
668 WR16(Tail, 0, USN_VALUE);
669 }
670}
671
672/* One INDX block holding view-index entries (key immediately followed by data). */
673static
674VOID
675MkViewIndxBlock(OUT PBYTE Blk,
676 IN const MK_VIEW_ENTRY *Entries,
677 IN ULONG Count)
678{
679 ULONG P;
680 ULONG Index;
681 USHORT UsaCount = (USHORT)(INDEX_RECORD_SIZE / BYTES_PER_SECTOR + 1);
682
683 RtlZeroMemory(Blk, INDEX_RECORD_SIZE);
684 RtlCopyMemory(Blk + 0x00, "INDX", 4);
685 WR16(Blk, 0x04, 0x28); /* USA offset */
686 WR16(Blk, 0x06, UsaCount);
687 WR64(Blk, 0x10, 0); /* VCN */
688 WR32(Blk, 0x18, 0x28); /* entries offset -> 0x40 */
689 WR32(Blk, 0x20, INDEX_RECORD_SIZE - 0x18);
690 Blk[0x24] = 0; /* leaf */
691
692 P = 0x40;
693 for (Index = 0; Index < Count; Index++)
694 {
695 USHORT DataOff = (USHORT)(0x10 + Entries[Index].KeyLen);
696 ULONG EntryLen = ALIGN8((ULONG)DataOff + Entries[Index].DataLen);
697 ULONG Pad;
698
699 WR16(Blk, P + 0x00, DataOff);
700 WR16(Blk, P + 0x02, Entries[Index].DataLen);
701 WR16(Blk, P + 0x08, EntryLen);
702 WR16(Blk, P + 0x0A, Entries[Index].KeyLen);
703 WR16(Blk, P + 0x0C, 0);
704 RtlCopyMemory(Blk + P + 0x10, Entries[Index].Key, Entries[Index].KeyLen);
705 RtlCopyMemory(Blk + P + DataOff, Entries[Index].Data, Entries[Index].DataLen);
706 /* Slack after each $SDH entry's data holds the UTF-16 unit 0x0049 ('I'),
707 * not zero. */
708 for (Pad = (ULONG)DataOff + Entries[Index].DataLen; Pad + 1 < EntryLen; Pad += 2)
709 WR16(Blk, P + Pad, 0x0049);
710 P += EntryLen;
711 }
712
713 WR16(Blk, P + 0x08, 0x10);
714 WR16(Blk, P + 0x0C, INDEX_ENTRY_END);
715 P += 0x10;
716 WR32(Blk, 0x1C, P - 0x18); /* index length */
717
718 MkIndxFixup(Blk, INDEX_RECORD_SIZE);
719}
720
721/* One INDX block for the root $I30 index: a filename entry per record in Order
722 * (collation order), fixup applied. */
723static
724VOID
725MkRootIndxBlock(OUT PBYTE Blk,
726 IN const BYTE *Mft,
727 IN const ULONG *Order,
728 IN ULONG Count)
729{
730 ULONG P;
731 ULONG Index;
732 USHORT UsaCount = (USHORT)(INDEX_RECORD_SIZE / BYTES_PER_SECTOR + 1);
733
734 RtlZeroMemory(Blk, INDEX_RECORD_SIZE);
735 RtlCopyMemory(Blk + 0x00, "INDX", 4);
736 WR16(Blk, 0x04, 0x28);
737 WR16(Blk, 0x06, UsaCount);
738 WR64(Blk, 0x08, 0);
739 WR64(Blk, 0x10, 0); /* VCN of this INDX */
740 WR32(Blk, 0x18, 0x28); /* entries offset -> 0x40 */
741 WR32(Blk, 0x20, INDEX_RECORD_SIZE - 0x18);
742 Blk[0x24] = 0; /* leaf */
743
744 P = 0x40;
745 for (Index = 0; Index < Count; Index++)
746 {
747 const BYTE *RecBuf = Mft + (ULONG_PTR)Order[Index] * MFT_RECORD_SIZE;
748 BYTE Fn[256];
749 USHORT FnLen = MkExtractFileName(RecBuf, Fn);
750 ULONG EntryLen = ALIGN8(0x10u + FnLen);
751
752 WR64(Blk, P + 0x00, MFT_REFERENCE(Order[Index]));
753 WR16(Blk, P + 0x08, EntryLen);
754 WR16(Blk, P + 0x0A, FnLen);
755 WR16(Blk, P + 0x0C, 0);
756 WR16(Blk, P + 0x0E, 0);
757 RtlCopyMemory(Blk + P + 0x10, Fn, FnLen);
758 P += EntryLen;
759 }
760
761 WR16(Blk, P + 0x08, 0x10);
762 WR16(Blk, P + 0x0C, INDEX_ENTRY_END);
763 P += 0x10;
764 WR32(Blk, 0x1C, P - 0x18); /* index length */
765
766 MkIndxFixup(Blk, INDEX_RECORD_SIZE);
767}
768
769
770/* DISK WRITE HELPERS ********************************************************/
771
772static
773NTSTATUS
774WriteAt(IN ULONGLONG Lcn,
775 IN PVOID Buffer,
776 IN ULONG Length)
777{
778 LARGE_INTEGER Offset;
779 IO_STATUS_BLOCK IoStatusBlock;
780
781 Offset.QuadPart = (LONGLONG)Lcn * BYTES_PER_CLUSTER;
782 return NtWriteFile(DISK_HANDLE, NULL, NULL, NULL, &IoStatusBlock,
783 Buffer, Length, &Offset, NULL);
784}
785
786/* Fills a contiguous run of clusters with a byte pattern in bounded chunks. */
787static
788NTSTATUS
789WritePatternToClusters(IN ULONGLONG Address,
790 IN ULONG ClustersCount,
791 IN BYTE Pattern)
792{
793 PBYTE Buffer;
794 ULONG ChunkClusters;
795 ULONG ChunkBytes;
796 ULONG Remaining;
797 ULONGLONG Lcn;
798 NTSTATUS Status = STATUS_SUCCESS;
799
800 if (ClustersCount == 0)
801 return STATUS_SUCCESS;
802
803 ChunkClusters = (1024 * 1024) / BYTES_PER_CLUSTER;
804 if (ChunkClusters == 0)
805 ChunkClusters = 1;
806 if (ChunkClusters > ClustersCount)
807 ChunkClusters = ClustersCount;
808 ChunkBytes = ChunkClusters * BYTES_PER_CLUSTER;
809
810 Buffer = RtlAllocateHeap(RtlGetProcessHeap(), 0, ChunkBytes);
811 if (!Buffer)
812 return STATUS_INSUFFICIENT_RESOURCES;
813
814 RtlFillMemory(Buffer, ChunkBytes, Pattern);
815
816 Lcn = Address;
817 Remaining = ClustersCount;
818 while (Remaining > 0)
819 {
820 ULONG ThisClusters = (Remaining < ChunkClusters) ? Remaining : ChunkClusters;
821
822 Status = WriteAt(Lcn, Buffer, ThisClusters * BYTES_PER_CLUSTER);
823 if (!NT_SUCCESS(Status))
824 break;
825
826 Lcn += ThisClusters;
827 Remaining -= ThisClusters;
828 }
829
830 FREE(Buffer);
831 return Status;
832}
833
834static
835NTSTATUS
836WriteZerosToClusters(IN ULONGLONG Address,
837 IN ULONG ClustersCount)
838{
839 return WritePatternToClusters(Address, ClustersCount, 0x00);
840}
841
842/* Writes Content (zero-padded) into a cluster-aligned region. */
843static
844NTSTATUS
845WriteRegion(IN ULONGLONG Lcn,
846 IN ULONG Clusters,
847 IN const VOID *Content,
848 IN ULONG ContentLen)
849{
850 ULONG Size = Clusters * BYTES_PER_CLUSTER;
851 PBYTE Buffer;
852 NTSTATUS Status;
853
854 Buffer = RtlAllocateHeap(RtlGetProcessHeap(), 0, Size);
855 if (!Buffer)
856 return STATUS_INSUFFICIENT_RESOURCES;
857
858 RtlZeroMemory(Buffer, Size);
859 if (Content && ContentLen)
860 RtlCopyMemory(Buffer, Content, ContentLen);
861
862 Status = WriteAt(Lcn, Buffer, Size);
863
864 FREE(Buffer);
865 return Status;
866}
867
868
869/* THE METADATA BUILDER *****************************************************/
870
871NTSTATUS
872WriteMetafiles(VOID)
873{
874 NTSTATUS Status;
875 PBYTE Mft;
876 PBYTE Val;
877 ULONG C = BYTES_PER_CLUSTER;
878 ULONGLONG Now = FORMAT_TIME;
879 ULONGLONG ClusterCount = LAYOUT.ClusterCount;
880
881 /* --- $Secure descriptor precompute (blob/$SDS offsets + hashes) ------ */
882 ULONG SdBlobOff[NTFS_DEFAULT_SD_COUNT];
883 ULONG SdSdsOff[NTFS_DEFAULT_SD_COUNT];
884 ULONG SdHash[NTFS_DEFAULT_SD_COUNT];
885 ULONG SdsContentLen;
886
887 /* $SDH hash-sorted order of the 8 default descriptors (index i = id 0x100+i). */
888 static const BYTE SdhOrder[NTFS_DEFAULT_SD_COUNT] = { 4, 6, 2, 3, 7, 5, 0, 1 };
889
890 ULONG Blob = 0;
891 ULONG Sds = 0;
892 ULONG i;
893
894 for (i = 0; i < NTFS_DEFAULT_SD_COUNT; i++)
895 {
896 SdBlobOff[i] = Blob;
897 SdSdsOff[i] = Sds;
898 SdHash[i] = MkSecHash(DefaultSds + Blob, DefaultSdLen[i]);
899 Blob += DefaultSdLen[i];
900 Sds = ALIGN_UP_BY(Sds + 0x14 + DefaultSdLen[i], 16);
901 }
902 SdsContentLen = SdSdsOff[NTFS_DEFAULT_SD_COUNT - 1] + 0x14 +
903 DefaultSdLen[NTFS_DEFAULT_SD_COUNT - 1];
904
905 /* --- Build the MFT in memory (records 0..35) ------------------------ */
906 Mft = RtlAllocateHeap(RtlGetProcessHeap(), 0, MREC_COUNT * MFT_RECORD_SIZE);
907 if (!Mft)
908 {
909 DPRINT1("ERROR: Unable to allocate MFT build buffer!\n");
910 return STATUS_INSUFFICIENT_RESOURCES;
911 }
912 RtlZeroMemory(Mft, MREC_COUNT * MFT_RECORD_SIZE);
913
914 Val = RtlAllocateHeap(RtlGetProcessHeap(), 0, 2048);
915 if (!Val)
916 {
917 DPRINT1("ERROR: Unable to allocate attribute scratch buffer!\n");
918 FREE(Mft);
919 return STATUS_INSUFFICIENT_RESOURCES;
920 }
921
922 {
923 MK_REC Rec;
924 ULONG Len;
925 MK_RUN Runs[1];
926
927 #define REC_BUF(n) (Mft + (ULONG_PTR)(n) * MFT_RECORD_SIZE)
928
929 /* Record 0: $MFT (large, contiguous $DATA run). */
930 MkInit(&Rec, REC_BUF(MREC_MFT), MREC_MFT, MFT_RECORD_IN_USE);
931 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
932 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
933 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
934 (ULONGLONG)LAYOUT.MftClusters * C,
935 (ULONGLONG)LAYOUT.MftAllocRecords * MFT_RECORD_SIZE,
936 Now, L"$MFT", FILE_NAME_WIN32_AND_DOS);
937 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
938 Runs[0].Lcn = LAYOUT.MftLcn; Runs[0].Len = LAYOUT.MftClusters;
939 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.MftClusters - 1,
940 (ULONGLONG)LAYOUT.MftClusters * C,
941 (ULONGLONG)LAYOUT.MftAllocRecords * MFT_RECORD_SIZE,
942 (ULONGLONG)LAYOUT.MftAllocRecords * MFT_RECORD_SIZE);
943 /* $BITMAP (non-resident): one bit per reserved MFT record. */
944 {
945 ULONGLONG MftBmpBytes = ((ULONGLONG)LAYOUT.MftAllocRecords + 7) / 8;
946 Runs[0].Lcn = LAYOUT.MftBitmapLcn; Runs[0].Len = LAYOUT.MftBitmapClusters;
947 MkAddNonResident(&Rec, AttributeBitmap, NULL, 0, 0, Runs, 1, LAYOUT.MftBitmapClusters - 1,
948 (ULONGLONG)LAYOUT.MftBitmapClusters * C, MftBmpBytes, MftBmpBytes);
949 }
950 MkFinalize(&Rec);
951
952 /* Record 1: $MFTMirr. */
953 MkInit(&Rec, REC_BUF(MREC_MFTMIRR), MREC_MFTMIRR, MFT_RECORD_IN_USE);
954 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
955 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
956 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
957 (ULONGLONG)LAYOUT.MftMirrClusters * C, (ULONGLONG)MFT_MIRR_COUNT * MFT_RECORD_SIZE,
958 Now, L"$MFTMirr", FILE_NAME_WIN32_AND_DOS);
959 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
960 Runs[0].Lcn = LAYOUT.MftMirrLcn; Runs[0].Len = LAYOUT.MftMirrClusters;
961 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.MftMirrClusters - 1,
962 (ULONGLONG)LAYOUT.MftMirrClusters * C,
963 (ULONGLONG)MFT_MIRR_COUNT * MFT_RECORD_SIZE,
964 (ULONGLONG)MFT_MIRR_COUNT * MFT_RECORD_SIZE);
965 MkFinalize(&Rec);
966
967 /* Record 2: $LogFile. */
968 MkInit(&Rec, REC_BUF(MREC_LOGFILE), MREC_LOGFILE, MFT_RECORD_IN_USE);
969 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
970 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
971 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
972 (ULONGLONG)LAYOUT.LogFileClusters * C, (ULONGLONG)LAYOUT.LogFileClusters * C,
973 Now, L"$LogFile", FILE_NAME_WIN32_AND_DOS);
974 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
975 Runs[0].Lcn = LAYOUT.LogFileLcn; Runs[0].Len = LAYOUT.LogFileClusters;
976 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.LogFileClusters - 1,
977 (ULONGLONG)LAYOUT.LogFileClusters * C, (ULONGLONG)LAYOUT.LogFileClusters * C,
978 (ULONGLONG)LAYOUT.LogFileClusters * C);
979 MkFinalize(&Rec);
980
981 /* Record 3: $Volume. */
982 MkInit(&Rec, REC_BUF(MREC_VOLUME), MREC_VOLUME, MFT_RECORD_IN_USE);
983 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x101);
984 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
985 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
986 0, 0, Now, L"$Volume", FILE_NAME_WIN32_AND_DOS);
987 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
988 {
989 BYTE VName[128];
990 ULONG VLen = 0;
991 if (LABEL && LABEL->Buffer && LABEL->Length > 0)
992 {
993 VLen = LABEL->Length;
994 if (VLen > 128)
995 VLen = 128;
996 RtlCopyMemory(VName, LABEL->Buffer, VLen);
997 }
998 MkAddResident(&Rec, AttributeVolumeName, NULL, 0, 0, VName, VLen);
999 }
1000 /* $VOLUME_INFORMATION: version 3.1, flags 0 (the 0x80 dirty bit left clear). */
1001 RtlZeroMemory(Val, 12);
1002 Val[0x08] = NTFS_MAJOR_VERSION;
1003 Val[0x09] = NTFS_MINOR_VERSION;
1004 MkAddResident(&Rec, AttributeVolumeInformation, NULL, 0, 0, Val, 12);
1005 MkAddResident(&Rec, AttributeData, NULL, 0, 0, NULL, 0); /* empty $DATA */
1006 MkFinalize(&Rec);
1007
1008 /* Record 4: $AttrDef. */
1009 MkInit(&Rec, REC_BUF(MREC_ATTRDEF), MREC_ATTRDEF, MFT_RECORD_IN_USE);
1010 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
1011 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1012 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
1013 (ULONGLONG)LAYOUT.AttrDefClusters * C,
1014 sizeof(ATTRIBUTES_TABLE) - sizeof(ATTRIBUTES_TABLE[0]),
1015 Now, L"$AttrDef", FILE_NAME_WIN32_AND_DOS);
1016 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1017 Runs[0].Lcn = LAYOUT.AttrDefLcn; Runs[0].Len = LAYOUT.AttrDefClusters;
1018 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.AttrDefClusters - 1,
1019 (ULONGLONG)LAYOUT.AttrDefClusters * C,
1020 sizeof(ATTRIBUTES_TABLE), sizeof(ATTRIBUTES_TABLE));
1021 MkFinalize(&Rec);
1022
1023 /* Record 6: $Bitmap. The stream length must be a multiple of 8 bytes
1024 * (NTFS tracks the cluster bitmap in 64-bit groups); an unaligned length
1025 * gets rounded up and zero-filled by the OS, freeing phantom clusters. */
1026 {
1027 ULONGLONG BitmapBytes = (((ClusterCount + 7) / 8) + 7) & ~7ULL;
1028 MkInit(&Rec, REC_BUF(MREC_BITMAP), MREC_BITMAP, MFT_RECORD_IN_USE);
1029 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
1030 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1031 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
1032 (ULONGLONG)LAYOUT.BitmapClusters * C, BitmapBytes,
1033 Now, L"$Bitmap", FILE_NAME_WIN32_AND_DOS);
1034 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1035 Runs[0].Lcn = LAYOUT.BitmapLcn; Runs[0].Len = LAYOUT.BitmapClusters;
1036 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.BitmapClusters - 1,
1037 (ULONGLONG)LAYOUT.BitmapClusters * C, BitmapBytes, BitmapBytes);
1038 MkFinalize(&Rec);
1039 }
1040
1041 /* Record 7: $Boot (short STD_INFO + embedded default descriptor 0x100). */
1042 MkInit(&Rec, REC_BUF(MREC_BOOT), MREC_BOOT, MFT_RECORD_IN_USE);
1043 MkStdInfoShort(Val, FA_HIDDEN | FA_SYSTEM, Now);
1044 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 48);
1045 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
1046 (ULONGLONG)LAYOUT.BootClusters * C, 0x2000,
1047 Now, L"$Boot", FILE_NAME_WIN32_AND_DOS);
1048 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1049 MkAddResident(&Rec, AttributeSecurityDescriptor, NULL, 0, 0,
1050 DefaultSds + SdBlobOff[0], DefaultSdLen[0]);
1051 Runs[0].Lcn = LAYOUT.BootLcn; Runs[0].Len = LAYOUT.BootClusters;
1052 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.BootClusters - 1,
1053 (ULONGLONG)LAYOUT.BootClusters * C, 0x2000, 0x2000);
1054 MkFinalize(&Rec);
1055
1056 /* Record 8: $BadClus (empty $DATA + sparse whole-volume $Bad hole). */
1057 MkInit(&Rec, REC_BUF(MREC_BADCLUS), MREC_BADCLUS, MFT_RECORD_IN_USE);
1058 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
1059 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1060 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
1061 0, 0, Now, L"$BadClus", FILE_NAME_WIN32_AND_DOS);
1062 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1063 MkAddResident(&Rec, AttributeData, NULL, 0, 0, NULL, 0);
1064 /* $Bad is a plain (non-sparse) non-resident attribute whose single
1065 * mapping-pair is a hole; alloc/real = whole volume, init = 0. */
1066 Runs[0].Lcn = HOLE_LCN; Runs[0].Len = ClusterCount;
1067 MkAddNonResident(&Rec, AttributeData, L"$Bad", 4, 0, Runs, 1, ClusterCount - 1,
1068 ClusterCount * C, ClusterCount * C, 0);
1069 MkFinalize(&Rec);
1070
1071 /* Record 9: $Secure ($SDS + large $SDH + resident $SII). */
1072 {
1073 BYTE SdsHdr[NTFS_DEFAULT_SD_COUNT][0x14];
1074 BYTE SiiKeys[NTFS_DEFAULT_SD_COUNT][4];
1075 BYTE SdhKeys[NTFS_DEFAULT_SD_COUNT][8];
1076 MK_VIEW_ENTRY SiiEnt[NTFS_DEFAULT_SD_COUNT];
1077 BYTE ViewRoot[512];
1078
1079 for (i = 0; i < NTFS_DEFAULT_SD_COUNT; i++)
1080 {
1081 ULONG Id = 0x100 + i;
1082 WR32(SdsHdr[i], 0x00, SdHash[i]);
1083 WR32(SdsHdr[i], 0x04, Id);
1084 WR64(SdsHdr[i], 0x08, SdSdsOff[i]);
1085 WR32(SdsHdr[i], 0x10, 0x14 + DefaultSdLen[i]);
1086 WR32(SiiKeys[i], 0, Id);
1087 WR32(SdhKeys[i], 0, SdHash[i]);
1088 WR32(SdhKeys[i], 4, Id);
1089 SiiEnt[i].Key = SiiKeys[i]; SiiEnt[i].KeyLen = 4;
1090 SiiEnt[i].Data = SdsHdr[i]; SiiEnt[i].DataLen = 0x14;
1091 }
1092
1093 MkInit(&Rec, REC_BUF(MREC_SECURE), MREC_SECURE, MFT_RECORD_IN_USE | MFT_RECORD_VIEW_INDEX);
1094 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM | FA_VIEW, Now, 0x101);
1095 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1096 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM | FA_VIEW,
1097 0, 0, Now, L"$Secure", FILE_NAME_WIN32_AND_DOS);
1098 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1099 /* $DATA:$SDS (non-resident: 8 descriptors + a 256 KiB-offset mirror). */
1100 Runs[0].Lcn = LAYOUT.SdsLcn; Runs[0].Len = LAYOUT.SdsClusters;
1101 MkAddNonResident(&Rec, AttributeData, L"$SDS", 4, 0, Runs, 1, LAYOUT.SdsClusters - 1,
1102 (ULONGLONG)LAYOUT.SdsClusters * C,
1103 (ULONGLONG)NTFS_SDS_MIRROR + SdsContentLen,
1104 (ULONGLONG)NTFS_SDS_MIRROR + SdsContentLen);
1105 /* Attribute order (type, name): $SDH root, $SII root, then $SDH alloc, $SDH bitmap. */
1106 Len = MkLargeViewRoot(ViewRoot, COLLATION_NTOFS_SECURITY_HASH);
1107 MkAddResident(&Rec, AttributeIndexRoot, L"$SDH", 4, 0, ViewRoot, Len);
1108 Len = MkViewRootN(ViewRoot, COLLATION_NTOFS_ULONG, SiiEnt, NTFS_DEFAULT_SD_COUNT);
1109 MkAddResident(&Rec, AttributeIndexRoot, L"$SII", 4, 0, ViewRoot, Len);
1110 Runs[0].Lcn = LAYOUT.SdhIdxLcn; Runs[0].Len = LAYOUT.SdhIdxClusters;
1111 MkAddNonResident(&Rec, AttributeIndexAllocation, L"$SDH", 4, 0, Runs, 1,
1112 LAYOUT.SdhIdxClusters - 1, (ULONGLONG)LAYOUT.SdhIdxClusters * C,
1113 INDEX_RECORD_SIZE, INDEX_RECORD_SIZE);
1114 RtlZeroMemory(Val, 8);
1115 Val[0] = 0x01;
1116 MkAddResident(&Rec, AttributeBitmap, L"$SDH", 4, 0, Val, 8);
1117 MkFinalize(&Rec);
1118 }
1119
1120 /* Record 10: $UpCase (+ $Info CRC stream). */
1121 MkInit(&Rec, REC_BUF(MREC_UPCASE), MREC_UPCASE, MFT_RECORD_IN_USE);
1122 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, NTFS_SECURITY_ID);
1123 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1124 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM,
1125 sizeof(UPCASE_TABLE), sizeof(UPCASE_TABLE),
1126 Now, L"$UpCase", FILE_NAME_WIN32_AND_DOS);
1127 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1128 Runs[0].Lcn = LAYOUT.UpCaseLcn; Runs[0].Len = LAYOUT.UpCaseClusters;
1129 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.UpCaseClusters - 1,
1130 (ULONGLONG)LAYOUT.UpCaseClusters * C, sizeof(UPCASE_TABLE), sizeof(UPCASE_TABLE));
1131 MkAddResident(&Rec, AttributeData, L"$Info", 5, 0, UpCaseInfo, sizeof(UpCaseInfo));
1132 MkFinalize(&Rec);
1133
1134 /* ---- $Extend children (build children before their index parents) --- */
1135
1136 /* Record 24: $Quota (default quota entries). */
1137 {
1138 BYTE Qce[64];
1139 BYTE QKey1[4];
1140 BYTE QKey256[4];
1141 BYTE OData[4];
1142 BYTE QIdx[256];
1143 BYTE OIdx[128];
1144 MK_VIEW_ENTRY QEnt[2];
1145 MK_VIEW_ENTRY OEnt[1];
1146
1147 RtlZeroMemory(Qce, sizeof(Qce));
1148 WR32(Qce, 0x00, 2); /* version */
1149 WR32(Qce, 0x04, 1); /* flags */
1150 WR64(Qce, 0x08, 0); /* bytes used */
1151 WR64(Qce, 0x10, Now); /* change time */
1152 WR64(Qce, 0x18, 0xFFFFFFFFFFFFFFFFULL); /* threshold */
1153 WR64(Qce, 0x20, 0xFFFFFFFFFFFFFFFFULL); /* limit */
1154 WR64(Qce, 0x28, 0); /* exceeded time */
1155 RtlCopyMemory(Qce + 48, SidAdmins, 16); /* id 0x100 carries the SID */
1156
1157 WR32(QKey1, 0, 1);
1158 WR32(QKey256, 0, 0x100);
1159 WR32(OData, 0, 0x100);
1160
1161 QEnt[0].Key = QKey1; QEnt[0].KeyLen = 4; QEnt[0].Data = Qce; QEnt[0].DataLen = 48;
1162 QEnt[1].Key = QKey256; QEnt[1].KeyLen = 4; QEnt[1].Data = Qce; QEnt[1].DataLen = 64;
1163 OEnt[0].Key = SidAdmins; OEnt[0].KeyLen = 16; OEnt[0].Data = OData; OEnt[0].DataLen = 4;
1164
1165 MkInit(&Rec, REC_BUF(MREC_QUOTA), MREC_QUOTA,
1166 MFT_RECORD_IN_USE | MFT_RECORD_UNKNOWN1 | MFT_RECORD_VIEW_INDEX);
1167 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM | FA_VIEW, Now, 0x101);
1168 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1169 Len = MkFileName(Val, MFT_REFERENCE(MREC_EXTEND), FA_HIDDEN | FA_SYSTEM | FA_VIEW,
1170 0, 0, Now, L"$Quota", FILE_NAME_POSIX);
1171 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1172 Len = MkViewRootN(OIdx, COLL_SID, OEnt, 1);
1173 MkAddResident(&Rec, AttributeIndexRoot, L"$O", 2, 0, OIdx, Len);
1174 Len = MkViewRootN(QIdx, COLLATION_NTOFS_ULONG, QEnt, 2);
1175 MkAddResident(&Rec, AttributeIndexRoot, L"$Q", 2, 0, QIdx, Len);
1176 MkFinalize(&Rec);
1177 }
1178
1179 /* Record 25: $ObjId (empty $O). */
1180 MkInit(&Rec, REC_BUF(MREC_OBJID), MREC_OBJID,
1181 MFT_RECORD_IN_USE | MFT_RECORD_UNKNOWN1 | MFT_RECORD_VIEW_INDEX);
1182 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM | FA_VIEW, Now, 0x101);
1183 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1184 Len = MkFileName(Val, MFT_REFERENCE(MREC_EXTEND), FA_HIDDEN | FA_SYSTEM | FA_VIEW,
1185 0, 0, Now, L"$ObjId", FILE_NAME_POSIX);
1186 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1187 Len = MkEmptyViewRoot(Val, COLL_ULONGS);
1188 MkAddResident(&Rec, AttributeIndexRoot, L"$O", 2, 0, Val, Len);
1189 MkFinalize(&Rec);
1190
1191 /* Record 26: $Reparse (empty $R). */
1192 MkInit(&Rec, REC_BUF(MREC_REPARSE), MREC_REPARSE,
1193 MFT_RECORD_IN_USE | MFT_RECORD_UNKNOWN1 | MFT_RECORD_VIEW_INDEX);
1194 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM | FA_VIEW, Now, 0x101);
1195 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1196 Len = MkFileName(Val, MFT_REFERENCE(MREC_EXTEND), FA_HIDDEN | FA_SYSTEM | FA_VIEW,
1197 0, 0, Now, L"$Reparse", FILE_NAME_POSIX);
1198 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1199 Len = MkEmptyViewRoot(Val, COLL_ULONGS);
1200 MkAddResident(&Rec, AttributeIndexRoot, L"$R", 2, 0, Val, Len);
1201 MkFinalize(&Rec);
1202
1203 /* Records 12..15: reserved stubs - in use, 0 hard links, short STD_INFO,
1204 * embedded default descriptor 0x101, empty resident unnamed $DATA. */
1205 for (i = 12; i <= 15; i++)
1206 {
1207 MkInit(&Rec, REC_BUF(i), i, MFT_RECORD_IN_USE);
1208 MkSetHardLinks(&Rec, 0);
1209 MkStdInfoShort(Val, FA_HIDDEN | FA_SYSTEM, Now);
1210 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 48);
1211 MkAddResident(&Rec, AttributeSecurityDescriptor, NULL, 0, 0,
1212 DefaultSds + SdBlobOff[1], DefaultSdLen[1]);
1213 MkAddResident(&Rec, AttributeData, NULL, 0, 0, NULL, 0);
1214 MkFinalize(&Rec);
1215 }
1216
1217 /* ---- $Extend/$RmMetadata TxF subtree ------------------------------ */
1218
1219 /* Record 28: $Repair - empty non-resident $DATA + $DATA:$Config. */
1220 MkInit(&Rec, REC_BUF(MREC_REPAIR), MREC_REPAIR, MFT_RECORD_IN_USE | MFT_RECORD_UNKNOWN1);
1221 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x101);
1222 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1223 Len = MkFileName(Val, MFT_REFERENCE(MREC_RMMETA), FA_HIDDEN | FA_SYSTEM,
1224 0, 0, Now, L"$Repair", FILE_NAME_POSIX);
1225 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1226 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, NULL, 0, (ULONGLONG)-1, 0, 0, 0);
1227 MkAddResident(&Rec, AttributeData, L"$Config", 7, 0, RepairCfg, sizeof(RepairCfg));
1228 MkFinalize(&Rec);
1229
1230 /* Record 29: $Deleted - empty dir with a pre-allocated (unused) 64 KiB index. */
1231 MkInit(&Rec, REC_BUF(MREC_DELETED), MREC_DELETED,
1232 MFT_RECORD_IN_USE | MFT_RECORD_IS_DIRECTORY | MFT_RECORD_UNKNOWN1);
1233 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x101);
1234 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1235 Len = MkFileName(Val, MFT_REFERENCE(MREC_EXTEND), FA_HIDDEN | FA_SYSTEM | FA_DIR,
1236 0, 0, Now, L"$Deleted", FILE_NAME_POSIX);
1237 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1238 Len = MkEmptyI30Root(Val);
1239 MkAddResident(&Rec, AttributeIndexRoot, L"$I30", 4, 0, Val, Len);
1240 Runs[0].Lcn = LAYOUT.DeletedIdxLcn; Runs[0].Len = LAYOUT.DeletedIdxClusters;
1241 MkAddNonResident(&Rec, AttributeIndexAllocation, L"$I30", 4, 0, Runs, 1,
1242 LAYOUT.DeletedIdxClusters - 1, (ULONGLONG)LAYOUT.DeletedIdxClusters * C, 0, 0);
1243 RtlZeroMemory(Val, 8);
1244 MkAddResident(&Rec, AttributeBitmap, L"$I30", 4, 0, Val, 8);
1245 MkFinalize(&Rec);
1246
1247 /* Record 31: $Txf - empty dir + $TXF_DATA. */
1248 MkInit(&Rec, REC_BUF(MREC_TXF), MREC_TXF, MFT_RECORD_IN_USE | MFT_RECORD_IS_DIRECTORY);
1249 MkStdInfo(Val, 0x80000006, Now, 0x102);
1250 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1251 Len = MkFileName(Val, MFT_REFERENCE(MREC_RMMETA), FA_HIDDEN | FA_SYSTEM | FA_DIR,
1252 0, 0, Now, L"$Txf", FILE_NAME_POSIX);
1253 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1254 Len = MkEmptyI30Root(Val);
1255 MkAddResident(&Rec, AttributeIndexRoot, L"$I30", 4, 0, Val, Len);
1256 MkAddResident(&Rec, AttributeLoggedUtilityStream, L"$TXF_DATA", 9, 0, TxfInfo, sizeof(TxfInfo));
1257 MkFinalize(&Rec);
1258
1259 /* Record 32: $Tops - resident $DATA + $DATA:$T (1 MiB). */
1260 MkInit(&Rec, REC_BUF(MREC_TOPS), MREC_TOPS, MFT_RECORD_IN_USE);
1261 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x102);
1262 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1263 Len = MkFileName(Val, MFT_REFERENCE(MREC_TXFLOG), FA_HIDDEN | FA_SYSTEM,
1264 0, 0, Now, L"$Tops", FILE_NAME_POSIX);
1265 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1266 MkAddResident(&Rec, AttributeData, NULL, 0, 0, TopsData, sizeof(TopsData));
1267 Runs[0].Lcn = LAYOUT.TopsTLcn; Runs[0].Len = LAYOUT.TopsTClusters;
1268 MkAddNonResident(&Rec, AttributeData, L"$T", 2, 0, Runs, 1, LAYOUT.TopsTClusters - 1,
1269 (ULONGLONG)LAYOUT.TopsTClusters * C,
1270 (ULONGLONG)LAYOUT.TopsTClusters * C, (ULONGLONG)LAYOUT.TopsTClusters * C);
1271 MkFinalize(&Rec);
1272
1273 /* Record 33: $TxfLog.blf (64 KiB). */
1274 MkInit(&Rec, REC_BUF(MREC_TXFBLF), MREC_TXFBLF, MFT_RECORD_IN_USE);
1275 MkStdInfo(Val, FA_ARCHIVE, Now, 0x103);
1276 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1277 Len = MkFileName(Val, MFT_REFERENCE(MREC_TXFLOG), FA_ARCHIVE,
1278 (ULONGLONG)LAYOUT.BlfClusters * C, 0, Now, L"$TxfLog.blf", FILE_NAME_POSIX);
1279 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1280 Runs[0].Lcn = LAYOUT.BlfLcn; Runs[0].Len = LAYOUT.BlfClusters;
1281 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.BlfClusters - 1,
1282 (ULONGLONG)LAYOUT.BlfClusters * C,
1283 (ULONGLONG)LAYOUT.BlfClusters * C, (ULONGLONG)LAYOUT.BlfClusters * C);
1284 MkFinalize(&Rec);
1285
1286 /* Records 34/35: $TxfLogContainer...0001 / ...0002 (2 MiB each). */
1287 MkInit(&Rec, REC_BUF(MREC_CONT1), MREC_CONT1, MFT_RECORD_IN_USE);
1288 MkStdInfo(Val, FA_ARCHIVE, Now, 0x104);
1289 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1290 Len = MkFileName(Val, MFT_REFERENCE(MREC_TXFLOG), FA_ARCHIVE,
1291 (ULONGLONG)LAYOUT.Cont1Clusters * C, 0, Now,
1292 L"$TxfLogContainer00000000000000000001", FILE_NAME_POSIX);
1293 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1294 Runs[0].Lcn = LAYOUT.Cont1Lcn; Runs[0].Len = LAYOUT.Cont1Clusters;
1295 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.Cont1Clusters - 1,
1296 (ULONGLONG)LAYOUT.Cont1Clusters * C,
1297 (ULONGLONG)LAYOUT.Cont1Clusters * C, (ULONGLONG)LAYOUT.Cont1Clusters * C);
1298 MkFinalize(&Rec);
1299
1300 MkInit(&Rec, REC_BUF(MREC_CONT2), MREC_CONT2, MFT_RECORD_IN_USE);
1301 MkStdInfo(Val, FA_ARCHIVE, Now, 0x104);
1302 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1303 Len = MkFileName(Val, MFT_REFERENCE(MREC_TXFLOG), FA_ARCHIVE,
1304 (ULONGLONG)LAYOUT.Cont2Clusters * C, 0, Now,
1305 L"$TxfLogContainer00000000000000000002", FILE_NAME_POSIX);
1306 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1307 Runs[0].Lcn = LAYOUT.Cont2Lcn; Runs[0].Len = LAYOUT.Cont2Clusters;
1308 MkAddNonResident(&Rec, AttributeData, NULL, 0, 0, Runs, 1, LAYOUT.Cont2Clusters - 1,
1309 (ULONGLONG)LAYOUT.Cont2Clusters * C,
1310 (ULONGLONG)LAYOUT.Cont2Clusters * C, (ULONGLONG)LAYOUT.Cont2Clusters * C);
1311 MkFinalize(&Rec);
1312
1313 /* Record 30: $TxfLog directory, indexing $Tops/$TxfLog.blf/containers. */
1314 {
1315 static const ULONG TxfLogOrder[] = { MREC_TOPS, MREC_TXFBLF, MREC_CONT1, MREC_CONT2 };
1316
1317 MkInit(&Rec, REC_BUF(MREC_TXFLOG), MREC_TXFLOG, MFT_RECORD_IN_USE | MFT_RECORD_IS_DIRECTORY);
1318 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x102);
1319 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1320 Len = MkFileName(Val, MFT_REFERENCE(MREC_RMMETA), FA_HIDDEN | FA_SYSTEM | FA_DIR,
1321 0, 0, Now, L"$TxfLog", FILE_NAME_POSIX);
1322 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1323 Len = MkI30RootWithEntries(Val, Mft, TxfLogOrder, ARR_SIZE(TxfLogOrder));
1324 MkAddResident(&Rec, AttributeIndexRoot, L"$I30", 4, 0, Val, Len);
1325 MkFinalize(&Rec);
1326 }
1327
1328 /* Record 27: $RmMetadata directory, indexing $Repair/$Txf/$TxfLog. */
1329 {
1330 static const ULONG RmOrder[] = { MREC_REPAIR, MREC_TXF, MREC_TXFLOG };
1331
1332 MkInit(&Rec, REC_BUF(MREC_RMMETA), MREC_RMMETA, MFT_RECORD_IN_USE | MFT_RECORD_IS_DIRECTORY);
1333 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x102);
1334 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1335 Len = MkFileName(Val, MFT_REFERENCE(MREC_EXTEND), FA_HIDDEN | FA_SYSTEM | FA_DIR,
1336 0, 0, Now, L"$RmMetadata", FILE_NAME_POSIX);
1337 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1338 Len = MkI30RootWithEntries(Val, Mft, RmOrder, ARR_SIZE(RmOrder));
1339 MkAddResident(&Rec, AttributeIndexRoot, L"$I30", 4, 0, Val, Len);
1340 MkFinalize(&Rec);
1341 }
1342
1343 /* Record 11: $Extend directory, indexing all children (collation order
1344 * $Deleted < $ObjId < $Quota < $Reparse < $RmMetadata). The directory
1345 * bit is set in FILE_NAME but not in STD_INFO. */
1346 {
1347 static const ULONG ExtendOrder[] =
1348 { MREC_DELETED, MREC_OBJID, MREC_QUOTA, MREC_REPARSE, MREC_RMMETA };
1349
1350 MkInit(&Rec, REC_BUF(MREC_EXTEND), MREC_EXTEND, MFT_RECORD_IN_USE | MFT_RECORD_IS_DIRECTORY);
1351 MkStdInfo(Val, FA_HIDDEN | FA_SYSTEM, Now, 0x101);
1352 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 72);
1353 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM | FA_DIR,
1354 0, 0, Now, L"$Extend", FILE_NAME_WIN32_AND_DOS);
1355 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1356 Len = MkI30RootWithEntries(Val, Mft, ExtendOrder, ARR_SIZE(ExtendOrder));
1357 MkAddResident(&Rec, AttributeIndexRoot, L"$I30", 4, 0, Val, Len);
1358 MkFinalize(&Rec);
1359 }
1360
1361 /* Record 5: root "." - large $I30 index + embedded (unique) SD + $TXF_DATA. */
1362 MkInit(&Rec, REC_BUF(MREC_ROOT), MREC_ROOT, MFT_RECORD_IN_USE | MFT_RECORD_IS_DIRECTORY);
1363 MkStdInfoShort(Val, FA_HIDDEN | FA_SYSTEM, Now);
1364 MkAddResident(&Rec, AttributeStandardInformation, NULL, 0, 0, Val, 48);
1365 Len = MkFileName(Val, MFT_REFERENCE(MREC_ROOT), FA_HIDDEN | FA_SYSTEM | FA_DIR,
1366 0, 0, Now, L".", FILE_NAME_WIN32_AND_DOS);
1367 MkAddResident(&Rec, AttributeFileName, NULL, 0, RA_INDEXED, Val, Len);
1368 MkAddResident(&Rec, AttributeSecurityDescriptor, NULL, 0, 0, RootSdValue, sizeof(RootSdValue));
1369 Len = MkLargeI30Root(Val);
1370 MkAddResident(&Rec, AttributeIndexRoot, L"$I30", 4, 0, Val, Len);
1371 Runs[0].Lcn = LAYOUT.RootIdxLcn; Runs[0].Len = LAYOUT.RootIdxClusters;
1372 MkAddNonResident(&Rec, AttributeIndexAllocation, L"$I30", 4, 0, Runs, 1,
1373 LAYOUT.RootIdxClusters - 1, (ULONGLONG)LAYOUT.RootIdxClusters * C,
1374 INDEX_RECORD_SIZE, INDEX_RECORD_SIZE);
1375 RtlZeroMemory(Val, 8);
1376 Val[0] = 0x01; /* INDX VCN 0 allocated */
1377 MkAddResident(&Rec, AttributeBitmap, L"$I30", 4, 0, Val, 8);
1378 MkAddResident(&Rec, AttributeLoggedUtilityStream, L"$TXF_DATA", 9, 0,
1379 TxfDataValue, sizeof(TxfDataValue));
1380 MkFinalize(&Rec);
1381
1382 #undef REC_BUF
1383 }
1384
1385 /* --- Emit everything to disk ---------------------------------------- */
1386
1387 /* Zero the whole reserved $MFT region, then lay the 36 built records over
1388 * the start of it. Records 16..23 and 36+ are left zero (no FILE record). */
1389 Status = WriteZerosToClusters(LAYOUT.MftLcn, LAYOUT.MftClusters);
1390 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: clear $MFT (Status %lx)\n", Status); goto done; }
1391
1392 Status = WriteAt(LAYOUT.MftLcn, Mft, MREC_COUNT * MFT_RECORD_SIZE);
1393 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $MFT (Status %lx)\n", Status); goto done; }
1394
1395 /* $MFTMirr = the first four records. */
1396 Status = WriteRegion(LAYOUT.MftMirrLcn, LAYOUT.MftMirrClusters, Mft, MFT_MIRR_COUNT * MFT_RECORD_SIZE);
1397 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $MFTMirr (Status %lx)\n", Status); goto done; }
1398
1399 /* $LogFile: fill 0xFF (a driver treats an all-0xFF log as uninitialized). */
1400 Status = WritePatternToClusters(LAYOUT.LogFileLcn, LAYOUT.LogFileClusters, 0xFF);
1401 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $LogFile (Status %lx)\n", Status); goto done; }
1402
1403 /* $AttrDef. */
1404 Status = WriteRegion(LAYOUT.AttrDefLcn, LAYOUT.AttrDefClusters, &ATTRIBUTES_TABLE, sizeof(ATTRIBUTES_TABLE));
1405 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $AttrDef (Status %lx)\n", Status); goto done; }
1406
1407 /* $UpCase. */
1408 Status = WriteRegion(LAYOUT.UpCaseLcn, LAYOUT.UpCaseClusters, &UPCASE_TABLE, sizeof(UPCASE_TABLE));
1409 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $UpCase (Status %lx)\n", Status); goto done; }
1410
1411 /* $Secure:$SDS - the 8 descriptors (16-byte aligned) with a duplicate copy
1412 * of the whole set placed 256 KiB further on. */
1413 {
1414 ULONG Size = LAYOUT.SdsClusters * BYTES_PER_CLUSTER;
1415 PBYTE Buf = RtlAllocateHeap(RtlGetProcessHeap(), 0, Size);
1416 if (!Buf) { Status = STATUS_INSUFFICIENT_RESOURCES; goto done; }
1417 RtlZeroMemory(Buf, Size);
1418 for (i = 0; i < NTFS_DEFAULT_SD_COUNT; i++)
1419 {
1420 ULONG EntryLen = 0x14 + DefaultSdLen[i];
1421 PBYTE E = Buf + SdSdsOff[i];
1422 WR32(E, 0x00, SdHash[i]);
1423 WR32(E, 0x04, 0x100 + i);
1424 WR64(E, 0x08, SdSdsOff[i]);
1425 WR32(E, 0x10, EntryLen);
1426 RtlCopyMemory(E + 0x14, DefaultSds + SdBlobOff[i], DefaultSdLen[i]);
1427 /* The copy is identical to the primary, offset field included (it
1428 * keeps pointing at the primary, not at the copy). */
1429 RtlCopyMemory(Buf + NTFS_SDS_MIRROR + SdSdsOff[i], E, EntryLen);
1430 }
1431 Status = WriteAt(LAYOUT.SdsLcn, Buf, Size);
1432 FREE(Buf);
1433 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $SDS (Status %lx)\n", Status); goto done; }
1434 }
1435
1436 /* $Secure:$SDH INDX block (8 entries keyed by {hash,id}, hash order). */
1437 {
1438 BYTE SdsHdr[NTFS_DEFAULT_SD_COUNT][0x14];
1439 BYTE SdhKeys[NTFS_DEFAULT_SD_COUNT][8];
1440 MK_VIEW_ENTRY SdhEnt[NTFS_DEFAULT_SD_COUNT];
1441 PBYTE Indx;
1442
1443 for (i = 0; i < NTFS_DEFAULT_SD_COUNT; i++)
1444 {
1445 ULONG Id = 0x100 + i;
1446 WR32(SdsHdr[i], 0x00, SdHash[i]);
1447 WR32(SdsHdr[i], 0x04, Id);
1448 WR64(SdsHdr[i], 0x08, SdSdsOff[i]);
1449 WR32(SdsHdr[i], 0x10, 0x14 + DefaultSdLen[i]);
1450 WR32(SdhKeys[i], 0, SdHash[i]);
1451 WR32(SdhKeys[i], 4, Id);
1452 }
1453 for (i = 0; i < NTFS_DEFAULT_SD_COUNT; i++)
1454 {
1455 BYTE J = SdhOrder[i];
1456 SdhEnt[i].Key = SdhKeys[J]; SdhEnt[i].KeyLen = 8;
1457 SdhEnt[i].Data = SdsHdr[J]; SdhEnt[i].DataLen = 0x14;
1458 }
1459
1460 Indx = RtlAllocateHeap(RtlGetProcessHeap(), 0, INDEX_RECORD_SIZE);
1461 if (!Indx) { Status = STATUS_INSUFFICIENT_RESOURCES; goto done; }
1462 MkViewIndxBlock(Indx, SdhEnt, NTFS_DEFAULT_SD_COUNT);
1463 Status = WriteRegion(LAYOUT.SdhIdxLcn, LAYOUT.SdhIdxClusters, Indx, INDEX_RECORD_SIZE);
1464 FREE(Indx);
1465 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $SDH (Status %lx)\n", Status); goto done; }
1466 }
1467
1468 /* $MFT:$BITMAP - records 0..15 and 24..35 in use. */
1469 {
1470 ULONG Size = LAYOUT.MftBitmapClusters * BYTES_PER_CLUSTER;
1471 PBYTE Buf = RtlAllocateHeap(RtlGetProcessHeap(), 0, Size);
1472 if (!Buf) { Status = STATUS_INSUFFICIENT_RESOURCES; goto done; }
1473 RtlZeroMemory(Buf, Size);
1474 Buf[0] = 0xFF; Buf[1] = 0xFF; /* records 0..15 */
1475 Buf[3] = 0xFF; Buf[4] = 0x0F; /* records 24..35 */
1476 Status = WriteAt(LAYOUT.MftBitmapLcn, Buf, Size);
1477 FREE(Buf);
1478 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $MFT:$BITMAP (Status %lx)\n", Status); goto done; }
1479 }
1480
1481 /* Cluster $Bitmap: metadata clusters [0, FirstFreeLcn) used, the rest free,
1482 * and the bits past ClusterCount (up to the 8-byte-aligned end) set. */
1483 {
1484 ULONG Size = LAYOUT.BitmapClusters * BYTES_PER_CLUSTER;
1485 ULONGLONG BitmapBytes = (((ClusterCount + 7) / 8) + 7) & ~7ULL;
1486 ULONGLONG BitmapBits = BitmapBytes * 8;
1487 ULONGLONG c;
1488 PBYTE Buf = RtlAllocateHeap(RtlGetProcessHeap(), 0, Size);
1489 if (!Buf) { Status = STATUS_INSUFFICIENT_RESOURCES; goto done; }
1490 RtlZeroMemory(Buf, Size);
1491 for (c = 0; c < LAYOUT.FirstFreeLcn; c++)
1492 Buf[c / 8] |= (1 << (c % 8));
1493 for (c = ClusterCount; c < BitmapBits; c++)
1494 Buf[c / 8] |= (1 << (c % 8));
1495 Status = WriteAt(LAYOUT.BitmapLcn, Buf, Size);
1496 FREE(Buf);
1497 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write $Bitmap (Status %lx)\n", Status); goto done; }
1498 }
1499
1500 /* Root $I30 INDX block: the system files in collation (uppercased-name)
1501 * order. "$" names (0x24) sort before root's own "." (0x2E), which is last. */
1502 {
1503 static const ULONG RootOrder[] =
1504 {
1505 MREC_ATTRDEF, MREC_BADCLUS, MREC_BITMAP, MREC_BOOT, MREC_EXTEND,
1506 MREC_LOGFILE, MREC_MFT, MREC_MFTMIRR, MREC_SECURE, MREC_UPCASE,
1507 MREC_VOLUME, MREC_ROOT
1508 };
1509 PBYTE Indx = RtlAllocateHeap(RtlGetProcessHeap(), 0, INDEX_RECORD_SIZE);
1510 if (!Indx) { Status = STATUS_INSUFFICIENT_RESOURCES; goto done; }
1511 MkRootIndxBlock(Indx, Mft, RootOrder, ARR_SIZE(RootOrder));
1512 Status = WriteRegion(LAYOUT.RootIdxLcn, LAYOUT.RootIdxClusters, Indx, INDEX_RECORD_SIZE);
1513 FREE(Indx);
1514 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: write root index (Status %lx)\n", Status); goto done; }
1515 }
1516
1517 /* Zero the TxF payload streams (CLFS logs are empty on a fresh volume). */
1518 Status = WriteZerosToClusters(LAYOUT.TopsTLcn, LAYOUT.TopsTClusters);
1519 if (NT_SUCCESS(Status)) Status = WriteZerosToClusters(LAYOUT.BlfLcn, LAYOUT.BlfClusters);
1520 if (NT_SUCCESS(Status)) Status = WriteZerosToClusters(LAYOUT.Cont1Lcn, LAYOUT.Cont1Clusters);
1521 if (NT_SUCCESS(Status)) Status = WriteZerosToClusters(LAYOUT.Cont2Lcn, LAYOUT.Cont2Clusters);
1522 if (NT_SUCCESS(Status)) Status = WriteZerosToClusters(LAYOUT.DeletedIdxLcn, LAYOUT.DeletedIdxClusters);
1523 if (!NT_SUCCESS(Status)) { DPRINT1("ERROR: zero TxF payloads (Status %lx)\n", Status); goto done; }
1524
1525done:
1526 FREE(Val);
1527 FREE(Mft);
1528 return Status;
1529}
Id
DWORD Id
Definition: CLayerUIPropPage.cpp:47
ALIGN_UP_BY
#define ALIGN_UP_BY(size, align)
Definition: GetWindowPlacement.c:13
Type
Type
Definition: Type.h:7
BOOLEAN
unsigned char BOOLEAN
Definition: actypes.h:127
FREE
#define FREE(ptr, size)
Definition: auth_des.c:64
NTSTATUS
LONG NTSTATUS
Definition: precomp.h:26
DPRINT1
#define DPRINT1
Definition: precomp.h:8
BYTES_PER_SECTOR
#define BYTES_PER_SECTOR
Definition: volume.c:37
RtlAllocateHeap
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:616
Pad
char * Pad(char *Str, char PadChar, ULONG Length)
Definition: cabman.cxx:29
A
Definition: ehthrow.cxx:93
B
Definition: ehthrow.cxx:54
Buffer
Definition: bufpool.h:45
C
Definition: terminate.cpp:24
UPCASE_TABLE
const BYTE UPCASE_TABLE[]
Definition: data.h:62
ATTRIBUTES_TABLE
const ATTR_DEF ATTRIBUTES_TABLE[]
Definition: data.h:41
Len
#define Len
Definition: deflate.h:82
Pos
ush Pos
Definition: deflate.h:92
Name
LPWSTR Name
Definition: desk.c:124
Out
@ Out
Definition: devicetopology.idl:176
IoStatusBlock
_In_ PIO_STATUS_BLOCK IoStatusBlock
Definition: dispmprt.h:608
Flags
_In_ D3DDDI_VIDEO_PRESENT_TARGET_ID _In_ ULONG _In_ ULONG Flags
Definition: dispmprt.h:245
NULL
#define NULL
Definition: types.h:112
NT_SUCCESS
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:33
P
#define P(row, col)
B
#define B(row, col)
Hash
static int Hash(const char *)
Definition: reader.c:2237
L
#define L(x)
Definition: resources.c:13
COLLATION_FILE_NAME
#define COLLATION_FILE_NAME
Definition: ntfs.h:228
INDEX_NODE_LARGE
#define INDEX_NODE_LARGE
Definition: ntfs.h:239
COLLATION_NTOFS_ULONG
#define COLLATION_NTOFS_ULONG
Definition: ntfs.h:230
AttributeVolumeName
@ AttributeVolumeName
Definition: ntfs.h:193
AttributeEnd
@ AttributeEnd
Definition: ntfs.h:204
AttributeIndexRoot
@ AttributeIndexRoot
Definition: ntfs.h:196
AttributeFileName
@ AttributeFileName
Definition: ntfs.h:190
AttributeStandardInformation
@ AttributeStandardInformation
Definition: ntfs.h:188
AttributeVolumeInformation
@ AttributeVolumeInformation
Definition: ntfs.h:194
AttributeSecurityDescriptor
@ AttributeSecurityDescriptor
Definition: ntfs.h:192
AttributeIndexAllocation
@ AttributeIndexAllocation
Definition: ntfs.h:197
AttributeLoggedUtilityStream
@ AttributeLoggedUtilityStream
Definition: ntfs.h:203
AttributeData
@ AttributeData
Definition: ntfs.h:195
AttributeBitmap
@ AttributeBitmap
Definition: ntfs.h:198
COLLATION_NTOFS_SECURITY_HASH
#define COLLATION_NTOFS_SECURITY_HASH
Definition: ntfs.h:232
RA_INDEXED
#define RA_INDEXED
Definition: ntfs.h:266
ULONG_PTR
#define ULONG_PTR
Definition: config.h:101
FileAttributes
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG FileAttributes
Definition: fltkernel.h:1236
Status
Status
Definition: gdiplustypes.h:24
c
const GLubyte * c
Definition: glext.h:8905
i
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
I
#define I(s)
V
#define V(i, a, b, c, d)
Definition: jaricom.c:29
Fn
BOOLEAN(* Fn)(ULONG Argc, PCHAR Argv[])
Definition: kdb_cli.c:346
c
#define c
Definition: ke_i.h:80
LABEL
#define LABEL
Definition: ntfslib.h:64
ARR_SIZE
#define ARR_SIZE(arr)
Definition: ntfslib.h:34
BYTES_PER_CLUSTER
#define BYTES_PER_CLUSTER
Definition: ntfslib.h:72
INDEX_ENTRY_END
#define INDEX_ENTRY_END
Definition: ntfslib.h:164
INDEX_ENTRY_NODE
#define INDEX_ENTRY_NODE
Definition: ntfslib.h:163
DISK_HANDLE
#define DISK_HANDLE
Definition: ntfslib.h:61
FILE_NAME_POSIX
#define FILE_NAME_POSIX
Definition: ntfslib.h:131
NTFS_MINOR_VERSION
#define NTFS_MINOR_VERSION
Definition: ntfslib.h:107
FILE_NAME_WIN32_AND_DOS
#define FILE_NAME_WIN32_AND_DOS
Definition: ntfslib.h:134
MFT_MIRR_COUNT
#define MFT_MIRR_COUNT
Definition: ntfslib.h:101
NTFS_SDS_MIRROR
#define NTFS_SDS_MIRROR
Definition: ntfslib.h:245
NTFS_SECURITY_ID
#define NTFS_SECURITY_ID
Definition: ntfslib.h:110
MFT_REFERENCE
#define MFT_REFERENCE(rec)
Definition: ntfslib.h:177
ATTR_IS_COMPRESSED
@ ATTR_IS_COMPRESSED
Definition: ntfslib.h:350
ATTR_IS_SPARSE
@ ATTR_IS_SPARSE
Definition: ntfslib.h:352
FORMAT_TIME
#define FORMAT_TIME
Definition: ntfslib.h:264
NTFS_MAJOR_VERSION
#define NTFS_MAJOR_VERSION
Definition: ntfslib.h:106
MFT_RECORD_SIZE
#define MFT_RECORD_SIZE
Definition: ntfslib.h:93
RECORD_SEQUENCE
#define RECORD_SEQUENCE(rec)
Definition: ntfslib.h:173
MFT_RECORD_VIEW_INDEX
@ MFT_RECORD_VIEW_INDEX
Definition: ntfslib.h:327
MFT_RECORD_IS_DIRECTORY
@ MFT_RECORD_IS_DIRECTORY
Definition: ntfslib.h:325
MFT_RECORD_IN_USE
@ MFT_RECORD_IN_USE
Definition: ntfslib.h:324
MFT_RECORD_UNKNOWN1
@ MFT_RECORD_UNKNOWN1
Definition: ntfslib.h:326
INDEX_RECORD_SIZE
#define INDEX_RECORD_SIZE
Definition: ntfslib.h:94
Bytes
_In_ UINT Bytes
Definition: mmcopy.h:9
Entries
static const ENTRY Entries[]
Definition: MultiByteToWideChar.c:42
Count
int Count
Definition: noreturn.cpp:7
NtWriteFile
NTSYSAPI NTSTATUS NTAPI NtWriteFile(IN HANDLE hFile, IN HANDLE hEvent OPTIONAL, IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL, IN PVOID IoApcContext OPTIONAL, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN PVOID WriteBuffer, IN ULONG WriteBufferLength, IN PLARGE_INTEGER FileOffset OPTIONAL, IN PULONG LockOperationKey OPTIONAL)
Offset
_In_ ULONG _In_ ULONG Offset
Definition: ntddpcm.h:101
Length
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
PBYTE
BYTE * PBYTE
Definition: pedump.c:66
USHORT
unsigned short USHORT
Definition: pedump.c:61
Address
static WCHAR Address[46]
Definition: ping.c:68
RtlFillMemory
#define RtlFillMemory(Dest, Length, Fill)
Definition: winternl.h:603
TopsData
static const BYTE TopsData[100]
Definition: refdata.h:93
TxfDataValue
static const BYTE TxfDataValue[56]
Definition: refdata.h:86
NTFS_DEFAULT_SD_COUNT
#define NTFS_DEFAULT_SD_COUNT
Definition: refdata.h:11
UpCaseInfo
static const BYTE UpCaseInfo[32]
Definition: refdata.h:117
RepairCfg
static const BYTE RepairCfg[8]
Definition: refdata.h:110
SidAdmins
static const BYTE SidAdmins[16]
Definition: refdata.h:112
DefaultSds
static const BYTE DefaultSds[716]
Definition: refdata.h:20
DefaultSdLen
static const USHORT DefaultSdLen[NTFS_DEFAULT_SD_COUNT]
Definition: refdata.h:18
RootSdValue
static const BYTE RootSdValue[228]
Definition: refdata.h:68
TxfInfo
static const BYTE TxfInfo[56]
Definition: refdata.h:103
MkIndxFixup
static VOID MkIndxFixup(IN OUT PBYTE Blk, IN ULONG BlkSize)
Definition: files.c:656
MREC_COUNT
#define MREC_COUNT
Definition: files.c:56
MREC_VOLUME
#define MREC_VOLUME
Definition: files.c:35
MREC_DELETED
#define MREC_DELETED
Definition: files.c:49
COLL_SID
#define COLL_SID
Definition: files.c:66
MREC_TXF
#define MREC_TXF
Definition: files.c:51
MREC_SECURE
#define MREC_SECURE
Definition: files.c:41
WR16
#define WR16(p, o, v)
Definition: files.c:77
MkStdInfoShort
static VOID MkStdInfoShort(OUT PBYTE Out, IN ULONG FileAttributes, IN ULONGLONG Now)
Definition: files.c:377
MREC_UPCASE
#define MREC_UPCASE
Definition: files.c:42
WriteMetafiles
NTSTATUS WriteMetafiles(VOID)
Definition: files.c:872
WR32
#define WR32(p, o, v)
Definition: files.c:78
MREC_CONT1
#define MREC_CONT1
Definition: files.c:54
MREC_BADCLUS
#define MREC_BADCLUS
Definition: files.c:40
MREC_BITMAP
#define MREC_BITMAP
Definition: files.c:38
MREC_TXFLOG
#define MREC_TXFLOG
Definition: files.c:50
ALIGN8
#define ALIGN8(x)
Definition: files.c:83
MkViewRootN
static ULONG MkViewRootN(OUT PBYTE Out, IN ULONG CollationRule, IN const MK_VIEW_ENTRY *Entries, IN ULONG Count)
Definition: files.c:591
MkRootIndxBlock
static VOID MkRootIndxBlock(OUT PBYTE Blk, IN const BYTE *Mft, IN const ULONG *Order, IN ULONG Count)
Definition: files.c:725
WritePatternToClusters
static NTSTATUS WritePatternToClusters(IN ULONGLONG Address, IN ULONG ClustersCount, IN BYTE Pattern)
Definition: files.c:789
MREC_MFTMIRR
#define MREC_MFTMIRR
Definition: files.c:33
MREC_ROOT
#define MREC_ROOT
Definition: files.c:37
MkStdInfo
static VOID MkStdInfo(OUT PBYTE Out, IN ULONG FileAttributes, IN ULONGLONG Now, IN ULONG SecurityId)
Definition: files.c:359
MREC_BOOT
#define MREC_BOOT
Definition: files.c:39
RD32
#define RD32(p, o)
Definition: files.c:81
MkExtractFileName
static USHORT MkExtractFileName(IN const BYTE *RecBuf, OUT PBYTE Out)
Definition: files.c:427
MkEncodeRuns
static ULONG MkEncodeRuns(IN const MK_RUN *Runs, IN ULONG RunCount, OUT PBYTE Out)
Definition: files.c:140
MREC_TXFBLF
#define MREC_TXFBLF
Definition: files.c:53
MREC_RMMETA
#define MREC_RMMETA
Definition: files.c:47
MREC_OBJID
#define MREC_OBJID
Definition: files.c:45
MkI30RootWithEntries
static ULONG MkI30RootWithEntries(OUT PBYTE Out, IN const BYTE *Mft, IN const ULONG *Order, IN ULONG Count)
Definition: files.c:499
WR64
#define WR64(p, o, v)
Definition: files.c:79
MREC_LOGFILE
#define MREC_LOGFILE
Definition: files.c:34
MREC_REPAIR
#define MREC_REPAIR
Definition: files.c:48
MkSecHash
static ULONG MkSecHash(IN const BYTE *Sd, IN ULONG Len)
Definition: files.c:639
FA_DIR
#define FA_DIR
Definition: files.c:62
WriteAt
static NTSTATUS WriteAt(IN ULONGLONG Lcn, IN PVOID Buffer, IN ULONG Length)
Definition: files.c:774
FA_ARCHIVE
#define FA_ARCHIVE
Definition: files.c:61
MkLargeI30Root
static ULONG MkLargeI30Root(OUT PBYTE Out)
Definition: files.c:478
HOLE_LCN
#define HOLE_LCN
Definition: files.c:72
MREC_REPARSE
#define MREC_REPARSE
Definition: files.c:46
USN_VALUE
#define USN_VALUE
Definition: files.c:70
MkSetHardLinks
static VOID MkSetHardLinks(IN MK_REC *Rec, IN USHORT Count)
Definition: files.c:222
REC_BUF
#define REC_BUF(n)
MkLargeViewRoot
static ULONG MkLargeViewRoot(OUT PBYTE Out, IN ULONG CollationRule)
Definition: files.c:568
FA_SYSTEM
#define FA_SYSTEM
Definition: files.c:60
MkSignBytes
static ULONG MkSignBytes(IN LONGLONG Value)
Definition: files.c:116
MkEmptyViewRoot
static ULONG MkEmptyViewRoot(OUT PBYTE Out, IN ULONG CollationRule)
Definition: files.c:548
MREC_CONT2
#define MREC_CONT2
Definition: files.c:55
MkEmptyI30Root
static ULONG MkEmptyI30Root(OUT PBYTE Out)
Definition: files.c:458
MREC_ATTRDEF
#define MREC_ATTRDEF
Definition: files.c:36
MkAddResident
static VOID MkAddResident(IN OUT MK_REC *Rec, IN ULONG Type, IN LPCWSTR Name, IN BYTE NameChars, IN BYTE ResidentFlags, IN const VOID *Value, IN ULONG ValueLen)
Definition: files.c:231
RD16
#define RD16(p, o)
Definition: files.c:80
MREC_QUOTA
#define MREC_QUOTA
Definition: files.c:44
FA_HIDDEN
#define FA_HIDDEN
Definition: files.c:59
WriteZerosToClusters
static NTSTATUS WriteZerosToClusters(IN ULONGLONG Address, IN ULONG ClustersCount)
Definition: files.c:836
MkFinalize
static VOID MkFinalize(IN MK_REC *Rec)
Definition: files.c:327
MkInit
static VOID MkInit(OUT MK_REC *Rec, IN PBYTE Buf, IN ULONG RecordNumber, IN USHORT Flags)
Definition: files.c:193
COLL_ULONGS
#define COLL_ULONGS
Definition: files.c:67
MkViewIndxBlock
static VOID MkViewIndxBlock(OUT PBYTE Blk, IN const MK_VIEW_ENTRY *Entries, IN ULONG Count)
Definition: files.c:675
MREC_MFT
#define MREC_MFT
Definition: files.c:32
MREC_TOPS
#define MREC_TOPS
Definition: files.c:52
FA_VIEW
#define FA_VIEW
Definition: files.c:63
MkFileName
static ULONG MkFileName(OUT PBYTE Out, IN ULONGLONG ParentRef, IN ULONG FileAttributes, IN ULONGLONG AllocSize, IN ULONGLONG RealSize, IN ULONGLONG Now, IN LPCWSTR Name, IN BYTE Namespace)
Definition: files.c:391
MREC_EXTEND
#define MREC_EXTEND
Definition: files.c:43
WriteRegion
static NTSTATUS WriteRegion(IN ULONGLONG Lcn, IN ULONG Clusters, IN const VOID *Content, IN ULONG ContentLen)
Definition: files.c:845
MkAddNonResident
static VOID MkAddNonResident(IN OUT MK_REC *Rec, IN ULONG Type, IN LPCWSTR Name, IN BYTE NameChars, IN USHORT Flags, IN const MK_RUN *Runs, IN ULONG RunCount, IN ULONGLONG HighVcn, IN ULONGLONG AllocSize, IN ULONGLONG RealSize, IN ULONGLONG InitSize)
Definition: files.c:267
Now
struct tm * Now
Definition: output.c:19
STATUS_SUCCESS
#define STATUS_SUCCESS
Definition: shellext.h:65
MK_REC
Definition: files.c:95
MK_REC::NextAttrId
USHORT NextAttrId
Definition: files.c:98
MK_REC::Buf
PBYTE Buf
Definition: files.c:96
MK_REC::Offset
ULONG Offset
Definition: files.c:97
MK_RUN
Definition: files.c:89
MK_RUN::Len
ULONGLONG Len
Definition: files.c:91
MK_RUN::Lcn
ULONGLONG Lcn
Definition: files.c:90
MK_VIEW_ENTRY
Definition: files.c:102
MK_VIEW_ENTRY::DataLen
USHORT DataLen
Definition: files.c:106
MK_VIEW_ENTRY::KeyLen
USHORT KeyLen
Definition: files.c:104
MK_VIEW_ENTRY::Key
const BYTE * Key
Definition: files.c:103
MK_VIEW_ENTRY::Data
const BYTE * Data
Definition: files.c:105
_IO_STATUS_BLOCK
Definition: env_spec_w32.h:870
Runs
ULONG Runs
Definition: symtest.c:7
LPCWSTR
const uint16_t * LPCWSTR
Definition: typedefs.h:57
LONGLONG
int64_t LONGLONG
Definition: typedefs.h:68
ULONGLONG
uint64_t ULONGLONG
Definition: typedefs.h:67
RtlCopyMemory
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
RtlZeroMemory
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
ULONG_PTR
uint32_t ULONG_PTR
Definition: typedefs.h:65
IN
#define IN
Definition: typedefs.h:39
ULONG
uint32_t ULONG
Definition: typedefs.h:59
OUT
#define OUT
Definition: typedefs.h:40
STATUS_INSUFFICIENT_RESOURCES
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
_LARGE_INTEGER
Definition: typedefs.h:103
Index
_In_ WDFCOLLECTION _In_ ULONG Index
Definition: wdfcollection.h:182
Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4539
Value
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _Out_opt_ PUSHORT _Inout_opt_ PUNICODE_STRING Value
Definition: wdfregistry.h:413
BYTE
unsigned char BYTE
Definition: xxhash.c:193