Source code of Windows XP (NT5)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

595 lines
19 KiB

#include "ulib.hxx"
#include "frsedit.hxx"
#include "untfs.hxx"
#include "frsstruc.hxx"
#include "attrrec.hxx"
#include "cmem.hxx"
#include "ntfssa.hxx"
#include "attrlist.hxx"
#include "crack.hxx"
extern "C" {
#include <stdio.h>
}
BOOLEAN
FRS_EDIT::Initialize(
IN HWND WindowHandle,
IN INT ClientHeight,
IN INT ClientWidth,
IN PLOG_IO_DP_DRIVE Drive
)
{
TEXTMETRIC textmetric;
HDC hdc;
NTFS_SA ntfssa;
MESSAGE msg;
hdc = GetDC(WindowHandle);
if (hdc == NULL)
return FALSE;
GetTextMetrics(hdc, &textmetric);
ReleaseDC(WindowHandle, hdc);
_buffer = NULL;
_size = 0;
_drive = Drive;
if (!_drive) {
return FALSE;
}
if (!ntfssa.Initialize(Drive, &msg) ||
!ntfssa.Read()) {
return FALSE;
}
_cluster_factor = ntfssa.QueryClusterFactor();
_frs_size = ntfssa.QueryFrsSize();
return VERTICAL_TEXT_SCROLL::Initialize(
WindowHandle,
0,
ClientHeight,
ClientWidth,
textmetric.tmExternalLeading + textmetric.tmHeight,
textmetric.tmMaxCharWidth);
}
VOID
FRS_EDIT::SetBuf(
IN HWND WindowHandle,
IN OUT PVOID Buffer,
IN ULONG Size
)
{
_buffer = Buffer;
_size = Size;
SetScrollPos(WindowHandle, SB_VERT, 0, FALSE);
}
STATIC TCHAR buf[1024];
VOID
FRS_EDIT::Paint(
IN HDC DeviceContext,
IN RECT InvalidRect,
IN HWND WindowHandle
)
{
INT nDrawX, nDrawY;
INT CurrentLine;
PCFILE_RECORD_SEGMENT_HEADER pfrs;
TCHAR sbFlags[32];
SelectObject(DeviceContext, GetStockObject(ANSI_FIXED_FONT));
if (!_buffer || !_size) {
return;
}
pfrs = (PCFILE_RECORD_SEGMENT_HEADER) _buffer;
CurrentLine = 0;
swprintf(buf, TEXT("FILE_RECORD_SEGMENT_HEADER {"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" MULTI_SECTOR_HEADER MultiSectorHeader {"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Signature: \t\t\t%c%c%c%c"),
pfrs->MultiSectorHeader.Signature[0],
pfrs->MultiSectorHeader.Signature[1],
pfrs->MultiSectorHeader.Signature[2],
pfrs->MultiSectorHeader.Signature[3]);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Update sequence array offset: \t%x"),
pfrs->MultiSectorHeader.UpdateSequenceArrayOffset);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Update sequence array size: \t%x"),
pfrs->MultiSectorHeader.UpdateSequenceArraySize);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Lsn: \t\t\t<%x,%x>"), pfrs->Lsn.HighPart,
pfrs->Lsn.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Sequence number: \t\t%x"), pfrs->SequenceNumber);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Reference count: \t\t%x"),
pfrs->ReferenceCount);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" First attribute offset: \t%x"),
pfrs->FirstAttributeOffset);
WriteLine(DeviceContext, CurrentLine++, buf);
if (pfrs->Flags & FILE_RECORD_SEGMENT_IN_USE) {
wcscpy(sbFlags, TEXT("U"));
} else {
wcscpy(sbFlags, TEXT(" "));
}
if (pfrs->Flags & FILE_FILE_NAME_INDEX_PRESENT) {
wcscat(sbFlags, TEXT("I"));
}
swprintf(buf, TEXT(" Flags: \t\t\t%x \t%s"), pfrs->Flags, sbFlags);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" First free byte: \t\t%x"), pfrs->FirstFreeByte);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Bytes available: \t\t%x"), pfrs->BytesAvailable);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" FILE_REFERENCE BaseFileRecordSegment {"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" LowPart: \t %x"),
pfrs->BaseFileRecordSegment.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Sequence number: %x"),
pfrs->BaseFileRecordSegment.SequenceNumber);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Next attribute instance: %x"),
pfrs->NextAttributeInstance);
WriteLine(DeviceContext, CurrentLine++, buf);
if (pfrs->MultiSectorHeader.UpdateSequenceArrayOffset >=
FIELD_OFFSET(FILE_RECORD_SEGMENT_HEADER, UpdateArrayForCreateOnly)) {
swprintf(buf, TEXT(" Segment Number: <%x,%x>"),
pfrs->SegmentNumberHighPart, pfrs->SegmentNumberLowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
}
swprintf(buf, TEXT("}"));
WriteLine(DeviceContext, CurrentLine++, buf);
CurrentLine++;
// At this point enumerate all of the attribute records.
NTFS_FRS_STRUCTURE frs;
PATTRIBUTE_RECORD_HEADER prec;
NTFS_ATTRIBUTE_RECORD attrrec;
DSTRING record_name;
PWSTR pstr;
CONT_MEM cmem;
if (!cmem.Initialize(_buffer, _size) ||
!frs.Initialize(&cmem, _drive, 0, _cluster_factor,
0, _frs_size, NULL)) {
return;
}
prec = NULL;
while (prec = (PATTRIBUTE_RECORD_HEADER) frs.GetNextAttributeRecord(prec)) {
if (!attrrec.Initialize(NULL, prec) ||
!attrrec.QueryName(&record_name) ||
!(pstr = record_name.QueryWSTR())) {
return;
}
swprintf(buf, TEXT("ATTRIBUTE_RECORD_HEADER at offset %x {"), (PCHAR) prec - (PCHAR) pfrs);
WriteLine(DeviceContext, CurrentLine++, buf);
PTCHAR SymbolicTypeCode = GetNtfsAttributeTypeCodeName(prec->TypeCode);
swprintf(buf, TEXT(" Type code, name: \t%x (%s), %s"), prec->TypeCode,
NULL == SymbolicTypeCode ? TEXT("unknown") : SymbolicTypeCode,
pstr);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Record length: \t%x"), prec->RecordLength);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Form code: \t\t%x"), prec->FormCode);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Name length: \t%x"), prec->NameLength);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Name offset: \t%x"), prec->NameOffset);
WriteLine(DeviceContext, CurrentLine++, buf);
if (prec->Flags & ATTRIBUTE_FLAG_COMPRESSION_MASK) {
wcscpy(sbFlags, TEXT("C"));
} else {
sbFlags[0] = '\0';
}
swprintf(buf, TEXT(" Flags: \t\t%x \t%s"), prec->Flags, sbFlags);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Instance: \t\t%x"), prec->Instance);
WriteLine(DeviceContext, CurrentLine++, buf);
CurrentLine++;
if (!(prec->FormCode & NONRESIDENT_FORM)) {
//
// Resident Attribute
//
swprintf(buf, TEXT(" Resident form {"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Value length: \t%x"),
prec->Form.Resident.ValueLength);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Value offset: \t%x"),
prec->Form.Resident.ValueOffset);
WriteLine(DeviceContext, CurrentLine++, buf);
if (prec->Form.Resident.ResidentFlags & RESIDENT_FORM_INDEXED) {
wcscpy(sbFlags, TEXT("I"));
} else {
sbFlags[0] = '\0';
}
swprintf(buf, TEXT(" Resident flags: %x \t%s"),
prec->Form.Resident.ResidentFlags, sbFlags);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
__try {
if ($FILE_NAME == prec->TypeCode) {
DisplayFileName(prec, DeviceContext, CurrentLine);
} else if ($ATTRIBUTE_LIST == prec->TypeCode) {
DisplayAttrList(prec, DeviceContext, CurrentLine);
} else if ($STANDARD_INFORMATION == prec->TypeCode) {
DisplayStandardInformation( prec, DeviceContext, CurrentLine );
}
} __except (EXCEPTION_EXECUTE_HANDLER) {
swprintf(buf, TEXT("[ADDRESS ERROR]"));
WriteLine(DeviceContext, CurrentLine++, buf);
}
swprintf(buf, TEXT("}"));
WriteLine(DeviceContext, CurrentLine++, buf);
CurrentLine++;
DELETE(pstr);
continue;
}
//
// Nonresident Attribute
//
swprintf(buf, TEXT(" Nonresident form {"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Lowest vcn: \t\t%x"),
prec->Form.Nonresident.LowestVcn.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Highest vcn: \t\t%x"),
prec->Form.Nonresident.HighestVcn.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Mapping pairs offset: \t%x"),
prec->Form.Nonresident.MappingPairsOffset);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Compression unit: \t%x"),
prec->Form.Nonresident.CompressionUnit);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Allocated length: \t%x"),
prec->Form.Nonresident.AllocatedLength.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" File size: \t\t%x"),
prec->Form.Nonresident.FileSize.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Valid data length: \t%x"),
prec->Form.Nonresident.ValidDataLength.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
if ((prec->Flags & ATTRIBUTE_FLAG_COMPRESSION_MASK) != 0) {
swprintf(buf, TEXT(" Total allocated: \t%x"),
prec->Form.Nonresident.TotalAllocated.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
}
NTFS_EXTENT_LIST extents;
BIG_INT vcn, lcn, run_length;
ULONG i;
if (!attrrec.QueryExtentList(&extents)) {
return;
}
swprintf(buf, TEXT(" Extent list {"));
WriteLine(DeviceContext, CurrentLine++, buf);
for (i = 0; i < extents.QueryNumberOfExtents(); i++) {
nDrawY = CurrentLine * QueryCharHeight();
if (nDrawY < QueryScrollPosition()*QueryCharHeight()) {
nDrawY += QueryCharHeight();
CurrentLine++;
continue;
}
if (nDrawY > QueryScrollPosition()*QueryCharHeight() +
QueryClientHeight()) {
break;
}
if (!extents.QueryExtent(i, &vcn, &lcn, &run_length)) {
break;
}
swprintf(buf, TEXT(" (vcn, lcn, run length): (%x, %x, %x)"),
vcn.GetLowPart(), lcn.GetLowPart(), run_length.GetLowPart());
WriteLine(DeviceContext, CurrentLine++, buf);
}
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("}"));
WriteLine(DeviceContext, CurrentLine++, buf);
CurrentLine++;
DELETE(pstr);
}
SetRange(WindowHandle, CurrentLine - 1);
}
VOID
FRS_EDIT::KeyUp(
IN HWND WindowHandle
)
{
ScrollUp(WindowHandle);
}
VOID
FRS_EDIT::KeyDown(
IN HWND WindowHandle
)
{
ScrollDown(WindowHandle);
}
VOID
FRS_EDIT::DisplayStandardInformation(
IN PATTRIBUTE_RECORD_HEADER pRec,
IN HDC DeviceContext,
IN OUT INT &CurrentLine
)
{
PSTANDARD_INFORMATION2 Info2;
PSTANDARD_INFORMATION Info;
PTCHAR pc;
TCHAR sbFlags[32];
Info = (PSTANDARD_INFORMATION ) ((PCHAR)pRec + pRec->Form.Resident.ValueOffset);
Info2 = (PSTANDARD_INFORMATION2) ((PCHAR)pRec + pRec->Form.Resident.ValueOffset);
swprintf( buf, TEXT( " CreationTime: %16I64x" ), Info->CreationTime );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " LastModificationTime: %16I64x" ), Info->LastModificationTime );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " LastChangeTime: %16I64x" ), Info->LastChangeTime );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " LastAccessTime: %16I64x" ), Info->LastAccessTime );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " FileAttributes: %08lx" ), Info->FileAttributes );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " MaximumVersions: %08lx" ), Info->MaximumVersions );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " VersionNumber: %08lx" ), Info->VersionNumber );
WriteLine( DeviceContext, CurrentLine++, buf );
if (pRec->Form.Resident.ValueLength == sizeof( STANDARD_INFORMATION2 )) {
swprintf( buf, TEXT( " ClassId: %08lx" ), Info2->ClassId );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " OwnerId: %08lx" ), Info2->OwnerId );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " SecurityId: %08lx" ), Info2->SecurityId );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " QuotaCharged: %16I64x" ), Info2->QuotaCharged );
WriteLine( DeviceContext, CurrentLine++, buf );
swprintf( buf, TEXT( " Usn: %16I64x" ), Info2->Usn );
WriteLine( DeviceContext, CurrentLine++, buf );
}
}
VOID
FRS_EDIT::DisplayFileName(
IN PATTRIBUTE_RECORD_HEADER pRec,
IN HDC DeviceContext,
IN OUT INT &CurrentLine
)
{
PFILE_NAME pfn;
PTCHAR pc;
TCHAR sbFlags[32];
pfn = (PFILE_NAME)((PCHAR)pRec + pRec->Form.Resident.ValueOffset);
swprintf(buf, TEXT(" File name: \t"));
pc = buf + wcslen(buf);
for (int i = 0; i < min(64, pfn->FileNameLength); ++i) {
*pc++ = (CHAR)pfn->FileName[i];
}
*pc++ = '\0';
if (pfn->FileNameLength > 64) {
wcscat(buf, TEXT("..."));
}
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" FILE_REFERENCE ParentDirectory {"));
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" LowPart: \t %x"),
pfn->ParentDirectory.LowPart);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" Sequence number: %x"),
pfn->ParentDirectory.SequenceNumber);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
if (pfn->Flags & FILE_NAME_NTFS) {
wcscpy(sbFlags, TEXT("N"));
} else {
wcscpy(sbFlags, TEXT(" "));
}
if (pfn->Flags & FILE_NAME_DOS) {
wcscat(sbFlags, TEXT("D"));
}
swprintf(buf, TEXT(" Flags: \t%x \t%s"), pfn->Flags, sbFlags);
WriteLine(DeviceContext, CurrentLine++, buf);
}
VOID
FRS_EDIT::DisplayAttrList(
IN PATTRIBUTE_RECORD_HEADER pRec,
IN HDC DeviceContext,
IN OUT INT &CurrentLine
)
{
PATTRIBUTE_LIST_ENTRY CurrentEntry;
PTCHAR pc;
CHAR sbFlags[32];
ULONG LengthOfList = pRec->Form.Resident.ValueLength;
ULONG CurrentOffset;
swprintf(buf, TEXT(" Attribute List Data {"));
WriteLine(DeviceContext, CurrentLine++, buf);
CurrentEntry = (PATTRIBUTE_LIST_ENTRY)((PCHAR)pRec +
pRec->Form.Resident.ValueOffset);
CurrentOffset = 0;
while (CurrentOffset < LengthOfList) {
if (0 != CurrentOffset) {
CurrentLine++;
}
PTCHAR SymbolicTypeCode = GetNtfsAttributeTypeCodeName(
CurrentEntry->AttributeTypeCode);
swprintf(buf, TEXT("\tAttribute type code: \t%x (%s)"),
CurrentEntry->AttributeTypeCode, SymbolicTypeCode);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tRecord length \t\t%x"), CurrentEntry->RecordLength);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tAttribute name length \t%x"),
CurrentEntry->AttributeNameLength);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tAttribute name offset \t%x"),
CurrentEntry->AttributeNameOffset);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tLowest vcn \t\t<%x,%x>"),
CurrentEntry->LowestVcn.GetHighPart(),
CurrentEntry->LowestVcn.GetLowPart());
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tSegment reference: \t<%x,%x>"),
CurrentEntry->SegmentReference.HighPart,
CurrentEntry->SegmentReference.LowPart,
CurrentEntry->SegmentReference.SequenceNumber);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tSequence number: \t%x"),
CurrentEntry->SegmentReference.SequenceNumber);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tInstance: \t\t%x"), CurrentEntry->Instance);
WriteLine(DeviceContext, CurrentLine++, buf);
swprintf(buf, TEXT("\tAttribute name:\t\t"));
pc = buf + wcslen(buf);
for (int i = 0; i < min(64, CurrentEntry->AttributeNameLength); ++i) {
*pc++ = (CHAR)CurrentEntry->AttributeName[i];
}
*pc++ = '\0';
if (CurrentEntry->AttributeNameLength > 64) {
wcscat(buf, TEXT("..."));
}
WriteLine(DeviceContext, CurrentLine++, buf);
CurrentOffset += CurrentEntry->RecordLength;
CurrentEntry = NextEntry(CurrentEntry);
}
swprintf(buf, TEXT(" }"));
WriteLine(DeviceContext, CurrentLine++, buf);
}