parttest.c File Reference

#include <stdio.h>
#include <stdlib.h>
#include <winternl.h>
#include <pshpack1.h>
#include <poppack.h>

Include dependency graph for parttest.c:

Go to the source code of this file.

Classes
struct	FATBootSector
struct	NTFSBootSector
struct	PARTITION_TABLE_ENTRY
struct	MASTER_BOOT_RECORD

Macros
#define	NT_SUCCESS(_Status)   (((NTSTATUS)(_Status)) >= 0)
#define	SECTOR_SIZE   512
#define	BOOT_RECORD_SIGNATURE   0xAA55

Typedefs
typedef struct FATBootSector *	PFATBootSector
typedef struct NTFSBootSector *	PNTFSBootSector
typedef struct PARTITION_TABLE_ENTRY *	PPARTITION_TABLE_ENTRY
typedef struct MASTER_BOOT_RECORD *	PMASTER_BOOT_RECORD

Functions
BOOL	CheckAgainstFAT (PFATBootSector Sector)
BOOL	CheckAgainstNTFS (PNTFSBootSector Sector)
BOOL	CheckAgainstMBR (PMASTER_BOOT_RECORD Sector)
int	main (int argc, char **argv)

Variables
PCWSTR	DiskFormat = L"\\Device\\Harddisk%lu\\Partition%lu"

Macro Definition Documentation

BOOT_RECORD_SIGNATURE

#define BOOT_RECORD_SIGNATURE   0xAA55

Definition at line 17 of file parttest.c.

NT_SUCCESS

#define NT_SUCCESS

(

_Status

)

(((NTSTATUS)(_Status)) >= 0)

Definition at line 13 of file parttest.c.

SECTOR_SIZE

#define SECTOR_SIZE   512

Definition at line 16 of file parttest.c.

Typedef Documentation

PFATBootSector

typedef struct FATBootSector * PFATBootSector

PMASTER_BOOT_RECORD

typedef struct MASTER_BOOT_RECORD * PMASTER_BOOT_RECORD

PNTFSBootSector

typedef struct NTFSBootSector * PNTFSBootSector

PPARTITION_TABLE_ENTRY

typedef struct PARTITION_TABLE_ENTRY * PPARTITION_TABLE_ENTRY

Function Documentation

CheckAgainstFAT()

BOOL CheckAgainstFAT

(

PFATBootSector

Sector

)

Definition at line 97 of file parttest.c.

{
    if (Sector->Signature1 != 0xaa55)
    {
        return FALSE;
    }

    if (Sector->BytesPerSector != 512 &&
        Sector->BytesPerSector != 1024 &&
        Sector->BytesPerSector != 2048 &&
        Sector->BytesPerSector != 4096)
    {
        return FALSE;
    }

    if (Sector->FATCount != 1 &&
        Sector->FATCount != 2)
    {
        return FALSE;
    }

    if (Sector->Media != 0xf0 &&
        Sector->Media != 0xf8 &&
        Sector->Media != 0xf9 &&
        Sector->Media != 0xfa &&
        Sector->Media != 0xfb &&
        Sector->Media != 0xfc &&
        Sector->Media != 0xfd &&
        Sector->Media != 0xfe &&
        Sector->Media != 0xff)
    {
        return FALSE;
    }

    if (Sector->SectorsPerCluster != 1 &&
        Sector->SectorsPerCluster != 2 &&
        Sector->SectorsPerCluster != 4 &&
        Sector->SectorsPerCluster != 8 &&
        Sector->SectorsPerCluster != 16 &&
        Sector->SectorsPerCluster != 32 &&
        Sector->SectorsPerCluster != 64 &&
        Sector->SectorsPerCluster != 128)
    {
        return FALSE;
    }

    if (Sector->BytesPerSector * Sector->SectorsPerCluster > 32 * 1024)
    {
        return FALSE;
    }

    return TRUE;
}

Referenced by main().

CheckAgainstMBR()

BOOL CheckAgainstMBR

(

PMASTER_BOOT_RECORD

Sector

)

Definition at line 193 of file parttest.c.

{
    if (Sector->MasterBootRecordMagic != BOOT_RECORD_SIGNATURE)
    {
        return FALSE;
    }

    return TRUE;
}

Referenced by main().

CheckAgainstNTFS()

BOOL CheckAgainstNTFS

(

PNTFSBootSector

Sector

)

Definition at line 151 of file parttest.c.

{
    ULONG k;
    ULONG ClusterSize;

    /* OEMID: this field must be NTFS */
    if (RtlCompareMemory(Sector->OEMID, "NTFS    ", 8) != 8)
    {
        return FALSE;
    }

    /* Unused0: this field must be COMPLETELY null */
    for (k = 0; k < 7; k++)
    {
        if (Sector->Unused0[k] != 0)
        {
            return FALSE;
        }
    }

    /* Unused3: this field must be COMPLETELY null */
    for (k = 0; k < 4; k++)
    {
        if (Sector->Unused3[k] != 0)
        {
            return FALSE;
        }
    }

    /* Check cluster size */
    ClusterSize = Sector->BytesPerSector * Sector->SectorsPerCluster;
    if (ClusterSize != 512 && ClusterSize != 1024 &&
        ClusterSize != 2048 && ClusterSize != 4096 &&
        ClusterSize != 8192 && ClusterSize != 16384 &&
        ClusterSize != 32768 && ClusterSize != 65536)
    {
        return FALSE;
    }

    return TRUE;
}

Referenced by main().

main()

int main	(	int argc	,
		char **	argv
	)

Definition at line 203 of file parttest.c.

{
    HANDLE FileHandle;
    NTSTATUS Status;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    WCHAR Buffer[MAX_PATH];
    UNICODE_STRING Name;
    PVOID Sector;

    Sector = malloc(SECTOR_SIZE);
    if (Sector == NULL)
    {
        fprintf(stderr, "Failed allocating memory!\n");
        return 0;
    }

    /* We first open disk */
    swprintf(Buffer, DiskFormat, 0, 0);
    RtlInitUnicodeString(&Name, Buffer);
    InitializeObjectAttributes(&ObjectAttributes,
                               &Name,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);

    Status = NtOpenFile(&FileHandle,
                        GENERIC_READ | SYNCHRONIZE,
                        &ObjectAttributes,
                        &IoStatusBlock,
                        0,
                        FILE_SYNCHRONOUS_IO_NONALERT);
    if (!NT_SUCCESS(Status))
    {
        free(Sector);
        fprintf(stderr, "Failed opening disk! %lx\n", Status);
        return 0;
    }

    /* Read first sector of the disk */
    Status = NtReadFile(FileHandle,
                        NULL,
                        NULL,
                        NULL,
                        &IoStatusBlock,
                        Sector,
                        SECTOR_SIZE,
                        NULL,
                        NULL);
    NtClose(FileHandle);
    if (!NT_SUCCESS(Status))
    {
        free(Sector);
        fprintf(stderr, "Failed reading sector 0! %lx\n", Status);
        return 0;
    }

    /* Is it FAT? */
    if (CheckAgainstFAT(Sector))
    {
        printf("Sector 0 seems to be FAT boot sector\n");
    }
    /* Is it NTFS? */
    else if (CheckAgainstNTFS(Sector))
    {
        printf("Sector 0 seems to be NTFS boot sector\n");
    }
    /* Is it MBR? */
    else if (CheckAgainstMBR(Sector))
    {
        printf("Sector 0 might be MBR\n");
    }
    /* We don't support anything else */
    else
    {
        printf("Sector 0 not recognized\n");
    }

    /* Redo it with first partition */
    swprintf(Buffer, DiskFormat, 0, 1);
    RtlInitUnicodeString(&Name, Buffer);
    InitializeObjectAttributes(&ObjectAttributes,
                               &Name,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);

    Status = NtOpenFile(&FileHandle,
                        GENERIC_READ | SYNCHRONIZE,
                        &ObjectAttributes,
                        &IoStatusBlock,
                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
                        FILE_SYNCHRONOUS_IO_NONALERT);
    if (!NT_SUCCESS(Status))
    {
        free(Sector);
        fprintf(stderr, "Failed opening partition! %lx\n", Status);
        return 0;
    }

    /* Read first sector of the partition */
    Status = NtReadFile(FileHandle,
                        NULL,
                        NULL,
                        NULL,
                        &IoStatusBlock,
                        Sector,
                        SECTOR_SIZE,
                        NULL,
                        NULL);
    if (!NT_SUCCESS(Status))
    {
        free(Sector);
        fprintf(stderr, "Failed reading first sector of the partition! %lx\n", Status);
        return 0;
    }

    /* Is it FAT? */
    if (CheckAgainstFAT(Sector))
    {
        printf("Seems to be a FAT partittion\n");
    }
    /* Is it NTFS? */
    else if (CheckAgainstNTFS(Sector))
    {
        printf("Seems to be a NTFS partition\n");
    }
    /* Is it MBR? */
    else if (CheckAgainstMBR(Sector))
    {
        printf("Seems to be MBR\n");
    }
    /* We don't support anything else */
    else
    {
        printf("Not recognized\n");
    }

    free(Sector);

    return 0;
}

Variable Documentation

DiskFormat

PCWSTR DiskFormat = L"\\Device\\Harddisk%lu\\Partition%lu"

Definition at line 19 of file parttest.c.

Referenced by main().