windows-xp/Source/XPSP1/NT/base/fs/fastfat/fskd/udfs.c

#include "pch.h"
#include "udfskd.h"
#include "fatkd.h"

#include <ntddcdrm.h>
#include <ntdddisk.h>
#include <ntddscsi.h>

#include "..\..\udfs\nodetype.h"

#ifdef UDFS_RW_IN_BUILD
#include "..\..\udfsrw\nodetype.h"
#endif

#include "..\..\udfs\udf.h"
#include "..\..\udfs\udfstruc.h"
#include "..\..\udfs\udfdata.h"

//
//  13346/UDF on disc note type codes and dump routines
//


DUMP_ROUTINE( DumpUdfOnDiscIcbFile);
DUMP_ROUTINE( DumpUdfOnDiscFid);
DUMP_ROUTINE( DumpUdfOnDiscFsd);
DUMP_ROUTINE( DumpUdfOnDiscLvol);
DUMP_ROUTINE( DumpUdfOnDiscPartDesc);
DUMP_ROUTINE( DumpUdfOnDiscVdp);
DUMP_ROUTINE( DumpUdfOnDiscAnchor);
DUMP_ROUTINE( DumpUdfOnDiscPvd);
DUMP_ROUTINE( DumpUdfOnDiscIcbExtFile);


static NODE_TYPE_INFO_NEW UdfOnDiscTypeCodes[] = {
    {   DESTAG_ID_NSR_PVD,          "(3/10.1) PVD",             NULL, DumpUdfOnDiscPvd },
    {   DESTAG_ID_NSR_ANCHOR,       "(3/10.2) AVDP",            NULL, DumpUdfOnDiscAnchor },
    {   DESTAG_ID_NSR_VDP,          "(3/10.3) VDP",             NULL, DumpUdfOnDiscVdp },
    {   DESTAG_ID_NSR_IMPUSE,       "(3/10.4) IUVD",            NULL, NULL },
    {   DESTAG_ID_NSR_PART,         "(3/10.5) PD",              NULL, DumpUdfOnDiscPartDesc },
    {   DESTAG_ID_NSR_LVOL,         "(3/10.6) LVD",             NULL, DumpUdfOnDiscLvol },
    {   DESTAG_ID_NSR_UASD,         "(3/10.8) UASD",            NULL, NULL },
    {   DESTAG_ID_NSR_TERM,         "(3/10.9) TD",              NULL, NULL },
    {   DESTAG_ID_NSR_LVINTEG,      "(3/10.10) LVID",           NULL, NULL },

    {   DESTAG_ID_NSR_FSD,          "(4/14.1) FSD",             NULL, DumpUdfOnDiscFsd },
    {   DESTAG_ID_NSR_FID,          "(4/14.4) FID",             NULL, DumpUdfOnDiscFid },
    {   DESTAG_ID_NSR_ALLOC,        "(4/14.5) AED",             NULL, NULL },
    {   DESTAG_ID_NSR_ICBIND,       "(4/14.7) ICB Indirect",    NULL, NULL },
    {   DESTAG_ID_NSR_ICBTRM,       "(4/14.8) ICB Terminal",    NULL, NULL },
    {   DESTAG_ID_NSR_FILE,         "(4/14.9) FE",              NULL, DumpUdfOnDiscIcbFile },
    {   DESTAG_ID_NSR_EXT_FILE,     "(4/14.17) EXT FE",         NULL, DumpUdfOnDiscIcbExtFile },
    {   DESTAG_ID_NSR_EA,           "(4/14.10) EAH",            NULL, NULL },
    {   DESTAG_ID_NSR_UASE,         "(4/14.11) USE",            NULL, NULL },
    {   DESTAG_ID_NSR_SBP,          "(4/14.12) SBD",            NULL, NULL },
    {   DESTAG_ID_NSR_PINTEG,       "(4/14.13) PI",             NULL, NULL },
    
    {   0, "UNKNOWN/NotSpec", NULL }
};

static PCHAR IcbStrategies[] = {
    "NOTSPEC",  
    "4/A.2 TREE",  
    "4/A.3 MASTER",  
    "4/A.4 BALTREE",  
    "4/A.5 DIRECT"
    };

#define MAX_VALID_ICB_STRAT 4

static PCHAR IcbFileTypes[] = {
    "NOTSPEC",
    "UASPACE",
    "PINTEG",
    "INDIRECT",
    "DIRECTORY",
    "FILE",
    "BLOCKDEV",
    "CHARDEV",
    "XA",
    "FIFO",
    "SOCKET",
    "TERMINAL",
    "PATHLINK",
    "STREAMDIR"
    };

#define MAX_VALID_ICB_TYPE 13

static STATE UdfIcbTagFlags[] = {

    {   ICBTAG_F_ALLOC_MASK,        ICBTAG_F_ALLOC_SHORT,       "ShortAlloc"},
    {   ICBTAG_F_ALLOC_MASK,        ICBTAG_F_ALLOC_LONG,        "LongAlloc"},
    {   ICBTAG_F_ALLOC_MASK,        ICBTAG_F_ALLOC_EXTENDED,    "ExtAlloc"},
    {   ICBTAG_F_ALLOC_MASK,        ICBTAG_F_ALLOC_IMMEDIATE,   "ImmAlloc"},

    {   ICBTAG_F_SORTED,            ICBTAG_F_SORTED,            "Sorted(4/8.6.1)"},
    {   ICBTAG_F_NO_RELOCATE,       ICBTAG_F_NO_RELOCATE,       "Nonrelocatable"},
    {   ICBTAG_F_ARCHIVE,           ICBTAG_F_ARCHIVE,           "Archive"},
    {   ICBTAG_F_SETUID,            ICBTAG_F_SETUID,            "SetUid"},
    {   ICBTAG_F_SETGID,            ICBTAG_F_SETGID,            "SetGid"},
    {   ICBTAG_F_STICKY,            ICBTAG_F_STICKY,            "Sticky"},
    {   ICBTAG_F_CONTIGUOUS,        ICBTAG_F_CONTIGUOUS,        "Contiguous"},
    {   ICBTAG_F_SYSTEM,            ICBTAG_F_SYSTEM,            "System"},
    {   ICBTAG_F_TRANSFORMED,       ICBTAG_F_TRANSFORMED,       "Transformed"},
    {   ICBTAG_F_MULTIVERSIONS,     ICBTAG_F_MULTIVERSIONS,     "MultiVersions"},
    {   0}
};


static STATE UdfFidFlags[] = {

    {   NSR_FID_F_HIDDEN,           NSR_FID_F_HIDDEN,       "Hidden"},
    {   NSR_FID_F_DIRECTORY,        NSR_FID_F_DIRECTORY,    "Directory"},
    {   NSR_FID_F_DELETED,          NSR_FID_F_DELETED,      "Deleted"},
    {   NSR_FID_F_PARENT,           NSR_FID_F_PARENT,       "Parent"},
    {   NSR_FID_F_META,             NSR_FID_F_META,         "MetadataStream"},
    { 0 }
};


//  LCB summary dump used by F/Scb tree dump

VOID
UdfSummaryLcbDumpRoutine(
    IN ULONG64 RemoteAddress,
    IN LONG Options
    )
{
    USHORT Type;
    ULONG64 Scb;
    ULONG Offset;

    ReadM( &Type, RemoteAddress, sizeof( Type));

#ifdef UDFS_RW_IN_BUILD
    if (( UDFS_NTC_LCB != Type) && (UDFSRW_NTC_LCB != Type)) {
#else
    if ( UDFS_NTC_LCB != Type) {
#endif
        dprintf( "Not a UDF LCB @ %08x\n", RemoteAddress);
        return;
    }
    
    if (Options & 2)  {
    
        DumpUdfLcb( RemoteAddress, (Options & 8) ? 1 : 0, &NewNodeTypeCodes[ TypeCodeInfoIndex( Type)]);
    }
    else  {

        GetFieldValue( RemoteAddress, 
                       "udfs!_LCB", 
                       (UDFS_NTC_LCB != Type) ? "ChildScb" : "ChildFcb", 
                       Scb);

        dprintf( "\nUDF LCB @ %I64x   Child F/Scb: %I64x  ",  RemoteAddress, Scb);

        GetFieldOffset( "udfs!_LCB", "FileName", &Offset);
        DumpStr( Offset, RemoteAddress + Offset, "FileName", FALSE, TRUE);
    }
}


// OK
DUMP_ROUTINE( DumpUdfFcb)

/*++

Routine Description:

    Dump a specific fcb.

Arguments:

    Address - Gives the address of the fcb to dump

Return Value:

    None

--*/

{
    ULONG Result;
    UINT64 NonP;
    ULONG Flags, FcbState;
    ULONG Offset, Offsetb;

    ROE( GetFieldValue( Address, InfoNode->TypeName, "FcbState", FcbState));

    //
    //  For R/O udfs,  dump the FCB flags and common header flags.  RW FCB
    //  is less interesting,  nothing to dump.
    //
    
    if (!NTC_IS_UDFS_RW( InfoNode->TypeCode))  {
    
        dprintf("[ Option flags:  1 = list children,  2 = List parent links,  4 = dump Mcb ]\n\n");

        dprintf("FcbState: ");
        PrintState( UdfFcbState, FcbState );

        ROE( GetFieldValue( Address, InfoNode->TypeName, "Flags", Flags));
        dprintf("\nHeader.Flags: ");
        PrintState( HeaderFlags, Flags );

        ROE( GetFieldValue( Address, InfoNode->TypeName, "Flags2", Flags));    // TODO:
        dprintf("\nHeader.Flags2: ");
        PrintState( HeaderFlags2, Flags );
        dprintf("\n");
    }
    
    //
    //  Having established that this looks like an fcb, let's dump the
    //  interesting parts.
    //
    

    Dt( InfoNode->TypeName, Address, 0, 0, NULL);

    // TODO: Does the above dump the union data/index part?

    dprintf("\n");
    
    //
    //  Nonpaged portion
    //
    
    ROE( GetFieldValue( Address, InfoNode->TypeName, "FcbNonpaged", NonP));

    if (NonP)  {
    
        dprintf("\nNonpaged portion @ %I64x\n\n",NonP);

        Dt( "Udfs!FCB_NONPAGED", NonP, 0, 0, NULL);
    }
    
    //
    //  R/O UDFS:  Dump all Fcb children 
    //

    if (!NTC_IS_UDFS_RW( InfoNode->TypeCode))  {
    
        if (( Options & 1)  && (UDFS_NTC_FCB_INDEX == InfoNode->TypeCode)) {

            dprintf("\nChild Lcb list\n");

            ROE( GetFieldOffset( "udfs!_FCB", "ChildLcbQueue", &Offset));
            ROE( GetFieldOffset( "udfs!_LCB", "ParentFcbLinks", &Offsetb));
            
            DumpList( Address + Offset,
                      UdfSummaryLcbDumpRoutine,
                      Offsetb,
                      FALSE,
                      0 );
        }

        if (Options & 2)  {
        
            dprintf("\nParent Lcb list\n");
            
            ROE( GetFieldOffset( "udfs!_FCB", "ParentLcbQueue", &Offset));
            ROE( GetFieldOffset( "udfs!_LCB", "ChildFcbLinks", &Offsetb));
            
            DumpList( Address + Offset,
                      UdfSummaryLcbDumpRoutine,
                      Offsetb,
                      FALSE,
                      0 );
        }
        
        if (Options & 4)  {
        
            if (FcbState & FCB_STATE_MCB_INITIALIZED)  {

                ROE( GetFieldOffset( "udfs!_FCB", "Mcb", &Offset));
                dprintf("\nMcb\n");
                DumpLargeMcb( Address+Offset, 0, NULL);
            }
        }
    }
    else {

        //
        // TODO: RW UDFS - dump attached stream Scb list?
        //
    }
    
    dprintf( "\n" );
}


// OK
DUMP_ROUTINE( DumpUdfLcb)
{
    ULONG Flags;
    ULONG Ntc;

    ROE( GetFieldValue(  Address, InfoNode->TypeName, "NodeTypeCode", Ntc));
    ROE( GetFieldValue(  Address, InfoNode->TypeName, "Flags", Flags));
    
    dprintf("Lcb.Flags: ");
    PrintState( NTC_IS_UDFS_RW(Ntc) ? UdfRwLcbFlags : UdfLcbFlags, Flags );
    dprintf( "\n");

    Dt( InfoNode->TypeName, Address, Options, 0, NULL); // TODO: Expand parent list?

    if (Options >= 1)  {

        ULONG64 Scb;

        dprintf("\n\nChild S/Fcb:\n");

        ROE( GetFieldValue( Scb, 
                            InfoNode->TypeName, 
                            (Ntc == UDFS_NTC_LCB) ? "ChildFcb" : "ChildScb",
                            Scb));
                            
        DumpAnyStruct( Scb, 0, NULL);
    }
}


// OK
DUMP_ROUTINE( DumpUdfPcb)
{
    ULONG Result;
    ULONG Offset;
    ULONG Current = 0;
    ULONG Partitions;
    ULONG Flags;
    ULONG Size;

    ROE( GetFieldValue(  Address, InfoNode->TypeName, "Flags", Flags));

    dprintf( "\nPcb.Flags: ");
    PrintState( UdfPcbFlags, Flags);

    Dt( InfoNode->TypeName, Address, Options, 0, NULL);

    ROE( GetFieldValue(  Address, InfoNode->TypeName, "Partitions", Partitions));

    if (Partitions > 5)  {

        dprintf("Bogus partition count %d\n", Partitions);
        return;
    }

    ROE( GetFieldOffset( InfoNode->TypeName, "Partition", &Offset));
    Address += Offset;

    Size = GetTypeSize( "Udfs!PARTITION");

    for (Current = 0;  Current < Partitions; ++Current)  {

        dprintf("\nRef: %d\n", Current);
        
        Dt( "Udfs!PARTITION", Address, Options, 0, NULL);

        Address += Size;
    }
}

// OK
DUMP_ROUTINE( DumpUdfCcb)
{
    ULONG Flags;
    ULONG Ntc;

    ROE( GetFieldValue(  Address, InfoNode->TypeName, "NodeTypeCode", Ntc));
    ROE( GetFieldValue(  Address, InfoNode->TypeName, "Flags", Flags));
    
    dprintf( "Ccb.Flags: ");
    PrintState( NTC_IS_UDFS_RW(Ntc) ? UdfRwCcbFlags : UdfCcbFlags, Flags);
    dprintf( "\n");

    Dt( InfoNode->TypeName, Address, Options, 0, NULL);
}

// OK
DUMP_ROUTINE( DumpUdfIrpContextLite)
{

    Dt( InfoNode->TypeName, Address, Options, 0, NULL);

    // *** FIXME - dump delayed close queue
}

// OK
DUMP_ROUTINE( DumpUdfIrpContext)
{
    ULONG Flags;
    ULONG Ntc;

    ROE( GetFieldValue(  Address, InfoNode->TypeName, "NodeTypeCode", Ntc));
    ROE( GetFieldValue(  Address, InfoNode->TypeName, "Flags", Flags));
    
    dprintf("\nIrpContext Flags: ");
    PrintState( NTC_IS_UDFS_RW(Ntc) ? UdfRwIrpContextFlags : UdfIrpContextFlags, Flags );
    dprintf( "\n");

    Dt( InfoNode->TypeName, Address, Options, 0, NULL);
}


// OK
DUMP_ROUTINE( DumpUdfIcbSearchContext)
{
    Dt( "udfs!_ICB_SEARCH_CONTEXT", Address, 1, 0, NULL);   // TODO: expand current/active only
}


// OK
DUMP_ROUTINE( DumpLargeMcb)
{
    ULONG PairCount = 0, EntryCount = 0, Result;
    ULONG64 Mapping;
    PMAPPING Mappings, Current;
    ULONG PrevVbn = 0;
    
    dprintf("\nLARGE MCB @ %I64X\n", Address);    

    Dt( "udfs!LARGE_MCB", Address, 0,0, NULL);
    dprintf("\n");
    
    ROE( GetFieldValue( Address,  "udfs!LARGE_MCB", "PairCount", PairCount));
    ROE( GetFieldValue( Address,  "udfs!LARGE_MCB", "Mapping", Mapping));
    
    Mappings = calloc( PairCount, sizeof( MAPPING));

    if (NULL == Mappings)  {

        dprintf("Failed to allocate space for %d mappings\n", PairCount);
        return;
    }

    if (!ReadMemory( Mapping,  Mappings, sizeof( MAPPING)*PairCount, &Result ))  {
    
        dprintf("Unable to read mapping info @ %08x", Mapping);
        return;
    }

    Current = Mappings;
    
    for ( Current = Mappings;  
          EntryCount < PairCount;  
          ++EntryCount, ++Current)  {

        dprintf("(%08x,%08x) -> %08x\n", PrevVbn, Current->NextVbn - PrevVbn, Current->Lbn);    
        PrevVbn = Current->NextVbn;
    }

    dprintf("\n");
    free( Mappings);
}


// OK
DUMP_ROUTINE( DumpUdfVcb)
{    
    ULONG Flags;
    ULONG Ntc;
    FIELD_INFO Alloc[] = { //{ ".", NULL, 0,  0, 0, NULL},
                           { "AllocSup.", NULL, 0,  DBG_DUMP_FIELD_RECUR_ON_THIS,0, NULL}
                         };

    ROE( GetFieldValue(  Address, InfoNode->TypeName, "NodeTypeCode", Ntc));
    ROE( GetFieldValue(  Address, InfoNode->TypeName, "VcbState", Flags));
    
    dprintf("VcbState: ");
    PrintState( NTC_IS_UDFS_RW(Ntc) ? UdfRwVcbStateFlags : UdfVcbStateFlags, Flags );
    dprintf("\n");

    Dt( InfoNode->TypeName, Address, Options, 0, NULL);
    dprintf("\n");

    //
    //  For RW UDFS,  expand some more fields.
    //
    
    if (NTC_IS_UDFS_RW( Ntc))  {

        Dt( InfoNode->TypeName, Address, Options, 1, Alloc);
    }
}


DUMP_ROUTINE( DumpUdfVdo)
{
    USHORT Ntc;
    PUSHORT pNtc;
    ULONG Offset;
    ULONG Result;

    RM( Address, Ntc, pNtc, PUSHORT, Result );
    
#ifndef UDFS_RW_IN_BUILD
    if (UDFS_NTC_VCB == Ntc)  {
#else
    if ((UDFS_NTC_VCB == Ntc) || (UDFSRW_NTC_VCB == Ntc))  {
#endif
        //
        //  Looks like we've been given a VCB pointer.  Work back to the containing vdo.
        //

        dprintf("Backtracking to containing VDO from VCB...");

        ROE( GetFieldOffset( "udfs!VOLUME_DEVICE_OBJECT", "Vcb", &Offset));

        Address -= Offset;
    }
    
    dprintf( "\nUDFS Volume device object @ %08lx\n",  Address );

    Dt( "Udfs!VOLUME_DEVICE_OBJECT", Address, Options, 0, NULL);    
}


VOID
DumpTreeLcb(
    IN ULONG64 Lcb,
    IN LONG RecurLevel
    );

static UCHAR RecurDumpBuf[512];
static ULONG __i;

#define DoIndent(I)  for ( __i = 0;  __i < (I);  ++__i) RecurDumpBuf[__i] = ' ';  \
                   RecurDumpBuf[ __i] = 0;                                       \
                   dprintf( RecurDumpBuf);

static WCHAR RDumpNameBuf[512];


//
//  Called from outside for "main" stream SCBs,
//  recursive for stream directories / stream Scbs
//

// OK
static VOID
DumpTreeRecur (
    IN ULONG64 Scb,
    IN ULONG RecurLevel
    )
{
    ULONG64 Fcb, SdScb, Lcb;
    ULONG Ur, Cc, R, Offset, Offsetb, Error, Flags = 0;
    USHORT Type, Indent, Lc;
    UNICODE_STRING Name;
    PUCHAR TypeString = NULL;
    BOOLEAN Stream, Index, StreamDir, Data;

    if ((*ExtensionApis.lpCheckControlCRoutine)())  {
    
        dprintf("CTRL+C - aborting\n");
        
        // Raise out - could be looping in many levels...

        *((PULONG)(0)) = 0;
        return;    
    }

    if (RecurLevel > 100)  {

        dprintf("*** Recursed more than 100 deep - aborting ***\n");
        return;
    }
    
    //
    //  dump S/Fcb vitals
    //

    Indent = ((USHORT)RecurLevel) << 1;

    if (0 == Scb)  {

        DoIndent( Indent);
        dprintf("Called with NULL F/Scb\n");
        return;
    }

    ReadM( &Type, Scb, sizeof( Type));

    if (!NTC_IS_UDFS_RW( Type))  {

        Stream = StreamDir = FALSE;
        TypeString = "Udfs!FCB";
        Fcb = 0;

        Index = Type == UDFS_NTC_FCB_INDEX;
        Data  = Type == UDFS_NTC_FCB_DATA;
    }
    else {

#ifdef UDFS_RW_IN_BUILD

        TypeString = "Udfs!SCB";

        ROE( GetFieldValue( Scb, "udfs!_SCB", "ScbState", Flags));

        Stream = 0 != (Flags & 0x10);  // scb_state_secondary_stream
        StreamDir = 0 != (Flags & 0x08); // stream_directory

        if ((Error = GetFieldValue( Scb, "udfs!_SCB", "Fcb", Fcb)) || (0 == Fcb))  {

            DoIndent( Indent);
            
            if (Error)  {
            
                dprintf("Error reading Fcb from Scb %d\n", Error);
            }
            else {
            
                dprintf("<NULL Fcb ptr>\n");
            }            
        }
        
        Index = NodeIsUdfsRwIndex( Type);
        Data  = NodeIsUdfsRwData( Type);
#else
        dprintf("This FSKD build does not support R/W UDFS structures\n");
        return;
#endif
    }
    
    //
    //  If this is a new file,  as opposed to a stream of a file we've already dumped,
    //  them dump out the FCB and follow the stream directory.  For R/O UDFS there's
    //  nothing to do here (No streams & F/Scb split)
    //

#ifdef UDFS_RW_IN_BUILD
    
    if (!Stream && NTC_IS_UDFS_RW( Type))  {

        DoIndent( Indent);
        dprintf("FCB     @ 0x%I64x\n", Fcb);
    
        if ((0 != Fcb) && !(Error = GetFieldValue( Fcb, "udfs!_FCB", "StreamDirectoryScb", SdScb)) &&
            (0 != SdScb))  {

            //
            // TODO: Count SCBs in chain,  verify match scbs under streamdir?
            //
            
            ROE( GetFieldValue( SdScb, "udfs!_SCB", "NodeTypeCode", Type));

            if (NodeIsUdfsRwIndex(Type))  {

                //
                //  Stream dir - dump details than trawl through LCBs
                //

                ROE( GetFieldValue( SdScb, "udfs!_SCB", "ScbUserReference", Ur)); // TODO: Don't bail here!
                ROE( GetFieldValue( SdScb, "udfs!_SCB", "ScbReference", R));
                ROE( GetFieldValue( SdScb, "udfs!_SCB", "ScbCleanup", Cc));

                DoIndent( Indent);
                dprintf("SCB     @ 0x%I64X (%X,%X,%X) (-STREAMDIR-) \n", SdScb, Cc, Ur, R);

                //
                //  Follow all Lcbs and recursively dump tree
                //

                ROE( GetFieldOffset( "udfs!_SCB", "ChildLcbQueue", &Offset));
                ROE( GetFieldOffset( "udfs!_LCB", "ParentScbLinks", &Offsetb));

                DumpList( SdScb + Offset,
                          DumpTreeLcb,
                          Offsetb,
                          FALSE,
                          RecurLevel + 1);
            }
            else {
            
                DoIndent( Indent);
                dprintf("Invalid StreamDir Scb nodetypecode %l\n", Type);
            }
        }
        else {

            DoIndent( Indent);
            
            if (Error)  {
            
                dprintf("Error reading streamdirscb from fcb %d\n", Error);
            }
            else {
            
                dprintf("<NULL stream dir or Fcb>\n");
            }
        }
    }
#endif
    
    if (!StreamDir)  {

        // old (win2k) udfs didn't have this field.  Ignore failure.
        
        Lc = 0xffff;
        GetFieldValue( Scb, TypeString, "LinkCount", Lc);

        if (NTC_IS_UDFS_RW( Type))  {
        
#ifdef UDFS_RW_IN_BUILD        
            ROE( GetFieldValue( Scb, TypeString, "ScbUserReference", Ur));
            ROE( GetFieldValue( Scb, TypeString, "ScbReference", R));
            ROE( GetFieldValue( Scb, TypeString, "ScbCleanup", Cc));
#endif
        }
        else {
            ROE( GetFieldValue( Scb, TypeString, "FcbUserReference", Ur));
            ROE( GetFieldValue( Scb, TypeString, "FcbReference", R));
            ROE( GetFieldValue( Scb, TypeString, "FcbCleanup", Cc));
        }
        
        if (Index)  {

            //
            //  Index - dump details then trawl Lcbs
            //

            DoIndent( Indent);
            dprintf("F/SCB (-DIR-) @ 0x%I64X (%d,%d,%d - %d)\n", Scb, Cc, Ur, R, Lc);

            if (NTC_IS_UDFS_RW( Type) && (0 != Fcb))  {

                if (!GetFieldValue( Fcb, "udfs!_FCB", "DefaultStreamScb", SdScb))  {

                    if (SdScb != Scb)  {

                        DoIndent(Indent);
                        dprintf("INCONSISTENT - Scb->Fcb->DefaultStreamScb != Scb\n");
                    }
                }
            }

            if (Stream)  {
            
                DoIndent( Indent);
                dprintf("ILLEGAL - secondary stream is index\n");
            }

            //
            //  Follow all Lcbs and recursively dump tree
            //

            ROE( GetFieldOffset( TypeString, "ChildLcbQueue", &Offset));
            ROE( GetFieldOffset( "udfs!_LCB", 
                                 NTC_IS_UDFS_RW( Type) ? "ParentScbLinks" : "ParentFcbLinks",
                                 &Offsetb));

            DumpList( Scb + Offset,
                      DumpTreeLcb,
                      Offsetb,
                      FALSE,
                      RecurLevel + 1);                      
        }
        else if (Data)  {

            //
            //  File - dump details
            //
            
            DoIndent( Indent);
            dprintf("F/SCB (-DATA-) @ 0x%I64X (%d,%d,%d - %d)\n", Scb, Cc, Ur, R, Lc);
        }
        else {
        
            DoIndent( Indent);
            dprintf("Invalid F/Scb nodetypecode %d\n", Type);
        }
    }
}

//
//  Dump an LCB and all below it.
//

// OK
VOID
DumpTreeLcb(
    IN ULONG64 Lcb,
    IN LONG RecurLevel
    )
{
    ULONG64 Scb;
    ULONG Offset;
    ULONG Ntc;
    ULONG Ref;

    ROE( GetFieldValue( Lcb, "udfs!_LCB", "NodeTypeCode", Ntc));

#ifdef UDFS_RW_IN_BUILD
    if (( UDFS_NTC_LCB != Ntc) && (UDFSRW_NTC_LCB != Ntc))  {
#else
    if ( UDFS_NTC_LCB != Ntc)  {
#endif
        dprintf( "Not a UDF LCB @ %I64x - list corrupt\n", Lcb);
        return;
    }

    GetFieldValue( Lcb, 
                   "udfs!_LCB", 
                   NTC_IS_UDFS_RW( Ntc) ? "ChildScb" : "ChildFcb",
                   Scb);

    ROE( GetFieldValue( Lcb, "udfs!_LCB", "Reference", Ref));

    DoIndent( ((ULONG)RecurLevel) << 1);
    dprintf( "LCB @ %I64x  (Ref: %d)  Child F/Scb: %I64x ",  Lcb, Ref, Scb);

#ifdef UDFS_RW_IN_BUILD
    if (NTC_IS_UDFS_RW( Ntc))  {
    
        ROE( GetFieldValue( Lcb, "udfs!_LCB", "Flags", Ref));
        
        if (LcbDeleted( Ref))  {
        
            dprintf(" *DEL*  ");
        }
    }
#endif

    GetFieldOffset( "udfs!_LCB", "FileName", &Offset);
    DumpStr( Offset, Lcb+Offset, "Name", FALSE, TRUE);



    DumpTreeRecur( Scb, (ULONG)(RecurLevel + 1));
}


void 
DumpCloseQueue( 
    IN ULONG64 Vcb
    )
{
    ULONG64 UdfData; 
    ULONG Offset;

//    ROE( GetFieldOffset( "udfs!", "UdfData", &Offset));
   
//    ROE( GetFieldValue( 0, "Udfs!UdfData", NULL, UdfData));
        
    dprintf("\nDelayed closes on Vcb %I64X\n", Vcb);

    dprintf("NOT IMPLEMENTED\n");
}

// OK
VOID
SummariseIrpContextLite(
    IN ULONG64 RemoteAddress,
    IN LONG Options
    )
{
    ULONG64 Scb;
    USHORT Type;

    ReadM( &Type, RemoteAddress, sizeof( Type));

    ROE( GetFieldValue( RemoteAddress, 
                        "udfs!_IRP_CONTEXT_LITE", 
                        NTC_IS_UDFS_RW( Type) ? "Scb" : "Fcb", Scb));

    dprintf("  0x%I64x\n", Scb);
}

// OK
VOID
SummariseIrpContext(
    IN ULONG64 RemoteAddress,
    IN LONG Options
    )
{
    ULONG64 Irp;

    ROE( GetFieldValue( RemoteAddress, "udfs!_IRP_CONTEXT", "Irp", Irp));

    dprintf("  0x%I64x\n", Irp);
}

// OK
DUMP_ROUTINE( DumpUdfData)
{
    ULONG Count, Offset, LinkOffset;

    Dt( "udfs!UDF_DATA", Address, Options, 0, NULL);

    ROE( GetFieldValue( Address, "udfs!_UDF_DATA", "DelayedCloseCount", Count));

    if (Count)  {
        
        dprintf("\nSCBs on Delayed Close Queue (%d entries)\n", Count);

        ROE( GetFieldOffset( "udfs!_UDF_DATA", "DelayedCloseQueue", &Offset));
        ROE( GetFieldOffset( "udfs!_IRP_CONTEXT_LITE", "DelayedCloseLinks", &LinkOffset));

        DumpList( Address+Offset, SummariseIrpContextLite, LinkOffset, FALSE, 0);
    }

    dprintf(" \n");
    
    GetFieldValue( Address, "udfs!_UDF_DATA", "AsyncCloseCount", Count);

    if (Count)  {

        dprintf("\nF/SCBs on Async Close Queue (%d entries)\n", Count);

        ROE( GetFieldOffset( "udfs!_UDF_DATA", "AsyncCloseQueue", &Offset));
        ROE( GetFieldOffset( "udfs!_IRP_CONTEXT", "WorkQueueItem.List", &LinkOffset));
        
        DumpList( Address+Offset, SummariseIrpContext, LinkOffset, FALSE, 0);
    }
    
    dprintf(" \n");
}

// OK
DUMP_ROUTINE( DumpTreeSummary)
{
    ULONG64 RootFcbAddr, Scb, Vcb = 0;
    ULONG Error;
    USHORT Type;
    
    ReadM( &Type, Address, sizeof( Type));

#ifdef UDFS_RW_IN_BUILD
    if ((UDFS_NTC_VCB == Type) || (UDFSRW_NTC_VCB == Type) ) {
#else
    if (UDFS_NTC_VCB == Type)  {
#endif        
        Error = GetFieldValue( Address, 
                               "udfs!_VCB",
                               NTC_IS_UDFS_RW( Type) ? "RootIndexScb" : "RootIndexFcb", 
                               Scb);
        if (Error)  {
        
            dprintf( "Error %d reading rootindex f/scb addr\n", Error);
            return;
        }

        Vcb = Address;
        dprintf( "\nSummary tree for UDF Vcb @ %I64x    Refs: (clean,userref,ref - linkcount)\n\n", Address );
        dprintf( "(1,0,0) handle\n(0,1,1) Outstanding FO / del.close / child lcb\n(0,0,1) Stream file\n(0,0,1) Stream directory\n\n");
    }
    else {

        //
        //  Try and extract vcb from scb->fcb to dump delay close info
        //

        Scb = Address;
    }
    
    DumpTreeRecur( Scb, 0);

    //
    //  Dump delayed close queue info
    //

    dprintf("\nDo   !d Udfs!UdfData   to display globals and dump the delayed close queue\n");

    dprintf( "\n" );
}


DECLARE_API( tree )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpTreeSummary, dwProcessor, hCurrentThread );
}

DECLARE_API( udfvcb )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfVcb, dwProcessor, hCurrentThread );
}


DECLARE_API( udficbsc )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfIcbSearchContext, dwProcessor, hCurrentThread );
}


DECLARE_API( udfccb)
{
    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfCcb, dwProcessor, hCurrentThread );
}


DECLARE_API( udffcb )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfFcb, dwProcessor, hCurrentThread );
}


DECLARE_API( udfvdo )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfVdo, dwProcessor, hCurrentThread );
}



DECLARE_API( udfirpcontext )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfIrpContext, dwProcessor, hCurrentThread );
}


DECLARE_API( udfirpcontextlite )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfIrpContextLite, dwProcessor, hCurrentThread );
}


DECLARE_API( udfmcb )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpLargeMcb, dwProcessor, hCurrentThread );
}


DECLARE_API( lcb )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfLcb, dwProcessor, hCurrentThread );
}

DECLARE_API( pcb )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfPcb, dwProcessor, hCurrentThread );
}


//
//  RAW ON DISC STUCTURE DUMP ROUTINES FOLLOW....
//

#define UdfNodeTypeName( InfoIndex)  (UdfOnDiscTypeCodes[ InfoIndex].Text)
#define UdfNodeTypeDumpFunction( InfoIndex)  (UdfOnDiscTypeCodes[ InfoIndex].DumpRoutine)
#define UdfNodeTypeSize( InfoIndex)  (UdfOnDiscTypeCodes[ InfoIndex].Size)


#define DUMP_EXTN_AD( type, realaddress, structure, element, label)       \
        dprintf( "\n(%03x) %08x -> %s (LSN %08x, LEN %08x)",              \
                FIELD_OFFSET(type, element),                              \
                ((PUCHAR)realaddress) + FIELD_OFFSET(type, element),      \
                label,                                                    \
                structure.element.Lsn, structure.element.Len)

static UCHAR RegIdBuffer[ 33];

#define DUMP_REGID( type, realaddress, structure, element, label)         \
        strncpy( RegIdBuffer, structure.element.Identifier, 23);          \
        strncpy( RegIdBuffer+24, structure.element.Suffix, 8);            \
        RegIdBuffer[23] = '\0';                                           \
        RegIdBuffer[32] = '\0';                                           \
        dprintf( "\n(%03x) %08x -> %s (Flags %02x, '%s':'%s')",           \
                FIELD_OFFSET(type, element),                              \
                ((PUCHAR)realaddress) + FIELD_OFFSET(type, element),      \
                label,                                                    \
                structure.element.Flags,                                  \
                RegIdBuffer, RegIdBuffer+24)

#define DUMP_LONGAD( type, realaddress, structure, element, label)        \
        dprintf( "\n(%03x) %08x -> %s (Len %1x:%08x, StartLba %04x:%08x)",\
                FIELD_OFFSET(type, element),                              \
                ((PUCHAR)realaddress) + FIELD_OFFSET(type, element),      \
                label,                                                    \
                structure.element.Length.Type,                            \
                structure.element.Length.Length,                          \
                structure.element.Start.Partition,                        \
                structure.element.Start.Lbn)

#define DUMP_NSRLBA( type, realaddress, structure, element, label)        \
        dprintf( "\n(%03x) %08x -> %s (%04x:%08x)",                       \
                FIELD_OFFSET(type, element),                              \
                ((PUCHAR)realaddress) + FIELD_OFFSET(type, element),      \
                label,                                                    \
                structure.element.Partition,                              \
                structure.element.Lbn)


DUMP_ROUTINE( DumpUdfOnDiscStructure)
{
    DESTAG Tag;
    PDESTAG pTag;
    ULONG Result, InfoIndex;
    STRUCT_DUMP_ROUTINE Routine;
    
    RM( Address, Tag, pTag, PDESTAG, Result );
  
    InfoIndex = SearchTypeCodeIndex( Tag.Ident, UdfOnDiscTypeCodes);
    Routine = UdfNodeTypeDumpFunction( InfoIndex);

    if ( NULL == Routine) {
    
        dprintf( "Udf/Iso node tag 0x%04x unknown.\n", Tag.Ident);
        return;
    }

    //
    //  And call it...
    //

    dprintf( "\n%s @ %08x\n", UdfNodeTypeName(InfoIndex),  Address);
    
    (Routine)(Address, Options, &UdfOnDiscTypeCodes[InfoIndex]);
}


DUMP_ROUTINE( DumpUdfOnDiscTag)
{
    DESTAG Tag;
    PDESTAG pTag;
    ULONG Result, InfoIndex;
    STRUCT_DUMP_ROUTINE Routine;
    
    RM( Address, Tag, pTag, PDESTAG, Result );

    InfoIndex = SearchTypeCodeIndex( Tag.Ident, UdfOnDiscTypeCodes);
    Routine = UdfNodeTypeDumpFunction( InfoIndex);

    DUMP16_WITH_OFFSET(  DESTAG, Tag,    Ident,     "Ident" );    
    dprintf(" (== %s)", UdfNodeTypeName(InfoIndex));
    
    DUMP16_WITH_OFFSET(  DESTAG, Tag,    Version,   "Version");
    DUMP8_WITH_OFFSET(   DESTAG, Tag,    Checksum,  "Checksum");
    DUMP16_WITH_OFFSET(  DESTAG, Tag,    Serial,    "Serial");
    DUMP16_WITH_OFFSET(  DESTAG, Tag,    CRC,       "CRC");
    DUMP16_WITH_OFFSET(  DESTAG, Tag,    CRCLen,    "CRCLen");
    DUMP_WITH_OFFSET(    DESTAG, Tag,    Lbn,       "(TagLoc)Lbn");
}


DUMP_ROUTINE( DumpUdfOnDiscPvd)
{
    NSR_PVD Pvd;
    PNSR_PVD pPvd;
    ULONG Result;
    
    RM( Address, Pvd, pPvd, PNSR_PVD, Result );

    DUMP_EMBW_OFFSET(  NSR_PVD, Address,   Destag,              "Destag" );
    DUMP_WITH_OFFSET(  NSR_PVD, Pvd,       VolDescSeqNum,       "VolDescSeqNum" );
    DUMP_WITH_OFFSET(  NSR_PVD, Pvd,       Number,              "Number" );

    Pvd.VolumeID[ Pvd.VolumeID[ 31]] = '\0';
    DUMP_RAW_TERM_STRN_OFFSET( NSR_PVD, Pvd, Address, VolumeID,    "VolumeID");
   
    DUMP16_WITH_OFFSET(  NSR_PVD, Pvd,       VolSetSeq,         "VolSetSeq" );
    DUMP16_WITH_OFFSET(  NSR_PVD, Pvd,       VolSetSeqMax,      "VolSetSeqMax" );
    DUMP16_WITH_OFFSET(  NSR_PVD, Pvd,       Level,             "Level" );
    DUMP16_WITH_OFFSET(  NSR_PVD, Pvd,       LevelMax,          "LevelMax" );

    Pvd.VolSetID[ Pvd.VolSetID[ 127]] = '\0';
    DUMP_RAW_TERM_STRN_OFFSET( NSR_PVD, Pvd, Address, VolSetID,    "VolSetID");
    
    DUMP_EXTN_AD( NSR_PVD, Address, Pvd, Abstract, "Abstract");
    DUMP_EXTN_AD( NSR_PVD, Address, Pvd, Copyright, "Copyright");
    DUMP_REGID( NSR_PVD, Address, Pvd, ImpUseID, "ImpUseID");
    
    DUMP_WITH_OFFSET(  NSR_PVD, Pvd,       Predecessor,    "Predecessor" );
    DUMP16_WITH_OFFSET(  NSR_PVD, Pvd,     Flags,          "Flags" );
}


DUMP_ROUTINE( DumpUdfOnDiscAnchor)
{
    NSR_ANCHOR Avd;
    PNSR_ANCHOR pAvd;
    ULONG Result;
    
    RM( Address, Avd, pAvd, PNSR_ANCHOR, Result );
    
    DUMP_EMBW_OFFSET(  NSR_ANCHOR, Address,   Destag,           "Destag" );
    DUMP_EXTN_AD( NSR_ANCHOR, Address, Avd,   Main,             "Main");
    DUMP_EXTN_AD( NSR_ANCHOR, Address, Avd,   Reserve,          "Reserve");
}


DUMP_ROUTINE( DumpUdfOnDiscVdp)
{
    NSR_VDP Vdp;
    PNSR_VDP pVdp;
    ULONG Result;
    
    RM( Address, Vdp, pVdp, PNSR_VDP, Result );
    
    DUMP_EMBW_OFFSET(  NSR_VDP, Address,   Destag,           "Destag" );
    DUMP_WITH_OFFSET(  NSR_VDP, Vdp,       VolDescSeqNum,    "VolDescSeqNum" );
    DUMP_EXTN_AD( NSR_VDP, Address, Vdp,   Next,             "Next");
}


DUMP_ROUTINE( DumpUdfOnDiscPartDesc)
{
    NSR_PART Part;
    PNSR_PART pPart;
    ULONG Result;
    
    RM( Address, Part, pPart, PNSR_PART, Result );
    
    dprintf("\n(3/10.5)\n");
    
    DUMP_EMBW_OFFSET(  NSR_PART, Address,   Destag,         "Destag" );
    DUMP_WITH_OFFSET(  NSR_PART, Part,      VolDescSeqNum,  "VolDescSeqNum" );

    DUMP16_WITH_OFFSET(  NSR_PART, Part,      Flags,        "Flags" );
    DUMP16_WITH_OFFSET(  NSR_PART, Part,      Number,       "Number" );

    DUMP_REGID( NSR_PART, Address, Part, ContentsID,        "ContentsID");
    
    DUMP_WITH_OFFSET(  NSR_PART, Part,      AccessType,     "AccessType" );
    DUMP_WITH_OFFSET(  NSR_PART, Part,      Start,          "Start" );
    DUMP_WITH_OFFSET(  NSR_PART, Part,      Length,         "Length" );
    
    DUMP_REGID( NSR_PART, Address, Part,    ImpUseID,       "ImpUseID");
}

DUMP_ROUTINE( DumpUdfOnDiscLvol)
{
    NSR_LVOL Lv;
    PNSR_LVOL pLv;
    ULONG Result;
    
    RM( Address, Lv, pLv, PNSR_LVOL, Result );
    
    DUMP_EMBW_OFFSET(  NSR_LVOL, Address,   Destag,         "Destag" );
    DUMP_WITH_OFFSET(  NSR_LVOL, Lv,        VolDescSeqNum,  "VolDescSeqNum" );

    Lv.VolumeID[ Lv.VolumeID[ 127]] = '\0';
    DUMP_RAW_TERM_STRN_OFFSET( NSR_LVOL, Lv, Address, VolumeID,    "VolumeID");
    
    DUMP_WITH_OFFSET(  NSR_LVOL, Lv,        BlockSize,  "BlockSize" );
    DUMP_REGID( NSR_LVOL, Address, Lv,      DomainID,   "DomainID");

    DUMP_LONGAD( NSR_LVOL, Address, Lv, FSD, "FSD");
    
    DUMP_WITH_OFFSET(  NSR_LVOL, Lv,        MapTableLength, "MapTableLength" );
    DUMP_WITH_OFFSET(  NSR_LVOL, Lv,        MapTableCount,  "MapTableCount" );
    
    DUMP_REGID( NSR_LVOL, Address,  Lv, ImpUseID,   "ImpUseID");
    
    DUMP_EXTN_AD( NSR_LVOL, Address, Lv, Integrity,             "Integrity");
    DUMP_EMBW_OFFSET(  NSR_LVOL, Address,   MapTable,           "MapTable" );
}


DUMP_ROUTINE( DumpUdfOnDiscLvInteg)
{
}


DUMP_ROUTINE( DumpUdfOnDiscFsd)
{
    NSR_FSD Fsd;
    PNSR_FSD pFsd;
    ULONG Result;
    STRING Str;
    
    RM( Address, Fsd, pFsd, PNSR_FSD, Result );
    
    DUMP_EMBW_OFFSET(  NSR_FSD, Address,   Destag,          "Destag" );
    DUMP_EMBW_OFFSET(  NSR_FSD, Address,   Time,            "Time" );
    DUMP16_WITH_OFFSET(  NSR_FSD, Fsd,      Level,         "Level" );
    DUMP16_WITH_OFFSET(  NSR_FSD, Fsd,      LevelMax,       "LevelMax" );
    DUMP_WITH_OFFSET(  NSR_FSD, Fsd,      FileSet,       "FileSet" );
    DUMP_WITH_OFFSET(  NSR_FSD, Fsd,      FileSetDesc,       "FileSetDesc" );

    Fsd.VolID[ Fsd.VolID[ 127]] = '\0';
    DUMP_RAW_TERM_STRN_OFFSET( NSR_FSD, Fsd, Address, VolID,       "VolID    ");

    Fsd.FileSetID[ Fsd.FileSetID[ 127]] = '\0';
    DUMP_RAW_TERM_STRN_OFFSET( NSR_FSD, Fsd, Address, FileSetID,   "FileSetID");

    DUMP_LONGAD( NSR_FSD, Address, Fsd, IcbRoot,             "IcbRoot   ");
    DUMP_REGID( NSR_FSD, Address, Fsd, DomainID,             "DomainID  ");
    DUMP_LONGAD( NSR_FSD, Address, Fsd, NextExtent,          "NextExtent");

    dprintf("\n");
}


DUMP_ROUTINE( DumpUdfOnDiscFid)
{
    NSR_FID Fid;
    PNSR_FID pFid;
    ULONG Result;
    UCHAR Buffer[512];
    
    RM( Address, Fid, pFid, PNSR_FID, Result );

    dprintf("\nFid.Flags: ");
    PrintState( UdfFidFlags, Fid.Flags);
    
    DUMP_EMBW_OFFSET(  NSR_FID, Address,   Destag,          "Destag" );
    DUMP16_WITH_OFFSET(  NSR_FID, Fid,     Version,         "Version" );
    DUMP8_WITH_OFFSET(  NSR_FID, Fid,      Flags,           "Flags" );
    DUMP8_WITH_OFFSET(  NSR_FID, Fid,      FileIDLen,       "FileIDLen" );
    DUMP_LONGAD( NSR_FID, Address, Fid, Icb, "Icb");
    DUMP16_WITH_OFFSET(  NSR_FID, Fid,     ImpUseLen,       "ImpUseLen" );
    DUMP_EMBW_OFFSET(  NSR_FID, Address,   ImpUse,          "ImpUse" );
    
    dprintf("\nFileID @ %08x\n", ((PUCHAR)Address) + FIELD_OFFSET( NSR_FID, ImpUse) + Fid.ImpUseLen);    
}


DUMP_ROUTINE( DumpUdfOnDiscIcbFile)
{
    ICBFILE Icb;
    PICBFILE pIcb;
    ULONG Result;
    USHORT AllocType;
    ULONG AllocLength = 0;
    DWORD_PTR AllocDescsRealAddr;
    
    RM( Address, Icb, pIcb, PICBFILE, Result );
    
    dprintf("\nIcb.IcbTag.Flags: ");
    PrintState( UdfIcbTagFlags, Icb.Icbtag.Flags);
    
    DUMP_EMBW_OFFSET(  ICBFILE, Address,   Destag,                      "Destag" );

    // IcbTag embedded structure
    
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       Icbtag.PriorDirectCount,   "Icbtag.PriorDirectCount" );
    
    DUMP16_WITH_OFFSET(  ICBFILE, Icb,       Icbtag.StratType,          "Icbtag.StratType" );
    dprintf(" == %s", (Icb.Icbtag.StratType <= MAX_VALID_ICB_STRAT) ? IcbStrategies[ Icb.Icbtag.StratType ] : "INVALID");
    
    DUMP16_WITH_OFFSET(  ICBFILE, Icb,       Icbtag.StratParm,          "Icbtag.StratParm" );
    DUMP16_WITH_OFFSET(  ICBFILE, Icb,       Icbtag.MaxEntries,         "Icbtag.MaxEntries" );
    
    DUMP16_WITH_OFFSET(  ICBFILE, Icb,       Icbtag.FileType,           "Icbtag.FileType" );
    dprintf(" == %s", (Icb.Icbtag.FileType <= MAX_VALID_ICB_TYPE) ? IcbFileTypes[ Icb.Icbtag.FileType ] : "INVALID");
    
    DUMP_NSRLBA( ICBFILE, Address,  Icb,  Icbtag.IcbParent,             "IcbTag.IcbParent");
    DUMP16_WITH_OFFSET(  ICBFILE, Icb,       Icbtag.Flags,              "Icbtag.Flags" );

    // end icbtag

    DUMP_WITH_OFFSET(    ICBFILE, Icb,       UID,               "UID" );
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       GID,               "GID" );
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       Permissions,       "Permissions" );
    DUMP16_WITH_OFFSET(    ICBFILE, Icb,     LinkCount,         "LinkCount" );
    DUMP8_WITH_OFFSET(    ICBFILE, Icb,      RecordFormat,      "RecordFormat" );
    DUMP8_WITH_OFFSET(    ICBFILE, Icb,      RecordDisplay,     "RecordDisplay" );
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       RecordLength,      "RecordLength" );
    DUMP64_WITH_OFFSET(    ICBFILE, Icb,     InfoLength,        "InfoLength" );
    DUMP64_WITH_OFFSET(    ICBFILE, Icb,     BlocksRecorded,    "BlocksRecorded" );
    DUMP_EMBW_OFFSET(  ICBFILE, Address,     AccessTime,        "AccessTime" );
    DUMP_EMBW_OFFSET(  ICBFILE, Address,     ModifyTime,        "ModifyTime" );
    DUMP_EMBW_OFFSET(  ICBFILE, Address,     AttributeTime,     "AttributeTime" );
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       Checkpoint,        "Checkpoint" );
    
    DUMP_LONGAD( ICBFILE,  Address, Icb,  IcbEA,    "IcbEA");
    DUMP_REGID(  ICBFILE,  Address, Icb,  ImpUseID, "ImpUseID");

    DUMP64_WITH_OFFSET(    ICBFILE, Icb,     UniqueID,          "UniqueID" );
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       EALength,          "EALength" );
    DUMP_WITH_OFFSET(    ICBFILE, Icb,       AllocLength,       "AllocLength" );

    // lazy! *** dump EA list
    
    DUMP_EMBW_OFFSET(  ICBFILE, Address,     EAs,     "EAs[]" );

    AllocDescsRealAddr = ((ULONG)Address) + FIELD_OFFSET( ICBFILE, EAs) + Icb.EALength;
    AllocType = (ICBTAG_F_ALLOC_MASK & Icb.Icbtag.Flags);
    
    dprintf("\n\nAllocation descriptors @ %08x\n\n", AllocDescsRealAddr );

    if ((Options & 1) && (ICBTAG_F_ALLOC_IMMEDIATE != AllocType))  {

        UCHAR Buffer[4*1024];
        PUCHAR CurrentDesc = Buffer;
        ULONG Size;

        if ( sizeof(Buffer) < Icb.AllocLength)  {
        
            dprintf("Buffer too small\n");
            return;
        }
        
        //
        //  Dump allocation descriptors
        //
        
        if (!ReadMemory( AllocDescsRealAddr, Buffer, Icb.AllocLength, &Result))  {
        
            dprintf( "Failed to read memory @%p\n", AllocDescsRealAddr);
            return;
        }

        while ( AllocLength < Icb.AllocLength)  {

            switch (AllocType)  {
            
                case ICBTAG_F_ALLOC_SHORT:
                
                    dprintf( " %08x , %01x:%08x\n", ((PSHORTAD)CurrentDesc)->Start, 
                             ((PSHORTAD)CurrentDesc)->Length.Type,  ((PSHORTAD)CurrentDesc)->Length.Length);
                    Size = sizeof( SHORTAD);
                    break;
                    
                case ICBTAG_F_ALLOC_LONG:  {
                    
                        PLONGAD Ad = (PLONGAD)CurrentDesc;
                        
                        dprintf( " %04x:%08x , %01x:%08x,  ImpUse[6] @ %08x\n", 
                                 Ad->Start.Partition, Ad->Start.Lbn, 
                                 Ad->Length.Type,  Ad->Length.Length,
                                 AllocDescsRealAddr + AllocLength + FIELD_OFFSET( LONGAD, ImpUse));
                        Size = sizeof( LONGAD);
                    }
                    break;
                    
                case ICBTAG_F_ALLOC_EXTENDED:  {
                    
                        PEXTAD Ad = (PEXTAD)CurrentDesc;
                        
                        dprintf( " %04x:%08x , EL: %01x:%08x, RL: %01x:%08x, InfoL: %08x, ImpUse[2] @ %08x\n", 
                                 Ad->Start.Partition, Ad->Start.Lbn, 
                                 Ad->ExtentLen.Type,  Ad->ExtentLen.Length,
                                 Ad->RecordedLen.Type,  Ad->RecordedLen.Length,
                                 Ad->InfoLen,
                                 AllocDescsRealAddr + AllocLength + FIELD_OFFSET( EXTAD, ImpUse));
                        Size = sizeof( EXTAD);
                    }
                    break;
                    
                default:
                    dprintf("INVALID Allocdesc type %d\n", AllocType);
                    return;
            }

            AllocLength += Size;
            CurrentDesc += Size;
        }
    }
}


DUMP_ROUTINE( DumpUdfOnDiscIcbExtFile)
{
    ICBEXTFILE Icb;
    PICBEXTFILE pIcb;
    ULONG Result;
    USHORT AllocType;
    ULONG AllocLength = 0;
    DWORD_PTR AllocDescsRealAddr;
    
    RM( Address, Icb, pIcb, PICBEXTFILE, Result );
    
    dprintf("\nIcb.IcbTag.Flags: ");
    PrintState( UdfIcbTagFlags, Icb.Icbtag.Flags);
    
    DUMP_EMBW_OFFSET(  ICBFILE, Address,   Destag,                      "Destag" );

    // IcbTag embedded structure
    
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       Icbtag.PriorDirectCount,   "Icbtag.PriorDirectCount" );
    
    DUMP16_WITH_OFFSET(  ICBEXTFILE, Icb,       Icbtag.StratType,          "Icbtag.StratType" );
    dprintf(" == %s", (Icb.Icbtag.StratType <= MAX_VALID_ICB_STRAT) ? IcbStrategies[ Icb.Icbtag.StratType ] : "INVALID");
    
    DUMP16_WITH_OFFSET(  ICBEXTFILE, Icb,       Icbtag.StratParm,          "Icbtag.StratParm" );
    DUMP16_WITH_OFFSET(  ICBEXTFILE, Icb,       Icbtag.MaxEntries,         "Icbtag.MaxEntries" );
    
    DUMP16_WITH_OFFSET(  ICBEXTFILE, Icb,       Icbtag.FileType,           "Icbtag.FileType" );
    dprintf(" == %s", (Icb.Icbtag.FileType <= MAX_VALID_ICB_TYPE) ? IcbFileTypes[ Icb.Icbtag.FileType ] : "INVALID");
    
    DUMP_NSRLBA( ICBEXTFILE, Address,  Icb,  Icbtag.IcbParent,             "IcbTag.IcbParent");
    DUMP16_WITH_OFFSET(  ICBEXTFILE, Icb,       Icbtag.Flags,              "Icbtag.Flags" );

    // end icbtag

    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       UID,               "UID" );
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       GID,               "GID" );
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       Permissions,       "Permissions" );
    DUMP16_WITH_OFFSET(    ICBEXTFILE, Icb,     LinkCount,         "LinkCount" );
    DUMP8_WITH_OFFSET(    ICBEXTFILE, Icb,      RecordFormat,      "RecordFormat" );
    DUMP8_WITH_OFFSET(    ICBEXTFILE, Icb,      RecordDisplay,     "RecordDisplay" );
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       RecordLength,      "RecordLength" );
    DUMP64_WITH_OFFSET(    ICBEXTFILE, Icb,     InfoLength,        "InfoLength" );
    DUMP64_WITH_OFFSET(    ICBEXTFILE, Icb,     ObjectSize,         "ObjectSize" );
    DUMP64_WITH_OFFSET(    ICBEXTFILE, Icb,     BlocksRecorded,    "BlocksRecorded" );
    DUMP_EMBW_OFFSET(  ICBEXTFILE, Address,     AccessTime,        "AccessTime" );
    DUMP_EMBW_OFFSET(  ICBEXTFILE, Address,     ModifyTime,        "ModifyTime" );
    DUMP_EMBW_OFFSET(  ICBEXTFILE, Address,     AttributeTime,     "AttributeTime" );
    DUMP_EMBW_OFFSET(  ICBEXTFILE, Address,     CreationTime,     "CreationTime" );
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       Checkpoint,        "Checkpoint" );
    
    DUMP_LONGAD( ICBEXTFILE,  Address, Icb,  IcbEA,    "IcbEA");
    DUMP_LONGAD( ICBEXTFILE,  Address, Icb,  IcbStream,    "IcbStream");
    DUMP_REGID(  ICBEXTFILE,  Address, Icb,  ImpUseID, "ImpUseID");

    DUMP64_WITH_OFFSET(    ICBEXTFILE, Icb,     UniqueID,          "UniqueID" );
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       EALength,          "EALength" );
    DUMP_WITH_OFFSET(    ICBEXTFILE, Icb,       AllocLength,       "AllocLength" );

    // lazy! *** dump EA list
    
    DUMP_EMBW_OFFSET(  ICBEXTFILE, Address,     EAs,     "EAs[]" );

    AllocDescsRealAddr = ((ULONG)Address) + FIELD_OFFSET( ICBEXTFILE, EAs) + Icb.EALength;
    AllocType = (ICBTAG_F_ALLOC_MASK & Icb.Icbtag.Flags);
    
    dprintf("\n\nAllocation descriptors @ %08x\n\n", AllocDescsRealAddr );

    if ((Options & 1) && (ICBTAG_F_ALLOC_IMMEDIATE != AllocType))  {

        UCHAR Buffer[4*1024];
        PUCHAR CurrentDesc = Buffer;
        ULONG Size;

        if ( sizeof(Buffer) < Icb.AllocLength)  {
        
            dprintf("Buffer too small\n");
            return;
        }
        
        //
        //  Dump allocation descriptors
        //
        
        if (!ReadMemory( AllocDescsRealAddr, Buffer, Icb.AllocLength, &Result))  {
        
            dprintf( "Failed to read memory @%p\n", AllocDescsRealAddr);
            return;
        }

        while ( AllocLength < Icb.AllocLength)  {

            switch (AllocType)  {
            
                case ICBTAG_F_ALLOC_SHORT:
                
                    dprintf( " %08x , %01x:%08x\n", ((PSHORTAD)CurrentDesc)->Start, 
                             ((PSHORTAD)CurrentDesc)->Length.Type,  ((PSHORTAD)CurrentDesc)->Length.Length);
                    Size = sizeof( SHORTAD);
                    break;
                    
                case ICBTAG_F_ALLOC_LONG:  {
                    
                        PLONGAD Ad = (PLONGAD)CurrentDesc;
                        
                        dprintf( " %04x:%08x , %01x:%08x,  ImpUse[6] @ %08x\n", 
                                 Ad->Start.Partition, Ad->Start.Lbn, 
                                 Ad->Length.Type,  Ad->Length.Length,
                                 AllocDescsRealAddr + AllocLength + FIELD_OFFSET( LONGAD, ImpUse));
                        Size = sizeof( LONGAD);
                    }
                    break;
                    
                case ICBTAG_F_ALLOC_EXTENDED:  {
                    
                        PEXTAD Ad = (PEXTAD)CurrentDesc;
                        
                        dprintf( " %04x:%08x , EL: %01x:%08x, RL: %01x:%08x, InfoL: %08x, ImpUse[2] @ %08x\n", 
                                 Ad->Start.Partition, Ad->Start.Lbn, 
                                 Ad->ExtentLen.Type,  Ad->ExtentLen.Length,
                                 Ad->RecordedLen.Type,  Ad->RecordedLen.Length,
                                 Ad->InfoLen,
                                 AllocDescsRealAddr + AllocLength + FIELD_OFFSET( EXTAD, ImpUse));
                        Size = sizeof( EXTAD);
                    }
                    break;
                    
                default:
                    dprintf("INVALID Allocdesc type %d\n", AllocType);
                    return;
            }

            AllocLength += Size;
            CurrentDesc += Size;
        }
    }
}


DECLARE_API( udftag )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfOnDiscTag, dwProcessor, hCurrentThread );
}

DECLARE_API( ud )
{
    UNREFERENCED_PARAMETER( dwCurrentPc );
    UNREFERENCED_PARAMETER( hCurrentProcess );

    ParseAndDump( (PCHAR) args, (STRUCT_DUMP_ROUTINE) DumpUdfOnDiscStructure, dwProcessor, hCurrentThread );
}