Rev 256 | Rev 262 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
Rev 256 | Rev 257 | ||
---|---|---|---|
Line 290... | Line 290... | ||
290 | 290 | ||
291 | ntfs_attr_iRecord dd ? |
291 | ntfs_attr_iRecord dd ? |
292 | ntfs_attr_iBaseRecord dd ? |
292 | ntfs_attr_iBaseRecord dd ? |
293 | ntfs_attr_offs dd ? |
293 | ntfs_attr_offs dd ? |
- | 294 | ntfs_attr_list dd ? |
|
294 | ntfs_attr_list dd ? |
295 | ntfs_attr_size dq ? |
Line 295... | Line 296... | ||
295 | endg |
296 | endg |
296 | 297 | ||
297 | ntfs_read_attr: |
298 | ntfs_read_attr: |
Line 387... | Line 388... | ||
387 | ; 1. Read file record. |
388 | ; 1. Read file record. |
388 | ; N.B. This will do recursive call of read_attr for $MFT::$Data. |
389 | ; N.B. This will do recursive call of read_attr for $MFT::$Data. |
389 | mov eax, [ntfs_cur_iRecord] |
390 | mov eax, [ntfs_cur_iRecord] |
390 | mov [ntfs_attr_iRecord], eax |
391 | mov [ntfs_attr_iRecord], eax |
391 | and [ntfs_attr_list], 0 |
392 | and [ntfs_attr_list], 0 |
- | 393 | or dword [ntfs_attr_size], -1 |
|
- | 394 | or dword [ntfs_attr_size+4], -1 |
|
392 | or [ntfs_attr_iBaseRecord], -1 |
395 | or [ntfs_attr_iBaseRecord], -1 |
393 | call ntfs_read_file_record |
396 | call ntfs_read_file_record |
394 | test eax, eax |
397 | test eax, eax |
395 | jz .errret |
398 | jz .errret |
396 | ; 2. Find required attribute. |
399 | ; 2. Find required attribute. |
Line 467... | Line 470... | ||
467 | @@: |
470 | @@: |
468 | push [ntfs_cur_offs] |
471 | push [ntfs_cur_offs] |
469 | push [ntfs_cur_size] |
472 | push [ntfs_cur_size] |
470 | push [ntfs_cur_read] |
473 | push [ntfs_cur_read] |
471 | push [ntfs_cur_buf] |
474 | push [ntfs_cur_buf] |
- | 475 | push dword [ntfs_attr_size] |
|
- | 476 | push dword [ntfs_attr_size+4] |
|
- | 477 | or dword [ntfs_attr_size], -1 |
|
- | 478 | or dword [ntfs_attr_size+4], -1 |
|
472 | xor edx, edx |
479 | xor edx, edx |
473 | mov [ntfs_cur_offs], edx |
480 | mov [ntfs_cur_offs], edx |
474 | mov [ntfs_cur_size], 2 |
481 | mov [ntfs_cur_size], 2 |
475 | and [ntfs_cur_read], 0 |
482 | and [ntfs_cur_read], 0 |
476 | mov [ntfs_cur_buf], ntfs_attrlist_buf |
483 | mov [ntfs_cur_buf], ntfs_attrlist_buf |
477 | push edx |
484 | push edx |
478 | call .doreadattr |
485 | call .doreadattr |
479 | pop edx |
486 | pop edx |
- | 487 | pop dword [ntfs_attr_size+4] |
|
- | 488 | pop dword [ntfs_attr_size] |
|
480 | mov ebp, [ntfs_cur_read] |
489 | mov ebp, [ntfs_cur_read] |
481 | pop [ntfs_cur_buf] |
490 | pop [ntfs_cur_buf] |
482 | pop [ntfs_cur_read] |
491 | pop [ntfs_cur_read] |
483 | pop [ntfs_cur_size] |
492 | pop [ntfs_cur_size] |
484 | pop [ntfs_cur_offs] |
493 | pop [ntfs_cur_offs] |
Line 498... | Line 507... | ||
498 | add esi, ecx |
507 | add esi, ecx |
499 | jmp .scanlist |
508 | jmp .scanlist |
500 | @@: |
509 | @@: |
501 | push eax |
510 | push eax |
502 | mov eax, [esi+8] |
511 | mov eax, [esi+8] |
- | 512 | test eax, eax |
|
- | 513 | jnz .testf |
|
- | 514 | mov eax, dword [ntfs_attr_size] |
|
- | 515 | and eax, dword [ntfs_attr_size+4] |
|
- | 516 | cmp eax, -1 |
|
- | 517 | jnz .testfz |
|
- | 518 | ; if attribute is in auxiliary records, its size is defined only in first |
|
- | 519 | mov eax, [esi+10h] |
|
- | 520 | call ntfs_read_file_record |
|
- | 521 | test eax, eax |
|
- | 522 | jnz @f |
|
- | 523 | .errret_pop: |
|
- | 524 | pop eax |
|
- | 525 | jmp .errret |
|
- | 526 | @@: |
|
- | 527 | mov eax, [ntfs_data.frs_buffer] |
|
- | 528 | movzx ecx, word [eax+14h] |
|
- | 529 | add eax, ecx |
|
- | 530 | mov ecx, [ntfs_cur_attr] |
|
- | 531 | @@: |
|
- | 532 | cmp dword [eax], -1 |
|
- | 533 | jz .errret_pop |
|
- | 534 | cmp dword [eax], ecx |
|
- | 535 | jz @f |
|
- | 536 | add eax, [eax+4] |
|
- | 537 | jmp @b |
|
- | 538 | @@: |
|
- | 539 | cmp byte [eax+8], 0 |
|
- | 540 | jnz .sdnores |
|
- | 541 | mov eax, [eax+10h] |
|
- | 542 | mov dword [ntfs_attr_size], eax |
|
- | 543 | and dword [ntfs_attr_size+4], 0 |
|
- | 544 | jmp .testfz |
|
- | 545 | .sdnores: |
|
- | 546 | mov ecx, [eax+30h] |
|
- | 547 | mov dword [ntfs_attr_size], ecx |
|
- | 548 | mov ecx, [eax+34h] |
|
- | 549 | mov dword [ntfs_attr_size+4], ecx |
|
- | 550 | .testfz: |
|
- | 551 | xor eax, eax |
|
- | 552 | .testf: |
|
503 | imul eax, [ntfs_data.sectors_per_cluster] |
553 | imul eax, [ntfs_data.sectors_per_cluster] |
504 | cmp eax, [ntfs_cur_offs] |
554 | cmp eax, [ntfs_cur_offs] |
505 | pop eax |
555 | pop eax |
506 | ja @f |
556 | ja @f |
507 | mov edi, [esi+10h] ; keep previous iRecord |
557 | mov edi, [esi+10h] ; keep previous iRecord |
508 | jmp .scanlistcont |
558 | jmp .scanlistcont |
509 | @@: |
559 | @@: |
- | 560 | .scanlistfound: |
|
510 | cmp edi, -1 |
561 | cmp edi, -1 |
511 | jnz @f |
562 | jnz @f |
512 | popad |
563 | popad |
513 | ret |
564 | ret |
514 | @@: |
565 | @@: |
515 | mov eax, [ntfs_cur_iRecord] |
566 | mov eax, [ntfs_cur_iRecord] |
516 | mov [ntfs_attr_iBaseRecord], eax |
567 | mov [ntfs_attr_iBaseRecord], eax |
517 | mov eax, edi |
568 | mov eax, edi |
518 | jmp .beginfindattr |
569 | jmp .beginfindattr |
- | 570 | .sde: |
|
- | 571 | popad |
|
- | 572 | stc |
|
- | 573 | ret |
|
519 | .scanlistdone: |
574 | .scanlistdone: |
520 | sub ebp, ntfs_attrlist_buf-1Ah |
575 | sub ebp, ntfs_attrlist_buf-1Ah |
521 | test ebp, 1FFh |
576 | test ebp, 1FFh |
522 | jnz .ret_is_attr |
577 | jnz .scanlistfound |
523 | test edx, edx |
578 | test edx, edx |
524 | jnz @f |
579 | jnz @f |
525 | inc edx |
580 | inc edx |
526 | cmp ebp, 0x400 |
581 | cmp ebp, 0x400 |
527 | jnz .ret_is_attr |
582 | jnz .scanlistfound |
528 | @@: |
583 | @@: |
529 | inc edx |
584 | inc edx |
530 | push esi edi |
585 | push esi edi |
531 | mov esi, ntfs_attrlist_buf+0x200 |
586 | mov esi, ntfs_attrlist_buf+0x200 |
532 | mov edi, ntfs_attrlist_buf |
587 | mov edi, ntfs_attrlist_buf |
Line 581... | Line 636... | ||
581 | mov [ntfs_cur_read], eax |
636 | mov [ntfs_cur_read], eax |
582 | mov ecx, eax |
637 | mov ecx, eax |
583 | mov eax, edx |
638 | mov eax, edx |
584 | mov ebx, [ntfs_cur_buf] |
639 | mov ebx, [ntfs_cur_buf] |
585 | call memmove |
640 | call memmove |
586 | clc |
641 | and [ntfs_cur_size], 0 ; CF=0 |
587 | ret |
642 | ret |
588 | .nonresident: |
643 | .nonresident: |
- | 644 | ; Not all auxiliary records contain correct FileSize info |
|
- | 645 | mov eax, dword [ntfs_attr_size] |
|
- | 646 | mov edx, dword [ntfs_attr_size+4] |
|
- | 647 | push eax |
|
- | 648 | and eax, edx |
|
- | 649 | cmp eax, -1 |
|
- | 650 | pop eax |
|
- | 651 | jnz @f |
|
589 | mov eax, [ecx+30h] ; FileSize |
652 | mov eax, [ecx+30h] ; FileSize |
590 | mov edx, [ecx+34h] |
653 | mov edx, [ecx+34h] |
- | 654 | mov dword [ntfs_attr_size], eax |
|
- | 655 | mov dword [ntfs_attr_size+4], edx |
|
- | 656 | @@: |
|
591 | add eax, 0x1FF |
657 | add eax, 0x1FF |
592 | adc edx, 0 |
658 | adc edx, 0 |
593 | shrd eax, edx, 9 |
659 | shrd eax, edx, 9 |
594 | sub eax, [ntfs_cur_offs] |
660 | sub eax, [ntfs_cur_offs] |
595 | ja @f |
661 | ja @f |
596 | ; return with nothing read |
662 | ; return with nothing read |
- | 663 | and [ntfs_cur_size], 0 |
|
597 | .okret: |
664 | .okret: |
598 | clc |
665 | clc |
599 | ret |
666 | ret |
600 | @@: |
667 | @@: |
601 | ; reduce read length |
668 | ; reduce read length |
Line 670... | Line 737... | ||
670 | mov ecx, [ntfs_data.frs_size] |
737 | mov ecx, [ntfs_data.frs_size] |
671 | mul ecx |
738 | mul ecx |
672 | shrd eax, edx, 9 |
739 | shrd eax, edx, 9 |
673 | shr edx, 9 |
740 | shr edx, 9 |
674 | jnz .err |
741 | jnz .err |
- | 742 | push [ntfs_attr_iRecord] |
|
- | 743 | push [ntfs_attr_iBaseRecord] |
|
- | 744 | push [ntfs_attr_offs] |
|
- | 745 | push [ntfs_attr_list] |
|
- | 746 | push dword [ntfs_attr_size+4] |
|
- | 747 | push dword [ntfs_attr_size] |
|
675 | push [ntfs_cur_iRecord] |
748 | push [ntfs_cur_iRecord] |
676 | push [ntfs_cur_attr] |
749 | push [ntfs_cur_attr] |
677 | push [ntfs_cur_offs] |
750 | push [ntfs_cur_offs] |
678 | push [ntfs_cur_size] |
751 | push [ntfs_cur_size] |
679 | push [ntfs_cur_buf] |
752 | push [ntfs_cur_buf] |
Line 691... | Line 764... | ||
691 | pop [ntfs_cur_buf] |
764 | pop [ntfs_cur_buf] |
692 | pop [ntfs_cur_size] |
765 | pop [ntfs_cur_size] |
693 | pop [ntfs_cur_offs] |
766 | pop [ntfs_cur_offs] |
694 | pop [ntfs_cur_attr] |
767 | pop [ntfs_cur_attr] |
695 | pop [ntfs_cur_iRecord] |
768 | pop [ntfs_cur_iRecord] |
- | 769 | pop dword [ntfs_attr_size] |
|
- | 770 | pop dword [ntfs_attr_size+4] |
|
- | 771 | pop [ntfs_attr_list] |
|
- | 772 | pop [ntfs_attr_offs] |
|
- | 773 | pop [ntfs_attr_iBaseRecord] |
|
- | 774 | pop [ntfs_attr_iRecord] |
|
696 | pop edx ecx |
775 | pop edx ecx |
697 | jc .errret |
776 | jc .errret |
698 | cmp eax, [ntfs_data.frs_size] |
777 | cmp eax, [ntfs_data.frs_size] |
699 | jnz .errret |
778 | jnz .errret |
700 | mov eax, [ntfs_data.frs_buffer] |
779 | mov eax, [ntfs_data.frs_buffer] |
Line 772... | Line 851... | ||
772 | rep movsb |
851 | rep movsb |
773 | pop ecx |
852 | pop ecx |
774 | sub ecx, 8 |
853 | sub ecx, 8 |
775 | neg ecx |
854 | neg ecx |
776 | cmp byte [esi-1], 80h |
855 | cmp byte [esi-1], 80h |
- | 856 | cmc |
|
777 | sbb eax, eax |
857 | sbb eax, eax |
778 | inc eax |
- | |
779 | rep stosb |
858 | rep stosb |
780 | stc |
859 | stc |
781 | .end: |
860 | .end: |
782 | pop edi ecx eax |
861 | pop edi ecx eax |
783 | ret |
862 | ret |
Line -... | Line 863... | ||
- | 863 | ||
- | 864 | ntfs_find_lfn: |
|
- | 865 | ; in: esi->name |
|
- | 866 | ; out: CF=1 - file not found |
|
- | 867 | ; else CF=0 and eax=ntfs_cur_iRecord valid |
|
- | 868 | mov [ntfs_cur_iRecord], 5 ; start parse from root cluster |
|
- | 869 | .doit2: |
|
- | 870 | mov [ntfs_cur_attr], 0x90 ; $INDEX_ROOT |
|
- | 871 | and [ntfs_cur_offs], 0 |
|
- | 872 | mov eax, [ntfs_data.cur_index_size] |
|
- | 873 | mov [ntfs_cur_size], eax |
|
- | 874 | mov eax, [ntfs_data.cur_index_buf] |
|
- | 875 | mov [ntfs_cur_buf], eax |
|
- | 876 | call ntfs_read_attr |
|
- | 877 | jnc @f |
|
- | 878 | .ret: |
|
- | 879 | ret |
|
- | 880 | @@: |
|
- | 881 | cmp [ntfs_cur_read], 0x20 |
|
- | 882 | jc .ret |
|
- | 883 | pushad |
|
- | 884 | mov esi, [ntfs_data.cur_index_buf] |
|
- | 885 | mov eax, [esi+14h] |
|
- | 886 | add eax, 10h |
|
- | 887 | cmp [ntfs_cur_read], eax |
|
- | 888 | jae .readok1 |
|
- | 889 | add eax, 1FFh |
|
- | 890 | shr eax, 9 |
|
- | 891 | cmp eax, [ntfs_data.cur_index_size] |
|
- | 892 | ja @f |
|
- | 893 | .stc_ret: |
|
- | 894 | popad |
|
- | 895 | stc |
|
- | 896 | ret |
|
- | 897 | @@: |
|
- | 898 | ; reallocate |
|
- | 899 | push eax |
|
- | 900 | push [ntfs_data.cur_index_buf] |
|
- | 901 | call kernel_free |
|
- | 902 | pop eax |
|
- | 903 | mov [ntfs_data.cur_index_size], eax |
|
- | 904 | push eax |
|
- | 905 | call kernel_alloc |
|
- | 906 | test eax, eax |
|
- | 907 | jnz @f |
|
- | 908 | and [ntfs_data.cur_index_size], 0 |
|
- | 909 | and [ntfs_data.cur_index_buf], 0 |
|
- | 910 | jmp .stc_ret |
|
- | 911 | @@: |
|
- | 912 | mov [ntfs_data.cur_index_buf], eax |
|
- | 913 | popad |
|
- | 914 | jmp .doit2 |
|
- | 915 | .readok1: |
|
- | 916 | mov ebp, [esi+8] ; subnode_size |
|
- | 917 | shr ebp, 9 |
|
- | 918 | cmp ebp, [ntfs_data.cur_index_size] |
|
- | 919 | jbe .ok2 |
|
- | 920 | push esi ebp |
|
- | 921 | push ebp |
|
- | 922 | call kernel_alloc |
|
- | 923 | pop ebp esi |
|
- | 924 | test eax, eax |
|
- | 925 | jz .stc_ret |
|
- | 926 | mov edi, eax |
|
- | 927 | mov ecx, [ntfs_data.cur_index_size] |
|
- | 928 | shl ecx, 9-2 |
|
- | 929 | rep movsd |
|
- | 930 | mov esi, eax |
|
- | 931 | mov [ntfs_data.cur_index_size], ebp |
|
- | 932 | push esi ebp |
|
- | 933 | push [ntfs_data.cur_index_buf] |
|
- | 934 | call kernel_free |
|
- | 935 | pop ebp esi |
|
- | 936 | mov [ntfs_data.cur_index_buf], esi |
|
- | 937 | .ok2: |
|
- | 938 | add esi, 10h |
|
- | 939 | mov edi, [esp+4] |
|
- | 940 | ; edi -> name, esi -> current index data, ebp = subnode size |
|
- | 941 | .scanloop: |
|
- | 942 | add esi, [esi] |
|
- | 943 | .scanloopint: |
|
- | 944 | test byte [esi+0Ch], 2 |
|
- | 945 | jnz .subnode |
|
- | 946 | push esi |
|
- | 947 | add esi, 0x52 |
|
- | 948 | movzx ecx, byte [esi-2] |
|
- | 949 | push edi |
|
- | 950 | @@: |
|
- | 951 | lodsw |
|
- | 952 | call uni2ansi_char |
|
- | 953 | call char_toupper |
|
- | 954 | push eax |
|
- | 955 | mov al, [edi] |
|
- | 956 | inc edi |
|
- | 957 | call char_toupper |
|
- | 958 | cmp al, [esp] |
|
- | 959 | pop eax |
|
- | 960 | loopz @b |
|
- | 961 | jz .found |
|
- | 962 | pop edi |
|
- | 963 | pop esi |
|
- | 964 | jb .subnode |
|
- | 965 | .scanloopcont: |
|
- | 966 | movzx eax, word [esi+8] |
|
- | 967 | add esi, eax |
|
- | 968 | jmp .scanloopint |
|
- | 969 | .subnode: |
|
- | 970 | test byte [esi+0Ch], 1 |
|
- | 971 | jz .notfound |
|
- | 972 | movzx eax, word [esi+8] |
|
- | 973 | mov eax, [esi+eax-8] |
|
- | 974 | mul [ntfs_data.sectors_per_cluster] |
|
- | 975 | mov [ntfs_cur_offs], eax |
|
- | 976 | mov [ntfs_cur_attr], 0xA0 ; $INDEX_ALLOCATION |
|
- | 977 | mov [ntfs_cur_size], ebp |
|
- | 978 | mov eax, [ntfs_data.cur_index_buf] |
|
- | 979 | mov esi, eax |
|
- | 980 | mov [ntfs_cur_buf], eax |
|
- | 981 | call ntfs_read_attr |
|
- | 982 | mov eax, ebp |
|
- | 983 | shl eax, 9 |
|
- | 984 | cmp [ntfs_cur_read], eax |
|
- | 985 | jnz .notfound |
|
- | 986 | cmp dword [esi], 'INDX' |
|
- | 987 | jnz .notfound |
|
- | 988 | mov ebx, esi |
|
- | 989 | call ntfs_restore_usa |
|
- | 990 | jc .notfound |
|
- | 991 | add esi, 0x18 |
|
- | 992 | jmp .scanloop |
|
- | 993 | .notfound: |
|
- | 994 | popad |
|
- | 995 | stc |
|
- | 996 | ret |
|
- | 997 | .found: |
|
- | 998 | cmp byte [edi], 0 |
|
- | 999 | jz .done |
|
- | 1000 | cmp byte [edi], '/' |
|
- | 1001 | jz .next |
|
- | 1002 | pop edi |
|
- | 1003 | pop esi |
|
- | 1004 | jmp .scanloopcont |
|
- | 1005 | .done: |
|
- | 1006 | .next: |
|
- | 1007 | pop esi |
|
- | 1008 | pop esi |
|
- | 1009 | mov eax, [esi] |
|
- | 1010 | mov [ntfs_cur_iRecord], eax |
|
- | 1011 | mov [esp+1Ch], eax |
|
- | 1012 | mov [esp+4], edi |
|
- | 1013 | popad |
|
- | 1014 | inc esi |
|
- | 1015 | cmp byte [esi-1], 0 |
|
- | 1016 | jnz .doit2 |
|
- | 1017 | ret |
|
784 | 1018 | ||
785 | ;---------------------------------------------------------------- |
1019 | ;---------------------------------------------------------------- |
786 | ; |
1020 | ; |
787 | ; ntfs_HdRead - read NTFS hard disk |
1021 | ; ntfs_HdRead - read NTFS hard disk |
788 | ; |
1022 | ; |
Line 818... | Line 1052... | ||
818 | ;-------------------------------------------------------------- |
1052 | ;-------------------------------------------------------------- |
819 | ntfs_HdReadFolder: |
1053 | ntfs_HdReadFolder: |
820 | mov eax, 5 ; root cluster |
1054 | mov eax, 5 ; root cluster |
821 | cmp byte [esi], 0 |
1055 | cmp byte [esi], 0 |
822 | jz .doit |
1056 | jz .doit |
823 | ; call ntfs_find_lfn |
1057 | call ntfs_find_lfn |
824 | ; jnc .doit |
1058 | jnc .doit2 |
825 | .notfound: |
1059 | .notfound: |
826 | or ebx, -1 |
1060 | or ebx, -1 |
827 | push ERROR_FILE_NOT_FOUND |
1061 | push ERROR_FILE_NOT_FOUND |
828 | .pop_ret: |
1062 | .pop_ret: |
829 | pop eax |
1063 | pop eax |
830 | ret |
1064 | ret |
831 | .doit: |
1065 | .doit: |
832 | mov [ntfs_cur_iRecord], eax |
1066 | mov [ntfs_cur_iRecord], eax |
833 | .doit2: |
1067 | .doit2: |
- | 1068 | mov [ntfs_cur_attr], 0x10 ; $STANDARD_INFORMATION |
|
- | 1069 | and [ntfs_cur_offs], 0 |
|
- | 1070 | mov [ntfs_cur_size], 1 |
|
- | 1071 | mov [ntfs_cur_buf], ntfs_bitmap_buf |
|
- | 1072 | call ntfs_read_attr |
|
- | 1073 | jc .notfound |
|
834 | mov [ntfs_cur_attr], 0x90 ; $INDEX_ROOT |
1074 | mov [ntfs_cur_attr], 0x90 ; $INDEX_ROOT |
835 | and [ntfs_cur_offs], 0 |
1075 | and [ntfs_cur_offs], 0 |
836 | mov eax, [ntfs_data.cur_index_size] |
1076 | mov eax, [ntfs_data.cur_index_size] |
837 | mov [ntfs_cur_size], eax |
1077 | mov [ntfs_cur_size], eax |
838 | mov eax, [ntfs_data.cur_index_buf] |
1078 | mov eax, [ntfs_data.cur_index_buf] |
Line 925... | Line 1165... | ||
925 | push edx |
1165 | push edx |
926 | mov edx, esp |
1166 | mov edx, esp |
927 | ; edi -> BDFE, esi -> current index data, ebp = subnode size, ebx = first wanted block, |
1167 | ; edi -> BDFE, esi -> current index data, ebp = subnode size, ebx = first wanted block, |
928 | ; ecx = number of blocks to read |
1168 | ; ecx = number of blocks to read |
929 | ; edx -> parameters block: dd |
1169 | ; edx -> parameters block: dd |
- | 1170 | cmp [ntfs_cur_iRecord], 5 |
|
- | 1171 | jz .skip_specials |
|
- | 1172 | ; dot and dotdot entries |
|
- | 1173 | push esi |
|
- | 1174 | xor esi, esi |
|
- | 1175 | call .add_special_entry |
|
- | 1176 | inc esi |
|
- | 1177 | call .add_special_entry |
|
- | 1178 | pop esi |
|
- | 1179 | .skip_specials: |
|
930 | ; at first, dump index root |
1180 | ; at first, dump index root |
931 | add esi, [esi] |
1181 | add esi, [esi] |
932 | .dump_root: |
1182 | .dump_root: |
933 | test byte [esi+0Ch], 2 |
1183 | test byte [esi+0Ch], 2 |
934 | jnz .dump_root_done |
1184 | jnz .dump_root_done |
Line 956... | Line 1206... | ||
956 | mov [ntfs_cur_size], ebp |
1206 | mov [ntfs_cur_size], ebp |
957 | mov eax, [ntfs_data.cur_index_buf] |
1207 | mov eax, [ntfs_data.cur_index_buf] |
958 | mov esi, eax |
1208 | mov esi, eax |
959 | mov [ntfs_cur_buf], eax |
1209 | mov [ntfs_cur_buf], eax |
960 | push [ntfs_cur_offs] |
1210 | push [ntfs_cur_offs] |
- | 1211 | mov eax, [ntfs_cur_offs] |
|
- | 1212 | imul eax, ebp |
|
- | 1213 | mov [ntfs_cur_offs], eax |
|
961 | call ntfs_read_attr |
1214 | call ntfs_read_attr |
962 | pop [ntfs_cur_offs] |
1215 | pop [ntfs_cur_offs] |
963 | mov eax, ebp |
1216 | mov eax, ebp |
964 | shl eax, 9 |
1217 | shl eax, 9 |
965 | cmp [ntfs_cur_read], eax |
1218 | cmp [ntfs_cur_read], eax |
Line 1022... | Line 1275... | ||
1022 | mov [esp+1Ch], eax |
1275 | mov [esp+1Ch], eax |
1023 | mov [esp+10h], ebx |
1276 | mov [esp+10h], ebx |
1024 | popad |
1277 | popad |
1025 | ret |
1278 | ret |
Line -... | Line 1279... | ||
- | 1279 | ||
- | 1280 | .add_special_entry: |
|
- | 1281 | mov eax, [edx] |
|
- | 1282 | inc dword [eax+8] ; new file found |
|
- | 1283 | dec ebx |
|
- | 1284 | jns .ret |
|
- | 1285 | dec ecx |
|
- | 1286 | js .ret |
|
- | 1287 | inc dword [eax+4] ; new file block copied |
|
- | 1288 | mov eax, [edx+4] |
|
- | 1289 | mov [edi+4], eax |
|
- | 1290 | ; mov eax, dword [ntfs_bitmap_buf+0x20] |
|
- | 1291 | ; or al, 0x10 |
|
- | 1292 | mov eax, 0x10 |
|
- | 1293 | stosd |
|
- | 1294 | scasd |
|
- | 1295 | push edx |
|
- | 1296 | mov eax, dword [ntfs_bitmap_buf] |
|
- | 1297 | mov edx, dword [ntfs_bitmap_buf+4] |
|
- | 1298 | call ntfs_datetime_to_bdfe |
|
- | 1299 | mov eax, dword [ntfs_bitmap_buf+0x18] |
|
- | 1300 | mov edx, dword [ntfs_bitmap_buf+0x1C] |
|
- | 1301 | call ntfs_datetime_to_bdfe |
|
- | 1302 | mov eax, dword [ntfs_bitmap_buf+8] |
|
- | 1303 | mov edx, dword [ntfs_bitmap_buf+0xC] |
|
- | 1304 | call ntfs_datetime_to_bdfe |
|
- | 1305 | pop edx |
|
- | 1306 | xor eax, eax |
|
- | 1307 | stosd |
|
- | 1308 | stosd |
|
- | 1309 | mov al, '.' |
|
- | 1310 | push edi ecx |
|
- | 1311 | lea ecx, [esi+1] |
|
- | 1312 | test byte [edi-0x24], 1 |
|
- | 1313 | jz @f |
|
- | 1314 | rep stosw |
|
- | 1315 | pop ecx |
|
- | 1316 | xor eax, eax |
|
- | 1317 | stosw |
|
- | 1318 | pop edi |
|
- | 1319 | add edi, 520 |
|
- | 1320 | ret |
|
- | 1321 | @@: |
|
- | 1322 | rep stosb |
|
- | 1323 | pop ecx |
|
- | 1324 | xor eax, eax |
|
- | 1325 | stosb |
|
- | 1326 | pop edi |
|
- | 1327 | add edi, 264 |
|
- | 1328 | .ret: |
|
- | 1329 | ret |
|
1026 | 1330 | ||
1027 | .add_entry: |
1331 | .add_entry: |
1028 | ; do not return DOS 8.3 names |
1332 | ; do not return DOS 8.3 names |
1029 | cmp byte [esi+0x51], 2 |
1333 | cmp byte [esi+0x51], 2 |
1030 | jz .ret |
1334 | jz .ret |
Line 1038... | Line 1342... | ||
1038 | jns .ret |
1342 | jns .ret |
1039 | dec ecx |
1343 | dec ecx |
1040 | js .ret |
1344 | js .ret |
1041 | inc dword [eax+4] ; new file block copied |
1345 | inc dword [eax+4] ; new file block copied |
1042 | mov eax, [edx+4] ; flags |
1346 | mov eax, [edx+4] ; flags |
1043 | call ntfs_direntry_to_bdfe |
- | |
1044 | .ret: |
- | |
1045 | ret |
- | |
Line 1046... | Line 1347... | ||
1046 | 1347 | ||
1047 | ntfs_direntry_to_bdfe: |
1348 | ntfs_direntry_to_bdfe: |
1048 | mov [edi+4], eax ; ANSI/UNICODE name |
1349 | mov [edi+4], eax ; ANSI/UNICODE name |
1049 | mov eax, [esi+48h] |
1350 | mov eax, [esi+48h] |