WebSVN – Kolibri OS – Blame – /kernel/trunk/fs/ntfs.inc

Rev	Author	Line No.	Line
2288	clevermous	1	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
		2	;; ;;
6080	pathoswith	3	;; Copyright (C) KolibriOS team 2004-2016. All rights reserved. ;;
6462	pathoswith	4	;; Distributed under terms of the GNU General Public License. ;;
2288	clevermous	5	;; ;;
		6	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
		7
		8	$Revision: 6876 $
		9
6462	pathoswith	10	; NTFS external functions
		11	; in:
		12	; ebx -> parameter structure of sysfunc 70
		13	; ebp -> NTFS structure
6471	pathoswith	14	; esi -> path string in UTF-8
6462	pathoswith	15	; out:
		16	; eax, ebx = return values for sysfunc 70
		17	iglobal
		18	align 4
		19	ntfs_user_functions:
		20	dd ntfs_free
		21	dd (ntfs_user_functions_end - ntfs_user_functions - 4) / 4
		22	dd ntfs_ReadFile
		23	dd ntfs_ReadFolder
		24	dd ntfs_CreateFile
		25	dd ntfs_WriteFile
		26	dd ntfs_SetFileEnd
		27	dd ntfs_GetFileInfo
		28	dd ntfs_SetFileInfo
		29	dd 0
		30	dd ntfs_Delete
		31	dd ntfs_CreateFolder
		32	ntfs_user_functions_end:
		33	endg
5954	pathoswith	34
		35	; Basic concepts:
		36	; File is a FileRecord in the $MFT.
		37	; $MFT is a file, that consists of FileRecords and starts with FileRecord of itself.
		38	; FileRecord (FILE) consists of a header and attributes.
		39	; Attribute consists of a header and a body.
		40	; Attribute's body can be inside (resident) or outside of FileRecord.
		41	; File's data is a body of $Data (80h) attribute.
		42	; FileRecords is a data of the $MFT file.
		43	; Directory is a file, that consists of index nodes.
		44	; Resident index node is always located in a body of $IndexRoot (90h) attribute.
		45	; Body of $IndexAllocation (A0h) attribute is always non resident
		46	; and consists of IndexRecords.
		47	; IndexRecord (INDX) consists of a header and an index node.
		48	; Index node consists of a header and indexes.
		49	; Index consists of a header and a copy of indexed attribute's body.
		50	; Directories index $Filename (30h) attribute of all existing files.
		51	; $IndexRoot and $IndexAllocation attributes of a directory has a name — $I30.
		52
		53	; Offsets:
		54	; record header
6273	pathoswith	55	magic = 0
5954	pathoswith	56	updateSequenceOffset = 4
		57	updateSequenceSize = 6
6273	pathoswith	58	; FileRecord header
5954	pathoswith	59	reuseCounter = 16
		60	hardLinkCounter = 12h
		61	attributeOffset = 14h
		62	recordFlags = 16h
		63	recordRealSize = 18h
		64	recordAllocatedSize = 1ch
5994	pathoswith	65	baseRecordReference = 20h ; for auxiliary records
		66	baseRecordReuse = 26h
5954	pathoswith	67	newAttributeID = 28h
		68	; attribute header
		69	attributeType = 0
		70	sizeWithHeader = 4
		71	nonResidentFlag = 8
		72	nameLength = 9
		73	nameOffset = 10
6019	pathoswith	74	attributeFlags = 12
5954	pathoswith	75	attributeID = 14
6080	pathoswith	76	; resident attribute header
		77	sizeWithoutHeader = 10h
6273	pathoswith	78	attributeOffset = 14h
6019	pathoswith	79	indexedFlag = 16h
5954	pathoswith	80	; non resident attribute header
6080	pathoswith	81	firstVCN = 10h
5954	pathoswith	82	lastVCN = 18h
		83	dataRunsOffset = 20h
		84	attributeAllocatedSize = 28h
		85	attributeRealSize = 30h
		86	initialDataSize = 38h
		87	; $IndexRoot
6273	pathoswith	88	indexedAttributesType = 0
5954	pathoswith	89	collationRule = 4
		90	indexRecordSize = 8
6340	pathoswith	91	indexRecordSizeClus = 12 ; in sectors if less than one cluster
6273	pathoswith	92	rootNode = 16
		93	; IndexRecord header
		94	recordVCN = 16
		95	recordNode = 18h
5954	pathoswith	96	; node header
		97	indexOffset = 0
		98	nodeRealSize = 4
		99	nodeAllocatedSize = 8
6273	pathoswith	100	nonLeafFlag = 12
5954	pathoswith	101	; $Filename index
		102	fileRecordReference = 0
		103	fileReferenceReuse = 6
		104	indexAllocatedSize = 8
		105	indexRawSize = 10
		106	indexFlags = 12
		107	directoryRecordReference = 16
		108	directoryReferenceReuse = 16h
6297	pathoswith	109	fileCreated = 18h
		110	fileModified = 20h
		111	recordModified = 28h
		112	fileAccessed = 30h
5954	pathoswith	113	fileAllocatedSize = 38h
		114	fileRealSize = 40h
		115	fileFlags = 48h
		116	fileNameLength = 50h
6297	pathoswith	117	namespace = 51h
		118	fileName = 52h
5954	pathoswith	119
3742	clevermous	120	struct NTFS PARTITION
6462	pathoswith	121	Lock MUTEX ; Currently operations with one partition
5954	pathoswith	122	; can not be executed in parallel since the legacy code is not ready.
6273	pathoswith	123	sectors_per_cluster dd ?
		124	mft_cluster dd ? ; location
		125	mftmirr_cluster dd ? ; location
		126	frs_size dd ? ; in bytes
		127	frs_buffer dd ? ; MFT fileRecord buffer
		128	mft_retrieval_end dd ?
6405	pathoswith	129	mftSize dd ? ; in sectors
6273	pathoswith	130	cur_index_size dd ? ; in sectors
		131	cur_index_buf dd ? ; index node buffer
6340	pathoswith	132	secondIndexBuffer dd ?
6273	pathoswith	133	BitmapBuffer dd ?
		134	BitmapTotalSize dd ? ; bytes reserved
		135	BitmapSize dd ? ; bytes readen
		136	BitmapLocation dd ? ; starting sector
		137	BitmapStart dd ? ; first byte after area, reserved for MFT
		138	mftBitmapBuffer dd ? ; one cluster
		139	mftBitmapSize dd ? ; bytes readen
		140	mftBitmapLocation dd ? ; starting sector
2288	clevermous	141
6405	pathoswith	142	attr_size dq ?
		143	attr_offs dd ?
		144	attr_list dd ?
		145	attr_iBaseRecord dd ?
6273	pathoswith	146	cur_attr dd ? ; attribute type
		147	cur_iRecord dd ? ; number of fileRecord in MFT
		148	cur_offs dd ? ; attribute VCN in sectors
		149	cur_size dd ? ; max sectors to read
		150	cur_buf dd ?
		151	cur_read dd ? ; bytes readen
6405	pathoswith	152	cur_tail dd ?
		153	cur_subnode_size dd ?
6273	pathoswith	154	LastRead dd ? ; last readen block of sectors
6408	pathoswith	155	mftLastRead dd ?
6340	pathoswith	156	rootLastRead dd ?
		157	nodeLastRead dd ?
		158	indexRoot dd ?
6405	pathoswith	159	indexPointer dd ?
6340	pathoswith	160	newRecord dd ?
6273	pathoswith	161	fileDataStart dd ? ; starting cluster
		162	fileDataSize dd ? ; in clusters
6292	pathoswith	163	fileDataBuffer dd ?
6273	pathoswith	164	fileRealSize dd ? ; in bytes
		165	fragmentCount db ?
		166	bCanContinue db ?
		167	bFolder db ?
		168	bWriteAttr db ? ; Warning: Don't forget to turn off!!!
3742	clevermous	169
6558	pathoswith	170	mft_retrieval rb 512
		171	align0 rb 1024-NTFS.align0
6405	pathoswith	172	attrlist_buf rb 1024
		173	attrlist_mft_buf rb 1024
		174	bitmap_buf rb 1024
3742	clevermous	175	ends
		176
2288	clevermous	177	ntfs_test_bootsec:
5954	pathoswith	178	; in: ebx -> buffer, edx = size of partition
		179	; out: CF=1 -> invalid
2288	clevermous	180	; 1. Name=='NTFS '
		181	cmp dword [ebx+3], 'NTFS'
		182	jnz .no
		183	cmp dword [ebx+7], ' '
		184	jnz .no
		185	; 2. Number of bytes per sector is the same as for physical device
		186	; (that is, 0x200 for hard disk)
		187	cmp word [ebx+11], 0x200
		188	jnz .no
		189	; 3. Number of sectors per cluster must be power of 2
		190	movzx eax, byte [ebx+13]
		191	dec eax
		192	js .no
		193	test al, [ebx+13]
		194	jnz .no
		195	; 4. FAT parameters must be zero
		196	cmp word [ebx+14], 0
		197	jnz .no
		198	cmp dword [ebx+16], 0
		199	jnz .no
		200	cmp byte [ebx+20], 0
		201	jnz .no
		202	cmp word [ebx+22], 0
		203	jnz .no
		204	cmp dword [ebx+32], 0
		205	jnz .no
		206	; 5. Number of sectors <= partition size
		207	cmp dword [ebx+0x2C], 0
		208	ja .no
		209	cmp [ebx+0x28], edx
		210	ja .no
		211	; 6. $MFT and $MFTMirr clusters must be within partition
		212	cmp dword [ebx+0x34], 0
		213	ja .no
		214	push edx
		215	movzx eax, byte [ebx+13]
		216	mul dword [ebx+0x30]
		217	test edx, edx
		218	pop edx
		219	jnz .no
		220	cmp eax, edx
		221	ja .no
		222	cmp dword [ebx+0x3C], 0
		223	ja .no
		224	push edx
		225	movzx eax, byte [ebx+13]
		226	mul dword [ebx+0x38]
		227	test edx, edx
		228	pop edx
		229	jnz .no
		230	cmp eax, edx
		231	ja .no
5954	pathoswith	232	; 7. Clusters per FRS must be either power of 2 or between -31 and -9
2288	clevermous	233	movsx eax, byte [ebx+0x40]
		234	cmp al, -31
		235	jl .no
		236	cmp al, -9
		237	jle @f
		238	dec eax
		239	js .no
		240	test [ebx+0x40], al
		241	jnz .no
5954	pathoswith	242	@@: ; 8. Same for clusters per IndexAllocationBuffer
2288	clevermous	243	movsx eax, byte [ebx+0x44]
		244	cmp al, -31
		245	jl .no
		246	cmp al, -9
		247	jle @f
		248	dec eax
		249	js .no
		250	test [ebx+0x44], al
		251	jnz .no
5954	pathoswith	252	@@: ; OK, this is correct NTFS bootsector
2288	clevermous	253	clc
		254	ret
5954	pathoswith	255	.no: ; No, this bootsector isn't NTFS
2288	clevermous	256	stc
		257	ret
		258
6462	pathoswith	259	; Mount if it's a valid NTFS partition.
5954	pathoswith	260	ntfs_create_partition:
6462	pathoswith	261	; in:
		262	; ebp -> PARTITION structure
		263	; ebx -> boot sector
		264	; ebx+512 -> buffer
		265	; out:
		266	; eax -> NTFS structure, 0 = not NTFS
5089	clevermous	267	cmp dword [esi+DISK.MediaInfo.SectorSize], 512
		268	jnz .nope
3742	clevermous	269	mov edx, dword [ebp+PARTITION.Length]
		270	cmp dword [esp+4], 0
		271	jz .boot_read_ok
		272	add ebx, 512
		273	lea eax, [edx-1]
		274	call fs_read32_sys
		275	test eax, eax
		276	jnz @f
		277	call ntfs_test_bootsec
		278	jnc .ntfs_setup
		279	@@:
		280	mov eax, edx
		281	shr eax, 1
		282	call fs_read32_sys
		283	test eax, eax
5954	pathoswith	284	jnz .nope
3742	clevermous	285	.boot_read_ok:
		286	call ntfs_test_bootsec
		287	jnc .ntfs_setup
		288	.nope:
		289	xor eax, eax
		290	jmp .exit
6297	pathoswith	291
6405	pathoswith	292	.ntfs_setup: ; By given bootsector, initialize some NTFS variables
		293	stdcall kernel_alloc, 1000h
3742	clevermous	294	test eax, eax
		295	jz .exit
		296	mov ecx, dword [ebp+PARTITION.FirstSector]
		297	mov dword [eax+NTFS.FirstSector], ecx
		298	mov ecx, dword [ebp+PARTITION.FirstSector+4]
		299	mov dword [eax+NTFS.FirstSector+4], ecx
		300	mov ecx, [ebp+PARTITION.Disk]
		301	mov [eax+NTFS.Disk], ecx
		302	mov [eax+NTFS.FSUserFunctions], ntfs_user_functions
6273	pathoswith	303	mov [eax+NTFS.bWriteAttr], 0
5954	pathoswith	304
3742	clevermous	305	push ebx ebp esi
		306	mov ebp, eax
		307	lea ecx, [ebp+NTFS.Lock]
		308	call mutex_init
2288	clevermous	309	movzx eax, byte [ebx+13]
3742	clevermous	310	mov [ebp+NTFS.sectors_per_cluster], eax
2288	clevermous	311	mov eax, [ebx+0x28]
3742	clevermous	312	mov dword [ebp+NTFS.Length], eax
		313	and dword [ebp+NTFS.Length+4], 0
2288	clevermous	314	mov eax, [ebx+0x30]
3742	clevermous	315	mov [ebp+NTFS.mft_cluster], eax
2288	clevermous	316	mov eax, [ebx+0x38]
3742	clevermous	317	mov [ebp+NTFS.mftmirr_cluster], eax
2288	clevermous	318	movsx eax, byte [ebx+0x40]
		319	test eax, eax
5954	pathoswith	320	js @f
3742	clevermous	321	mul [ebp+NTFS.sectors_per_cluster]
2288	clevermous	322	shl eax, 9
5954	pathoswith	323	jmp .1
6297	pathoswith	324
5954	pathoswith	325	@@:
2288	clevermous	326	neg eax
		327	mov ecx, eax
		328	mov eax, 1
		329	shl eax, cl
5954	pathoswith	330	.1:
3742	clevermous	331	mov [ebp+NTFS.frs_size], eax
5954	pathoswith	332	stdcall kernel_alloc, eax
2288	clevermous	333	test eax, eax
3742	clevermous	334	jz .fail_free
		335	mov [ebp+NTFS.frs_buffer], eax
2288	clevermous	336	; read $MFT disposition
3742	clevermous	337	mov eax, [ebp+NTFS.mft_cluster]
		338	mul [ebp+NTFS.sectors_per_cluster]
6405	pathoswith	339	mov ecx, [ebp+NTFS.frs_size]
		340	shr ecx, 9
		341	mov ebx, [ebp+NTFS.frs_buffer]
		342	call fs_read64_sys
3742	clevermous	343	test eax, eax
2288	clevermous	344	jnz .usemirr
		345	cmp dword [ebx], 'FILE'
		346	jnz .usemirr
		347	call ntfs_restore_usa_frs
		348	jnc .mftok
		349	.usemirr:
3742	clevermous	350	mov eax, [ebp+NTFS.mftmirr_cluster]
		351	mul [ebp+NTFS.sectors_per_cluster]
6405	pathoswith	352	mov ecx, [ebp+NTFS.frs_size]
		353	shr ecx, 9
		354	mov ebx, [ebp+NTFS.frs_buffer]
		355	call fs_read64_sys
3742	clevermous	356	test eax, eax
5954	pathoswith	357	jnz .fail_free_frs
2288	clevermous	358	cmp dword [ebx], 'FILE'
5954	pathoswith	359	jnz .fail_free_frs
2288	clevermous	360	call ntfs_restore_usa_frs
5954	pathoswith	361	jc .fail_free_frs
6405	pathoswith	362	.mftok: ; prepare $MFT retrieval information
		363	; search for unnamed non-resident $DATA attribute
		364	movzx eax, word [ebx+attributeOffset]
2288	clevermous	365	add eax, ebx
		366	.scandata:
		367	cmp dword [eax], -1
6405	pathoswith	368	jz .fail_free_frs
2288	clevermous	369	cmp dword [eax], 0x80
		370	jnz @f
6405	pathoswith	371	cmp byte [eax+nameLength], 0
2288	clevermous	372	jz .founddata
		373	@@:
6405	pathoswith	374	add eax, [eax+sizeWithHeader]
2288	clevermous	375	jmp .scandata
6297	pathoswith	376
2288	clevermous	377	.founddata:
6405	pathoswith	378	cmp byte [eax+nonResidentFlag], 0
		379	jz .fail_free_frs
		380	movzx esi, word [eax+dataRunsOffset]
2288	clevermous	381	add esi, eax
6405	pathoswith	382	mov edx, [eax+attributeAllocatedSize+4]
		383	mov eax, [eax+attributeAllocatedSize]
		384	shrd eax, edx, 9
		385	mov [ebp+NTFS.mftSize], eax
2288	clevermous	386	sub esp, 10h
6405	pathoswith	387	lea ecx, [ebp+NTFS.mft_retrieval]
		388	xor edx, edx
		389	.scanmcb: ; load descriptions of fragments
2288	clevermous	390	call ntfs_decode_mcb_entry
		391	jnc .scanmcbend
6405	pathoswith	392	mov eax, [esp] ; block length
		393	mov [ecx], eax
		394	add edx, [esp+8] ; block addr
		395	mov [ecx+4], edx
		396	add ecx, 8
2288	clevermous	397	jmp .scanmcb
6297	pathoswith	398
2288	clevermous	399	.scanmcbend:
		400	add esp, 10h
6405	pathoswith	401	lea eax, [ebp+NTFS.attrlist_buf]
		402	cmp eax, ecx
		403	jc @f
		404	mov eax, ecx
		405	@@:
		406	mov [ebp+NTFS.mft_retrieval_end], eax
		407	; allocate index buffers
6340	pathoswith	408	stdcall kernel_alloc, 2000h
2288	clevermous	409	test eax, eax
6405	pathoswith	410	jz .fail_free_frs
3742	clevermous	411	mov [ebp+NTFS.cur_index_buf], eax
6340	pathoswith	412	add eax, 1000h
		413	mov [ebp+NTFS.secondIndexBuffer], eax
		414	mov [ebp+NTFS.cur_index_size], 8
5954	pathoswith	415	; reserve adress space for bitmap buffer and load some part of bitmap
		416	mov eax, dword [ebp+NTFS.Length]
		417	xor edx, edx
		418	div [ebp+NTFS.sectors_per_cluster]
		419	shr eax, 3
		420	mov [ebp+NTFS.BitmapTotalSize], eax
		421	add eax, 7FFFh
		422	and eax, not 7FFFh
		423	push eax
		424	call alloc_kernel_space
		425	test eax, eax
		426	jz .failFreeIndex
		427	mov [ebp+NTFS.BitmapBuffer], eax
6273	pathoswith	428	mov [ebp+NTFS.cur_buf], eax
5954	pathoswith	429	mov eax, [ebp+NTFS.BitmapTotalSize]
		430	add eax, [ebp+NTFS.mft_cluster]
		431	shr eax, 3+2 ; reserve 1/8 of partition for $MFT
		432	shl eax, 2
		433	mov [ebp+NTFS.BitmapStart], eax
		434	shr eax, 15
		435	inc eax
		436	shl eax, 3
		437	push eax
		438	push eax
		439	shl eax, 3
6273	pathoswith	440	mov [ebp+NTFS.cur_size], eax
5954	pathoswith	441	call alloc_pages
		442	test eax, eax
		443	pop ecx
		444	jz .failFreeBitmap
		445	add eax, 3
		446	mov ebx, [ebp+NTFS.BitmapBuffer]
		447	call commit_pages
6273	pathoswith	448	mov [ebp+NTFS.cur_iRecord], 6
		449	mov [ebp+NTFS.cur_attr], 0x80
		450	mov [ebp+NTFS.cur_offs], 0
5954	pathoswith	451	call ntfs_read_attr
		452	jc .failFreeBitmap
6273	pathoswith	453	mov eax, [ebp+NTFS.cur_read]
5954	pathoswith	454	mov [ebp+NTFS.BitmapSize], eax
6273	pathoswith	455	mov eax, [ebp+NTFS.LastRead]
5954	pathoswith	456	mov [ebp+NTFS.BitmapLocation], eax
		457	; read MFT $BITMAP attribute
		458	mov eax, [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	459	mov [ebp+NTFS.cur_size], eax
5954	pathoswith	460	shl eax, 9
		461	stdcall kernel_alloc, eax
		462	test eax, eax
		463	jz .failFreeBitmap
		464	mov [ebp+NTFS.mftBitmapBuffer], eax
6273	pathoswith	465	mov [ebp+NTFS.cur_buf], eax
		466	mov [ebp+NTFS.cur_iRecord], 0
		467	mov [ebp+NTFS.cur_attr], 0xB0
		468	mov [ebp+NTFS.cur_offs], 0
5954	pathoswith	469	call ntfs_read_attr
6273	pathoswith	470	mov eax, [ebp+NTFS.cur_read]
5954	pathoswith	471	cmp eax, 4
		472	jc .failFreeBitmapMFT
6273	pathoswith	473	mov ecx, [ebp+NTFS.attr_offs]
6107	pathoswith	474	cmp byte [ecx+nonResidentFlag], 1
		475	jnz .failFreeBitmapMFT
5954	pathoswith	476	mov [ebp+NTFS.mftBitmapSize], eax
6273	pathoswith	477	mov eax, [ebp+NTFS.LastRead]
5954	pathoswith	478	mov [ebp+NTFS.mftBitmapLocation], eax
2288	clevermous	479
3742	clevermous	480	mov eax, ebp
5954	pathoswith	481	.pop_exit:
		482	pop esi ebp ebx
		483	.exit:
		484	cmp dword [esp+4], 0
		485	jz @f
		486	sub ebx, 512
		487	@@:
		488	ret
		489
		490	.failFreeBitmapMFT:
6405	pathoswith	491	stdcall kernel_free, [ebp+NTFS.mftBitmapBuffer]
5954	pathoswith	492	.failFreeBitmap:
6405	pathoswith	493	stdcall kernel_free, [ebp+NTFS.BitmapBuffer]
5954	pathoswith	494	.failFreeIndex:
6405	pathoswith	495	mov eax, [ebp+NTFS.cur_index_buf]
		496	cmp eax, [ebp+NTFS.secondIndexBuffer]
		497	jc @f
		498	mov eax, [ebp+NTFS.secondIndexBuffer]
		499	@@:
		500	stdcall kernel_free, eax
5954	pathoswith	501	.fail_free_frs:
		502	stdcall kernel_free, [ebp+NTFS.frs_buffer]
		503	.fail_free:
6405	pathoswith	504	stdcall kernel_free, ebp
5954	pathoswith	505	xor eax, eax
3742	clevermous	506	jmp .pop_exit
2288	clevermous	507
5954	pathoswith	508	ntfs_free:
3742	clevermous	509	push ebx
5954	pathoswith	510	mov ebx, eax
3742	clevermous	511	stdcall kernel_free, [ebx+NTFS.frs_buffer]
5954	pathoswith	512	stdcall kernel_free, [ebx+NTFS.mftBitmapBuffer]
		513	stdcall kernel_free, [ebx+NTFS.BitmapBuffer]
6405	pathoswith	514	mov eax, [ebx+NTFS.cur_index_buf]
		515	cmp eax, [ebx+NTFS.secondIndexBuffer]
		516	jc @f
		517	mov eax, [ebx+NTFS.secondIndexBuffer]
		518	@@:
		519	stdcall kernel_free, eax
		520	stdcall kernel_free, ebx
3742	clevermous	521	pop ebx
6405	pathoswith	522	ret
3742	clevermous	523
5954	pathoswith	524	ntfs_lock:
3742	clevermous	525	lea ecx, [ebp+NTFS.Lock]
		526	jmp mutex_lock
		527
5954	pathoswith	528	ntfs_unlock:
3742	clevermous	529	lea ecx, [ebp+NTFS.Lock]
		530	jmp mutex_unlock
		531
2288	clevermous	532	ntfs_read_attr:
6273	pathoswith	533	; [ebp+NTFS.bWriteAttr]=1 -> write attribute
5954	pathoswith	534	; in:
6273	pathoswith	535	; [ebp+NTFS.cur_iRecord] = number of fileRecord
		536	; [ebp+NTFS.cur_attr] = attribute type
		537	; [ebp+NTFS.cur_offs] = attribute VCN in sectors
		538	; [ebp+NTFS.cur_buf] -> buffer for data
		539	; [ebp+NTFS.cur_size] = max sectors to read
5954	pathoswith	540	; out:
6273	pathoswith	541	; [ebp+NTFS.cur_read] = bytes readen
5954	pathoswith	542	; CF=1 -> failed, eax = disk error code, eax=0 -> something with FS
3742	clevermous	543	xor eax, eax
2288	clevermous	544	pushad
6273	pathoswith	545	and [ebp+NTFS.cur_read], 0
		546	cmp [ebp+NTFS.cur_iRecord], 0
2288	clevermous	547	jnz .nomft
6273	pathoswith	548	cmp [ebp+NTFS.cur_attr], 0x80
2288	clevermous	549	jnz .nomft
		550	; precalculated part of $Mft $DATA
6273	pathoswith	551	mov eax, [ebp+NTFS.cur_offs]
2288	clevermous	552	xor edx, edx
3742	clevermous	553	div [ebp+NTFS.sectors_per_cluster]
6405	pathoswith	554	mov ebx, edx
6418	pathoswith	555	mov [ebp+NTFS.fragmentCount], 0
6405	pathoswith	556	; eax = VCN, ebx = offset in sectors from beginning of cluster
		557	lea esi, [ebp+NTFS.mft_retrieval]
		558	sub esi, 8
2288	clevermous	559	.mftscan:
6405	pathoswith	560	add esi, 8
		561	cmp esi, [ebp+NTFS.mft_retrieval_end]
		562	jz .nomft
		563	mov ecx, [esi+4]
2288	clevermous	564	sub eax, [esi]
6405	pathoswith	565	jnc .mftscan
2288	clevermous	566	add ecx, eax
		567	add ecx, [esi]
6405	pathoswith	568	neg eax
		569	mul [ebp+NTFS.sectors_per_cluster]
		570	xchg eax, ecx
		571	mul [ebp+NTFS.sectors_per_cluster]
		572	sub ecx, ebx
		573	add eax, ebx
6273	pathoswith	574	mov ebx, [ebp+NTFS.cur_buf]
		575	cmp ecx, [ebp+NTFS.cur_size]
2288	clevermous	576	jb @f
6273	pathoswith	577	mov ecx, [ebp+NTFS.cur_size]
2288	clevermous	578	@@:
6405	pathoswith	579	mov [ebp+NTFS.LastRead], eax
		580	mov edi, ecx
		581	call fs_read64_sys
3742	clevermous	582	test eax, eax
6405	pathoswith	583	jnz .errret
		584	sub [ebp+NTFS.cur_size], edi
		585	add [ebp+NTFS.cur_offs], edi
		586	shl edi, 9
		587	add [ebp+NTFS.cur_read], edi
		588	add [ebp+NTFS.cur_buf], edi
6418	pathoswith	589	inc [ebp+NTFS.fragmentCount]
2288	clevermous	590	xor eax, eax
6405	pathoswith	591	xor ebx, ebx
6273	pathoswith	592	cmp [ebp+NTFS.cur_size], eax
2288	clevermous	593	jz @f
		594	jmp .mftscan
6297	pathoswith	595
		596	.errret2_pop:
		597	xor eax, eax
		598	.errret_pop:
		599	pop ecx
2288	clevermous	600	pop ecx
		601	.errret:
3742	clevermous	602	mov [esp+28], eax
2288	clevermous	603	stc
6297	pathoswith	604	@@:
2288	clevermous	605	popad
		606	ret
6297	pathoswith	607
2288	clevermous	608	.nomft:
		609	; 1. Read file record.
		610	; N.B. This will do recursive call of read_attr for $MFT::$Data.
6273	pathoswith	611	mov eax, [ebp+NTFS.cur_iRecord]
		612	and [ebp+NTFS.attr_list], 0
		613	or dword [ebp+NTFS.attr_size+4], -1
		614	or [ebp+NTFS.attr_iBaseRecord], -1
2288	clevermous	615	call ntfs_read_file_record
3742	clevermous	616	jc .errret
2288	clevermous	617	; 2. Find required attribute.
3742	clevermous	618	mov eax, [ebp+NTFS.frs_buffer]
6107	pathoswith	619	; a) For auxiliary records, read base record.
		620	; If base record is present, base iRecord may be 0 (for $Mft),
		621	; but SequenceNumber is nonzero.
6297	pathoswith	622	cmp word [eax+baseRecordReuse], 0
2288	clevermous	623	jz @f
6297	pathoswith	624	mov eax, [eax+baseRecordReference]
2288	clevermous	625	.beginfindattr:
		626	call ntfs_read_file_record
3742	clevermous	627	jc .errret
6107	pathoswith	628	jmp @f
6297	pathoswith	629
6107	pathoswith	630	.newAttribute:
		631	pushad
6297	pathoswith	632	and [ebp+NTFS.cur_read], 0
2288	clevermous	633	@@:
		634	; b) Scan for required attribute and for $ATTR_LIST
3742	clevermous	635	mov eax, [ebp+NTFS.frs_buffer]
6297	pathoswith	636	movzx ecx, word [eax+attributeOffset]
2288	clevermous	637	add eax, ecx
6273	pathoswith	638	mov ecx, [ebp+NTFS.cur_attr]
		639	and [ebp+NTFS.attr_offs], 0
2288	clevermous	640	.scanattr:
		641	cmp dword [eax], -1
		642	jz .scandone
		643	cmp dword [eax], ecx
		644	jz .okattr
6273	pathoswith	645	cmp [ebp+NTFS.attr_iBaseRecord], -1
2288	clevermous	646	jnz .scancont
		647	cmp dword [eax], 0x20 ; $ATTR_LIST
		648	jnz .scancont
6273	pathoswith	649	mov [ebp+NTFS.attr_list], eax
2288	clevermous	650	jmp .scancont
6297	pathoswith	651
2288	clevermous	652	.okattr:
		653	; ignore named $DATA attributes (aka NTFS streams)
		654	cmp ecx, 0x80
		655	jnz @f
6297	pathoswith	656	cmp byte [eax+nameLength], 0
2288	clevermous	657	jnz .scancont
		658	@@:
6273	pathoswith	659	mov [ebp+NTFS.attr_offs], eax
2288	clevermous	660	.scancont:
6297	pathoswith	661	add eax, [eax+sizeWithHeader]
2288	clevermous	662	jmp .scanattr
6297	pathoswith	663
2288	clevermous	664	.continue:
		665	pushad
6273	pathoswith	666	and [ebp+NTFS.cur_read], 0
2288	clevermous	667	.scandone:
		668	; c) Check for required offset and length
6273	pathoswith	669	mov ecx, [ebp+NTFS.attr_offs]
2288	clevermous	670	jecxz .noattr
6273	pathoswith	671	push [ebp+NTFS.cur_size]
		672	push [ebp+NTFS.cur_read]
2288	clevermous	673	call .doreadattr
		674	pop edx
3742	clevermous	675	pop ecx
6297	pathoswith	676	jc .ret
6273	pathoswith	677	cmp [ebp+NTFS.bCanContinue], 0
6297	pathoswith	678	jz .ret
6273	pathoswith	679	sub edx, [ebp+NTFS.cur_read]
2288	clevermous	680	neg edx
		681	shr edx, 9
3742	clevermous	682	sub ecx, edx
6273	pathoswith	683	mov [ebp+NTFS.cur_size], ecx
6297	pathoswith	684	jz .ret
2288	clevermous	685	.noattr:
6273	pathoswith	686	cmp [ebp+NTFS.cur_attr], 0x20
2288	clevermous	687	jz @f
6273	pathoswith	688	mov ecx, [ebp+NTFS.attr_list]
2288	clevermous	689	test ecx, ecx
		690	jnz .lookattr
3742	clevermous	691	and dword [esp+28], 0
6297	pathoswith	692	cmp [ebp+NTFS.attr_offs], 1 ; define CF
		693	.ret:
2288	clevermous	694	popad
		695	ret
6297	pathoswith	696
2288	clevermous	697	.lookattr:
		698	; required attribute or required offset was not found in base record;
		699	; it may be present in auxiliary records;
		700	; scan $ATTR_LIST
6273	pathoswith	701	mov eax, [ebp+NTFS.attr_iBaseRecord]
2288	clevermous	702	cmp eax, -1
		703	jz @f
		704	call ntfs_read_file_record
3742	clevermous	705	jc .errret
6273	pathoswith	706	or [ebp+NTFS.attr_iBaseRecord], -1
2288	clevermous	707	@@:
6273	pathoswith	708	push [ebp+NTFS.cur_offs]
		709	push [ebp+NTFS.cur_size]
		710	push [ebp+NTFS.cur_read]
		711	push [ebp+NTFS.cur_buf]
		712	push dword [ebp+NTFS.attr_size]
		713	push dword [ebp+NTFS.attr_size+4]
		714	or dword [ebp+NTFS.attr_size+4], -1
		715	and [ebp+NTFS.cur_offs], 0
		716	mov [ebp+NTFS.cur_size], 2
		717	and [ebp+NTFS.cur_read], 0
		718	lea eax, [ebp+NTFS.attrlist_buf]
		719	cmp [ebp+NTFS.cur_iRecord], 0
2288	clevermous	720	jnz @f
6273	pathoswith	721	lea eax, [ebp+NTFS.attrlist_mft_buf]
2288	clevermous	722	@@:
6273	pathoswith	723	mov [ebp+NTFS.cur_buf], eax
2288	clevermous	724	push eax
		725	call .doreadattr
		726	pop esi
		727	mov edx, 1
6273	pathoswith	728	pop dword [ebp+NTFS.attr_size+4]
		729	pop dword [ebp+NTFS.attr_size]
		730	mov ecx, [ebp+NTFS.cur_read]
		731	pop [ebp+NTFS.cur_buf]
		732	pop [ebp+NTFS.cur_read]
		733	pop [ebp+NTFS.cur_size]
		734	pop [ebp+NTFS.cur_offs]
2288	clevermous	735	jc .errret
		736	or edi, -1
3742	clevermous	737	lea ecx, [ecx+esi-1Ah]
2288	clevermous	738	.scanliststart:
3742	clevermous	739	push ecx
6273	pathoswith	740	mov eax, [ebp+NTFS.cur_attr]
2288	clevermous	741	.scanlist:
3742	clevermous	742	cmp esi, [esp]
2288	clevermous	743	jae .scanlistdone
		744	cmp eax, [esi]
		745	jz @f
		746	.scanlistcont:
		747	movzx ecx, word [esi+4]
		748	add esi, ecx
		749	jmp .scanlist
6297	pathoswith	750
2288	clevermous	751	@@:
		752	; ignore named $DATA attributes (aka NTFS streams)
		753	cmp eax, 0x80
		754	jnz @f
		755	cmp byte [esi+6], 0
		756	jnz .scanlistcont
		757	@@:
		758	push eax
		759	mov eax, [esi+8]
		760	test eax, eax
		761	jnz .testf
6407	pathoswith	762	cmp dword [ebp+NTFS.attr_size+4], -1
2288	clevermous	763	jnz .testfz
		764	; if attribute is in auxiliary records, its size is defined only in first
		765	mov eax, [esi+10h]
		766	call ntfs_read_file_record
6297	pathoswith	767	jc .errret_pop
3742	clevermous	768	mov eax, [ebp+NTFS.frs_buffer]
2288	clevermous	769	movzx ecx, word [eax+14h]
		770	add eax, ecx
6273	pathoswith	771	mov ecx, [ebp+NTFS.cur_attr]
2288	clevermous	772	@@:
		773	cmp dword [eax], -1
3742	clevermous	774	jz .errret2_pop
2288	clevermous	775	cmp dword [eax], ecx
		776	jz @f
		777	.l1:
		778	add eax, [eax+4]
		779	jmp @b
6297	pathoswith	780
2288	clevermous	781	@@:
		782	cmp eax, 0x80
		783	jnz @f
		784	cmp byte [eax+9], 0
		785	jnz .l1
		786	@@:
		787	cmp byte [eax+8], 0
		788	jnz .sdnores
		789	mov eax, [eax+10h]
6273	pathoswith	790	mov dword [ebp+NTFS.attr_size], eax
		791	and dword [ebp+NTFS.attr_size+4], 0
2288	clevermous	792	jmp .testfz
6297	pathoswith	793
2288	clevermous	794	.sdnores:
		795	mov ecx, [eax+30h]
6273	pathoswith	796	mov dword [ebp+NTFS.attr_size], ecx
2288	clevermous	797	mov ecx, [eax+34h]
6273	pathoswith	798	mov dword [ebp+NTFS.attr_size+4], ecx
2288	clevermous	799	.testfz:
		800	xor eax, eax
		801	.testf:
3742	clevermous	802	imul eax, [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	803	cmp eax, [ebp+NTFS.cur_offs]
2288	clevermous	804	pop eax
		805	ja @f
		806	mov edi, [esi+10h] ; keep previous iRecord
		807	jmp .scanlistcont
6297	pathoswith	808
2288	clevermous	809	@@:
3742	clevermous	810	pop ecx
2288	clevermous	811	.scanlistfound:
		812	cmp edi, -1
6297	pathoswith	813	jz .ret
6273	pathoswith	814	mov eax, [ebp+NTFS.cur_iRecord]
		815	mov [ebp+NTFS.attr_iBaseRecord], eax
2288	clevermous	816	mov eax, edi
		817	jmp .beginfindattr
6297	pathoswith	818
2288	clevermous	819	.scanlistdone:
3742	clevermous	820	pop ecx
		821	sub ecx, ebp
6273	pathoswith	822	sub ecx, NTFS.attrlist_buf-1Ah
		823	cmp [ebp+NTFS.cur_iRecord], 0
2288	clevermous	824	jnz @f
6273	pathoswith	825	sub ecx, NTFS.attrlist_mft_buf-NTFS.attrlist_buf
2288	clevermous	826	@@:
3742	clevermous	827	cmp ecx, 0x400
2288	clevermous	828	jnz .scanlistfound
		829	inc edx
		830	push esi edi
6273	pathoswith	831	lea esi, [ebp+NTFS.attrlist_buf+0x200]
		832	lea edi, [ebp+NTFS.attrlist_buf]
		833	cmp [ebp+NTFS.cur_iRecord], 0
2288	clevermous	834	jnz @f
6273	pathoswith	835	lea esi, [ebp+NTFS.attrlist_mft_buf+0x200]
		836	lea edi, [ebp+NTFS.attrlist_mft_buf]
2288	clevermous	837	@@:
		838	mov ecx, 0x200/4
		839	rep movsd
		840	mov eax, edi
		841	pop edi esi
		842	sub esi, 0x200
6273	pathoswith	843	push [ebp+NTFS.cur_offs]
		844	push [ebp+NTFS.cur_size]
		845	push [ebp+NTFS.cur_read]
		846	push [ebp+NTFS.cur_buf]
		847	push dword [ebp+NTFS.attr_size]
		848	push dword [ebp+NTFS.attr_size+4]
		849	or dword [ebp+NTFS.attr_size+4], -1
		850	mov [ebp+NTFS.cur_offs], edx
		851	mov [ebp+NTFS.cur_size], 1
		852	and [ebp+NTFS.cur_read], 0
		853	mov [ebp+NTFS.cur_buf], eax
		854	mov ecx, [ebp+NTFS.attr_list]
3742	clevermous	855	push esi edx edi
2288	clevermous	856	call .doreadattr
3742	clevermous	857	pop edi edx esi
6273	pathoswith	858	mov ecx, [ebp+NTFS.cur_read]
		859	pop dword [ebp+NTFS.attr_size+4]
		860	pop dword [ebp+NTFS.attr_size]
		861	pop [ebp+NTFS.cur_buf]
		862	pop [ebp+NTFS.cur_read]
		863	pop [ebp+NTFS.cur_size]
		864	pop [ebp+NTFS.cur_offs]
2288	clevermous	865	jc .errret
6273	pathoswith	866	lea ecx, [ecx+ebp+NTFS.attrlist_buf+0x200-0x1A]
		867	cmp [ebp+NTFS.cur_iRecord], 0
2288	clevermous	868	jnz .scanliststart
6273	pathoswith	869	add ecx, NTFS.attrlist_mft_buf-NTFS.attrlist_buf
2288	clevermous	870	jmp .scanliststart
		871
		872	.doreadattr:
6273	pathoswith	873	mov [ebp+NTFS.bCanContinue], 0
6297	pathoswith	874	cmp byte [ecx+nonResidentFlag], 0
2288	clevermous	875	jnz .nonresident
6297	pathoswith	876	mov eax, [ecx+sizeWithoutHeader]
2288	clevermous	877	mov esi, eax
6273	pathoswith	878	mov edx, [ebp+NTFS.cur_offs]
2288	clevermous	879	shr eax, 9
		880	cmp eax, edx
		881	jb .okret
		882	shl edx, 9
		883	sub esi, edx
6297	pathoswith	884	movzx eax, word [ecx+attributeOffset]
2288	clevermous	885	add edx, eax
		886	add edx, ecx ; edx -> data
6273	pathoswith	887	mov eax, [ebp+NTFS.cur_size]
2288	clevermous	888	cmp eax, (0xFFFFFFFF shr 9)+1
		889	jbe @f
		890	mov eax, (0xFFFFFFFF shr 9)+1
		891	@@:
		892	shl eax, 9
		893	cmp eax, esi
		894	jbe @f
		895	mov eax, esi
		896	@@:
		897	; eax = length, edx -> data
6273	pathoswith	898	mov [ebp+NTFS.cur_read], eax
2288	clevermous	899	mov ecx, eax
		900	mov eax, edx
6273	pathoswith	901	mov ebx, [ebp+NTFS.cur_buf]
2288	clevermous	902	call memmove
6273	pathoswith	903	and [ebp+NTFS.cur_size], 0 ; CF=0
2288	clevermous	904	ret
6297	pathoswith	905
2288	clevermous	906	.nonresident:
		907	; Not all auxiliary records contain correct FileSize info
6273	pathoswith	908	mov eax, dword [ebp+NTFS.attr_size]
		909	mov edx, dword [ebp+NTFS.attr_size+4]
6407	pathoswith	910	cmp edx, -1
2288	clevermous	911	jnz @f
6297	pathoswith	912	mov eax, [ecx+attributeRealSize]
		913	mov edx, [ecx+attributeRealSize+4]
6273	pathoswith	914	mov dword [ebp+NTFS.attr_size], eax
		915	mov dword [ebp+NTFS.attr_size+4], edx
2288	clevermous	916	@@:
		917	add eax, 0x1FF
		918	adc edx, 0
		919	shrd eax, edx, 9
6273	pathoswith	920	sub eax, [ebp+NTFS.cur_offs]
2288	clevermous	921	ja @f
		922	; return with nothing read
6273	pathoswith	923	and [ebp+NTFS.cur_size], 0
2288	clevermous	924	.okret:
		925	clc
		926	ret
6297	pathoswith	927
2288	clevermous	928	@@:
		929	; reduce read length
6273	pathoswith	930	and [ebp+NTFS.cur_tail], 0
		931	cmp [ebp+NTFS.cur_size], eax
2288	clevermous	932	jb @f
6273	pathoswith	933	mov [ebp+NTFS.cur_size], eax
		934	mov eax, dword [ebp+NTFS.attr_size]
2288	clevermous	935	and eax, 0x1FF
6273	pathoswith	936	mov [ebp+NTFS.cur_tail], eax
2288	clevermous	937	@@:
6273	pathoswith	938	mov eax, [ebp+NTFS.cur_offs]
2288	clevermous	939	xor edx, edx
3742	clevermous	940	div [ebp+NTFS.sectors_per_cluster]
6297	pathoswith	941	sub eax, [ecx+firstVCN]
2288	clevermous	942	jb .okret
6405	pathoswith	943	mov ebx, edx
		944	; eax = starting cluster, ebx = sector in the cluster
6273	pathoswith	945	cmp [ebp+NTFS.cur_attr], 0x80
5994	pathoswith	946	jnz .sys
6273	pathoswith	947	cmp [ebp+NTFS.cur_iRecord], 0
5994	pathoswith	948	jz .sys
		949	push fs_read64_app
6273	pathoswith	950	cmp [ebp+NTFS.bWriteAttr], 1
5994	pathoswith	951	jnz @f
		952	mov dword[esp], fs_write64_app
		953	jmp @f
6297	pathoswith	954
5994	pathoswith	955	.sys:
		956	push fs_read64_sys
		957	@@:
2288	clevermous	958	sub esp, 10h
6297	pathoswith	959	movzx esi, word [ecx+dataRunsOffset]
2288	clevermous	960	add esi, ecx
3742	clevermous	961	xor edi, edi
6273	pathoswith	962	mov [ebp+NTFS.fragmentCount], 0
2288	clevermous	963	.readloop:
		964	call ntfs_decode_mcb_entry
		965	jnc .break
3742	clevermous	966	add edi, [esp+8]
2288	clevermous	967	sub eax, [esp]
		968	jae .readloop
6405	pathoswith	969	mov ecx, edi
		970	add ecx, eax
		971	add ecx, [esp]
		972	neg eax
		973	mul [ebp+NTFS.sectors_per_cluster]
		974	xchg eax, ecx
		975	mul [ebp+NTFS.sectors_per_cluster]
		976	sub ecx, ebx
		977	add eax, ebx
		978	mov ebx, [ebp+NTFS.cur_buf]
6273	pathoswith	979	cmp ecx, [ebp+NTFS.cur_size]
2288	clevermous	980	jb @f
6273	pathoswith	981	mov ecx, [ebp+NTFS.cur_size]
2288	clevermous	982	@@:
6273	pathoswith	983	mov [ebp+NTFS.LastRead], eax
5954	pathoswith	984	push ecx
6405	pathoswith	985	call dword[esp+14h]
5954	pathoswith	986	pop ecx
3742	clevermous	987	test eax, eax
2288	clevermous	988	jnz .errread2
6273	pathoswith	989	sub [ebp+NTFS.cur_size], ecx
		990	add [ebp+NTFS.cur_offs], ecx
5954	pathoswith	991	shl ecx, 9
6273	pathoswith	992	add [ebp+NTFS.cur_read], ecx
		993	add [ebp+NTFS.cur_buf], ecx
		994	inc [ebp+NTFS.fragmentCount]
2288	clevermous	995	xor eax, eax
6405	pathoswith	996	xor ebx, ebx
6273	pathoswith	997	cmp [ebp+NTFS.cur_size], 0
2288	clevermous	998	jnz .readloop
5994	pathoswith	999	add esp, 14h
6273	pathoswith	1000	mov eax, [ebp+NTFS.cur_tail]
2288	clevermous	1001	test eax, eax
		1002	jz @f
		1003	sub eax, 0x200
6273	pathoswith	1004	add [ebp+NTFS.cur_read], eax
2288	clevermous	1005	@@:
		1006	clc
		1007	ret
6297	pathoswith	1008
2288	clevermous	1009	.errread2:
5994	pathoswith	1010	add esp, 14h
2288	clevermous	1011	stc
		1012	ret
6297	pathoswith	1013
2288	clevermous	1014	.break:
5994	pathoswith	1015	add esp, 14h ; CF=0
6273	pathoswith	1016	mov [ebp+NTFS.bCanContinue], 1
2288	clevermous	1017	ret
		1018
		1019	ntfs_read_file_record:
5954	pathoswith	1020	; in: eax = iRecord
6080	pathoswith	1021	; out: [ebp+NTFS.frs_buffer] -> file record
5954	pathoswith	1022	; CF=1 -> failed, eax = disk error code, eax=0 -> something with FS
		1023	; Read attr $DATA of $Mft, starting from eax*[ebp+NTFS.frs_size]
2288	clevermous	1024	push ecx edx
3742	clevermous	1025	mov ecx, [ebp+NTFS.frs_size]
2288	clevermous	1026	mul ecx
		1027	shrd eax, edx, 9
		1028	shr edx, 9
3742	clevermous	1029	jnz .errret
6273	pathoswith	1030	push [ebp+NTFS.attr_iBaseRecord]
		1031	push [ebp+NTFS.attr_offs]
		1032	push [ebp+NTFS.attr_list]
		1033	push dword [ebp+NTFS.attr_size+4]
		1034	push dword [ebp+NTFS.attr_size]
		1035	push [ebp+NTFS.cur_iRecord]
		1036	push [ebp+NTFS.cur_attr]
		1037	push [ebp+NTFS.cur_offs]
		1038	push [ebp+NTFS.cur_size]
		1039	push [ebp+NTFS.cur_buf]
		1040	push [ebp+NTFS.cur_read]
		1041	mov [ebp+NTFS.cur_attr], 0x80 ; $DATA
		1042	and [ebp+NTFS.cur_iRecord], 0 ; $Mft
		1043	mov [ebp+NTFS.cur_offs], eax
2288	clevermous	1044	shr ecx, 9
6273	pathoswith	1045	mov [ebp+NTFS.cur_size], ecx
3742	clevermous	1046	mov eax, [ebp+NTFS.frs_buffer]
6273	pathoswith	1047	mov [ebp+NTFS.cur_buf], eax
2288	clevermous	1048	call ntfs_read_attr
6273	pathoswith	1049	mov edx, [ebp+NTFS.cur_read]
		1050	pop [ebp+NTFS.cur_read]
		1051	pop [ebp+NTFS.cur_buf]
		1052	pop [ebp+NTFS.cur_size]
		1053	pop [ebp+NTFS.cur_offs]
		1054	pop [ebp+NTFS.cur_attr]
		1055	pop [ebp+NTFS.cur_iRecord]
		1056	pop dword [ebp+NTFS.attr_size]
		1057	pop dword [ebp+NTFS.attr_size+4]
		1058	pop [ebp+NTFS.attr_list]
		1059	pop [ebp+NTFS.attr_offs]
		1060	pop [ebp+NTFS.attr_iBaseRecord]
3742	clevermous	1061	jc .ret
		1062	cmp edx, [ebp+NTFS.frs_size]
2288	clevermous	1063	jnz .errret
6408	pathoswith	1064	mov eax, [ebp+NTFS.LastRead]
		1065	mov [ebp+NTFS.mftLastRead], eax
3742	clevermous	1066	mov eax, [ebp+NTFS.frs_buffer]
2288	clevermous	1067	cmp dword [eax], 'FILE'
		1068	jnz .errret
		1069	push ebx
		1070	mov ebx, eax
		1071	call ntfs_restore_usa_frs
		1072	pop ebx
3742	clevermous	1073	jc .errret
2288	clevermous	1074	.ret:
3742	clevermous	1075	pop edx ecx
2288	clevermous	1076	ret
6297	pathoswith	1077
3742	clevermous	1078	.errret:
2288	clevermous	1079	pop edx ecx
		1080	xor eax, eax
3742	clevermous	1081	stc
2288	clevermous	1082	ret
		1083
		1084	ntfs_restore_usa_frs:
3742	clevermous	1085	mov eax, [ebp+NTFS.frs_size]
2288	clevermous	1086	ntfs_restore_usa:
6080	pathoswith	1087	; in:
		1088	; ebx -> record
		1089	; eax = size in bytes
2288	clevermous	1090	pushad
		1091	shr eax, 9
		1092	mov ecx, eax
		1093	inc eax
6297	pathoswith	1094	cmp [ebx+updateSequenceSize], ax
2288	clevermous	1095	jnz .err
6297	pathoswith	1096	movzx eax, word [ebx+updateSequenceOffset]
2288	clevermous	1097	lea esi, [eax+ebx]
		1098	lodsw
		1099	mov edx, eax
		1100	lea edi, [ebx+0x1FE]
		1101	@@:
		1102	cmp [edi], dx
		1103	jnz .err
		1104	lodsw
		1105	stosw
		1106	add edi, 0x1FE
		1107	loop @b
		1108	popad
		1109	clc
		1110	ret
6297	pathoswith	1111
2288	clevermous	1112	.err:
		1113	popad
		1114	stc
		1115	ret
		1116
		1117	ntfs_decode_mcb_entry:
6019	pathoswith	1118	; in:
6080	pathoswith	1119	; esi -> MCB entry
6019	pathoswith	1120	; esp -> buffer (16 bytes)
		1121	; out:
6080	pathoswith	1122	; esi -> next MCB entry
6019	pathoswith	1123	; esp -> data run size
		1124	; esp+8 -> cluster (delta)
6080	pathoswith	1125	; CF=0 -> MCB end
2288	clevermous	1126	push eax ecx edi
		1127	lea edi, [esp+16]
		1128	xor eax, eax
		1129	lodsb
		1130	test al, al
		1131	jz .end
		1132	mov ecx, eax
		1133	and ecx, 0xF
		1134	cmp ecx, 8
		1135	ja .end
		1136	push ecx
		1137	rep movsb
		1138	pop ecx
		1139	sub ecx, 8
		1140	neg ecx
		1141	cmp byte [esi-1], 80h
		1142	jae .end
		1143	push eax
		1144	xor eax, eax
		1145	rep stosb
		1146	pop ecx
		1147	shr ecx, 4
		1148	cmp ecx, 8
		1149	ja .end
		1150	push ecx
		1151	rep movsb
		1152	pop ecx
		1153	sub ecx, 8
		1154	neg ecx
		1155	cmp byte [esi-1], 80h
		1156	cmc
		1157	sbb eax, eax
		1158	rep stosb
		1159	stc
		1160	.end:
		1161	pop edi ecx eax
		1162	ret
		1163
		1164	ntfs_find_lfn:
6471	pathoswith	1165	; in: esi -> path string in UTF-8
5954	pathoswith	1166	; out:
6405	pathoswith	1167	; [ebp+NTFS.cur_iRecord] = target fileRecord
6411	pathoswith	1168	; eax -> target index in the node
		1169	; [ebp+NTFS.LastRead] = target node location
6405	pathoswith	1170	; [ebp+NTFS.indexPointer] -> index, that points the target subnode
6411	pathoswith	1171	; [ebp+NTFS.nodeLastRead] = branch node location
6405	pathoswith	1172	; [ebp+NTFS.indexRoot] -> attribute
6411	pathoswith	1173	; [ebp+NTFS.rootLastRead] = directory fileRecord location
6405	pathoswith	1174	; [ebp+NTFS.cur_size] = index record size in sectors
		1175	; [ebp+NTFS.cur_subnode_size] = index record size in clusters or sectors
5994	pathoswith	1176	; CF=1 -> file not found, eax=0 -> error
6297	pathoswith	1177	mov [ebp+NTFS.cur_iRecord], 5 ; start from root directory
2288	clevermous	1178	.doit2:
6273	pathoswith	1179	mov [ebp+NTFS.cur_attr], 0x90 ; $INDEX_ROOT
		1180	and [ebp+NTFS.cur_offs], 0
3742	clevermous	1181	mov eax, [ebp+NTFS.cur_index_size]
6273	pathoswith	1182	mov [ebp+NTFS.cur_size], eax
3742	clevermous	1183	mov eax, [ebp+NTFS.cur_index_buf]
6273	pathoswith	1184	mov [ebp+NTFS.cur_buf], eax
2288	clevermous	1185	call ntfs_read_attr
5994	pathoswith	1186	mov eax, 0
6297	pathoswith	1187	jc .ret
6273	pathoswith	1188	cmp [ebp+NTFS.cur_read], 0x20
2288	clevermous	1189	jc .ret
6418	pathoswith	1190	push esi
2288	clevermous	1191	pushad
3742	clevermous	1192	mov esi, [ebp+NTFS.cur_index_buf]
6340	pathoswith	1193	mov eax, [esi+indexRecordSize]
		1194	shr eax, 9
		1195	cmp [ebp+NTFS.cur_index_size], eax
6297	pathoswith	1196	jc .realloc
6340	pathoswith	1197	mov [ebp+NTFS.cur_size], eax
		1198	mov al, [esi+indexRecordSizeClus]
		1199	mov [ebp+NTFS.cur_subnode_size], eax
6297	pathoswith	1200	add esi, rootNode
		1201	mov eax, [esi+nodeRealSize]
		1202	add eax, rootNode
6273	pathoswith	1203	cmp [ebp+NTFS.cur_read], eax
6297	pathoswith	1204	jc .err
6408	pathoswith	1205	mov eax, [ebp+NTFS.mftLastRead]
6340	pathoswith	1206	mov [ebp+NTFS.rootLastRead], eax
		1207	mov eax, [ebp+NTFS.attr_offs]
		1208	mov [ebp+NTFS.indexRoot], eax
6471	pathoswith	1209	.scanloop: ; esi -> current index node
6297	pathoswith	1210	add esi, [esi+indexOffset]
2288	clevermous	1211	.scanloopint:
6471	pathoswith	1212	push esi
6297	pathoswith	1213	test byte [esi+indexFlags], 2
2288	clevermous	1214	jnz .subnode
6297	pathoswith	1215	movzx ecx, byte [esi+fileNameLength]
6471	pathoswith	1216	lea edi, [esi+fileName]
		1217	mov esi, [esp+8]
2288	clevermous	1218	@@:
6471	pathoswith	1219	call utf8to16
		1220	cmp ax, '/'
		1221	jz .subnode
		1222	call utf16toUpper
2288	clevermous	1223	push eax
6471	pathoswith	1224	mov ax, [edi]
		1225	call utf16toUpper
		1226	cmp [esp], ax
2288	clevermous	1227	pop eax
6471	pathoswith	1228	jc .subnode
		1229	jnz .scanloopcont
		1230	add edi, 2
		1231	loop @b
		1232	call utf8to16
		1233	cmp ax, '/'
2288	clevermous	1234	jz .found
6471	pathoswith	1235	test ax, ax
		1236	jz .found
		1237	.scanloopcont:
2288	clevermous	1238	pop esi
6297	pathoswith	1239	movzx eax, word [esi+indexAllocatedSize]
2288	clevermous	1240	add esi, eax
		1241	jmp .scanloopint
6297	pathoswith	1242
		1243	.realloc:
6340	pathoswith	1244	mov edi, eax
		1245	mov eax, [esi+indexRecordSize]
		1246	shl eax, 1
		1247	stdcall kernel_alloc, eax
6297	pathoswith	1248	test eax, eax
		1249	jz .err
6405	pathoswith	1250	mov edx, [ebp+NTFS.cur_index_buf]
		1251	cmp edx, [ebp+NTFS.secondIndexBuffer]
		1252	jc @f
		1253	mov edx, [ebp+NTFS.secondIndexBuffer]
		1254	@@:
6297	pathoswith	1255	mov [ebp+NTFS.cur_index_buf], eax
6340	pathoswith	1256	add eax, [esi+indexRecordSize]
		1257	mov [ebp+NTFS.secondIndexBuffer], eax
		1258	mov [ebp+NTFS.cur_index_size], edi
6405	pathoswith	1259	stdcall kernel_free, edx
6297	pathoswith	1260	popad
6418	pathoswith	1261	pop eax
6297	pathoswith	1262	jmp .doit2
		1263
		1264	.notfound:
6471	pathoswith	1265	mov [esp+28], esi
6297	pathoswith	1266	.err:
		1267	popad
		1268	stc
6418	pathoswith	1269	.ret2:
		1270	pop esi
6297	pathoswith	1271	.ret:
6468	pathoswith	1272	ret
6297	pathoswith	1273
6471	pathoswith	1274	.subnode:
2288	clevermous	1275	pop esi
6297	pathoswith	1276	test byte [esi+indexFlags], 1
2288	clevermous	1277	jz .notfound
6411	pathoswith	1278	mov eax, [ebp+NTFS.LastRead]
		1279	mov [ebp+NTFS.nodeLastRead], eax
		1280	mov [ebp+NTFS.indexPointer], esi
6297	pathoswith	1281	movzx eax, word [esi+indexAllocatedSize]
2288	clevermous	1282	mov eax, [esi+eax-8]
6340	pathoswith	1283	mov edx, [ebp+NTFS.cur_size]
		1284	push edx
		1285	cmp edx, [ebp+NTFS.cur_subnode_size]
		1286	jz @f
		1287	mul [ebp+NTFS.sectors_per_cluster]
		1288	@@:
		1289	mov esi, [ebp+NTFS.cur_index_buf]
		1290	xchg [ebp+NTFS.secondIndexBuffer], esi
		1291	mov [ebp+NTFS.cur_index_buf], esi
		1292	mov [ebp+NTFS.cur_buf], esi
		1293	mov [ebp+NTFS.cur_attr], 0xA0 ; $INDEX_ALLOCATION
6273	pathoswith	1294	mov [ebp+NTFS.cur_offs], eax
6297	pathoswith	1295	call ntfs_read_attr.newAttribute
6340	pathoswith	1296	pop eax
		1297	mov [ebp+NTFS.cur_size], eax
2288	clevermous	1298	shl eax, 9
6273	pathoswith	1299	cmp [ebp+NTFS.cur_read], eax
5954	pathoswith	1300	jnz .err
2288	clevermous	1301	cmp dword [esi], 'INDX'
5954	pathoswith	1302	jnz .err
2288	clevermous	1303	mov ebx, esi
		1304	call ntfs_restore_usa
5954	pathoswith	1305	jc .err
6297	pathoswith	1306	add esi, recordNode
2288	clevermous	1307	jmp .scanloop
6297	pathoswith	1308
2288	clevermous	1309	.found:
6471	pathoswith	1310	mov [esp+8], esi
		1311	pop eax
		1312	mov [esp+28], eax
		1313	mov eax, [eax+fileRecordReference]
6273	pathoswith	1314	mov [ebp+NTFS.cur_iRecord], eax
2288	clevermous	1315	popad
6471	pathoswith	1316	cmp byte [esi-1], 0
6468	pathoswith	1317	jz .ret2
6418	pathoswith	1318	pop eax
2288	clevermous	1319	jmp .doit2
		1320
		1321	;----------------------------------------------------------------
5954	pathoswith	1322	ntfs_ReadFile:
3742	clevermous	1323	call ntfs_lock
6468	pathoswith	1324	call ntfs_find_lfn
6845	pathoswith	1325	jc ntfsNotFound
6273	pathoswith	1326	mov [ebp+NTFS.cur_attr], 0x80 ; $DATA
		1327	and [ebp+NTFS.cur_offs], 0
		1328	and [ebp+NTFS.cur_size], 0
2288	clevermous	1329	call ntfs_read_attr
6845	pathoswith	1330	jc ntfsDenied
2288	clevermous	1331	xor eax, eax
6845	pathoswith	1332	push eax
3742	clevermous	1333	cmp dword [ebx+8], 0x200
6845	pathoswith	1334	jnc .eof
3742	clevermous	1335	mov ecx, [ebx+12]
		1336	mov edx, [ebx+16]
		1337	mov eax, [ebx+4]
2288	clevermous	1338	test eax, 0x1FF
		1339	jz .alignedstart
		1340	push edx
3742	clevermous	1341	mov edx, [ebx+8]
2288	clevermous	1342	shrd eax, edx, 9
1400	turbanoff	1343	pop edx
6273	pathoswith	1344	mov [ebp+NTFS.cur_offs], eax
		1345	mov [ebp+NTFS.cur_size], 1
		1346	lea eax, [ebp+NTFS.bitmap_buf]
		1347	mov [ebp+NTFS.cur_buf], eax
2288	clevermous	1348	call ntfs_read_attr.continue
3742	clevermous	1349	mov eax, [ebx+4]
2288	clevermous	1350	and eax, 0x1FF
6273	pathoswith	1351	lea esi, [ebp+NTFS.bitmap_buf+eax]
		1352	sub eax, [ebp+NTFS.cur_read]
6845	pathoswith	1353	jae .eof
2288	clevermous	1354	neg eax
		1355	push ecx
		1356	cmp ecx, eax
		1357	jb @f
		1358	mov ecx, eax
		1359	@@:
6845	pathoswith	1360	mov [esp+4], ecx
2288	clevermous	1361	mov edi, edx
		1362	rep movsb
		1363	mov edx, edi
		1364	pop ecx
6845	pathoswith	1365	sub ecx, [esp]
		1366	jz .retok
6273	pathoswith	1367	cmp [ebp+NTFS.cur_read], 0x200
6845	pathoswith	1368	jnz .eof
2288	clevermous	1369	.alignedstart:
3742	clevermous	1370	mov eax, [ebx+4]
2288	clevermous	1371	push edx
3742	clevermous	1372	mov edx, [ebx+8]
2288	clevermous	1373	add eax, 511
		1374	adc edx, 0
		1375	shrd eax, edx, 9
		1376	pop edx
6273	pathoswith	1377	mov [ebp+NTFS.cur_offs], eax
		1378	mov [ebp+NTFS.cur_buf], edx
2288	clevermous	1379	mov eax, ecx
		1380	shr eax, 9
6273	pathoswith	1381	mov [ebp+NTFS.cur_size], eax
		1382	add eax, [ebp+NTFS.cur_offs]
2288	clevermous	1383	push eax
		1384	call ntfs_read_attr.continue
6273	pathoswith	1385	pop [ebp+NTFS.cur_offs]
		1386	mov eax, [ebp+NTFS.cur_read]
6845	pathoswith	1387	add [esp], eax
2288	clevermous	1388	mov eax, ecx
		1389	and eax, not 0x1FF
6273	pathoswith	1390	cmp [ebp+NTFS.cur_read], eax
6845	pathoswith	1391	jnz .eof
2288	clevermous	1392	and ecx, 0x1FF
		1393	jz .retok
6273	pathoswith	1394	add edx, [ebp+NTFS.cur_read]
		1395	mov [ebp+NTFS.cur_size], 1
		1396	lea eax, [ebp+NTFS.bitmap_buf]
		1397	mov [ebp+NTFS.cur_buf], eax
2288	clevermous	1398	call ntfs_read_attr.continue
6273	pathoswith	1399	cmp [ebp+NTFS.cur_read], ecx
2288	clevermous	1400	jb @f
6273	pathoswith	1401	mov [ebp+NTFS.cur_read], ecx
2288	clevermous	1402	@@:
6273	pathoswith	1403	xchg ecx, [ebp+NTFS.cur_read]
2288	clevermous	1404	push ecx
		1405	mov edi, edx
6273	pathoswith	1406	lea esi, [ebp+NTFS.bitmap_buf]
6845	pathoswith	1407	add [esp+4], ecx
2288	clevermous	1408	rep movsb
		1409	pop ecx
6273	pathoswith	1410	cmp ecx, [ebp+NTFS.cur_read]
6845	pathoswith	1411	jnz .eof
		1412	.retok:
		1413	pushd 0
		1414	.ret:
3742	clevermous	1415	call ntfs_unlock
6845	pathoswith	1416	pop eax ebx
2288	clevermous	1417	ret
1400	turbanoff	1418
6845	pathoswith	1419	.eof:
		1420	push ERROR_END_OF_FILE
		1421	jmp .ret
		1422
2288	clevermous	1423	;----------------------------------------------------------------
3742	clevermous	1424	ntfs_ReadFolder:
		1425	call ntfs_lock
6297	pathoswith	1426	mov [ebp+NTFS.cur_iRecord], 5 ; root directory
2288	clevermous	1427	cmp byte [esi], 0
6297	pathoswith	1428	jz @f
6468	pathoswith	1429	call ntfs_find_lfn
6297	pathoswith	1430	jc ntfsNotFound
		1431	@@:
6273	pathoswith	1432	mov [ebp+NTFS.cur_attr], 0x10 ; $STANDARD_INFORMATION
		1433	and [ebp+NTFS.cur_offs], 0
		1434	mov [ebp+NTFS.cur_size], 1
		1435	lea eax, [ebp+NTFS.bitmap_buf]
		1436	mov [ebp+NTFS.cur_buf], eax
2288	clevermous	1437	call ntfs_read_attr
6297	pathoswith	1438	jc ntfsFail
6273	pathoswith	1439	mov [ebp+NTFS.cur_attr], 0x90 ; $INDEX_ROOT
6297	pathoswith	1440	.doit:
3742	clevermous	1441	mov eax, [ebp+NTFS.cur_index_size]
6273	pathoswith	1442	mov [ebp+NTFS.cur_size], eax
3742	clevermous	1443	mov eax, [ebp+NTFS.cur_index_buf]
6273	pathoswith	1444	mov [ebp+NTFS.cur_buf], eax
6297	pathoswith	1445	call ntfs_read_attr.newAttribute
		1446	jc ntfsFail
6273	pathoswith	1447	cmp [ebp+NTFS.cur_read], 0x20
6297	pathoswith	1448	jc ntfsFail
3742	clevermous	1449	mov esi, [ebp+NTFS.cur_index_buf]
6340	pathoswith	1450	mov eax, [esi+indexRecordSize]
		1451	shr eax, 9
		1452	cmp [ebp+NTFS.cur_index_size], eax
6297	pathoswith	1453	jc .realloc
6340	pathoswith	1454	mov [ebp+NTFS.cur_subnode_size], eax
6297	pathoswith	1455	add esi, rootNode
		1456	mov eax, [esi+nodeRealSize]
		1457	add eax, rootNode
		1458	cmp [ebp+NTFS.cur_read], eax
6408	pathoswith	1459	jc ntfsFail
		1460	mov edi, [ebx+16]
		1461	mov ecx, [ebx+12]
		1462	pushd [ebx]
		1463	pushd [ebx+8] ; read ANSI/UNICODE name
		1464	push edi
		1465	mov edx, esp
		1466	mov ebx, [ebx+4]
2288	clevermous	1467	; init header
		1468	xor eax, eax
6408	pathoswith	1469	mov [edi+8], eax
		1470	mov [edi+4], eax
		1471	inc eax
		1472	mov [edi], eax ; version
		1473	add edi, 32
3742	clevermous	1474	; edi -> BDFE, esi -> current index data, ebx = first wanted block,
2288	clevermous	1475	; ecx = number of blocks to read
		1476	; edx -> parameters block: dd , dd
6273	pathoswith	1477	cmp [ebp+NTFS.cur_iRecord], 5
2288	clevermous	1478	jz .skip_specials
		1479	; dot and dotdot entries
		1480	push esi
		1481	xor esi, esi
		1482	call .add_special_entry
		1483	inc esi
		1484	call .add_special_entry
		1485	pop esi
		1486	.skip_specials:
		1487	; at first, dump index root
6297	pathoswith	1488	add esi, [esi+indexOffset]
2288	clevermous	1489	.dump_root:
6297	pathoswith	1490	test byte [esi+indexFlags], 2
2288	clevermous	1491	jnz .dump_root_done
		1492	call .add_entry
6297	pathoswith	1493	movzx eax, word [esi+indexAllocatedSize]
2288	clevermous	1494	add esi, eax
		1495	jmp .dump_root
6297	pathoswith	1496
		1497	.realloc:
6340	pathoswith	1498	mov edi, eax
		1499	mov eax, [esi+indexRecordSize]
		1500	shl eax, 1
		1501	stdcall kernel_alloc, eax
6297	pathoswith	1502	test eax, eax
6408	pathoswith	1503	jz ntfsFail
6405	pathoswith	1504	mov edx, [ebp+NTFS.cur_index_buf]
		1505	cmp edx, [ebp+NTFS.secondIndexBuffer]
		1506	jc @f
		1507	mov edx, [ebp+NTFS.secondIndexBuffer]
		1508	@@:
6297	pathoswith	1509	mov [ebp+NTFS.cur_index_buf], eax
6340	pathoswith	1510	add eax, [esi+indexRecordSize]
		1511	mov [ebp+NTFS.secondIndexBuffer], eax
		1512	mov [ebp+NTFS.cur_index_size], edi
6405	pathoswith	1513	stdcall kernel_free, edx
6297	pathoswith	1514	jmp .doit
		1515
2288	clevermous	1516	.dump_root_done:
		1517	; now dump all subnodes
		1518	push ecx edi
6273	pathoswith	1519	lea edi, [ebp+NTFS.bitmap_buf]
		1520	mov [ebp+NTFS.cur_buf], edi
2288	clevermous	1521	mov ecx, 0x400/4
		1522	xor eax, eax
		1523	rep stosd
6273	pathoswith	1524	mov [ebp+NTFS.cur_attr], 0xB0 ; $BITMAP
		1525	and [ebp+NTFS.cur_offs], 0
		1526	mov [ebp+NTFS.cur_size], 2
6297	pathoswith	1527	call ntfs_read_attr.newAttribute
2288	clevermous	1528	pop edi ecx
		1529	push 0 ; save offset in $BITMAP attribute
6273	pathoswith	1530	and [ebp+NTFS.cur_offs], 0
2288	clevermous	1531	.dumploop:
6273	pathoswith	1532	mov [ebp+NTFS.cur_attr], 0xA0
3742	clevermous	1533	mov eax, [ebp+NTFS.cur_subnode_size]
6273	pathoswith	1534	mov [ebp+NTFS.cur_size], eax
6297	pathoswith	1535	mov esi, [ebp+NTFS.cur_index_buf]
		1536	mov [ebp+NTFS.cur_buf], esi
6273	pathoswith	1537	mov eax, [ebp+NTFS.cur_offs]
6297	pathoswith	1538	push eax
3742	clevermous	1539	imul eax, [ebp+NTFS.cur_subnode_size]
6273	pathoswith	1540	mov [ebp+NTFS.cur_offs], eax
6297	pathoswith	1541	call ntfs_read_attr.newAttribute
6273	pathoswith	1542	pop [ebp+NTFS.cur_offs]
3742	clevermous	1543	mov eax, [ebp+NTFS.cur_subnode_size]
2288	clevermous	1544	shl eax, 9
6273	pathoswith	1545	cmp [ebp+NTFS.cur_read], eax
2288	clevermous	1546	jnz .done
		1547	push eax
6273	pathoswith	1548	mov eax, [ebp+NTFS.cur_offs]
2288	clevermous	1549	and eax, 0x400*8-1
6273	pathoswith	1550	bt dword [ebp+NTFS.bitmap_buf], eax
2288	clevermous	1551	pop eax
		1552	jnc .dump_subnode_done
		1553	cmp dword [esi], 'INDX'
		1554	jnz .dump_subnode_done
		1555	push ebx
		1556	mov ebx, esi
		1557	call ntfs_restore_usa
		1558	pop ebx
		1559	jc .dump_subnode_done
6297	pathoswith	1560	add esi, recordNode
		1561	add esi, [esi+indexOffset]
2288	clevermous	1562	.dump_subnode:
6297	pathoswith	1563	test byte [esi+indexFlags], 2
2288	clevermous	1564	jnz .dump_subnode_done
		1565	call .add_entry
6297	pathoswith	1566	movzx eax, word [esi+indexAllocatedSize]
2288	clevermous	1567	add esi, eax
		1568	jmp .dump_subnode
6297	pathoswith	1569
2288	clevermous	1570	.dump_subnode_done:
6273	pathoswith	1571	inc [ebp+NTFS.cur_offs]
		1572	test [ebp+NTFS.cur_offs], 0x400*8-1
2288	clevermous	1573	jnz .dumploop
6273	pathoswith	1574	mov [ebp+NTFS.cur_attr], 0xB0
2288	clevermous	1575	push ecx edi
6273	pathoswith	1576	lea edi, [ebp+NTFS.bitmap_buf]
		1577	mov [ebp+NTFS.cur_buf], edi
2288	clevermous	1578	mov ecx, 0x400/4
		1579	xor eax, eax
		1580	rep stosd
		1581	pop edi ecx
		1582	pop eax
6273	pathoswith	1583	push [ebp+NTFS.cur_offs]
2288	clevermous	1584	inc eax
6273	pathoswith	1585	mov [ebp+NTFS.cur_offs], eax
		1586	mov [ebp+NTFS.cur_size], 2
2288	clevermous	1587	push eax
6297	pathoswith	1588	call ntfs_read_attr.newAttribute
2288	clevermous	1589	pop eax
6273	pathoswith	1590	pop [ebp+NTFS.cur_offs]
2288	clevermous	1591	push eax
		1592	jmp .dumploop
6297	pathoswith	1593
2288	clevermous	1594	.done:
		1595	pop eax
6408	pathoswith	1596	pop eax
		1597	mov ebx, [eax+4]
		1598	pop eax
		1599	pop eax
		1600	test eax, eax
		1601	jz .ret
2288	clevermous	1602	xor eax, eax
		1603	dec ecx
		1604	js @f
		1605	mov al, ERROR_END_OF_FILE
		1606	@@:
6408	pathoswith	1607	push eax
3742	clevermous	1608	call ntfs_unlock
6408	pathoswith	1609	pop eax
2288	clevermous	1610	ret
		1611
		1612	.add_special_entry:
		1613	mov eax, [edx]
		1614	inc dword [eax+8] ; new file found
		1615	dec ebx
		1616	jns .ret
		1617	dec ecx
		1618	js .ret
		1619	inc dword [eax+4] ; new file block copied
		1620	mov eax, [edx+4]
		1621	mov [edi+4], eax
		1622	mov eax, 0x10
		1623	stosd
		1624	scasd
6462	pathoswith	1625	push ebx ecx edx
6273	pathoswith	1626	mov eax, dword [ebp+NTFS.bitmap_buf]
		1627	mov edx, dword [ebp+NTFS.bitmap_buf+4]
2288	clevermous	1628	call ntfs_datetime_to_bdfe
6273	pathoswith	1629	mov eax, dword [ebp+NTFS.bitmap_buf+0x18]
		1630	mov edx, dword [ebp+NTFS.bitmap_buf+0x1C]
2288	clevermous	1631	call ntfs_datetime_to_bdfe
6273	pathoswith	1632	mov eax, dword [ebp+NTFS.bitmap_buf+8]
		1633	mov edx, dword [ebp+NTFS.bitmap_buf+0xC]
2288	clevermous	1634	call ntfs_datetime_to_bdfe
6462	pathoswith	1635	pop edx ecx ebx
2288	clevermous	1636	xor eax, eax
		1637	stosd
		1638	stosd
		1639	mov al, '.'
		1640	push edi ecx
		1641	lea ecx, [esi+1]
6798	pathoswith	1642	cmp dword[edi-36], 2
		1643	jz .utf16sp
		1644	rep stosb
		1645	mov byte [edi], 0
		1646	pop ecx edi
		1647	cmp dword[edi-36], 3
2288	clevermous	1648	jz @f
6798	pathoswith	1649	add edi, 264
2288	clevermous	1650	ret
6297	pathoswith	1651
6798	pathoswith	1652	.utf16sp:
		1653	rep stosw
		1654	mov word [edi], 0
		1655	pop ecx edi
2288	clevermous	1656	@@:
6798	pathoswith	1657	add edi, 520
2288	clevermous	1658	.ret:
		1659	ret
		1660
		1661	.add_entry:
		1662	; do not return DOS 8.3 names
6297	pathoswith	1663	cmp byte [esi+namespace], 2
2288	clevermous	1664	jz .ret
		1665	; do not return system files
6798	pathoswith	1666	cmp dword[esi+fileRecordReference], 16
2288	clevermous	1667	jb .ret
6798	pathoswith	1668	cmp byte [esi+fileNameLength], 0
		1669	jz .ret
2288	clevermous	1670	mov eax, [edx]
		1671	inc dword [eax+8] ; new file found
		1672	dec ebx
		1673	jns .ret
		1674	dec ecx
		1675	js .ret
		1676	inc dword [eax+4] ; new file block copied
		1677	mov eax, [edx+4] ; flags
		1678	call ntfs_direntry_to_bdfe
		1679	push ecx esi edi
6297	pathoswith	1680	movzx ecx, byte [esi+fileNameLength]
		1681	add esi, fileName
6798	pathoswith	1682	cmp dword[edi-36], 2
		1683	jz .utf16
		1684	cmp dword[edi-36], 3
		1685	jz .utf8
2288	clevermous	1686	@@:
		1687	lodsw
		1688	call uni2ansi_char
		1689	stosb
		1690	loop @b
6798	pathoswith	1691	mov byte [edi], 0
		1692	pop edi esi ecx
2288	clevermous	1693	add edi, 264
		1694	ret
		1695
6798	pathoswith	1696	.utf8:
		1697	push ecx
		1698	mov cx, 519
		1699	@@:
		1700	lodsw
		1701	call UTF16to8
		1702	js @f
		1703	dec dword[esp]
		1704	jnz @b
		1705	@@:
		1706	mov byte [edi], 0
		1707	pop edi
		1708	@@:
		1709	pop edi esi ecx
		1710	add edi, 520
		1711	ret
		1712
		1713	.utf16:
		1714	rep movsw
		1715	mov word [edi], 0
		1716	jmp @b
		1717
2288	clevermous	1718	ntfs_direntry_to_bdfe:
		1719	mov [edi+4], eax ; ANSI/UNICODE name
6297	pathoswith	1720	mov eax, [esi+fileFlags]
2288	clevermous	1721	test eax, 0x10000000
		1722	jz @f
		1723	and eax, not 0x10000000
		1724	or al, 0x10
		1725	@@:
		1726	stosd
		1727	scasd
6462	pathoswith	1728	push ebx ecx edx
6297	pathoswith	1729	mov eax, [esi+fileCreated]
		1730	mov edx, [esi+fileCreated+4]
2288	clevermous	1731	call ntfs_datetime_to_bdfe
6297	pathoswith	1732	mov eax, [esi+fileAccessed]
		1733	mov edx, [esi+fileAccessed+4]
2288	clevermous	1734	call ntfs_datetime_to_bdfe
6297	pathoswith	1735	mov eax, [esi+fileModified]
		1736	mov edx, [esi+fileModified+4]
2288	clevermous	1737	call ntfs_datetime_to_bdfe
6462	pathoswith	1738	pop edx ecx ebx
6297	pathoswith	1739	mov eax, [esi+fileRealSize]
2288	clevermous	1740	stosd
6297	pathoswith	1741	mov eax, [esi+fileRealSize+4]
2288	clevermous	1742	stosd
		1743	ret
		1744
		1745	ntfs_datetime_to_bdfe:
6462	pathoswith	1746	; in: edx:eax = seconds since 01.01.1601 x10000000
		1747	; edi -> data block
		1748	; out: edi = edi+8
		1749	sub eax, 3365781504
		1750	sbb edx, 29389701
6297	pathoswith	1751	mov ecx, 10000000
6462	pathoswith	1752	cmp edx, ecx
		1753	jc @f
2288	clevermous	1754	xor edx, edx
6462	pathoswith	1755	@@:
6297	pathoswith	1756	div ecx
6462	pathoswith	1757	jmp fsTime2bdfe
2288	clevermous	1758
		1759	;----------------------------------------------------------------
6420	pathoswith	1760	ntfs_GetFileInfo:
6426	pathoswith	1761	mov edi, [ebx+16]
6420	pathoswith	1762	cmp byte [esi], 0
6426	pathoswith	1763	jz .volume
6876	pathoswith	1764	call ntfs_lock
6468	pathoswith	1765	call ntfs_find_lfn
6420	pathoswith	1766	jnc .found
		1767	test eax, eax
		1768	jz ntfsFail
		1769	jmp ntfsNotFound
		1770
		1771	.found:
		1772	mov esi, eax
		1773	xor eax, eax
		1774	call ntfs_direntry_to_bdfe
6426	pathoswith	1775	.end:
6420	pathoswith	1776	call ntfs_unlock
		1777	xor eax, eax
6876	pathoswith	1778	@@:
6420	pathoswith	1779	ret
		1780
6426	pathoswith	1781	.volume:
		1782	mov eax, dword [ebp+NTFS.Length]
		1783	mov edx, dword [ebp+NTFS.Length+4]
		1784	shld edx, eax, 9
		1785	shl eax, 9
		1786	mov [edi+36], edx
		1787	mov [edi+32], eax
6876	pathoswith	1788	mov eax, [ebx+8]
		1789	mov byte [edi], 8
		1790	mov [edi+4], eax
		1791	test eax, eax
		1792	jz @b
		1793	call ntfs_lock
6426	pathoswith	1794	add edi, 40
		1795	mov [ebp+NTFS.cur_buf], edi
		1796	mov [ebp+NTFS.cur_iRecord], 3
		1797	mov [ebp+NTFS.cur_attr], 0x60
		1798	mov [ebp+NTFS.cur_offs], 0
		1799	mov [ebp+NTFS.cur_size], 1
		1800	call ntfs_read_attr
		1801	jc ntfsFail
		1802	mov ecx, [ebp+NTFS.cur_read]
		1803	mov [edi+ecx], ax
6869	pathoswith	1804	cmp byte [ebx+8], 2
		1805	jz .end
6426	pathoswith	1806	shr ecx, 1
6428	pathoswith	1807	jz .end
6869	pathoswith	1808	mov esi, edi
		1809	cmp byte [ebx+8], 3
		1810	jnz @f
		1811	shl ecx, 1
		1812	call UTF16to8_string
		1813	mov byte [edi], 0
		1814	jmp .end
		1815
6426	pathoswith	1816	@@:
		1817	lodsw
		1818	call uni2ansi_char
		1819	stosb
6471	pathoswith	1820	loop @b
6426	pathoswith	1821	mov byte [edi], 0
		1822	jmp .end
		1823
6420	pathoswith	1824	;----------------------------------------------------------------
3742	clevermous	1825	ntfs_CreateFolder:
6273	pathoswith	1826	mov [ebp+NTFS.bFolder], 1
5954	pathoswith	1827	jmp @f
5994	pathoswith	1828
5954	pathoswith	1829	ntfs_CreateFile:
6273	pathoswith	1830	mov [ebp+NTFS.bFolder], 0
5954	pathoswith	1831	@@: ; 1. Search file
		1832	call ntfs_lock
6468	pathoswith	1833	call ntfs_find_lfn
6080	pathoswith	1834	jc .notFound
		1835	; found, rewrite
6273	pathoswith	1836	cmp [ebp+NTFS.cur_iRecord], 16
6019	pathoswith	1837	jc ntfsDenied
6273	pathoswith	1838	cmp [ebp+NTFS.bFolder], 1
6080	pathoswith	1839	jz .folder
6420	pathoswith	1840	test byte [eax+fileFlags], 1
		1841	jnz ntfsDenied
6273	pathoswith	1842	cmp [ebp+NTFS.fragmentCount], 1
6080	pathoswith	1843	jnz ntfsUnsupported ; record fragmented
6151	pathoswith	1844	; edit directory node
6080	pathoswith	1845	mov edi, [ebp+NTFS.cur_index_buf]
		1846	cmp dword [edi], 'INDX'
		1847	jz @f
		1848	mov esi, [ebp+NTFS.frs_buffer]
		1849	mov ecx, [esi+recordRealSize]
		1850	shr ecx, 2
		1851	rep movsd
6273	pathoswith	1852	mov esi, [ebp+NTFS.attr_offs]
6080	pathoswith	1853	mov cl, [esi+attributeOffset]
		1854	sub esi, [ebp+NTFS.frs_buffer]
		1855	add eax, ecx
		1856	add eax, esi
		1857	@@:
6420	pathoswith	1858	mov edi, eax
		1859	mov eax, [ebx+12]
		1860	mov [edi+fileRealSize], eax
		1861	mov dword [edi+fileRealSize+4], 0
		1862	push ebx eax
		1863	call ntfsGetTime
		1864	mov [edi+fileModified], eax
		1865	mov [edi+fileModified+4], edx
		1866	mov [edi+recordModified], eax
		1867	mov [edi+recordModified+4], edx
		1868	mov [edi+fileAccessed], eax
		1869	mov [edi+fileAccessed+4], edx
		1870	pop edx ebx
6273	pathoswith	1871	mov eax, [ebp+NTFS.LastRead]
6080	pathoswith	1872	mov [ebp+NTFS.nodeLastRead], eax
6273	pathoswith	1873	mov [ebp+NTFS.cur_attr], 0x80
		1874	mov [ebp+NTFS.cur_offs], 0
		1875	mov [ebp+NTFS.cur_size], 0
5994	pathoswith	1876	call ntfs_read_attr
6080	pathoswith	1877	jc ntfsFail
6420	pathoswith	1878	mov esi, edi
		1879	mov edi, [ebp+NTFS.frs_buffer]
		1880	cmp word [edi+baseRecordReuse], 0
		1881	jnz ntfsUnsupported ; auxiliary record
		1882	mov al, [edi+attributeOffset]
		1883	add edi, eax
		1884	mov al, [edi+attributeOffset]
		1885	add edi, eax
		1886	mov ecx, 6
		1887	add esi, fileModified
		1888	add edi, 8
		1889	rep movsd
6080	pathoswith	1890	mov eax, edx
		1891	xor edx, edx
6273	pathoswith	1892	mov ecx, [ebp+NTFS.attr_offs]
6151	pathoswith	1893	cmp word [ecx+attributeFlags], 0
		1894	jnz ntfsUnsupported
		1895	push ebx
		1896	cmp byte [ecx+nonResidentFlag], 0
		1897	jz @f
6080	pathoswith	1898	cmp [ecx+attributeRealSize+4], edx
		1899	jnz @f
5994	pathoswith	1900	cmp [ecx+attributeRealSize], eax
6080	pathoswith	1901	jz ntfs_WriteFile.writeNode
		1902	@@:
		1903	jmp ntfs_WriteFile.resizeAttribute
5994	pathoswith	1904
6080	pathoswith	1905	.folder:
		1906	bt dword [eax+fileFlags], 28
		1907	jnc ntfsDenied
		1908	push 0
		1909	jmp ntfsOut
		1910
		1911	.notFound: ; create
		1912	test eax, eax
		1913	jz ntfsFail
6273	pathoswith	1914	cmp [ebp+NTFS.fragmentCount], 1
6080	pathoswith	1915	jnz ntfsUnsupported ; record fragmented
6019	pathoswith	1916	; 2. Prepare directory record
6471	pathoswith	1917	mov edi, esi
		1918	mov edx, eax
		1919	xor ecx, ecx
5954	pathoswith	1920	@@: ; count characters
6471	pathoswith	1921	call utf8to16
		1922	cmp ax, '/'
		1923	jz ntfsNotFound ; path folder not found
5954	pathoswith	1924	inc ecx
6471	pathoswith	1925	test ax, ax
5954	pathoswith	1926	jnz @b
6471	pathoswith	1927	dec ecx
		1928	push ecx ; name length in chars
		1929	push edi
6297	pathoswith	1930	shl ecx, 1
		1931	add ecx, fileName+7
		1932	and ecx, not 7
5954	pathoswith	1933	mov edi, [ebp+NTFS.cur_index_buf]
6471	pathoswith	1934	mov eax, [ebx+12]
		1935	mov [ebp+NTFS.fileRealSize], eax
		1936	mov eax, [ebx+16]
		1937	mov [ebp+NTFS.fileDataBuffer], eax
6297	pathoswith	1938	push ecx ; index length
6471	pathoswith	1939	mov eax, edx
6292	pathoswith	1940	mov edx, ecx
6019	pathoswith	1941	cmp dword [edi], 'INDX'
5954	pathoswith	1942	jz .indexRecord
6019	pathoswith	1943	mov esi, [ebp+NTFS.frs_buffer] ; indexRoot
6292	pathoswith	1944	mov ecx, [esi+recordRealSize]
5954	pathoswith	1945	add edx, ecx
		1946	cmp [esi+recordAllocatedSize], edx
6292	pathoswith	1947	jc .growTree
5954	pathoswith	1948	mov [esi+recordRealSize], edx
		1949	shr ecx, 2
		1950	rep movsd
6407	pathoswith	1951	mov edi, [ebp+NTFS.indexRoot]
5954	pathoswith	1952	sub edi, [ebp+NTFS.frs_buffer]
		1953	add edi, [ebp+NTFS.cur_index_buf]
		1954	mov esi, [esp]
		1955	add [edi+sizeWithHeader], esi
		1956	add [edi+sizeWithoutHeader], esi
6019	pathoswith	1957	mov cl, [edi+attributeOffset]
5954	pathoswith	1958	add edi, ecx
6273	pathoswith	1959	add [edi+rootNode+nodeRealSize], esi
		1960	add [edi+rootNode+nodeAllocatedSize], esi
5954	pathoswith	1961	sub eax, [ebp+NTFS.cur_index_buf]
		1962	add eax, edi
		1963	mov edi, [ebp+NTFS.cur_index_buf]
		1964	jmp .common
2288	clevermous	1965
6411	pathoswith	1966	.growTree: ; create indexRecord
		1967	mov edi, [ebp+NTFS.cur_index_buf]
6292	pathoswith	1968	mov ecx, 10
		1969	xor eax, eax
		1970	rep stosd
6407	pathoswith	1971	mov esi, [ebp+NTFS.indexRoot]
6340	pathoswith	1972	mov al, [esi+attributeOffset]
		1973	add esi, eax
6292	pathoswith	1974	rdtsc
		1975	stosw
		1976	mov eax, [esi+indexRecordSize]
		1977	cmp eax, [ebp+NTFS.frs_size]
6407	pathoswith	1978	jc .errorPop3
6292	pathoswith	1979	shr eax, 9
		1980	inc eax
		1981	mov edi, [ebp+NTFS.cur_index_buf]
		1982	mov dword[edi], 'INDX'
		1983	mov byte [edi+updateSequenceOffset], 28h
		1984	mov [edi+updateSequenceSize], al
		1985	add edi, recordNode
		1986	shl eax, 1
		1987	add eax, 28h-recordNode+7
		1988	and eax, not 7
		1989	mov [edi+indexOffset], eax
		1990	mov ecx, [esi+indexRecordSize]
		1991	sub ecx, recordNode
		1992	mov [edi+nodeAllocatedSize], ecx
		1993	add esi, rootNode
		1994	push esi
		1995	mov ecx, [esi+nodeRealSize]
		1996	sub ecx, [esi+indexOffset]
		1997	add eax, ecx
		1998	mov [edi+nodeRealSize], eax
6411	pathoswith	1999	mov eax, [esi+nonLeafFlag]
		2000	mov [edi+nonLeafFlag], eax
6292	pathoswith	2001	shr ecx, 2
		2002	add esi, [esi+indexOffset]
		2003	add edi, [edi+indexOffset]
		2004	rep movsd ; copy root indexes
		2005	; clear root node
		2006	mov cl, 10
		2007	mov edi, [esp]
		2008	xor eax, eax
		2009	rep stosd
		2010	pop edi
		2011	mov byte [edi+indexOffset], 16
		2012	mov byte [edi+nodeRealSize], 28h
		2013	mov byte [edi+nodeAllocatedSize], 28h
		2014	mov byte [edi+nonLeafFlag], 1
		2015	mov byte [edi+16+indexAllocatedSize], 18h
		2016	mov byte [edi+16+indexFlags], 3
6407	pathoswith	2017	mov esi, [ebp+NTFS.indexRoot]
6292	pathoswith	2018	add edi, 28h
		2019	mov eax, edi
		2020	sub eax, esi
		2021	mov word [esi+sizeWithoutHeader], 38h
		2022	xchg [esi+sizeWithHeader], eax
6407	pathoswith	2023	add esi, eax
		2024	mov [ebp+NTFS.attr_offs], edi
		2025	cmp byte [esi], 0xA0
		2026	jnz @f
		2027	cmp dword [esi+attributeAllocatedSize], 0
		2028	jz @f
		2029	mov eax, [ebp+NTFS.frs_buffer]
		2030	mov ecx, eax
		2031	add ecx, [eax+recordRealSize]
		2032	sub ecx, esi
		2033	shr ecx, 2
		2034	rep movsd
		2035	sub edi, eax
		2036	mov [eax+recordRealSize], edi
		2037	call .ntfsNodeAlloc
		2038	jc ntfsErrorPop3
		2039	mov eax, [ebp+NTFS.newRecord]
		2040	mov edi, [ebp+NTFS.cur_index_buf]
		2041	mov [edi+recordVCN], eax
		2042	mov edi, [ebp+NTFS.attr_offs]
		2043	mov [edi-8], eax
		2044	jmp .refresh
		2045
		2046	@@:
6292	pathoswith	2047	mov cl, 32
		2048	xor eax, eax
		2049	rep stosd
6407	pathoswith	2050	mov eax, [ebp+NTFS.cur_subnode_size]
		2051	cmp eax, [ebp+NTFS.cur_size]
		2052	jnz @f
6824	pathoswith	2053	cmp [ebp+NTFS.sectors_per_cluster], 1
		2054	jz @f
6407	pathoswith	2055	mov al, 1
		2056	@@:
		2057	mov [ebp+NTFS.fileDataSize], eax
6292	pathoswith	2058	mov edi, [ebp+NTFS.BitmapStart]
		2059	call ntfsSpaceAlloc
6407	pathoswith	2060	movi eax, ERROR_DISK_FULL
		2061	jc ntfsErrorPop3
		2062	; create $IndexAllocation
		2063	mov edi, [ebp+NTFS.attr_offs]
6292	pathoswith	2064	mov byte [edi+attributeType], 0xA0
		2065	mov byte [edi+nonResidentFlag], 1
		2066	mov byte [edi+nameLength], 4
		2067	mov byte [edi+nameOffset], 40h
		2068	mov byte [edi+dataRunsOffset], 48h
		2069	mov byte [edi+sizeWithHeader], 50h
		2070	mov eax, [ebp+NTFS.fileDataSize]
		2071	dec eax
		2072	mov [edi+lastVCN], eax
		2073	inc eax
		2074	mul [ebp+NTFS.sectors_per_cluster]
		2075	shl eax, 9
		2076	mov [edi+attributeAllocatedSize], eax
		2077	mov [edi+attributeRealSize], eax
		2078	mov [edi+initialDataSize], eax
		2079	mov dword[edi+40h], 490024h ; unicode $I30
		2080	mov dword[edi+40h+4], 300033h
		2081	push edi
		2082	mov esi, edi
		2083	add edi, 48h
		2084	call createMcbEntry
		2085	mov esi, [ebp+NTFS.frs_buffer]
		2086	pop edi
		2087	mov al, [esi+newAttributeID]
		2088	mov [edi+attributeID], al
		2089	add edi, 50h
		2090	inc eax
		2091	; create $Bitmap
		2092	mov [edi+attributeID], al
		2093	inc eax
		2094	mov [esi+newAttributeID], al
		2095	mov byte [edi+attributeType], 0xB0
		2096	mov byte [edi+nameLength], 4
		2097	mov byte [edi+nameOffset], 18h
		2098	mov byte [edi+attributeOffset], 20h
		2099	mov byte [edi+sizeWithoutHeader], 8
		2100	mov byte [edi+sizeWithHeader], 28h
		2101	mov dword[edi+18h], 490024h ; unicode $I30
		2102	mov dword[edi+18h+4], 300033h
		2103	mov byte [edi+20h], 1
		2104	mov dword[edi+28h], -1
		2105	add edi, 30h
		2106	sub edi, esi
		2107	mov [esi+recordRealSize], edi
		2108	mov eax, [ebp+NTFS.fileDataStart]
		2109	mul [ebp+NTFS.sectors_per_cluster]
6408	pathoswith	2110	mov edx, eax
6407	pathoswith	2111	jmp @f
		2112
		2113	.refresh:
		2114	mov [ebp+NTFS.cur_size], 0
		2115	call ntfs_read_attr.continue
		2116	movi eax, ERROR_FS_FAIL
		2117	jc ntfsErrorPop3
6408	pathoswith	2118	mov edx, [ebp+NTFS.LastRead]
6407	pathoswith	2119	@@:
6408	pathoswith	2120	mov ebx, [ebp+NTFS.cur_index_buf]
6407	pathoswith	2121	call writeRecord
6408	pathoswith	2122	mov ebx, [ebp+NTFS.frs_buffer]
		2123	mov edx, [ebp+NTFS.rootLastRead]
6407	pathoswith	2124	call writeRecord
		2125	mov esi, [esp+4]
6468	pathoswith	2126	call ntfs_find_lfn.doit2
6407	pathoswith	2127	test eax, eax
		2128	jz .errorPop3
6292	pathoswith	2129	mov edi, [ebp+NTFS.cur_index_buf]
		2130	mov edx, [esp]
5954	pathoswith	2131	.indexRecord:
6273	pathoswith	2132	add edi, recordNode
6292	pathoswith	2133	add edx, [edi+nodeRealSize]
6273	pathoswith	2134	cmp [edi+nodeAllocatedSize], edx
6340	pathoswith	2135	jc .arborizeTree
		2136	mov [edi+nodeRealSize], edx
		2137	jmp .common
		2138
		2139	.errorPop3:
5954	pathoswith	2140	add esp, 12
6340	pathoswith	2141	jmp ntfsUnsupported
6292	pathoswith	2142
6407	pathoswith	2143	.ntfsNodeAlloc:
		2144	; in: [ebp+NTFS.attr_offs] -> $IndexAllocation
		2145	; out:
		2146	; [ebp+NTFS.newRecord] = node VCN
		2147	; [ebp+NTFS.cur_offs]
		2148	; CF=1 -> eax = error code
6340	pathoswith	2149	mov esi, [ebp+NTFS.attr_offs]
		2150	add esi, [esi+sizeWithHeader]
		2151	cmp byte [esi], 0xB0
6407	pathoswith	2152	jnz .ret
6414	pathoswith	2153	movzx ecx, word [esi+sizeWithoutHeader]
		2154	shr ecx, 2
		2155	movzx edi, byte [esi+attributeOffset]
		2156	add edi, esi
		2157	mov edx, edi
		2158	or eax, -1
		2159	repz scasd
		2160	jnz @f
		2161	cmp [edi], eax
		2162	jnz .ret
		2163	; extend folder $Bitmap
		2164	add word [esi+sizeWithHeader], 8
		2165	add word [esi+sizeWithoutHeader], 8
		2166	mov esi, [ebp+NTFS.frs_buffer]
		2167	mov eax, [esi+recordRealSize]
		2168	add eax, 8
		2169	cmp [esi+recordAllocatedSize], eax
		2170	jc .ret
		2171	mov [esi+recordRealSize], eax
		2172	xor eax, eax
		2173	stosd
		2174	mov [edi], eax
		2175	mov [edi+8], eax
		2176	dec eax
		2177	mov [edi+4], eax
		2178	@@:
		2179	sub edi, 4
		2180	mov eax, [edi]
6340	pathoswith	2181	not eax
		2182	bsf eax, eax
6414	pathoswith	2183	bts [edi], eax
		2184	sub edi, edx
		2185	shl edi, 3
		2186	add eax, edi
6340	pathoswith	2187	mul [ebp+NTFS.cur_subnode_size]
		2188	mov [ebp+NTFS.newRecord], eax
6407	pathoswith	2189	mov ecx, [ebp+NTFS.cur_size]
		2190	cmp ecx, [ebp+NTFS.cur_subnode_size]
		2191	jz @f
		2192	mul [ebp+NTFS.sectors_per_cluster]
		2193	@@:
		2194	mov [ebp+NTFS.cur_offs], eax
		2195	add eax, ecx
		2196	shl eax, 9
		2197	mov esi, [ebp+NTFS.attr_offs]
		2198	cmp [esi+attributeAllocatedSize], eax
		2199	jnc @f
		2200	xor edx, edx
		2201	jmp resizeAttribute
		2202
		2203	.ret:
		2204	movi eax, ERROR_UNSUPPORTED_FS
		2205	stc
		2206	@@:
		2207	ret
		2208
		2209	.arborizeTree: ; find median index
6340	pathoswith	2210	mov ecx, [edi+nodeRealSize]
		2211	sub ecx, [edi+indexOffset]
		2212	shr ecx, 1
		2213	add edi, [edi+indexOffset]
		2214	xor eax, eax
		2215	@@:
		2216	add edi, eax
		2217	mov ax, [edi+indexAllocatedSize]
		2218	sub ecx, eax
		2219	jnc @b
6407	pathoswith	2220	add eax, 8
6340	pathoswith	2221	mov esi, [ebp+NTFS.secondIndexBuffer]
		2222	cmp dword [esi], 'INDX'
6411	pathoswith	2223	jz @f
6340	pathoswith	2224	; move index to the root node
		2225	mov esi, [ebp+NTFS.frs_buffer]
6407	pathoswith	2226	mov ecx, eax
		2227	add ecx, 8
		2228	add ecx, [esi+recordRealSize]
6340	pathoswith	2229	cmp [esi+recordAllocatedSize], ecx
6411	pathoswith	2230	jc .growTree
6409	pathoswith	2231	push edi eax
6407	pathoswith	2232	call .ntfsNodeAlloc
6414	pathoswith	2233	jc ntfsErrorPop5
		2234	pop eax
6340	pathoswith	2235	mov edi, [ebp+NTFS.indexRoot]
		2236	add [ebp+NTFS.attr_offs], eax
		2237	add [edi+sizeWithHeader], eax
		2238	add [edi+sizeWithoutHeader], eax
		2239	movzx ecx, byte [edi+attributeOffset]
		2240	add ecx, edi
		2241	add [ecx+rootNode+nodeRealSize], eax
		2242	add [ecx+rootNode+nodeAllocatedSize], eax
6405	pathoswith	2243	add ecx, [ebp+NTFS.indexPointer]
6340	pathoswith	2244	sub ecx, [ebp+NTFS.secondIndexBuffer]
6409	pathoswith	2245	mov esi, [ebp+NTFS.frs_buffer]
		2246	add [esi+recordRealSize], eax
		2247	add esi, [esi+recordRealSize]
6340	pathoswith	2248	mov edi, esi
		2249	sub esi, eax
		2250	neg ecx
		2251	add ecx, esi
		2252	shr ecx, 2
		2253	sub esi, 4
		2254	sub edi, 4
		2255	std
		2256	rep movsd ; make space
		2257	mov [edi], ecx
		2258	mov edi, esi
		2259	add edi, 4
		2260	mov esi, [esp]
		2261	add word [esi+indexAllocatedSize], 8
		2262	mov byte [esi+indexFlags], 1
		2263	mov ecx, eax
		2264	sub ecx, 8
		2265	shr ecx, 2
		2266	cld
		2267	rep movsd ; insert index
		2268	mov eax, [ebp+NTFS.newRecord]
		2269	stosd
6411	pathoswith	2270	jmp .splitNode
		2271
6414	pathoswith	2272	.growBranch: ; move node and replace it with empty one
		2273	mov esi, [ebp+NTFS.cur_index_buf]
		2274	mov edi, [ebp+NTFS.secondIndexBuffer]
		2275	mov eax, [esi+recordVCN]
		2276	mov [edi+recordVCN], eax
		2277	add edi, recordNode
		2278	mov eax, [edi+indexOffset]
		2279	add eax, 18h
		2280	mov [edi+nodeRealSize], eax
		2281	add edi, [edi+indexOffset]
		2282	mov ecx, 6
		2283	xor eax, eax
		2284	mov [ebp+NTFS.indexPointer], edi
		2285	push edi
		2286	rep stosd
		2287	pop edi
		2288	mov eax, [ebp+NTFS.newRecord]
		2289	mov byte [edi+indexAllocatedSize], 18h
		2290	mov byte [edi+indexFlags], 3
		2291	mov [edi+16], eax
		2292	mov [esi+recordVCN], eax
		2293	mov eax, [ebp+NTFS.LastRead]
		2294	mov [ebp+NTFS.nodeLastRead], eax
		2295	push [ebp+NTFS.cur_size]
		2296	mov [ebp+NTFS.cur_size], 0
		2297	call ntfs_read_attr.continue
		2298	pop [ebp+NTFS.cur_size]
		2299	movi eax, ERROR_FS_FAIL
		2300	jc ntfsErrorPop5
		2301	pop eax edi
6411	pathoswith	2302	@@: ; move index to the branch node
6414	pathoswith	2303	push edi eax
		2304	call .ntfsNodeAlloc
		2305	jc ntfsErrorPop5
		2306	mov eax, [esp]
		2307	mov esi, [ebp+NTFS.secondIndexBuffer]
6411	pathoswith	2308	add esi, recordNode
		2309	mov ecx, [esi+nodeRealSize]
		2310	add eax, ecx
		2311	cmp [esi+nodeAllocatedSize], eax
6414	pathoswith	2312	jc .growBranch
6411	pathoswith	2313	mov [esi+nodeRealSize], eax
		2314	lea edi, [esi+eax-4]
		2315	add esi, ecx
		2316	mov ecx, esi
		2317	sub ecx, [ebp+NTFS.indexPointer]
		2318	shr ecx, 2
		2319	sub esi, 4
		2320	std
		2321	rep movsd ; make space
		2322	mov [edi], ecx
6414	pathoswith	2323	pop ecx
		2324	sub ecx, 8
		2325	shr ecx, 2
6411	pathoswith	2326	mov edi, esi
		2327	add edi, 4
		2328	mov esi, [esp]
		2329	add word [esi+indexAllocatedSize], 8
		2330	mov byte [esi+indexFlags], 1
		2331	cld
		2332	rep movsd ; insert index
		2333	mov eax, [ebp+NTFS.newRecord]
		2334	stosd
		2335	mov ebx, [ebp+NTFS.secondIndexBuffer]
		2336	mov edx, [ebp+NTFS.nodeLastRead]
		2337	push esi
		2338	call writeRecord
		2339	pop esi
		2340	.splitNode:
6340	pathoswith	2341	mov edi, [ebp+NTFS.cur_index_buf]
		2342	mov eax, edi
		2343	add eax, recordNode
		2344	add eax, [edi+recordNode+nodeRealSize]
		2345	sub eax, esi
		2346	push eax
		2347	mov ecx, [edi+recordNode+indexOffset]
		2348	add eax, ecx
		2349	add ecx, recordNode
		2350	shr ecx, 2
		2351	push esi
		2352	mov esi, edi
		2353	mov edi, [ebp+NTFS.secondIndexBuffer]
		2354	rep movsd
		2355	pop esi
		2356	pop ecx
		2357	shr ecx, 2
		2358	rep movsd
		2359	mov edi, [ebp+NTFS.secondIndexBuffer]
		2360	mov [edi+recordNode+nodeRealSize], eax
		2361	pop edi
		2362	mov cl, 4
		2363	xor eax, eax
		2364	mov esi, edi
		2365	rep stosd
		2366	mov byte [esi+indexAllocatedSize], 16
		2367	mov byte [esi+indexFlags], 2
		2368	mov esi, [ebp+NTFS.cur_index_buf]
		2369	mov eax, [ebp+NTFS.newRecord]
		2370	mov [esi+recordVCN], eax
		2371	add esi, recordNode
		2372	sub edi, esi
		2373	mov [esi+nodeRealSize], edi
6408	pathoswith	2374	mov ebx, [ebp+NTFS.secondIndexBuffer]
		2375	mov edx, [ebp+NTFS.LastRead]
6340	pathoswith	2376	call writeRecord
6407	pathoswith	2377	jmp .refresh
6340	pathoswith	2378
6292	pathoswith	2379	.common:
6273	pathoswith	2380	add edi, edx
		2381	sub edi, 4
5954	pathoswith	2382	mov esi, edi
		2383	sub esi, [esp]
		2384	mov ecx, esi
6292	pathoswith	2385	sub ecx, eax ; eax = pointer in the record
5954	pathoswith	2386	shr ecx, 2
		2387	inc ecx
		2388	std
		2389	rep movsd ; move forward, make space
		2390	mov ecx, [esp]
		2391	shr ecx, 2
		2392	xor eax, eax
		2393	rep stosd
		2394	cld
		2395	add edi, 4
6420	pathoswith	2396	call ntfsGetTime
		2397	mov [edi+fileCreated], eax
		2398	mov [edi+fileCreated+4], edx
		2399	mov [edi+fileModified], eax
		2400	mov [edi+fileModified+4], edx
		2401	mov [edi+recordModified], eax
		2402	mov [edi+recordModified+4], edx
		2403	mov [edi+fileAccessed], eax
		2404	mov [edi+fileAccessed+4], edx
6151	pathoswith	2405	pop ecx
5954	pathoswith	2406	pop esi
6151	pathoswith	2407	mov [edi+indexAllocatedSize], cx ; fill index with data
5954	pathoswith	2408	mov eax, [esp]
6080	pathoswith	2409	shl eax, 1
		2410	add eax, 42h
5954	pathoswith	2411	mov [edi+indexRawSize], ax
6418	pathoswith	2412	mov eax, [ebp+NTFS.cur_iRecord]
5954	pathoswith	2413	mov [edi+directoryRecordReference], eax
		2414	mov eax, [ebp+NTFS.frs_buffer]
		2415	mov eax, [eax+reuseCounter]
		2416	mov [edi+directoryReferenceReuse], ax
6292	pathoswith	2417	mov eax, [ebp+NTFS.frs_size]
		2418	shr eax, 8
6151	pathoswith	2419	add ecx, 30h+48h+8+18h+8
		2420	add ecx, eax
6292	pathoswith	2421	mov eax, [ebp+NTFS.fileRealSize]
		2422	add ecx, eax
5954	pathoswith	2423	mov [edi+fileRealSize], eax
6151	pathoswith	2424	cmp [ebp+NTFS.frs_size], ecx
		2425	jc @f
		2426	xor eax, eax
		2427	@@:
5954	pathoswith	2428	mov ecx, [ebp+NTFS.sectors_per_cluster]
		2429	shl ecx, 9
		2430	add eax, ecx
		2431	dec eax
		2432	xor edx, edx
		2433	div ecx
		2434	mov [ebp+NTFS.fileDataSize], eax
		2435	mul ecx
		2436	mov [edi+fileAllocatedSize], eax
		2437	pop ecx
6405	pathoswith	2438	mov [ebp+NTFS.indexPointer], edi
5954	pathoswith	2439	mov [edi+fileNameLength], cl
6297	pathoswith	2440	add edi, fileName
5954	pathoswith	2441	@@: ; record filename
6471	pathoswith	2442	call utf8to16
5954	pathoswith	2443	stosw
6471	pathoswith	2444	loop @b
6273	pathoswith	2445	mov eax, [ebp+NTFS.LastRead]
5954	pathoswith	2446	mov [ebp+NTFS.nodeLastRead], eax
6273	pathoswith	2447	cmp [ebp+NTFS.bFolder], 0
5954	pathoswith	2448	jz @f
6405	pathoswith	2449	mov edi, [ebp+NTFS.indexPointer]
6080	pathoswith	2450	bts dword [edi+fileFlags], 28
5954	pathoswith	2451	jmp .mftBitmap
		2452
		2453	@@: ; 3. File data
6151	pathoswith	2454	cmp [ebp+NTFS.fileDataSize], 0
5954	pathoswith	2455	jz .mftBitmap
6080	pathoswith	2456	mov edi, [ebp+NTFS.BitmapStart]
		2457	call ntfsSpaceAlloc
		2458	jc ntfsDiskFull
6292	pathoswith	2459	mov eax, [ebp+NTFS.fileDataStart]
5954	pathoswith	2460	mul [ebp+NTFS.sectors_per_cluster]
		2461	mov ecx, [ebp+NTFS.fileRealSize]
		2462	add ecx, 511
		2463	shr ecx, 9
6292	pathoswith	2464	mov ebx, [ebp+NTFS.fileDataBuffer]
5954	pathoswith	2465	call fs_write64_app
		2466	test eax, eax
6019	pathoswith	2467	jnz ntfsDevice
5954	pathoswith	2468	; 4. MFT record
		2469	.mftBitmap: ; search for free record
		2470	mov edi, [ebp+NTFS.mftBitmapBuffer]
		2471	mov ecx, [ebp+NTFS.mftBitmapSize]
		2472	mov al, -1
		2473	add edi, 3
		2474	sub ecx, 3
		2475	repz scasb
		2476	dec edi
		2477	movzx eax, byte [edi]
		2478	not al
		2479	bsf ecx, eax
6107	pathoswith	2480	jz .extendBitmapMFT ; no free records
6019	pathoswith	2481	bts [edi], ecx
		2482	; get record location
5954	pathoswith	2483	sub edi, [ebp+NTFS.mftBitmapBuffer]
		2484	shl edi, 3
		2485	add edi, ecx
6340	pathoswith	2486	mov [ebp+NTFS.newRecord], edi
5954	pathoswith	2487	mov eax, [ebp+NTFS.frs_size]
		2488	shr eax, 9
		2489	mul edi
6273	pathoswith	2490	mov [ebp+NTFS.cur_iRecord], 0
		2491	mov [ebp+NTFS.cur_attr], 0x80
		2492	mov [ebp+NTFS.cur_offs], eax
6405	pathoswith	2493	push eax
		2494	mov [ebp+NTFS.cur_size], 0
5954	pathoswith	2495	mov eax, [ebp+NTFS.frs_buffer]
6273	pathoswith	2496	mov [ebp+NTFS.cur_buf], eax
5954	pathoswith	2497	call ntfs_read_attr
6405	pathoswith	2498	pop eax
		2499	jc ntfsFail
		2500	cmp eax, [ebp+NTFS.mftSize]
		2501	jnc .extendMFT
6107	pathoswith	2502	jmp .mftRecord
		2503
		2504	.extendBitmapMFT:
		2505	mov eax, [ebp+NTFS.sectors_per_cluster]
6405	pathoswith	2506	mov [ebp+NTFS.cur_offs], eax
6107	pathoswith	2507	shl eax, 9
		2508	cmp [ebp+NTFS.mftBitmapSize], eax
		2509	jnc ntfsUnsupported
6273	pathoswith	2510	mov [ebp+NTFS.cur_iRecord], 0
		2511	mov [ebp+NTFS.cur_attr], 0xB0
		2512	mov [ebp+NTFS.cur_size], 0
6107	pathoswith	2513	call ntfs_read_attr
		2514	jc ntfsFail
5954	pathoswith	2515	mov eax, [ebp+NTFS.mft_cluster]
		2516	mul [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	2517	cmp eax, [ebp+NTFS.LastRead]
6019	pathoswith	2518	jnz ntfsUnsupported ; auxiliary record
6107	pathoswith	2519	mov edi, [ebp+NTFS.mftBitmapBuffer]
		2520	mov ecx, [ebp+NTFS.mftBitmapSize]
		2521	add edi, ecx
		2522	mov eax, ecx
6273	pathoswith	2523	mov edx, [ebp+NTFS.attr_offs]
6107	pathoswith	2524	add ecx, 8
		2525	mov [edx+attributeRealSize], ecx
		2526	mov [edx+initialDataSize], ecx
		2527	shl eax, 3
6340	pathoswith	2528	mov [ebp+NTFS.newRecord], eax
6107	pathoswith	2529	mov dword [edi], 1
		2530	mov dword [edi+4], 0
6273	pathoswith	2531	mov [ebp+NTFS.cur_attr], 0x80
6405	pathoswith	2532	mov [ebp+NTFS.cur_offs], 0
6107	pathoswith	2533	call ntfs_read_attr.newAttribute
		2534	jc ntfsFail
		2535	mov [ebp+NTFS.mftBitmapSize], ecx
		2536	.extendMFT:
		2537	mov eax, [ebp+NTFS.mft_cluster]
5954	pathoswith	2538	mul [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	2539	cmp eax, [ebp+NTFS.LastRead]
6107	pathoswith	2540	jnz ntfsUnsupported ; auxiliary record
6273	pathoswith	2541	mov ecx, [ebp+NTFS.attr_offs]
6107	pathoswith	2542	mov eax, [ecx+attributeRealSize]
		2543	mov edx, [ecx+attributeRealSize+4]
		2544	xor ax, ax
		2545	add eax, 10000h
		2546	adc edx, 0
		2547	push [ebp+NTFS.fileDataStart]
		2548	push [ebp+NTFS.fileDataSize]
		2549	call resizeAttribute
		2550	jc ntfsErrorPop2
6408	pathoswith	2551	mov ebx, [ebp+NTFS.frs_buffer]
		2552	mov edx, [ebp+NTFS.LastRead]
5954	pathoswith	2553	call writeRecord ; $MFT
		2554	mov eax, [ebp+NTFS.mftmirr_cluster]
		2555	mul [ebp+NTFS.sectors_per_cluster]
6408	pathoswith	2556	mov ecx, [ebp+NTFS.frs_size]
		2557	shr ecx, 9
5954	pathoswith	2558	call fs_write64_sys ; $MFTMirr
6405	pathoswith	2559	; update $MFT retrieval information
		2560	mov edi, [ebp+NTFS.mft_retrieval_end]
		2561	mov eax, [edi-4]
		2562	add eax, [edi-8]
		2563	mov edx, [ebp+NTFS.fileDataSize]
		2564	cmp eax, [ebp+NTFS.fileDataStart]
		2565	jnz .newFragment
		2566	add [edi-8], edx
		2567	jmp @f
		2568	.newFragment:
		2569	lea eax, [ebp+NTFS.attrlist_buf]
		2570	cmp eax, edi
		2571	jz @f
		2572	mov [edi], edx
		2573	mov eax, [ebp+NTFS.fileDataStart]
		2574	mov [edi+4], eax
		2575	add [ebp+NTFS.mft_retrieval_end], 8
		2576	@@:
		2577	mov eax, [ebp+NTFS.fileDataSize]
		2578	mul [ebp+NTFS.sectors_per_cluster]
		2579	add [ebp+NTFS.mftSize], eax
6107	pathoswith	2580	call ntfsSpaceClean
		2581	pop [ebp+NTFS.fileDataSize]
		2582	pop [ebp+NTFS.fileDataStart]
5954	pathoswith	2583	.mftRecord:
6151	pathoswith	2584	mov ecx, [ebp+NTFS.frs_size]
		2585	shr ecx, 2
5954	pathoswith	2586	mov edi, [ebp+NTFS.frs_buffer]
		2587	xor eax, eax
		2588	rep stosd
6418	pathoswith	2589	mov esi, [ebp+NTFS.indexPointer]
		2590	mov eax, [ebp+NTFS.newRecord]
		2591	mov [esi+fileRecordReference], eax
		2592	rdtsc
		2593	mov [esi+fileReferenceReuse], ax
5954	pathoswith	2594	mov edi, [ebp+NTFS.frs_buffer]
6019	pathoswith	2595	; record header
6418	pathoswith	2596	mov [edi+reuseCounter], ax
6292	pathoswith	2597	mov [edi+2ah], ax
6151	pathoswith	2598	mov eax, [ebp+NTFS.frs_size]
		2599	mov [edi+recordAllocatedSize], eax
		2600	shr eax, 9
		2601	inc eax
		2602	mov [edi+updateSequenceSize], al
6292	pathoswith	2603	shl eax, 1
		2604	add eax, 2ah+7
		2605	and eax, not 7
5954	pathoswith	2606	mov dword[edi], 'FILE'
		2607	mov byte [edi+updateSequenceOffset], 2ah
		2608	mov byte [edi+hardLinkCounter], 1
		2609	mov byte [edi+newAttributeID], 3
6292	pathoswith	2610	mov [edi+attributeOffset], al
		2611	add edi, eax
6019	pathoswith	2612	; $StandardInformation
5954	pathoswith	2613	mov byte [edi+attributeType], 10h
		2614	mov byte [edi+sizeWithHeader], 48h
		2615	mov byte [edi+sizeWithoutHeader], 30h
		2616	mov byte [edi+attributeOffset], 18h
6420	pathoswith	2617	mov cl, 8
		2618	add esi, fileCreated
		2619	add edi, 18h
		2620	rep movsd
		2621	add edi, 16
		2622	mov esi, [ebp+NTFS.indexPointer]
6019	pathoswith	2623	; $FileName
5954	pathoswith	2624	mov byte [edi+attributeType], 30h
		2625	mov byte [edi+attributeID], 1
6151	pathoswith	2626	mov byte [edi+attributeOffset], 18h
		2627	mov byte [edi+indexedFlag], 1
5954	pathoswith	2628	mov cx, [esi+indexRawSize]
		2629	mov [edi+sizeWithoutHeader], ecx
		2630	mov cx, [esi+indexAllocatedSize]
		2631	add ecx, 8
		2632	mov [edi+sizeWithHeader], ecx
		2633	add edi, 18h
		2634	add esi, 16
		2635	sub ecx, 18h
		2636	shr ecx, 2
		2637	rep movsd
6080	pathoswith	2638	mov byte [edi+sizeWithHeader], 50h
		2639	mov byte [edi+attributeID], 2
6273	pathoswith	2640	cmp [ebp+NTFS.bFolder], 1
6151	pathoswith	2641	jz .indexRoot
6019	pathoswith	2642	; $Data
5954	pathoswith	2643	mov byte [edi+attributeType], 80h
6151	pathoswith	2644	mov eax, [ebp+NTFS.fileDataSize]
		2645	test eax, eax
		2646	jz .resident
6405	pathoswith	2647	mov esi, [ebp+NTFS.indexPointer]
6080	pathoswith	2648	dec eax
		2649	mov [edi+lastVCN], eax
5954	pathoswith	2650	mov byte [edi+nonResidentFlag], 1
		2651	mov byte [edi+dataRunsOffset], 40h
		2652	mov eax, [esi+fileAllocatedSize]
		2653	mov [edi+attributeAllocatedSize], eax
		2654	mov eax, [esi+fileRealSize]
		2655	mov [edi+attributeRealSize], eax
		2656	mov [edi+initialDataSize], eax
6151	pathoswith	2657	push edi
6080	pathoswith	2658	mov esi, edi
		2659	add edi, 40h
		2660	call createMcbEntry
6151	pathoswith	2661	inc edi
		2662	jmp @f
5954	pathoswith	2663
6151	pathoswith	2664	.resident:
		2665	mov ecx, [ebp+NTFS.fileRealSize]
		2666	mov [edi+sizeWithoutHeader], ecx
5954	pathoswith	2667	mov byte [edi+attributeOffset], 18h
6151	pathoswith	2668	push edi
6292	pathoswith	2669	mov esi, [ebp+NTFS.fileDataBuffer]
6151	pathoswith	2670	add edi, 18h
		2671	rep movsb
		2672	@@:
		2673	mov eax, edi
		2674	pop edi
		2675	sub eax, edi
		2676	add eax, 7
		2677	and eax, not 7
		2678	mov [edi+sizeWithHeader], eax
		2679	add edi, eax
5954	pathoswith	2680	mov al, 1
6292	pathoswith	2681	jmp .end
5954	pathoswith	2682
6151	pathoswith	2683	.indexRoot:
5954	pathoswith	2684	mov byte [edi+attributeType], 90h
		2685	mov byte [edi+nameLength], 4
		2686	mov byte [edi+nameOffset], 18h
		2687	mov byte [edi+sizeWithoutHeader], 30h
		2688	mov byte [edi+attributeOffset], 20h
		2689	mov dword[edi+18h], 490024h ; unicode $I30
		2690	mov dword[edi+18h+4], 300033h
6273	pathoswith	2691	mov byte [edi+20h+indexedAttributesType], 30h
6019	pathoswith	2692	mov byte [edi+20h+collationRule], 1
5954	pathoswith	2693	mov eax, [ebp+NTFS.sectors_per_cluster]
6292	pathoswith	2694	mov dl, 1
		2695	shl eax, 8
		2696	@@:
		2697	shl eax, 1
		2698	shl edx, 1
		2699	cmp eax, [ebp+NTFS.frs_size]
		2700	jc @b
		2701	shr edx, 1
6019	pathoswith	2702	mov [edi+20h+indexRecordSize], eax
6292	pathoswith	2703	mov [edi+20h+indexRecordSizeClus], dl
6019	pathoswith	2704	mov byte [edi+30h+indexOffset], 16
		2705	mov byte [edi+30h+nodeRealSize], 32
		2706	mov byte [edi+30h+nodeAllocatedSize], 32
		2707	mov byte [edi+40h+indexAllocatedSize], 16
		2708	mov byte [edi+40h+indexFlags], 2
6151	pathoswith	2709	add edi, 50h
5954	pathoswith	2710	mov al, 3
6292	pathoswith	2711	.end:
6408	pathoswith	2712	mov ebx, [ebp+NTFS.frs_buffer]
6151	pathoswith	2713	mov dword [edi], -1
		2714	mov dword [edi+4], 0
		2715	add edi, 8
6408	pathoswith	2716	sub edi, ebx
		2717	mov [ebx+recordFlags], al
		2718	mov [ebx+recordRealSize], edi
		2719	mov edx, [ebp+NTFS.LastRead]
5954	pathoswith	2720	call writeRecord
6019	pathoswith	2721	; write MFT bitmap
6340	pathoswith	2722	mov eax, [ebp+NTFS.newRecord]
5954	pathoswith	2723	shr eax, 3+9
		2724	mov ebx, eax
		2725	shl ebx, 9
		2726	add eax, [ebp+NTFS.mftBitmapLocation]
		2727	add ebx, [ebp+NTFS.mftBitmapBuffer]
		2728	mov ecx, 1
		2729	xor edx, edx
		2730	call fs_write64_sys
6292	pathoswith	2731	; 5. Write directory node
6408	pathoswith	2732	mov ebx, [ebp+NTFS.cur_index_buf]
		2733	mov edx, [ebp+NTFS.nodeLastRead]
5954	pathoswith	2734	call writeRecord
6019	pathoswith	2735	mov ebx, [ebp+NTFS.fileRealSize]
		2736	ntfsDone:
5954	pathoswith	2737	mov esi, [ebp+PARTITION.Disk]
		2738	call disk_sync
		2739	call ntfs_unlock
6019	pathoswith	2740	xor eax, eax
5954	pathoswith	2741	ret
		2742
		2743	writeRecord:
6080	pathoswith	2744	; make updateSequence and write to disk
5954	pathoswith	2745	; in:
6408	pathoswith	2746	; ebx -> record
		2747	; edx = partition sector
		2748	mov esi, ebx
		2749	mov edi, ebx
5954	pathoswith	2750	movzx ecx, word [esi+updateSequenceOffset]
		2751	add edi, ecx
		2752	mov ax, [edi]
6080	pathoswith	2753	inc ax
		2754	stosw
5954	pathoswith	2755	mov cx, [esi+updateSequenceSize]
		2756	dec ecx
		2757	push ecx
		2758	@@:
		2759	add esi, 510
		2760	movsw
		2761	mov [esi-2], ax
6471	pathoswith	2762	loop @b
6408	pathoswith	2763	mov eax, edx
		2764	xor edx, edx
5954	pathoswith	2765	pop ecx
		2766	jmp fs_write64_sys
		2767
6080	pathoswith	2768	createMcbEntry:
		2769	; in:
		2770	; [ebp+NTFS.fileDataStart] = position value
		2771	; [ebp+NTFS.fileDataSize] = size value
		2772	; edi -> destination
		2773	; esi -> attribute header
		2774	mov eax, [ebp+NTFS.fileDataStart]
		2775	xor edx, edx
		2776	shl eax, 1
		2777	jnc @f
		2778	not eax
		2779	@@:
		2780	inc edx
		2781	shr eax, 8
		2782	jnz @b
		2783	mov eax, [ebp+NTFS.fileDataSize]
		2784	shl eax, 1
		2785	xor ecx, ecx
		2786	@@:
		2787	inc ecx
		2788	shr eax, 8
		2789	jnz @b
		2790	lea eax, [edi+edx+1]
		2791	add eax, ecx
		2792	sub eax, esi
6151	pathoswith	2793	sub eax, [esi+sizeWithHeader]
6080	pathoswith	2794	jc @f
		2795	add word [esi+sizeWithHeader], 8 ; extend attribute
		2796	mov esi, [ebp+NTFS.frs_buffer]
		2797	mov eax, [esi+recordRealSize]
		2798	add eax, 8
		2799	cmp [esi+recordAllocatedSize], eax
		2800	jc .end ; no space in the record
		2801	mov [esi+recordRealSize], eax
		2802	push ecx edi
		2803	add esi, eax
		2804	mov ecx, esi
		2805	sub ecx, edi
		2806	sub ecx, 8
		2807	shr ecx, 2
		2808	mov edi, esi
		2809	sub edi, 4
		2810	sub esi, 12
		2811	std
		2812	rep movsd
		2813	cld
		2814	pop edi ecx
		2815	@@:
		2816	mov eax, edx
		2817	shl eax, 4
		2818	add eax, ecx
		2819	stosb
		2820	lea esi, [ebp+NTFS.fileDataSize]
		2821	rep movsb
		2822	lea esi, [ebp+NTFS.fileDataStart]
		2823	mov ecx, edx
		2824	rep movsb
6151	pathoswith	2825	mov [edi], cl
6080	pathoswith	2826	.end:
		2827	ret
		2828
		2829	resizeAttribute:
		2830	; in:
		2831	; [ebp+NTFS.frs_buffer] -> file record
6273	pathoswith	2832	; [ebp+NTFS.attr_offs] -> attribute
6080	pathoswith	2833	; edx:eax = new size
		2834	; out:
6107	pathoswith	2835	; [ebp+NTFS.fileDataSize] = clusters added (positive)
		2836	; [ebp+NTFS.fileDataStart] = added block
6080	pathoswith	2837	; CF=1 -> eax = error code
6273	pathoswith	2838	mov esi, [ebp+NTFS.attr_offs]
		2839	mov dword [ebp+NTFS.attr_size], eax
		2840	mov dword [ebp+NTFS.attr_size+4], edx
6151	pathoswith	2841	cmp byte [esi+nonResidentFlag], 0
		2842	jz .resident
6080	pathoswith	2843	mov ecx, [ebp+NTFS.sectors_per_cluster]
		2844	shl ecx, 9
		2845	mov [esi+attributeRealSize], eax
		2846	mov [esi+attributeRealSize+4], edx
		2847	mov [esi+initialDataSize], eax
		2848	mov [esi+initialDataSize+4], edx
		2849	sub eax, 1
		2850	sbb edx, 0
6151	pathoswith	2851	jc .makeResident
6080	pathoswith	2852	div ecx
		2853	mov edi, eax
		2854	inc eax
		2855	mul ecx
		2856	mov [esi+attributeAllocatedSize], eax
		2857	mov [esi+attributeAllocatedSize+4], edx
		2858	mov ecx, [esi+lastVCN]
		2859	mov [esi+lastVCN], edi
		2860	movzx eax, byte [esi+dataRunsOffset]
		2861	sub edi, ecx
6107	pathoswith	2862	mov [ebp+NTFS.fileDataSize], edi
6080	pathoswith	2863	jz .done
		2864	jc .shrinkAttribute
		2865	; extend attribute
		2866	xor edi, edi
		2867	add esi, eax
		2868	push edi edi edi edi
		2869	@@:
		2870	mov edx, eax
		2871	mov eax, esi
		2872	add edi, [esp+8]
		2873	call ntfs_decode_mcb_entry
		2874	jc @b
		2875	mov [esp+4], edx
		2876	mov [esp+12], edi
		2877	add edi, [esp]
		2878	push edi
		2879	shr edi, 5
		2880	shl edi, 2
		2881	push eax
6820	pathoswith	2882	cmp edi, [ebp+NTFS.BitmapStart]
		2883	jnc @f
6273	pathoswith	2884	cmp [ebp+NTFS.cur_iRecord], 0
6107	pathoswith	2885	jz @f
6820	pathoswith	2886	mov edi, [ebp+NTFS.BitmapStart]
6107	pathoswith	2887	@@:
6080	pathoswith	2888	call ntfsSpaceAlloc
		2889	jc .err1
6292	pathoswith	2890	mov eax, [ebp+NTFS.fileDataStart]
6080	pathoswith	2891	pop edi
		2892	pop edx
		2893	cmp edx, eax
		2894	jnz .newEntry
		2895	pop edx
		2896	pop edi
		2897	pop [ebp+NTFS.fileDataStart]
		2898	mov [esp], eax
		2899	push [ebp+NTFS.fileDataSize]
		2900	add [ebp+NTFS.fileDataSize], edx
		2901	jmp @f
		2902
		2903	.newEntry:
		2904	add esp, 12
		2905	pop edx
		2906	push eax
		2907	push [ebp+NTFS.fileDataSize]
		2908	sub eax, edx
		2909	mov [ebp+NTFS.fileDataStart], eax
		2910	@@:
6273	pathoswith	2911	mov esi, [ebp+NTFS.attr_offs]
6080	pathoswith	2912	call createMcbEntry
6292	pathoswith	2913	pop [ebp+NTFS.fileDataSize]
		2914	pop [ebp+NTFS.fileDataStart]
		2915	movi eax, ERROR_UNSUPPORTED_FS
6151	pathoswith	2916	.done:
		2917	ret
		2918
6080	pathoswith	2919	.err1:
		2920	add esp, 24
		2921	stc
6292	pathoswith	2922	.err2:
6151	pathoswith	2923	movi eax, ERROR_DISK_FULL
6080	pathoswith	2924	ret
		2925
6292	pathoswith	2926	.err3:
		2927	movi eax, ERROR_FS_FAIL
		2928	add esp, 20
		2929	stc
6080	pathoswith	2930	ret
		2931
		2932	.shrinkAttribute:
		2933	add ecx, edi
		2934	inc ecx
		2935	add esi, eax
		2936	xor edi, edi
		2937	sub esp, 20
		2938	@@:
		2939	mov [esp+16], esi
		2940	call ntfs_decode_mcb_entry
		2941	jnc .err3
		2942	add edi, [esp+8]
		2943	sub ecx, [esp]
		2944	jnc @b
		2945	mov ebx, ecx
		2946	add ecx, [esp]
		2947	mov eax, [esp+8]
		2948	mov [ebp+NTFS.fileDataSize], ecx
		2949	mov [ebp+NTFS.fileDataStart], eax
		2950	push edi
		2951	add edi, ecx
		2952	neg ebx
		2953	call ntfsSpaceFree
		2954	pop edi
		2955	jc .end
		2956	@@:
		2957	call ntfs_decode_mcb_entry
		2958	jnc .end
		2959	cmp dword[esp+8], 0
		2960	jz @b
		2961	add edi, [esp+8]
		2962	mov ebx, [esp]
		2963	call ntfsSpaceFree
		2964	jnc @b
		2965	.end:
		2966	add esp, 16
		2967	pop edi
		2968	cmp [ebp+NTFS.fileDataSize], 0
		2969	jz @f
6273	pathoswith	2970	mov esi, [ebp+NTFS.attr_offs]
6080	pathoswith	2971	call createMcbEntry
6107	pathoswith	2972	mov [ebp+NTFS.fileDataSize], 0
6080	pathoswith	2973	@@:
		2974	ret
		2975
6151	pathoswith	2976	.resident:
		2977	test edx, edx
		2978	jnz .nonResident
		2979	cmp eax, 8000h
		2980	jnc .nonResident
		2981	add ax, [esi+attributeOffset]
		2982	sub eax, [esi+sizeWithHeader]
		2983	jc @f
		2984	mov edi, [ebp+NTFS.frs_buffer]
		2985	mov ecx, eax
		2986	add ecx, [edi+recordRealSize]
		2987	cmp [edi+recordAllocatedSize], ecx
		2988	jc .nonResident
		2989	add eax, 7
		2990	and eax, not 7
		2991	add [edi+recordRealSize], eax
		2992	add edi, [edi+recordRealSize]
		2993	add [esi+sizeWithHeader], eax
		2994	add esi, [esi+sizeWithHeader]
		2995	mov ecx, edi
		2996	sub ecx, esi
		2997	shr ecx, 2
		2998	sub edi, 4
		2999	mov esi, edi
		3000	sub esi, eax
		3001	std
		3002	rep movsd
		3003	mov ecx, eax
		3004	shr ecx, 2
		3005	xor eax, eax
		3006	rep stosd
		3007	cld
6273	pathoswith	3008	mov esi, [ebp+NTFS.attr_offs]
6151	pathoswith	3009	@@:
6273	pathoswith	3010	mov eax, dword [ebp+NTFS.attr_size]
6151	pathoswith	3011	mov [esi+sizeWithoutHeader], eax
		3012	mov [ebp+NTFS.fileDataSize], 0
		3013	clc
		3014	ret
		3015
		3016	.nonResident: ; convert resident to non-resident
6273	pathoswith	3017	mov eax, dword [ebp+NTFS.attr_size]
6151	pathoswith	3018	sub eax, 1
		3019	sbb edx, 0
		3020	mov ecx, [ebp+NTFS.sectors_per_cluster]
		3021	shl ecx, 9
		3022	div ecx
		3023	inc eax
		3024	mov [ebp+NTFS.fileDataSize], eax
		3025	mov edi, [ebp+NTFS.BitmapStart]
		3026	push ecx
		3027	call ntfsSpaceAlloc
		3028	pop ecx
6292	pathoswith	3029	jc .err2
6273	pathoswith	3030	mov esi, [ebp+NTFS.attr_offs]
6151	pathoswith	3031	xor eax, eax
		3032	xor edx, edx
		3033	@@:
		3034	add eax, ecx
		3035	inc edx
		3036	cmp eax, [esi+sizeWithoutHeader]
		3037	jc @b
		3038	push edx
		3039	push eax
		3040	stdcall kernel_alloc, eax
		3041	mov ecx, [esp]
		3042	shr ecx, 2
		3043	mov edi, eax
		3044	mov ebx, eax
		3045	xor eax, eax
		3046	rep stosd
		3047	mov al, [esi+attributeOffset]
		3048	mov ecx, [esi+sizeWithoutHeader]
		3049	add esi, eax
		3050	mov edi, ebx
		3051	rep movsb
		3052	mov eax, [ebp+NTFS.fileDataStart]
		3053	mul [ebp+NTFS.sectors_per_cluster]
		3054	pop ecx
		3055	shr ecx, 9
		3056	call fs_write64_app
6292	pathoswith	3057	stdcall kernel_free, ebx
6273	pathoswith	3058	mov esi, [ebp+NTFS.attr_offs]
6151	pathoswith	3059	add esi, [esi+sizeWithHeader]
		3060	mov ecx, [ebp+NTFS.frs_buffer]
		3061	add ecx, [ecx+recordRealSize]
		3062	sub ecx, esi
		3063	shr ecx, 2
6273	pathoswith	3064	lea edi, [ebp+NTFS.bitmap_buf]
6151	pathoswith	3065	push ecx
		3066	rep movsd
6273	pathoswith	3067	mov edi, [ebp+NTFS.attr_offs]
6151	pathoswith	3068	add edi, 16
		3069	mov cl, 6
		3070	xor eax, eax
		3071	rep stosd
6273	pathoswith	3072	mov edi, [ebp+NTFS.attr_offs]
6151	pathoswith	3073	mov eax, [ebp+NTFS.fileDataSize]
		3074	dec eax
		3075	mov [edi+lastVCN], eax
		3076	inc eax
		3077	mov ecx, [ebp+NTFS.sectors_per_cluster]
		3078	shl ecx, 9
		3079	mul ecx
		3080	mov byte [edi+sizeWithHeader], 50h
		3081	mov byte [edi+nonResidentFlag], 1
		3082	mov byte [edi+dataRunsOffset], 40h
		3083	mov [edi+attributeAllocatedSize], eax
		3084	mov [edi+attributeAllocatedSize+4], edx
6273	pathoswith	3085	mov eax, dword [ebp+NTFS.attr_size]
		3086	mov edx, dword [ebp+NTFS.attr_size+4]
6151	pathoswith	3087	mov [edi+attributeRealSize], eax
		3088	mov [edi+attributeRealSize+4], edx
		3089	mov [edi+initialDataSize], eax
		3090	mov [edi+initialDataSize+4], edx
		3091	mov esi, edi
		3092	add edi, 40h
		3093	call createMcbEntry
		3094	mov eax, edi
6273	pathoswith	3095	mov edi, [ebp+NTFS.attr_offs]
6151	pathoswith	3096	sub eax, edi
		3097	add eax, 8
		3098	and eax, not 7
		3099	mov [edi+sizeWithHeader], eax
		3100	pop ecx
6273	pathoswith	3101	lea esi, [ebp+NTFS.bitmap_buf]
6151	pathoswith	3102	add edi, eax
		3103	rep movsd
		3104	mov esi, [ebp+NTFS.frs_buffer]
		3105	sub edi, esi
		3106	mov [esi+recordRealSize], edi
		3107	pop edx
		3108	sub [ebp+NTFS.fileDataSize], edx
		3109	add [ebp+NTFS.fileDataStart], edx
6292	pathoswith	3110	ret
6151	pathoswith	3111
		3112	.makeResident: ; convert non-resident to empty resident
		3113	movzx eax, byte [esi+dataRunsOffset]
		3114	mov byte [esi+nonResidentFlag], 0
		3115	mov dword [esi+sizeWithoutHeader], 0
		3116	mov dword [esi+attributeOffset], 18h
		3117	add esi, eax
		3118	xor edi, edi
		3119	sub esp, 16
		3120	@@:
		3121	call ntfs_decode_mcb_entry
		3122	jnc @f
		3123	cmp dword[esp+8], 0
		3124	jz @b
		3125	add edi, [esp+8]
		3126	mov ebx, [esp]
		3127	call ntfsSpaceFree
		3128	jnc @b
		3129	@@:
		3130	add esp, 16
		3131	mov [ebp+NTFS.fileDataSize], 0
		3132	ret
		3133
6107	pathoswith	3134	ntfsSpaceClean:
		3135	; clean up to 16 Mb of disk space
		3136	; in:
		3137	; [ebp+NTFS.fileDataStart] = block to clean
		3138	; [ebp+NTFS.fileDataSize] = block size
		3139	mov eax, [ebp+NTFS.fileDataSize]
		3140	test eax, eax
		3141	jz @f
		3142	mul [ebp+NTFS.sectors_per_cluster]
		3143	cmp eax, 8001h
		3144	jnc @f
		3145	push eax
		3146	shl eax, 9
		3147	stdcall kernel_alloc, eax
		3148	pop ecx
		3149	test eax, eax
		3150	jz @f
		3151	push ecx
		3152	shl ecx, 7
		3153	mov edi, eax
		3154	mov ebx, eax
		3155	xor eax, eax
		3156	rep stosd
		3157	mov eax, [ebp+NTFS.fileDataStart]
		3158	mul [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	3159	mov [ebp+NTFS.LastRead], eax
6107	pathoswith	3160	pop ecx
		3161	call fs_write64_app
		3162	stdcall kernel_free, ebx
		3163	@@:
		3164	ret
		3165
6080	pathoswith	3166	ntfsSpaceAlloc:
6292	pathoswith	3167	; allocate disk space
6080	pathoswith	3168	; in:
		3169	; edi = offset in bitmap to start search from
		3170	; [ebp+NTFS.fileDataSize] = block size in clusters
		3171	; out:
6292	pathoswith	3172	; [ebp+NTFS.fileDataStart] = allocated block starting cluster
6080	pathoswith	3173	; CF=1 -> disk full
		3174	mov ecx, [ebp+NTFS.BitmapBuffer]
		3175	add edi, ecx
		3176	add ecx, [ebp+NTFS.BitmapSize]
		3177	sub ecx, edi
6781	pathoswith	3178	ja @f
		3179	push eax
6080	pathoswith	3180	call bitmapBuffering
6781	pathoswith	3181	pop eax
6080	pathoswith	3182	shl ecx, 2
		3183	@@:
		3184	shr ecx, 2
6781	pathoswith	3185	push ecx
6080	pathoswith	3186	mov eax, [ebp+NTFS.fileDataSize]
		3187	shr eax, 5
		3188	jz .small
6292	pathoswith	3189	mov ebx, eax ; bitmap dwords
6080	pathoswith	3190	.start:
		3191	mov ecx, [ebp+NTFS.BitmapBuffer]
		3192	add ecx, [ebp+NTFS.BitmapSize]
		3193	sub ecx, edi
		3194	shr ecx, 2
		3195	@@:
		3196	xor eax, eax
		3197	repnz scasd ; search for empty dword
		3198	jz @f
		3199	call bitmapBuffering
		3200	jmp @b
		3201	@@:
6292	pathoswith	3202	cmp ecx, ebx
6080	pathoswith	3203	jnc @f
		3204	call bitmapBuffering
		3205	jmp @b
		3206	@@:
		3207	sub edi, 4
6292	pathoswith	3208	mov ecx, ebx
6080	pathoswith	3209	mov esi, edi
		3210	xor eax, eax
		3211	repz scasd ; check following dwords
		3212	jnz .start
		3213	sub esi, 4
		3214	mov eax, [esi]
		3215	xor edx, edx
		3216	bsr edx, eax
		3217	inc edx
		3218	push edx ; starting bit
		3219	push esi ; starting dword
		3220	add esi, 4
		3221	neg edx
		3222	add edx, 32
		3223	mov eax, [ebp+NTFS.fileDataSize]
		3224	sub eax, edx
		3225	mov edx, eax
		3226	shr eax, 5
		3227	shl eax, 2
		3228	add esi, eax
		3229	mov eax, [esi]
		3230	bsf ecx, eax ; check last dword
		3231	jz .done
		3232	and edx, 31
		3233	cmp ecx, edx
		3234	jnc .done
		3235	add esp, 8
		3236	jmp .start
		3237
		3238	@@:
		3239	sub edi, 4
6781	pathoswith	3240	call bitmapBuffering
		3241	push ecx
		3242	.small: ; less than 32 clusters
		3243	pop ecx
		3244	or eax, -1
		3245	repz scasd
		3246	jecxz @b
		3247	push ecx
		3248	mov eax, [edi-4]
6080	pathoswith	3249	not eax
		3250	@@:
6781	pathoswith	3251	bsf ecx, eax ; first 0
		3252	jz .small
6080	pathoswith	3253	not eax
		3254	shr eax, cl
		3255	shl eax, cl
		3256	bsf edx, eax ; next 1
		3257	jz @f
6781	pathoswith	3258	sub edx, ecx
6080	pathoswith	3259	cmp edx, [ebp+NTFS.fileDataSize]
		3260	jnc .got ; fits inside
6781	pathoswith	3261	bsf ecx, eax
6080	pathoswith	3262	not eax
		3263	shr eax, cl
		3264	shl eax, cl
		3265	jmp @b
6781	pathoswith	3266
6080	pathoswith	3267	@@: ; next dword
6781	pathoswith	3268	mov eax, [edi]
6080	pathoswith	3269	bsf edx, eax
		3270	jz .got ; empty
		3271	add edx, 32
6781	pathoswith	3272	sub edx, ecx
6080	pathoswith	3273	cmp edx, [ebp+NTFS.fileDataSize]
6781	pathoswith	3274	jc .small
6080	pathoswith	3275	.got:
6781	pathoswith	3276	sub edi, 4
		3277	push ecx ; starting bit
6080	pathoswith	3278	push edi ; starting dword
		3279	.done: ; mark space
6781	pathoswith	3280	pop edi ecx
6080	pathoswith	3281	cmp ecx, 32
		3282	jc @f
		3283	xor ecx, ecx
6781	pathoswith	3284	add edi, 4
6080	pathoswith	3285	@@:
6781	pathoswith	3286	push ecx edi
		3287	or eax, -1
6080	pathoswith	3288	shr eax, cl
		3289	shl eax, cl
		3290	neg ecx
		3291	add ecx, 32
		3292	sub ecx, [ebp+NTFS.fileDataSize]
		3293	jc @f
		3294	shl eax, cl ; fits inside dword
		3295	shr eax, cl
		3296	or [edi], eax
		3297	jmp .end
		3298
		3299	@@:
		3300	or [edi], eax
		3301	neg ecx
		3302	push ecx
		3303	shr ecx, 5
		3304	add edi, 4
6781	pathoswith	3305	or eax, -1
6080	pathoswith	3306	rep stosd
		3307	pop ecx
		3308	and ecx, 31
		3309	shr eax, cl
		3310	shl eax, cl
		3311	not eax
		3312	or [edi], eax
		3313	.end:
		3314	pop eax
6292	pathoswith	3315	pop ecx
6080	pathoswith	3316	sub eax, [ebp+NTFS.BitmapBuffer]
		3317	shl eax, 3
6292	pathoswith	3318	add eax, ecx
		3319	pop ecx
		3320	mov ecx, [ebp+NTFS.fileDataSize]
		3321	mov [ebp+NTFS.fileDataStart], eax
		3322	add ecx, eax
		3323	add ecx, 4095
		3324	shr ecx, 3+9
		3325	shr eax, 3+9
		3326	sub ecx, eax
		3327	mov ebx, eax
		3328	shl ebx, 9
		3329	add eax, [ebp+NTFS.BitmapLocation]
		3330	add ebx, [ebp+NTFS.BitmapBuffer]
		3331	xor edx, edx
		3332	jmp fs_write64_app
6080	pathoswith	3333
		3334	ntfsSpaceFree:
		3335	; free disk space
		3336	; in:
		3337	; edi = starting cluster
		3338	; ebx = size in clusters
		3339	mov eax, edi
		3340	add eax, ebx
		3341	shr eax, 3
		3342	cmp eax, [ebp+NTFS.BitmapSize]
		3343	jc @f
		3344	add eax, [ebp+NTFS.BitmapBuffer]
		3345	push edi
		3346	mov edi, eax
		3347	call bitmapBuffering
		3348	pop edi
		3349	@@:
		3350	push edi
		3351	mov ecx, edi
		3352	shr edi, 5
		3353	shl edi, 2
		3354	add edi, [ebp+NTFS.BitmapBuffer]
		3355	and ecx, 31
		3356	xor eax, eax
		3357	dec eax
		3358	shr eax, cl
		3359	shl eax, cl
		3360	neg ecx
		3361	add ecx, 32
		3362	sub ecx, ebx
		3363	jc @f
		3364	shl eax, cl ; fits inside dword
		3365	shr eax, cl
		3366	not eax
		3367	and [edi], eax
		3368	jmp .writeBitmap
		3369
		3370	@@:
		3371	not eax
		3372	and [edi], eax
		3373	neg ecx
		3374	push ecx
		3375	shr ecx, 5
		3376	add edi, 4
		3377	xor eax, eax
		3378	rep stosd
		3379	pop ecx
		3380	and ecx, 31
		3381	dec eax
		3382	shr eax, cl
		3383	shl eax, cl
		3384	and [edi], eax
		3385	.writeBitmap:
		3386	pop eax
		3387	mov edi, eax
		3388	lea ecx, [eax+ebx+4095]
		3389	shr eax, 3+9
		3390	shr ecx, 3+9
		3391	sub ecx, eax
		3392	mov ebx, eax
		3393	shl ebx, 9
		3394	add eax, [ebp+NTFS.BitmapLocation]
		3395	add ebx, [ebp+NTFS.BitmapBuffer]
		3396	xor edx, edx
		3397	jmp fs_write64_app
		3398
5954	pathoswith	3399	bitmapBuffering:
		3400	; Extend BitmapBuffer and read next 32kb of bitmap
		3401	; Warning: $Bitmap fragmentation is not foreseen
6080	pathoswith	3402	; in: edi -> position in bitmap buffer
		3403	; out: ecx = number of buffered dwords left
5954	pathoswith	3404	push ebx
		3405	mov eax, [ebp+NTFS.BitmapTotalSize]
		3406	cmp eax, [ebp+NTFS.BitmapSize]
		3407	jz .end
		3408	stdcall alloc_pages, 8
		3409	test eax, eax
		3410	jz .end
		3411	add eax, 3
		3412	mov ebx, [ebp+NTFS.BitmapBuffer]
		3413	add ebx, [ebp+NTFS.BitmapSize]
		3414	push ebx
		3415	mov ecx, 8
		3416	call commit_pages
		3417	mov eax, [ebp+NTFS.BitmapSize]
		3418	shr eax, 9
		3419	add eax, [ebp+NTFS.BitmapLocation]
		3420	pop ebx
		3421	mov ecx, 64
		3422	xor edx, edx
		3423	call fs_read64_app
		3424	test eax, eax
		3425	jnz .err
6781	pathoswith	3426	mov eax, [ebp+NTFS.BitmapSize]
		3427	add eax, 8000h
		3428	cmp [ebp+NTFS.BitmapTotalSize], eax
		3429	jnc @f
5954	pathoswith	3430	mov eax, [ebp+NTFS.BitmapTotalSize]
6781	pathoswith	3431	@@:
5954	pathoswith	3432	mov [ebp+NTFS.BitmapSize], eax
6080	pathoswith	3433	pop ebx
		3434	mov ecx, [ebp+NTFS.BitmapBuffer]
6781	pathoswith	3435	add ecx, eax
6019	pathoswith	3436	sub ecx, edi
6781	pathoswith	3437	jbe bitmapBuffering
5954	pathoswith	3438	shr ecx, 2
		3439	ret
		3440
		3441	.err:
		3442	mov eax, [ebp+NTFS.BitmapBuffer]
		3443	add eax, [ebp+NTFS.BitmapSize]
		3444	mov ecx, 8
		3445	call release_pages
		3446	.end:
6292	pathoswith	3447	add esp, 12 ; ret
6080	pathoswith	3448	stc
		3449	ret
5954	pathoswith	3450
2288	clevermous	3451	;----------------------------------------------------------------
5994	pathoswith	3452	ntfs_WriteFile:
		3453	call ntfs_lock
6468	pathoswith	3454	call ntfs_find_lfn
6019	pathoswith	3455	jc ntfsNotFound
6273	pathoswith	3456	cmp [ebp+NTFS.cur_iRecord], 16
6019	pathoswith	3457	jc ntfsDenied
6420	pathoswith	3458	test dword [eax+fileFlags], 10000001h
		3459	jnz ntfsDenied
6273	pathoswith	3460	cmp [ebp+NTFS.fragmentCount], 1
6080	pathoswith	3461	jnz ntfsUnsupported ; record fragmented
6151	pathoswith	3462	; edit directory node
6080	pathoswith	3463	mov edi, [ebp+NTFS.cur_index_buf]
		3464	cmp dword [edi], 'INDX'
		3465	jz @f
		3466	mov esi, [ebp+NTFS.frs_buffer]
		3467	mov ecx, [esi+recordRealSize]
		3468	shr ecx, 2
		3469	rep movsd
6273	pathoswith	3470	mov esi, [ebp+NTFS.attr_offs]
6080	pathoswith	3471	mov cl, [esi+attributeOffset]
		3472	sub esi, [ebp+NTFS.frs_buffer]
6151	pathoswith	3473	add eax, ecx
		3474	add eax, esi
6080	pathoswith	3475	@@:
6420	pathoswith	3476	mov edi, eax
		3477	mov eax, [ebx+4]
6151	pathoswith	3478	mov edx, [ebx+8]
6420	pathoswith	3479	add eax, [ebx+12]
6151	pathoswith	3480	adc edx, 0
6420	pathoswith	3481	mov [edi+fileRealSize], eax
		3482	mov [edi+fileRealSize+4], edx
		3483	push edx eax ebx
		3484	call ntfsGetTime
		3485	mov [edi+fileModified], eax
		3486	mov [edi+fileModified+4], edx
		3487	mov [edi+recordModified], eax
		3488	mov [edi+recordModified+4], edx
		3489	mov [edi+fileAccessed], eax
		3490	mov [edi+fileAccessed+4], edx
		3491	pop ebx ecx edx
6273	pathoswith	3492	mov eax, [ebp+NTFS.LastRead]
6151	pathoswith	3493	mov [ebp+NTFS.nodeLastRead], eax
6273	pathoswith	3494	mov [ebp+NTFS.cur_attr], 0x80
		3495	mov [ebp+NTFS.cur_offs], 0
		3496	mov [ebp+NTFS.cur_size], 0
5994	pathoswith	3497	call ntfs_read_attr
6080	pathoswith	3498	jc ntfsFail
6420	pathoswith	3499	mov esi, edi
		3500	mov edi, [ebp+NTFS.frs_buffer]
		3501	cmp word [edi+baseRecordReuse], 0
		3502	jnz ntfsUnsupported ; auxiliary record
		3503	mov al, [edi+attributeOffset]
		3504	add edi, eax
		3505	mov al, [edi+attributeOffset]
		3506	add edi, eax
6151	pathoswith	3507	mov eax, ecx
6420	pathoswith	3508	mov ecx, 6
		3509	add esi, fileModified
		3510	add edi, 8
		3511	rep movsd
6273	pathoswith	3512	mov ecx, [ebp+NTFS.attr_offs]
6151	pathoswith	3513	cmp word [ecx+attributeFlags], 0
		3514	jnz ntfsUnsupported
		3515	push ebx
		3516	cmp byte [ecx+nonResidentFlag], 0
		3517	jz .resizeAttribute
5994	pathoswith	3518	cmp edx, [ecx+attributeRealSize+4]
6080	pathoswith	3519	jc .writeNode
		3520	jnz .resizeAttribute
5994	pathoswith	3521	cmp [ecx+attributeRealSize], eax
6080	pathoswith	3522	jnc .writeNode
		3523	.resizeAttribute:
		3524	call resizeAttribute
6107	pathoswith	3525	jc ntfsErrorPop
6273	pathoswith	3526	mov ecx, [ebp+NTFS.attr_offs]
6151	pathoswith	3527	cmp byte [ecx+nonResidentFlag], 1
		3528	jz @f
		3529	mov ebx, [esp]
		3530	movzx edi, byte [ecx+attributeOffset]
		3531	add edi, ecx
		3532	add edi, [ebx+4]
		3533	mov ecx, [ebx+12]
		3534	mov esi, [ebx+16]
		3535	rep movsb
		3536	@@:
6408	pathoswith	3537	mov ebx, [ebp+NTFS.frs_buffer]
		3538	mov edx, [ebp+NTFS.mftLastRead]
6080	pathoswith	3539	call writeRecord ; file
		3540	call ntfs_restore_usa_frs
		3541	.writeNode:
6408	pathoswith	3542	mov ebx, [ebp+NTFS.cur_index_buf]
		3543	mov edx, [ebp+NTFS.nodeLastRead]
6080	pathoswith	3544	call writeRecord ; directory
		3545	pop ebx
6273	pathoswith	3546	mov ecx, [ebp+NTFS.attr_offs]
6151	pathoswith	3547	cmp byte [ecx+nonResidentFlag], 0
		3548	jz .done
		3549	mov ecx, [ebx+12]
		3550	test ecx, ecx
		3551	jz .done
5994	pathoswith	3552	mov eax, [ebx+4]
		3553	mov edx, [ebx+8]
		3554	mov esi, [ebx+16]
		3555	shrd eax, edx, 9
		3556	test dword[ebx+4], 1FFh
		3557	jz .aligned
6273	pathoswith	3558	mov [ebp+NTFS.cur_offs], eax
		3559	mov [ebp+NTFS.cur_size], 1
		3560	lea edi, [ebp+NTFS.bitmap_buf]
		3561	mov [ebp+NTFS.cur_buf], edi
5994	pathoswith	3562	call ntfs_read_attr.continue
6019	pathoswith	3563	jc ntfsDevice
5994	pathoswith	3564	mov eax, [ebx+4]
		3565	and eax, 1FFh
		3566	add edi, eax
6273	pathoswith	3567	sub eax, [ebp+NTFS.cur_read]
5994	pathoswith	3568	neg eax
		3569	push ecx
		3570	cmp ecx, eax
		3571	jb @f
		3572	mov ecx, eax
		3573	@@:
		3574	sub [esp], ecx
		3575	rep movsb
		3576	push ebx
6273	pathoswith	3577	mov eax, [ebp+NTFS.LastRead]
		3578	lea ebx, [ebp+NTFS.bitmap_buf]
5994	pathoswith	3579	mov ecx, 1
		3580	xor edx, edx
		3581	call fs_write64_app
		3582	pop ebx
		3583	pop ecx
		3584	test ecx, ecx
6151	pathoswith	3585	jz .done
5994	pathoswith	3586	mov eax, [ebx+4]
		3587	mov edx, [ebx+8]
		3588	shrd eax, edx, 9
		3589	inc eax
		3590	.aligned:
		3591	push ecx
		3592	shr ecx, 9
6273	pathoswith	3593	mov [ebp+NTFS.cur_offs], eax
		3594	mov [ebp+NTFS.cur_size], ecx
		3595	mov [ebp+NTFS.cur_buf], esi
5994	pathoswith	3596	add eax, ecx
		3597	push eax
6273	pathoswith	3598	mov [ebp+NTFS.bWriteAttr], 1
5994	pathoswith	3599	call ntfs_read_attr.continue
6273	pathoswith	3600	mov [ebp+NTFS.bWriteAttr], 0
		3601	pop [ebp+NTFS.cur_offs]
5994	pathoswith	3602	pop ecx
6019	pathoswith	3603	jc ntfsDevice
5994	pathoswith	3604	and ecx, 1FFh
6151	pathoswith	3605	jz .done
6273	pathoswith	3606	add esi, [ebp+NTFS.cur_read]
		3607	mov [ebp+NTFS.cur_size], 1
		3608	lea edi, [ebp+NTFS.bitmap_buf]
		3609	mov [ebp+NTFS.cur_buf], edi
5994	pathoswith	3610	call ntfs_read_attr.continue
6019	pathoswith	3611	jc ntfsDevice
5994	pathoswith	3612	rep movsb
		3613	push ebx
6273	pathoswith	3614	mov eax, [ebp+NTFS.LastRead]
		3615	lea ebx, [ebp+NTFS.bitmap_buf]
5994	pathoswith	3616	mov ecx, 1
		3617	xor edx, edx
		3618	call fs_write64_app
		3619	pop ebx
6151	pathoswith	3620	.done:
5994	pathoswith	3621	mov ebx, [ebx+12]
6019	pathoswith	3622	jmp ntfsDone
		3623
		3624	;----------------------------------------------------------------
		3625	ntfs_Delete:
		3626	call ntfs_lock
6468	pathoswith	3627	call ntfs_find_lfn
6019	pathoswith	3628	jc ntfsNotFound
6273	pathoswith	3629	cmp [ebp+NTFS.cur_iRecord], 16
6019	pathoswith	3630	jc ntfsDenied
6420	pathoswith	3631	test byte [eax+fileFlags], 1
		3632	jnz ntfsDenied
6273	pathoswith	3633	cmp [ebp+NTFS.fragmentCount], 1
6019	pathoswith	3634	jnz ntfsUnsupported ; record fragmented
6418	pathoswith	3635	mov ebx, [eax+directoryRecordReference]
		3636	mov [ebp+NTFS.newRecord], ebx
		3637	mov bx, [eax+fileReferenceReuse]
		3638	mov [ebp+NTFS.indexPointer], esi
		3639	mov eax, [ebp+NTFS.cur_iRecord]
		3640	shr eax, 3
		3641	cmp eax, [ebp+NTFS.mftBitmapSize]
6019	pathoswith	3642	jnc ntfsUnsupported
6418	pathoswith	3643	; examine file record
		3644	mov [ebp+NTFS.cur_attr], 0x80 ; file?
		3645	mov [ebp+NTFS.cur_offs], 0
		3646	mov [ebp+NTFS.cur_size], 0
		3647	call ntfs_read_attr
		3648	jnc @f
		3649	xor eax, eax
		3650	push ebx eax eax eax eax
		3651	mov [esp+12], esp
		3652	push eax
		3653	mov ebx, esp
		3654	mov [ebp+NTFS.cur_attr], 0x90 ; folder?
		3655	call ntfs_ReadFolder.doit
		3656	mov edx, [esp+12]
		3657	add esp, 20
		3658	pop ebx
		3659	test eax, eax
		3660	jnz .ret
		3661	cmp edx, 2
		3662	jnz ntfsDenied ; folder is not empty
6401	pathoswith	3663	mov [ebp+NTFS.cur_attr], 0xA0
6418	pathoswith	3664	mov [ebp+NTFS.cur_offs], 0
		3665	mov [ebp+NTFS.cur_size], 0
6401	pathoswith	3666	call ntfs_read_attr.newAttribute
6418	pathoswith	3667	jc .deleteFileRecord
6401	pathoswith	3668	@@:
6418	pathoswith	3669	mov esi, [ebp+NTFS.frs_buffer]
		3670	cmp word [esi+baseRecordReuse], 0
		3671	jnz ntfsUnsupported ; auxiliary record
		3672	cmp word [esi+reuseCounter], bx
		3673	jnz .backToIndex ; broken index
6420	pathoswith	3674	test byte [esi+recordFlags], 1
6418	pathoswith	3675	jz .writeBitmapMFT ; record deleted
		3676	cmp byte [esi+hardLinkCounter], 3
		3677	jnc ntfsUnsupported
		3678	mov esi, [ebp+NTFS.attr_offs]
		3679	cmp byte [esi+nonResidentFlag], 0
		3680	jz .deleteFileRecord
		3681	movzx eax, byte [esi+dataRunsOffset]
6401	pathoswith	3682	add esi, eax
6418	pathoswith	3683	xor edi, edi
		3684	sub esp, 16
		3685	@@:
		3686	call ntfs_decode_mcb_entry
		3687	jnc @f
		3688	cmp dword[esp+8], 0
6401	pathoswith	3689	jz @b
6418	pathoswith	3690	add edi, [esp+8]
		3691	mov ebx, [esp]
		3692	call ntfsSpaceFree
		3693	jnc @b
		3694	@@:
		3695	add esp, 16
		3696	.deleteFileRecord:
		3697	mov ebx, [ebp+NTFS.frs_buffer]
		3698	mov byte [ebx+recordFlags], 0
		3699	mov edx, [ebp+NTFS.mftLastRead]
		3700	call writeRecord
		3701	.writeBitmapMFT:
		3702	mov eax, [ebp+NTFS.cur_iRecord]
		3703	mov ecx, eax
		3704	shr eax, 3
		3705	and ecx, 7
		3706	mov edi, [ebp+NTFS.mftBitmapBuffer]
		3707	btr [edi+eax], ecx
		3708	shr eax, 9
		3709	mov ebx, eax
		3710	shl ebx, 9
		3711	add eax, [ebp+NTFS.mftBitmapLocation]
		3712	add ebx, edi
		3713	mov ecx, 1
		3714	xor edx, edx
		3715	call fs_write64_sys
		3716	.backToIndex:
		3717	mov eax, [ebp+NTFS.newRecord]
		3718	mov [ebp+NTFS.cur_iRecord], eax
		3719	mov esi, [ebp+NTFS.indexPointer]
6468	pathoswith	3720	call ntfs_find_lfn.doit2
6418	pathoswith	3721	jc ntfsFail
		3722	mov ebx, [ebp+NTFS.secondIndexBuffer]
		3723	mov byte [ebx], 0
		3724	mov ebx, [ebp+NTFS.LastRead]
		3725	mov [ebp+NTFS.nodeLastRead], ebx
		3726	xor ebx, ebx
		3727	test byte [eax+indexFlags], 1
		3728	jz .deleteIndex ; no subnode
		3729	mov edi, eax
		3730	call .findSubindex
		3731	jc ntfsFail
6401	pathoswith	3732	movzx edx, word [edi+indexAllocatedSize]
6418	pathoswith	3733	test esi, esi
		3734	jz @f
6401	pathoswith	3735	sub edx, eax
		3736	sub edx, 8
6418	pathoswith	3737	@@:
		3738	mov eax, edi
6401	pathoswith	3739	mov ebx, esi
		3740	jmp @f
		3741
		3742	.deleteIndex:
		3743	movzx edx, word [eax+indexAllocatedSize]
6107	pathoswith	3744	mov ecx, [eax+fileRecordReference]
		3745	cmp [eax+edx+fileRecordReference], ecx
		3746	jnz @f
		3747	add dx, [eax+edx+indexAllocatedSize]
		3748	@@:
6019	pathoswith	3749	mov edi, [ebp+NTFS.cur_index_buf]
		3750	cmp dword [edi], 'INDX'
		3751	jz .indexRecord
6418	pathoswith	3752	sub eax, edi
6401	pathoswith	3753	mov edi, [ebp+NTFS.indexRoot]
6019	pathoswith	3754	sub [edi+sizeWithHeader], edx
		3755	sub [edi+sizeWithoutHeader], edx
6418	pathoswith	3756	movzx ecx, byte [edi+attributeOffset]
6019	pathoswith	3757	add edi, ecx
6418	pathoswith	3758	add eax, edi
6273	pathoswith	3759	sub [edi+rootNode+nodeRealSize], edx
		3760	sub [edi+rootNode+nodeAllocatedSize], edx
6418	pathoswith	3761	mov edi, [ebp+NTFS.frs_buffer]
		3762	sub [edi+recordRealSize], edx
		3763	mov ecx, [edi+recordRealSize]
		3764	cmp [edi+recordAllocatedSize], ecx
6019	pathoswith	3765	jmp @f
2288	clevermous	3766
6019	pathoswith	3767	.indexRecord:
6401	pathoswith	3768	add edi, recordNode
		3769	sub [edi+nodeRealSize], edx
		3770	mov ecx, [edi+nodeRealSize]
		3771	cmp [edi+nodeAllocatedSize], ecx
6418	pathoswith	3772	@@:
6401	pathoswith	3773	jc ntfsUnsupported
6418	pathoswith	3774	add ecx, edi
6019	pathoswith	3775	sub ecx, eax
		3776	mov esi, eax
		3777	add esi, edx
		3778	mov edi, eax
6401	pathoswith	3779	test edx, edx
		3780	jns @f
		3781	neg edx
		3782	add edx, ecx
		3783	sub edx, 4
		3784	add esi, edx
		3785	add edi, edx
		3786	std
		3787	@@:
		3788	jz @f
		3789	shr ecx, 2
6019	pathoswith	3790	rep movsd
6401	pathoswith	3791	cld
		3792	@@:
		3793	test ebx, ebx
6418	pathoswith	3794	jz .done
6401	pathoswith	3795	; copy index from the subnode to replace deleted pointing index
		3796	movzx ecx, word [ebx+indexAllocatedSize]
		3797	mov edx, ecx
6418	pathoswith	3798	test byte [ebx+indexFlags], 1
		3799	jz @f
		3800	sub ecx, 8
		3801	movzx edi, word [ebx+edx+indexAllocatedSize]
		3802	add edi, edx
		3803	mov esi, [ebx+ecx]
		3804	mov [ebx+edi-8], esi
		3805	mov [ebx+indexAllocatedSize], cx
		3806	@@:
6401	pathoswith	3807	shr ecx, 2
		3808	mov esi, ebx
		3809	mov edi, eax
		3810	rep movsd
		3811	add word [eax+indexAllocatedSize], 8
		3812	mov byte [eax+indexFlags], 1
6418	pathoswith	3813	mov edi, [ebp+NTFS.secondIndexBuffer]
6401	pathoswith	3814	mov eax, ebx
		3815	xor ebx, ebx
		3816	jmp .indexRecord
		3817
6418	pathoswith	3818	.done:
6408	pathoswith	3819	mov ebx, [ebp+NTFS.frs_buffer]
6418	pathoswith	3820	mov edx, [ebp+NTFS.rootLastRead]
6019	pathoswith	3821	call writeRecord
6408	pathoswith	3822	mov ebx, [ebp+NTFS.cur_index_buf]
6418	pathoswith	3823	cmp dword [ebx], 'INDX'
		3824	jnz @f
6408	pathoswith	3825	mov edx, [ebp+NTFS.nodeLastRead]
6401	pathoswith	3826	call writeRecord
6418	pathoswith	3827	@@:
6408	pathoswith	3828	mov ebx, [ebp+NTFS.secondIndexBuffer]
		3829	cmp byte [ebx], 0
6401	pathoswith	3830	jz ntfsDone
6418	pathoswith	3831	mov edx, [ebp+NTFS.LastRead]
6019	pathoswith	3832	call writeRecord
6080	pathoswith	3833	jmp ntfsDone
6019	pathoswith	3834
6418	pathoswith	3835	.findSubindex:
		3836	; in: eax -> index
		3837	; out:
		3838	; CF=1 -> error
		3839	; esi=0 -> subnode deleted
		3840	; esi -> replacement index
		3841	; eax = index effective size
		3842	movzx edx, word [eax+indexAllocatedSize]
		3843	mov eax, [eax+edx-8]
		3844	mov edx, [ebp+NTFS.cur_size]
		3845	push edx
		3846	cmp edx, [ebp+NTFS.cur_subnode_size]
		3847	jz @f
		3848	mul [ebp+NTFS.sectors_per_cluster]
		3849	@@:
		3850	mov [ebp+NTFS.cur_attr], 0xA0
		3851	mov [ebp+NTFS.cur_offs], eax
		3852	push eax
		3853	mov ebx, [ebp+NTFS.secondIndexBuffer]
		3854	mov esi, ebx
		3855	mov [ebp+NTFS.cur_buf], ebx
		3856	call ntfs_read_attr.newAttribute
		3857	pop [ebp+NTFS.cur_offs]
		3858	pop eax
		3859	jc .ret
		3860	cmp dword [esi], 'INDX'
		3861	stc
		3862	jnz .ret
		3863	mov [ebp+NTFS.cur_size], eax
		3864	shl eax, 9
		3865	call ntfs_restore_usa
		3866	jc .ret
		3867	add esi, recordNode
		3868	add esi, [esi+indexOffset]
		3869	test byte [esi+indexFlags], 2
		3870	jnz .emptyNode
		3871	cmp [ebp+NTFS.fragmentCount], 1
		3872	stc
		3873	jnz .ret ; record fragmented
		3874	xor eax, eax
		3875	@@:
		3876	add esi, eax
		3877	mov ax, [esi+indexAllocatedSize]
		3878	test byte [esi+eax+indexFlags], 2
		3879	jz @b
		3880	test byte [esi+indexFlags], 1
		3881	jz .ret
		3882	add eax, esi
		3883	push esi
		3884	push [ebp+NTFS.cur_offs]
		3885	call .findSubindex
		3886	pop [ebp+NTFS.cur_offs]
		3887	pop edx
		3888	jc .ret
		3889	test esi, esi
		3890	jnz .ret
		3891	mov esi, edx
		3892	mov ebx, [ebp+NTFS.secondIndexBuffer]
		3893	mov [ebp+NTFS.cur_buf], ebx
		3894	push [ebp+NTFS.cur_size]
		3895	call ntfs_read_attr.continue
		3896	pop eax
		3897	jc .ret
		3898	shl eax, 9
		3899	call ntfs_restore_usa
		3900	jc .ret
		3901	movzx eax, word [esi+indexAllocatedSize]
		3902	sub eax, 8
		3903	.ret:
		3904	ret
		3905
		3906	.emptyNode:
		3907	test byte [esi+indexFlags], 1
		3908	jz @f
		3909	mov eax, esi
		3910	push [ebp+NTFS.cur_offs]
		3911	call .findSubindex
		3912	pop [ebp+NTFS.cur_offs]
		3913	jc .ret
		3914	test esi, esi
		3915	jnz .ret
		3916	@@: ; delete node
		3917	mov esi, [ebp+NTFS.attr_offs]
		3918	add esi, [esi+sizeWithHeader]
		3919	cmp byte [esi], 0xB0
		3920	stc
		3921	jnz .ret
		3922	movzx eax, byte [esi+attributeOffset]
		3923	add esi, eax
		3924	mov eax, [ebp+NTFS.cur_offs]
		3925	xor edx, edx
		3926	div [ebp+NTFS.cur_size]
		3927	mov edx, eax
		3928	shr eax, 3
		3929	and edx, 7
		3930	btr [esi+eax], edx
		3931	mov esi, [ebp+NTFS.secondIndexBuffer]
		3932	mov byte [esi], 0
		3933	xor esi, esi
		3934	ret
		3935
5954	pathoswith	3936	;----------------------------------------------------------------
3742	clevermous	3937	ntfs_SetFileEnd:
6107	pathoswith	3938	call ntfs_lock
6468	pathoswith	3939	call ntfs_find_lfn
6107	pathoswith	3940	jc ntfsNotFound
6273	pathoswith	3941	cmp [ebp+NTFS.cur_iRecord], 16
6107	pathoswith	3942	jc ntfsDenied
6420	pathoswith	3943	test dword [eax+fileFlags], 10000001h
		3944	jnz ntfsDenied
6273	pathoswith	3945	cmp [ebp+NTFS.fragmentCount], 1
6107	pathoswith	3946	jnz ntfsUnsupported ; record fragmented
6151	pathoswith	3947	; edit directory node
6107	pathoswith	3948	mov edi, [ebp+NTFS.cur_index_buf]
		3949	cmp dword [edi], 'INDX'
		3950	jz @f
		3951	mov esi, [ebp+NTFS.frs_buffer]
		3952	mov ecx, [esi+recordRealSize]
		3953	shr ecx, 2
		3954	rep movsd
6273	pathoswith	3955	mov esi, [ebp+NTFS.attr_offs]
6107	pathoswith	3956	mov cl, [esi+attributeOffset]
		3957	sub esi, [ebp+NTFS.frs_buffer]
		3958	add eax, ecx
		3959	add eax, esi
		3960	@@:
6420	pathoswith	3961	mov edi, eax
		3962	mov eax, [ebx+4]
6107	pathoswith	3963	mov edx, [ebx+8]
6420	pathoswith	3964	mov [edi+fileRealSize], eax
		3965	mov [edi+fileRealSize+4], edx
		3966	push edx eax ebx
		3967	call ntfsGetTime
		3968	mov [edi+fileModified], eax
		3969	mov [edi+fileModified+4], edx
		3970	mov [edi+recordModified], eax
		3971	mov [edi+recordModified+4], edx
		3972	mov [edi+fileAccessed], eax
		3973	mov [edi+fileAccessed+4], edx
		3974	pop ebx ecx edx
6273	pathoswith	3975	mov eax, [ebp+NTFS.LastRead]
6107	pathoswith	3976	mov [ebp+NTFS.nodeLastRead], eax
6273	pathoswith	3977	mov [ebp+NTFS.cur_attr], 0x80
		3978	mov [ebp+NTFS.cur_offs], 0
		3979	mov [ebp+NTFS.cur_size], 0
6107	pathoswith	3980	call ntfs_read_attr
		3981	jc ntfsFail
6420	pathoswith	3982	mov esi, edi
		3983	mov edi, [ebp+NTFS.frs_buffer]
		3984	cmp word [edi+baseRecordReuse], 0
		3985	jnz ntfsUnsupported ; auxiliary record
		3986	mov al, [edi+attributeOffset]
		3987	add edi, eax
		3988	mov al, [edi+attributeOffset]
		3989	add edi, eax
6107	pathoswith	3990	mov eax, ecx
6420	pathoswith	3991	mov ecx, 6
		3992	add esi, fileModified
		3993	add edi, 8
		3994	rep movsd
6273	pathoswith	3995	mov ecx, [ebp+NTFS.attr_offs]
6151	pathoswith	3996	cmp word [ecx+attributeFlags], 0
		3997	jnz ntfsUnsupported
		3998	cmp byte [ecx+nonResidentFlag], 0
		3999	jz .resizeAttribute
6107	pathoswith	4000	cmp [ecx+attributeRealSize+4], edx
		4001	jnz .resizeAttribute
		4002	cmp [ecx+attributeRealSize], eax
		4003	jnc .resizeAttribute
		4004	mov eax, [ecx+attributeRealSize]
		4005	mov ecx, [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	4006	mov [ebp+NTFS.cur_size], ecx
6107	pathoswith	4007	shl ecx, 9
		4008	div ecx
		4009	test edx, edx
		4010	jz .aligned
		4011	push edx
		4012	push ecx
		4013	mul [ebp+NTFS.sectors_per_cluster]
6273	pathoswith	4014	mov [ebp+NTFS.cur_offs], eax
6107	pathoswith	4015	stdcall kernel_alloc, ecx
		4016	pop ecx
		4017	pop edi
6405	pathoswith	4018	mov esi, eax
6107	pathoswith	4019	sub ecx, edi
		4020	add edi, eax
6273	pathoswith	4021	mov [ebp+NTFS.cur_buf], eax
6107	pathoswith	4022	call ntfs_read_attr.continue
		4023	jc @f
		4024	xor eax, eax
		4025	rep stosb
		4026	push ebx
6273	pathoswith	4027	mov eax, [ebp+NTFS.LastRead]
6405	pathoswith	4028	mov ebx, esi
6107	pathoswith	4029	mov ecx, [ebp+NTFS.sectors_per_cluster]
		4030	xor edx, edx
		4031	call fs_write64_app
		4032	pop ebx
		4033	@@:
6405	pathoswith	4034	stdcall kernel_free, esi
6107	pathoswith	4035	.aligned:
		4036	mov eax, [ebx+4]
		4037	mov edx, [ebx+8]
		4038	.resizeAttribute:
		4039	call resizeAttribute
		4040	jc ntfsError
6408	pathoswith	4041	mov ebx, [ebp+NTFS.frs_buffer]
		4042	mov edx, [ebp+NTFS.mftLastRead]
6107	pathoswith	4043	call writeRecord ; file
6408	pathoswith	4044	mov ebx, [ebp+NTFS.cur_index_buf]
		4045	mov edx, [ebp+NTFS.nodeLastRead]
6107	pathoswith	4046	call writeRecord ; directory
		4047	call ntfsSpaceClean
		4048	jmp ntfsDone
		4049
6462	pathoswith	4050	ntfsGetTime:
		4051	call fsGetTime
		4052	jmp @f
2288	clevermous	4053
6420	pathoswith	4054	ntfsCalculateTime:
		4055	; in: esi -> data block
6462	pathoswith	4056	; out: edx:eax = seconds since 01.01.1601 x10000000
		4057	call fsCalculateTime
6420	pathoswith	4058	@@:
6462	pathoswith	4059	mov edx, 10000000
6420	pathoswith	4060	mul edx
6462	pathoswith	4061	add eax, 3365781504
		4062	adc edx, 29389701
6420	pathoswith	4063	ret
		4064
3742	clevermous	4065	;----------------------------------------------------------------
6420	pathoswith	4066	ntfs_SetFileInfo:
3742	clevermous	4067	call ntfs_lock
6468	pathoswith	4068	call ntfs_find_lfn
6420	pathoswith	4069	jnc @f
3742	clevermous	4070	test eax, eax
6019	pathoswith	4071	jz ntfsFail
		4072	jmp ntfsNotFound
2288	clevermous	4073
6420	pathoswith	4074	@@:
		4075	cmp [ebp+NTFS.fragmentCount], 1
		4076	jnz ntfsUnsupported ; record fragmented
		4077	mov esi, [ebp+NTFS.cur_index_buf]
		4078	cmp dword [esi], 'INDX'
		4079	jz @f
		4080	sub eax, esi
		4081	mov esi, [ebp+NTFS.indexRoot]
		4082	movzx edx, byte [esi+attributeOffset]
		4083	add eax, esi
		4084	add eax, edx
		4085	@@:
		4086	mov esi, [ebx+16]
		4087	mov edi, eax
		4088	mov eax, [esi]
		4089	and eax, 27h
		4090	and byte [edi+fileFlags], -28h
		4091	or [edi+fileFlags], al
		4092	add esi, 8
		4093	call ntfsCalculateTime
		4094	mov [edi+fileCreated], eax
		4095	mov [edi+fileCreated+4], edx
		4096	add esi, 8
		4097	call ntfsCalculateTime
		4098	mov [edi+fileAccessed], eax
		4099	mov [edi+fileAccessed+4], edx
		4100	add esi, 8
		4101	call ntfsCalculateTime
		4102	mov [edi+fileModified], eax
		4103	mov [edi+fileModified+4], edx
		4104	mov ebx, [ebp+NTFS.cur_index_buf]
		4105	cmp dword [ebx], 'INDX'
		4106	jz @f
		4107	mov ebx, [ebp+NTFS.frs_buffer]
		4108	@@:
		4109	mov edx, [ebp+NTFS.LastRead]
		4110	call writeRecord
		4111	jmp ntfsDone
		4112
6019	pathoswith	4113	ntfsUnsupported:
		4114	push ERROR_UNSUPPORTED_FS
6080	pathoswith	4115	jmp ntfsOut
6019	pathoswith	4116	ntfsDevice:
		4117	push ERROR_DEVICE
		4118	jmp ntfsOut
		4119	ntfsNotFound:
		4120	push ERROR_FILE_NOT_FOUND
		4121	jmp ntfsOut
		4122	ntfsDenied:
		4123	push ERROR_ACCESS_DENIED
		4124	jmp ntfsOut
		4125	ntfsFail:
		4126	push ERROR_FS_FAIL
		4127	jmp ntfsOut
6080	pathoswith	4128	ntfsDiskFull:
		4129	push ERROR_DISK_FULL
		4130	jmp ntfsOut
6414	pathoswith	4131	ntfsErrorPop5:
		4132	pop ebx
		4133	pop ebx
6340	pathoswith	4134	ntfsErrorPop3:
		4135	pop ebx
6107	pathoswith	4136	ntfsErrorPop2:
		4137	pop ebx
		4138	ntfsErrorPop:
		4139	pop ebx
6080	pathoswith	4140	ntfsError:
		4141	push eax
		4142	ntfsOut:
		4143	call ntfs_unlock
		4144	xor ebx, ebx
		4145	pop eax
		4146	ret

Subversion Repositories Kolibri OS

(root)/kernel/trunk/fs/ntfs.inc – Rev 6876