windows-xp/Source/XPSP1/NT/base/fs/fastfat/fskd/fatkd.c

/*++

Copyright (c) 1992  Microsoft Corporation

Module Name:

    FatKd.c

Abstract:

    KD Extension Api for examining Fat specific data structures

Author:

    Tom Jolly    [tomjolly]   14-Sep-99
    (ntfskd) Keith Kaplan [KeithKa]    24-Apr-96
    Portions by Jeff Havens

Environment:

    User Mode.

Revision History:

--*/

#include "pch.h"

#undef FlagOn
#undef WordAlign
#undef LongAlign
#undef QuadAlign
#undef DebugPrint
#undef MAXULONGLONG

#define KDEXT
//#include "gentable.h"

#undef DebugTrace

#include "..\nodetype.h"
#include "..\..\cdfs\nodetype.h"
#include "..\..\udfs\nodetype.h"

#ifdef UDFS_RW_IN_BUILD
#include "..\..\udfsrw\nodetype.h"
#endif

#include "fatkd.h"
#include "cdfskd.h"
#include "udfskd.h"

//
//  Lookup table that tells how many clear bits (i.e., 0) there are in a byte
//

CONST UCHAR BitsClearTotal[] =
          { 8,7,7,6,7,6,6,5,7,6,6,5,6,5,5,4,
            7,6,6,5,6,5,5,4,6,5,5,4,5,4,4,3,
            7,6,6,5,6,5,5,4,6,5,5,4,5,4,4,3,
            6,5,5,4,5,4,4,3,5,4,4,3,4,3,3,2,
            7,6,6,5,6,5,5,4,6,5,5,4,5,4,4,3,
            6,5,5,4,5,4,4,3,5,4,4,3,4,3,3,2,
            6,5,5,4,5,4,4,3,5,4,4,3,4,3,3,2,
            5,4,4,3,4,3,3,2,4,3,3,2,3,2,2,1,
            7,6,6,5,6,5,5,4,6,5,5,4,5,4,4,3,
            6,5,5,4,5,4,4,3,5,4,4,3,4,3,3,2,
            6,5,5,4,5,4,4,3,5,4,4,3,4,3,3,2,
            5,4,4,3,4,3,3,2,4,3,3,2,3,2,2,1,
            6,5,5,4,5,4,4,3,5,4,4,3,4,3,3,2,
            5,4,4,3,4,3,3,2,4,3,3,2,3,2,2,1,
            5,4,4,3,4,3,3,2,4,3,3,2,3,2,2,1,
            4,3,3,2,3,2,2,1,3,2,2,1,2,1,1,0 };
            

VOID 
DumpStr( 
    IN ULONG FieldOffset,
    IN ULONG64 StringAddress,
    IN PUCHAR Label,
    IN BOOLEAN CrFirst,
    IN BOOLEAN Wide
    )
{
    WCHAR Buffer[512];
    ULONG64 StringChars = 0;    // *64
    USHORT DisplayLength;
    UNICODE_STRING String;

    ROE( GetFieldValue( StringAddress, "UNICODE_STRING", "Buffer", StringChars));
    ROE( GetFieldValue( StringAddress, "UNICODE_STRING", "Length", DisplayLength));
    ROE( GetFieldValue( StringAddress, "UNICODE_STRING", "MaximumLength", String.MaximumLength));

    if (DisplayLength > sizeof( Buffer))  {
    
        DisplayLength = sizeof(Buffer);
    }

    if (CrFirst)  {
    
        dprintf("\n");
    }
    
    if (DisplayLength)  {

        if (StringChars)  {

            ReadM( Buffer, StringChars, DisplayLength);
            String.Length = DisplayLength;
            String.Buffer = Buffer;
        }
        else {
            
            String.Buffer = (PWCHAR)"<<NULL buffer pointer>>";
            String.Length = 23;
            Wide = FALSE;
        }
    }
    else {

        String.Buffer = (PWCHAR)"<<empty>>";
        String.Length = 9;
        Wide = FALSE;
    }

    if (Wide)  {
    
        dprintf( "%s: (%03x/%03x) '%wZ'\n", 
                 Label,  DisplayLength, String.MaximumLength, 
                 &String );
    }
    else {
    
        dprintf( "%s: (%03x/%03x) '%Z'\n", 
                 Label,  DisplayLength, String.MaximumLength, 
                 &String );
    }
}


ULONG
Dt( IN UCHAR *Type,
    IN ULONG64 Addr,
    IN ULONG Recur,
    IN ULONG FieldInfoCount,
    IN FIELD_INFO FieldInfo[]
  )
{
    SYM_DUMP_PARAM Param;

    Param.size = sizeof( Param);
    Param.sName = Type;
    Param.Options = DBG_DUMP_RECUR_LEVEL(Recur);
    Param.addr = Addr;
    Param.listLink = NULL;
    Param.Context = NULL;
    Param.CallbackRoutine = NULL;
    Param.nFields = FieldInfoCount;
    Param.Fields = FieldInfo;

    return Ioctl( IG_DUMP_SYMBOL_INFO, &Param, Param.size);
}

//
// The help strings printed out
//

static LPSTR Extensions[] = {
    "FAT/CDFS/UDFS Debugger Extension Commands,  where...\n\n   [FS] => CD/UDF/FAT\n   -> in output denotes address of embedded structure\n",
    "  [FS]mcb            [addr] [1]       Dump MCB",
    "                                          [1] Dump out extent list",
    "  [FS]vdo            [addr]           Volume device object (from direct addr *OR* VCB addr)",
    "  fo                 [addr] [1]       Dump FileObject."
    "\n                                      [1] Also dump associated Fcb/Ccb structures",
    "                                          [2] dump SHARED_CACHE_MAP",
    " ",
    "  d                  [addr] [...]     Dump any tagged structure (any FS).  Understands...",
    "                                      VCB, CCB, fsDATA, IRPCONTEXT, IRPCONTEXTLITE,"
    "\n                                         FCB / SCB (** see command ouput for further options)",
    "                                      and (UDF ONLY) PCB, VMCB,",
    "                                      LCB - options",
    "                                          [1] dump associated FCB"
    " ",
    "                                      For structures without options,  second parameter is dump recurse level",
    " ",
    "  db                 [addr] [recur]   As !d,  but just a straight DT of the structure based on node type",
    " ",
    "  cdrawdirent        [addr] [count]   Dump a COUNT raw ISO9660 dirents starting at ADDR",
    " ",
    "  udficbsc           [addr]           (UDFS only) Dump an ICB_CONTEXT",
    "  udftag             [addr]           Dump out a UDF on disk format descriptor tag in detail (3/7.2)",
    "  ud                 [addr] [...]     Dump any on disc format UDF structure which has a descr.tag",
    "                                          Currently: PVD,AVDP,VDP,PD,LVD,FSD,FID,FE",
    "                                              [1] (FE) Dump allocation decriptors",
    " ",
    "  vmcb               [addr]           Use on pre 1.10.2000 builds (vmcb not tagged) rather than !d ",
    " ",
    "  tree               [addr]           (UDFS only) Dumps a summary of the F/Scb tree (names, ref counts) from",
    "                                                 the specified Scb down.  If a Vcb address is specified will",
    "                                                 dump from root down",
    " ",
    "  countclearbits     [addr] [bytes]   Count clear bits in mem range",
    "  countdwords        [addr] [dword]   Count occurences of dword in mem range",
    " ",
    " ",
    "  fshelp                              ...",
    0
};

STATE FoFlags[] = {

    {   FO_FILE_OPEN,                   FO_FILE_OPEN,                   "Open"  },
    {   FO_SYNCHRONOUS_IO,              FO_SYNCHRONOUS_IO,              "Synchronous" },
    {   FO_ALERTABLE_IO,                FO_ALERTABLE_IO,                "Alertable" },
    {   FO_NO_INTERMEDIATE_BUFFERING,   FO_NO_INTERMEDIATE_BUFFERING,   "NoIntermediateBuffering" },
    {   FO_WRITE_THROUGH,               FO_WRITE_THROUGH,               "WriteThrough"},
    {   FO_SEQUENTIAL_ONLY,             FO_SEQUENTIAL_ONLY,             "SequentialOnly"},
    {   FO_CACHE_SUPPORTED,             FO_CACHE_SUPPORTED,             "CacheSupported"},
    {   FO_NAMED_PIPE,                  FO_NAMED_PIPE,                  "NamedPipe"},
    {   FO_STREAM_FILE,                 FO_STREAM_FILE,                 "StreamFile"},
    {   FO_MAILSLOT,                    FO_MAILSLOT,                    "MailSlot"},
    {   FO_GENERATE_AUDIT_ON_CLOSE,     FO_GENERATE_AUDIT_ON_CLOSE,     "AuditOnClose"},
    {   FO_DIRECT_DEVICE_OPEN,          FO_DIRECT_DEVICE_OPEN,          "DirectDeviceOpen"},
    {   FO_FILE_MODIFIED,               FO_FILE_MODIFIED,               "Modified"},
    {   FO_FILE_SIZE_CHANGED,           FO_FILE_SIZE_CHANGED,           "SizeChanged"},
    {   FO_CLEANUP_COMPLETE,            FO_CLEANUP_COMPLETE,            "CleanupComplete"},
    {   FO_TEMPORARY_FILE,              FO_TEMPORARY_FILE,              "Temporary"},
    {   FO_DELETE_ON_CLOSE,             FO_DELETE_ON_CLOSE,             "DeleteOnClose"},
    {   FO_OPENED_CASE_SENSITIVE,       FO_OPENED_CASE_SENSITIVE,       "CaseSensitive"},
    {   FO_HANDLE_CREATED,              FO_HANDLE_CREATED,              "HandleCreated"},
    {   FO_FILE_FAST_IO_READ,           FO_FILE_FAST_IO_READ,           "FastIoRead"},
    {   FO_RANDOM_ACCESS,               FO_RANDOM_ACCESS,               "RandomAccess"},
    {   FO_FILE_OPEN_CANCELLED,         FO_FILE_OPEN_CANCELLED,         "OpenCancelled"},
    {   FO_VOLUME_OPEN,                 FO_VOLUME_OPEN,                 "VolumeOpen"},
    { 0 }
};

//
//  FSRTL Common header flags
//

STATE HeaderFlags[] = {

    {   FSRTL_FLAG_FILE_MODIFIED,          FSRTL_FLAG_FILE_MODIFIED,            "Modified"},
    {   FSRTL_FLAG_FILE_LENGTH_CHANGED,    FSRTL_FLAG_FILE_LENGTH_CHANGED,      "LengthChanged"},
    {   FSRTL_FLAG_LIMIT_MODIFIED_PAGES,   FSRTL_FLAG_LIMIT_MODIFIED_PAGES,     "LimitModPages"},
    {   FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX,   FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX,     "ModWrAcqMainEx"},
    {   FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH,   FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH,     "ModWrAcqMainSh"},
    {   FSRTL_FLAG_USER_MAPPED_FILE,       FSRTL_FLAG_USER_MAPPED_FILE,         "UserMapped"},
    {   FSRTL_FLAG_ADVANCED_HEADER,        FSRTL_FLAG_ADVANCED_HEADER,          "AdvancedHeader"},
    {   FSRTL_FLAG_EOF_ADVANCE_ACTIVE,     FSRTL_FLAG_EOF_ADVANCE_ACTIVE,       "EofAdvanceActive"},
    { 0 }
};

STATE HeaderFlags2[] = {

    {   FSRTL_FLAG2_DO_MODIFIED_WRITE,          FSRTL_FLAG2_DO_MODIFIED_WRITE,          "DoModWrite"},
    {   FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS,   FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS,   "FilterContexts"},
    {   FSRTL_FLAG2_PURGE_WHEN_MAPPED,          FSRTL_FLAG2_PURGE_WHEN_MAPPED,          "PurgeOnMap"},
    { 0 }
};


VOID
DumpList(
    IN ULONG64 RemoteListEntryAddress,
    IN ELEMENT_DUMP_ROUTINE ProcessElementRoutine,
    IN ULONG OffsetToContainerStart,
    IN BOOLEAN ProcessThisEntry,
    IN ULONG Options
    )
{
    LIST_ENTRY64 Entry;
    ULONG64 CurrentEntryRemoteAddress = 0;

    //
    //  Read the first LIST_ENTRY structure
    //

    ROE( !ReadListEntry( RemoteListEntryAddress, &Entry));

    //
    //  Scan through until we end up back at the  3start again.
    //
    
    while (CurrentEntryRemoteAddress != RemoteListEntryAddress)  {

        if (ProcessThisEntry)  {

            (ProcessElementRoutine)( CurrentEntryRemoteAddress - OffsetToContainerStart,  Options);
        }
        else  {
        
            ProcessThisEntry = TRUE;
        }
        
        CurrentEntryRemoteAddress = Entry.Flink;
        ROE( !ReadListEntry( CurrentEntryRemoteAddress, &Entry));
    }
}


/*
 * Dump structures
 */

typedef BOOLEAN (WINAPI *PENUM_PROCESS_CALLBACK)(PVOID ProcessAddress, PVOID Process, PVOID ThreadAddress, PVOID Thread);
typedef VOID (* ENUM_PROCESSES_FUNC)(PENUM_PROCESS_CALLBACK CallBack);


VOID
PrintState(STATE *ps, ULONG state)
{
    ULONG ul = 0;

    if (NULL == ps)  {
    
        dprintf(" << NULL flags supplied! >>\n");
        return;
    }
    
    while (ps->mask != 0)
    {
        ul |= ps->mask;
        if ((state & ps->mask) == ps->value)
        {
            dprintf(" %s", ps->pszname);
        }
        ps++;
    }
    state &= ~ul;
    if (state != 0)
    {
        dprintf(" +%lx!!", state);
    }
    dprintf("\n");
}

DUMP_ROUTINE( DumpVmcb);
DUMP_ROUTINE( DumpFileObject);    
DUMP_ROUTINE( DumpAnyStruct);


VOID
PrintHelp (
    VOID
    );

//
//  NULL dump function means just do DT with type.
//

NODE_TYPE_INFO_NEW NewNodeTypeCodes[] = {

    //  RO UDFS
    
    {   UDFS_NTC_DATA_HEADER,       "UDFS DATA",            "Udfs!UDF_DATA",       DumpUdfData},
    {   UDFS_NTC_VCB,               "UDFS VCB",             "Udfs!VCB",            DumpUdfVcb},
    {   UDFS_NTC_FCB_INDEX,         "UDFS FCB (INDEX)",     "Udfs!FCB",            DumpUdfFcb},
    {   UDFS_NTC_FCB_DATA,          "UDFS FCB (DATA) ",     "Udfs!FCB",            DumpUdfFcb},
    {   UDFS_NTC_FCB_NONPAGED,      "UDFS FCB (nonpaged)",  "Udfs!FCB_NONPAGED",   NULL},
    {   UDFS_NTC_CCB,               "UDFS CCB",             "Udfs!CCB",            DumpUdfCcb},
    {   UDFS_NTC_IRP_CONTEXT,       "UDFS IRPCONTEXT",      "Udfs!IRP_CONTEXT",    DumpUdfIrpContext},
    {   UDFS_NTC_IRP_CONTEXT_LITE,  "UDFS IRPCONTEXT LITE", "Udfs!IRP_CONTEXT_LITE",DumpUdfIrpContextLite},
    {   UDFS_NTC_LCB,               "UDFS LCB",             "Udfs!LCB",            DumpUdfLcb},
    {   UDFS_NTC_PCB,               "UDFS PCB",             "Udfs!PCB",            DumpUdfPcb},
    {   UDFS_NTC_VMCB,              "UDFS VMCB",            "Udfs!VMCB",           DumpVmcb},

#ifdef UDFS_RW_IN_BUILD

    //  RW UDFS,  same dump fn.
    
    {   UDFSRW_NTC_DATA_HEADER,     "UDFSRW DATA",            "Udfs!UDF_DATA",       DumpUdfData},
    {   UDFSRW_NTC_IRP_CONTEXT,     "UDFSRW IRPCONTEXT",      "Udfs!IRP_CONTEXT",    DumpUdfIrpContext},
    {   UDFSRW_NTC_IRP_CONTEXT_LITE,"UDFSRW IRPCONTEXT LITE", "Udfs!IRP_CONTEXT_LITE",DumpUdfIrpContextLite},
    {   UDFSRW_NTC_CCB,             "UDFSRW CCB",             "Udfs!CCB",            DumpUdfCcb},
    {   UDFSRW_NTC_LCB,             "UDFSRW LCB",             "Udfs!LCB",            DumpUdfLcb},
    {   UDFSRW_NTC_PCB,             "UDFSRW PCB",             "Udfs!PCB",            DumpUdfPcb},
    {   UDFSRW_NTC_VCB,             "UDFSRW VCB",             "Udfs!VCB",            DumpUdfVcb},
    {   UDFSRW_NTC_VMCB,            "UDFSRW VMCB",            "Udfs!VMCB",           DumpVmcb},
    {   UDFSRW_NTC_FCB,             "UDFSRW FCB",             "Udfs!FCB",            DumpUdfFcb}, // TODO: Dump stream SCB list?
    {   UDFSRW_NTC_FCB_NONPAGED,    "UDFSRW FCB (nonpaged)",  "Udfs!FCB_NONPAGED",   DumpUdfFcb},

    //  RW UDFS specific dump fn.
    
    {   UDFSRW_NTC_SCB_INDEX,       "UDFSRW SCB (INDEX)",     "Udfs!SCB_INDEX_TYPE", DumpUdfScb},
    {   UDFSRW_NTC_SCB_DATA,        "UDFSRW SCB (DATA) ",     "Udfs!SCB_DATA_TYPE",  DumpUdfScb},
    {   UDFSRW_NTC_SCB_NONPAGED,    "UDFSRW SCB (nonpaged)",  "Udfs!SCB_NONPAGED",   NULL},

#endif

    {   FAT_NTC_VCB,                "FAT VCB",              "FastFat!VCB",          DumpFatVcb},
    {   FAT_NTC_FCB,                "FAT FCB",              "FastFat!FCB",          DumpFatFcb},
    {   FAT_NTC_DCB,                "FAT DCB",              "FastFat!FCB",          DumpFatFcb},
    {   FAT_NTC_CCB,                "FAT CCB",              "FastFat!CCB",          DumpFatCcb},
    {   FAT_NTC_ROOT_DCB,           "FAT ROOT DCB",         "FastFat!FCB",          DumpFatFcb},
    {   FAT_NTC_IRP_CONTEXT,        "FAT IRP CONTEXT",      "FastFat!IRP_CONTEXT",  DumpFatIrpContext},
    {   FAT_NTC_DATA_HEADER,        "FAT DATA",             "FastFat!FAT_DATA",     NULL},

    {   CDFS_NTC_DATA_HEADER,       "CDFS DATA",            "Cdfs!CD_DATA",         NULL},
    {   CDFS_NTC_VCB,               "CDFS VCB",             "Cdfs!VCB",             DumpCdVcb},
    {   CDFS_NTC_FCB_PATH_TABLE,    "CDFS FCB (PATH TABLE)","Cdfs!FCB",             DumpCdFcb},
    {   CDFS_NTC_FCB_INDEX,         "CDFS FCB (INDEX)",     "Cdfs!FCB",             DumpCdFcb},
    {   CDFS_NTC_FCB_DATA,          "CDFS FCB (DATA) ",     "Cdfs!FCB",             DumpCdFcb},
    {   CDFS_NTC_FCB_NONPAGED,      "CDFS FCB (nonpaged)",  "Cdfs!FCB_NONPAGED",    NULL},
    {   CDFS_NTC_CCB,               "CDFS CCB",             "Cdfs!CCB",             DumpCdCcb},
    {   CDFS_NTC_IRP_CONTEXT,       "CDFS IRPCONTEXT",      "Cdfs!IRP_CONTEXT",     DumpCdIrpContext},
    {   CDFS_NTC_IRP_CONTEXT_LITE,  "CDFS IRPCONTEXT (LITE)","Cdfs!IRP_CONTEXT_LITE",NULL},


//    {   CACHE_NTC_SHARED_CACHE_MAP, "CC Shared Cache Map",  "nt!SHARED_CACHE_MAP",  NULL},

    {   0,                          "Undefined",            NULL,   NULL}
};


ULONG
SearchTypeCodeIndex (
    IN USHORT TypeCode,
    IN NODE_TYPE_INFO_NEW TypeCodes[]
    )

/*++

Routine Description:

    Guess at a structure's type code

Arguments:

    TypeCode - Type code from the data structure

Return Value:

    None

--*/

{
    int i = 0;

    while (TypeCodes[i].TypeCode != 0 &&
           TypeCodes[i].TypeCode != TypeCode) {

        i++;
    }

    return i;
}

DUMP_ROUTINE( DumpFileObject)
{
    ULONG Result;
    ULONG Flags, Offset;
    USHORT ObType;
    ULONG64 Adr, Scm;

    dprintf( "\nFileObject @ %I64X\n", Address );
    dprintf( "\n[ Options: 1 = dump FsContext & FsContext2,  2 = dump shared cache map ]\n");

    ReadM( &ObType, Address, sizeof( USHORT));

    if (ObType != IO_TYPE_FILE) {

        dprintf( "Invalid signature, probably not a file object" );
        return;
    }

    GetFieldValue( Address, "nt!FILE_OBJECT", "Flags", Flags);
    dprintf("\nFlags: ");
    PrintState( FoFlags, Flags);
    dprintf( "\n" );
    
    Dt( "nt!FILE_OBJECT", Address, 0, 0, NULL);

    dprintf( "\n" );
    GetFieldValue( Address, "nt!FILE_OBJECT", "SectionObjectPointer", Adr);

    if (Adr)  {

        Dt( "nt!SECTION_OBJECT_POINTERS", Adr, 0, 0, NULL);
    }

    GetFieldValue( Adr, "nt!SECTION_OBJECT_POINTERS", "SharedCacheMap", Scm);

    if (Options & 2)  {

        dprintf( "\n" );
        Dt( "nt!SHARED_CACHE_MAP", Scm, 0, 0, NULL);
    }
    
    if (Options & 1)  {
    
        GetFieldValue( Address, "nt!FILE_OBJECT", "FsContext", Adr);
        
        if (Adr) {

            DumpAnyStruct( Adr, 0, NULL);
        }
        
        GetFieldValue( Address, "nt!FILE_OBJECT", "FsContext2", Adr);

        if (Adr)  {
        
            DumpAnyStruct( Adr, 0, NULL);
        }
    }
    
    dprintf( "\n" );
}


DUMP_ROUTINE( DumpVmcb)
{
    ULONG Result;

    ULONG Offset;
    
    dprintf( "\nVMCB @ %I64X\n", Address );

    Dt( "udfs!VMCB", Address, 0, 0, NULL);
    
#ifdef UDFS_RW_IN_BUILD

    if (Options & 2)  {

        USHORT NodeType;

        //
        //  UDFS in Win2k had no nodetype field in the vmcb
        //
        
        if (!GetFieldValue( Address, "udfs!VMCB", "NodeTypeCode", NodeType))  {

            if (NodeType == UDFSRW_NTC_VMCB)  {

                //
                //  Summarize the dirty bitmap,  if
                //  these fields are present.
                //

                // TODO: Dump dirty blocks
            }
        }
    }
#endif

    if (Options & 1)  {

        dprintf("\n\nLbn->Vbn Mappings\n");
        ROE( GetFieldOffset( "udfs!VMCB", "LbnIndexed", &Offset));
        DumpLargeMcb( Address + Offset, Options, NULL);
                    
        dprintf("\nVbn->Lbn Mappings\n");
        ROE( GetFieldOffset( "udfs!VMCB", "VbnIndexed", &Offset));    
        DumpLargeMcb( Address + Offset, Options, NULL);
    }
    
    dprintf("\n");
}



VOID
CountClearBits(
    IN UINT64 Address,
    IN ULONG Length
    )
{
    UCHAR Buffer[2048];
    ULONG Result;
    ULONG ThisBytes;
    ULONG ClearBits = 0;
    ULONG CurrByte;
    
    // address, length

    dprintf("\nCounting clear bits in range 0x%p L 0x%x\n", Address, Length);

    while (Length)  {

        ThisBytes = (Length > sizeof( Buffer)) ? sizeof( Buffer) : Length;

        if ( !ReadMemory( (DWORD_PTR)Address, Buffer, ThisBytes, &Result) ) {
        
            dprintf( "Unable to read %d bytes at %p\n", ThisBytes, Address);
            return;
        }

        for (CurrByte = 0;  CurrByte < ThisBytes;  ++CurrByte)  {

            ClearBits += BitsClearTotal[ Buffer[CurrByte]];
        }

        Address += ThisBytes;
        Length -= ThisBytes;
    }

    dprintf("\n0x%x bits clear.\n\n", ClearBits);
}


VOID CountDwords(
    IN UINT64 Address,
    IN ULONG Length,
    IN ULONG Dword
    )
{
    ULONG Buffer[512];
    ULONG Result;
    ULONG ThisBytes;
    ULONG Count = 0;
    ULONG CurrByte;
    
    // address, length

    dprintf("\nCounting ocurrences of DWORD 0x%x in range 0x%p L 0x%x\n", Dword, Address, Length);

    if (Length & 3)  {
    
        dprintf("Length must be multiple of 4 bytes\n");
        return;
    }

    while (Length)  {

        ThisBytes = (Length > sizeof( Buffer)) ? sizeof( Buffer) : Length;

        if ( !ReadMemory( (DWORD_PTR)Address, Buffer, ThisBytes, &Result) ) {
        
            dprintf( "Unable to read %d bytes at %p\n", ThisBytes, Address);
            return;
        }

        for (CurrByte = 0;  CurrByte < (ThisBytes >> 2);  ++CurrByte)  {

            if (Buffer[ CurrByte] == Dword)  {
            
                ++Count;
            }
        }

        Address += ThisBytes;
        Length -= ThisBytes;
    }

    dprintf("\n0x%x found.\n\n", Count);

}



DUMP_ROUTINE( DumpAnyStruct)
/*++

Routine Description:

    Dump a tagged structure,  guessing based on node type code.

Arguments:

    Address - Gives the address of the structure

Return Value:

    None

--*/
{
    STRUCT_DUMP_ROUTINE Routine;
    ULONG TagAndSize,  *TagAndSizePtr, Result, Error;
    LONG InfoIndex;

    RM( Address, TagAndSize, TagAndSizePtr, PULONG, Result );

    //
    //  Find out what function should be used to dump the stucture (if we can)
    //

    InfoIndex = TypeCodeInfoIndex( (USHORT)(TagAndSize & 0xffff));
    Routine = NodeTypeDumpFunction( InfoIndex);

    if ( 0 == NewNodeTypeCodes[ InfoIndex].TypeCode)  {

        dprintf( "\nNode type %0x%04x unknown.\n", (USHORT)TagAndSize & 0xffff);
        return;
    }

    dprintf("\n%s @ 0x%I64X\n\n", NewNodeTypeCodes[InfoIndex].Text, Address);
    
    if (Routine)  {

        //
        //  And call it...
        //

        (Routine)(Address, Options, &NewNodeTypeCodes[InfoIndex]);
    }
    else {

        //
        //  No special routine - just DT it,  treating first parameter following
        //  address as level of recursion
        //

        Error = Dt( NewNodeTypeCodes[InfoIndex].TypeName, Address, Options, 0, NULL);

        if (Error)  {

            dprintf("Error %d from debugger when dumping structure\n", Error);
        }        
    }
}


DUMP_ROUTINE( DtAnyStruct)
/*++

Routine Description:

    Dump a tagged structure,  guessing based on node type code.

Arguments:

    Address - Gives the address of the structure

Return Value:

    None

--*/
{
    ULONG TagAndSize,  *TagAndSizePtr, Result;
    ULONG Error;
    LONG InfoIndex;
 
    RM( Address, TagAndSize, TagAndSizePtr, PULONG, Result );

    InfoIndex = TypeCodeInfoIndex( (USHORT)(TagAndSize & 0xffff));

    dprintf("\n%s @ 0x%X\n\n", NewNodeTypeCodes[InfoIndex].Text, Address);

    Error = Dt( NewNodeTypeCodes[InfoIndex].TypeName, Address, Options, 0, NULL);

    if (Error)  {

        dprintf("Error %d\n", Error);
    }
}

//
//  Entry points, parameter parsers, etc. below
//

VOID
ParseAndDump (
    IN PCHAR args,
    IN STRUCT_DUMP_ROUTINE DumpFunction,
    ULONG Processor,
    HANDLE hCurrentThread
    )

/*++

Routine Description:

    Parse command line arguments and dump an ntfs structure.

Arguments:

    Args - String of arguments to parse.

    DumpFunction - Function to call with parsed arguments.

Return Value:

    None

--*/

{
    CHAR StringStructToDump[1024];  // See other kd routines for size
    CHAR Dummy[24];
    LARGE_INTEGER StructToDump;
    LONG Options;

    //
    //  If the caller specified an address then that's the item we dump
    //

    StructToDump.QuadPart = 0;
    Options = 0;

    StringStructToDump[0] = '\0';
    
//dprintf("Args %s\n", args);

    sscanf(args,"%s %lx", StringStructToDump, &Options );

//dprintf("GetExpr %s\n", StringStructToDump);

    if (!GetExpressionEx( StringStructToDump, &StructToDump.QuadPart, NULL))  {

        dprintf("GetExpression failed\n");
        return;
    }
    
//dprintf("Getexpr returned %I64X\n", StructToDump.QuadPart);
    
    if (!StructToDump.QuadPart){
        dprintf("unable to get expression %s\n",StringStructToDump);
        return;
    }

    (*DumpFunction) ( StructToDump.QuadPart, Options, NULL );

    dprintf( "\n" );
}



VOID
PrintHelp (
    VOID
    )
{
    int i;

    for( i=0; Extensions[i]; i++ )
        dprintf( "   %s\n", Extensions[i] );
}

DECLARE_API( fshelp )

{
    UNREFERENCED_PARAMETER( args );
    UNREFERENCED_PARAMETER( dwProcessor );
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );
    UNREFERENCED_PARAMETER( hCurrentThread );

    PrintHelp();
}


DECLARE_API( d)
{
    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpAnyStruct, dwProcessor, hCurrentThread );
}


DECLARE_API( fo)
{
    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpFileObject, dwProcessor, hCurrentThread );
}


DECLARE_API( vmcb)
{
    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpVmcb, dwProcessor, hCurrentThread );
}

DECLARE_API( db )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DtAnyStruct, dwProcessor, hCurrentThread );
}


DECLARE_API( countclearbits)
{
    CHAR StringStructToDump[1024];  // See other kd routines for size
    UINT64 StructToDump;
    ULONG Length;

    //
    //  If the caller specified an address then that's the item we dump
    //

    StructToDump = 0;
    Length = 0;

    StringStructToDump[0] = '\0';

    sscanf(args,"%s %lx", StringStructToDump, &Length );

    if (!GetExpressionEx( StringStructToDump, &StructToDump, NULL ))  {
    
        dprintf("unable to get expression %s\n",StringStructToDump);
        return;
    }

    CountClearBits( StructToDump,  Length);
}


DECLARE_API( countdwords)
{
    CHAR StringStructToDump[1024];  // See other kd routines for size
    UINT64 StructToDump;
    ULONG Length;
    ULONG Dword;

    //
    //  If the caller specified an address then that's the item we dump
    //

    StructToDump = 0;
    Length = 0;

    StringStructToDump[0] = '\0';

    sscanf(args,"%s %lx %lx", StringStructToDump, &Length, &Dword);

    if (!GetExpressionEx( StringStructToDump, &StructToDump, NULL))  {
    
        dprintf("unable to get expression %s\n",StringStructToDump);
        return;
    }

    CountDwords( StructToDump,  Length, Dword);
}