^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /* SPDX-License-Identifier: GPL-2.0-or-later */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * layout.h - All NTFS associated on-disk structures. Part of the Linux-NTFS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * project.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Copyright (c) 2001-2005 Anton Altaparmakov
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Copyright (c) 2002 Richard Russon
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #ifndef _LINUX_NTFS_LAYOUT_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #define _LINUX_NTFS_LAYOUT_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/bitops.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <asm/byteorder.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include "types.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) /* The NTFS oem_id "NTFS " */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #define magicNTFS cpu_to_le64(0x202020205346544eULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * Location of bootsector on partition:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * The standard NTFS_BOOT_SECTOR is on sector 0 of the partition.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) * On NT4 and above there is one backup copy of the boot sector to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) * be found on the last sector of the partition (not normally accessible
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) * from within Windows as the bootsector contained number of sectors
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * value is one less than the actual value!).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * On versions of NT 3.51 and earlier, the backup copy was located at
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * number of sectors/2 (integer divide), i.e. in the middle of the volume.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) * BIOS parameter block (bpb) structure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) le16 bytes_per_sector; /* Size of a sector in bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) u8 sectors_per_cluster; /* Size of a cluster in sectors. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) le16 reserved_sectors; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) u8 fats; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) le16 root_entries; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) le16 sectors; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) u8 media_type; /* 0xf8 = hard disk */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) le16 sectors_per_fat; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) le16 sectors_per_track; /* irrelevant */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) le16 heads; /* irrelevant */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) le32 hidden_sectors; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) le32 large_sectors; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) } __attribute__ ((__packed__)) BIOS_PARAMETER_BLOCK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) * NTFS boot sector structure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) u8 jump[3]; /* Irrelevant (jump to boot up code).*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) le64 oem_id; /* Magic "NTFS ". */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) BIOS_PARAMETER_BLOCK bpb; /* See BIOS_PARAMETER_BLOCK. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) u8 unused[4]; /* zero, NTFS diskedit.exe states that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) this is actually:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) __u8 physical_drive; // 0x80
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) __u8 current_head; // zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) __u8 extended_boot_signature;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) // 0x80
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) __u8 unused; // zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) /*0x28*/sle64 number_of_sectors; /* Number of sectors in volume. Gives
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) maximum volume size of 2^63 sectors.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) Assuming standard sector size of 512
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) bytes, the maximum byte size is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) approx. 4.7x10^21 bytes. (-; */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) sle64 mft_lcn; /* Cluster location of mft data. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) sle64 mftmirr_lcn; /* Cluster location of copy of mft. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) s8 clusters_per_mft_record; /* Mft record size in clusters. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) u8 reserved0[3]; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) s8 clusters_per_index_record; /* Index block size in clusters. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) u8 reserved1[3]; /* zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) le64 volume_serial_number; /* Irrelevant (serial number). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) le32 checksum; /* Boot sector checksum. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) /*0x54*/u8 bootstrap[426]; /* Irrelevant (boot up code). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) le16 end_of_sector_marker; /* End of bootsector magic. Always is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) 0xaa55 in little endian. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) /* sizeof() = 512 (0x200) bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) } __attribute__ ((__packed__)) NTFS_BOOT_SECTOR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) * Magic identifiers present at the beginning of all ntfs record containing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) * records (like mft records for example).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) /* Found in $MFT/$DATA. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) magic_FILE = cpu_to_le32(0x454c4946), /* Mft entry. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) magic_INDX = cpu_to_le32(0x58444e49), /* Index buffer. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) magic_HOLE = cpu_to_le32(0x454c4f48), /* ? (NTFS 3.0+?) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) /* Found in $LogFile/$DATA. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) magic_RSTR = cpu_to_le32(0x52545352), /* Restart page. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) magic_RCRD = cpu_to_le32(0x44524352), /* Log record page. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) /* Found in $LogFile/$DATA. (May be found in $MFT/$DATA, also?) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) magic_CHKD = cpu_to_le32(0x444b4843), /* Modified by chkdsk. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) /* Found in all ntfs record containing records. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) magic_BAAD = cpu_to_le32(0x44414142), /* Failed multi sector
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) transfer was detected. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) * Found in $LogFile/$DATA when a page is full of 0xff bytes and is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) * thus not initialized. Page must be initialized before using it.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) magic_empty = cpu_to_le32(0xffffffff) /* Record is empty. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) typedef le32 NTFS_RECORD_TYPE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) * Generic magic comparison macros. Finally found a use for the ## preprocessor
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) * operator! (-8
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) static inline bool __ntfs_is_magic(le32 x, NTFS_RECORD_TYPE r)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) return (x == r);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) #define ntfs_is_magic(x, m) __ntfs_is_magic(x, magic_##m)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) static inline bool __ntfs_is_magicp(le32 *p, NTFS_RECORD_TYPE r)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) return (*p == r);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) #define ntfs_is_magicp(p, m) __ntfs_is_magicp(p, magic_##m)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) * Specialised magic comparison macros for the NTFS_RECORD_TYPEs defined above.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) #define ntfs_is_file_record(x) ( ntfs_is_magic (x, FILE) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) #define ntfs_is_file_recordp(p) ( ntfs_is_magicp(p, FILE) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) #define ntfs_is_mft_record(x) ( ntfs_is_file_record (x) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) #define ntfs_is_mft_recordp(p) ( ntfs_is_file_recordp(p) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) #define ntfs_is_indx_record(x) ( ntfs_is_magic (x, INDX) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) #define ntfs_is_indx_recordp(p) ( ntfs_is_magicp(p, INDX) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) #define ntfs_is_hole_record(x) ( ntfs_is_magic (x, HOLE) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) #define ntfs_is_hole_recordp(p) ( ntfs_is_magicp(p, HOLE) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) #define ntfs_is_rstr_record(x) ( ntfs_is_magic (x, RSTR) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) #define ntfs_is_rstr_recordp(p) ( ntfs_is_magicp(p, RSTR) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) #define ntfs_is_rcrd_record(x) ( ntfs_is_magic (x, RCRD) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) #define ntfs_is_rcrd_recordp(p) ( ntfs_is_magicp(p, RCRD) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) #define ntfs_is_chkd_record(x) ( ntfs_is_magic (x, CHKD) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) #define ntfs_is_chkd_recordp(p) ( ntfs_is_magicp(p, CHKD) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) #define ntfs_is_baad_record(x) ( ntfs_is_magic (x, BAAD) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) #define ntfs_is_baad_recordp(p) ( ntfs_is_magicp(p, BAAD) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) #define ntfs_is_empty_record(x) ( ntfs_is_magic (x, empty) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) #define ntfs_is_empty_recordp(p) ( ntfs_is_magicp(p, empty) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) * The Update Sequence Array (usa) is an array of the le16 values which belong
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) * to the end of each sector protected by the update sequence record in which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) * this array is contained. Note that the first entry is the Update Sequence
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) * Number (usn), a cyclic counter of how many times the protected record has
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) * been written to disk. The values 0 and -1 (ie. 0xffff) are not used. All
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) * last le16's of each sector have to be equal to the usn (during reading) or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) * are set to it (during writing). If they are not, an incomplete multi sector
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) * transfer has occurred when the data was written.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) * The maximum size for the update sequence array is fixed to:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) * maximum size = usa_ofs + (usa_count * 2) = 510 bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) * The 510 bytes comes from the fact that the last le16 in the array has to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) * (obviously) finish before the last le16 of the first 512-byte sector.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) * This formula can be used as a consistency check in that usa_ofs +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) * (usa_count * 2) has to be less than or equal to 510.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) NTFS_RECORD_TYPE magic; /* A four-byte magic identifying the record
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) type and/or status. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) le16 usa_ofs; /* Offset to the Update Sequence Array (usa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) from the start of the ntfs record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) le16 usa_count; /* Number of le16 sized entries in the usa
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) including the Update Sequence Number (usn),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) thus the number of fixups is the usa_count
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) minus 1. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) } __attribute__ ((__packed__)) NTFS_RECORD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) * System files mft record numbers. All these files are always marked as used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) * in the bitmap attribute of the mft; presumably in order to avoid accidental
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) * allocation for random other mft records. Also, the sequence number for each
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) * of the system files is always equal to their mft record number and it is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) * never modified.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) typedef enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) FILE_MFT = 0, /* Master file table (mft). Data attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) contains the entries and bitmap attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) records which ones are in use (bit==1). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) FILE_MFTMirr = 1, /* Mft mirror: copy of first four mft records
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) in data attribute. If cluster size > 4kiB,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) copy of first N mft records, with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) N = cluster_size / mft_record_size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) FILE_LogFile = 2, /* Journalling log in data attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) FILE_Volume = 3, /* Volume name attribute and volume information
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) attribute (flags and ntfs version). Windows
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) refers to this file as volume DASD (Direct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) Access Storage Device). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) FILE_AttrDef = 4, /* Array of attribute definitions in data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) FILE_root = 5, /* Root directory. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) FILE_Bitmap = 6, /* Allocation bitmap of all clusters (lcns) in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) data attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) FILE_Boot = 7, /* Boot sector (always at cluster 0) in data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) FILE_BadClus = 8, /* Contains all bad clusters in the non-resident
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) data attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) FILE_Secure = 9, /* Shared security descriptors in data attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) and two indexes into the descriptors.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) Appeared in Windows 2000. Before that, this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) file was named $Quota but was unused. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) FILE_UpCase = 10, /* Uppercase equivalents of all 65536 Unicode
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) characters in data attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) FILE_Extend = 11, /* Directory containing other system files (eg.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) $ObjId, $Quota, $Reparse and $UsnJrnl). This
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) is new to NTFS3.0. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) FILE_reserved12 = 12, /* Reserved for future use (records 12-15). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) FILE_reserved13 = 13,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) FILE_reserved14 = 14,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) FILE_reserved15 = 15,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) FILE_first_user = 16, /* First user file, used as test limit for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) whether to allow opening a file or not. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) } NTFS_SYSTEM_FILES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) * These are the so far known MFT_RECORD_* flags (16-bit) which contain
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) * information about the mft record in which they are present.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) MFT_RECORD_IN_USE = cpu_to_le16(0x0001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) MFT_RECORD_IS_DIRECTORY = cpu_to_le16(0x0002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) typedef le16 MFT_RECORD_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) * mft references (aka file references or file record segment references) are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) * used whenever a structure needs to refer to a record in the mft.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) * A reference consists of a 48-bit index into the mft and a 16-bit sequence
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) * number used to detect stale references.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) * For error reporting purposes we treat the 48-bit index as a signed quantity.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) * The sequence number is a circular counter (skipping 0) describing how many
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) * times the referenced mft record has been (re)used. This has to match the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) * sequence number of the mft record being referenced, otherwise the reference
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) * is considered stale and removed (FIXME: only ntfsck or the driver itself?).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) * If the sequence number is zero it is assumed that no sequence number
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) * consistency checking should be performed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) * FIXME: Since inodes are 32-bit as of now, the driver needs to always check
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) * for high_part being 0 and if not either BUG(), cause a panic() or handle
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) * the situation in some other way. This shouldn't be a problem as a volume has
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) * to become HUGE in order to need more than 32-bits worth of mft records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) * Assuming the standard mft record size of 1kb only the records (never mind
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) * the non-resident attributes, etc.) would require 4Tb of space on their own
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) * for the first 32 bits worth of records. This is only if some strange person
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) * doesn't decide to foul play and make the mft sparse which would be a really
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) * horrible thing to do as it would trash our current driver implementation. )-:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) * Do I hear screams "we want 64-bit inodes!" ?!? (-;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) * FIXME: The mft zone is defined as the first 12% of the volume. This space is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) * reserved so that the mft can grow contiguously and hence doesn't become
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) * fragmented. Volume free space includes the empty part of the mft zone and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) * when the volume's free 88% are used up, the mft zone is shrunk by a factor
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) * of 2, thus making more space available for more files/data. This process is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) * repeated every time there is no more free space except for the mft zone until
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) * there really is no more free space.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) * Typedef the MFT_REF as a 64-bit value for easier handling.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) * Also define two unpacking macros to get to the reference (MREF) and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) * sequence number (MSEQNO) respectively.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) * The _LE versions are to be applied on little endian MFT_REFs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) * Note: The _LE versions will return a CPU endian formatted value!
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) #define MFT_REF_MASK_CPU 0x0000ffffffffffffULL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) #define MFT_REF_MASK_LE cpu_to_le64(MFT_REF_MASK_CPU)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) typedef u64 MFT_REF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) typedef le64 leMFT_REF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) #define MK_MREF(m, s) ((MFT_REF)(((MFT_REF)(s) << 48) | \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) ((MFT_REF)(m) & MFT_REF_MASK_CPU)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) #define MK_LE_MREF(m, s) cpu_to_le64(MK_MREF(m, s))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) #define MREF(x) ((unsigned long)((x) & MFT_REF_MASK_CPU))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) #define MSEQNO(x) ((u16)(((x) >> 48) & 0xffff))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) #define MREF_LE(x) ((unsigned long)(le64_to_cpu(x) & MFT_REF_MASK_CPU))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) #define MSEQNO_LE(x) ((u16)((le64_to_cpu(x) >> 48) & 0xffff))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) #define IS_ERR_MREF(x) (((x) & 0x0000800000000000ULL) ? true : false)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) #define ERR_MREF(x) ((u64)((s64)(x)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) #define MREF_ERR(x) ((int)((s64)(x)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) * The mft record header present at the beginning of every record in the mft.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) * This is followed by a sequence of variable length attribute records which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) * is terminated by an attribute of type AT_END which is a truncated attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) * in that it only consists of the attribute type code AT_END and none of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) * other members of the attribute structure are present.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) /* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) NTFS_RECORD_TYPE magic; /* Usually the magic is "FILE". */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) le16 usa_ofs; /* See NTFS_RECORD definition above. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) le16 usa_count; /* See NTFS_RECORD definition above. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) /* 8*/ le64 lsn; /* $LogFile sequence number for this record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) Changed every time the record is modified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) /* 16*/ le16 sequence_number; /* Number of times this mft record has been
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) reused. (See description for MFT_REF
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) above.) NOTE: The increment (skipping zero)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) is done when the file is deleted. NOTE: If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) this is zero it is left zero. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) /* 18*/ le16 link_count; /* Number of hard links, i.e. the number of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) directory entries referencing this record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) NOTE: Only used in mft base records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) NOTE: When deleting a directory entry we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) check the link_count and if it is 1 we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) delete the file. Otherwise we delete the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) FILE_NAME_ATTR being referenced by the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) directory entry from the mft record and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) decrement the link_count.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) FIXME: Careful with Win32 + DOS names! */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) /* 20*/ le16 attrs_offset; /* Byte offset to the first attribute in this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) mft record from the start of the mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) NOTE: Must be aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) /* 22*/ MFT_RECORD_FLAGS flags; /* Bit array of MFT_RECORD_FLAGS. When a file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) is deleted, the MFT_RECORD_IN_USE flag is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) set to zero. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) /* 24*/ le32 bytes_in_use; /* Number of bytes used in this mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) NOTE: Must be aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) /* 28*/ le32 bytes_allocated; /* Number of bytes allocated for this mft
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) record. This should be equal to the mft
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) record size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) /* 32*/ leMFT_REF base_mft_record;/* This is zero for base mft records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) When it is not zero it is a mft reference
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) pointing to the base mft record to which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) this record belongs (this is then used to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) locate the attribute list attribute present
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) in the base record which describes this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) extension record and hence might need
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) modification when the extension record
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) itself is modified, also locating the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) attribute list also means finding the other
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) potential extents, belonging to the non-base
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) mft record). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) /* 40*/ le16 next_attr_instance;/* The instance number that will be assigned to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) the next attribute added to this mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) NOTE: Incremented each time after it is used.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) NOTE: Every time the mft record is reused
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) this number is set to zero. NOTE: The first
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) instance number is always 0. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) /* The below fields are specific to NTFS 3.1+ (Windows XP and above): */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) /* 42*/ le16 reserved; /* Reserved/alignment. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) /* 44*/ le32 mft_record_number; /* Number of this mft record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) /* sizeof() = 48 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) * When (re)using the mft record, we place the update sequence array at this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) * offset, i.e. before we start with the attributes. This also makes sense,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) * otherwise we could run into problems with the update sequence array
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) * containing in itself the last two bytes of a sector which would mean that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) * multi sector transfer protection wouldn't work. As you can't protect data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) * by overwriting it since you then can't get it back...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) * When reading we obviously use the data from the ntfs record header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) } __attribute__ ((__packed__)) MFT_RECORD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) /* This is the version without the NTFS 3.1+ specific fields. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) /* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) NTFS_RECORD_TYPE magic; /* Usually the magic is "FILE". */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) le16 usa_ofs; /* See NTFS_RECORD definition above. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) le16 usa_count; /* See NTFS_RECORD definition above. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) /* 8*/ le64 lsn; /* $LogFile sequence number for this record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) Changed every time the record is modified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) /* 16*/ le16 sequence_number; /* Number of times this mft record has been
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) reused. (See description for MFT_REF
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) above.) NOTE: The increment (skipping zero)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) is done when the file is deleted. NOTE: If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) this is zero it is left zero. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) /* 18*/ le16 link_count; /* Number of hard links, i.e. the number of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) directory entries referencing this record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) NOTE: Only used in mft base records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) NOTE: When deleting a directory entry we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) check the link_count and if it is 1 we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) delete the file. Otherwise we delete the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) FILE_NAME_ATTR being referenced by the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) directory entry from the mft record and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) decrement the link_count.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) FIXME: Careful with Win32 + DOS names! */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) /* 20*/ le16 attrs_offset; /* Byte offset to the first attribute in this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) mft record from the start of the mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) NOTE: Must be aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) /* 22*/ MFT_RECORD_FLAGS flags; /* Bit array of MFT_RECORD_FLAGS. When a file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) is deleted, the MFT_RECORD_IN_USE flag is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) set to zero. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) /* 24*/ le32 bytes_in_use; /* Number of bytes used in this mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) NOTE: Must be aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) /* 28*/ le32 bytes_allocated; /* Number of bytes allocated for this mft
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) record. This should be equal to the mft
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) record size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) /* 32*/ leMFT_REF base_mft_record;/* This is zero for base mft records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) When it is not zero it is a mft reference
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) pointing to the base mft record to which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) this record belongs (this is then used to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) locate the attribute list attribute present
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) in the base record which describes this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) extension record and hence might need
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) modification when the extension record
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) itself is modified, also locating the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) attribute list also means finding the other
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) potential extents, belonging to the non-base
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) mft record). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) /* 40*/ le16 next_attr_instance;/* The instance number that will be assigned to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) the next attribute added to this mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) NOTE: Incremented each time after it is used.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) NOTE: Every time the mft record is reused
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) this number is set to zero. NOTE: The first
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) instance number is always 0. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) /* sizeof() = 42 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) * When (re)using the mft record, we place the update sequence array at this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) * offset, i.e. before we start with the attributes. This also makes sense,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) * otherwise we could run into problems with the update sequence array
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) * containing in itself the last two bytes of a sector which would mean that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) * multi sector transfer protection wouldn't work. As you can't protect data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) * by overwriting it since you then can't get it back...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) * When reading we obviously use the data from the ntfs record header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) } __attribute__ ((__packed__)) MFT_RECORD_OLD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) * System defined attributes (32-bit). Each attribute type has a corresponding
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) * attribute name (Unicode string of maximum 64 character length) as described
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) * by the attribute definitions present in the data attribute of the $AttrDef
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) * system file. On NTFS 3.0 volumes the names are just as the types are named
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) * in the below defines exchanging AT_ for the dollar sign ($). If that is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) * a revealing choice of symbol I do not know what is... (-;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) AT_UNUSED = cpu_to_le32( 0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) AT_STANDARD_INFORMATION = cpu_to_le32( 0x10),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) AT_ATTRIBUTE_LIST = cpu_to_le32( 0x20),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) AT_FILE_NAME = cpu_to_le32( 0x30),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) AT_OBJECT_ID = cpu_to_le32( 0x40),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) AT_SECURITY_DESCRIPTOR = cpu_to_le32( 0x50),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) AT_VOLUME_NAME = cpu_to_le32( 0x60),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) AT_VOLUME_INFORMATION = cpu_to_le32( 0x70),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) AT_DATA = cpu_to_le32( 0x80),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) AT_INDEX_ROOT = cpu_to_le32( 0x90),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) AT_INDEX_ALLOCATION = cpu_to_le32( 0xa0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) AT_BITMAP = cpu_to_le32( 0xb0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) AT_REPARSE_POINT = cpu_to_le32( 0xc0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) AT_EA_INFORMATION = cpu_to_le32( 0xd0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) AT_EA = cpu_to_le32( 0xe0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) AT_PROPERTY_SET = cpu_to_le32( 0xf0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) AT_LOGGED_UTILITY_STREAM = cpu_to_le32( 0x100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) AT_FIRST_USER_DEFINED_ATTRIBUTE = cpu_to_le32( 0x1000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) AT_END = cpu_to_le32(0xffffffff)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) typedef le32 ATTR_TYPE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) * The collation rules for sorting views/indexes/etc (32-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) * COLLATION_BINARY - Collate by binary compare where the first byte is most
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) * significant.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) * COLLATION_UNICODE_STRING - Collate Unicode strings by comparing their binary
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) * Unicode values, except that when a character can be uppercased, the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) * upper case value collates before the lower case one.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) * COLLATION_FILE_NAME - Collate file names as Unicode strings. The collation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) * is done very much like COLLATION_UNICODE_STRING. In fact I have no idea
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) * what the difference is. Perhaps the difference is that file names
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) * would treat some special characters in an odd way (see
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) * unistr.c::ntfs_collate_names() and unistr.c::legal_ansi_char_array[]
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) * for what I mean but COLLATION_UNICODE_STRING would not give any special
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) * treatment to any characters at all, but this is speculation.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) * COLLATION_NTOFS_ULONG - Sorting is done according to ascending le32 key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) * values. E.g. used for $SII index in FILE_Secure, which sorts by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) * security_id (le32).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) * COLLATION_NTOFS_SID - Sorting is done according to ascending SID values.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) * E.g. used for $O index in FILE_Extend/$Quota.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) * COLLATION_NTOFS_SECURITY_HASH - Sorting is done first by ascending hash
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) * values and second by ascending security_id values. E.g. used for $SDH
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) * index in FILE_Secure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) * COLLATION_NTOFS_ULONGS - Sorting is done according to a sequence of ascending
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) * le32 key values. E.g. used for $O index in FILE_Extend/$ObjId, which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) * sorts by object_id (16-byte), by splitting up the object_id in four
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) * le32 values and using them as individual keys. E.g. take the following
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) * two security_ids, stored as follows on disk:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) * 1st: a1 61 65 b7 65 7b d4 11 9e 3d 00 e0 81 10 42 59
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) * 2nd: 38 14 37 d2 d2 f3 d4 11 a5 21 c8 6b 79 b1 97 45
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) * To compare them, they are split into four le32 values each, like so:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) * 1st: 0xb76561a1 0x11d47b65 0xe0003d9e 0x59421081
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) * 2nd: 0xd2371438 0x11d4f3d2 0x6bc821a5 0x4597b179
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) * Now, it is apparent why the 2nd object_id collates after the 1st: the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) * first le32 value of the 1st object_id is less than the first le32 of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) * the 2nd object_id. If the first le32 values of both object_ids were
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) * equal then the second le32 values would be compared, etc.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) COLLATION_BINARY = cpu_to_le32(0x00),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) COLLATION_FILE_NAME = cpu_to_le32(0x01),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) COLLATION_UNICODE_STRING = cpu_to_le32(0x02),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) COLLATION_NTOFS_ULONG = cpu_to_le32(0x10),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) COLLATION_NTOFS_SID = cpu_to_le32(0x11),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) COLLATION_NTOFS_SECURITY_HASH = cpu_to_le32(0x12),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) COLLATION_NTOFS_ULONGS = cpu_to_le32(0x13),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) typedef le32 COLLATION_RULE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) * The flags (32-bit) describing attribute properties in the attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) * definition structure. FIXME: This information is based on Regis's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) * information and, according to him, it is not certain and probably
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) * incomplete. The INDEXABLE flag is fairly certainly correct as only the file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) * name attribute has this flag set and this is the only attribute indexed in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) * NT4.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) ATTR_DEF_INDEXABLE = cpu_to_le32(0x02), /* Attribute can be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) indexed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) ATTR_DEF_MULTIPLE = cpu_to_le32(0x04), /* Attribute type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) can be present multiple times in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) mft records of an inode. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) ATTR_DEF_NOT_ZERO = cpu_to_le32(0x08), /* Attribute value
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) must contain at least one non-zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) byte. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) ATTR_DEF_INDEXED_UNIQUE = cpu_to_le32(0x10), /* Attribute must be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) indexed and the attribute value must be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) unique for the attribute type in all of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) the mft records of an inode. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) ATTR_DEF_NAMED_UNIQUE = cpu_to_le32(0x20), /* Attribute must be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) named and the name must be unique for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) the attribute type in all of the mft
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) records of an inode. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) ATTR_DEF_RESIDENT = cpu_to_le32(0x40), /* Attribute must be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) resident. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) ATTR_DEF_ALWAYS_LOG = cpu_to_le32(0x80), /* Always log
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) modifications to this attribute,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) regardless of whether it is resident or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) non-resident. Without this, only log
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) modifications if the attribute is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) resident. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) typedef le32 ATTR_DEF_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) * The data attribute of FILE_AttrDef contains a sequence of attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) * definitions for the NTFS volume. With this, it is supposed to be safe for an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) * older NTFS driver to mount a volume containing a newer NTFS version without
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) * damaging it (that's the theory. In practice it's: not damaging it too much).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) * Entries are sorted by attribute type. The flags describe whether the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) * attribute can be resident/non-resident and possibly other things, but the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) * actual bits are unknown.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) /*hex ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) /* 0*/ ntfschar name[0x40]; /* Unicode name of the attribute. Zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) terminated. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) /* 80*/ ATTR_TYPE type; /* Type of the attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) /* 84*/ le32 display_rule; /* Default display rule.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) FIXME: What does it mean? (AIA) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) /* 88*/ COLLATION_RULE collation_rule; /* Default collation rule. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) /* 8c*/ ATTR_DEF_FLAGS flags; /* Flags describing the attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583) /* 90*/ sle64 min_size; /* Optional minimum attribute size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) /* 98*/ sle64 max_size; /* Maximum size of attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) /* sizeof() = 0xa0 or 160 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) } __attribute__ ((__packed__)) ATTR_DEF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) * Attribute flags (16-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592) ATTR_IS_COMPRESSED = cpu_to_le16(0x0001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) ATTR_COMPRESSION_MASK = cpu_to_le16(0x00ff), /* Compression method
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) mask. Also, first
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) illegal value. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) ATTR_IS_ENCRYPTED = cpu_to_le16(0x4000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) ATTR_IS_SPARSE = cpu_to_le16(0x8000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) typedef le16 ATTR_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) * Attribute compression.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) * Only the data attribute is ever compressed in the current ntfs driver in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) * Windows. Further, compression is only applied when the data attribute is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) * non-resident. Finally, to use compression, the maximum allowed cluster size
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) * on a volume is 4kib.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) * The compression method is based on independently compressing blocks of X
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) * clusters, where X is determined from the compression_unit value found in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) * non-resident attribute record header (more precisely: X = 2^compression_unit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613) * clusters). On Windows NT/2k, X always is 16 clusters (compression_unit = 4).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615) * There are three different cases of how a compression block of X clusters
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616) * can be stored:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) * 1) The data in the block is all zero (a sparse block):
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) * This is stored as a sparse block in the runlist, i.e. the runlist
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620) * entry has length = X and lcn = -1. The mapping pairs array actually
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) * uses a delta_lcn value length of 0, i.e. delta_lcn is not present at
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622) * all, which is then interpreted by the driver as lcn = -1.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) * NOTE: Even uncompressed files can be sparse on NTFS 3.0 volumes, then
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624) * the same principles apply as above, except that the length is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625) * restricted to being any particular value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) * 2) The data in the block is not compressed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) * This happens when compression doesn't reduce the size of the block
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) * in clusters. I.e. if compression has a small effect so that the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630) * compressed data still occupies X clusters, then the uncompressed data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) * is stored in the block.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) * This case is recognised by the fact that the runlist entry has
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) * length = X and lcn >= 0. The mapping pairs array stores this as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) * normal with a run length of X and some specific delta_lcn, i.e.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635) * delta_lcn has to be present.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) * 3) The data in the block is compressed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) * The common case. This case is recognised by the fact that the run
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) * list entry has length L < X and lcn >= 0. The mapping pairs array
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640) * stores this as normal with a run length of X and some specific
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641) * delta_lcn, i.e. delta_lcn has to be present. This runlist entry is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) * immediately followed by a sparse entry with length = X - L and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) * lcn = -1. The latter entry is to make up the vcn counting to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) * full compression block size X.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) * In fact, life is more complicated because adjacent entries of the same type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) * can be coalesced. This means that one has to keep track of the number of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) * clusters handled and work on a basis of X clusters at a time being one
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) * block. An example: if length L > X this means that this particular runlist
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) * entry contains a block of length X and part of one or more blocks of length
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) * L - X. Another example: if length L < X, this does not necessarily mean that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) * the block is compressed as it might be that the lcn changes inside the block
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) * and hence the following runlist entry describes the continuation of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654) * potentially compressed block. The block would be compressed if the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) * following runlist entry describes at least X - L sparse clusters, thus
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656) * making up the compression block length as described in point 3 above. (Of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) * course, there can be several runlist entries with small lengths so that the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) * sparse entry does not follow the first data containing entry with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) * length < X.)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) * NOTE: At the end of the compressed attribute value, there most likely is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) * just the right amount of data to make up a compression block, thus this data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) * is not even attempted to be compressed. It is just stored as is, unless
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) * the number of clusters it occupies is reduced when compressed in which case
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) * it is stored as a compressed compression block, complete with sparse
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) * clusters at the end.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670) * Flags of resident attributes (8-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) RESIDENT_ATTR_IS_INDEXED = 0x01, /* Attribute is referenced in an index
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674) (has implications for deleting and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675) modifying the attribute). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) typedef u8 RESIDENT_ATTR_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) * Attribute record header. Always aligned to 8-byte boundary.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685) /* 0*/ ATTR_TYPE type; /* The (32-bit) type of the attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) /* 4*/ le32 length; /* Byte size of the resident part of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) attribute (aligned to 8-byte boundary).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688) Used to get to the next attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689) /* 8*/ u8 non_resident; /* If 0, attribute is resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) If 1, attribute is non-resident. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) /* 9*/ u8 name_length; /* Unicode character size of name of attribute.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) 0 if unnamed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) /* 10*/ le16 name_offset; /* If name_length != 0, the byte offset to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) beginning of the name from the attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) record. Note that the name is stored as a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696) Unicode string. When creating, place offset
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) just at the end of the record header. Then,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) follow with attribute value or mapping pairs
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) array, resident and non-resident attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) respectively, aligning to an 8-byte
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) /* 12*/ ATTR_FLAGS flags; /* Flags describing the attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) /* 14*/ le16 instance; /* The instance of this attribute record. This
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) number is unique within this mft record (see
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) MFT_RECORD/next_attribute_instance notes in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706) in mft.h for more details). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) /* 16*/ union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) /* Resident attributes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) /* 16 */ le32 value_length;/* Byte size of attribute value. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711) /* 20 */ le16 value_offset;/* Byte offset of the attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) value from the start of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713) attribute record. When creating,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714) align to 8-byte boundary if we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) have a name present as this might
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) not have a length of a multiple
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) of 8-bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718) /* 22 */ RESIDENT_ATTR_FLAGS flags; /* See above. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) /* 23 */ s8 reserved; /* Reserved/alignment to 8-byte
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721) } __attribute__ ((__packed__)) resident;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) /* Non-resident attributes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) /* 16*/ leVCN lowest_vcn;/* Lowest valid virtual cluster number
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) for this portion of the attribute value or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726) 0 if this is the only extent (usually the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) case). - Only when an attribute list is used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728) does lowest_vcn != 0 ever occur. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) /* 24*/ leVCN highest_vcn;/* Highest valid vcn of this extent of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730) the attribute value. - Usually there is only one
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) portion, so this usually equals the attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) value size in clusters minus 1. Can be -1 for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733) zero length files. Can be 0 for "single extent"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) attributes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) /* 32*/ le16 mapping_pairs_offset; /* Byte offset from the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) beginning of the structure to the mapping pairs
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) array which contains the mappings between the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) vcns and the logical cluster numbers (lcns).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) When creating, place this at the end of this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) record header aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741) /* 34*/ u8 compression_unit; /* The compression unit expressed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) as the log to the base 2 of the number of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) clusters in a compression unit. 0 means not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) compressed. (This effectively limits the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) compression unit size to be a power of two
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) clusters.) WinNT4 only uses a value of 4.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) Sparse files have this set to 0 on XPSP2. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) /* 35*/ u8 reserved[5]; /* Align to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) /* The sizes below are only used when lowest_vcn is zero, as otherwise it would
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750) be difficult to keep them up-to-date.*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) /* 40*/ sle64 allocated_size; /* Byte size of disk space
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) allocated to hold the attribute value. Always
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753) is a multiple of the cluster size. When a file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) is compressed, this field is a multiple of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) compression block size (2^compression_unit) and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) it represents the logically allocated space
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) rather than the actual on disk usage. For this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) use the compressed_size (see below). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) /* 48*/ sle64 data_size; /* Byte size of the attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760) value. Can be larger than allocated_size if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761) attribute value is compressed or sparse. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) /* 56*/ sle64 initialized_size; /* Byte size of initialized
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) portion of the attribute value. Usually equals
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) data_size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) /* sizeof(uncompressed attr) = 64*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) /* 64*/ sle64 compressed_size; /* Byte size of the attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) value after compression. Only present when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) compressed or sparse. Always is a multiple of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769) the cluster size. Represents the actual amount
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770) of disk space being used on the disk. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) /* sizeof(compressed attr) = 72*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) } __attribute__ ((__packed__)) non_resident;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) } __attribute__ ((__packed__)) data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) } __attribute__ ((__packed__)) ATTR_RECORD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776) typedef ATTR_RECORD ATTR_REC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) * File attribute flags (32-bit) appearing in the file_attributes fields of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) * STANDARD_INFORMATION attribute of MFT_RECORDs and the FILENAME_ATTR
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) * attributes of MFT_RECORDs and directory index entries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) * All of the below flags appear in the directory index entries but only some
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) * appear in the STANDARD_INFORMATION attribute whilst only some others appear
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) * in the FILENAME_ATTR attribute of MFT_RECORDs. Unless otherwise stated the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786) * flags appear in all of the above.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) FILE_ATTR_READONLY = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) FILE_ATTR_HIDDEN = cpu_to_le32(0x00000002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) FILE_ATTR_SYSTEM = cpu_to_le32(0x00000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) /* Old DOS volid. Unused in NT. = cpu_to_le32(0x00000008), */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) FILE_ATTR_DIRECTORY = cpu_to_le32(0x00000010),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795) /* Note, FILE_ATTR_DIRECTORY is not considered valid in NT. It is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) reserved for the DOS SUBDIRECTORY flag. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) FILE_ATTR_ARCHIVE = cpu_to_le32(0x00000020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) FILE_ATTR_DEVICE = cpu_to_le32(0x00000040),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) FILE_ATTR_NORMAL = cpu_to_le32(0x00000080),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) FILE_ATTR_TEMPORARY = cpu_to_le32(0x00000100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) FILE_ATTR_SPARSE_FILE = cpu_to_le32(0x00000200),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) FILE_ATTR_REPARSE_POINT = cpu_to_le32(0x00000400),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) FILE_ATTR_COMPRESSED = cpu_to_le32(0x00000800),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806) FILE_ATTR_OFFLINE = cpu_to_le32(0x00001000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807) FILE_ATTR_NOT_CONTENT_INDEXED = cpu_to_le32(0x00002000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808) FILE_ATTR_ENCRYPTED = cpu_to_le32(0x00004000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) FILE_ATTR_VALID_FLAGS = cpu_to_le32(0x00007fb7),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811) /* Note, FILE_ATTR_VALID_FLAGS masks out the old DOS VolId and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812) FILE_ATTR_DEVICE and preserves everything else. This mask is used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813) to obtain all flags that are valid for reading. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) FILE_ATTR_VALID_SET_FLAGS = cpu_to_le32(0x000031a7),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815) /* Note, FILE_ATTR_VALID_SET_FLAGS masks out the old DOS VolId, the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816) F_A_DEVICE, F_A_DIRECTORY, F_A_SPARSE_FILE, F_A_REPARSE_POINT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817) F_A_COMPRESSED, and F_A_ENCRYPTED and preserves the rest. This mask
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818) is used to obtain all flags that are valid for setting. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820) * The flag FILE_ATTR_DUP_FILENAME_INDEX_PRESENT is present in all
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821) * FILENAME_ATTR attributes but not in the STANDARD_INFORMATION
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822) * attribute of an mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824) FILE_ATTR_DUP_FILE_NAME_INDEX_PRESENT = cpu_to_le32(0x10000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) /* Note, this is a copy of the corresponding bit from the mft record,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826) telling us whether this is a directory or not, i.e. whether it has
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) an index root attribute or not. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828) FILE_ATTR_DUP_VIEW_INDEX_PRESENT = cpu_to_le32(0x20000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) /* Note, this is a copy of the corresponding bit from the mft record,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830) telling us whether this file has a view index present (eg. object id
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831) index, quota index, one of the security indexes or the encrypting
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832) filesystem related indexes). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835) typedef le32 FILE_ATTR_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) * NOTE on times in NTFS: All times are in MS standard time format, i.e. they
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839) * are the number of 100-nanosecond intervals since 1st January 1601, 00:00:00
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) * universal coordinated time (UTC). (In Linux time starts 1st January 1970,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) * 00:00:00 UTC and is stored as the number of 1-second intervals since then.)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) * Attribute: Standard information (0x10).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847) * NOTE: Always resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848) * NOTE: Present in all base file records on a volume.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) * NOTE: There is conflicting information about the meaning of each of the time
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) * fields but the meaning as defined below has been verified to be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851) * correct by practical experimentation on Windows NT4 SP6a and is hence
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852) * assumed to be the one and only correct interpretation.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856) /* 0*/ sle64 creation_time; /* Time file was created. Updated when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857) a filename is changed(?). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858) /* 8*/ sle64 last_data_change_time; /* Time the data attribute was last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) modified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) /* 16*/ sle64 last_mft_change_time; /* Time this mft record was last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861) modified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862) /* 24*/ sle64 last_access_time; /* Approximate time when the file was
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863) last accessed (obviously this is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) updated on read-only volumes). In
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865) Windows this is only updated when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) accessed if some time delta has
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867) passed since the last update. Also,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) last access time updates can be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869) disabled altogether for speed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870) /* 32*/ FILE_ATTR_FLAGS file_attributes; /* Flags describing the file. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871) /* 36*/ union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872) /* NTFS 1.2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) /* 36*/ u8 reserved12[12]; /* Reserved/alignment to 8-byte
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875) boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876) } __attribute__ ((__packed__)) v1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877) /* sizeof() = 48 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878) /* NTFS 3.x */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) * If a volume has been upgraded from a previous NTFS version, then these
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 882) * fields are present only if the file has been accessed since the upgrade.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 883) * Recognize the difference by comparing the length of the resident attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 884) * value. If it is 48, then the following fields are missing. If it is 72 then
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 885) * the fields are present. Maybe just check like this:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 886) * if (resident.ValueLength < sizeof(STANDARD_INFORMATION)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 887) * Assume NTFS 1.2- format.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 888) * If (volume version is 3.x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 889) * Upgrade attribute to NTFS 3.x format.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 890) * else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 891) * Use NTFS 1.2- format for access.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 892) * } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 893) * Use NTFS 3.x format for access.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 894) * Only problem is that it might be legal to set the length of the value to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 895) * arbitrarily large values thus spoiling this check. - But chkdsk probably
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 896) * views that as a corruption, assuming that it behaves like this for all
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 897) * attributes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 898) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 899) /* 36*/ le32 maximum_versions; /* Maximum allowed versions for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 900) file. Zero if version numbering is disabled. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 901) /* 40*/ le32 version_number; /* This file's version (if any).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 902) Set to zero if maximum_versions is zero. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 903) /* 44*/ le32 class_id; /* Class id from bidirectional
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 904) class id index (?). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 905) /* 48*/ le32 owner_id; /* Owner_id of the user owning
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 906) the file. Translate via $Q index in FILE_Extend
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 907) /$Quota to the quota control entry for the user
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 908) owning the file. Zero if quotas are disabled. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 909) /* 52*/ le32 security_id; /* Security_id for the file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 910) Translate via $SII index and $SDS data stream
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 911) in FILE_Secure to the security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 912) /* 56*/ le64 quota_charged; /* Byte size of the charge to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 913) the quota for all streams of the file. Note: Is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 914) zero if quotas are disabled. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 915) /* 64*/ leUSN usn; /* Last update sequence number
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 916) of the file. This is a direct index into the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 917) transaction log file ($UsnJrnl). It is zero if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 918) the usn journal is disabled or this file has
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 919) not been subject to logging yet. See usnjrnl.h
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 920) for details. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 921) } __attribute__ ((__packed__)) v3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 922) /* sizeof() = 72 bytes (NTFS 3.x) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 923) } __attribute__ ((__packed__)) ver;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 924) } __attribute__ ((__packed__)) STANDARD_INFORMATION;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 925)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 926) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 927) * Attribute: Attribute list (0x20).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 928) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 929) * - Can be either resident or non-resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 930) * - Value consists of a sequence of variable length, 8-byte aligned,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 931) * ATTR_LIST_ENTRY records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 932) * - The list is not terminated by anything at all! The only way to know when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 933) * the end is reached is to keep track of the current offset and compare it to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 934) * the attribute value size.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 935) * - The attribute list attribute contains one entry for each attribute of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 936) * the file in which the list is located, except for the list attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 937) * itself. The list is sorted: first by attribute type, second by attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 938) * name (if present), third by instance number. The extents of one
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 939) * non-resident attribute (if present) immediately follow after the initial
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 940) * extent. They are ordered by lowest_vcn and have their instace set to zero.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 941) * It is not allowed to have two attributes with all sorting keys equal.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 942) * - Further restrictions:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 943) * - If not resident, the vcn to lcn mapping array has to fit inside the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 944) * base mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 945) * - The attribute list attribute value has a maximum size of 256kb. This
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 946) * is imposed by the Windows cache manager.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 947) * - Attribute lists are only used when the attributes of mft record do not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 948) * fit inside the mft record despite all attributes (that can be made
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 949) * non-resident) having been made non-resident. This can happen e.g. when:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 950) * - File has a large number of hard links (lots of file name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 951) * attributes present).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 952) * - The mapping pairs array of some non-resident attribute becomes so
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 953) * large due to fragmentation that it overflows the mft record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 954) * - The security descriptor is very complex (not applicable to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 955) * NTFS 3.0 volumes).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 956) * - There are many named streams.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 957) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 958) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 959) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 960) /* 0*/ ATTR_TYPE type; /* Type of referenced attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 961) /* 4*/ le16 length; /* Byte size of this entry (8-byte aligned). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 962) /* 6*/ u8 name_length; /* Size in Unicode chars of the name of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 963) attribute or 0 if unnamed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 964) /* 7*/ u8 name_offset; /* Byte offset to beginning of attribute name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 965) (always set this to where the name would
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 966) start even if unnamed). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 967) /* 8*/ leVCN lowest_vcn; /* Lowest virtual cluster number of this portion
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 968) of the attribute value. This is usually 0. It
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 969) is non-zero for the case where one attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 970) does not fit into one mft record and thus
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 971) several mft records are allocated to hold
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 972) this attribute. In the latter case, each mft
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 973) record holds one extent of the attribute and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 974) there is one attribute list entry for each
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 975) extent. NOTE: This is DEFINITELY a signed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 976) value! The windows driver uses cmp, followed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 977) by jg when comparing this, thus it treats it
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 978) as signed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 979) /* 16*/ leMFT_REF mft_reference;/* The reference of the mft record holding
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 980) the ATTR_RECORD for this portion of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 981) attribute value. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 982) /* 24*/ le16 instance; /* If lowest_vcn = 0, the instance of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 983) attribute being referenced; otherwise 0. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 984) /* 26*/ ntfschar name[0]; /* Use when creating only. When reading use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 985) name_offset to determine the location of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 986) name. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 987) /* sizeof() = 26 + (attribute_name_length * 2) bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 988) } __attribute__ ((__packed__)) ATTR_LIST_ENTRY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 989)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 990) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 991) * The maximum allowed length for a file name.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 992) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 993) #define MAXIMUM_FILE_NAME_LENGTH 255
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 994)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 995) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 996) * Possible namespaces for filenames in ntfs (8-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 997) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 998) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 999) FILE_NAME_POSIX = 0x00,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1000) /* This is the largest namespace. It is case sensitive and allows all
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1001) Unicode characters except for: '\0' and '/'. Beware that in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1002) WinNT/2k/2003 by default files which eg have the same name except
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1003) for their case will not be distinguished by the standard utilities
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1004) and thus a "del filename" will delete both "filename" and "fileName"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1005) without warning. However if for example Services For Unix (SFU) are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1006) installed and the case sensitive option was enabled at installation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1007) time, then you can create/access/delete such files.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1008) Note that even SFU places restrictions on the filenames beyond the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1009) '\0' and '/' and in particular the following set of characters is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1010) not allowed: '"', '/', '<', '>', '\'. All other characters,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1011) including the ones no allowed in WIN32 namespace are allowed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1012) Tested with SFU 3.5 (this is now free) running on Windows XP. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1013) FILE_NAME_WIN32 = 0x01,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1014) /* The standard WinNT/2k NTFS long filenames. Case insensitive. All
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1015) Unicode chars except: '\0', '"', '*', '/', ':', '<', '>', '?', '\',
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1016) and '|'. Further, names cannot end with a '.' or a space. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1017) FILE_NAME_DOS = 0x02,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1018) /* The standard DOS filenames (8.3 format). Uppercase only. All 8-bit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1019) characters greater space, except: '"', '*', '+', ',', '/', ':', ';',
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1020) '<', '=', '>', '?', and '\'. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1021) FILE_NAME_WIN32_AND_DOS = 0x03,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1022) /* 3 means that both the Win32 and the DOS filenames are identical and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1023) hence have been saved in this single filename record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1024) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1025)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1026) typedef u8 FILE_NAME_TYPE_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1027)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1028) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1029) * Attribute: Filename (0x30).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1030) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1031) * NOTE: Always resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1032) * NOTE: All fields, except the parent_directory, are only updated when the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1033) * filename is changed. Until then, they just become out of sync with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1034) * reality and the more up to date values are present in the standard
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1035) * information attribute.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1036) * NOTE: There is conflicting information about the meaning of each of the time
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1037) * fields but the meaning as defined below has been verified to be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1038) * correct by practical experimentation on Windows NT4 SP6a and is hence
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1039) * assumed to be the one and only correct interpretation.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1040) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1041) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1042) /*hex ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1043) /* 0*/ leMFT_REF parent_directory; /* Directory this filename is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1044) referenced from. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1045) /* 8*/ sle64 creation_time; /* Time file was created. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1046) /* 10*/ sle64 last_data_change_time; /* Time the data attribute was last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1047) modified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1048) /* 18*/ sle64 last_mft_change_time; /* Time this mft record was last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1049) modified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1050) /* 20*/ sle64 last_access_time; /* Time this mft record was last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1051) accessed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1052) /* 28*/ sle64 allocated_size; /* Byte size of on-disk allocated space
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1053) for the unnamed data attribute. So
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1054) for normal $DATA, this is the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1055) allocated_size from the unnamed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1056) $DATA attribute and for compressed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1057) and/or sparse $DATA, this is the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1058) compressed_size from the unnamed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1059) $DATA attribute. For a directory or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1060) other inode without an unnamed $DATA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1061) attribute, this is always 0. NOTE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1062) This is a multiple of the cluster
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1063) size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1064) /* 30*/ sle64 data_size; /* Byte size of actual data in unnamed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1065) data attribute. For a directory or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1066) other inode without an unnamed $DATA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1067) attribute, this is always 0. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1068) /* 38*/ FILE_ATTR_FLAGS file_attributes; /* Flags describing the file. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1069) /* 3c*/ union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1070) /* 3c*/ struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1071) /* 3c*/ le16 packed_ea_size; /* Size of the buffer needed to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1072) pack the extended attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1073) (EAs), if such are present.*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1074) /* 3e*/ le16 reserved; /* Reserved for alignment. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1075) } __attribute__ ((__packed__)) ea;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1076) /* 3c*/ struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1077) /* 3c*/ le32 reparse_point_tag; /* Type of reparse point,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1078) present only in reparse
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1079) points and only if there are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1080) no EAs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1081) } __attribute__ ((__packed__)) rp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1082) } __attribute__ ((__packed__)) type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1083) /* 40*/ u8 file_name_length; /* Length of file name in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1084) (Unicode) characters. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1085) /* 41*/ FILE_NAME_TYPE_FLAGS file_name_type; /* Namespace of the file name.*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1086) /* 42*/ ntfschar file_name[0]; /* File name in Unicode. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1087) } __attribute__ ((__packed__)) FILE_NAME_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1088)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1089) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1090) * GUID structures store globally unique identifiers (GUID). A GUID is a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1091) * 128-bit value consisting of one group of eight hexadecimal digits, followed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1092) * by three groups of four hexadecimal digits each, followed by one group of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1093) * twelve hexadecimal digits. GUIDs are Microsoft's implementation of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1094) * distributed computing environment (DCE) universally unique identifier (UUID).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1095) * Example of a GUID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1096) * 1F010768-5A73-BC91-0010A52216A7
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1097) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1098) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1099) le32 data1; /* The first eight hexadecimal digits of the GUID. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1100) le16 data2; /* The first group of four hexadecimal digits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1101) le16 data3; /* The second group of four hexadecimal digits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1102) u8 data4[8]; /* The first two bytes are the third group of four
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1103) hexadecimal digits. The remaining six bytes are the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1104) final 12 hexadecimal digits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1105) } __attribute__ ((__packed__)) GUID;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1107) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1108) * FILE_Extend/$ObjId contains an index named $O. This index contains all
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1109) * object_ids present on the volume as the index keys and the corresponding
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1110) * mft_record numbers as the index entry data parts. The data part (defined
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1111) * below) also contains three other object_ids:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1112) * birth_volume_id - object_id of FILE_Volume on which the file was first
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1113) * created. Optional (i.e. can be zero).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1114) * birth_object_id - object_id of file when it was first created. Usually
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1115) * equals the object_id. Optional (i.e. can be zero).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1116) * domain_id - Reserved (always zero).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1117) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1118) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1119) leMFT_REF mft_reference;/* Mft record containing the object_id in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1120) the index entry key. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1121) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1122) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1123) GUID birth_volume_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1124) GUID birth_object_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1125) GUID domain_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1126) } __attribute__ ((__packed__)) origin;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1127) u8 extended_info[48];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1128) } __attribute__ ((__packed__)) opt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1129) } __attribute__ ((__packed__)) OBJ_ID_INDEX_DATA;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1131) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1132) * Attribute: Object id (NTFS 3.0+) (0x40).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1133) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1134) * NOTE: Always resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1135) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1136) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1137) GUID object_id; /* Unique id assigned to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1138) file.*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1139) /* The following fields are optional. The attribute value size is 16
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1140) bytes, i.e. sizeof(GUID), if these are not present at all. Note,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1141) the entries can be present but one or more (or all) can be zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1142) meaning that that particular value(s) is(are) not defined. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1143) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1144) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1145) GUID birth_volume_id; /* Unique id of volume on which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1146) the file was first created.*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1147) GUID birth_object_id; /* Unique id of file when it was
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1148) first created. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1149) GUID domain_id; /* Reserved, zero. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1150) } __attribute__ ((__packed__)) origin;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1151) u8 extended_info[48];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1152) } __attribute__ ((__packed__)) opt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1153) } __attribute__ ((__packed__)) OBJECT_ID_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1155) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1156) * The pre-defined IDENTIFIER_AUTHORITIES used as SID_IDENTIFIER_AUTHORITY in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1157) * the SID structure (see below).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1158) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1159) //typedef enum { /* SID string prefix. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1160) // SECURITY_NULL_SID_AUTHORITY = {0, 0, 0, 0, 0, 0}, /* S-1-0 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1161) // SECURITY_WORLD_SID_AUTHORITY = {0, 0, 0, 0, 0, 1}, /* S-1-1 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1162) // SECURITY_LOCAL_SID_AUTHORITY = {0, 0, 0, 0, 0, 2}, /* S-1-2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1163) // SECURITY_CREATOR_SID_AUTHORITY = {0, 0, 0, 0, 0, 3}, /* S-1-3 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1164) // SECURITY_NON_UNIQUE_AUTHORITY = {0, 0, 0, 0, 0, 4}, /* S-1-4 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1165) // SECURITY_NT_SID_AUTHORITY = {0, 0, 0, 0, 0, 5}, /* S-1-5 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1166) //} IDENTIFIER_AUTHORITIES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1168) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1169) * These relative identifiers (RIDs) are used with the above identifier
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1170) * authorities to make up universal well-known SIDs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1171) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1172) * Note: The relative identifier (RID) refers to the portion of a SID, which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1173) * identifies a user or group in relation to the authority that issued the SID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1174) * For example, the universal well-known SID Creator Owner ID (S-1-3-0) is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1175) * made up of the identifier authority SECURITY_CREATOR_SID_AUTHORITY (3) and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1176) * the relative identifier SECURITY_CREATOR_OWNER_RID (0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1177) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1178) typedef enum { /* Identifier authority. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1179) SECURITY_NULL_RID = 0, /* S-1-0 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1180) SECURITY_WORLD_RID = 0, /* S-1-1 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1181) SECURITY_LOCAL_RID = 0, /* S-1-2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1183) SECURITY_CREATOR_OWNER_RID = 0, /* S-1-3 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1184) SECURITY_CREATOR_GROUP_RID = 1, /* S-1-3 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1186) SECURITY_CREATOR_OWNER_SERVER_RID = 2, /* S-1-3 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1187) SECURITY_CREATOR_GROUP_SERVER_RID = 3, /* S-1-3 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1188)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1189) SECURITY_DIALUP_RID = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1190) SECURITY_NETWORK_RID = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1191) SECURITY_BATCH_RID = 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1192) SECURITY_INTERACTIVE_RID = 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1193) SECURITY_SERVICE_RID = 6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1194) SECURITY_ANONYMOUS_LOGON_RID = 7,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1195) SECURITY_PROXY_RID = 8,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1196) SECURITY_ENTERPRISE_CONTROLLERS_RID=9,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1197) SECURITY_SERVER_LOGON_RID = 9,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1198) SECURITY_PRINCIPAL_SELF_RID = 0xa,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1199) SECURITY_AUTHENTICATED_USER_RID = 0xb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1200) SECURITY_RESTRICTED_CODE_RID = 0xc,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1201) SECURITY_TERMINAL_SERVER_RID = 0xd,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1202)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1203) SECURITY_LOGON_IDS_RID = 5,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1204) SECURITY_LOGON_IDS_RID_COUNT = 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1205)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1206) SECURITY_LOCAL_SYSTEM_RID = 0x12,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1208) SECURITY_NT_NON_UNIQUE = 0x15,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1209)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1210) SECURITY_BUILTIN_DOMAIN_RID = 0x20,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1211)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1212) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1213) * Well-known domain relative sub-authority values (RIDs).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1214) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1215)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1216) /* Users. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1217) DOMAIN_USER_RID_ADMIN = 0x1f4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1218) DOMAIN_USER_RID_GUEST = 0x1f5,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1219) DOMAIN_USER_RID_KRBTGT = 0x1f6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1220)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1221) /* Groups. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1222) DOMAIN_GROUP_RID_ADMINS = 0x200,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1223) DOMAIN_GROUP_RID_USERS = 0x201,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1224) DOMAIN_GROUP_RID_GUESTS = 0x202,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1225) DOMAIN_GROUP_RID_COMPUTERS = 0x203,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1226) DOMAIN_GROUP_RID_CONTROLLERS = 0x204,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1227) DOMAIN_GROUP_RID_CERT_ADMINS = 0x205,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1228) DOMAIN_GROUP_RID_SCHEMA_ADMINS = 0x206,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1229) DOMAIN_GROUP_RID_ENTERPRISE_ADMINS= 0x207,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1230) DOMAIN_GROUP_RID_POLICY_ADMINS = 0x208,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1231)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1232) /* Aliases. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1233) DOMAIN_ALIAS_RID_ADMINS = 0x220,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1234) DOMAIN_ALIAS_RID_USERS = 0x221,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1235) DOMAIN_ALIAS_RID_GUESTS = 0x222,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1236) DOMAIN_ALIAS_RID_POWER_USERS = 0x223,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1237)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1238) DOMAIN_ALIAS_RID_ACCOUNT_OPS = 0x224,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1239) DOMAIN_ALIAS_RID_SYSTEM_OPS = 0x225,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1240) DOMAIN_ALIAS_RID_PRINT_OPS = 0x226,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1241) DOMAIN_ALIAS_RID_BACKUP_OPS = 0x227,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1242)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1243) DOMAIN_ALIAS_RID_REPLICATOR = 0x228,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1244) DOMAIN_ALIAS_RID_RAS_SERVERS = 0x229,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1245) DOMAIN_ALIAS_RID_PREW2KCOMPACCESS = 0x22a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1246) } RELATIVE_IDENTIFIERS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1247)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1248) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1249) * The universal well-known SIDs:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1250) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1251) * NULL_SID S-1-0-0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1252) * WORLD_SID S-1-1-0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1253) * LOCAL_SID S-1-2-0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1254) * CREATOR_OWNER_SID S-1-3-0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1255) * CREATOR_GROUP_SID S-1-3-1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1256) * CREATOR_OWNER_SERVER_SID S-1-3-2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1257) * CREATOR_GROUP_SERVER_SID S-1-3-3
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1258) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1259) * (Non-unique IDs) S-1-4
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1260) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1261) * NT well-known SIDs:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1262) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1263) * NT_AUTHORITY_SID S-1-5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1264) * DIALUP_SID S-1-5-1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1265) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1266) * NETWORD_SID S-1-5-2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1267) * BATCH_SID S-1-5-3
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1268) * INTERACTIVE_SID S-1-5-4
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1269) * SERVICE_SID S-1-5-6
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1270) * ANONYMOUS_LOGON_SID S-1-5-7 (aka null logon session)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1271) * PROXY_SID S-1-5-8
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1272) * SERVER_LOGON_SID S-1-5-9 (aka domain controller account)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1273) * SELF_SID S-1-5-10 (self RID)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1274) * AUTHENTICATED_USER_SID S-1-5-11
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1275) * RESTRICTED_CODE_SID S-1-5-12 (running restricted code)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1276) * TERMINAL_SERVER_SID S-1-5-13 (running on terminal server)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1277) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1278) * (Logon IDs) S-1-5-5-X-Y
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1279) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1280) * (NT non-unique IDs) S-1-5-0x15-...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1281) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1282) * (Built-in domain) S-1-5-0x20
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1283) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1284)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1285) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1286) * The SID_IDENTIFIER_AUTHORITY is a 48-bit value used in the SID structure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1287) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1288) * NOTE: This is stored as a big endian number, hence the high_part comes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1289) * before the low_part.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1290) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1291) typedef union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1292) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1293) u16 high_part; /* High 16-bits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1294) u32 low_part; /* Low 32-bits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1295) } __attribute__ ((__packed__)) parts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1296) u8 value[6]; /* Value as individual bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1297) } __attribute__ ((__packed__)) SID_IDENTIFIER_AUTHORITY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1298)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1299) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1300) * The SID structure is a variable-length structure used to uniquely identify
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1301) * users or groups. SID stands for security identifier.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1302) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1303) * The standard textual representation of the SID is of the form:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1304) * S-R-I-S-S...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1305) * Where:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1306) * - The first "S" is the literal character 'S' identifying the following
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1307) * digits as a SID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1308) * - R is the revision level of the SID expressed as a sequence of digits
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1309) * either in decimal or hexadecimal (if the later, prefixed by "0x").
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1310) * - I is the 48-bit identifier_authority, expressed as digits as R above.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1311) * - S... is one or more sub_authority values, expressed as digits as above.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1312) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1313) * Example SID; the domain-relative SID of the local Administrators group on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1314) * Windows NT/2k:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1315) * S-1-5-32-544
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1316) * This translates to a SID with:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1317) * revision = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1318) * sub_authority_count = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1319) * identifier_authority = {0,0,0,0,0,5}, // SECURITY_NT_AUTHORITY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1320) * sub_authority[0] = 32, // SECURITY_BUILTIN_DOMAIN_RID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1321) * sub_authority[1] = 544 // DOMAIN_ALIAS_RID_ADMINS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1322) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1323) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1324) u8 revision;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1325) u8 sub_authority_count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1326) SID_IDENTIFIER_AUTHORITY identifier_authority;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1327) le32 sub_authority[1]; /* At least one sub_authority. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1328) } __attribute__ ((__packed__)) SID;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1329)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1330) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1331) * Current constants for SIDs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1332) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1333) typedef enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1334) SID_REVISION = 1, /* Current revision level. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1335) SID_MAX_SUB_AUTHORITIES = 15, /* Maximum number of those. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1336) SID_RECOMMENDED_SUB_AUTHORITIES = 1, /* Will change to around 6 in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1337) a future revision. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1338) } SID_CONSTANTS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1339)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1340) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1341) * The predefined ACE types (8-bit, see below).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1342) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1343) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1344) ACCESS_MIN_MS_ACE_TYPE = 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1345) ACCESS_ALLOWED_ACE_TYPE = 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1346) ACCESS_DENIED_ACE_TYPE = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1347) SYSTEM_AUDIT_ACE_TYPE = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1348) SYSTEM_ALARM_ACE_TYPE = 3, /* Not implemented as of Win2k. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1349) ACCESS_MAX_MS_V2_ACE_TYPE = 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1351) ACCESS_ALLOWED_COMPOUND_ACE_TYPE= 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1352) ACCESS_MAX_MS_V3_ACE_TYPE = 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1353)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1354) /* The following are Win2k only. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1355) ACCESS_MIN_MS_OBJECT_ACE_TYPE = 5,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1356) ACCESS_ALLOWED_OBJECT_ACE_TYPE = 5,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1357) ACCESS_DENIED_OBJECT_ACE_TYPE = 6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1358) SYSTEM_AUDIT_OBJECT_ACE_TYPE = 7,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1359) SYSTEM_ALARM_OBJECT_ACE_TYPE = 8,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1360) ACCESS_MAX_MS_OBJECT_ACE_TYPE = 8,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1361)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1362) ACCESS_MAX_MS_V4_ACE_TYPE = 8,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1363)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1364) /* This one is for WinNT/2k. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1365) ACCESS_MAX_MS_ACE_TYPE = 8,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1366) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1367)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1368) typedef u8 ACE_TYPES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1370) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1371) * The ACE flags (8-bit) for audit and inheritance (see below).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1372) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1373) * SUCCESSFUL_ACCESS_ACE_FLAG is only used with system audit and alarm ACE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1374) * types to indicate that a message is generated (in Windows!) for successful
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1375) * accesses.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1376) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1377) * FAILED_ACCESS_ACE_FLAG is only used with system audit and alarm ACE types
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1378) * to indicate that a message is generated (in Windows!) for failed accesses.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1379) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1380) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1381) /* The inheritance flags. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1382) OBJECT_INHERIT_ACE = 0x01,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1383) CONTAINER_INHERIT_ACE = 0x02,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1384) NO_PROPAGATE_INHERIT_ACE = 0x04,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1385) INHERIT_ONLY_ACE = 0x08,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1386) INHERITED_ACE = 0x10, /* Win2k only. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1387) VALID_INHERIT_FLAGS = 0x1f,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1388)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1389) /* The audit flags. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1390) SUCCESSFUL_ACCESS_ACE_FLAG = 0x40,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1391) FAILED_ACCESS_ACE_FLAG = 0x80,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1392) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1393)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1394) typedef u8 ACE_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1395)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1396) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1397) * An ACE is an access-control entry in an access-control list (ACL).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1398) * An ACE defines access to an object for a specific user or group or defines
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1399) * the types of access that generate system-administration messages or alarms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1400) * for a specific user or group. The user or group is identified by a security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1401) * identifier (SID).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1402) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1403) * Each ACE starts with an ACE_HEADER structure (aligned on 4-byte boundary),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1404) * which specifies the type and size of the ACE. The format of the subsequent
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1405) * data depends on the ACE type.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1406) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1407) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1408) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1409) /* 0*/ ACE_TYPES type; /* Type of the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1410) /* 1*/ ACE_FLAGS flags; /* Flags describing the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1411) /* 2*/ le16 size; /* Size in bytes of the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1412) } __attribute__ ((__packed__)) ACE_HEADER;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1413)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1414) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1415) * The access mask (32-bit). Defines the access rights.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1416) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1417) * The specific rights (bits 0 to 15). These depend on the type of the object
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1418) * being secured by the ACE.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1419) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1420) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1421) /* Specific rights for files and directories are as follows: */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1422)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1423) /* Right to read data from the file. (FILE) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1424) FILE_READ_DATA = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1425) /* Right to list contents of a directory. (DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1426) FILE_LIST_DIRECTORY = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1427)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1428) /* Right to write data to the file. (FILE) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1429) FILE_WRITE_DATA = cpu_to_le32(0x00000002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1430) /* Right to create a file in the directory. (DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1431) FILE_ADD_FILE = cpu_to_le32(0x00000002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1432)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1433) /* Right to append data to the file. (FILE) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1434) FILE_APPEND_DATA = cpu_to_le32(0x00000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1435) /* Right to create a subdirectory. (DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1436) FILE_ADD_SUBDIRECTORY = cpu_to_le32(0x00000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1438) /* Right to read extended attributes. (FILE/DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1439) FILE_READ_EA = cpu_to_le32(0x00000008),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1440)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1441) /* Right to write extended attributes. (FILE/DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1442) FILE_WRITE_EA = cpu_to_le32(0x00000010),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1443)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1444) /* Right to execute a file. (FILE) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1445) FILE_EXECUTE = cpu_to_le32(0x00000020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1446) /* Right to traverse the directory. (DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1447) FILE_TRAVERSE = cpu_to_le32(0x00000020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1448)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1449) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1450) * Right to delete a directory and all the files it contains (its
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1451) * children), even if the files are read-only. (DIRECTORY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1452) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1453) FILE_DELETE_CHILD = cpu_to_le32(0x00000040),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1454)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1455) /* Right to read file attributes. (FILE/DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1456) FILE_READ_ATTRIBUTES = cpu_to_le32(0x00000080),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1457)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1458) /* Right to change file attributes. (FILE/DIRECTORY) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1459) FILE_WRITE_ATTRIBUTES = cpu_to_le32(0x00000100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1460)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1461) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1462) * The standard rights (bits 16 to 23). These are independent of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1463) * type of object being secured.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1464) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1465)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1466) /* Right to delete the object. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1467) DELETE = cpu_to_le32(0x00010000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1468)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1469) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1470) * Right to read the information in the object's security descriptor,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1471) * not including the information in the SACL, i.e. right to read the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1472) * security descriptor and owner.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1473) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1474) READ_CONTROL = cpu_to_le32(0x00020000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1475)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1476) /* Right to modify the DACL in the object's security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1477) WRITE_DAC = cpu_to_le32(0x00040000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1478)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1479) /* Right to change the owner in the object's security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1480) WRITE_OWNER = cpu_to_le32(0x00080000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1481)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1482) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1483) * Right to use the object for synchronization. Enables a process to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1484) * wait until the object is in the signalled state. Some object types
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1485) * do not support this access right.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1486) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1487) SYNCHRONIZE = cpu_to_le32(0x00100000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1488)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1489) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1490) * The following STANDARD_RIGHTS_* are combinations of the above for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1491) * convenience and are defined by the Win32 API.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1492) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1493)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1494) /* These are currently defined to READ_CONTROL. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1495) STANDARD_RIGHTS_READ = cpu_to_le32(0x00020000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1496) STANDARD_RIGHTS_WRITE = cpu_to_le32(0x00020000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1497) STANDARD_RIGHTS_EXECUTE = cpu_to_le32(0x00020000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1498)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1499) /* Combines DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER access. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1500) STANDARD_RIGHTS_REQUIRED = cpu_to_le32(0x000f0000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1501)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1502) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1503) * Combines DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1504) * SYNCHRONIZE access.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1505) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1506) STANDARD_RIGHTS_ALL = cpu_to_le32(0x001f0000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1507)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1508) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1509) * The access system ACL and maximum allowed access types (bits 24 to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1510) * 25, bits 26 to 27 are reserved).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1511) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1512) ACCESS_SYSTEM_SECURITY = cpu_to_le32(0x01000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1513) MAXIMUM_ALLOWED = cpu_to_le32(0x02000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1514)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1515) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1516) * The generic rights (bits 28 to 31). These map onto the standard and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1517) * specific rights.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1518) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1519)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1520) /* Read, write, and execute access. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1521) GENERIC_ALL = cpu_to_le32(0x10000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1522)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1523) /* Execute access. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1524) GENERIC_EXECUTE = cpu_to_le32(0x20000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1525)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1526) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1527) * Write access. For files, this maps onto:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1528) * FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_DATA |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1529) * FILE_WRITE_EA | STANDARD_RIGHTS_WRITE | SYNCHRONIZE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1530) * For directories, the mapping has the same numerical value. See
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1531) * above for the descriptions of the rights granted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1532) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1533) GENERIC_WRITE = cpu_to_le32(0x40000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1534)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1535) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1536) * Read access. For files, this maps onto:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1537) * FILE_READ_ATTRIBUTES | FILE_READ_DATA | FILE_READ_EA |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1538) * STANDARD_RIGHTS_READ | SYNCHRONIZE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1539) * For directories, the mapping has the same numberical value. See
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1540) * above for the descriptions of the rights granted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1541) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1542) GENERIC_READ = cpu_to_le32(0x80000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1543) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1544)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1545) typedef le32 ACCESS_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1546)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1547) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1548) * The generic mapping array. Used to denote the mapping of each generic
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1549) * access right to a specific access mask.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1550) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1551) * FIXME: What exactly is this and what is it for? (AIA)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1552) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1553) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1554) ACCESS_MASK generic_read;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1555) ACCESS_MASK generic_write;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1556) ACCESS_MASK generic_execute;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1557) ACCESS_MASK generic_all;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1558) } __attribute__ ((__packed__)) GENERIC_MAPPING;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1559)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1560) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1561) * The predefined ACE type structures are as defined below.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1562) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1563)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1564) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1565) * ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE, SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1566) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1567) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1568) /* 0 ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1569) ACE_TYPES type; /* Type of the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1570) ACE_FLAGS flags; /* Flags describing the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1571) le16 size; /* Size in bytes of the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1572) /* 4*/ ACCESS_MASK mask; /* Access mask associated with the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1573)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1574) /* 8*/ SID sid; /* The SID associated with the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1575) } __attribute__ ((__packed__)) ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1576) SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1577)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1578) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1579) * The object ACE flags (32-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1580) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1581) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1582) ACE_OBJECT_TYPE_PRESENT = cpu_to_le32(1),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1583) ACE_INHERITED_OBJECT_TYPE_PRESENT = cpu_to_le32(2),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1584) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1585)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1586) typedef le32 OBJECT_ACE_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1587)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1588) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1589) /* 0 ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1590) ACE_TYPES type; /* Type of the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1591) ACE_FLAGS flags; /* Flags describing the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1592) le16 size; /* Size in bytes of the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1593) /* 4*/ ACCESS_MASK mask; /* Access mask associated with the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1594)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1595) /* 8*/ OBJECT_ACE_FLAGS object_flags; /* Flags describing the object ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1596) /* 12*/ GUID object_type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1597) /* 28*/ GUID inherited_object_type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1598)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1599) /* 44*/ SID sid; /* The SID associated with the ACE. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1600) } __attribute__ ((__packed__)) ACCESS_ALLOWED_OBJECT_ACE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1601) ACCESS_DENIED_OBJECT_ACE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1602) SYSTEM_AUDIT_OBJECT_ACE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1603) SYSTEM_ALARM_OBJECT_ACE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1604)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1605) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1606) * An ACL is an access-control list (ACL).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1607) * An ACL starts with an ACL header structure, which specifies the size of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1608) * the ACL and the number of ACEs it contains. The ACL header is followed by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1609) * zero or more access control entries (ACEs). The ACL as well as each ACE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1610) * are aligned on 4-byte boundaries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1611) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1612) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1613) u8 revision; /* Revision of this ACL. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1614) u8 alignment1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1615) le16 size; /* Allocated space in bytes for ACL. Includes this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1616) header, the ACEs and the remaining free space. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1617) le16 ace_count; /* Number of ACEs in the ACL. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1618) le16 alignment2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1619) /* sizeof() = 8 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1620) } __attribute__ ((__packed__)) ACL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1621)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1622) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1623) * Current constants for ACLs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1624) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1625) typedef enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1626) /* Current revision. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1627) ACL_REVISION = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1628) ACL_REVISION_DS = 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1629)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1630) /* History of revisions. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1631) ACL_REVISION1 = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1632) MIN_ACL_REVISION = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1633) ACL_REVISION2 = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1634) ACL_REVISION3 = 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1635) ACL_REVISION4 = 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1636) MAX_ACL_REVISION = 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1637) } ACL_CONSTANTS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1638)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1639) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1640) * The security descriptor control flags (16-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1641) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1642) * SE_OWNER_DEFAULTED - This boolean flag, when set, indicates that the SID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1643) * pointed to by the Owner field was provided by a defaulting mechanism
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1644) * rather than explicitly provided by the original provider of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1645) * security descriptor. This may affect the treatment of the SID with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1646) * respect to inheritance of an owner.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1647) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1648) * SE_GROUP_DEFAULTED - This boolean flag, when set, indicates that the SID in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1649) * the Group field was provided by a defaulting mechanism rather than
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1650) * explicitly provided by the original provider of the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1651) * descriptor. This may affect the treatment of the SID with respect to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1652) * inheritance of a primary group.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1653) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1654) * SE_DACL_PRESENT - This boolean flag, when set, indicates that the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1655) * descriptor contains a discretionary ACL. If this flag is set and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1656) * Dacl field of the SECURITY_DESCRIPTOR is null, then a null ACL is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1657) * explicitly being specified.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1658) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1659) * SE_DACL_DEFAULTED - This boolean flag, when set, indicates that the ACL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1660) * pointed to by the Dacl field was provided by a defaulting mechanism
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1661) * rather than explicitly provided by the original provider of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1662) * security descriptor. This may affect the treatment of the ACL with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1663) * respect to inheritance of an ACL. This flag is ignored if the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1664) * DaclPresent flag is not set.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1665) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1666) * SE_SACL_PRESENT - This boolean flag, when set, indicates that the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1667) * descriptor contains a system ACL pointed to by the Sacl field. If this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1668) * flag is set and the Sacl field of the SECURITY_DESCRIPTOR is null, then
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1669) * an empty (but present) ACL is being specified.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1670) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1671) * SE_SACL_DEFAULTED - This boolean flag, when set, indicates that the ACL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1672) * pointed to by the Sacl field was provided by a defaulting mechanism
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1673) * rather than explicitly provided by the original provider of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1674) * security descriptor. This may affect the treatment of the ACL with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1675) * respect to inheritance of an ACL. This flag is ignored if the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1676) * SaclPresent flag is not set.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1677) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1678) * SE_SELF_RELATIVE - This boolean flag, when set, indicates that the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1679) * descriptor is in self-relative form. In this form, all fields of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1680) * security descriptor are contiguous in memory and all pointer fields are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1681) * expressed as offsets from the beginning of the security descriptor.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1682) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1683) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1684) SE_OWNER_DEFAULTED = cpu_to_le16(0x0001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1685) SE_GROUP_DEFAULTED = cpu_to_le16(0x0002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1686) SE_DACL_PRESENT = cpu_to_le16(0x0004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1687) SE_DACL_DEFAULTED = cpu_to_le16(0x0008),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1688)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1689) SE_SACL_PRESENT = cpu_to_le16(0x0010),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1690) SE_SACL_DEFAULTED = cpu_to_le16(0x0020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1691)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1692) SE_DACL_AUTO_INHERIT_REQ = cpu_to_le16(0x0100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1693) SE_SACL_AUTO_INHERIT_REQ = cpu_to_le16(0x0200),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1694) SE_DACL_AUTO_INHERITED = cpu_to_le16(0x0400),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1695) SE_SACL_AUTO_INHERITED = cpu_to_le16(0x0800),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1696)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1697) SE_DACL_PROTECTED = cpu_to_le16(0x1000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1698) SE_SACL_PROTECTED = cpu_to_le16(0x2000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1699) SE_RM_CONTROL_VALID = cpu_to_le16(0x4000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1700) SE_SELF_RELATIVE = cpu_to_le16(0x8000)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1701) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1702)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1703) typedef le16 SECURITY_DESCRIPTOR_CONTROL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1704)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1705) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1706) * Self-relative security descriptor. Contains the owner and group SIDs as well
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1707) * as the sacl and dacl ACLs inside the security descriptor itself.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1708) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1709) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1710) u8 revision; /* Revision level of the security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1711) u8 alignment;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1712) SECURITY_DESCRIPTOR_CONTROL control; /* Flags qualifying the type of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1713) the descriptor as well as the following fields. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1714) le32 owner; /* Byte offset to a SID representing an object's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1715) owner. If this is NULL, no owner SID is present in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1716) the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1717) le32 group; /* Byte offset to a SID representing an object's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1718) primary group. If this is NULL, no primary group
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1719) SID is present in the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1720) le32 sacl; /* Byte offset to a system ACL. Only valid, if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1721) SE_SACL_PRESENT is set in the control field. If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1722) SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1723) is specified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1724) le32 dacl; /* Byte offset to a discretionary ACL. Only valid, if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1725) SE_DACL_PRESENT is set in the control field. If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1726) SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1727) (unconditionally granting access) is specified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1728) /* sizeof() = 0x14 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1729) } __attribute__ ((__packed__)) SECURITY_DESCRIPTOR_RELATIVE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1730)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1731) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1732) * Absolute security descriptor. Does not contain the owner and group SIDs, nor
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1733) * the sacl and dacl ACLs inside the security descriptor. Instead, it contains
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1734) * pointers to these structures in memory. Obviously, absolute security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1735) * descriptors are only useful for in memory representations of security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1736) * descriptors. On disk, a self-relative security descriptor is used.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1737) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1738) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1739) u8 revision; /* Revision level of the security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1740) u8 alignment;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1741) SECURITY_DESCRIPTOR_CONTROL control; /* Flags qualifying the type of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1742) the descriptor as well as the following fields. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1743) SID *owner; /* Points to a SID representing an object's owner. If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1744) this is NULL, no owner SID is present in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1745) descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1746) SID *group; /* Points to a SID representing an object's primary
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1747) group. If this is NULL, no primary group SID is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1748) present in the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1749) ACL *sacl; /* Points to a system ACL. Only valid, if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1750) SE_SACL_PRESENT is set in the control field. If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1751) SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1752) is specified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1753) ACL *dacl; /* Points to a discretionary ACL. Only valid, if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1754) SE_DACL_PRESENT is set in the control field. If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1755) SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1756) (unconditionally granting access) is specified. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1757) } __attribute__ ((__packed__)) SECURITY_DESCRIPTOR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1758)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1759) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1760) * Current constants for security descriptors.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1761) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1762) typedef enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1763) /* Current revision. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1764) SECURITY_DESCRIPTOR_REVISION = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1765) SECURITY_DESCRIPTOR_REVISION1 = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1766)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1767) /* The sizes of both the absolute and relative security descriptors is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1768) the same as pointers, at least on ia32 architecture are 32-bit. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1769) SECURITY_DESCRIPTOR_MIN_LENGTH = sizeof(SECURITY_DESCRIPTOR),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1770) } SECURITY_DESCRIPTOR_CONSTANTS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1771)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1772) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1773) * Attribute: Security descriptor (0x50). A standard self-relative security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1774) * descriptor.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1775) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1776) * NOTE: Can be resident or non-resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1777) * NOTE: Not used in NTFS 3.0+, as security descriptors are stored centrally
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1778) * in FILE_Secure and the correct descriptor is found using the security_id
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1779) * from the standard information attribute.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1780) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1781) typedef SECURITY_DESCRIPTOR_RELATIVE SECURITY_DESCRIPTOR_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1782)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1783) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1784) * On NTFS 3.0+, all security descriptors are stored in FILE_Secure. Only one
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1785) * referenced instance of each unique security descriptor is stored.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1786) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1787) * FILE_Secure contains no unnamed data attribute, i.e. it has zero length. It
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1788) * does, however, contain two indexes ($SDH and $SII) as well as a named data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1789) * stream ($SDS).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1790) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1791) * Every unique security descriptor is assigned a unique security identifier
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1792) * (security_id, not to be confused with a SID). The security_id is unique for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1793) * the NTFS volume and is used as an index into the $SII index, which maps
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1794) * security_ids to the security descriptor's storage location within the $SDS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1795) * data attribute. The $SII index is sorted by ascending security_id.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1796) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1797) * A simple hash is computed from each security descriptor. This hash is used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1798) * as an index into the $SDH index, which maps security descriptor hashes to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1799) * the security descriptor's storage location within the $SDS data attribute.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1800) * The $SDH index is sorted by security descriptor hash and is stored in a B+
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1801) * tree. When searching $SDH (with the intent of determining whether or not a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1802) * new security descriptor is already present in the $SDS data stream), if a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1803) * matching hash is found, but the security descriptors do not match, the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1804) * search in the $SDH index is continued, searching for a next matching hash.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1805) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1806) * When a precise match is found, the security_id coresponding to the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1807) * descriptor in the $SDS attribute is read from the found $SDH index entry and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1808) * is stored in the $STANDARD_INFORMATION attribute of the file/directory to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1809) * which the security descriptor is being applied. The $STANDARD_INFORMATION
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1810) * attribute is present in all base mft records (i.e. in all files and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1811) * directories).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1812) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1813) * If a match is not found, the security descriptor is assigned a new unique
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1814) * security_id and is added to the $SDS data attribute. Then, entries
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1815) * referencing the this security descriptor in the $SDS data attribute are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1816) * added to the $SDH and $SII indexes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1817) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1818) * Note: Entries are never deleted from FILE_Secure, even if nothing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1819) * references an entry any more.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1820) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1821)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1822) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1823) * This header precedes each security descriptor in the $SDS data stream.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1824) * This is also the index entry data part of both the $SII and $SDH indexes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1825) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1826) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1827) le32 hash; /* Hash of the security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1828) le32 security_id; /* The security_id assigned to the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1829) le64 offset; /* Byte offset of this entry in the $SDS stream. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1830) le32 length; /* Size in bytes of this entry in $SDS stream. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1831) } __attribute__ ((__packed__)) SECURITY_DESCRIPTOR_HEADER;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1832)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1833) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1834) * The $SDS data stream contains the security descriptors, aligned on 16-byte
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1835) * boundaries, sorted by security_id in a B+ tree. Security descriptors cannot
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1836) * cross 256kib boundaries (this restriction is imposed by the Windows cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1837) * manager). Each security descriptor is contained in a SDS_ENTRY structure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1838) * Also, each security descriptor is stored twice in the $SDS stream with a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1839) * fixed offset of 0x40000 bytes (256kib, the Windows cache manager's max size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1840) * between them; i.e. if a SDS_ENTRY specifies an offset of 0x51d0, then the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1841) * the first copy of the security descriptor will be at offset 0x51d0 in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1842) * $SDS data stream and the second copy will be at offset 0x451d0.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1843) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1844) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1845) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1846) /* 0 SECURITY_DESCRIPTOR_HEADER; -- Unfolded here as gcc doesn't like
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1847) unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1848) le32 hash; /* Hash of the security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1849) le32 security_id; /* The security_id assigned to the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1850) le64 offset; /* Byte offset of this entry in the $SDS stream. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1851) le32 length; /* Size in bytes of this entry in $SDS stream. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1852) /* 20*/ SECURITY_DESCRIPTOR_RELATIVE sid; /* The self-relative security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1853) descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1854) } __attribute__ ((__packed__)) SDS_ENTRY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1855)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1856) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1857) * The index entry key used in the $SII index. The collation type is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1858) * COLLATION_NTOFS_ULONG.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1859) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1860) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1861) le32 security_id; /* The security_id assigned to the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1862) } __attribute__ ((__packed__)) SII_INDEX_KEY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1863)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1864) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1865) * The index entry key used in the $SDH index. The keys are sorted first by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1866) * hash and then by security_id. The collation rule is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1867) * COLLATION_NTOFS_SECURITY_HASH.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1868) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1869) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1870) le32 hash; /* Hash of the security descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1871) le32 security_id; /* The security_id assigned to the descriptor. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1872) } __attribute__ ((__packed__)) SDH_INDEX_KEY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1873)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1874) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1875) * Attribute: Volume name (0x60).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1876) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1877) * NOTE: Always resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1878) * NOTE: Present only in FILE_Volume.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1879) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1880) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1881) ntfschar name[0]; /* The name of the volume in Unicode. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1882) } __attribute__ ((__packed__)) VOLUME_NAME;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1883)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1884) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1885) * Possible flags for the volume (16-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1886) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1887) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1888) VOLUME_IS_DIRTY = cpu_to_le16(0x0001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1889) VOLUME_RESIZE_LOG_FILE = cpu_to_le16(0x0002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1890) VOLUME_UPGRADE_ON_MOUNT = cpu_to_le16(0x0004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1891) VOLUME_MOUNTED_ON_NT4 = cpu_to_le16(0x0008),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1892)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1893) VOLUME_DELETE_USN_UNDERWAY = cpu_to_le16(0x0010),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1894) VOLUME_REPAIR_OBJECT_ID = cpu_to_le16(0x0020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1895)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1896) VOLUME_CHKDSK_UNDERWAY = cpu_to_le16(0x4000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1897) VOLUME_MODIFIED_BY_CHKDSK = cpu_to_le16(0x8000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1898)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1899) VOLUME_FLAGS_MASK = cpu_to_le16(0xc03f),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1900)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1901) /* To make our life easier when checking if we must mount read-only. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1902) VOLUME_MUST_MOUNT_RO_MASK = cpu_to_le16(0xc027),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1903) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1904)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1905) typedef le16 VOLUME_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1906)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1907) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1908) * Attribute: Volume information (0x70).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1909) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1910) * NOTE: Always resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1911) * NOTE: Present only in FILE_Volume.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1912) * NOTE: Windows 2000 uses NTFS 3.0 while Windows NT4 service pack 6a uses
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1913) * NTFS 1.2. I haven't personally seen other values yet.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1914) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1915) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1916) le64 reserved; /* Not used (yet?). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1917) u8 major_ver; /* Major version of the ntfs format. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1918) u8 minor_ver; /* Minor version of the ntfs format. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1919) VOLUME_FLAGS flags; /* Bit array of VOLUME_* flags. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1920) } __attribute__ ((__packed__)) VOLUME_INFORMATION;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1921)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1922) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1923) * Attribute: Data attribute (0x80).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1924) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1925) * NOTE: Can be resident or non-resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1926) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1927) * Data contents of a file (i.e. the unnamed stream) or of a named stream.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1928) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1929) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1930) u8 data[0]; /* The file's data contents. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1931) } __attribute__ ((__packed__)) DATA_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1932)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1933) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1934) * Index header flags (8-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1935) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1936) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1937) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1938) * When index header is in an index root attribute:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1939) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1940) SMALL_INDEX = 0, /* The index is small enough to fit inside the index
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1941) root attribute and there is no index allocation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1942) attribute present. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1943) LARGE_INDEX = 1, /* The index is too large to fit in the index root
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1944) attribute and/or an index allocation attribute is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1945) present. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1946) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1947) * When index header is in an index block, i.e. is part of index
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1948) * allocation attribute:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1949) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1950) LEAF_NODE = 0, /* This is a leaf node, i.e. there are no more nodes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1951) branching off it. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1952) INDEX_NODE = 1, /* This node indexes other nodes, i.e. it is not a leaf
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1953) node. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1954) NODE_MASK = 1, /* Mask for accessing the *_NODE bits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1955) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1956)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1957) typedef u8 INDEX_HEADER_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1958)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1959) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1960) * This is the header for indexes, describing the INDEX_ENTRY records, which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1961) * follow the INDEX_HEADER. Together the index header and the index entries
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1962) * make up a complete index.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1963) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1964) * IMPORTANT NOTE: The offset, length and size structure members are counted
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1965) * relative to the start of the index header structure and not relative to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1966) * start of the index root or index allocation structures themselves.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1967) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1968) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1969) le32 entries_offset; /* Byte offset to first INDEX_ENTRY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1970) aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1971) le32 index_length; /* Data size of the index in bytes,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1972) i.e. bytes used from allocated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1973) size, aligned to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1974) le32 allocated_size; /* Byte size of this index (block),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1975) multiple of 8 bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1976) /* NOTE: For the index root attribute, the above two numbers are always
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1977) equal, as the attribute is resident and it is resized as needed. In
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1978) the case of the index allocation attribute the attribute is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1979) resident and hence the allocated_size is a fixed value and must
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1980) equal the index_block_size specified by the INDEX_ROOT attribute
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1981) corresponding to the INDEX_ALLOCATION attribute this INDEX_BLOCK
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1982) belongs to. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1983) INDEX_HEADER_FLAGS flags; /* Bit field of INDEX_HEADER_FLAGS. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1984) u8 reserved[3]; /* Reserved/align to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1985) } __attribute__ ((__packed__)) INDEX_HEADER;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1986)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1987) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1988) * Attribute: Index root (0x90).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1989) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1990) * NOTE: Always resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1991) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1992) * This is followed by a sequence of index entries (INDEX_ENTRY structures)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1993) * as described by the index header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1994) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1995) * When a directory is small enough to fit inside the index root then this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1996) * is the only attribute describing the directory. When the directory is too
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1997) * large to fit in the index root, on the other hand, two additional attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1998) * are present: an index allocation attribute, containing sub-nodes of the B+
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1999) * directory tree (see below), and a bitmap attribute, describing which virtual
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2000) * cluster numbers (vcns) in the index allocation attribute are in use by an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2001) * index block.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2002) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2003) * NOTE: The root directory (FILE_root) contains an entry for itself. Other
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2004) * directories do not contain entries for themselves, though.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2005) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2006) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2007) ATTR_TYPE type; /* Type of the indexed attribute. Is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2008) $FILE_NAME for directories, zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2009) for view indexes. No other values
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2010) allowed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2011) COLLATION_RULE collation_rule; /* Collation rule used to sort the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2012) index entries. If type is $FILE_NAME,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2013) this must be COLLATION_FILE_NAME. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2014) le32 index_block_size; /* Size of each index block in bytes (in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2015) the index allocation attribute). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2016) u8 clusters_per_index_block; /* Cluster size of each index block (in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2017) the index allocation attribute), when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2018) an index block is >= than a cluster,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2019) otherwise this will be the log of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2020) the size (like how the encoding of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2021) the mft record size and the index
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2022) record size found in the boot sector
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2023) work). Has to be a power of 2. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2024) u8 reserved[3]; /* Reserved/align to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2025) INDEX_HEADER index; /* Index header describing the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2026) following index entries. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2027) } __attribute__ ((__packed__)) INDEX_ROOT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2028)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2029) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2030) * Attribute: Index allocation (0xa0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2031) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2032) * NOTE: Always non-resident (doesn't make sense to be resident anyway!).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2033) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2034) * This is an array of index blocks. Each index block starts with an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2035) * INDEX_BLOCK structure containing an index header, followed by a sequence of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2036) * index entries (INDEX_ENTRY structures), as described by the INDEX_HEADER.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2037) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2038) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2039) /* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2040) NTFS_RECORD_TYPE magic; /* Magic is "INDX". */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2041) le16 usa_ofs; /* See NTFS_RECORD definition. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2042) le16 usa_count; /* See NTFS_RECORD definition. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2043)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2044) /* 8*/ sle64 lsn; /* $LogFile sequence number of the last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2045) modification of this index block. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2046) /* 16*/ leVCN index_block_vcn; /* Virtual cluster number of the index block.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2047) If the cluster_size on the volume is <= the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2048) index_block_size of the directory,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2049) index_block_vcn counts in units of clusters,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2050) and in units of sectors otherwise. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2051) /* 24*/ INDEX_HEADER index; /* Describes the following index entries. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2052) /* sizeof()= 40 (0x28) bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2053) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2054) * When creating the index block, we place the update sequence array at this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2055) * offset, i.e. before we start with the index entries. This also makes sense,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2056) * otherwise we could run into problems with the update sequence array
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2057) * containing in itself the last two bytes of a sector which would mean that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2058) * multi sector transfer protection wouldn't work. As you can't protect data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2059) * by overwriting it since you then can't get it back...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2060) * When reading use the data from the ntfs record header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2061) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2062) } __attribute__ ((__packed__)) INDEX_BLOCK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2063)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2064) typedef INDEX_BLOCK INDEX_ALLOCATION;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2065)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2066) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2067) * The system file FILE_Extend/$Reparse contains an index named $R listing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2068) * all reparse points on the volume. The index entry keys are as defined
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2069) * below. Note, that there is no index data associated with the index entries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2070) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2071) * The index entries are sorted by the index key file_id. The collation rule is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2072) * COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2073) * primary key / is not a key at all. (AIA)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2074) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2075) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2076) le32 reparse_tag; /* Reparse point type (inc. flags). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2077) leMFT_REF file_id; /* Mft record of the file containing the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2078) reparse point attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2079) } __attribute__ ((__packed__)) REPARSE_INDEX_KEY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2080)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2081) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2082) * Quota flags (32-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2083) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2084) * The user quota flags. Names explain meaning.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2085) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2086) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2087) QUOTA_FLAG_DEFAULT_LIMITS = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2088) QUOTA_FLAG_LIMIT_REACHED = cpu_to_le32(0x00000002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2089) QUOTA_FLAG_ID_DELETED = cpu_to_le32(0x00000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2090)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2091) QUOTA_FLAG_USER_MASK = cpu_to_le32(0x00000007),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2092) /* This is a bit mask for the user quota flags. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2093)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2094) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2095) * These flags are only present in the quota defaults index entry, i.e.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2096) * in the entry where owner_id = QUOTA_DEFAULTS_ID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2097) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2098) QUOTA_FLAG_TRACKING_ENABLED = cpu_to_le32(0x00000010),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2099) QUOTA_FLAG_ENFORCEMENT_ENABLED = cpu_to_le32(0x00000020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2100) QUOTA_FLAG_TRACKING_REQUESTED = cpu_to_le32(0x00000040),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2101) QUOTA_FLAG_LOG_THRESHOLD = cpu_to_le32(0x00000080),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2103) QUOTA_FLAG_LOG_LIMIT = cpu_to_le32(0x00000100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2104) QUOTA_FLAG_OUT_OF_DATE = cpu_to_le32(0x00000200),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2105) QUOTA_FLAG_CORRUPT = cpu_to_le32(0x00000400),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2106) QUOTA_FLAG_PENDING_DELETES = cpu_to_le32(0x00000800),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2107) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2109) typedef le32 QUOTA_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2111) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2112) * The system file FILE_Extend/$Quota contains two indexes $O and $Q. Quotas
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2113) * are on a per volume and per user basis.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2114) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2115) * The $Q index contains one entry for each existing user_id on the volume. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2116) * index key is the user_id of the user/group owning this quota control entry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2117) * i.e. the key is the owner_id. The user_id of the owner of a file, i.e. the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2118) * owner_id, is found in the standard information attribute. The collation rule
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2119) * for $Q is COLLATION_NTOFS_ULONG.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2120) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2121) * The $O index contains one entry for each user/group who has been assigned
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2122) * a quota on that volume. The index key holds the SID of the user_id the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2123) * entry belongs to, i.e. the owner_id. The collation rule for $O is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2124) * COLLATION_NTOFS_SID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2125) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2126) * The $O index entry data is the user_id of the user corresponding to the SID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2127) * This user_id is used as an index into $Q to find the quota control entry
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2128) * associated with the SID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2129) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2130) * The $Q index entry data is the quota control entry and is defined below.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2131) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2132) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2133) le32 version; /* Currently equals 2. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2134) QUOTA_FLAGS flags; /* Flags describing this quota entry. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2135) le64 bytes_used; /* How many bytes of the quota are in use. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2136) sle64 change_time; /* Last time this quota entry was changed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2137) sle64 threshold; /* Soft quota (-1 if not limited). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2138) sle64 limit; /* Hard quota (-1 if not limited). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2139) sle64 exceeded_time; /* How long the soft quota has been exceeded. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2140) SID sid; /* The SID of the user/object associated with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2141) this quota entry. Equals zero for the quota
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2142) defaults entry (and in fact on a WinXP
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2143) volume, it is not present at all). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2144) } __attribute__ ((__packed__)) QUOTA_CONTROL_ENTRY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2146) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2147) * Predefined owner_id values (32-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2148) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2149) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2150) QUOTA_INVALID_ID = cpu_to_le32(0x00000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2151) QUOTA_DEFAULTS_ID = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2152) QUOTA_FIRST_USER_ID = cpu_to_le32(0x00000100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2153) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2155) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2156) * Current constants for quota control entries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2157) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2158) typedef enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2159) /* Current version. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2160) QUOTA_VERSION = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2161) } QUOTA_CONTROL_ENTRY_CONSTANTS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2162)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2163) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2164) * Index entry flags (16-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2165) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2166) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2167) INDEX_ENTRY_NODE = cpu_to_le16(1), /* This entry contains a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2168) sub-node, i.e. a reference to an index block in form of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2169) a virtual cluster number (see below). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2170) INDEX_ENTRY_END = cpu_to_le16(2), /* This signifies the last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2171) entry in an index block. The index entry does not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2172) represent a file but it can point to a sub-node. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2173)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2174) INDEX_ENTRY_SPACE_FILLER = cpu_to_le16(0xffff), /* gcc: Force
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2175) enum bit width to 16-bit. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2176) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2177)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2178) typedef le16 INDEX_ENTRY_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2180) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2181) * This the index entry header (see below).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2182) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2183) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2184) /* 0*/ union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2185) struct { /* Only valid when INDEX_ENTRY_END is not set. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2186) leMFT_REF indexed_file; /* The mft reference of the file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2187) described by this index
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2188) entry. Used for directory
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2189) indexes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2190) } __attribute__ ((__packed__)) dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2191) struct { /* Used for views/indexes to find the entry's data. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2192) le16 data_offset; /* Data byte offset from this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2193) INDEX_ENTRY. Follows the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2194) index key. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2195) le16 data_length; /* Data length in bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2196) le32 reservedV; /* Reserved (zero). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2197) } __attribute__ ((__packed__)) vi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2198) } __attribute__ ((__packed__)) data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2199) /* 8*/ le16 length; /* Byte size of this index entry, multiple of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2200) 8-bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2201) /* 10*/ le16 key_length; /* Byte size of the key value, which is in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2202) index entry. It follows field reserved. Not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2203) multiple of 8-bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2204) /* 12*/ INDEX_ENTRY_FLAGS flags; /* Bit field of INDEX_ENTRY_* flags. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2205) /* 14*/ le16 reserved; /* Reserved/align to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2206) /* sizeof() = 16 bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2207) } __attribute__ ((__packed__)) INDEX_ENTRY_HEADER;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2208)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2209) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2210) * This is an index entry. A sequence of such entries follows each INDEX_HEADER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2211) * structure. Together they make up a complete index. The index follows either
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2212) * an index root attribute or an index allocation attribute.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2213) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2214) * NOTE: Before NTFS 3.0 only filename attributes were indexed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2215) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2216) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2217) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2218) /* 0 INDEX_ENTRY_HEADER; -- Unfolded here as gcc dislikes unnamed structs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2219) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2220) struct { /* Only valid when INDEX_ENTRY_END is not set. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2221) leMFT_REF indexed_file; /* The mft reference of the file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2222) described by this index
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2223) entry. Used for directory
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2224) indexes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2225) } __attribute__ ((__packed__)) dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2226) struct { /* Used for views/indexes to find the entry's data. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2227) le16 data_offset; /* Data byte offset from this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2228) INDEX_ENTRY. Follows the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2229) index key. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2230) le16 data_length; /* Data length in bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2231) le32 reservedV; /* Reserved (zero). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2232) } __attribute__ ((__packed__)) vi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2233) } __attribute__ ((__packed__)) data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2234) le16 length; /* Byte size of this index entry, multiple of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2235) 8-bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2236) le16 key_length; /* Byte size of the key value, which is in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2237) index entry. It follows field reserved. Not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2238) multiple of 8-bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2239) INDEX_ENTRY_FLAGS flags; /* Bit field of INDEX_ENTRY_* flags. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2240) le16 reserved; /* Reserved/align to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2241)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2242) /* 16*/ union { /* The key of the indexed attribute. NOTE: Only present
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2243) if INDEX_ENTRY_END bit in flags is not set. NOTE: On
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2244) NTFS versions before 3.0 the only valid key is the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2245) FILE_NAME_ATTR. On NTFS 3.0+ the following
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2246) additional index keys are defined: */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2247) FILE_NAME_ATTR file_name;/* $I30 index in directories. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2248) SII_INDEX_KEY sii; /* $SII index in $Secure. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2249) SDH_INDEX_KEY sdh; /* $SDH index in $Secure. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2250) GUID object_id; /* $O index in FILE_Extend/$ObjId: The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2251) object_id of the mft record found in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2252) the data part of the index. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2253) REPARSE_INDEX_KEY reparse; /* $R index in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2254) FILE_Extend/$Reparse. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2255) SID sid; /* $O index in FILE_Extend/$Quota:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2256) SID of the owner of the user_id. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2257) le32 owner_id; /* $Q index in FILE_Extend/$Quota:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2258) user_id of the owner of the quota
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2259) control entry in the data part of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2260) the index. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2261) } __attribute__ ((__packed__)) key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2262) /* The (optional) index data is inserted here when creating. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2263) // leVCN vcn; /* If INDEX_ENTRY_NODE bit in flags is set, the last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2264) // eight bytes of this index entry contain the virtual
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2265) // cluster number of the index block that holds the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2266) // entries immediately preceding the current entry (the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2267) // vcn references the corresponding cluster in the data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2268) // of the non-resident index allocation attribute). If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2269) // the key_length is zero, then the vcn immediately
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2270) // follows the INDEX_ENTRY_HEADER. Regardless of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2271) // key_length, the address of the 8-byte boundary
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2272) // aligned vcn of INDEX_ENTRY{_HEADER} *ie is given by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2273) // (char*)ie + le16_to_cpu(ie*)->length) - sizeof(VCN),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2274) // where sizeof(VCN) can be hardcoded as 8 if wanted. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2275) } __attribute__ ((__packed__)) INDEX_ENTRY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2276)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2277) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2278) * Attribute: Bitmap (0xb0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2279) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2280) * Contains an array of bits (aka a bitfield).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2281) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2282) * When used in conjunction with the index allocation attribute, each bit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2283) * corresponds to one index block within the index allocation attribute. Thus
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2284) * the number of bits in the bitmap * index block size / cluster size is the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2285) * number of clusters in the index allocation attribute.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2286) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2287) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2288) u8 bitmap[0]; /* Array of bits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2289) } __attribute__ ((__packed__)) BITMAP_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2290)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2291) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2292) * The reparse point tag defines the type of the reparse point. It also
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2293) * includes several flags, which further describe the reparse point.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2294) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2295) * The reparse point tag is an unsigned 32-bit value divided in three parts:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2296) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2297) * 1. The least significant 16 bits (i.e. bits 0 to 15) specifiy the type of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2298) * the reparse point.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2299) * 2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2300) * 3. The most significant three bits are flags describing the reparse point.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2301) * They are defined as follows:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2302) * bit 29: Name surrogate bit. If set, the filename is an alias for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2303) * another object in the system.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2304) * bit 30: High-latency bit. If set, accessing the first byte of data will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2305) * be slow. (E.g. the data is stored on a tape drive.)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2306) * bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2307) * defined tags have to use zero here.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2308) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2309) * These are the predefined reparse point tags:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2310) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2311) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2312) IO_REPARSE_TAG_IS_ALIAS = cpu_to_le32(0x20000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2313) IO_REPARSE_TAG_IS_HIGH_LATENCY = cpu_to_le32(0x40000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2314) IO_REPARSE_TAG_IS_MICROSOFT = cpu_to_le32(0x80000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2315)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2316) IO_REPARSE_TAG_RESERVED_ZERO = cpu_to_le32(0x00000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2317) IO_REPARSE_TAG_RESERVED_ONE = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2318) IO_REPARSE_TAG_RESERVED_RANGE = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2319)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2320) IO_REPARSE_TAG_NSS = cpu_to_le32(0x68000005),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2321) IO_REPARSE_TAG_NSS_RECOVER = cpu_to_le32(0x68000006),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2322) IO_REPARSE_TAG_SIS = cpu_to_le32(0x68000007),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2323) IO_REPARSE_TAG_DFS = cpu_to_le32(0x68000008),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2324)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2325) IO_REPARSE_TAG_MOUNT_POINT = cpu_to_le32(0x88000003),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2326)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2327) IO_REPARSE_TAG_HSM = cpu_to_le32(0xa8000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2328)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2329) IO_REPARSE_TAG_SYMBOLIC_LINK = cpu_to_le32(0xe8000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2330)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2331) IO_REPARSE_TAG_VALID_VALUES = cpu_to_le32(0xe000ffff),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2332) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2333)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2334) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2335) * Attribute: Reparse point (0xc0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2336) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2337) * NOTE: Can be resident or non-resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2338) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2339) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2340) le32 reparse_tag; /* Reparse point type (inc. flags). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2341) le16 reparse_data_length; /* Byte size of reparse data. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2342) le16 reserved; /* Align to 8-byte boundary. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2343) u8 reparse_data[0]; /* Meaning depends on reparse_tag. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2344) } __attribute__ ((__packed__)) REPARSE_POINT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2346) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2347) * Attribute: Extended attribute (EA) information (0xd0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2348) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2349) * NOTE: Always resident. (Is this true???)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2350) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2351) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2352) le16 ea_length; /* Byte size of the packed extended
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2353) attributes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2354) le16 need_ea_count; /* The number of extended attributes which have
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2355) the NEED_EA bit set. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2356) le32 ea_query_length; /* Byte size of the buffer required to query
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2357) the extended attributes when calling
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2358) ZwQueryEaFile() in Windows NT/2k. I.e. the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2359) byte size of the unpacked extended
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2360) attributes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2361) } __attribute__ ((__packed__)) EA_INFORMATION;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2362)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2363) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2364) * Extended attribute flags (8-bit).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2365) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2366) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2367) NEED_EA = 0x80 /* If set the file to which the EA belongs
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2368) cannot be interpreted without understanding
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2369) the associates extended attributes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2370) } __attribute__ ((__packed__));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2372) typedef u8 EA_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2373)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2374) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2375) * Attribute: Extended attribute (EA) (0xe0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2376) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2377) * NOTE: Can be resident or non-resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2378) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2379) * Like the attribute list and the index buffer list, the EA attribute value is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2380) * a sequence of EA_ATTR variable length records.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2381) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2382) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2383) le32 next_entry_offset; /* Offset to the next EA_ATTR. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2384) EA_FLAGS flags; /* Flags describing the EA. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2385) u8 ea_name_length; /* Length of the name of the EA in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2386) excluding the '\0' byte terminator. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2387) le16 ea_value_length; /* Byte size of the EA's value. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2388) u8 ea_name[0]; /* Name of the EA. Note this is ASCII, not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2389) Unicode and it is zero terminated. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2390) u8 ea_value[0]; /* The value of the EA. Immediately follows
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2391) the name. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2392) } __attribute__ ((__packed__)) EA_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2393)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2394) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2395) * Attribute: Property set (0xf0).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2396) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2397) * Intended to support Native Structure Storage (NSS) - a feature removed from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2398) * NTFS 3.0 during beta testing.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2399) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2400) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2401) /* Irrelevant as feature unused. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2402) } __attribute__ ((__packed__)) PROPERTY_SET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2403)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2404) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2405) * Attribute: Logged utility stream (0x100).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2406) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2407) * NOTE: Can be resident or non-resident.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2408) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2409) * Operations on this attribute are logged to the journal ($LogFile) like
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2410) * normal metadata changes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2411) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2412) * Used by the Encrypting File System (EFS). All encrypted files have this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2413) * attribute with the name $EFS.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2414) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2415) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2416) /* Can be anything the creator chooses. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2417) /* EFS uses it as follows: */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2418) // FIXME: Type this info, verifying it along the way. (AIA)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2419) } __attribute__ ((__packed__)) LOGGED_UTILITY_STREAM, EFS_ATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2420)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2421) #endif /* _LINUX_NTFS_LAYOUT_H */
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags