// enumr.c #include "oidtst.h" void FsTestDumpReparsePointIndexEntries ( IN PFILE_REPARSE_POINT_INFORMATION ReparsePointInfo, IN ULONG LengthInBytes ) { ULONG ReturnedCount; ULONG Idx; ReturnedCount = LengthInBytes / sizeof( FILE_REPARSE_POINT_INFORMATION ); printf( "\n\nFound %x reparse point index entries", ReturnedCount ); for (Idx = 0; Idx < ReturnedCount; Idx += 1) { printf( "\nEntry %x", Idx ); printf( "\nTag %x", ReparsePointInfo[Idx].Tag ); printf( "\nFileReference " ); FsTestHexDumpLongs( &ReparsePointInfo[Idx].FileReference, 8 ); printf( "\n" ); } } int FsTestEnumerateReparsePoints ( IN HANDLE hFile ) { IO_STATUS_BLOCK IoStatusBlock; NTSTATUS Status; FILE_REPARSE_POINT_INFORMATION ReparsePointInfo[4]; BOOLEAN ReturnSingleEntry = FALSE; FILE_INFORMATION_CLASS InfoClass = FileReparsePointInformation; Status = NtQueryDirectoryFile( hFile, NULL, // Event NULL, // ApcRoutine NULL, // ApcContext &IoStatusBlock, &ReparsePointInfo[0], sizeof(ReparsePointInfo), InfoClass, ReturnSingleEntry, NULL, // FileName TRUE ); // RestartScan if (Status == STATUS_SUCCESS) { FsTestDumpReparsePointIndexEntries( &ReparsePointInfo[0], IoStatusBlock.Information ); } while (Status == STATUS_SUCCESS) { RtlFillMemory( ReparsePointInfo, sizeof(ReparsePointInfo), 0x51 ); Status = NtQueryDirectoryFile( hFile, NULL, // Event NULL, // ApcRoutine NULL, // ApcContext &IoStatusBlock, &ReparsePointInfo[0], sizeof(ReparsePointInfo), InfoClass, ReturnSingleEntry, NULL, // FileName FALSE ); // RestartScan if (Status == STATUS_SUCCESS) { FsTestDumpReparsePointIndexEntries( &ReparsePointInfo[0], IoStatusBlock.Information ); } } printf( "\n" ); return FsTestDecipherStatus( Status ); } VOID _cdecl main ( int argc, char *argv[] ) { HANDLE hFile; char Buffer[80]; // // Get parameters // if (argc < 2) { printf("This program enumerates the reparse points (if any) for a volume (ntfs only).\n\n"); printf("usage: %s driveletter\n", argv[0]); return; } strcpy( Buffer, argv[1] ); strcat( Buffer, "\\$Extend\\$Reparse:$R:$INDEX_ALLOCATION" ); hFile = CreateFile( Buffer, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | SECURITY_IMPERSONATION, NULL ); if ( hFile == INVALID_HANDLE_VALUE ) { printf( "Error opening directory %s (dec) %d\n", Buffer, GetLastError() ); return; } printf( "\nUsing directory:%s\n", Buffer ); FsTestEnumerateReparsePoints( hFile ); CloseHandle( hFile ); return; }