53 DPRINT(
"NtfsHasFileSystem() called\n");
65 DPRINT1(
"NtfsDeviceIoControl() failed (Status %lx)\n",
Status);
82 DPRINT1(
"NtfsDeviceIoControl() failed (Status %lx)\n",
Status);
88 DPRINT1(
"Invalid partition type\n");
127 for (
k = 0;
k < 7;
k++)
138 for (
k = 0;
k < 4;
k++)
155 DPRINT1(
"Cluster size failed: %hu, %hu, %hu\n",
174 ULONG ZoneReservation = 1;
188 return ZoneReservation;
209 DPRINT(
"NtfsGetVolumeData() called\n");
221 DPRINT(
"NtfsDeviceIoControl() failed (Status %lx)\n",
Status);
251 NtfsInfo->
ClusterCount = DeviceExt->NtfsInfo.SectorCount / (
ULONGLONG)DeviceExt->NtfsInfo.SectorsPerCluster;
260 if (
BootSector->EBPB.ClustersPerIndexRecord > 0)
265 DPRINT(
"Boot sector information:\n");
271 DPRINT(
" ClustersPerMftRecord: %lx\n",
BootSector->EBPB.ClustersPerMftRecord);
272 DPRINT(
" ClustersPerIndexRecord: %lx\n",
BootSector->EBPB.ClustersPerIndexRecord);
280 DeviceExt->MasterFileTable = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
281 if (DeviceExt->MasterFileTable ==
NULL)
291 (
PVOID)DeviceExt->MasterFileTable,
295 DPRINT1(
"Failed reading MFT.\n");
296 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, DeviceExt->MasterFileTable);
302 DeviceExt->MasterFileTable,
306 &DeviceExt->MFTContext,
307 &DeviceExt->MftDataOffset);
310 DPRINT1(
"Can't find data attribute for Master File Table.\n");
311 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, DeviceExt->MasterFileTable);
316 VolumeRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
317 if (VolumeRecord ==
NULL)
319 DPRINT1(
"Allocation failed for volume record\n");
320 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, DeviceExt->MasterFileTable);
332 DPRINT1(
"Failed reading volume file\n");
333 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, VolumeRecord);
334 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, DeviceExt->MasterFileTable);
350 Attribute = AttrCtxt->pRecord;
371 if (VolumeFcb ==
NULL)
373 DPRINT1(
"Failed allocating volume FCB\n");
374 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, VolumeRecord);
375 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, DeviceExt->MasterFileTable);
381 VolumeFcb->
RFCB.
FileSize.
QuadPart = DeviceExt->NtfsInfo.SectorCount * DeviceExt->NtfsInfo.BytesPerSector;
385 DeviceExt->VolumeFcb = VolumeFcb;
392 Attribute = AttrCtxt->pRecord;
406 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, VolumeRecord);
428 DPRINT(
"NtfsMountVolume() called\n");
437 DeviceToMount =
Stack->Parameters.MountVolume.DeviceObject;
469 NewDeviceObject->Vpb = DeviceToMount->Vpb;
471 Vcb->StorageDevice = DeviceToMount;
472 Vcb->StorageDevice->Vpb->DeviceObject = NewDeviceObject;
473 Vcb->StorageDevice->Vpb->RealDevice =
Vcb->StorageDevice;
475 NewDeviceObject->
StackSize =
Vcb->StorageDevice->StackSize + 1;
476 NewDeviceObject->
Flags &= ~DO_DEVICE_INITIALIZING;
504 Vcb->StreamFileObject->FsContext =
Fcb;
505 Vcb->StreamFileObject->FsContext2 =
Ccb;
507 Vcb->StreamFileObject->PrivateCacheMap =
NULL;
508 Vcb->StreamFileObject->Vpb =
Vcb->Vpb;
509 Ccb->PtrFileObject =
Vcb->StreamFileObject;
542 NewDeviceObject->Vpb->SerialNumber =
Vcb->NtfsInfo.SerialNumber;
545 NewDeviceObject->Vpb->VolumeLabelLength =
Vcb->NtfsInfo.VolumeLabelLength;
547 Vcb->NtfsInfo.VolumeLabel,
548 Vcb->NtfsInfo.VolumeLabelLength);
558 if (
Vcb &&
Vcb->StreamFileObject)
574 DPRINT(
"NtfsMountVolume() done (Status: %lx)\n",
Status);
587 DPRINT1(
"NtfsVerifyVolume() called\n");
609 DPRINT1(
"Invalid output! %d %p\n",
Stack->Parameters.FileSystemControl.OutputBufferLength,
Irp->UserBuffer);
649 ExtendedData->
MajorVersion = DeviceExt->NtfsInfo.MajorVersion;
650 ExtendedData->
MinorVersion = DeviceExt->NtfsInfo.MinorVersion;
673 Irp->AssociatedIrp.SystemBuffer ==
NULL)
675 DPRINT1(
"Invalid input! %d %p\n",
Stack->Parameters.FileSystemControl.InputBufferLength,
Irp->AssociatedIrp.SystemBuffer);
680 Irp->AssociatedIrp.SystemBuffer ==
NULL)
682 DPRINT1(
"Invalid output! %d %p\n",
Stack->Parameters.FileSystemControl.OutputBufferLength,
Irp->AssociatedIrp.SystemBuffer);
686 FileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
687 if (FileRecord ==
NULL)
694 MFTRecord =
InputBuffer->FileReferenceNumber.QuadPart;
695 DPRINT1(
"Requesting: %I64x\n", MFTRecord);
711 DPRINT1(
"Returning: %I64x\n", MFTRecord);
714 OutputBuffer->FileRecordLength = DeviceExt->NtfsInfo.BytesPerFileRecord;
717 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, FileRecord);
740 DPRINT(
"GetVolumeBitmap(%p, %p)\n", DeviceExt,
Irp);
746 DPRINT1(
"Invalid input! %d\n",
Stack->Parameters.FileSystemControl.InputBufferLength);
752 DPRINT1(
"Invalid output! %d\n",
Stack->Parameters.FileSystemControl.OutputBufferLength);
762 Stack->Parameters.FileSystemControl.InputBufferLength,
775 if (
Stack->Parameters.FileSystemControl.Type3InputBuffer ==
NULL ||
789 if (StartingLcn > DeviceExt->NtfsInfo.ClusterCount)
791 DPRINT1(
"Requested bitmap start beyond partition end: %I64x %I64x\n", DeviceExt->NtfsInfo.ClusterCount, StartingLcn);
796 StartingLcn = StartingLcn & ~7;
797 TotalClusters = DeviceExt->NtfsInfo.ClusterCount - StartingLcn;
798 ToCopy = TotalClusters / 8;
806 BitmapRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
807 if (BitmapRecord ==
NULL)
816 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
824 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
843 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, BitmapRecord);
859 DPRINT(
"LockOrUnlockVolume(%p, %p, %d)\n", DeviceExt,
Irp,
Lock);
879 if (
Lock && DeviceExt->OpenHandleCount != 1)
891 DeviceExt->Flags &= ~VCB_VOLUME_LOCKED;
911 switch (
Stack->Parameters.FileSystemControl.FsControlCode)
928 DPRINT1(
"Unimplemented user request: %x\n",
Stack->Parameters.FileSystemControl.FsControlCode);
953 DPRINT(
"Invalid user request: %x\n",
Stack->Parameters.FileSystemControl.FsControlCode);
969 DPRINT(
"NtfsFileSystemControl() called\n");
978 DPRINT1(
"NTFS: IRP_MN_USER_FS_REQUEST\n");
987 DPRINT(
"NTFS: IRP_MN_MOUNT_VOLUME\n");
992 DPRINT1(
"NTFS: IRP_MN_VERIFY_VOLUME\n");
static PIO_STACK_LOCATION IoGetCurrentIrpStackLocation(PIRP Irp)
_Inout_ PFILE_OBJECT _In_ TYPE_OF_OPEN PFCB _In_opt_ PCCB Ccb
#define IOCTL_DISK_GET_DRIVE_GEOMETRY
#define STATUS_NOT_IMPLEMENTED
#define NT_SUCCESS(StatCode)
struct _BEEP_DEVICE_EXTENSION * PDEVICE_EXTENSION
NTSTATUS FindFirstAttribute(PFIND_ATTR_CONTXT Context, PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord, BOOLEAN OnlyResident, PNTFS_ATTR_RECORD *Attribute)
VOID FindCloseAttribute(PFIND_ATTR_CONTXT Context)
VOID NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER FileRecord)
NTSTATUS FindNextAttribute(PFIND_ATTR_CONTXT Context, PNTFS_ATTR_RECORD *Attribute)
PVOID NtfsGetUserBuffer(PIRP Irp, BOOLEAN Paging)
PNTFS_GLOBAL_DATA NtfsGlobalData
ULONGLONG NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt)
@ AttributeVolumeInformation
#define FCB_IS_VOLUME_STREAM
#define ExAllocatePoolWithTag(hernya, size, tag)
NTSTATUS ExInitializeResourceLite(PULONG res)
#define RtlCompareMemory(s1, s2, l)
#define InitializeListHead(ListHead)
#define KeInitializeSpinLock(sl)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
#define VCB_VOLUME_LOCKED
VOID NTAPI CcInitializeCacheMap(IN PFILE_OBJECT FileObject, IN PCC_FILE_SIZES FileSizes, IN BOOLEAN PinAccess, IN PCACHE_MANAGER_CALLBACKS Callbacks, IN PVOID LazyWriteContext)
static ULONG BitmapBuffer[(XMS_BLOCKS+31)/32]
NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, PVOID, PVOID)
#define EXCEPTION_EXECUTE_HANDLER
VOID NTAPI ExDeleteNPagedLookasideList(IN PNPAGED_LOOKASIDE_LIST Lookaside)
VOID NTAPI ExInitializeNPagedLookasideList(IN PNPAGED_LOOKASIDE_LIST Lookaside, IN PALLOCATE_FUNCTION Allocate OPTIONAL, IN PFREE_FUNCTION Free OPTIONAL, IN ULONG Flags, IN SIZE_T Size, IN ULONG Tag, IN USHORT Depth)
NTSTATUS ReadFileRecord(PDEVICE_EXTENSION Vcb, ULONGLONG index, PFILE_RECORD_HEADER file)
VOID ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
ULONGLONG AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord)
NTSTATUS FindAttribute(PDEVICE_EXTENSION Vcb, PFILE_RECORD_HEADER MftRecord, ULONG Type, PCWSTR Name, ULONG NameLength, PNTFS_ATTR_CONTEXT *AttrCtx, PULONG Offset)
ULONG ReadAttribute(PDEVICE_EXTENSION Vcb, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length)
_In_ PCWSTR _Inout_ _At_ QueryTable _Pre_unknown_ PRTL_QUERY_REGISTRY_TABLE QueryTable
#define RTL_REGISTRY_CONTROL
#define FSCTL_LOCK_VOLUME
#define RTL_QUERY_REGISTRY_DIRECT
#define FSCTL_UNLOCK_VOLUME
#define UNREFERENCED_PARAMETER(P)
struct _DISK_GEOMETRY DISK_GEOMETRY
struct _PARTITION_INFORMATION PARTITION_INFORMATION
#define IOCTL_DISK_GET_PARTITION_INFO
NTSTATUS NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject, IN ULONG DiskSector, IN ULONG SectorCount, IN ULONG SectorSize, IN OUT PUCHAR Buffer, IN BOOLEAN Override)
NTSTATUS NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject, IN ULONG ControlCode, IN PVOID InputBuffer, IN ULONG InputBufferSize, IN OUT PVOID OutputBuffer, IN OUT PULONG OutputBufferSize, IN BOOLEAN Override)
PNTFS_FCB NtfsCreateFCB(PCWSTR FileName, PCWSTR Stream, PNTFS_VCB Vcb)
VOID NtfsDestroyFCB(PNTFS_FCB Fcb)
static NTSTATUS LockOrUnlockVolume(PDEVICE_EXTENSION DeviceExt, PIRP Irp, BOOLEAN Lock)
static ULONG NtfsQueryMftZoneReservation(VOID)
static NTSTATUS GetVolumeBitmap(PDEVICE_EXTENSION DeviceExt, PIRP Irp)
static NTSTATUS NtfsHasFileSystem(PDEVICE_OBJECT DeviceToMount)
static NTSTATUS NtfsGetVolumeData(PDEVICE_OBJECT DeviceObject, PDEVICE_EXTENSION DeviceExt)
NTSTATUS NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext)
static NTSTATUS GetNtfsFileRecord(PDEVICE_EXTENSION DeviceExt, PIRP Irp)
static NTSTATUS NtfsVerifyVolume(PDEVICE_OBJECT DeviceObject, PIRP Irp)
static NTSTATUS NtfsMountVolume(PDEVICE_OBJECT DeviceObject, PIRP Irp)
static NTSTATUS NtfsUserFsRequest(PDEVICE_OBJECT DeviceObject, PIRP Irp)
static NTSTATUS GetNfsVolumeData(PDEVICE_EXTENSION DeviceExt, PIRP Irp)
#define FSCTL_GET_NTFS_VOLUME_DATA
#define FSRTL_VOLUME_MOUNT
#define FSCTL_GET_NTFS_FILE_RECORD
NTSTATUS NTAPI FsRtlNotifyVolumeEvent(IN PFILE_OBJECT FileObject, IN ULONG EventCode)
NTSTATUS NTAPI IoCreateDevice(IN PDRIVER_OBJECT DriverObject, IN ULONG DeviceExtensionSize, IN PUNICODE_STRING DeviceName, IN DEVICE_TYPE DeviceType, IN ULONG DeviceCharacteristics, IN BOOLEAN Exclusive, OUT PDEVICE_OBJECT *DeviceObject)
VOID NTAPI IoDeleteDevice(IN PDEVICE_OBJECT DeviceObject)
PFILE_OBJECT NTAPI IoCreateStreamFileObject(IN PFILE_OBJECT FileObject, IN PDEVICE_OBJECT DeviceObject)
#define FILE_DEVICE_DISK_FILE_SYSTEM
struct NTFS_VOLUME_DATA_BUFFER * PNTFS_VOLUME_DATA_BUFFER
struct STARTING_LCN_INPUT_BUFFER * PSTARTING_LCN_INPUT_BUFFER
struct NTFS_EXTENDED_VOLUME_DATA * PNTFS_EXTENDED_VOLUME_DATA
#define FSCTL_GET_RETRIEVAL_POINTERS
struct NTFS_FILE_RECORD_OUTPUT_BUFFER * PNTFS_FILE_RECORD_OUTPUT_BUFFER
#define FSCTL_GET_VOLUME_BITMAP
struct NTFS_FILE_RECORD_INPUT_BUFFER * PNTFS_FILE_RECORD_INPUT_BUFFER
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define FSCTL_WRITE_USN_CLOSE_RECORD
#define FSCTL_READ_USN_JOURNAL
#define FSCTL_DELETE_USN_JOURNAL
#define FSCTL_MARK_HANDLE
#define FSCTL_QUERY_USN_JOURNAL
#define FSCTL_CREATE_USN_JOURNAL
#define FSCTL_ENUM_USN_DATA
#define FSCTL_EXTEND_VOLUME
#define FSCTL_READ_FILE_USN_DATA
#define STATUS_BUFFER_TOO_SMALL
#define STATUS_BUFFER_OVERFLOW
struct NTFS_ATTR_RECORD::@171::@173 Resident
struct NTFS_ATTR_RECORD::@171::@174 NonResident
PDEVICE_OBJECT DeviceObject
CACHE_MANAGER_CALLBACKS CacheMgrCallbacks
PDRIVER_OBJECT DriverObject
PDEVICE_OBJECT DeviceObject
LARGE_INTEGER NumberSectors
LARGE_INTEGER MftValidDataLength
LARGE_INTEGER TotalReserved
LARGE_INTEGER Mft2StartLcn
LARGE_INTEGER FreeClusters
DWORD BytesPerFileRecordSegment
LARGE_INTEGER MftZoneStart
DWORD ClustersPerFileRecordSegment
LARGE_INTEGER TotalClusters
LARGE_INTEGER VolumeSerialNumber
LARGE_INTEGER MftStartLcn
FSRTL_COMMON_FCB_HEADER RFCB
NTFSIDENTIFIER Identifier
SECTION_OBJECT_POINTERS SectionObjectPointers
WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH]
ULONG BytesPerIndexRecord
ULARGE_INTEGER MftMirrStart
struct _ULARGE_INTEGER::@4191 u
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define STATUS_INVALID_DEVICE_REQUEST
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_UNRECOGNIZED_VOLUME
#define STATUS_WRONG_VOLUME
#define STATUS_INSUFFICIENT_RESOURCES
_In_ PDEVICE_OBJECT DeviceObject
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _In_ _In_ _Strict_type_match_ POOL_TYPE _In_opt_ PWDF_OBJECT_ATTRIBUTES _In_opt_ ULONG _Out_ WDFLOOKASIDE * Lookaside
_In_ WDFREQUEST _In_ PIO_STACK_LOCATION Stack
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFWAITLOCK * Lock
_In_ ULONG _In_ struct _SET_PARTITION_INFORMATION_EX * PartitionInfo
#define IRP_MN_VERIFY_VOLUME
#define IRP_MN_USER_FS_REQUEST
#define IRP_MN_KERNEL_CALL
#define MAXIMUM_VOLUME_LABEL_LENGTH
#define IRP_MN_MOUNT_VOLUME
#define ObDereferenceObject