21#define NRH_FILE_TYPE 0x454C4946
105 USHORT AlignmentOrReserved;
114#define NTFS_FILE_NAME_POSIX 0
115#define NTFS_FILE_NAME_WIN32 1
116#define NTFS_FILE_NAME_DOS 2
117#define NTFS_FILE_NAME_WIN32_AND_DOS 3
119#define NTFS_FILE_MFT 0
120#define NTFS_FILE_MFTMIRR 1
121#define NTFS_FILE_LOGFILE 2
122#define NTFS_FILE_VOLUME 3
123#define NTFS_FILE_ATTRDEF 4
124#define NTFS_FILE_ROOT 5
125#define NTFS_FILE_BITMAP 6
126#define NTFS_FILE_BOOT 7
127#define NTFS_FILE_BADCLUS 8
128#define NTFS_FILE_QUOTA 9
129#define NTFS_FILE_UPCASE 10
130#define NTFS_FILE_EXTEND 11
134 _T(
"Master File Table ($Mft)"),
135 _T(
"Master File Table Mirror ($MftMirr)"),
136 _T(
"Log File ($LogFile)"),
137 _T(
"DASD ($Volume)"),
138 _T(
"Attribute Definition Table ($AttrDef)"),
139 _T(
"Root Directory"),
140 _T(
"Volume Bitmap ($BitMap)"),
141 _T(
"Boot Sectors ($Boot)"),
142 _T(
"Bad Cluster List ($BadClus)"),
143 _T(
"Security ($Secure)"),
144 _T(
"Upcase Table ($UpCase)"),
145 _T(
"Extend Table ($Extend)")
148#define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
150#define NTFS_FILE_TYPE_DIRECTORY 0x10000000
188 if (CacheEntry !=
NULL)
195 if (CacheEntry ==
NULL)
287 if (CacheEntry ==
NULL)
303 if (CacheEntry !=
NULL)
361 UCHAR DataRunOffsetSize;
362 UCHAR DataRunLengthSize;
366 DataRunOffsetSize = (*DataRun >> 4) & 0xF;
368 DataRunLengthSize = *DataRun & 0xF;
378 for (
i = 0;
i < DataRunLengthSize;
i++)
380 *DataRunLength += ((
ULONG64)*DataRun) << (
i * 8);
386 if (DataRunOffsetSize == 0)
394 for (
i = 0;
i < DataRunOffsetSize - 1;
i++)
396 *DataRunOffset += ((
ULONG64)*DataRun) << (
i * 8);
401 *DataRunOffset = ((
LONG64)(
CHAR)(*(DataRun++)) << (
i * 8)) + *DataRunOffset;
411 WCHAR AttributeName[0xFF + 3];
416 AttributeName[0] =
L' ';
423 AttributeName[0] =
L' ';
428 switch (Attribute->
Type)
498 if (CurrOffset != -1)
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 NameType
BOOL WINAPI DeviceIoControl(IN HANDLE hDevice, IN DWORD dwIoControlCode, IN LPVOID lpInBuffer OPTIONAL, IN DWORD nInBufferSize OPTIONAL, OUT LPVOID lpOutBuffer OPTIONAL, IN DWORD nOutBufferSize OPTIONAL, OUT LPDWORD lpBytesReturned OPTIONAL, IN LPOVERLAPPED lpOverlapped OPTIONAL)
#define INVALID_HANDLE_VALUE
#define HeapFree(x, y, z)
_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING VolumeName
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG FileAttributes
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS _Out_opt_ PULONG LengthReturned
_Must_inspect_result_ _Out_ PHANDLE VolumeHandle
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD
#define NTFS_FILE_NAME_DOS
enum ATTRIBUTE_TYPE * PATTRIBUTE_TYPE
struct FILENAME_ATTRIBUTE * PFILENAME_ATTRIBUTE
PUCHAR DecodeRun(PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength)
PNAME_CACHE_ENTRY CacheHead
PNAME_CACHE_ENTRY HandleFile(HANDLE VolumeHandle, PNTFS_VOLUME_DATA_BUFFER VolumeInfo, ULONGLONG Id, PNTFS_FILE_RECORD_OUTPUT_BUFFER OutputBuffer, BOOLEAN Silent)
struct _NAME_CACHE_ENTRY NAME_CACHE_ENTRY
struct NTFS_RECORD_HEADER * PNTFS_RECORD_HEADER
#define NTFS_FILE_TYPE_DIRECTORY
PWSTR KnownEntries[NTFS_FILE_EXTEND+1]
PNAME_CACHE_ENTRY FindInCache(ULONGLONG MftId)
@ AttributeStandardInformation
@ AttributeVolumeInformation
@ AttributeSecurityDescriptor
@ AttributeIndexAllocation
@ AttributeLoggedUtilityStream
PNAME_CACHE_ENTRY AddToCache(PWSTR Name, DWORD Length, ULONGLONG MftId)
PNAME_CACHE_ENTRY PrintPrettyName(HANDLE VolumeHandle, PNTFS_VOLUME_DATA_BUFFER VolumeInfo, PNTFS_ATTR_RECORD Attributes, PNTFS_ATTR_RECORD AttributesEnd, ULONGLONG MftId, BOOLEAN Silent)
struct _FILE_RECORD_HEADER * PFILE_RECORD_HEADER
struct _NAME_CACHE_ENTRY * PNAME_CACHE_ENTRY
struct _FILE_RECORD_HEADER FILE_RECORD_HEADER
void PrintAttributeInfo(PNTFS_ATTR_RECORD Attribute, DWORD MaxSize)
#define NTFS_FILE_NAME_POSIX
_In_ ULONG _In_ ULONG Offset
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define FSCTL_GET_NTFS_VOLUME_DATA
#define FSCTL_GET_NTFS_FILE_RECORD
struct NTFS_ATTR_RECORD::@169::@171 Resident
struct NTFS_ATTR_RECORD::@169::@172 NonResident
struct _NAME_CACHE_ENTRY * Next
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_WMI_INSTANCE_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_opt_ WDFWMIINSTANCE * Instance
DWORD WINAPI GetLastError(void)
_Reserved_ PVOID Reserved
_Must_inspect_result_ _In_ ULONG Flags