This file defines the NTFS driver of PwnOS.
| NTFS Driver.asm | This file defines the NTFS driver of PwnOS. |
| Functions | |
| OpenFileNTFS | This procedure opens a file from an NTFS partition. |
| ReadFileNTFS | This procedure reads data from an open file on an NTFS partition. |
| SearchNTFSDirectory | This procedure finds a file (or directory) in an NTFS directory. |
| GetNTFSFileRecord | This procedure reads in the NTFS file record of the file with the specified file record number. |
| ReadVirtualClusters | This procedure reads the specified range of virtual cluster of any non-resident attribute. |
| VirtualClusNumToSector | This procedure determines the starting sector number of the specified virtual cluster of any non-resident attribute. |
| LogicalClusNumToSector | This procedure determines the starting sector number of the specified logical cluster. |
This procedure opens a file from an NTFS partition. It should only be called from OpenFile.
TODO: Add handling for Access value and Creation value.
| pPartition | address of <PARTITIONINFO_NTFS> structure for the NTFS partition |
| pName | address of unicode filename with no preceding protocol |
| pDirectory | address of FILE structure for the directory to which the filename is relative, or NULL if absolute |
| Access | access options |
| Creation | creation options |
| Flags | miscellaneous |
| pHeap | address of the heap on which to allocate memory |
| MFTRecordNum | NTFSMFTREF to keep track of the MFT record number of the file found |
This procedure reads data from an open file on an NTFS partition.
| pFile | address of <FILE_NTFS> structure |
| pDestination | address to which the data is to be read |
| nBytes | number of bytes to read |
| nBytesPerCluster | size of a cluster in bytes |
| nBytesInCache | size of the file’s cache in bytes |
This procedure finds a file (or directory) in an NTFS directory. It should only be called from OpenFileNTFS.
| pPartition | address of <PARTITIONINFO_NTFS> structure for the NTFS partition |
| pName | address of unicode filename; in case pointing to the middle of a path, the function considers “\”, “/”, or 0 to be the name end |
| pDirFileHeader | address of <NTFSFILEHEADER> structure for the directory to search |
| pIndexScratch | address of I/O scratch memory (must be at least cluster size) |
| pIndexRoot | address of index root attribute structure |
| pIndexAlloc | address of index allocation attribute structure |
| edx:eax | the NTFSMFTREF (eax is low, edx is high), including sequence number, or 0 if file not found |
This procedure reads in the NTFS file record of the file with the specified file record number.
| pDest | address to which the file record is to be written |
| pPartition | address of <PARTITIONINFO_NTFS> structure for the NTFS partition |
| FileRecNumLow | low dword of file record number |
| FileRecNumHigh | high dword of file record number |
| nClusLeft | number of clusters left (if file record is 1 cluster or larger) |
This procedure reads the specified range of virtual cluster of any non-resident attribute.
| pPartition | address of <PARTITIONINFO_NTFS> structure for the NTFS partition |
| VCNLow | low dword of virtual cluster number |
| VCNHigh | high dword of virtual cluster number |
| pAttribute | address of the <NTFSATTRIBHEADER_NRES> structure for the attribute |
| pDestination | address to which the data is to be read |
| nClusters | number of clusters to read |
This procedure determines the starting sector number of the specified virtual cluster of any non-resident attribute.
FIXME: Add support for offset larger than 4 bytes (>= 2^31 or < -2^31 clusters) FIXME: Add support for run length larger than 4 bytes (>= 2^31 or < -2^31 clusters) FIXME: Add support for VCN >= 2^32
| pPartition | address of <PARTITIONINFO_NTFS> structure for the NTFS partition |
| VCNLow | low dword of virtual cluster number |
| VCNHigh | high dword of virtual cluster number |
| pAttribute | address of the <NTFSATTRIBHEADER_NRES> structure for the attribute |
| ecx:edx | the sector number (edx is low, ecx is high), or 0 if sparse cluster run, or -1 if past end of runs |
| eax | the number of subsequent clusters in the run |
This procedure determines the starting sector number of the specified logical cluster.
| pPartition | address of <PARTITIONINFO_NTFS> structure for the NTFS partition |
| LCNLow | low dword of logical cluster number |
| LCNHigh | high dword of logical cluster number |
| ecx:edx | the sector number (edx is low, ecx is high) |
| eax | the given value of pPartition (this is only returned for convenience of the calling function) |