|
|
// getoid.c
#include "oidtst.h"
int FsTestGetOid( IN HANDLE hFile, IN FILE_OBJECTID_BUFFER *ObjectIdBuffer ) { IO_STATUS_BLOCK IoStatusBlock; NTSTATUS Status;
Status = NtFsControlFile( hFile, // file handle
NULL, // event
NULL, // apc routine
NULL, // apc context
&IoStatusBlock, // iosb
FSCTL_GET_OBJECT_ID, // FsControlCode
&hFile, // input buffer
sizeof(HANDLE), // input buffer length
ObjectIdBuffer, // OutputBuffer for data from the FS
sizeof(FILE_OBJECTID_BUFFER) ); // OutputBuffer Length
if (Status == STATUS_SUCCESS) {
printf( "\nOid for this file is %s", ObjectIdBuffer->ObjectId );
FsTestHexDump( ObjectIdBuffer->ObjectId, 16 );
printf( "\nObjectId:%08x %08x %08x %08x\n", *((PULONG)&ObjectIdBuffer->ObjectId[12]), *((PULONG)&ObjectIdBuffer->ObjectId[8]), *((PULONG)&ObjectIdBuffer->ObjectId[4]), *((PULONG)&ObjectIdBuffer->ObjectId[0]) );
printf( "\nExtended info is %s\n", ObjectIdBuffer->ExtendedInfo );
FsTestHexDump( ObjectIdBuffer->ExtendedInfo, 48 ); }
return FsTestDecipherStatus( Status ); }
VOID _cdecl main( int argc, char *argv[] ) { HANDLE File; FILE_OBJECTID_BUFFER ObjectIdBuffer; IO_STATUS_BLOCK IoStatusBlock; char mybuffer[100]; NTSTATUS GetNameStatus; NTSTATUS GetFrsStatus; FILE_INTERNAL_INFORMATION InternalInfo;
//
// Get parameters
//
if (argc < 2) { printf("This program finds the object id of a file (ntfs only).\n\n"); printf("usage: %s filename\n", argv[0]); return; }
File = CreateFile( argv[1], 0, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL );
if ( File == INVALID_HANDLE_VALUE ) { printf( "Error opening file %s %x\n", argv[1], GetLastError() ); return; }
GetNameStatus = NtQueryInformationFile( File, &IoStatusBlock, mybuffer, sizeof(mybuffer), FileNameInformation );
printf( "\nGetNameStatus %x, Filename is:", GetNameStatus ); printf( "%S", (mybuffer + 4) );
GetFrsStatus = NtQueryInformationFile( File, &IoStatusBlock, &InternalInfo, sizeof(InternalInfo), FileInternalInformation );
printf( "\nGetFrsStatus %x, FRS is: (highpart lowpart )", GetFrsStatus ); printf( "\n %08x %08x", InternalInfo.IndexNumber.HighPart, InternalInfo.IndexNumber.LowPart );
RtlZeroBytes( &ObjectIdBuffer, sizeof( ObjectIdBuffer ) );
printf( "\nGetting object id for file:%s\n", argv[1] );
FsTestGetOid( File, &ObjectIdBuffer );
CloseHandle( File ); }
|