WebSVN – Kolibri OS – Diff – /kernel/branches/Kolibri-acpi/fs/ntfs.inc


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;                                                              ;;
;; Copyright (C) KolibriOS team 2004-2015. All rights reserved. ;;
;; Distributed under terms of the GNU General Public License    ;;
;;                                                              ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
$Revision: 6078 $
 
; NTFS driver
 
; Basic concepts:
; File is a FileRecord in the $MFT.
; $MFT is a file, that consists of FileRecords and starts with FileRecord of itself.
; FileRecord (FILE) consists of a header and attributes.
; Attribute consists of a header and a body.
; Attribute's body can be inside (resident) or outside of FileRecord.
; File's data is a body of $Data (80h) attribute.
; FileRecords is a data of the $MFT file.
; Directory is a file, that consists of index nodes.
; Resident index node is always located in a body of $IndexRoot (90h) attribute.
; Body of $IndexAllocation (A0h) attribute is always non resident
;  and consists of IndexRecords.
; IndexRecord (INDX) consists of a header and an index node.
; Index node consists of a header and indexes.
; Index consists of a header and a copy of indexed attribute's body.
; Directories index $Filename (30h) attribute of all existing files.
; $IndexRoot and $IndexAllocation attributes of a directory has a name — $I30.
 
; Offsets:
    ; record header
updateSequenceOffset = 4
updateSequenceSize = 6
reuseCounter = 16
hardLinkCounter = 12h
attributeOffset = 14h
recordFlags = 16h
recordRealSize = 18h
recordAllocatedSize = 1ch
baseRecordReference = 20h       ; for auxiliary records
baseRecordReuse = 26h
newAttributeID = 28h
    ; attribute header
attributeType = 0
sizeWithHeader = 4
nonResidentFlag = 8
nameLength = 9
nameOffset = 10
attributeFlags = 12
attributeID = 14
sizeWithoutHeader = 16
indexedFlag = 16h
    ; non resident attribute header
lastVCN = 18h
dataRunsOffset = 20h
attributeAllocatedSize = 28h
attributeRealSize = 30h
initialDataSize = 38h
    ; $IndexRoot
collationRule = 4
indexRecordSize = 8
indexRecordSizeClus = 12
    ; node header
indexOffset = 0
nodeRealSize = 4
nodeAllocatedSize = 8
    ; $Filename index
fileRecordReference = 0
fileReferenceReuse = 6
indexAllocatedSize = 8
indexRawSize = 10
indexFlags = 12
directoryRecordReference = 16
directoryReferenceReuse = 16h
fileAllocatedSize = 38h
fileRealSize = 40h
fileFlags = 48h
fileNameLength = 50h
 
struct NTFS PARTITION
Lock                MUTEX   ?   ; Currently operations with one partition
; can not be executed in parallel since the legacy code is not ready.
sectors_per_cluster     dd  ?
mft_cluster             dd  ?   ; location
mftmirr_cluster         dd  ?   ; location
frs_size                dd  ?   ; in bytes
frs_buffer              dd  ?   ; MFT fileRecord buffer
mft_retrieval           dd  ?
mft_retrieval_size      dd  ?
mft_retrieval_alloc     dd  ?
mft_retrieval_end       dd  ?
cur_index_size          dd  ?   ; in sectors
cur_index_buf           dd  ?   ; index node buffer
BitmapBuffer            dd  ?
BitmapTotalSize         dd  ?   ; bytes reserved
BitmapSize              dd  ?   ; bytes readen
BitmapLocation          dd  ?   ; starting sector
BitmapStart             dd  ?   ; first byte after area, reserved for MFT
mftBitmapBuffer         dd  ?   ; one cluster
mftBitmapSize           dd  ?   ; bytes readen
mftBitmapLocation       dd  ?   ; starting sector
 
ntfs_cur_attr           dd  ?   ; attribute type
ntfs_cur_iRecord        dd  ?   ; number of fileRecord in MFT
ntfs_cur_offs           dd  ?   ; attribute VCN in sectors
ntfs_cur_size           dd  ?   ; max sectors to read
ntfs_cur_buf            dd  ?
ntfs_cur_read           dd  ?   ; bytes readen
ntfsLastRead            dd  ?   ; last readen block of sectors
newMftRecord            dd  ?   ; number of fileRecord in MFT
fileDataStart           dd  ?   ; starting cluster
fileDataSize            dd  ?   ; in clusters
fileRealSize            dd  ?   ; in bytes
indexOffset             dd  ?
nodeLastRead            dd  ?
ntfs_bCanContinue       db  ?
 
ntfsFolder              db  ?
ntfsWriteAttr           db  ?   ; Warning: Don't forget to turn off!!!
ntfsFragmentCount       db  ?
 
cur_subnode_size        dd  ?
ntfs_attr_iRecord       dd  ?
ntfs_attr_iBaseRecord   dd  ?
ntfs_attr_offs          dd  ?
ntfs_attr_list          dd  ?
ntfs_attr_size          dq  ?
ntfs_cur_tail           dd  ?
 
ntfs_attrlist_buf       rb  0x400
ntfs_attrlist_mft_buf   rb  0x400
ntfs_bitmap_buf         rb  0x400
ends
 
; NTFS external functions
;   in:
; ebx -> parameter structure of sysfunc 70
; ebp -> NTFS structure
; [esi]+[esp+4] = name
;   out:
; eax, ebx = return values for sysfunc 70
iglobal
align 4
ntfs_user_functions:
        dd      ntfs_free
        dd      (ntfs_user_functions_end - ntfs_user_functions - 4) / 4
        dd      ntfs_ReadFile
        dd      ntfs_ReadFolder
        dd      ntfs_CreateFile
        dd      ntfs_WriteFile
        dd      ntfs_SetFileEnd
        dd      ntfs_GetFileInfo
        dd      ntfs_SetFileInfo
        dd      0
        dd      ntfs_Delete
        dd      ntfs_CreateFolder
ntfs_user_functions_end:
endg
 
ntfs_test_bootsec:
; in: ebx -> buffer, edx = size of partition
; out: CF=1 -> invalid
; 1. Name=='NTFS    '
        cmp     dword [ebx+3], 'NTFS'
        jnz     .no
        cmp     dword [ebx+7], '    '
        jnz     .no
; 2. Number of bytes per sector is the same as for physical device
; (that is, 0x200 for hard disk)
        cmp     word [ebx+11], 0x200
        jnz     .no
; 3. Number of sectors per cluster must be power of 2
        movzx   eax, byte [ebx+13]
        dec     eax
        js      .no
        test    al, [ebx+13]
        jnz     .no
; 4. FAT parameters must be zero
        cmp     word [ebx+14], 0
        jnz     .no
        cmp     dword [ebx+16], 0
        jnz     .no
        cmp     byte [ebx+20], 0
        jnz     .no
        cmp     word [ebx+22], 0
        jnz     .no
        cmp     dword [ebx+32], 0
        jnz     .no
; 5. Number of sectors <= partition size
        cmp     dword [ebx+0x2C], 0
        ja      .no
        cmp     [ebx+0x28], edx
        ja      .no
; 6. $MFT and $MFTMirr clusters must be within partition
        cmp     dword [ebx+0x34], 0
        ja      .no
        push    edx
        movzx   eax, byte [ebx+13]
        mul     dword [ebx+0x30]
        test    edx, edx
        pop     edx
        jnz     .no
        cmp     eax, edx
        ja      .no
        cmp     dword [ebx+0x3C], 0
        ja      .no
        push    edx
        movzx   eax, byte [ebx+13]
        mul     dword [ebx+0x38]
        test    edx, edx
        pop     edx
        jnz     .no
        cmp     eax, edx
        ja      .no
; 7. Clusters per FRS must be either power of 2 or between -31 and -9
        movsx   eax, byte [ebx+0x40]
        cmp     al, -31
        jl      .no
        cmp     al, -9
        jle     @f
        dec     eax
        js      .no
        test    [ebx+0x40], al
        jnz     .no
@@:         ; 8. Same for clusters per IndexAllocationBuffer
        movsx   eax, byte [ebx+0x44]
        cmp     al, -31
        jl      .no
        cmp     al, -9
        jle     @f
        dec     eax
        js      .no
        test    [ebx+0x44], al
        jnz     .no
@@:         ; OK, this is correct NTFS bootsector
        clc
        ret
.no:        ; No, this bootsector isn't NTFS
        stc
        ret
 
ntfs_create_partition:
        cmp     dword [esi+DISK.MediaInfo.SectorSize], 512
        jnz     .nope
        mov     edx, dword [ebp+PARTITION.Length]
        cmp     dword [esp+4], 0
        jz      .boot_read_ok
        add     ebx, 512
        lea     eax, [edx-1]
        call    fs_read32_sys
        test    eax, eax
        jnz     @f
        call    ntfs_test_bootsec
        jnc     .ntfs_setup
@@:
        mov     eax, edx
        shr     eax, 1
        call    fs_read32_sys
        test    eax, eax
        jnz     .nope
.boot_read_ok:
        call    ntfs_test_bootsec
        jnc     .ntfs_setup
.nope:
        xor     eax, eax
        jmp     .exit
; By given bootsector, initialize some NTFS variables
.ntfs_setup:
        movi    eax, sizeof.NTFS
        call    malloc
        test    eax, eax
        jz      .exit
        mov     ecx, dword [ebp+PARTITION.FirstSector]
        mov     dword [eax+NTFS.FirstSector], ecx
        mov     ecx, dword [ebp+PARTITION.FirstSector+4]
        mov     dword [eax+NTFS.FirstSector+4], ecx
 
 
 
 
        mov     ecx, [ebp+PARTITION.Disk]
        mov     [eax+NTFS.Disk], ecx
        mov     [eax+NTFS.FSUserFunctions], ntfs_user_functions
        mov     [eax+NTFS.ntfsWriteAttr], 0
 
        push    ebx ebp esi
        mov     ebp, eax
        lea     ecx, [ebp+NTFS.Lock]
        call    mutex_init
        movzx   eax, byte [ebx+13]
        mov     [ebp+NTFS.sectors_per_cluster], eax
        mov     eax, [ebx+0x28]
        mov     dword [ebp+NTFS.Length], eax
        and     dword [ebp+NTFS.Length+4], 0
        mov     eax, [ebx+0x30]
        mov     [ebp+NTFS.mft_cluster], eax
        mov     eax, [ebx+0x38]
        mov     [ebp+NTFS.mftmirr_cluster], eax
        movsx   eax, byte [ebx+0x40]
        test    eax, eax
        js      @f
        mul     [ebp+NTFS.sectors_per_cluster]
        shl     eax, 9
        jmp     .1
@@:
        neg     eax
        mov     ecx, eax
        mov     eax, 1
        shl     eax, cl
.1:
        mov     [ebp+NTFS.frs_size], eax
        stdcall kernel_alloc, eax
        test    eax, eax
        jz      .fail_free
        mov     [ebp+NTFS.frs_buffer], eax
; read $MFT disposition
        mov     eax, [ebp+NTFS.mft_cluster]
        mul     [ebp+NTFS.sectors_per_cluster]
        call    ntfs_read_frs_sector
        test    eax, eax
        jnz     .usemirr
        cmp     dword [ebx], 'FILE'
        jnz     .usemirr
        call    ntfs_restore_usa_frs
        jnc     .mftok
.usemirr:
        mov     eax, [ebp+NTFS.mftmirr_cluster]
        mul     [ebp+NTFS.sectors_per_cluster]
        call    ntfs_read_frs_sector
        test    eax, eax
        jnz     .fail_free_frs
        cmp     dword [ebx], 'FILE'
        jnz     .fail_free_frs
        call    ntfs_restore_usa_frs
        jc      .fail_free_frs
.mftok:
; read $MFT table retrieval information
; start with one page, increase if not enough (when MFT too fragmented)
        push    ebx
        stdcall kernel_alloc, 0x1000
        pop     ebx
        test    eax, eax
        jz      .fail_free_frs
        mov     [ebp+NTFS.mft_retrieval], eax
        and     [ebp+NTFS.mft_retrieval_size], 0
        mov     [ebp+NTFS.mft_retrieval_alloc], 0x1000/8
; $MFT base record must contain unnamed non-resident $DATA attribute
        movzx   eax, word [ebx+14h]
        add     eax, ebx
.scandata:
        cmp     dword [eax], -1
        jz      .fail_free_mft
        cmp     dword [eax], 0x80
        jnz     @f
        cmp     byte [eax+9], 0
        jz      .founddata
@@:
        add     eax, [eax+4]
        jmp     .scandata
.founddata:
        cmp     byte [eax+8], 0
        jz      .fail_free_mft
; load first portion of $DATA attribute retrieval information
        mov     edx, [eax+0x18]
        mov     [ebp+NTFS.mft_retrieval_end], edx
        mov     esi, eax
        movzx   eax, word [eax+0x20]
        add     esi, eax
        sub     esp, 10h
.scanmcb:
        call    ntfs_decode_mcb_entry
        jnc     .scanmcbend
        call    .get_mft_retrieval_ptr
        mov     edx, [esp]      ; block length
        mov     [eax], edx
        mov     edx, [esp+8]    ; block addr (relative)
        mov     [eax+4], edx
        inc     [ebp+NTFS.mft_retrieval_size]
        jmp     .scanmcb
.scanmcbend:
        add     esp, 10h
; there may be other portions of $DATA attribute in auxiliary records;
; if they will be needed, they will be loaded later
        mov     [ebp+NTFS.cur_index_size], 0x1000/0x200
        stdcall kernel_alloc, 0x1000
        test    eax, eax
        jz      .fail_free_mft
        mov     [ebp+NTFS.cur_index_buf], eax
; reserve adress space for bitmap buffer and load some part of bitmap
        mov     eax, dword [ebp+NTFS.Length]
        xor     edx, edx
        div     [ebp+NTFS.sectors_per_cluster]
        shr     eax, 3
        mov     [ebp+NTFS.BitmapTotalSize], eax
        add     eax, 7FFFh
        and     eax, not 7FFFh
        push    eax
        call    alloc_kernel_space
        test    eax, eax
        jz      .failFreeIndex
        mov     [ebp+NTFS.BitmapBuffer], eax
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        mov     eax, [ebp+NTFS.BitmapTotalSize]
        add     eax, [ebp+NTFS.mft_cluster]
        shr     eax, 3+2        ; reserve 1/8 of partition for $MFT
        shl     eax, 2
        mov     [ebp+NTFS.BitmapStart], eax
        shr     eax, 15
        inc     eax
        shl     eax, 3
        push    eax
        push    eax
        shl     eax, 3
        mov     [ebp+NTFS.ntfs_cur_size], eax
        call    alloc_pages
        test    eax, eax
        pop     ecx
        jz      .failFreeBitmap
        add     eax, 3
        mov     ebx, [ebp+NTFS.BitmapBuffer]
        call    commit_pages
        mov     [ebp+NTFS.ntfs_cur_iRecord], 6
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80
        mov     [ebp+NTFS.ntfs_cur_offs], 0
        call    ntfs_read_attr
        jc      .failFreeBitmap
        mov     eax, [ebp+NTFS.ntfs_cur_read]
        mov     [ebp+NTFS.BitmapSize], eax
        mov     eax, [ebp+NTFS.ntfsLastRead]
        mov     [ebp+NTFS.BitmapLocation], eax
; read MFT $BITMAP attribute
        mov     eax, [ebp+NTFS.sectors_per_cluster]
        mov     [ebp+NTFS.ntfs_cur_size], eax
        shl     eax, 9
        stdcall kernel_alloc, eax
        test    eax, eax
        jz      .failFreeBitmap
        mov     [ebp+NTFS.mftBitmapBuffer], eax
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        mov     [ebp+NTFS.ntfs_cur_iRecord], 0
        mov     [ebp+NTFS.ntfs_cur_attr], 0xB0
        mov     [ebp+NTFS.ntfs_cur_offs], 0
        call    ntfs_read_attr
        mov     eax, [ebp+NTFS.ntfs_cur_read]
        cmp     eax, 4
        jc      .failFreeBitmapMFT
        mov     [ebp+NTFS.mftBitmapSize], eax
        mov     eax, [ebp+NTFS.ntfsLastRead]
        mov     [ebp+NTFS.mftBitmapLocation], eax
 
        mov     eax, ebp
.pop_exit:
        pop     esi ebp ebx
.exit:
        cmp     dword [esp+4], 0
        jz      @f
        sub     ebx, 512
@@:
        ret
 
.failFreeBitmapMFT:
        stdcall kernel_free, [ebx+NTFS.mftBitmapBuffer]
.failFreeBitmap:
        stdcall kernel_free, [ebx+NTFS.BitmapBuffer]
.failFreeIndex:
        stdcall kernel_free, [ebp+NTFS.cur_index_buf]
.fail_free_mft:
        stdcall kernel_free, [ebp+NTFS.mft_retrieval]
.fail_free_frs:
        stdcall kernel_free, [ebp+NTFS.frs_buffer]
.fail_free:
        mov     eax, ebp
        call    free
        xor     eax, eax
        jmp     .pop_exit
 
.get_mft_retrieval_ptr:
        pushad
        mov     eax, [ebp+NTFS.mft_retrieval_size]
        cmp     eax, [ebp+NTFS.mft_retrieval_alloc]
        jnz     .ok
        add     eax, 0x1000/8
        mov     [ebp+NTFS.mft_retrieval_alloc], eax
        shl     eax, 3
        stdcall kernel_alloc, eax
        test    eax, eax
        jnz     @f
        popad
        add     esp, 14h
        jmp     .fail_free_mft
@@:
        mov     esi, [ebp+NTFS.mft_retrieval]
        mov     edi, eax
        mov     ecx, [ebp+NTFS.mft_retrieval_size]
        add     ecx, ecx
        rep movsd
        push    [ebp+NTFS.mft_retrieval]
        mov     [ebp+NTFS.mft_retrieval], eax
        call    kernel_free
        mov     eax, [ebp+NTFS.mft_retrieval_size]
.ok:
        shl     eax, 3
        add     eax, [ebp+NTFS.mft_retrieval]
        mov     [esp+28], eax
        popad
        ret
 
ntfs_free:
        push    ebx
        mov     ebx, eax
        stdcall kernel_free, [ebx+NTFS.frs_buffer]
        stdcall kernel_free, [ebx+NTFS.mft_retrieval]
        stdcall kernel_free, [ebx+NTFS.cur_index_buf]
        stdcall kernel_free, [ebx+NTFS.mftBitmapBuffer]
        stdcall kernel_free, [ebx+NTFS.BitmapBuffer]
        mov     eax, ebx
        pop     ebx
        jmp     free
 
ntfs_lock:
        lea     ecx, [ebp+NTFS.Lock]
        jmp     mutex_lock
 
ntfs_unlock:
        lea     ecx, [ebp+NTFS.Lock]
        jmp     mutex_unlock
 
ntfs_read_frs_sector:
        push    ecx
        mov     ebx, [ebp+NTFS.frs_buffer]
        push    ebx
        mov     ecx, [ebp+NTFS.frs_size]
        shr     ecx, 9
        push    ecx
        mov     ecx, eax
@@:
        mov     eax, ecx
        call    fs_read32_sys
        test    eax, eax
        jnz     .fail
        add     ebx, 0x200
        inc     ecx
        dec     dword [esp]
        jnz     @b
        pop     eax
.fail:
        pop     ebx
        pop     ecx
        ret
 
ntfs_read_attr:
; [ebp+NTFS.ntfsWriteAttr]=1 -> write attribute
;   in:
; [ebp+NTFS.ntfs_cur_iRecord] = number of fileRecord
; [ebp+NTFS.ntfs_cur_attr] = attribute type
; [ebp+NTFS.ntfs_cur_offs] = attribute VCN in sectors
; [ebp+NTFS.ntfs_cur_buf] -> buffer for data
; [ebp+NTFS.ntfs_cur_size] = max sectors to read
;   out:
; [ebp+NTFS.ntfs_cur_read] = bytes readen
; CF=1 -> failed, eax = disk error code, eax=0 -> something with FS
        xor     eax, eax
        pushad
        and     [ebp+NTFS.ntfs_cur_read], 0
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 0
        jnz     .nomft
        cmp     [ebp+NTFS.ntfs_cur_attr], 0x80
        jnz     .nomft
        mov     eax, [ebp+NTFS.mft_retrieval_end]
        inc     eax
        mul     [ebp+NTFS.sectors_per_cluster]
        cmp     eax, [ebp+NTFS.ntfs_cur_offs]
        jbe     .nomft
; precalculated part of $Mft $DATA
        mov     esi, [ebp+NTFS.mft_retrieval]
        mov     eax, [ebp+NTFS.ntfs_cur_offs]
        xor     edx, edx
        div     [ebp+NTFS.sectors_per_cluster]
; eax = VCN, edx = offset in sectors from beginning of cluster
        xor     ecx, ecx        ; ecx will contain LCN
.mftscan:
        add     ecx, [esi+4]
        sub     eax, [esi]
        jb      @f
        add     esi, 8
        push    eax
        mov     eax, [ebp+NTFS.mft_retrieval_end]
        shl     eax, 3
        add     eax, [ebp+NTFS.mft_retrieval]
        cmp     eax, esi
        pop     eax
        jnz     .mftscan
        jmp     .nomft
@@:
        push    ecx
        add     ecx, eax
        add     ecx, [esi]
        push    eax
        push    edx
        mov     eax, [ebp+NTFS.sectors_per_cluster]
        mul     ecx
; eax = sector on partition
        pop     edx
        add     eax, edx
        mov     ebx, [ebp+NTFS.ntfs_cur_buf]
        pop     ecx
        neg     ecx
        imul    ecx, [ebp+NTFS.sectors_per_cluster]
        sub     ecx, edx
        mov     [ebp+NTFS.ntfsLastRead], eax
        cmp     ecx, [ebp+NTFS.ntfs_cur_size]
        jb      @f
        mov     ecx, [ebp+NTFS.ntfs_cur_size]
@@:
; ecx = number of sequential sectors to read
        push    eax
        call    fs_read32_sys
        pop     edx
        test    eax, eax
        jnz     .errread
        add     [ebp+NTFS.ntfs_cur_read], 0x200
        dec     [ebp+NTFS.ntfs_cur_size]
        inc     [ebp+NTFS.ntfs_cur_offs]
        add     ebx, 0x200
        mov     [ebp+NTFS.ntfs_cur_buf], ebx
        lea     eax, [edx+1]
        loop    @b
        pop     ecx
        xor     eax, eax
        xor     edx, edx
        cmp     [ebp+NTFS.ntfs_cur_size], eax
        jz      @f
        add     esi, 8
        push    eax
        mov     eax, [ebp+NTFS.mft_retrieval_end]
        shl     eax, 3
        add     eax, [ebp+NTFS.mft_retrieval]
        cmp     eax, esi
        pop     eax
        jz      .nomft
        jmp     .mftscan
@@:
        popad
        ret
.errread:
        pop     ecx
.errret:
        mov     [esp+28], eax
        stc
        popad
        ret
.nomft:
; 1. Read file record.
; N.B. This will do recursive call of read_attr for $MFT::$Data.
        mov     eax, [ebp+NTFS.ntfs_cur_iRecord]
        mov     [ebp+NTFS.ntfs_attr_iRecord], eax
        and     [ebp+NTFS.ntfs_attr_list], 0
        or      dword [ebp+NTFS.ntfs_attr_size], -1
        or      dword [ebp+NTFS.ntfs_attr_size+4], -1
        or      [ebp+NTFS.ntfs_attr_iBaseRecord], -1
        call    ntfs_read_file_record
        jc      .errret
; 2. Find required attribute.
        mov     eax, [ebp+NTFS.frs_buffer]
; a) For auxiliary records, read base record
; N.B. If base record is present,
;      base iRecord may be 0 (for $Mft), but SequenceNumber is nonzero
        cmp     dword [eax+24h], 0
        jz      @f
        mov     eax, [eax+20h]
;        test    eax, eax
;        jz      @f
.beginfindattr:
        mov     [ebp+NTFS.ntfs_attr_iRecord], eax
        call    ntfs_read_file_record
        jc      .errret
@@:
; b) Scan for required attribute and for $ATTR_LIST
        mov     eax, [ebp+NTFS.frs_buffer]
        movzx   ecx, word [eax+14h]
        add     eax, ecx
        mov     ecx, [ebp+NTFS.ntfs_cur_attr]
        and     [ebp+NTFS.ntfs_attr_offs], 0
.scanattr:
        cmp     dword [eax], -1
        jz      .scandone
        cmp     dword [eax], ecx
        jz      .okattr
        cmp     [ebp+NTFS.ntfs_attr_iBaseRecord], -1
        jnz     .scancont
        cmp     dword [eax], 0x20       ; $ATTR_LIST
        jnz     .scancont
        mov     [ebp+NTFS.ntfs_attr_list], eax
        jmp     .scancont
.okattr:
; ignore named $DATA attributes (aka NTFS streams)
        cmp     ecx, 0x80
        jnz     @f
        cmp     byte [eax+9], 0
        jnz     .scancont
@@:
        mov     [ebp+NTFS.ntfs_attr_offs], eax
.scancont:
        add     eax, [eax+4]
        jmp     .scanattr
.continue:
        pushad
        and     [ebp+NTFS.ntfs_cur_read], 0
.scandone:
; c) Check for required offset and length
        mov     ecx, [ebp+NTFS.ntfs_attr_offs]
        jecxz   .noattr
        push    [ebp+NTFS.ntfs_cur_size]
        push    [ebp+NTFS.ntfs_cur_read]
        call    .doreadattr
        pop     edx
        pop     ecx
        jc      @f
        cmp     [ebp+NTFS.ntfs_bCanContinue], 0
        jz      @f
        sub     edx, [ebp+NTFS.ntfs_cur_read]
        neg     edx
        shr     edx, 9
        sub     ecx, edx
        mov     [ebp+NTFS.ntfs_cur_size], ecx
        jnz     .not_in_cur
@@:
        popad
        ret
.noattr:
.not_in_cur:
        cmp     [ebp+NTFS.ntfs_cur_attr], 0x20
        jz      @f
        mov     ecx, [ebp+NTFS.ntfs_attr_list]
        test    ecx, ecx
        jnz     .lookattr
.ret_is_attr:
        and     dword [esp+28], 0
        cmp     [ebp+NTFS.ntfs_attr_offs], 1     ; CF set <=> ntfs_attr_offs == 0
        popad
        ret
.lookattr:
; required attribute or required offset was not found in base record;
; it may be present in auxiliary records;
; scan $ATTR_LIST
        mov     eax, [ebp+NTFS.ntfs_attr_iBaseRecord]
        cmp     eax, -1
        jz      @f
        call    ntfs_read_file_record
        jc      .errret
        or      [ebp+NTFS.ntfs_attr_iBaseRecord], -1
@@:
        push    [ebp+NTFS.ntfs_cur_offs]
        push    [ebp+NTFS.ntfs_cur_size]
        push    [ebp+NTFS.ntfs_cur_read]
        push    [ebp+NTFS.ntfs_cur_buf]
        push    dword [ebp+NTFS.ntfs_attr_size]
        push    dword [ebp+NTFS.ntfs_attr_size+4]
        or      dword [ebp+NTFS.ntfs_attr_size], -1
        or      dword [ebp+NTFS.ntfs_attr_size+4], -1
        and     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 2
        and     [ebp+NTFS.ntfs_cur_read], 0
        lea     eax, [ebp+NTFS.ntfs_attrlist_buf]
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 0
        jnz     @f
        lea     eax, [ebp+NTFS.ntfs_attrlist_mft_buf]
@@:
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        push    eax
        call    .doreadattr
        pop     esi
        mov     edx, 1
        pop     dword [ebp+NTFS.ntfs_attr_size+4]
        pop     dword [ebp+NTFS.ntfs_attr_size]
        mov     ecx, [ebp+NTFS.ntfs_cur_read]
        pop     [ebp+NTFS.ntfs_cur_buf]
        pop     [ebp+NTFS.ntfs_cur_read]
        pop     [ebp+NTFS.ntfs_cur_size]
        pop     [ebp+NTFS.ntfs_cur_offs]
        jc      .errret
        or      edi, -1
        lea     ecx, [ecx+esi-1Ah]
.scanliststart:
        push    ecx
        mov     eax, [ebp+NTFS.ntfs_cur_attr]
.scanlist:
        cmp     esi, [esp]
        jae     .scanlistdone
        cmp     eax, [esi]
        jz      @f
.scanlistcont:
        movzx   ecx, word [esi+4]
        add     esi, ecx
        jmp     .scanlist
@@:
; ignore named $DATA attributes (aka NTFS streams)
        cmp     eax, 0x80
        jnz     @f
        cmp     byte [esi+6], 0
        jnz     .scanlistcont
@@:
        push    eax
        mov     eax, [esi+8]
        test    eax, eax
        jnz     .testf
        mov     eax, dword [ebp+NTFS.ntfs_attr_size]
        and     eax, dword [ebp+NTFS.ntfs_attr_size+4]
        cmp     eax, -1
        jnz     .testfz
; if attribute is in auxiliary records, its size is defined only in first
        mov     eax, [esi+10h]
        call    ntfs_read_file_record
        jnc     @f
.errret_pop:
        pop     ecx ecx
        jmp     .errret
.errret2_pop:
        xor     eax, eax
        jmp     .errret_pop
@@:
        mov     eax, [ebp+NTFS.frs_buffer]
        movzx   ecx, word [eax+14h]
        add     eax, ecx
        mov     ecx, [ebp+NTFS.ntfs_cur_attr]
@@:
        cmp     dword [eax], -1
        jz      .errret2_pop
        cmp     dword [eax], ecx
        jz      @f
.l1:
        add     eax, [eax+4]
        jmp     @b
@@:
        cmp     eax, 0x80
        jnz     @f
        cmp     byte [eax+9], 0
        jnz     .l1
@@:
        cmp     byte [eax+8], 0
        jnz     .sdnores
        mov     eax, [eax+10h]
        mov     dword [ebp+NTFS.ntfs_attr_size], eax
        and     dword [ebp+NTFS.ntfs_attr_size+4], 0
        jmp     .testfz
.sdnores:
        mov     ecx, [eax+30h]
        mov     dword [ebp+NTFS.ntfs_attr_size], ecx
        mov     ecx, [eax+34h]
        mov     dword [ebp+NTFS.ntfs_attr_size+4], ecx
.testfz:
        xor     eax, eax
.testf:
        imul    eax, [ebp+NTFS.sectors_per_cluster]
        cmp     eax, [ebp+NTFS.ntfs_cur_offs]
        pop     eax
        ja      @f
        mov     edi, [esi+10h]  ; keep previous iRecord
        jmp     .scanlistcont
@@:
        pop     ecx
.scanlistfound:
        cmp     edi, -1
        jnz     @f
        popad
        ret
@@:
        mov     eax, [ebp+NTFS.ntfs_cur_iRecord]
        mov     [ebp+NTFS.ntfs_attr_iBaseRecord], eax
        mov     eax, edi
        jmp     .beginfindattr
.scanlistdone:
        pop     ecx
        sub     ecx, ebp
        sub     ecx, NTFS.ntfs_attrlist_buf-1Ah
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 0
        jnz     @f
        sub     ecx, NTFS.ntfs_attrlist_mft_buf-NTFS.ntfs_attrlist_buf
@@:
        cmp     ecx, 0x400
        jnz     .scanlistfound
        inc     edx
        push    esi edi
        lea     esi, [ebp+NTFS.ntfs_attrlist_buf+0x200]
        lea     edi, [ebp+NTFS.ntfs_attrlist_buf]
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 0
        jnz     @f
        lea     esi, [ebp+NTFS.ntfs_attrlist_mft_buf+0x200]
        lea     edi, [ebp+NTFS.ntfs_attrlist_mft_buf]
@@:
        mov     ecx, 0x200/4
        rep movsd
        mov     eax, edi
        pop     edi esi
        sub     esi, 0x200
        push    [ebp+NTFS.ntfs_cur_offs]
        push    [ebp+NTFS.ntfs_cur_size]
        push    [ebp+NTFS.ntfs_cur_read]
        push    [ebp+NTFS.ntfs_cur_buf]
        push    dword [ebp+NTFS.ntfs_attr_size]
        push    dword [ebp+NTFS.ntfs_attr_size+4]
        or      dword [ebp+NTFS.ntfs_attr_size], -1
        or      dword [ebp+NTFS.ntfs_attr_size+4], -1
        mov     [ebp+NTFS.ntfs_cur_offs], edx
        mov     [ebp+NTFS.ntfs_cur_size], 1
        and     [ebp+NTFS.ntfs_cur_read], 0
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        mov     ecx, [ebp+NTFS.ntfs_attr_list]
        push    esi edx edi
        call    .doreadattr
        pop     edi edx esi
        mov     ecx, [ebp+NTFS.ntfs_cur_read]
        pop     dword [ebp+NTFS.ntfs_attr_size+4]
        pop     dword [ebp+NTFS.ntfs_attr_size]
        pop     [ebp+NTFS.ntfs_cur_buf]
        pop     [ebp+NTFS.ntfs_cur_read]
        pop     [ebp+NTFS.ntfs_cur_size]
        pop     [ebp+NTFS.ntfs_cur_offs]
        jc      .errret
        lea     ecx, [ecx+ebp+NTFS.ntfs_attrlist_buf+0x200-0x1A]
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 0
        jnz     .scanliststart
        add     ecx, NTFS.ntfs_attrlist_mft_buf-NTFS.ntfs_attrlist_buf
        jmp     .scanliststart
 
.doreadattr:
        mov     [ebp+NTFS.ntfs_bCanContinue], 0
        cmp     byte [ecx+8], 0
        jnz     .nonresident
        mov     eax, [ecx+10h]  ; length
        mov     esi, eax
        mov     edx, [ebp+NTFS.ntfs_cur_offs]
        shr     eax, 9
        cmp     eax, edx
        jb      .okret
        shl     edx, 9
        sub     esi, edx
        movzx   eax, word [ecx+14h]
        add     edx, eax
        add     edx, ecx        ; edx -> data
        mov     eax, [ebp+NTFS.ntfs_cur_size]
        cmp     eax, (0xFFFFFFFF shr 9)+1
        jbe     @f
        mov     eax, (0xFFFFFFFF shr 9)+1
@@:
        shl     eax, 9
        cmp     eax, esi
        jbe     @f
        mov     eax, esi
@@:
; eax = length, edx -> data
        mov     [ebp+NTFS.ntfs_cur_read], eax
        mov     ecx, eax
        mov     eax, edx
        mov     ebx, [ebp+NTFS.ntfs_cur_buf]
        call    memmove
        and     [ebp+NTFS.ntfs_cur_size], 0      ; CF=0
        ret
.nonresident:
; Not all auxiliary records contain correct FileSize info
        mov     eax, dword [ebp+NTFS.ntfs_attr_size]
        mov     edx, dword [ebp+NTFS.ntfs_attr_size+4]
        push    eax
        and     eax, edx
        cmp     eax, -1
        pop     eax
        jnz     @f
        mov     eax, [ecx+30h]  ; FileSize
        mov     edx, [ecx+34h]
        mov     dword [ebp+NTFS.ntfs_attr_size], eax
        mov     dword [ebp+NTFS.ntfs_attr_size+4], edx
@@:
        add     eax, 0x1FF
        adc     edx, 0
        shrd    eax, edx, 9
        sub     eax, [ebp+NTFS.ntfs_cur_offs]
        ja      @f
; return with nothing read
        and     [ebp+NTFS.ntfs_cur_size], 0
.okret:
        clc
        ret
@@:
; reduce read length
        and     [ebp+NTFS.ntfs_cur_tail], 0
        cmp     [ebp+NTFS.ntfs_cur_size], eax
        jb      @f
        mov     [ebp+NTFS.ntfs_cur_size], eax
        mov     eax, dword [ebp+NTFS.ntfs_attr_size]
        and     eax, 0x1FF
        mov     [ebp+NTFS.ntfs_cur_tail], eax
@@:
        cmp     [ebp+NTFS.ntfs_cur_size], 0
        jz      .okret
        mov     eax, [ebp+NTFS.ntfs_cur_offs]
        xor     edx, edx
        div     [ebp+NTFS.sectors_per_cluster]
        sub     eax, [ecx+10h]  ; first_vbo
        jb      .okret
; eax = cluster, edx = starting sector
        cmp     [ebp+NTFS.ntfs_cur_attr], 0x80
        jnz     .sys
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 0
        jz      .sys
        push    fs_read64_app
        cmp     [ebp+NTFS.ntfsWriteAttr], 1
        jnz     @f
        mov     dword[esp], fs_write64_app
        jmp     @f
.sys:
        push    fs_read64_sys
@@:
        sub     esp, 10h
        movzx   esi, word [ecx+20h]     ; mcb_info_ofs
        add     esi, ecx
        xor     edi, edi
        mov     [ebp+NTFS.ntfsFragmentCount], 0
.readloop:
        call    ntfs_decode_mcb_entry
        jnc     .break
        add     edi, [esp+8]
        sub     eax, [esp]
        jae     .readloop
        push    ecx
        push    eax
        add     eax, [esp+8]
        add     eax, edi
        imul    eax, [ebp+NTFS.sectors_per_cluster]
        add     eax, edx
        pop     ecx
        neg     ecx
        imul    ecx, [ebp+NTFS.sectors_per_cluster]
        sub     ecx, edx
        cmp     ecx, [ebp+NTFS.ntfs_cur_size]
        jb      @f
        mov     ecx, [ebp+NTFS.ntfs_cur_size]
@@:
        mov     ebx, [ebp+NTFS.ntfs_cur_buf]
        mov     [ebp+NTFS.ntfsLastRead], eax
        push    ecx
        xor     edx, edx
 
 
 
 
        call    dword[esp+18h]
 
 
 
 
        pop     ecx
        test    eax, eax
        jnz     .errread2
        sub     [ebp+NTFS.ntfs_cur_size], ecx
        add     [ebp+NTFS.ntfs_cur_offs], ecx
        shl     ecx, 9
        add     [ebp+NTFS.ntfs_cur_read], ecx
        add     [ebp+NTFS.ntfs_cur_buf], ecx
        inc     [ebp+NTFS.ntfsFragmentCount]
        pop     ecx
        xor     eax, eax
        xor     edx, edx
        cmp     [ebp+NTFS.ntfs_cur_size], 0
        jnz     .readloop
        add     esp, 14h
        mov     eax, [ebp+NTFS.ntfs_cur_tail]
        test    eax, eax
        jz      @f
        sub     eax, 0x200
        add     [ebp+NTFS.ntfs_cur_read], eax
@@:
        clc
        ret
.errread2:
        pop     ecx
        add     esp, 14h
        stc
        ret
.break:
        add     esp, 14h        ; CF=0
        mov     [ebp+NTFS.ntfs_bCanContinue], 1
        ret
 
ntfs_read_file_record:
; in: eax = iRecord
; out: [ebp+NTFS.frs_buffer] = record data
; CF=1 -> failed, eax = disk error code, eax=0 -> something with FS
    ; Read attr $DATA of $Mft, starting from eax*[ebp+NTFS.frs_size]
        push    ecx edx
        mov     ecx, [ebp+NTFS.frs_size]
        mul     ecx
        shrd    eax, edx, 9
        shr     edx, 9
        jnz     .errret
        push    [ebp+NTFS.ntfs_attr_iRecord]
        push    [ebp+NTFS.ntfs_attr_iBaseRecord]
        push    [ebp+NTFS.ntfs_attr_offs]
        push    [ebp+NTFS.ntfs_attr_list]
        push    dword [ebp+NTFS.ntfs_attr_size+4]
        push    dword [ebp+NTFS.ntfs_attr_size]
        push    [ebp+NTFS.ntfs_cur_iRecord]
        push    [ebp+NTFS.ntfs_cur_attr]
        push    [ebp+NTFS.ntfs_cur_offs]
        push    [ebp+NTFS.ntfs_cur_size]
        push    [ebp+NTFS.ntfs_cur_buf]
        push    [ebp+NTFS.ntfs_cur_read]
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80   ; $DATA
        and     [ebp+NTFS.ntfs_cur_iRecord], 0   ; $Mft
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        shr     ecx, 9
        mov     [ebp+NTFS.ntfs_cur_size], ecx
        mov     eax, [ebp+NTFS.frs_buffer]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr
        mov     edx, [ebp+NTFS.ntfs_cur_read]
        pop     [ebp+NTFS.ntfs_cur_read]
        pop     [ebp+NTFS.ntfs_cur_buf]
        pop     [ebp+NTFS.ntfs_cur_size]
        pop     [ebp+NTFS.ntfs_cur_offs]
        pop     [ebp+NTFS.ntfs_cur_attr]
        pop     [ebp+NTFS.ntfs_cur_iRecord]
        pop     dword [ebp+NTFS.ntfs_attr_size]
        pop     dword [ebp+NTFS.ntfs_attr_size+4]
        pop     [ebp+NTFS.ntfs_attr_list]
        pop     [ebp+NTFS.ntfs_attr_offs]
        pop     [ebp+NTFS.ntfs_attr_iBaseRecord]
        pop     [ebp+NTFS.ntfs_attr_iRecord]
        jc      .ret
        cmp     edx, [ebp+NTFS.frs_size]
        jnz     .errret
        mov     eax, [ebp+NTFS.frs_buffer]
        cmp     dword [eax], 'FILE'
        jnz     .errret
        push    ebx
        mov     ebx, eax
        call    ntfs_restore_usa_frs
        pop     ebx
        jc      .errret
.ret:
        pop     edx ecx
        ret
.errret:
        pop     edx ecx
        xor     eax, eax
        stc
        ret
 
ntfs_restore_usa_frs:
        mov     eax, [ebp+NTFS.frs_size]
ntfs_restore_usa:
        pushad
        shr     eax, 9
        mov     ecx, eax
        inc     eax
        cmp     [ebx+6], ax
        jnz     .err
        movzx   eax, word [ebx+4]
        lea     esi, [eax+ebx]
        lodsw
        mov     edx, eax
        lea     edi, [ebx+0x1FE]
@@:
        cmp     [edi], dx
        jnz     .err
        lodsw
        stosw
        add     edi, 0x1FE
        loop    @b
        popad
        clc
        ret
.err:
        popad
        stc
        ret
 
ntfs_decode_mcb_entry:
;   in:
; esi -> mcb entry
; esp -> buffer (16 bytes)
;   out:
; esi -> next mcb entry
; esp -> data run size
; esp+8 -> cluster (delta)
; CF=0 -> mcb end
        push    eax ecx edi
        lea     edi, [esp+16]
        xor     eax, eax
        lodsb
        test    al, al
        jz      .end
        mov     ecx, eax
        and     ecx, 0xF
        cmp     ecx, 8
        ja      .end
        push    ecx
        rep movsb
        pop     ecx
        sub     ecx, 8
        neg     ecx
        cmp     byte [esi-1], 80h
        jae     .end
        push    eax
        xor     eax, eax
        rep stosb
        pop     ecx
        shr     ecx, 4
        cmp     ecx, 8
        ja      .end
        push    ecx
        rep movsb
        pop     ecx
        sub     ecx, 8
        neg     ecx
        cmp     byte [esi-1], 80h
        cmc
        sbb     eax, eax
        rep stosb
        stc
.end:
        pop     edi ecx eax
        ret
 
unichar_toupper:
        push    eax
        call    uni2ansi_char
        cmp     al, '_'
        jz      .unk
        add     esp, 4
        call    char_toupper
        jmp     ansi2uni_char
.unk:
        pop     eax
        ret
 
ntfs_find_lfn:
; in: [esi]+[esp+4] = name
;   out:
; [ebp+NTFS.ntfs_cur_iRecord] = number of MFT fileRecord
; eax -> index in the parent index node
; CF=1 -> file not found, eax=0 -> error
        mov     [ebp+NTFS.ntfs_cur_iRecord], 5   ; start parse from root cluster
.doit2:
        mov     [ebp+NTFS.ntfs_cur_attr], 0x90   ; $INDEX_ROOT
        and     [ebp+NTFS.ntfs_cur_offs], 0
        mov     eax, [ebp+NTFS.cur_index_size]
        mov     [ebp+NTFS.ntfs_cur_size], eax
        mov     eax, [ebp+NTFS.cur_index_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr
        mov     eax, 0
        jnc     @f
.ret:
        ret     4
@@:
 
        cmp     [ebp+NTFS.ntfs_cur_read], 0x20
        jc      .ret
        pushad
        mov     esi, [ebp+NTFS.cur_index_buf]
        mov     eax, [esi+14h]
        add     eax, 10h
        cmp     [ebp+NTFS.ntfs_cur_read], eax
        jae     .readok1
        add     eax, 1FFh
        shr     eax, 9
        cmp     eax, [ebp+NTFS.cur_index_size]
        ja      @f
.stc_ret:
        popad
        stc
        ret     4
@@:
; reallocate
        push    eax
        stdcall kernel_free, [ebp+NTFS.cur_index_buf]
        pop     eax
        mov     [ebp+NTFS.cur_index_size], eax
        stdcall kernel_alloc, eax
        test    eax, eax
        jnz     @f
        and     [ebp+NTFS.cur_index_size], 0
        and     [ebp+NTFS.cur_index_buf], 0
        jmp     .stc_ret
@@:
        mov     [ebp+NTFS.cur_index_buf], eax
        popad
        jmp     .doit2
.readok1:
        mov     edx, [esi+8]    ; subnode_size
        shr     edx, 9
        cmp     edx, [ebp+NTFS.cur_index_size]
        jbe     .ok2
        push    esi edx
        stdcall kernel_alloc, edx
        pop     edx esi
        test    eax, eax
        jz      .stc_ret
        mov     edi, eax
        mov     ecx, [ebp+NTFS.cur_index_size]
        shl     ecx, 9-2
        rep movsd
        mov     esi, eax
        mov     [ebp+NTFS.cur_index_size], edx
        push    esi edx
        stdcall kernel_free, [ebp+NTFS.cur_index_buf]
        pop     edx esi
        mov     [ebp+NTFS.cur_index_buf], esi
.ok2:
        add     esi, 10h
        mov     edi, [esp+4]
; edi -> name, esi -> current index data, edx = subnode size
.scanloop:
        add     esi, [esi]
.scanloopint:
        test    byte [esi+0Ch], 2
        jnz     .subnode
        push    esi
        add     esi, 0x52
        movzx   ecx, byte [esi-2]
        push    edi
@@:
        lodsw
        call    unichar_toupper
        push    eax
        mov     al, [edi]
        inc     edi
        cmp     al, '/'
        jz      .slash
        call    char_toupper
        call    ansi2uni_char
        cmp     ax, [esp]
        pop     eax
        loopz   @b
        jz      .found
        pop     edi
        pop     esi
        jb      .subnode
.scanloopcont:
        movzx   eax, word [esi+8]
        add     esi, eax
        jmp     .scanloopint
.slash:
        pop     eax
        pop     edi
        pop     esi
.subnode:
        test    byte [esi+0Ch], 1
        jz      .notfound
        movzx   eax, word [esi+8]
        mov     eax, [esi+eax-8]
        imul    eax, [ebp+NTFS.sectors_per_cluster]
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_attr], 0xA0   ; $INDEX_ALLOCATION
        mov     [ebp+NTFS.ntfs_cur_size], edx
        mov     eax, [ebp+NTFS.cur_index_buf]
        mov     esi, eax
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        push    edx
        call    ntfs_read_attr
        pop     edx
        mov     eax, edx
        shl     eax, 9
        cmp     [ebp+NTFS.ntfs_cur_read], eax
        jnz     .err
        cmp     dword [esi], 'INDX'
        jnz     .err
        mov     [ebp+NTFS.ntfs_cur_buf], esi
        mov     ebx, esi
        call    ntfs_restore_usa
        jc      .err
        add     esi, 0x18
        jmp     .scanloop
.notfound:
 
        mov     [esp+1Ch], esi
.err:
        popad
        stc
        ret     4
.found:
        cmp     byte [edi], 0
        jz      .done
        cmp     byte [edi], '/'
        jz      .next
        pop     edi
        pop     esi
        jmp     .scanloopcont
.done:
.next:
        pop     esi
        pop     esi
        mov     eax, [esi]
        mov     [ebp+NTFS.ntfs_cur_iRecord], eax
        mov     [esp+1Ch], esi
        mov     [esp+4], edi
        popad
        inc     esi
        cmp     byte [esi-1], 0
        jnz     .doit2
        cmp     dword [esp+4], 0
        jz      @f
        mov     esi, [esp+4]
        mov     dword [esp+4], 0
        jmp     .doit2
@@:
        ret     4
 
;----------------------------------------------------------------
ntfs_ReadFile:
        cmp     byte [esi], 0
        jnz     @f
        or      ebx, -1
        movi    eax, ERROR_ACCESS_DENIED
        ret
@@:
        call    ntfs_lock
        stdcall ntfs_find_lfn, [esp+4]
        jnc     .found
        call    ntfs_unlock
        or      ebx, -1
        movi    eax, ERROR_FILE_NOT_FOUND
        ret
.found:
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80   ; $DATA
        and     [ebp+NTFS.ntfs_cur_offs], 0
        and     [ebp+NTFS.ntfs_cur_size], 0
        call    ntfs_read_attr
        jnc     @f
        call    ntfs_unlock
        or      ebx, -1
        movi    eax, ERROR_ACCESS_DENIED
        ret
@@:
        pushad
        and     dword [esp+10h], 0
        xor     eax, eax
        cmp     dword [ebx+8], 0x200
        jb      @f
.eof0:
        popad
        xor     ebx, ebx
.eof:
        push    ERROR_END_OF_FILE
        call    ntfs_unlock
        pop     eax
        ret
@@:
        mov     ecx, [ebx+12]
        mov     edx, [ebx+16]
        mov     eax, [ebx+4]
        test    eax, 0x1FF
        jz      .alignedstart
        push    edx
        mov     edx, [ebx+8]
        shrd    eax, edx, 9
        pop     edx
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_size], 1
        lea     eax, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr.continue
        mov     eax, [ebx+4]
        and     eax, 0x1FF
        lea     esi, [ebp+NTFS.ntfs_bitmap_buf+eax]
        sub     eax, [ebp+NTFS.ntfs_cur_read]
        jae     .eof0
        neg     eax
        push    ecx
        cmp     ecx, eax
        jb      @f
        mov     ecx, eax
@@:
        mov     [esp+10h+4], ecx
        mov     edi, edx
        rep movsb
        mov     edx, edi
        pop     ecx
        sub     ecx, [esp+10h]
        jnz     @f
.retok:
        popad
        call    ntfs_unlock
        xor     eax, eax
        ret
@@:
        cmp     [ebp+NTFS.ntfs_cur_read], 0x200
        jz      .alignedstart
.eof_ebx:
        popad
        jmp     .eof
.alignedstart:
        mov     eax, [ebx+4]
        push    edx
        mov     edx, [ebx+8]
        add     eax, 511
        adc     edx, 0
        shrd    eax, edx, 9
        pop     edx
 
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_buf], edx
        mov     eax, ecx
        shr     eax, 9
        mov     [ebp+NTFS.ntfs_cur_size], eax
        add     eax, [ebp+NTFS.ntfs_cur_offs]
        push    eax
        call    ntfs_read_attr.continue
        pop     [ebp+NTFS.ntfs_cur_offs]
        mov     eax, [ebp+NTFS.ntfs_cur_read]
        add     [esp+10h], eax
        mov     eax, ecx
        and     eax, not 0x1FF
        cmp     [ebp+NTFS.ntfs_cur_read], eax
        jnz     .eof_ebx
        and     ecx, 0x1FF
        jz      .retok
        add     edx, [ebp+NTFS.ntfs_cur_read]
        mov     [ebp+NTFS.ntfs_cur_size], 1
        lea     eax, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr.continue
        cmp     [ebp+NTFS.ntfs_cur_read], ecx
        jb      @f
        mov     [ebp+NTFS.ntfs_cur_read], ecx
@@:
        xchg    ecx, [ebp+NTFS.ntfs_cur_read]
        push    ecx
        mov     edi, edx
        lea     esi, [ebp+NTFS.ntfs_bitmap_buf]
        add     [esp+10h+4], ecx
        rep movsb
        pop     ecx
        xor     eax, eax
        cmp     ecx, [ebp+NTFS.ntfs_cur_read]
        jz      @f
        mov     al, ERROR_END_OF_FILE
@@:
        mov     [esp+1Ch], eax
        call    ntfs_unlock
        popad
        ret
 
;----------------------------------------------------------------
ntfs_ReadFolder:
        call    ntfs_lock
        mov     eax, 5          ; root cluster
        cmp     byte [esi], 0
        jz      .doit
        stdcall ntfs_find_lfn, [esp+4]
        jnc     .doit2
.notfound:
        or      ebx, -1
        push    ERROR_FILE_NOT_FOUND
.pop_ret:
        call    ntfs_unlock
        pop     eax
        ret
.doit:
        mov     [ebp+NTFS.ntfs_cur_iRecord], eax
.doit2:
        mov     [ebp+NTFS.ntfs_cur_attr], 0x10   ; $STANDARD_INFORMATION
        and     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 1
        lea     eax, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr
        jc      .notfound
        mov     [ebp+NTFS.ntfs_cur_attr], 0x90   ; $INDEX_ROOT
        and     [ebp+NTFS.ntfs_cur_offs], 0
        mov     eax, [ebp+NTFS.cur_index_size]
        mov     [ebp+NTFS.ntfs_cur_size], eax
        mov     eax, [ebp+NTFS.cur_index_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr
        jnc     .ok
        test    eax, eax
        jz      .notfound
        or      ebx, -1
        push    ERROR_DEVICE
        jmp     .pop_ret
.ok:
        cmp     [ebp+NTFS.ntfs_cur_read], 0x20
        jae     @f
        or      ebx, -1
.fserr:
        push    ERROR_FAT_TABLE
        jmp     .pop_ret
@@:
        pushad
        mov     esi, [ebp+NTFS.cur_index_buf]
        mov     eax, [esi+14h]
        add     eax, 10h
        cmp     [ebp+NTFS.ntfs_cur_read], eax
        jae     .readok1
        add     eax, 1FFh
        shr     eax, 9
        cmp     eax, [ebp+NTFS.cur_index_size]
        ja      @f
        popad
        jmp     .fserr
@@:
; reallocate
        push    eax
        stdcall kernel_free, [ebp+NTFS.cur_index_buf]
        pop     eax
        mov     [ebp+NTFS.cur_index_size], eax
        stdcall kernel_alloc, eax
        test    eax, eax
        jnz     @f
        and     [ebp+NTFS.cur_index_size], 0
        and     [ebp+NTFS.cur_index_buf], 0
.nomem:
        call    ntfs_unlock
        popad
        or      ebx, -1
        movi    eax, ERROR_OUT_OF_MEMORY
        ret
@@:
        mov     [ebp+NTFS.cur_index_buf], eax
        popad
        jmp     .doit2
.readok1:
        mov     edx, [esi+8]    ; subnode_size
        shr     edx, 9
        mov     [ebp+NTFS.cur_subnode_size], edx
        cmp     edx, [ebp+NTFS.cur_index_size]
        jbe     .ok2
        push    esi edx
        stdcall kernel_alloc, edx
        pop     edx esi
        test    eax, eax
        jz      .nomem
        mov     edi, eax
        mov     ecx, [ebp+NTFS.cur_index_size]
        shl     ecx, 9-2
        rep movsd
        mov     esi, eax
        mov     [ebp+NTFS.cur_index_size], edx
        stdcall kernel_free, [ebp+NTFS.cur_index_buf]
        mov     [ebp+NTFS.cur_index_buf], esi
.ok2:
        add     esi, 10h
        mov     edx, [ebx+16]
        push    dword [ebx+8]   ; read ANSI/UNICODE name
; init header
        mov     edi, edx
        mov     ecx, 32/4
        xor     eax, eax
        rep stosd
        mov     byte [edx], 1   ; version
        mov     ecx, [ebx+12]
        mov     ebx, [ebx+4]
        push    edx
        mov     edx, esp
; edi -> BDFE, esi -> current index data, ebx = first wanted block,
; ecx = number of blocks to read
; edx -> parameters block: dd , dd 
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 5
        jz      .skip_specials
; dot and dotdot entries
        push    esi
        xor     esi, esi
        call    .add_special_entry
        inc     esi
        call    .add_special_entry
        pop     esi
.skip_specials:
; at first, dump index root
        add     esi, [esi]
.dump_root:
        test    byte [esi+0Ch], 2
        jnz     .dump_root_done
        call    .add_entry
        movzx   eax, word [esi+8]
        add     esi, eax
        jmp     .dump_root
.dump_root_done:
; now dump all subnodes
        push    ecx edi
        lea     edi, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], edi
        mov     ecx, 0x400/4
        xor     eax, eax
        rep stosd
        mov     [ebp+NTFS.ntfs_cur_attr], 0xB0   ; $BITMAP
        and     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 2
        call    ntfs_read_attr
        pop     edi ecx
        push    0       ; save offset in $BITMAP attribute
        and     [ebp+NTFS.ntfs_cur_offs], 0
.dumploop:
        mov     [ebp+NTFS.ntfs_cur_attr], 0xA0
        mov     eax, [ebp+NTFS.cur_subnode_size]
        mov     [ebp+NTFS.ntfs_cur_size], eax
        mov     eax, [ebp+NTFS.cur_index_buf]
        mov     esi, eax
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        push    [ebp+NTFS.ntfs_cur_offs]
        mov     eax, [ebp+NTFS.ntfs_cur_offs]
        imul    eax, [ebp+NTFS.cur_subnode_size]
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        call    ntfs_read_attr
        pop     [ebp+NTFS.ntfs_cur_offs]
        mov     eax, [ebp+NTFS.cur_subnode_size]
        shl     eax, 9
        cmp     [ebp+NTFS.ntfs_cur_read], eax
        jnz     .done
        push    eax
        mov     eax, [ebp+NTFS.ntfs_cur_offs]
        and     eax, 0x400*8-1
        bt      dword [ebp+NTFS.ntfs_bitmap_buf], eax
        pop     eax
        jnc     .dump_subnode_done
        cmp     dword [esi], 'INDX'
        jnz     .dump_subnode_done
        push    ebx
        mov     ebx, esi
        call    ntfs_restore_usa
        pop     ebx
        jc      .dump_subnode_done
        add     esi, 0x18
        add     esi, [esi]
.dump_subnode:
        test    byte [esi+0Ch], 2
        jnz     .dump_subnode_done
        call    .add_entry
        movzx   eax, word [esi+8]
        add     esi, eax
        jmp     .dump_subnode
.dump_subnode_done:
        inc     [ebp+NTFS.ntfs_cur_offs]
        test    [ebp+NTFS.ntfs_cur_offs], 0x400*8-1
        jnz     .dumploop
        mov     [ebp+NTFS.ntfs_cur_attr], 0xB0
        push    ecx edi
        lea     edi, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], edi
        mov     ecx, 0x400/4
        xor     eax, eax
        rep stosd
        pop     edi ecx
        pop     eax
        push    [ebp+NTFS.ntfs_cur_offs]
        inc     eax
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_size], 2
        push    eax
        call    ntfs_read_attr
        pop     eax
        pop     [ebp+NTFS.ntfs_cur_offs]
        push    eax
        jmp     .dumploop
.done:
        pop     eax
        pop     edx
        mov     ebx, [edx+4]
        pop     edx
        xor     eax, eax
        dec     ecx
        js      @f
        mov     al, ERROR_END_OF_FILE
@@:
        mov     [esp+1Ch], eax
        mov     [esp+10h], ebx
        call    ntfs_unlock
        popad
        ret
 
.add_special_entry:
        mov     eax, [edx]
        inc     dword [eax+8]   ; new file found
        dec     ebx
        jns     .ret
        dec     ecx
        js      .ret
        inc     dword [eax+4]   ; new file block copied
        mov     eax, [edx+4]
        mov     [edi+4], eax
;        mov     eax, dword [ntfs_bitmap_buf+0x20]
;        or      al, 0x10
        mov     eax, 0x10
        stosd
        scasd
        push    edx
        mov     eax, dword [ebp+NTFS.ntfs_bitmap_buf]
        mov     edx, dword [ebp+NTFS.ntfs_bitmap_buf+4]
        call    ntfs_datetime_to_bdfe
        mov     eax, dword [ebp+NTFS.ntfs_bitmap_buf+0x18]
        mov     edx, dword [ebp+NTFS.ntfs_bitmap_buf+0x1C]
        call    ntfs_datetime_to_bdfe
        mov     eax, dword [ebp+NTFS.ntfs_bitmap_buf+8]
        mov     edx, dword [ebp+NTFS.ntfs_bitmap_buf+0xC]
        call    ntfs_datetime_to_bdfe
        pop     edx
        xor     eax, eax
        stosd
        stosd
        mov     al, '.'
        push    edi ecx
        lea     ecx, [esi+1]
        test    byte [edi-0x24], 1
        jz      @f
        rep stosw
        pop     ecx
        xor     eax, eax
        stosw
        pop     edi
        add     edi, 520
        ret
@@:
        rep stosb
        pop     ecx
        xor     eax, eax
        stosb
        pop     edi
        add     edi, 264
.ret:
        ret
 
.add_entry:
; do not return DOS 8.3 names
        cmp     byte [esi+0x51], 2
        jz      .ret
; do not return system files
; ... note that there will be no bad effects if system files also were reported ...
        cmp     dword [esi], 0x10
        jb      .ret
        mov     eax, [edx]
        inc     dword [eax+8]   ; new file found
        dec     ebx
        jns     .ret
        dec     ecx
        js      .ret
        inc     dword [eax+4]   ; new file block copied
        mov     eax, [edx+4]    ; flags
        call    ntfs_direntry_to_bdfe
        push    ecx esi edi
        movzx   ecx, byte [esi+0x50]
        add     esi, 0x52
        test    byte [edi-0x24], 1
        jz      .ansi
        shr     ecx, 1
        rep movsd
        adc     ecx, ecx
        rep movsw
        and     word [edi], 0
        pop     edi
        add     edi, 520
        pop     esi ecx
        ret
.ansi:
        jecxz   .skip
@@:
        lodsw
        call    uni2ansi_char
        stosb
        loop    @b
.skip:
        xor     al, al
        stosb
        pop     edi
        add     edi, 264
        pop     esi ecx
        ret
 
ntfs_direntry_to_bdfe:
        mov     [edi+4], eax    ; ANSI/UNICODE name
        mov     eax, [esi+48h]
        test    eax, 0x10000000
        jz      @f
        and     eax, not 0x10000000
        or      al, 0x10
@@:
        stosd
        scasd
        push    edx
        mov     eax, [esi+0x18]
        mov     edx, [esi+0x1C]
        call    ntfs_datetime_to_bdfe
        mov     eax, [esi+0x30]
        mov     edx, [esi+0x34]
        call    ntfs_datetime_to_bdfe
        mov     eax, [esi+0x20]
        mov     edx, [esi+0x24]
        call    ntfs_datetime_to_bdfe
        pop     edx
        mov     eax, [esi+0x40]
        stosd
        mov     eax, [esi+0x44]
        stosd
        ret
 
iglobal
_24             dd      24
_60             dd      60
_10000000       dd      10000000
days400year     dd      365*400+100-4+1
days100year     dd      365*100+25-1
days4year       dd      365*4+1
days1year       dd      365
months  dd  31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
months2 dd  31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
_400            dd      400
_100            dd      100
endg
 
ntfs_datetime_to_bdfe:
; edx:eax = number of 100-nanosecond intervals since January 1, 1601, in UTC
        push    eax
        mov     eax, edx
        xor     edx, edx
        div     [_10000000]
        xchg    eax, [esp]
        div     [_10000000]
        pop     edx
    .sec:
; edx:eax = number of seconds since January 1, 1601
        push    eax
        mov     eax, edx
        xor     edx, edx
        div     [_60]
        xchg    eax, [esp]
        div     [_60]
        mov     [edi], dl
        pop     edx
; edx:eax = number of minutes
        div     [_60]
        mov     [edi+1], dl
; eax = number of hours (note that 2^64/(10^7*60*60) < 2^32)
        xor     edx, edx
        div     [_24]
        mov     [edi+2], dl
        mov     [edi+3], byte 0
; eax = number of days since January 1, 1601
        xor     edx, edx
        div     [days400year]
        imul    eax, 400
        add     eax, 1601
        mov     [edi+6], ax
        mov     eax, edx
        xor     edx, edx
        div     [days100year]
        cmp     al, 4
        jnz     @f
        dec     eax
        add     edx, [days100year]
@@:
        imul    eax, 100
        add     [edi+6], ax
        mov     eax, edx
        xor     edx, edx
        div     [days4year]
        shl     eax, 2
        add     [edi+6], ax
        mov     eax, edx
        xor     edx, edx
        div     [days1year]
        cmp     al, 4
        jnz     @f
        dec     eax
        add     edx, [days1year]
@@:
        add     [edi+6], ax
        push    esi edx
        mov     esi, months
        movzx   eax, word [edi+6]
        test    al, 3
        jnz     .noleap
        xor     edx, edx
        push    eax
        div     [_400]
        pop     eax
        test    edx, edx
        jz      .leap
        xor     edx, edx
        div     [_100]
        test    edx, edx
        jz      .noleap
.leap:
        mov     esi, months2
.noleap:
        pop     edx
        xor     eax, eax
        inc     eax
@@:
        sub     edx, [esi]
        jb      @f
        add     esi, 4
        inc     eax
        jmp     @b
@@:
        add     edx, [esi]
        pop     esi
        inc     edx
        mov     [edi+4], dl
        mov     [edi+5], al
        add     edi, 8
        ret
 
;----------------------------------------------------------------
ntfs_CreateFolder:
        mov     [ebp+NTFS.ntfsFolder], 1
        jmp     @f
 
ntfs_CreateFile:
        mov     [ebp+NTFS.ntfsFolder], 0
@@:
        cmp     byte [esi], 0
        jnz     @f
        xor     ebx, ebx
        movi    eax, ERROR_ACCESS_DENIED
        ret
@@: ; 1. Search file
        call    ntfs_lock
 
        stdcall ntfs_find_lfn, [esp+4]
        jnc     .found
        cmp     [ebp+NTFS.ntfsFragmentCount], 1
        jnz     ntfsUnsupported     ; record fragmented
        test    eax, eax
        jz      ntfsFail
        jmp     .notFound
 
.found:     ; rewrite
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 16
        jc      ntfsDenied
        cmp     [ebp+NTFS.ntfsFolder], 1
        jz      ntfsDenied
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80
        mov     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 0
        call    ntfs_read_attr
        jc      ntfsDenied
        mov     eax, [ebp+NTFS.frs_buffer]
        cmp     word [eax+baseRecordReuse], 0
        jnz     ntfsUnsupported     ; auxiliary record
        cmp     byte [eax+hardLinkCounter], 1
        jnz     ntfsUnsupported     ; file copying required
        mov     ecx, [ebp+NTFS.ntfs_attr_offs]
        cmp     byte [ecx+nonResidentFlag], 1
        jnz     ntfsUnsupported     ; resident $DATA
        mov     eax, [ebx+4]
        mov     edx, [ebx+8]
        add     eax, [ebx+12]
        adc     edx, 0
        cmp     edx, [ecx+attributeRealSize+4]
        jnz     ntfsUnsupported
        cmp     [ecx+attributeRealSize], eax
        jnz     ntfsUnsupported
        jmp     ntfs_WriteFile.write
 
.notFound:  ; create; check path folders
        cmp     dword [esp+4], 0
        jnz     ntfsNotFound
        cmp     byte [esi], 0
 
 
 
        jz      ntfsNotFound
; 2. Prepare directory record
        mov     ecx, esi
@@:         ; count characters
        inc     ecx
        cmp     byte [ecx], '/'
        jz      ntfsNotFound
        cmp     byte [ecx], 0
        jnz     @b
        sub     ecx, esi
        push    ecx
        lea     ecx, [ecx*2+52h]    ; precalculate index length
        add     ecx, 7              ; align 8
        and     ecx, not 7
        mov     edi, [ebp+NTFS.cur_index_buf]
        push    esi
        push    ecx
        cmp     dword [edi], 'INDX'
        jz      .indexRecord
        mov     esi, [ebp+NTFS.frs_buffer]  ; indexRoot
        mov     edx, [esi+recordRealSize]
        add     edx, ecx
        cmp     [esi+recordAllocatedSize], edx
        jnc     @f
        add     esp, 12
        jmp     ntfsUnsupported     ; indexAllocation required
 
@@:         ; index fits in the indexRoot
        mov     [esi+recordRealSize], edx
        mov     ecx, edx
        shr     ecx, 2
        rep movsd
        mov     edi, [ebp+NTFS.ntfs_attr_offs]
        sub     edi, [ebp+NTFS.frs_buffer]
        add     edi, [ebp+NTFS.cur_index_buf]
        mov     esi, [esp]
        add     [edi+sizeWithHeader], esi
        add     [edi+sizeWithoutHeader], esi
        mov     cl, [edi+attributeOffset]
        add     edi, ecx
        add     [edi+16+nodeRealSize], esi
        add     [edi+16+nodeAllocatedSize], esi
        sub     eax, [ebp+NTFS.cur_index_buf]
        add     eax, edi
        mov     edi, [ebp+NTFS.cur_index_buf]
        add     edi, edx
        sub     edi, 4
        jmp     .common
 
.indexRecord:
        mov     edx, [edi+28]
        add     edx, ecx
        cmp     [edi+32], edx
        jnc     @f
        add     esp, 12
        jmp     ntfsUnsupported     ; new node required
 
@@:         ; index fits in the node
        mov     [edi+28], edx
        lea     edi, [edi+edx+24-4]
.common:
        mov     esi, edi
        sub     esi, [esp]
        mov     ecx, esi
        sub     ecx, eax    ; eax = pointer in the node
        shr     ecx, 2
        inc     ecx
        std
        rep movsd           ; move forward, make space
        mov     ecx, [esp]
        shr     ecx, 2
        xor     eax, eax
        rep stosd
        cld
        add     edi, 4
        pop     eax
        pop     esi
        mov     [edi+indexAllocatedSize], ax     ; fill index with data
        mov     eax, [esp]
        lea     eax, [eax*2+42h]
        mov     [edi+indexRawSize], ax
        mov     eax, [ebp+NTFS.ntfs_attr_iRecord]
        mov     [edi+directoryRecordReference], eax
        mov     eax, [ebp+NTFS.frs_buffer]
        mov     eax, [eax+reuseCounter]
        mov     [edi+directoryReferenceReuse], ax
        mov     eax, [ebx+12]
        mov     [ebp+NTFS.fileRealSize], eax
        mov     [edi+fileRealSize], eax
        mov     ecx, [ebp+NTFS.sectors_per_cluster]
        shl     ecx, 9
        add     eax, ecx
        dec     eax
        xor     edx, edx
        div     ecx
        mov     [ebp+NTFS.fileDataSize], eax
        mul     ecx
        mov     [edi+fileAllocatedSize], eax
        pop     ecx
        mov     [ebp+NTFS.indexOffset], edi
        mov     [edi+fileNameLength], cl
        add     edi, 52h
@@:         ; record filename
        lodsb
        call    ansi2uni_char
        stosw
        dec     ecx
        jnz     @b
        mov     eax, [ebp+NTFS.ntfsLastRead]
        mov     [ebp+NTFS.nodeLastRead], eax
        cmp     [ebp+NTFS.ntfsFolder], 0
        jz      @f
        mov     edi, [ebp+NTFS.indexOffset]
        mov     byte [edi+fileFlags+3], 16
        jmp     .mftBitmap
 
@@: ; 3. File data
        cmp     [ebp+NTFS.fileRealSize], 0
        jz      .mftBitmap
; One piece free space bitmap search engine
        mov     edi, [ebp+NTFS.BitmapBuffer]
        add     edi, [ebp+NTFS.BitmapStart]
        mov     eax, [ebp+NTFS.fileDataSize]
        shr     eax, 5
        jz      .small
        push    eax         ; bitmap dwords
        add     edi, 4
 
.start:
        mov     ecx, [ebp+NTFS.BitmapSize]
 
        add     ecx, [ebp+NTFS.BitmapBuffer]
        sub     ecx, edi
        shr     ecx, 2
@@:
        xor     eax, eax
        repnz scasd         ; search for empty dword
        jz      @f
        call    bitmapBuffering
        jmp     @b
@@:
        cmp     ecx, [esp]
        jnc     @f
        call    bitmapBuffering
        jmp     @b
@@:
        sub     edi, 4
        mov     ecx, [esp]
        mov     esi, edi
        xor     eax, eax
        repz scasd          ; check following dwords
        jnz     .start
        sub     esi, 4
        mov     eax, [esi]
        xor     edx, edx
        bsr     edx, eax
        inc     edx
        push    edx         ; starting bit
        push    esi         ; starting dword
        add     esi, 4
        neg     edx
        add     edx, 32
        mov     eax, [ebp+NTFS.fileDataSize]
        sub     eax, edx
        mov     edx, eax
        shr     eax, 5
        shl     eax, 2
        add     esi, eax
        mov     eax, [esi]
        bsf     ecx, eax    ; last dword
        jz      .done
        and     edx, 31
        cmp     ecx, edx
        jnc     .done
        add     esp, 8
        jmp     .start
 
.small:     ; less than 32 clusters
        mov     ecx, [ebp+NTFS.BitmapSize]
        sub     ecx, [ebp+NTFS.BitmapStart]
        shr     ecx, 2
.smStart:
        mov     eax, -1
        repz scasd          ; search for zero bits
        push    ecx
        test    ecx, ecx
        jnz     @f
        call    bitmapBuffering
        pop     eax
        jmp     .smStart
@@:
        sub     edi, 4
        mov     eax, [edi]
        not     eax
@@:
        bsf     ecx, eax    ; first 0
        jz      .again
        not     eax
        shr     eax, cl
        shl     eax, cl
        bsf     edx, eax    ; next 1
        jz      @f
        sub     edx, ecx
        cmp     edx, [ebp+NTFS.fileDataSize]
        jnc     .got        ; fits inside
        bsf     ecx, eax
        not     eax
        shr     eax, cl
        shl     eax, cl
        jmp     @b
@@:         ; next dword
        mov     eax, [edi+4]
        bsf     edx, eax
        jz      .got        ; empty
        add     edx, 32
        sub     edx, ecx
        cmp     edx, [ebp+NTFS.fileDataSize]
        jnc     .got        ; share between dwords
.again:
        add     edi, 4
        pop     ecx
        jmp     .smStart
 
.got:
        push    ecx         ; starting bit
        push    edi         ; starting dword
.done:      ; mark space
        mov     ecx, [esp+4]
        cmp     ecx, 32
        jc      @f
        xor     ecx, ecx
        add     dword [esp], 4
        mov     [esp+4], ecx
@@:
        mov     edi, [esp]
        xor     eax, eax
        dec     eax
        shr     eax, cl
        shl     eax, cl
        neg     ecx
        add     ecx, 32
 
        sub     ecx, [ebp+NTFS.fileDataSize]
        jc      @f
        shl     eax, cl     ; fits inside dword
 
 
 
 
        shr     eax, cl
        or      [edi], eax
        jmp     .writeData
 
@@:
        or      [edi], eax
        neg     ecx
        push    ecx
        shr     ecx, 5
        add     edi, 4
        xor     eax, eax
        dec     eax
        rep stosd
        pop     ecx
        and     ecx, 31
        shr     eax, cl
        shl     eax, cl
        not     eax
        or      [edi], eax
.writeData:
        pop     edx
        sub     edx, [ebp+NTFS.BitmapBuffer]
        shl     edx, 3
        pop     eax
        add     eax, edx
        pop     edx
        mov     [ebp+NTFS.fileDataStart], eax
        mul     [ebp+NTFS.sectors_per_cluster]
        mov     ecx, [ebp+NTFS.fileRealSize]
        add     ecx, 511
        shr     ecx, 9
        mov     ebx, [ebx+16]
        call    fs_write64_app
        test    eax, eax
 
 
        jnz     ntfsDevice
 
    ; 4. MFT record
.mftBitmap: ; search for free record
        mov     edi, [ebp+NTFS.mftBitmapBuffer]
        mov     ecx, [ebp+NTFS.mftBitmapSize]
        mov     al, -1
        add     edi, 3
        sub     ecx, 3
        repz scasb
        dec     edi
        movzx   eax, byte [edi]
        not     al
        bsf     ecx, eax
 
        jz      ntfsUnsupported     ; no free records
 
 
 
        bts     [edi], ecx
 
; get record location
        sub     edi, [ebp+NTFS.mftBitmapBuffer]
        shl     edi, 3
        add     edi, ecx
        mov     [ebp+NTFS.newMftRecord], edi
        mov     eax, [ebp+NTFS.frs_size]
        shr     eax, 9
        mul     edi
        mov     [ebp+NTFS.ntfs_cur_iRecord], 0
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_size], 1
        mov     eax, [ebp+NTFS.frs_buffer]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    ntfs_read_attr
        cmp     [ebp+NTFS.ntfs_cur_read], 0
        jnz     .mftRecord
; extend MFT $DATA
        mov     eax, [ebp+NTFS.mft_cluster]
        mul     [ebp+NTFS.sectors_per_cluster]
 
        cmp     eax, [ebp+NTFS.ntfsLastRead]
        jnz     ntfsUnsupported     ; auxiliary record
        mov     edi, [ebp+NTFS.ntfs_attr_offs]
        mov     ebx, [ebp+NTFS.sectors_per_cluster]
        shl     ebx, 9+3
        add     dword [edi+lastVCN], 8
        add     [edi+attributeAllocatedSize], ebx
        adc     byte [edi+attributeAllocatedSize+4], 0
        add     [edi+attributeRealSize], ebx
        adc     byte [edi+attributeRealSize+4], 0
        add     [edi+initialDataSize], ebx
        adc     byte [edi+initialDataSize+4], 0
        movzx   eax, byte [edi+dataRunsOffset]
        add     edi, eax
        mov     al, [edi]
        inc     edi
        shl     eax, 4
        shr     al, 4
        mov     cl, 4
        sub     cl, al
        shl     cl, 3
        add     ah, al
        shr     eax, 8
        cmp     byte [edi+eax], 0
        jnz     ntfsUnsupported     ; $MFT fragmented
        mov     al, 8
        mov     edx, [edi]
        rol     eax, cl
        rol     edx, cl
        add     eax, edx
        jc      ntfsUnsupported
        ror     eax, cl
        shr     edx, cl
        mov     [edi], eax
        add     edx, [ebp+NTFS.mft_cluster]
        mov     esi, edx
        mov     ecx, edx
        and     ecx, 7
        shr     edx, 3
        add     edx, [ebp+NTFS.BitmapBuffer]
        mov     ax, [edx]
        shr     ax, cl
        test    al, al
        jnz     ntfsUnsupported
        dec     al
        xchg    [edx], al
        mov     [edx+1], al
 
 
        stdcall kernel_alloc, ebx
        test    eax, eax
        jz      ntfsNoMemory
        mov     ecx, ebx
        shr     ecx, 2
        mov     edi, eax
        push    ebx
        mov     ebx, eax
        xor     eax, eax
        rep stosd
        mov     eax, esi
        mul     [ebp+NTFS.sectors_per_cluster]
        pop     ecx
        shr     ecx, 9
        call    fs_write64_sys  ; clear new records
        stdcall kernel_free, ebx
 
 
        mov     eax, esi
        shr     eax, 3+9
        mov     ebx, eax
        shl     ebx, 9
        add     ebx, [ebp+NTFS.BitmapBuffer]
        add     eax, [ebp+NTFS.BitmapLocation]
        mov     ecx, 1
        xor     edx, edx
        call    fs_write64_app  ; partition bitmap
        test    eax, eax
        jnz     ntfsDevice
        mov     eax, [ebp+NTFS.frs_buffer]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    writeRecord     ; $MFT
        test    eax, eax
        jnz     ntfsDevice
        mov     eax, [ebp+NTFS.mftmirr_cluster]
        mul     [ebp+NTFS.sectors_per_cluster]
        mov     ebx, [ebp+NTFS.frs_buffer]
        movzx   ecx, word [ebx+updateSequenceSize]
        dec     ecx
        call    fs_write64_sys  ; $MFTMirr
        test    eax, eax
        jnz     ntfsDevice
 
        mov     eax, [ebp+NTFS.ntfs_cur_offs]
        add     [ebp+NTFS.ntfsLastRead], eax
.mftRecord:
        mov     esi, [ebp+NTFS.indexOffset]
        mov     edi, [ebp+NTFS.frs_buffer]
        xor     eax, eax
        movzx   ecx, word [esi+indexAllocatedSize]
        add     ecx, 8+30h+48h+50h+8
        push    ecx
        shr     ecx, 2
        rep stosd
        mov     edi, [ebp+NTFS.frs_buffer]
; record header
        mov     dword[edi], 'FILE'
        mov     byte [edi+updateSequenceOffset], 2ah
        mov     byte [edi+updateSequenceSize], 3
        mov     byte [edi+hardLinkCounter], 1
        mov     byte [edi+attributeOffset], 30h
        pop     dword[edi+recordRealSize]
        mov     word [edi+recordAllocatedSize], 1024
        mov     byte [edi+newAttributeID], 3
        rdtsc
        mov     [edi+2ah], ax
        add     edi, 30h
; $StandardInformation
        mov     byte [edi+attributeType], 10h
        mov     byte [edi+sizeWithHeader], 48h
        mov     byte [edi+sizeWithoutHeader], 30h
        mov     byte [edi+attributeOffset], 18h
        add     edi, 48h
; $FileName
        mov     byte [edi+attributeType], 30h
        mov     byte [edi+attributeID], 1
        mov     cx, [esi+indexRawSize]
        mov     [edi+sizeWithoutHeader], ecx
        mov     cx, [esi+indexAllocatedSize]
        add     ecx, 8
        mov     [edi+sizeWithHeader], ecx
        mov     byte [edi+attributeOffset], 18h
        mov     byte [edi+indexedFlag], 1
        add     edi, 18h
        add     esi, 16
        sub     ecx, 18h
        shr     ecx, 2
        rep movsd
        cmp     [ebp+NTFS.ntfsFolder], 0
        jnz     @f
; $Data
        mov     byte [edi+attributeType], 80h
        cmp     [ebp+NTFS.fileRealSize], 0
        jz      .zeroSize
        mov     esi, [ebp+NTFS.indexOffset]
        mov     byte [edi+nonResidentFlag], 1
        mov     byte [edi+dataRunsOffset], 40h
        mov     eax, [esi+fileAllocatedSize]
        mov     [edi+attributeAllocatedSize], eax
        mov     eax, [esi+fileRealSize]
        mov     [edi+attributeRealSize], eax
        mov     [edi+initialDataSize], eax
        mov     byte [edi+40h], 44h
        mov     eax, [ebp+NTFS.fileDataSize]
        mov     [edi+41h], eax
        dec     eax
        mov     [edi+lastVCN], eax
        mov     eax, [ebp+NTFS.fileDataStart]
        mov     [edi+45h], eax
        mov     al, 1
        jmp     .writeMftRecord
 
.zeroSize:
        mov     byte [edi+attributeOffset], 18h
        mov     al, 1
        jmp     .writeMftRecord
 
@@: ; $IndexRoot
        mov     byte [edi+attributeType], 90h
        mov     byte [edi+nameLength], 4
        mov     byte [edi+nameOffset], 18h
        mov     byte [edi+sizeWithoutHeader], 30h
        mov     byte [edi+attributeOffset], 20h
        mov     dword[edi+18h], 490024h     ; unicode $I30
        mov     dword[edi+18h+4], 300033h
 
        mov     byte [edi+20h+attributeType], 30h
        mov     byte [edi+20h+collationRule], 1
        mov     eax, [ebp+NTFS.sectors_per_cluster]
        shl     eax, 9
        mov     [edi+20h+indexRecordSize], eax
        mov     byte [edi+20h+indexRecordSizeClus], 1
        mov     byte [edi+30h+indexOffset], 16
        mov     byte [edi+30h+nodeRealSize], 32
        mov     byte [edi+30h+nodeAllocatedSize], 32
        mov     byte [edi+40h+indexAllocatedSize], 16
        mov     byte [edi+40h+indexFlags], 2
 
        mov     al, 3
.writeMftRecord:
        mov     byte [edi+sizeWithHeader], 50h
        mov     byte [edi+attributeID], 2
        mov     dword[edi+50h], -1      ; $End
        mov     edi, [ebp+NTFS.frs_buffer]
        mov     [edi+recordFlags], al
        mov     [ebp+NTFS.ntfs_cur_buf], edi
        call    writeRecord
        test    eax, eax
 
 
        jnz     ntfsDevice
 
        mov     esi, [ebp+PARTITION.Disk]
        call    disk_sync
; write MFT bitmap
        mov     eax, [ebp+NTFS.newMftRecord]
        shr     eax, 3+9
        mov     ebx, eax
        shl     ebx, 9
        add     eax, [ebp+NTFS.mftBitmapLocation]
        add     ebx, [ebp+NTFS.mftBitmapBuffer]
        mov     ecx, 1
        xor     edx, edx
        call    fs_write64_sys
        test    eax, eax
 
 
        jnz     ntfsDevice
; 5. Write partition bitmap
        cmp     [ebp+NTFS.ntfsFolder], 0
        jnz     @f
        cmp     [ebp+NTFS.fileRealSize], 0
        jz      @f
        mov     ecx, [ebp+NTFS.fileDataStart]
        mov     eax, ecx
        add     ecx, [ebp+NTFS.fileDataSize]
        add     ecx, 4095
        shr     ecx, 3+9
        shr     eax, 3+9
        sub     ecx, eax
        mov     ebx, eax
        shl     ebx, 9
        add     eax, [ebp+NTFS.BitmapLocation]
        add     ebx, [ebp+NTFS.BitmapBuffer]
        xor     edx, edx
        call    fs_write64_app
        test    eax, eax
 
 
        jnz     ntfsDevice
@@:
        mov     esi, [ebp+PARTITION.Disk]
        call    disk_sync
        mov     edi, [ebp+NTFS.indexOffset]
        mov     eax, [ebp+NTFS.newMftRecord]
        mov     [edi+fileRecordReference], eax
; 6. Write directory node
        mov     eax, [ebp+NTFS.nodeLastRead]
        mov     [ebp+NTFS.ntfsLastRead], eax
        mov     eax, [ebp+NTFS.cur_index_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    writeRecord
        test    eax, eax
        jnz     ntfsDevice
        mov     ebx, [ebp+NTFS.fileRealSize]
ntfsDone:
        mov     esi, [ebp+PARTITION.Disk]
        call    disk_sync
        call    ntfs_unlock
        xor     eax, eax
 
        ret
 
writeRecord:
;   in:
; [ebp+NTFS.ntfs_cur_buf] = record
; [ebp+NTFS.ntfsLastRead] = partition sector
    ; making updateSequence
        mov     esi, [ebp+NTFS.ntfs_cur_buf]
        mov     edi, esi
        movzx   ecx, word [esi+updateSequenceOffset]
        add     edi, ecx
        mov     ax, [edi]
        add     edi, 2
        mov     cx, [esi+updateSequenceSize]
        dec     ecx
        push    ecx
@@:
        add     esi, 510
        movsw
        mov     [esi-2], ax
        dec     ecx
        jnz     @b
; writing to disk
        mov     eax, [ebp+NTFS.ntfsLastRead]
        mov     ebx, [ebp+NTFS.ntfs_cur_buf]
        pop     ecx
        xor     edx, edx
        jmp     fs_write64_sys
 
bitmapBuffering:
; Extend BitmapBuffer and read next 32kb of bitmap
; Warning: $Bitmap fragmentation is not foreseen
; if edi -> position in bitmap buffer,
; then ecx = number of buffered dwords left
        push    ebx
        mov     eax, [ebp+NTFS.BitmapTotalSize]
        cmp     eax, [ebp+NTFS.BitmapSize]
        jz      .end
        stdcall alloc_pages, 8
        test    eax, eax
        jz      .end
        add     eax, 3
        mov     ebx, [ebp+NTFS.BitmapBuffer]
        add     ebx, [ebp+NTFS.BitmapSize]
        push    ebx
        mov     ecx, 8
        call    commit_pages
        mov     eax, [ebp+NTFS.BitmapSize]
        shr     eax, 9
        add     eax, [ebp+NTFS.BitmapLocation]
        pop     ebx
        mov     ecx, 64
        xor     edx, edx
        call    fs_read64_app
        test    eax, eax
        jnz     .err
        add     [ebp+NTFS.BitmapSize], 8000h
        mov     eax, [ebp+NTFS.BitmapTotalSize]
        cmp     eax, [ebp+NTFS.BitmapSize]
        jnc     @f
        mov     [ebp+NTFS.BitmapSize], eax
@@:
        mov     ecx, [ebp+NTFS.BitmapSize]
 
        add     ecx, [ebp+NTFS.BitmapBuffer]
        sub     ecx, edi
        shr     ecx, 2
        pop     ebx
        ret
 
.err:
        mov     eax, [ebp+NTFS.BitmapBuffer]
        add     eax, [ebp+NTFS.BitmapSize]
        mov     ecx, 8
        call    release_pages
.end:
        add     esp, 12     ; double ret
        push    ERROR_DISK_FULL
        jmp     ntfsOut
 
;----------------------------------------------------------------
ntfs_WriteFile:
        cmp     byte [esi], 0
        jnz     @f
        xor     ebx, ebx
        movi    eax, ERROR_ACCESS_DENIED
        ret
@@:
        call    ntfs_lock
        stdcall ntfs_find_lfn, [esp+4]
        jc      ntfsNotFound
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 16
        jc      ntfsDenied
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80
        mov     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 0
        call    ntfs_read_attr
        jc      ntfsDenied
        mov     eax, [ebp+NTFS.frs_buffer]
        cmp     word [eax+baseRecordReuse], 0
        jnz     ntfsUnsupported     ; auxiliary record
        cmp     byte [eax+hardLinkCounter], 1
        jnz     ntfsUnsupported     ; file copying required
        mov     ecx, [ebp+NTFS.ntfs_attr_offs]
        cmp     byte [ecx+nonResidentFlag], 1
        jnz     ntfsUnsupported     ; resident $DATA
        cmp     word [ecx+attributeFlags], 0
        jnz     ntfsUnsupported
        mov     eax, [ebx+4]
        mov     edx, [ebx+8]
        add     eax, [ebx+12]
        adc     edx, 0
        cmp     edx, [ecx+attributeRealSize+4]
        jc      .write
        jnz     ntfsUnsupported     ; end of file
        cmp     [ecx+attributeRealSize], eax
        jc      ntfsUnsupported
.write:
        mov     eax, [ebx+4]
        mov     edx, [ebx+8]
        mov     ecx, [ebx+12]
        mov     esi, [ebx+16]
        shrd    eax, edx, 9
        test    dword[ebx+4], 1FFh
        jz      .aligned
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_size], 1
        lea     edi, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], edi
        call    ntfs_read_attr.continue
        jc      ntfsDevice
        mov     eax, [ebx+4]
        and     eax, 1FFh
        add     edi, eax
        sub     eax, [ebp+NTFS.ntfs_cur_read]
        neg     eax
        push    ecx
        cmp     ecx, eax
        jb      @f
        mov     ecx, eax
@@:
        sub     [esp], ecx
        rep movsb
        push    ebx
        mov     eax, [ebp+NTFS.ntfsLastRead]
        lea     ebx, [ebp+NTFS.ntfs_bitmap_buf]
        mov     ecx, 1
        xor     edx, edx
        call    fs_write64_app
        pop     ebx
        pop     ecx
        test    eax, eax
        jnz     ntfsDevice
        test    ecx, ecx
        jz      @f
        mov     eax, [ebx+4]
        mov     edx, [ebx+8]
        shrd    eax, edx, 9
        inc     eax
.aligned:
        push    ecx
        shr     ecx, 9
        mov     [ebp+NTFS.ntfs_cur_offs], eax
        mov     [ebp+NTFS.ntfs_cur_size], ecx
        mov     [ebp+NTFS.ntfs_cur_buf], esi
        add     eax, ecx
        push    eax
        mov     [ebp+NTFS.ntfsWriteAttr], 1
        call    ntfs_read_attr.continue
        mov     [ebp+NTFS.ntfsWriteAttr], 0
        pop     [ebp+NTFS.ntfs_cur_offs]
        pop     ecx
        jc      ntfsDevice
        and     ecx, 1FFh
        jz      @f
        add     esi, [ebp+NTFS.ntfs_cur_read]
        mov     [ebp+NTFS.ntfs_cur_size], 1
        lea     edi, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], edi
        call    ntfs_read_attr.continue
        jc      ntfsDevice
        rep movsb
        push    ebx
        mov     eax, [ebp+NTFS.ntfsLastRead]
        lea     ebx, [ebp+NTFS.ntfs_bitmap_buf]
        mov     ecx, 1
        xor     edx, edx
        call    fs_write64_app
        pop     ebx
        test    eax, eax
        jnz     ntfsDevice
@@:
        mov     ebx, [ebx+12]
        jmp     ntfsDone
 
;----------------------------------------------------------------
ntfs_Delete:
        cmp     byte [esi], 0
        jnz     @f
        xor     ebx, ebx
        movi    eax, ERROR_ACCESS_DENIED
        ret
@@:
        call    ntfs_lock
        stdcall ntfs_find_lfn, [esp+4]
        jc      ntfsNotFound
        cmp     [ebp+NTFS.ntfs_cur_iRecord], 16
        jc      ntfsDenied
        cmp     [ebp+NTFS.ntfsFragmentCount], 1
        jnz     ntfsUnsupported     ; record fragmented
        test    byte [eax+indexFlags], 1
        jnz     ntfsUnsupported     ; index has a subnode
        mov     edx, [ebp+NTFS.ntfs_cur_iRecord]
        shr     edx, 3
        cmp     edx, [ebp+NTFS.mftBitmapSize]
        jnc     ntfsUnsupported
; delete index from the node
        movzx   edx, word [eax+indexAllocatedSize]
        mov     edi, [ebp+NTFS.cur_index_buf]
        cmp     dword [edi], 'INDX'
        jz      .indexRecord
        mov     esi, [ebp+NTFS.frs_buffer]  ; indexRoot
        mov     ecx, [esi+recordRealSize]
        shr     ecx, 2
        rep movsd
        mov     esi, [ebp+NTFS.cur_index_buf]
        mov     edi, [ebp+NTFS.ntfs_attr_offs]
        sub     edi, [ebp+NTFS.frs_buffer]
        add     edi, esi
        sub     [edi+sizeWithHeader], edx
        sub     [edi+sizeWithoutHeader], edx
        mov     cl, [edi+attributeOffset]
        add     edi, ecx
        sub     [edi+16+nodeRealSize], edx
        sub     [edi+16+nodeAllocatedSize], edx
        sub     eax, esi
        add     eax, edi
        sub     [esi+recordRealSize], edx
        mov     ecx, [esi+recordRealSize]
        jmp     @f
 
.indexRecord:
        sub     [edi+28], edx
        mov     ecx, [edi+28]
        add     ecx, 24
@@:
        add     ecx, [ebp+NTFS.cur_index_buf]
        sub     ecx, eax
        shr     ecx, 2
        mov     esi, eax
        add     esi, edx
        mov     edi, eax
        rep movsd
        mov     eax, [ebp+NTFS.ntfsLastRead]
        mov     [ebp+NTFS.nodeLastRead], eax
; examine file record
        mov     [ebp+NTFS.ntfs_cur_attr], 0x80
        mov     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 0
        call    ntfs_read_attr
        jc      .folder
        mov     esi, [ebp+NTFS.frs_buffer]
        cmp     word [esi+baseRecordReuse], 0
        jnz     ntfsUnsupported     ; auxiliary record
        cmp     byte [esi+hardLinkCounter], 2
        jnc     .writeFileRecord    ; delete hard link
        mov     esi, [ebp+NTFS.ntfs_attr_offs]
        cmp     byte [esi+nonResidentFlag], 0
        jz      .writeBitmapMFT
        movzx   eax, byte [esi+dataRunsOffset]
        add     esi, eax
        xor     edi, edi
        sub     esp, 16
.clearBitmap:       ; "delete" file data
        call    ntfs_decode_mcb_entry
        jnc     .mcbEnd
        cmp     dword[esp+8], 0
        jz      .clearBitmap
        add     edi, [esp+8]
        mov     ebx, [esp]
        mov     eax, edi
        add     eax, ebx
        shr     eax, 3
        inc     eax
        cmp     eax, [ebp+NTFS.BitmapSize]
        jc      .buffered
        add     eax, [ebp+NTFS.BitmapBuffer]
        add     esp, 16
        push    edi
        mov     edi, eax
@@:
        call    bitmapBuffering
        shl     ecx, 2
        js      @b
        pop     edi
        sub     esp, 16
.buffered:
        push    edi
        mov     ecx, edi
        shr     edi, 5
        shl     edi, 2
        add     edi, [ebp+NTFS.BitmapBuffer]
        and     ecx, 31
        xor     eax, eax
        dec     eax
        shr     eax, cl
        shl     eax, cl
        neg     ecx
        add     ecx, 32
        sub     ecx, ebx
        jc      @f
        shl     eax, cl     ; fits inside dword
        shr     eax, cl
        not     eax
        and     [edi], eax
        jmp     .writeBitmap
 
@@:
        not     eax
        and     [edi], eax
        neg     ecx
        push    ecx
        shr     ecx, 5
        add     edi, 4
        xor     eax, eax
        rep stosd
        pop     ecx
        and     ecx, 31
        dec     eax
        shr     eax, cl
        shl     eax, cl
        and     [edi], eax
.writeBitmap:
        pop     edi
        mov     ecx, edi
        add     ecx, ebx
        add     ecx, 4095
        shr     ecx, 3+9
        mov     eax, edi
        shr     eax, 3+9
        sub     ecx, eax
        mov     ebx, eax
        shl     ebx, 9
        add     eax, [ebp+NTFS.BitmapLocation]
        add     ebx, [ebp+NTFS.BitmapBuffer]
        xor     edx, edx
        call    fs_write64_app
        jmp     .clearBitmap
 
.mcbEnd:
        add     esp, 16
        jmp     .writeBitmapMFT
 
.folder:    ; empty?
        lea     esi, [ebp+NTFS.ntfs_bitmap_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], esi
        mov     [ebp+NTFS.ntfs_cur_attr], 0x90
        mov     [ebp+NTFS.ntfs_cur_offs], 0
        mov     [ebp+NTFS.ntfs_cur_size], 1
        call    ntfs_read_attr
        cmp     [ebp+NTFS.ntfs_cur_read], 48
        jnz     ntfsDenied
        test    byte [esi+32+indexFlags], 1
        jnz     ntfsDenied
.writeBitmapMFT:    ; "delete" file record
        mov     eax, [ebp+NTFS.ntfs_cur_iRecord]
        mov     ecx, eax
        shr     eax, 3
        and     ecx, 7
        mov     edi, [ebp+NTFS.mftBitmapBuffer]
        btr     [edi+eax], ecx
        shr     eax, 9
        mov     ebx, eax
        shl     ebx, 9
        add     eax, [ebp+NTFS.mftBitmapLocation]
        add     ebx, edi
        mov     ecx, 1
        xor     edx, edx
        call    fs_write64_sys
        mov     esi, [ebp+NTFS.frs_buffer]
        mov     byte [esi+recordFlags], 0
.writeFileRecord:
        dec     byte [esi+hardLinkCounter]
        mov     [ebp+NTFS.ntfs_cur_buf], esi
        call    writeRecord
; write directory node
        mov     eax, [ebp+NTFS.nodeLastRead]
        mov     [ebp+NTFS.ntfsLastRead], eax
        mov     eax, [ebp+NTFS.cur_index_buf]
        mov     [ebp+NTFS.ntfs_cur_buf], eax
        call    writeRecord
        test    eax, eax
        jz      ntfsDone
        jmp     ntfsDevice
 
;----------------------------------------------------------------
ntfs_SetFileEnd:
ntfs_SetFileInfo:
 
        movi    eax, ERROR_UNSUPPORTED_FS
        ret
 
;----------------------------------------------------------------
ntfs_GetFileInfo:
        cmp     byte [esi], 0
        jnz     @f
        movi    eax, ERROR_UNSUPPORTED_FS
        ret
@@:
        call    ntfs_lock
        stdcall ntfs_find_lfn, [esp+4]
        jnc     .found
        test    eax, eax
 
        jz      ntfsFail
 
 
        jmp     ntfsNotFound
.found:
        push    esi edi
        mov     esi, eax
        mov     edi, [ebx+16]
        xor     eax, eax
        call    ntfs_direntry_to_bdfe
        pop     edi esi
        call    ntfs_unlock
        xor     eax, eax
        ret
 
ntfsUnsupported:
        push    ERROR_UNSUPPORTED_FS
ntfsOut:
        call    ntfs_unlock
        xor     ebx, ebx
        pop     eax
        ret
ntfsDevice:
        push    ERROR_DEVICE
        jmp     ntfsOut
ntfsNotFound:
        push    ERROR_FILE_NOT_FOUND
        jmp     ntfsOut
ntfsDenied:
        push    ERROR_ACCESS_DENIED
        jmp     ntfsOut
ntfsFail:
        push    ERROR_FS_FAIL
        jmp     ntfsOut
ntfsNoMemory:
        push    ERROR_OUT_OF_MEMORY
        jmp     ntfsOut

Rev 5984	Rev 6078
1	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;	1	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
2	;; ;;	2	;; ;;
3	;; Copyright (C) KolibriOS team 2004-2015. All rights reserved. ;;	3	;; Copyright (C) KolibriOS team 2004-2015. All rights reserved. ;;
4	;; Distributed under terms of the GNU General Public License ;;	4	;; Distributed under terms of the GNU General Public License ;;
5	;; ;;	5	;; ;;
6	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;	6	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
7		7
8	$Revision: 5984 $	8	$Revision: 6078 $
9		9
10	; NTFS driver	10	; NTFS driver
11		11
12	; Basic concepts:	12	; Basic concepts:
13	; File is a FileRecord in the $MFT.	13	; File is a FileRecord in the $MFT.
14	; $MFT is a file, that consists of FileRecords and starts with FileRecord of itself.	14	; $MFT is a file, that consists of FileRecords and starts with FileRecord of itself.
15	; FileRecord (FILE) consists of a header and attributes.	15	; FileRecord (FILE) consists of a header and attributes.
16	; Attribute consists of a header and a body.	16	; Attribute consists of a header and a body.
17	; Attribute's body can be inside (resident) or outside of FileRecord.	17	; Attribute's body can be inside (resident) or outside of FileRecord.
18	; File's data is a body of $Data (80h) attribute.	18	; File's data is a body of $Data (80h) attribute.
19	; FileRecords is a data of the $MFT file.	19	; FileRecords is a data of the $MFT file.
20	; Directory is a file, that consists of index nodes.	20	; Directory is a file, that consists of index nodes.
21	; Resident index node is always located in a body of $IndexRoot (90h) attribute.	21	; Resident index node is always located in a body of $IndexRoot (90h) attribute.
22	; Body of $IndexAllocation (A0h) attribute is always non resident	22	; Body of $IndexAllocation (A0h) attribute is always non resident
23	; and consists of IndexRecords.	23	; and consists of IndexRecords.
24	; IndexRecord (INDX) consists of a header and an index node.	24	; IndexRecord (INDX) consists of a header and an index node.
25	; Index node consists of a header and indexes.	25	; Index node consists of a header and indexes.
26	; Index consists of a header and a copy of indexed attribute's body.	26	; Index consists of a header and a copy of indexed attribute's body.
27	; Directories index $Filename (30h) attribute of all existing files.	27	; Directories index $Filename (30h) attribute of all existing files.
28	; $IndexRoot and $IndexAllocation attributes of a directory has a name — $I30.	28	; $IndexRoot and $IndexAllocation attributes of a directory has a name — $I30.
29		29
30	; Offsets:	30	; Offsets:
31	; record header	31	; record header
32	updateSequenceOffset = 4	32	updateSequenceOffset = 4
33	updateSequenceSize = 6	33	updateSequenceSize = 6
34	reuseCounter = 16	34	reuseCounter = 16
35	hardLinkCounter = 12h	35	hardLinkCounter = 12h
36	attributeOffset = 14h	36	attributeOffset = 14h
37	recordFlags = 16h	37	recordFlags = 16h
38	recordRealSize = 18h	38	recordRealSize = 18h
39	recordAllocatedSize = 1ch	39	recordAllocatedSize = 1ch
-		40	baseRecordReference = 20h ; for auxiliary records
-		41	baseRecordReuse = 26h
40	newAttributeID = 28h	42	newAttributeID = 28h
41	; attribute header	43	; attribute header
42	attributeType = 0	44	attributeType = 0
43	sizeWithHeader = 4	45	sizeWithHeader = 4
44	nonResidentFlag = 8	46	nonResidentFlag = 8
45	nameLength = 9	47	nameLength = 9
46	nameOffset = 10	48	nameOffset = 10
-		49	attributeFlags = 12
47	attributeID = 14	50	attributeID = 14
48	sizeWithoutHeader = 16	51	sizeWithoutHeader = 16
49	attributeFlags = 16h	52	indexedFlag = 16h
50	; non resident attribute header	53	; non resident attribute header
51	lastVCN = 18h	54	lastVCN = 18h
52	dataRunsOffset = 20h	55	dataRunsOffset = 20h
53	attributeAllocatedSize = 28h	56	attributeAllocatedSize = 28h
54	attributeRealSize = 30h	57	attributeRealSize = 30h
55	initialDataSize = 38h	58	initialDataSize = 38h
56	; $IndexRoot	59	; $IndexRoot
57	collationRule = 4	60	collationRule = 4
58	indexRecordSize = 8	61	indexRecordSize = 8
59	indexRecordSizeClus = 12	62	indexRecordSizeClus = 12
60	; node header	63	; node header
61	indexOffset = 0	64	indexOffset = 0
62	nodeRealSize = 4	65	nodeRealSize = 4
63	nodeAllocatedSize = 8	66	nodeAllocatedSize = 8
64	; $Filename index	67	; $Filename index
65	fileRecordReference = 0	68	fileRecordReference = 0
66	fileReferenceReuse = 6	69	fileReferenceReuse = 6
67	indexAllocatedSize = 8	70	indexAllocatedSize = 8
68	indexRawSize = 10	71	indexRawSize = 10
69	indexFlags = 12	72	indexFlags = 12
70	directoryRecordReference = 16	73	directoryRecordReference = 16
71	directoryReferenceReuse = 16h	74	directoryReferenceReuse = 16h
72	fileAllocatedSize = 38h	75	fileAllocatedSize = 38h
73	fileRealSize = 40h	76	fileRealSize = 40h
74	fileFlags = 48h	77	fileFlags = 48h
75	fileNameLength = 50h	78	fileNameLength = 50h
76		79
77	struct NTFS PARTITION	80	struct NTFS PARTITION
78	Lock MUTEX ? ; Currently operations with one partition	81	Lock MUTEX ? ; Currently operations with one partition
79	; can not be executed in parallel since the legacy code is not ready.	82	; can not be executed in parallel since the legacy code is not ready.
80	sectors_per_cluster dd ?	83	sectors_per_cluster dd ?
81	mft_cluster dd ? ; location	84	mft_cluster dd ? ; location
82	mftmirr_cluster dd ? ; location	85	mftmirr_cluster dd ? ; location
83	frs_size dd ? ; in bytes	86	frs_size dd ? ; in bytes
84	frs_buffer dd ? ; MFT fileRecord buffer	87	frs_buffer dd ? ; MFT fileRecord buffer
85	mft_retrieval dd ?	88	mft_retrieval dd ?
86	mft_retrieval_size dd ?	89	mft_retrieval_size dd ?
87	mft_retrieval_alloc dd ?	90	mft_retrieval_alloc dd ?
88	mft_retrieval_end dd ?	91	mft_retrieval_end dd ?
89	cur_index_size dd ? ; in sectors	92	cur_index_size dd ? ; in sectors
90	cur_index_buf dd ? ; index node buffer	93	cur_index_buf dd ? ; index node buffer
91	BitmapBuffer dd ?	94	BitmapBuffer dd ?
92	BitmapTotalSize dd ? ; bytes reserved	95	BitmapTotalSize dd ? ; bytes reserved
93	BitmapSize dd ? ; bytes readen	96	BitmapSize dd ? ; bytes readen
94	BitmapLocation dd ? ; starting sector	97	BitmapLocation dd ? ; starting sector
95	BitmapStart dd ? ; first byte after area, reserved for MFT	98	BitmapStart dd ? ; first byte after area, reserved for MFT
96	mftBitmapBuffer dd ? ; one cluster	99	mftBitmapBuffer dd ? ; one cluster
97	mftBitmapSize dd ? ; bytes readen	100	mftBitmapSize dd ? ; bytes readen
98	mftBitmapLocation dd ? ; starting sector	101	mftBitmapLocation dd ? ; starting sector
99		102
100	ntfs_cur_attr dd ? ; attribute type	103	ntfs_cur_attr dd ? ; attribute type
101	ntfs_cur_iRecord dd ? ; number of fileRecord in MFT	104	ntfs_cur_iRecord dd ? ; number of fileRecord in MFT
102	ntfs_cur_offs dd ? ; attribute VCN in sectors	105	ntfs_cur_offs dd ? ; attribute VCN in sectors
103	ntfs_cur_size dd ? ; max sectors to read	106	ntfs_cur_size dd ? ; max sectors to read
104	ntfs_cur_buf dd ?	107	ntfs_cur_buf dd ?
105	ntfs_cur_read dd ? ; bytes readen	108	ntfs_cur_read dd ? ; bytes readen
106	ntfsLastRead dd ? ; last readen block of sectors	109	ntfsLastRead dd ? ; last readen block of sectors
107	newMftRecord dd ? ; number of fileRecord in MFT	110	newMftRecord dd ? ; number of fileRecord in MFT
108	fileDataStart dd ? ; starting cluster	111	fileDataStart dd ? ; starting cluster
109	fileDataSize dd ? ; in clusters	112	fileDataSize dd ? ; in clusters
110	fileRealSize dd ? ; in bytes	113	fileRealSize dd ? ; in bytes
111	indexOffset dd ?	114	indexOffset dd ?
112	nodeLastRead dd ?	115	nodeLastRead dd ?
113	ntfs_bCanContinue db ?	116	ntfs_bCanContinue db ?
114	ntfsNotFound db ?	-
115	ntfsFolder db ?	117	ntfsFolder db ?
-		118	ntfsWriteAttr db ? ; Warning: Don't forget to turn off!!!
116	ntfsFragmentCount db ?	119	ntfsFragmentCount db ?
117		120
118	cur_subnode_size dd ?	121	cur_subnode_size dd ?
119	ntfs_attr_iRecord dd ?	122	ntfs_attr_iRecord dd ?
120	ntfs_attr_iBaseRecord dd ?	123	ntfs_attr_iBaseRecord dd ?
121	ntfs_attr_offs dd ?	124	ntfs_attr_offs dd ?
122	ntfs_attr_list dd ?	125	ntfs_attr_list dd ?
123	ntfs_attr_size dq ?	126	ntfs_attr_size dq ?
124	ntfs_cur_tail dd ?	127	ntfs_cur_tail dd ?
125		128
126	ntfs_attrlist_buf rb 0x400	129	ntfs_attrlist_buf rb 0x400
127	ntfs_attrlist_mft_buf rb 0x400	130	ntfs_attrlist_mft_buf rb 0x400
128	ntfs_bitmap_buf rb 0x400	131	ntfs_bitmap_buf rb 0x400
129	ends	132	ends
130		133
131	; NTFS external functions	134	; NTFS external functions
132	; in:	135	; in:
133	; ebx -> parameter structure of sysfunc 70	136	; ebx -> parameter structure of sysfunc 70
134	; ebp -> NTFS structure	137	; ebp -> NTFS structure
135	; [esi]+[esp+4] = name	138	; [esi]+[esp+4] = name
136	; out:	139	; out:
137	; eax, ebx = return values for sysfunc 70	140	; eax, ebx = return values for sysfunc 70
138	iglobal	141	iglobal
139	align 4	142	align 4
140	ntfs_user_functions:	143	ntfs_user_functions:
141	dd ntfs_free	144	dd ntfs_free
142	dd (ntfs_user_functions_end - ntfs_user_functions - 4) / 4	145	dd (ntfs_user_functions_end - ntfs_user_functions - 4) / 4
143	dd ntfs_ReadFile	146	dd ntfs_ReadFile
144	dd ntfs_ReadFolder	147	dd ntfs_ReadFolder
145	dd ntfs_CreateFile	148	dd ntfs_CreateFile
146	dd ntfs_Write	149	dd ntfs_WriteFile
147	dd ntfs_SetFileEnd	150	dd ntfs_SetFileEnd
148	dd ntfs_GetFileInfo	151	dd ntfs_GetFileInfo
149	dd ntfs_SetFileInfo	152	dd ntfs_SetFileInfo
150	dd 0	153	dd 0
151	dd ntfs_Delete	154	dd ntfs_Delete
152	dd ntfs_CreateFolder	155	dd ntfs_CreateFolder
153	ntfs_user_functions_end:	156	ntfs_user_functions_end:
154	endg	157	endg
155		158
156	ntfs_test_bootsec:	159	ntfs_test_bootsec:
157	; in: ebx -> buffer, edx = size of partition	160	; in: ebx -> buffer, edx = size of partition
158	; out: CF=1 -> invalid	161	; out: CF=1 -> invalid
159	; 1. Name=='NTFS '	162	; 1. Name=='NTFS '
160	cmp dword [ebx+3], 'NTFS'	163	cmp dword [ebx+3], 'NTFS'
161	jnz .no	164	jnz .no
162	cmp dword [ebx+7], ' '	165	cmp dword [ebx+7], ' '
163	jnz .no	166	jnz .no
164	; 2. Number of bytes per sector is the same as for physical device	167	; 2. Number of bytes per sector is the same as for physical device
165	; (that is, 0x200 for hard disk)	168	; (that is, 0x200 for hard disk)
166	cmp word [ebx+11], 0x200	169	cmp word [ebx+11], 0x200
167	jnz .no	170	jnz .no
168	; 3. Number of sectors per cluster must be power of 2	171	; 3. Number of sectors per cluster must be power of 2
169	movzx eax, byte [ebx+13]	172	movzx eax, byte [ebx+13]
170	dec eax	173	dec eax
171	js .no	174	js .no
172	test al, [ebx+13]	175	test al, [ebx+13]
173	jnz .no	176	jnz .no
174	; 4. FAT parameters must be zero	177	; 4. FAT parameters must be zero
175	cmp word [ebx+14], 0	178	cmp word [ebx+14], 0
176	jnz .no	179	jnz .no
177	cmp dword [ebx+16], 0	180	cmp dword [ebx+16], 0
178	jnz .no	181	jnz .no
179	cmp byte [ebx+20], 0	182	cmp byte [ebx+20], 0
180	jnz .no	183	jnz .no
181	cmp word [ebx+22], 0	184	cmp word [ebx+22], 0
182	jnz .no	185	jnz .no
183	cmp dword [ebx+32], 0	186	cmp dword [ebx+32], 0
184	jnz .no	187	jnz .no
185	; 5. Number of sectors <= partition size	188	; 5. Number of sectors <= partition size
186	cmp dword [ebx+0x2C], 0	189	cmp dword [ebx+0x2C], 0
187	ja .no	190	ja .no
188	cmp [ebx+0x28], edx	191	cmp [ebx+0x28], edx
189	ja .no	192	ja .no
190	; 6. $MFT and $MFTMirr clusters must be within partition	193	; 6. $MFT and $MFTMirr clusters must be within partition
191	cmp dword [ebx+0x34], 0	194	cmp dword [ebx+0x34], 0
192	ja .no	195	ja .no
193	push edx	196	push edx
194	movzx eax, byte [ebx+13]	197	movzx eax, byte [ebx+13]
195	mul dword [ebx+0x30]	198	mul dword [ebx+0x30]
196	test edx, edx	199	test edx, edx
197	pop edx	200	pop edx
198	jnz .no	201	jnz .no
199	cmp eax, edx	202	cmp eax, edx
200	ja .no	203	ja .no
201	cmp dword [ebx+0x3C], 0	204	cmp dword [ebx+0x3C], 0
202	ja .no	205	ja .no
203	push edx	206	push edx
204	movzx eax, byte [ebx+13]	207	movzx eax, byte [ebx+13]
205	mul dword [ebx+0x38]	208	mul dword [ebx+0x38]
206	test edx, edx	209	test edx, edx
207	pop edx	210	pop edx
208	jnz .no	211	jnz .no
209	cmp eax, edx	212	cmp eax, edx
210	ja .no	213	ja .no
211	; 7. Clusters per FRS must be either power of 2 or between -31 and -9	214	; 7. Clusters per FRS must be either power of 2 or between -31 and -9
212	movsx eax, byte [ebx+0x40]	215	movsx eax, byte [ebx+0x40]
213	cmp al, -31	216	cmp al, -31
214	jl .no	217	jl .no
215	cmp al, -9	218	cmp al, -9
216	jle @f	219	jle @f
217	dec eax	220	dec eax
218	js .no	221	js .no
219	test [ebx+0x40], al	222	test [ebx+0x40], al
220	jnz .no	223	jnz .no
221	@@: ; 8. Same for clusters per IndexAllocationBuffer	224	@@: ; 8. Same for clusters per IndexAllocationBuffer
222	movsx eax, byte [ebx+0x44]	225	movsx eax, byte [ebx+0x44]
223	cmp al, -31	226	cmp al, -31
224	jl .no	227	jl .no
225	cmp al, -9	228	cmp al, -9
226	jle @f	229	jle @f
227	dec eax	230	dec eax
228	js .no	231	js .no
229	test [ebx+0x44], al	232	test [ebx+0x44], al
230	jnz .no	233	jnz .no
231	@@: ; OK, this is correct NTFS bootsector	234	@@: ; OK, this is correct NTFS bootsector
232	clc	235	clc
233	ret	236	ret
234	.no: ; No, this bootsector isn't NTFS	237	.no: ; No, this bootsector isn't NTFS
235	stc	238	stc
236	ret	239	ret
237		240
238	ntfs_create_partition:	241	ntfs_create_partition:
239	cmp dword [esi+DISK.MediaInfo.SectorSize], 512	242	cmp dword [esi+DISK.MediaInfo.SectorSize], 512
240	jnz .nope	243	jnz .nope
241	mov edx, dword [ebp+PARTITION.Length]	244	mov edx, dword [ebp+PARTITION.Length]
242	cmp dword [esp+4], 0	245	cmp dword [esp+4], 0
243	jz .boot_read_ok	246	jz .boot_read_ok
244	add ebx, 512	247	add ebx, 512
245	lea eax, [edx-1]	248	lea eax, [edx-1]
246	call fs_read32_sys	249	call fs_read32_sys
247	test eax, eax	250	test eax, eax
248	jnz @f	251	jnz @f
249	call ntfs_test_bootsec	252	call ntfs_test_bootsec
250	jnc .ntfs_setup	253	jnc .ntfs_setup
251	@@:	254	@@:
252	mov eax, edx	255	mov eax, edx
253	shr eax, 1	256	shr eax, 1
254	call fs_read32_sys	257	call fs_read32_sys
255	test eax, eax	258	test eax, eax
256	jnz .nope	259	jnz .nope
257	.boot_read_ok:	260	.boot_read_ok:
258	call ntfs_test_bootsec	261	call ntfs_test_bootsec
259	jnc .ntfs_setup	262	jnc .ntfs_setup
260	.nope:	263	.nope:
261	xor eax, eax	264	xor eax, eax
262	jmp .exit	265	jmp .exit
263	; By given bootsector, initialize some NTFS variables	266	; By given bootsector, initialize some NTFS variables
264	.ntfs_setup:	267	.ntfs_setup:
265	movi eax, sizeof.NTFS	268	movi eax, sizeof.NTFS
266	call malloc	269	call malloc
267	test eax, eax	270	test eax, eax
268	jz .exit	271	jz .exit
269	mov ecx, dword [ebp+PARTITION.FirstSector]	272	mov ecx, dword [ebp+PARTITION.FirstSector]
270	mov dword [eax+NTFS.FirstSector], ecx	273	mov dword [eax+NTFS.FirstSector], ecx
271	mov ecx, dword [ebp+PARTITION.FirstSector+4]	274	mov ecx, dword [ebp+PARTITION.FirstSector+4]
272	mov dword [eax+NTFS.FirstSector+4], ecx	275	mov dword [eax+NTFS.FirstSector+4], ecx
273	mov ecx, dword [ebp+PARTITION.Length]	-
274	mov dword [eax+NTFS.Length], ecx	-
275	mov ecx, dword [ebp+PARTITION.Length+4]	-
276	mov dword [eax+NTFS.Length+4], ecx	-
277	mov ecx, [ebp+PARTITION.Disk]	276	mov ecx, [ebp+PARTITION.Disk]
278	mov [eax+NTFS.Disk], ecx	277	mov [eax+NTFS.Disk], ecx
279	mov [eax+NTFS.FSUserFunctions], ntfs_user_functions	278	mov [eax+NTFS.FSUserFunctions], ntfs_user_functions
-		279	mov [eax+NTFS.ntfsWriteAttr], 0
280		280
281	push ebx ebp esi	281	push ebx ebp esi
282	mov ebp, eax	282	mov ebp, eax
283	lea ecx, [ebp+NTFS.Lock]	283	lea ecx, [ebp+NTFS.Lock]
284	call mutex_init	284	call mutex_init
285	movzx eax, byte [ebx+13]	285	movzx eax, byte [ebx+13]
286	mov [ebp+NTFS.sectors_per_cluster], eax	286	mov [ebp+NTFS.sectors_per_cluster], eax
287	mov eax, [ebx+0x28]	287	mov eax, [ebx+0x28]
288	mov dword [ebp+NTFS.Length], eax	288	mov dword [ebp+NTFS.Length], eax
289	and dword [ebp+NTFS.Length+4], 0	289	and dword [ebp+NTFS.Length+4], 0
290	mov eax, [ebx+0x30]	290	mov eax, [ebx+0x30]
291	mov [ebp+NTFS.mft_cluster], eax	291	mov [ebp+NTFS.mft_cluster], eax
292	mov eax, [ebx+0x38]	292	mov eax, [ebx+0x38]
293	mov [ebp+NTFS.mftmirr_cluster], eax	293	mov [ebp+NTFS.mftmirr_cluster], eax
294	movsx eax, byte [ebx+0x40]	294	movsx eax, byte [ebx+0x40]
295	test eax, eax	295	test eax, eax
296	js @f	296	js @f
297	mul [ebp+NTFS.sectors_per_cluster]	297	mul [ebp+NTFS.sectors_per_cluster]
298	shl eax, 9	298	shl eax, 9
299	jmp .1	299	jmp .1
300	@@:	300	@@:
301	neg eax	301	neg eax
302	mov ecx, eax	302	mov ecx, eax
303	mov eax, 1	303	mov eax, 1
304	shl eax, cl	304	shl eax, cl
305	.1:	305	.1:
306	mov [ebp+NTFS.frs_size], eax	306	mov [ebp+NTFS.frs_size], eax
307	stdcall kernel_alloc, eax	307	stdcall kernel_alloc, eax
308	test eax, eax	308	test eax, eax
309	jz .fail_free	309	jz .fail_free
310	mov [ebp+NTFS.frs_buffer], eax	310	mov [ebp+NTFS.frs_buffer], eax
311	; read $MFT disposition	311	; read $MFT disposition
312	mov eax, [ebp+NTFS.mft_cluster]	312	mov eax, [ebp+NTFS.mft_cluster]
313	mul [ebp+NTFS.sectors_per_cluster]	313	mul [ebp+NTFS.sectors_per_cluster]
314	call ntfs_read_frs_sector	314	call ntfs_read_frs_sector
315	test eax, eax	315	test eax, eax
316	jnz .usemirr	316	jnz .usemirr
317	cmp dword [ebx], 'FILE'	317	cmp dword [ebx], 'FILE'
318	jnz .usemirr	318	jnz .usemirr
319	call ntfs_restore_usa_frs	319	call ntfs_restore_usa_frs
320	jnc .mftok	320	jnc .mftok
321	.usemirr:	321	.usemirr:
322	mov eax, [ebp+NTFS.mftmirr_cluster]	322	mov eax, [ebp+NTFS.mftmirr_cluster]
323	mul [ebp+NTFS.sectors_per_cluster]	323	mul [ebp+NTFS.sectors_per_cluster]
324	call ntfs_read_frs_sector	324	call ntfs_read_frs_sector
325	test eax, eax	325	test eax, eax
326	jnz .fail_free_frs	326	jnz .fail_free_frs
327	cmp dword [ebx], 'FILE'	327	cmp dword [ebx], 'FILE'
328	jnz .fail_free_frs	328	jnz .fail_free_frs
329	call ntfs_restore_usa_frs	329	call ntfs_restore_usa_frs
330	jc .fail_free_frs	330	jc .fail_free_frs
331	.mftok:	331	.mftok:
332	; read $MFT table retrieval information	332	; read $MFT table retrieval information
333	; start with one page, increase if not enough (when MFT too fragmented)	333	; start with one page, increase if not enough (when MFT too fragmented)
334	push ebx	334	push ebx
335	stdcall kernel_alloc, 0x1000	335	stdcall kernel_alloc, 0x1000
336	pop ebx	336	pop ebx
337	test eax, eax	337	test eax, eax
338	jz .fail_free_frs	338	jz .fail_free_frs
339	mov [ebp+NTFS.mft_retrieval], eax	339	mov [ebp+NTFS.mft_retrieval], eax
340	and [ebp+NTFS.mft_retrieval_size], 0	340	and [ebp+NTFS.mft_retrieval_size], 0
341	mov [ebp+NTFS.mft_retrieval_alloc], 0x1000/8	341	mov [ebp+NTFS.mft_retrieval_alloc], 0x1000/8
342	; $MFT base record must contain unnamed non-resident $DATA attribute	342	; $MFT base record must contain unnamed non-resident $DATA attribute
343	movzx eax, word [ebx+14h]	343	movzx eax, word [ebx+14h]
344	add eax, ebx	344	add eax, ebx
345	.scandata:	345	.scandata:
346	cmp dword [eax], -1	346	cmp dword [eax], -1
347	jz .fail_free_mft	347	jz .fail_free_mft
348	cmp dword [eax], 0x80	348	cmp dword [eax], 0x80
349	jnz @f	349	jnz @f
350	cmp byte [eax+9], 0	350	cmp byte [eax+9], 0
351	jz .founddata	351	jz .founddata
352	@@:	352	@@:
353	add eax, [eax+4]	353	add eax, [eax+4]
354	jmp .scandata	354	jmp .scandata
355	.founddata:	355	.founddata:
356	cmp byte [eax+8], 0	356	cmp byte [eax+8], 0
357	jz .fail_free_mft	357	jz .fail_free_mft
358	; load first portion of $DATA attribute retrieval information	358	; load first portion of $DATA attribute retrieval information
359	mov edx, [eax+0x18]	359	mov edx, [eax+0x18]
360	mov [ebp+NTFS.mft_retrieval_end], edx	360	mov [ebp+NTFS.mft_retrieval_end], edx
361	mov esi, eax	361	mov esi, eax
362	movzx eax, word [eax+0x20]	362	movzx eax, word [eax+0x20]
363	add esi, eax	363	add esi, eax
364	sub esp, 10h	364	sub esp, 10h
365	.scanmcb:	365	.scanmcb:
366	call ntfs_decode_mcb_entry	366	call ntfs_decode_mcb_entry
367	jnc .scanmcbend	367	jnc .scanmcbend
368	call .get_mft_retrieval_ptr	368	call .get_mft_retrieval_ptr
369	mov edx, [esp] ; block length	369	mov edx, [esp] ; block length
370	mov [eax], edx	370	mov [eax], edx
371	mov edx, [esp+8] ; block addr (relative)	371	mov edx, [esp+8] ; block addr (relative)
372	mov [eax+4], edx	372	mov [eax+4], edx
373	inc [ebp+NTFS.mft_retrieval_size]	373	inc [ebp+NTFS.mft_retrieval_size]
374	jmp .scanmcb	374	jmp .scanmcb
375	.scanmcbend:	375	.scanmcbend:
376	add esp, 10h	376	add esp, 10h
377	; there may be other portions of $DATA attribute in auxiliary records;	377	; there may be other portions of $DATA attribute in auxiliary records;
378	; if they will be needed, they will be loaded later	378	; if they will be needed, they will be loaded later
379	mov [ebp+NTFS.cur_index_size], 0x1000/0x200	379	mov [ebp+NTFS.cur_index_size], 0x1000/0x200
380	stdcall kernel_alloc, 0x1000	380	stdcall kernel_alloc, 0x1000
381	test eax, eax	381	test eax, eax
382	jz .fail_free_mft	382	jz .fail_free_mft
383	mov [ebp+NTFS.cur_index_buf], eax	383	mov [ebp+NTFS.cur_index_buf], eax
384	; reserve adress space for bitmap buffer and load some part of bitmap	384	; reserve adress space for bitmap buffer and load some part of bitmap
385	mov eax, dword [ebp+NTFS.Length]	385	mov eax, dword [ebp+NTFS.Length]
386	xor edx, edx	386	xor edx, edx
387	div [ebp+NTFS.sectors_per_cluster]	387	div [ebp+NTFS.sectors_per_cluster]
388	shr eax, 3	388	shr eax, 3
389	mov [ebp+NTFS.BitmapTotalSize], eax	389	mov [ebp+NTFS.BitmapTotalSize], eax
390	add eax, 7FFFh	390	add eax, 7FFFh
391	and eax, not 7FFFh	391	and eax, not 7FFFh
392	push eax	392	push eax
393	call alloc_kernel_space	393	call alloc_kernel_space
394	test eax, eax	394	test eax, eax
395	jz .failFreeIndex	395	jz .failFreeIndex
396	mov [ebp+NTFS.BitmapBuffer], eax	396	mov [ebp+NTFS.BitmapBuffer], eax
397	mov [ebp+NTFS.ntfs_cur_buf], eax	397	mov [ebp+NTFS.ntfs_cur_buf], eax
398	mov eax, [ebp+NTFS.BitmapTotalSize]	398	mov eax, [ebp+NTFS.BitmapTotalSize]
399	add eax, [ebp+NTFS.mft_cluster]	399	add eax, [ebp+NTFS.mft_cluster]
400	shr eax, 3+2 ; reserve 1/8 of partition for $MFT	400	shr eax, 3+2 ; reserve 1/8 of partition for $MFT
401	shl eax, 2	401	shl eax, 2
402	mov [ebp+NTFS.BitmapStart], eax	402	mov [ebp+NTFS.BitmapStart], eax
403	shr eax, 15	403	shr eax, 15
404	inc eax	404	inc eax
405	shl eax, 3	405	shl eax, 3
406	push eax	406	push eax
407	push eax	407	push eax
408	shl eax, 3	408	shl eax, 3
409	mov [ebp+NTFS.ntfs_cur_size], eax	409	mov [ebp+NTFS.ntfs_cur_size], eax
410	call alloc_pages	410	call alloc_pages
411	test eax, eax	411	test eax, eax
412	pop ecx	412	pop ecx
413	jz .failFreeBitmap	413	jz .failFreeBitmap
414	add eax, 3	414	add eax, 3
415	mov ebx, [ebp+NTFS.BitmapBuffer]	415	mov ebx, [ebp+NTFS.BitmapBuffer]
416	call commit_pages	416	call commit_pages
417	mov [ebp+NTFS.ntfs_cur_iRecord], 6	417	mov [ebp+NTFS.ntfs_cur_iRecord], 6
418	mov [ebp+NTFS.ntfs_cur_attr], 0x80	418	mov [ebp+NTFS.ntfs_cur_attr], 0x80
419	mov [ebp+NTFS.ntfs_cur_offs], 0	419	mov [ebp+NTFS.ntfs_cur_offs], 0
420	call ntfs_read_attr	420	call ntfs_read_attr
421	jc .failFreeBitmap	421	jc .failFreeBitmap
422	mov eax, [ebp+NTFS.ntfs_cur_read]	422	mov eax, [ebp+NTFS.ntfs_cur_read]
423	mov [ebp+NTFS.BitmapSize], eax	423	mov [ebp+NTFS.BitmapSize], eax
424	mov eax, [ebp+NTFS.ntfsLastRead]	424	mov eax, [ebp+NTFS.ntfsLastRead]
425	mov [ebp+NTFS.BitmapLocation], eax	425	mov [ebp+NTFS.BitmapLocation], eax
426	; read MFT $BITMAP attribute	426	; read MFT $BITMAP attribute
427	mov eax, [ebp+NTFS.sectors_per_cluster]	427	mov eax, [ebp+NTFS.sectors_per_cluster]
428	mov [ebp+NTFS.ntfs_cur_size], eax	428	mov [ebp+NTFS.ntfs_cur_size], eax
429	shl eax, 9	429	shl eax, 9
430	stdcall kernel_alloc, eax	430	stdcall kernel_alloc, eax
431	test eax, eax	431	test eax, eax
432	jz .failFreeBitmap	432	jz .failFreeBitmap
433	mov [ebp+NTFS.mftBitmapBuffer], eax	433	mov [ebp+NTFS.mftBitmapBuffer], eax
434	mov [ebp+NTFS.ntfs_cur_buf], eax	434	mov [ebp+NTFS.ntfs_cur_buf], eax
435	mov [ebp+NTFS.ntfs_cur_iRecord], 0	435	mov [ebp+NTFS.ntfs_cur_iRecord], 0
436	mov [ebp+NTFS.ntfs_cur_attr], 0xB0	436	mov [ebp+NTFS.ntfs_cur_attr], 0xB0
437	mov [ebp+NTFS.ntfs_cur_offs], 0	437	mov [ebp+NTFS.ntfs_cur_offs], 0
438	call ntfs_read_attr	438	call ntfs_read_attr
439	mov eax, [ebp+NTFS.ntfs_cur_read]	439	mov eax, [ebp+NTFS.ntfs_cur_read]
440	cmp eax, 4	440	cmp eax, 4
441	jc .failFreeBitmapMFT	441	jc .failFreeBitmapMFT
442	mov [ebp+NTFS.mftBitmapSize], eax	442	mov [ebp+NTFS.mftBitmapSize], eax
443	mov eax, [ebp+NTFS.ntfsLastRead]	443	mov eax, [ebp+NTFS.ntfsLastRead]
444	mov [ebp+NTFS.mftBitmapLocation], eax	444	mov [ebp+NTFS.mftBitmapLocation], eax
445		445
446	mov eax, ebp	446	mov eax, ebp
447	.pop_exit:	447	.pop_exit:
448	pop esi ebp ebx	448	pop esi ebp ebx
449	.exit:	449	.exit:
450	cmp dword [esp+4], 0	450	cmp dword [esp+4], 0
451	jz @f	451	jz @f
452	sub ebx, 512	452	sub ebx, 512
453	@@:	453	@@:
454	ret	454	ret
455		455
456	.failFreeBitmapMFT:	456	.failFreeBitmapMFT:
457	stdcall kernel_free, [ebx+NTFS.mftBitmapBuffer]	457	stdcall kernel_free, [ebx+NTFS.mftBitmapBuffer]
458	.failFreeBitmap:	458	.failFreeBitmap:
459	stdcall kernel_free, [ebx+NTFS.BitmapBuffer]	459	stdcall kernel_free, [ebx+NTFS.BitmapBuffer]
460	.failFreeIndex:	460	.failFreeIndex:
461	stdcall kernel_free, [ebp+NTFS.cur_index_buf]	461	stdcall kernel_free, [ebp+NTFS.cur_index_buf]
462	.fail_free_mft:	462	.fail_free_mft:
463	stdcall kernel_free, [ebp+NTFS.mft_retrieval]	463	stdcall kernel_free, [ebp+NTFS.mft_retrieval]
464	.fail_free_frs:	464	.fail_free_frs:
465	stdcall kernel_free, [ebp+NTFS.frs_buffer]	465	stdcall kernel_free, [ebp+NTFS.frs_buffer]
466	.fail_free:	466	.fail_free:
467	mov eax, ebp	467	mov eax, ebp
468	call free	468	call free
469	xor eax, eax	469	xor eax, eax
470	jmp .pop_exit	470	jmp .pop_exit
471		471
472	.get_mft_retrieval_ptr:	472	.get_mft_retrieval_ptr:
473	pushad	473	pushad
474	mov eax, [ebp+NTFS.mft_retrieval_size]	474	mov eax, [ebp+NTFS.mft_retrieval_size]
475	cmp eax, [ebp+NTFS.mft_retrieval_alloc]	475	cmp eax, [ebp+NTFS.mft_retrieval_alloc]
476	jnz .ok	476	jnz .ok
477	add eax, 0x1000/8	477	add eax, 0x1000/8
478	mov [ebp+NTFS.mft_retrieval_alloc], eax	478	mov [ebp+NTFS.mft_retrieval_alloc], eax
479	shl eax, 3	479	shl eax, 3
480	stdcall kernel_alloc, eax	480	stdcall kernel_alloc, eax
481	test eax, eax	481	test eax, eax
482	jnz @f	482	jnz @f
483	popad	483	popad
484	add esp, 14h	484	add esp, 14h
485	jmp .fail_free_mft	485	jmp .fail_free_mft
486	@@:	486	@@:
487	mov esi, [ebp+NTFS.mft_retrieval]	487	mov esi, [ebp+NTFS.mft_retrieval]
488	mov edi, eax	488	mov edi, eax
489	mov ecx, [ebp+NTFS.mft_retrieval_size]	489	mov ecx, [ebp+NTFS.mft_retrieval_size]
490	add ecx, ecx	490	add ecx, ecx
491	rep movsd	491	rep movsd
492	push [ebp+NTFS.mft_retrieval]	492	push [ebp+NTFS.mft_retrieval]
493	mov [ebp+NTFS.mft_retrieval], eax	493	mov [ebp+NTFS.mft_retrieval], eax
494	call kernel_free	494	call kernel_free
495	mov eax, [ebp+NTFS.mft_retrieval_size]	495	mov eax, [ebp+NTFS.mft_retrieval_size]

Subversion Repositories Kolibri OS

(root)/kernel/branches/Kolibri-acpi/fs/ntfs.inc – Rev 5984 → 6078