Subversion Repositories Kolibri OS

Rev

Rev 425 | Rev 467 | Go to most recent revision | Only display areas with differences | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 425 Rev 431
1 
$Revision: 425 $
 1 
$Revision: 431 $
- 
 
 2 
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
- 
 
 3 
;;                                                              ;;
- 
 
 4 
;; Copyright (C) KolibriOS team 2004-2007. All rights reserved. ;;
- 
 
 5 
;; Distributed under terms of the GNU General Public License    ;;
- 
 
 6 
;;                                                              ;;
- 
 
 7 
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
- 
 
 8 
 
2 
ntfs_test_bootsec:
 9 
ntfs_test_bootsec:
3 
; in: ebx->buffer, edx=size of partition
 10 
; in: ebx->buffer, edx=size of partition
4 
; out: CF set <=> invalid
 11 
; out: CF set <=> invalid
5 
; 1. Name=='NTFS    '
 12 
; 1. Name=='NTFS    '
6 
        cmp     dword [ebx+3], 'NTFS'
 13 
        cmp     dword [ebx+3], 'NTFS'
7 
        jnz     .no
 14 
        jnz     .no
8 
        cmp     dword [ebx+7], '    '
 15 
        cmp     dword [ebx+7], '    '
9 
        jnz     .no
 16 
        jnz     .no
10 
; 2. Number of bytes per sector is the same as for physical device
 17 
; 2. Number of bytes per sector is the same as for physical device
11 
; (that is, 0x200 for hard disk)
 18 
; (that is, 0x200 for hard disk)
12 
        cmp     word [ebx+11], 0x200
 19 
        cmp     word [ebx+11], 0x200
13 
        jnz     .no
 20 
        jnz     .no
14 
; 3. Number of sectors per cluster must be power of 2
 21 
; 3. Number of sectors per cluster must be power of 2
15 
        movzx   eax, byte [ebx+13]
 22 
        movzx   eax, byte [ebx+13]
16 
        dec     eax
 23 
        dec     eax
17 
        js      .no
 24 
        js      .no
18 
        test    al, [ebx+13]
 25 
        test    al, [ebx+13]
19 
        jnz     .no
 26 
        jnz     .no
20 
; 4. FAT parameters must be zero
 27 
; 4. FAT parameters must be zero
21 
        cmp     word [ebx+14], 0
 28 
        cmp     word [ebx+14], 0
22 
        jnz     .no
 29 
        jnz     .no
23 
        cmp     dword [ebx+16], 0
 30 
        cmp     dword [ebx+16], 0
24 
        jnz     .no
 31 
        jnz     .no
25 
        cmp     byte [ebx+20], 0
 32 
        cmp     byte [ebx+20], 0
26 
        jnz     .no
 33 
        jnz     .no
27 
        cmp     word [ebx+22], 0
 34 
        cmp     word [ebx+22], 0
28 
        jnz     .no
 35 
        jnz     .no
29 
        cmp     dword [ebx+32], 0
 36 
        cmp     dword [ebx+32], 0
30 
        jnz     .no
 37 
        jnz     .no
31 
; 5. Number of sectors <= partition size
 38 
; 5. Number of sectors <= partition size
32 
        cmp     dword [ebx+0x2C], 0
 39 
        cmp     dword [ebx+0x2C], 0
33 
        ja      .no
 40 
        ja      .no
34 
        cmp     [ebx+0x28], edx
 41 
        cmp     [ebx+0x28], edx
35 
        ja      .no
 42 
        ja      .no
36 
; 6. $MFT and $MFTMirr clusters must be within partition
 43 
; 6. $MFT and $MFTMirr clusters must be within partition
37 
        cmp     dword [ebx+0x34], 0
 44 
        cmp     dword [ebx+0x34], 0
38 
        ja      .no
 45 
        ja      .no
39 
        push    edx
 46 
        push    edx
40 
        movzx   eax, byte [ebx+13]
 47 
        movzx   eax, byte [ebx+13]
41 
        mul     dword [ebx+0x30]
 48 
        mul     dword [ebx+0x30]
42 
        test    edx, edx
 49 
        test    edx, edx
43 
        pop     edx
 50 
        pop     edx
44 
        jnz     .no
 51 
        jnz     .no
45 
        cmp     eax, edx
 52 
        cmp     eax, edx
46 
        ja      .no
 53 
        ja      .no
47 
        cmp     dword [ebx+0x3C], 0
 54 
        cmp     dword [ebx+0x3C], 0
48 
        ja      .no
 55 
        ja      .no
49 
        push    edx
 56 
        push    edx
50 
        movzx   eax, byte [ebx+13]
 57 
        movzx   eax, byte [ebx+13]
51 
        mul     dword [ebx+0x38]
 58 
        mul     dword [ebx+0x38]
52 
        test    edx, edx
 59 
        test    edx, edx
53 
        pop     edx
 60 
        pop     edx
54 
        jnz     .no
 61 
        jnz     .no
55 
        cmp     eax, edx
 62 
        cmp     eax, edx
56 
        ja      .no
 63 
        ja      .no
57 
; 7. Clusters per FRS must be either negative and in [-31,-9] or positive and power of 2
 64 
; 7. Clusters per FRS must be either negative and in [-31,-9] or positive and power of 2
58 
        movsx   eax, byte [ebx+0x40]
 65 
        movsx   eax, byte [ebx+0x40]
59 
        cmp     al, -31
 66 
        cmp     al, -31
60 
        jl      .no
 67 
        jl      .no
61 
        cmp     al, -9
 68 
        cmp     al, -9
62 
        jle     @f
 69 
        jle     @f
63 
        dec     eax
 70 
        dec     eax
64 
        js      .no
 71 
        js      .no
65 
        test    [ebx+0x40], al
 72 
        test    [ebx+0x40], al
66 
        jnz     .no
 73 
        jnz     .no
67 
@@:
 74 
@@:
68 
; 8. Same for clusters per IndexAllocationBuffer
 75 
; 8. Same for clusters per IndexAllocationBuffer
69 
        movsx   eax, byte [ebx+0x44]
 76 
        movsx   eax, byte [ebx+0x44]
70 
        cmp     al, -31
 77 
        cmp     al, -31
71 
        jl      .no
 78 
        jl      .no
72 
        cmp     al, -9
 79 
        cmp     al, -9
73 
        jle     @f
 80 
        jle     @f
74 
        dec     eax
 81 
        dec     eax
75 
        js      .no
 82 
        js      .no
76 
        test    [ebx+0x44], al
 83 
        test    [ebx+0x44], al
77 
        jnz     .no
 84 
        jnz     .no
78 
@@:
 85 
@@:
79 
; OK, this is correct NTFS bootsector
 86 
; OK, this is correct NTFS bootsector
80 
        clc
 87 
        clc
81 
        ret
 88 
        ret
82 
.no:
 89 
.no:
83 
; No, this bootsector isn't NTFS
 90 
; No, this bootsector isn't NTFS
84 
        stc
 91 
        stc
85 
        ret
 92 
        ret
86 
 
 93 
 
87 
ntfs_setup:             ; CODE XREF: part_set.inc
 94 
ntfs_setup:             ; CODE XREF: part_set.inc
88 
; By given bootsector, initialize some NTFS variables
 95 
; By given bootsector, initialize some NTFS variables
89 
        call    ntfs_test_bootsec
 96 
        call    ntfs_test_bootsec
90 
        jc      problem_fat_dec_count
 97 
        jc      problem_fat_dec_count
91 
        movzx   eax, byte [ebx+13]
 98 
        movzx   eax, byte [ebx+13]
92 
        mov     [ntfs_data.sectors_per_cluster], eax
 99 
        mov     [ntfs_data.sectors_per_cluster], eax
93 
        mov     eax, [ebx+0x28]
 100 
        mov     eax, [ebx+0x28]
94 
        add     eax, [PARTITION_START]
 101 
        add     eax, [PARTITION_START]
95 
        dec     eax
 102 
        dec     eax
96 
        mov     [PARTITION_END], eax
 103 
        mov     [PARTITION_END], eax
97 
        mov     [fs_type], 1
 104 
        mov     [fs_type], 1
98 
        mov     eax, [ebx+0x30]
 105 
        mov     eax, [ebx+0x30]
99 
        mov     [ntfs_data.mft_cluster], eax
 106 
        mov     [ntfs_data.mft_cluster], eax
100 
        mov     eax, [ebx+0x38]
 107 
        mov     eax, [ebx+0x38]
101 
        mov     [ntfs_data.mftmirr_cluster], eax
 108 
        mov     [ntfs_data.mftmirr_cluster], eax
102 
        movsx   eax, byte [ebx+0x40]
 109 
        movsx   eax, byte [ebx+0x40]
103 
        test    eax, eax
 110 
        test    eax, eax
104 
        js      .1
 111 
        js      .1
105 
        mul     [ntfs_data.sectors_per_cluster]
 112 
        mul     [ntfs_data.sectors_per_cluster]
106 
        shl     eax, 9
 113 
        shl     eax, 9
107 
        jmp     .2
 114 
        jmp     .2
108 
.1:
 115 
.1:
109 
        neg     eax
 116 
        neg     eax
110 
        mov     ecx, eax
 117 
        mov     ecx, eax
111 
        mov     eax, 1
 118 
        mov     eax, 1
112 
        shl     eax, cl
 119 
        shl     eax, cl
113 
.2:
 120 
.2:
114 
        mov     [ntfs_data.frs_size], eax
 121 
        mov     [ntfs_data.frs_size], eax
115 
        movsx   eax, byte [ebx+0x44]
 122 
        movsx   eax, byte [ebx+0x44]
116 
        test    eax, eax
 123 
        test    eax, eax
117 
        js      .3
 124 
        js      .3
118 
        mul     [ntfs_data.sectors_per_cluster]
 125 
        mul     [ntfs_data.sectors_per_cluster]
119 
        shl     eax, 9
 126 
        shl     eax, 9
120 
        jmp     .4
 127 
        jmp     .4
121 
.3:
 128 
.3:
122 
        neg     eax
 129 
        neg     eax
123 
        mov     ecx, eax
 130 
        mov     ecx, eax
124 
        mov     eax, 1
 131 
        mov     eax, 1
125 
        shl     eax, cl
 132 
        shl     eax, cl
126 
.4:
 133 
.4:
127 
        mov     [ntfs_data.iab_size], eax
 134 
        mov     [ntfs_data.iab_size], eax
128 
; allocate space for buffers
 135 
; allocate space for buffers
129 
        add     eax, [ntfs_data.frs_size]
 136 
        add     eax, [ntfs_data.frs_size]
130 
        push    eax
 137 
        push    eax
131 
        call    kernel_alloc
 138 
        call    kernel_alloc
132 
        test    eax, eax
 139 
        test    eax, eax
133 
        jz      problem_fat_dec_count
 140 
        jz      problem_fat_dec_count
134 
        mov     [ntfs_data.frs_buffer], eax
 141 
        mov     [ntfs_data.frs_buffer], eax
135 
        add     eax, [ntfs_data.frs_size]
 142 
        add     eax, [ntfs_data.frs_size]
136 
        mov     [ntfs_data.iab_buffer], eax
 143 
        mov     [ntfs_data.iab_buffer], eax
137 
; read $MFT disposition
 144 
; read $MFT disposition
138 
        mov     eax, [ntfs_data.mft_cluster]
 145 
        mov     eax, [ntfs_data.mft_cluster]
139 
        mul     [ntfs_data.sectors_per_cluster]
 146 
        mul     [ntfs_data.sectors_per_cluster]
140 
        call    ntfs_read_frs_sector
 147 
        call    ntfs_read_frs_sector
141 
        cmp     [hd_error], 0
 148 
        cmp     [hd_error], 0
142 
        jnz     .usemirr
 149 
        jnz     .usemirr
143 
        cmp     dword [ebx], 'FILE'
 150 
        cmp     dword [ebx], 'FILE'
144 
        jnz     .usemirr
 151 
        jnz     .usemirr
145 
        call    ntfs_restore_usa_frs
 152 
        call    ntfs_restore_usa_frs
146 
        jnc     .mftok
 153 
        jnc     .mftok
147 
.usemirr:
 154 
.usemirr:
148 
        and     [hd_error], 0
 155 
        and     [hd_error], 0
149 
        mov     eax, [ntfs_data.mftmirr_cluster]
 156 
        mov     eax, [ntfs_data.mftmirr_cluster]
150 
        mul     [ntfs_data.sectors_per_cluster]
 157 
        mul     [ntfs_data.sectors_per_cluster]
151 
        call    ntfs_read_frs_sector
 158 
        call    ntfs_read_frs_sector
152 
        cmp     [hd_error], 0
 159 
        cmp     [hd_error], 0
153 
        jnz     @f
 160 
        jnz     @f
154 
        cmp     dword [ebx], 'FILE'
 161 
        cmp     dword [ebx], 'FILE'
155 
        jnz     @f
 162 
        jnz     @f
156 
        call    ntfs_restore_usa_frs
 163 
        call    ntfs_restore_usa_frs
157 
        jnc     .mftok
 164 
        jnc     .mftok
158 
@@:
 165 
@@:
159 
; $MFT and $MFTMirr invalid!
 166 
; $MFT and $MFTMirr invalid!
160 
.fail_free_frs:
 167 
.fail_free_frs:
161 
        push    [ntfs_data.frs_buffer]
 168 
        push    [ntfs_data.frs_buffer]
162 
        call    kernel_free
 169 
        call    kernel_free
163 
        jmp     problem_fat_dec_count
 170 
        jmp     problem_fat_dec_count
164 
.fail_free_mft:
 171 
.fail_free_mft:
165 
        push    [ntfs_data.mft_retrieval]
 172 
        push    [ntfs_data.mft_retrieval]
166 
        call    kernel_free
 173 
        call    kernel_free
167 
        jmp     .fail_free_frs
 174 
        jmp     .fail_free_frs
168 
.mftok:
 175 
.mftok:
169 
; read $MFT table retrieval information
 176 
; read $MFT table retrieval information
170 
; start with one page, increase if not enough (when MFT too fragmented)
 177 
; start with one page, increase if not enough (when MFT too fragmented)
171 
        push    ebx
 178 
        push    ebx
172 
        push    0x1000
 179 
        push    0x1000
173 
        call    kernel_alloc
 180 
        call    kernel_alloc
174 
        pop     ebx
 181 
        pop     ebx
175 
        test    eax, eax
 182 
        test    eax, eax
176 
        jz      .fail_free_frs
 183 
        jz      .fail_free_frs
177 
        mov     [ntfs_data.mft_retrieval], eax
 184 
        mov     [ntfs_data.mft_retrieval], eax
178 
        and     [ntfs_data.mft_retrieval_size], 0
 185 
        and     [ntfs_data.mft_retrieval_size], 0
179 
        mov     [ntfs_data.mft_retrieval_alloc], 0x1000/8
 186 
        mov     [ntfs_data.mft_retrieval_alloc], 0x1000/8
180 
; $MFT base record must contain unnamed non-resident $DATA attribute
 187 
; $MFT base record must contain unnamed non-resident $DATA attribute
181 
        movzx   eax, word [ebx+14h]
 188 
        movzx   eax, word [ebx+14h]
182 
        add     eax, ebx
 189 
        add     eax, ebx
183 
.scandata:
 190 
.scandata:
184 
        cmp     dword [eax], -1
 191 
        cmp     dword [eax], -1
185 
        jz      .fail_free_mft
 192 
        jz      .fail_free_mft
186 
        cmp     dword [eax], 0x80
 193 
        cmp     dword [eax], 0x80
187 
        jnz     @f
 194 
        jnz     @f
188 
        cmp     byte [eax+9], 0
 195 
        cmp     byte [eax+9], 0
189 
        jz      .founddata
 196 
        jz      .founddata
190 
@@:
 197 
@@:
191 
        add     eax, [eax+4]
 198 
        add     eax, [eax+4]
192 
        jmp     .scandata
 199 
        jmp     .scandata
193 
.founddata:
 200 
.founddata:
194 
        cmp     byte [eax+8], 0
 201 
        cmp     byte [eax+8], 0
195 
        jz      .fail_free_mft
 202 
        jz      .fail_free_mft
196 
; load first portion of $DATA attribute retrieval information
 203 
; load first portion of $DATA attribute retrieval information
197 
        mov     edx, [eax+0x18]
 204 
        mov     edx, [eax+0x18]
198 
        mov     [ntfs_data.mft_retrieval_end], edx
 205 
        mov     [ntfs_data.mft_retrieval_end], edx
199 
        mov     esi, eax
 206 
        mov     esi, eax
200 
        movzx   eax, word [eax+0x20]
 207 
        movzx   eax, word [eax+0x20]
201 
        add     esi, eax
 208 
        add     esi, eax
202 
        sub     esp, 10h
 209 
        sub     esp, 10h
203 
.scanmcb:
 210 
.scanmcb:
204 
        call    ntfs_decode_mcb_entry
 211 
        call    ntfs_decode_mcb_entry
205 
        jnc     .scanmcbend
 212 
        jnc     .scanmcbend
206 
        call    .get_mft_retrieval_ptr
 213 
        call    .get_mft_retrieval_ptr
207 
        mov     edx, [esp]      ; block length
 214 
        mov     edx, [esp]      ; block length
208 
        mov     [eax], edx
 215 
        mov     [eax], edx
209 
        mov     edx, [esp+8]    ; block addr (relative)
 216 
        mov     edx, [esp+8]    ; block addr (relative)
210 
        mov     [eax+4], edx
 217 
        mov     [eax+4], edx
211 
        inc     [ntfs_data.mft_retrieval_size]
 218 
        inc     [ntfs_data.mft_retrieval_size]
212 
        jmp     .scanmcb
 219 
        jmp     .scanmcb
213 
.scanmcbend:
 220 
.scanmcbend:
214 
        add     esp, 10h
 221 
        add     esp, 10h
215 
; there may be other portions of $DATA attribute in auxiliary records;
 222 
; there may be other portions of $DATA attribute in auxiliary records;
216 
; if they will be needed, they will be loaded later
 223 
; if they will be needed, they will be loaded later
217 
 
 224 
 
218 
        mov     [ntfs_data.cur_index_size], 0x1000/0x200
 225 
        mov     [ntfs_data.cur_index_size], 0x1000/0x200
219 
        push    0x1000
 226 
        push    0x1000
220 
        call    kernel_alloc
 227 
        call    kernel_alloc
221 
        test    eax, eax
 228 
        test    eax, eax
222 
        jz      .fail_free_mft
 229 
        jz      .fail_free_mft
223 
        mov     [ntfs_data.cur_index_buf], eax
 230 
        mov     [ntfs_data.cur_index_buf], eax
224 
 
 231 
 
225 
        popad
 232 
        popad
226 
        call    free_hd_channel
 233 
        call    free_hd_channel
227 
        and     [hd1_status], 0
 234 
        and     [hd1_status], 0
228 
        ret
 235 
        ret
229 
 
 236 
 
230 
.get_mft_retrieval_ptr:
 237 
.get_mft_retrieval_ptr:
231 
        pushad
 238 
        pushad
232 
        mov     eax, [ntfs_data.mft_retrieval_size]
 239 
        mov     eax, [ntfs_data.mft_retrieval_size]
233 
        cmp     eax, [ntfs_data.mft_retrieval_alloc]
 240 
        cmp     eax, [ntfs_data.mft_retrieval_alloc]
234 
        jnz     .ok
 241 
        jnz     .ok
235 
        add     eax, 0x1000/8
 242 
        add     eax, 0x1000/8
236 
        mov     [ntfs_data.mft_retrieval_alloc], eax
 243 
        mov     [ntfs_data.mft_retrieval_alloc], eax
237 
        shl     eax, 3
 244 
        shl     eax, 3
238 
        push    eax
 245 
        push    eax
239 
        call    kernel_alloc
 246 
        call    kernel_alloc
240 
        test    eax, eax
 247 
        test    eax, eax
241 
        jnz     @f
 248 
        jnz     @f
242 
        popad
 249 
        popad
243 
        add     esp, 14h
 250 
        add     esp, 14h
244 
        jmp     .fail_free_mft
 251 
        jmp     .fail_free_mft
245 
@@:
 252 
@@:
246 
        mov     esi, [ntfs_data.mft_retrieval]
 253 
        mov     esi, [ntfs_data.mft_retrieval]
247 
        mov     edi, eax
 254 
        mov     edi, eax
248 
        mov     ecx, [ntfs_data.mft_retrieval_size]
 255 
        mov     ecx, [ntfs_data.mft_retrieval_size]
249 
        add     ecx, ecx
 256 
        add     ecx, ecx
250 
        rep     movsd
 257 
        rep     movsd
251 
        push    [ntfs_data.mft_retrieval]
 258 
        push    [ntfs_data.mft_retrieval]
252 
        mov     [ntfs_data.mft_retrieval], eax
 259 
        mov     [ntfs_data.mft_retrieval], eax
253 
        call    kernel_free
 260 
        call    kernel_free
254 
        mov     eax, [ntfs_data.mft_retrieval_size]
 261 
        mov     eax, [ntfs_data.mft_retrieval_size]
255 
.ok:
 262 
.ok:
256 
        shl     eax, 3
 263 
        shl     eax, 3
257 
        add     eax, [ntfs_data.mft_retrieval]
 264 
        add     eax, [ntfs_data.mft_retrieval]
258 
        mov     [esp+28], eax
 265 
        mov     [esp+28], eax
259 
        popad
 266 
        popad
260 
        ret
 267 
        ret
261 
 
 268 
 
262 
ntfs_read_frs_sector:
 269 
ntfs_read_frs_sector:
263 
        push    eax ecx
 270 
        push    eax ecx
264 
        add     eax, [PARTITION_START]
 271 
        add     eax, [PARTITION_START]
265 
        mov     ecx, [ntfs_data.frs_size]
 272 
        mov     ecx, [ntfs_data.frs_size]
266 
        shr     ecx, 9
 273 
        shr     ecx, 9
267 
        mov     ebx, [ntfs_data.frs_buffer]
 274 
        mov     ebx, [ntfs_data.frs_buffer]
268 
        push    ebx
 275 
        push    ebx
269 
@@:
 276 
@@:
270 
        call    hd_read
 277 
        call    hd_read
271 
        cmp     [hd_error], 0
 278 
        cmp     [hd_error], 0
272 
        jnz     .fail
 279 
        jnz     .fail
273 
        add     ebx, 0x200
 280 
        add     ebx, 0x200
274 
        inc     eax
 281 
        inc     eax
275 
        loop    @b
 282 
        loop    @b
276 
.fail:
 283 
.fail:
277 
        pop     ebx
 284 
        pop     ebx
278 
        pop     ecx eax
 285 
        pop     ecx eax
279 
        ret
 286 
        ret
280 
 
 287 
 
281 
uglobal
 288 
uglobal
282 
align 4
 289 
align 4
283 
ntfs_cur_attr   dd      ?
 290 
ntfs_cur_attr   dd      ?
284 
ntfs_cur_iRecord dd     ?
 291 
ntfs_cur_iRecord dd     ?
285 
ntfs_cur_offs   dd      ?       ; in sectors
 292 
ntfs_cur_offs   dd      ?       ; in sectors
286 
ntfs_cur_size   dd      ?       ; in sectors
 293 
ntfs_cur_size   dd      ?       ; in sectors
287 
ntfs_cur_buf    dd      ?
 294 
ntfs_cur_buf    dd      ?
288 
ntfs_cur_read   dd      ?       ; [output]
 295 
ntfs_cur_read   dd      ?       ; [output]
289 
ntfs_bCanContinue db    ?
 296 
ntfs_bCanContinue db    ?
290 
                rb      3
 297 
                rb      3
291 
 
 298 
 
292 
ntfs_attrlist_buf       rb      0x400
 299 
ntfs_attrlist_buf       rb      0x400
293 
ntfs_attrlist_mft_buf   rb      0x400
 300 
ntfs_attrlist_mft_buf   rb      0x400
294 
ntfs_bitmap_buf         rb      0x400
 301 
ntfs_bitmap_buf         rb      0x400
295 
 
 302 
 
296 
ntfs_attr_iRecord       dd      ?
 303 
ntfs_attr_iRecord       dd      ?
297 
ntfs_attr_iBaseRecord   dd      ?
 304 
ntfs_attr_iBaseRecord   dd      ?
298 
ntfs_attr_offs          dd      ?
 305 
ntfs_attr_offs          dd      ?
299 
ntfs_attr_list          dd      ?
 306 
ntfs_attr_list          dd      ?
300 
ntfs_attr_size          dq      ?
 307 
ntfs_attr_size          dq      ?
301 
ntfs_cur_tail           dd      ?
 308 
ntfs_cur_tail           dd      ?
302 
endg
 309 
endg
303 
 
 310 
 
304 
ntfs_read_attr:
 311 
ntfs_read_attr:
305 
; in: global variables
 312 
; in: global variables
306 
; out: [ntfs_cur_read]
 313 
; out: [ntfs_cur_read]
307 
        pushad
 314 
        pushad
308 
        and     [ntfs_cur_read], 0
 315 
        and     [ntfs_cur_read], 0
309 
        cmp     [ntfs_cur_iRecord], 0
 316 
        cmp     [ntfs_cur_iRecord], 0
310 
        jnz     .nomft
 317 
        jnz     .nomft
311 
        cmp     [ntfs_cur_attr], 0x80
 318 
        cmp     [ntfs_cur_attr], 0x80
312 
        jnz     .nomft
 319 
        jnz     .nomft
313 
        mov     eax, [ntfs_data.mft_retrieval_end]
 320 
        mov     eax, [ntfs_data.mft_retrieval_end]
314 
        inc     eax
 321 
        inc     eax
315 
        mul     [ntfs_data.sectors_per_cluster]
 322 
        mul     [ntfs_data.sectors_per_cluster]
316 
        cmp     eax, [ntfs_cur_offs]
 323 
        cmp     eax, [ntfs_cur_offs]
317 
        jbe     .nomft
 324 
        jbe     .nomft
318 
; precalculated part of $Mft $DATA
 325 
; precalculated part of $Mft $DATA
319 
        mov     esi, [ntfs_data.mft_retrieval]
 326 
        mov     esi, [ntfs_data.mft_retrieval]
320 
        mov     eax, [ntfs_cur_offs]
 327 
        mov     eax, [ntfs_cur_offs]
321 
        xor     edx, edx
 328 
        xor     edx, edx
322 
        div     [ntfs_data.sectors_per_cluster]
 329 
        div     [ntfs_data.sectors_per_cluster]
323 
; eax = VCN, edx = offset in sectors from beginning of cluster
 330 
; eax = VCN, edx = offset in sectors from beginning of cluster
324 
        xor     ecx, ecx        ; ecx will contain LCN
 331 
        xor     ecx, ecx        ; ecx will contain LCN
325 
.mftscan:
 332 
.mftscan:
326 
        add     ecx, [esi+4]
 333 
        add     ecx, [esi+4]
327 
        sub     eax, [esi]
 334 
        sub     eax, [esi]
328 
        jb      @f
 335 
        jb      @f
329 
        add     esi, 8
 336 
        add     esi, 8
330 
        push    eax
 337 
        push    eax
331 
        mov     eax, [ntfs_data.mft_retrieval_end]
 338 
        mov     eax, [ntfs_data.mft_retrieval_end]
332 
        shl     eax, 3
 339 
        shl     eax, 3
333 
        add     eax, [ntfs_data.mft_retrieval]
 340 
        add     eax, [ntfs_data.mft_retrieval]
334 
        cmp     eax, esi
 341 
        cmp     eax, esi
335 
        pop     eax
 342 
        pop     eax
336 
        jnz     .mftscan
 343 
        jnz     .mftscan
337 
        jmp     .nomft
 344 
        jmp     .nomft
338 
@@:
 345 
@@:
339 
        push    ecx
 346 
        push    ecx
340 
        add     ecx, eax
 347 
        add     ecx, eax
341 
        add     ecx, [esi]
 348 
        add     ecx, [esi]
342 
        push    eax
 349 
        push    eax
343 
        push    edx
 350 
        push    edx
344 
        mov     eax, [ntfs_data.sectors_per_cluster]
 351 
        mov     eax, [ntfs_data.sectors_per_cluster]
345 
        mul     ecx
 352 
        mul     ecx
346 
; eax = sector on partition
 353 
; eax = sector on partition
347 
        add     eax, [PARTITION_START]
 354 
        add     eax, [PARTITION_START]
348 
        pop     edx
 355 
        pop     edx
349 
        add     eax, edx
 356 
        add     eax, edx
350 
        mov     ebx, [ntfs_cur_buf]
 357 
        mov     ebx, [ntfs_cur_buf]
351 
        pop     ecx
 358 
        pop     ecx
352 
        neg     ecx
 359 
        neg     ecx
353 
        imul    ecx, [ntfs_data.sectors_per_cluster]
 360 
        imul    ecx, [ntfs_data.sectors_per_cluster]
354 
        sub     ecx, edx
 361 
        sub     ecx, edx
355 
        cmp     ecx, [ntfs_cur_size]
 362 
        cmp     ecx, [ntfs_cur_size]
356 
        jb      @f
 363 
        jb      @f
357 
        mov     ecx, [ntfs_cur_size]
 364 
        mov     ecx, [ntfs_cur_size]
358 
@@:
 365 
@@:
359 
; ecx = number of sequential sectors to read
 366 
; ecx = number of sequential sectors to read
360 
        call    hd_read
 367 
        call    hd_read
361 
        cmp     [hd_error], 0
 368 
        cmp     [hd_error], 0
362 
        jnz     .errread
 369 
        jnz     .errread
363 
        add     [ntfs_cur_read], 0x200
 370 
        add     [ntfs_cur_read], 0x200
364 
        dec     [ntfs_cur_size]
 371 
        dec     [ntfs_cur_size]
365 
        inc     [ntfs_cur_offs]
 372 
        inc     [ntfs_cur_offs]
366 
        add     ebx, 0x200
 373 
        add     ebx, 0x200
367 
        mov     [ntfs_cur_buf], ebx
 374 
        mov     [ntfs_cur_buf], ebx
368 
        inc     eax
 375 
        inc     eax
369 
        loop    @b
 376 
        loop    @b
370 
        pop     ecx
 377 
        pop     ecx
371 
        xor     eax, eax
 378 
        xor     eax, eax
372 
        xor     edx, edx
 379 
        xor     edx, edx
373 
        cmp     [ntfs_cur_size], eax
 380 
        cmp     [ntfs_cur_size], eax
374 
        jz      @f
 381 
        jz      @f
375 
        add     esi, 8
 382 
        add     esi, 8
376 
        push    eax
 383 
        push    eax
377 
        mov     eax, [ntfs_data.mft_retrieval_end]
 384 
        mov     eax, [ntfs_data.mft_retrieval_end]
378 
        shl     eax, 3
 385 
        shl     eax, 3
379 
        add     eax, [ntfs_data.mft_retrieval]
 386 
        add     eax, [ntfs_data.mft_retrieval]
380 
        cmp     eax, esi
 387 
        cmp     eax, esi
381 
        pop     eax
 388 
        pop     eax
382 
        jz      .nomft
 389 
        jz      .nomft
383 
        jmp     .mftscan
 390 
        jmp     .mftscan
384 
@@:
 391 
@@:
385 
        popad
 392 
        popad
386 
        ret
 393 
        ret
387 
.errread:
 394 
.errread:
388 
        pop     ecx
 395 
        pop     ecx
389 
.errret:
 396 
.errret:
390 
        stc
 397 
        stc
391 
        popad
 398 
        popad
392 
        ret
 399 
        ret
393 
.nomft:
 400 
.nomft:
394 
; 1. Read file record.
 401 
; 1. Read file record.
395 
; N.B. This will do recursive call of read_attr for $MFT::$Data.
 402 
; N.B. This will do recursive call of read_attr for $MFT::$Data.
396 
        mov     eax, [ntfs_cur_iRecord]
 403 
        mov     eax, [ntfs_cur_iRecord]
397 
        mov     [ntfs_attr_iRecord], eax
 404 
        mov     [ntfs_attr_iRecord], eax
398 
        and     [ntfs_attr_list], 0
 405 
        and     [ntfs_attr_list], 0
399 
        or      dword [ntfs_attr_size], -1
 406 
        or      dword [ntfs_attr_size], -1
400 
        or      dword [ntfs_attr_size+4], -1
 407 
        or      dword [ntfs_attr_size+4], -1
401 
        or      [ntfs_attr_iBaseRecord], -1
 408 
        or      [ntfs_attr_iBaseRecord], -1
402 
        call    ntfs_read_file_record
 409 
        call    ntfs_read_file_record
403 
        test    eax, eax
 410 
        test    eax, eax
404 
        jz      .errret
 411 
        jz      .errret
405 
; 2. Find required attribute.
 412 
; 2. Find required attribute.
406 
        mov     eax, [ntfs_data.frs_buffer]
 413 
        mov     eax, [ntfs_data.frs_buffer]
407 
; a) For auxiliary records, read base record
 414 
; a) For auxiliary records, read base record
408 
; N.B. If base record is present,
 415 
; N.B. If base record is present,
409 
;      base iRecord may be 0 (for $Mft), but SequenceNumber is nonzero
 416 
;      base iRecord may be 0 (for $Mft), but SequenceNumber is nonzero
410 
        cmp     dword [eax+24h], 0
 417 
        cmp     dword [eax+24h], 0
411 
        jz      @f
 418 
        jz      @f
412 
        mov     eax, [eax+20h]
 419 
        mov     eax, [eax+20h]
413 
;        test    eax, eax
 420 
;        test    eax, eax
414 
;        jz      @f
 421 
;        jz      @f
415 
.beginfindattr:
 422 
.beginfindattr:
416 
        mov     [ntfs_attr_iRecord], eax
 423 
        mov     [ntfs_attr_iRecord], eax
417 
        call    ntfs_read_file_record
 424 
        call    ntfs_read_file_record
418 
        test    eax, eax
 425 
        test    eax, eax
419 
        jz      .errret
 426 
        jz      .errret
420 
@@:
 427 
@@:
421 
; b) Scan for required attribute and for $ATTR_LIST
 428 
; b) Scan for required attribute and for $ATTR_LIST
422 
        mov     eax, [ntfs_data.frs_buffer]
 429 
        mov     eax, [ntfs_data.frs_buffer]
423 
        movzx   ecx, word [eax+14h]
 430 
        movzx   ecx, word [eax+14h]
424 
        add     eax, ecx
 431 
        add     eax, ecx
425 
        mov     ecx, [ntfs_cur_attr]
 432 
        mov     ecx, [ntfs_cur_attr]
426 
        and     [ntfs_attr_offs], 0
 433 
        and     [ntfs_attr_offs], 0
427 
.scanattr:
 434 
.scanattr:
428 
        cmp     dword [eax], -1
 435 
        cmp     dword [eax], -1
429 
        jz      .scandone
 436 
        jz      .scandone
430 
        cmp     dword [eax], ecx
 437 
        cmp     dword [eax], ecx
431 
        jz      .okattr
 438 
        jz      .okattr
432 
        cmp     [ntfs_attr_iBaseRecord], -1
 439 
        cmp     [ntfs_attr_iBaseRecord], -1
433 
        jnz     .scancont
 440 
        jnz     .scancont
434 
        cmp     dword [eax], 0x20       ; $ATTR_LIST
 441 
        cmp     dword [eax], 0x20       ; $ATTR_LIST
435 
        jnz     .scancont
 442 
        jnz     .scancont
436 
        mov     [ntfs_attr_list], eax
 443 
        mov     [ntfs_attr_list], eax
437 
        jmp     .scancont
 444 
        jmp     .scancont
438 
.okattr:
 445 
.okattr:
439 
; ignore named $DATA attributes (aka NTFS streams)
 446 
; ignore named $DATA attributes (aka NTFS streams)
440 
        cmp     ecx, 0x80
 447 
        cmp     ecx, 0x80
441 
        jnz     @f
 448 
        jnz     @f
442 
        cmp     byte [eax+9], 0
 449 
        cmp     byte [eax+9], 0
443 
        jnz     .scancont
 450 
        jnz     .scancont
444 
@@:
 451 
@@:
445 
        mov     [ntfs_attr_offs], eax
 452 
        mov     [ntfs_attr_offs], eax
446 
.scancont:
 453 
.scancont:
447 
        add     eax, [eax+4]
 454 
        add     eax, [eax+4]
448 
        jmp     .scanattr
 455 
        jmp     .scanattr
449 
.continue:
 456 
.continue:
450 
        pushad
 457 
        pushad
451 
        and     [ntfs_cur_read], 0
 458 
        and     [ntfs_cur_read], 0
452 
.scandone:
 459 
.scandone:
453 
; c) Check for required offset and length
 460 
; c) Check for required offset and length
454 
        mov     ecx, [ntfs_attr_offs]
 461 
        mov     ecx, [ntfs_attr_offs]
455 
        jecxz   .noattr
 462 
        jecxz   .noattr
456 
        push    [ntfs_cur_size]
 463 
        push    [ntfs_cur_size]
457 
        push    [ntfs_cur_read]
 464 
        push    [ntfs_cur_read]
458 
        call    .doreadattr
 465 
        call    .doreadattr
459 
        pop     edx
 466 
        pop     edx
460 
        pop     eax
 467 
        pop     eax
461 
        jc      @f
 468 
        jc      @f
462 
        cmp     [ntfs_bCanContinue], 0
 469 
        cmp     [ntfs_bCanContinue], 0
463 
        jz      @f
 470 
        jz      @f
464 
        sub     edx, [ntfs_cur_read]
 471 
        sub     edx, [ntfs_cur_read]
465 
        neg     edx
 472 
        neg     edx
466 
        shr     edx, 9
 473 
        shr     edx, 9
467 
        sub     eax, edx
 474 
        sub     eax, edx
468 
        mov     [ntfs_cur_size], eax
 475 
        mov     [ntfs_cur_size], eax
469 
        jnz     .not_in_cur
 476 
        jnz     .not_in_cur
470 
@@:
 477 
@@:
471 
        popad
 478 
        popad
472 
        ret
 479 
        ret
473 
.noattr:
 480 
.noattr:
474 
.not_in_cur:
 481 
.not_in_cur:
475 
        cmp     [ntfs_cur_attr], 0x20
 482 
        cmp     [ntfs_cur_attr], 0x20
476 
        jz      @f
 483 
        jz      @f
477 
        mov     ecx, [ntfs_attr_list]
 484 
        mov     ecx, [ntfs_attr_list]
478 
        test    ecx, ecx
 485 
        test    ecx, ecx
479 
        jnz     .lookattr
 486 
        jnz     .lookattr
480 
.ret_is_attr:
 487 
.ret_is_attr:
481 
        cmp     [ntfs_attr_offs], 1     ; CF set <=> ntfs_attr_offs == 0
 488 
        cmp     [ntfs_attr_offs], 1     ; CF set <=> ntfs_attr_offs == 0
482 
        popad
 489 
        popad
483 
        ret
 490 
        ret
484 
.lookattr:
 491 
.lookattr:
485 
; required attribute or required offset was not found in base record;
 492 
; required attribute or required offset was not found in base record;
486 
; it may be present in auxiliary records;
 493 
; it may be present in auxiliary records;
487 
; scan $ATTR_LIST
 494 
; scan $ATTR_LIST
488 
        mov     eax, [ntfs_attr_iBaseRecord]
 495 
        mov     eax, [ntfs_attr_iBaseRecord]
489 
        cmp     eax, -1
 496 
        cmp     eax, -1
490 
        jz      @f
 497 
        jz      @f
491 
        call    ntfs_read_file_record
 498 
        call    ntfs_read_file_record
492 
        test    eax, eax
 499 
        test    eax, eax
493 
        jz      .errret
 500 
        jz      .errret
494 
        or      [ntfs_attr_iBaseRecord], -1
 501 
        or      [ntfs_attr_iBaseRecord], -1
495 
@@:
 502 
@@:
496 
        push    [ntfs_cur_offs]
 503 
        push    [ntfs_cur_offs]
497 
        push    [ntfs_cur_size]
 504 
        push    [ntfs_cur_size]
498 
        push    [ntfs_cur_read]
 505 
        push    [ntfs_cur_read]
499 
        push    [ntfs_cur_buf]
 506 
        push    [ntfs_cur_buf]
500 
        push    dword [ntfs_attr_size]
 507 
        push    dword [ntfs_attr_size]
501 
        push    dword [ntfs_attr_size+4]
 508 
        push    dword [ntfs_attr_size+4]
502 
        or      dword [ntfs_attr_size], -1
 509 
        or      dword [ntfs_attr_size], -1
503 
        or      dword [ntfs_attr_size+4], -1
 510 
        or      dword [ntfs_attr_size+4], -1
504 
        and     [ntfs_cur_offs], 0
 511 
        and     [ntfs_cur_offs], 0
505 
        mov     [ntfs_cur_size], 2
 512 
        mov     [ntfs_cur_size], 2
506 
        and     [ntfs_cur_read], 0
 513 
        and     [ntfs_cur_read], 0
507 
        mov     eax, ntfs_attrlist_buf
 514 
        mov     eax, ntfs_attrlist_buf
508 
        cmp     [ntfs_cur_iRecord], 0
 515 
        cmp     [ntfs_cur_iRecord], 0
509 
        jnz     @f
 516 
        jnz     @f
510 
        mov     eax, ntfs_attrlist_mft_buf
 517 
        mov     eax, ntfs_attrlist_mft_buf
511 
@@:
 518 
@@:
512 
        mov     [ntfs_cur_buf], eax
 519 
        mov     [ntfs_cur_buf], eax
513 
        push    eax
 520 
        push    eax
514 
        call    .doreadattr
 521 
        call    .doreadattr
515 
        pop     esi
 522 
        pop     esi
516 
        mov     edx, 1
 523 
        mov     edx, 1
517 
        pop     dword [ntfs_attr_size+4]
 524 
        pop     dword [ntfs_attr_size+4]
518 
        pop     dword [ntfs_attr_size]
 525 
        pop     dword [ntfs_attr_size]
519 
        mov     ebp, [ntfs_cur_read]
 526 
        mov     ebp, [ntfs_cur_read]
520 
        pop     [ntfs_cur_buf]
 527 
        pop     [ntfs_cur_buf]
521 
        pop     [ntfs_cur_read]
 528 
        pop     [ntfs_cur_read]
522 
        pop     [ntfs_cur_size]
 529 
        pop     [ntfs_cur_size]
523 
        pop     [ntfs_cur_offs]
 530 
        pop     [ntfs_cur_offs]
524 
        jc      .errret
 531 
        jc      .errret
525 
        or      edi, -1
 532 
        or      edi, -1
526 
        lea     ebp, [ebp+esi-1Ah]
 533 
        lea     ebp, [ebp+esi-1Ah]
527 
.scanliststart:
 534 
.scanliststart:
528 
        mov     eax, [ntfs_cur_attr]
 535 
        mov     eax, [ntfs_cur_attr]
529 
.scanlist:
 536 
.scanlist:
530 
        cmp     esi, ebp
 537 
        cmp     esi, ebp
531 
        jae     .scanlistdone
 538 
        jae     .scanlistdone
532 
        cmp     eax, [esi]
 539 
        cmp     eax, [esi]
533 
        jz      @f
 540 
        jz      @f
534 
.scanlistcont:
 541 
.scanlistcont:
535 
        movzx   ecx, word [esi+4]
 542 
        movzx   ecx, word [esi+4]
536 
        add     esi, ecx
 543 
        add     esi, ecx
537 
        jmp     .scanlist
 544 
        jmp     .scanlist
538 
@@:
 545 
@@:
539 
; ignore named $DATA attributes (aka NTFS streams)
 546 
; ignore named $DATA attributes (aka NTFS streams)
540 
        cmp     eax, 0x80
 547 
        cmp     eax, 0x80
541 
        jnz     @f
 548 
        jnz     @f
542 
        cmp     byte [esi+6], 0
 549 
        cmp     byte [esi+6], 0
543 
        jnz     .scanlistcont
 550 
        jnz     .scanlistcont
544 
@@:
 551 
@@:
545 
        push    eax
 552 
        push    eax
546 
        mov     eax, [esi+8]
 553 
        mov     eax, [esi+8]
547 
        test    eax, eax
 554 
        test    eax, eax
548 
        jnz     .testf
 555 
        jnz     .testf
549 
        mov     eax, dword [ntfs_attr_size]
 556 
        mov     eax, dword [ntfs_attr_size]
550 
        and     eax, dword [ntfs_attr_size+4]
 557 
        and     eax, dword [ntfs_attr_size+4]
551 
        cmp     eax, -1
 558 
        cmp     eax, -1
552 
        jnz     .testfz
 559 
        jnz     .testfz
553 
; if attribute is in auxiliary records, its size is defined only in first
 560 
; if attribute is in auxiliary records, its size is defined only in first
554 
        mov     eax, [esi+10h]
 561 
        mov     eax, [esi+10h]
555 
        call    ntfs_read_file_record
 562 
        call    ntfs_read_file_record
556 
        test    eax, eax
 563 
        test    eax, eax
557 
        jnz     @f
 564 
        jnz     @f
558 
.errret_pop:
 565 
.errret_pop:
559 
        pop     eax
 566 
        pop     eax
560 
        jmp     .errret
 567 
        jmp     .errret
561 
@@:
 568 
@@:
562 
        mov     eax, [ntfs_data.frs_buffer]
 569 
        mov     eax, [ntfs_data.frs_buffer]
563 
        movzx   ecx, word [eax+14h]
 570 
        movzx   ecx, word [eax+14h]
564 
        add     eax, ecx
 571 
        add     eax, ecx
565 
        mov     ecx, [ntfs_cur_attr]
 572 
        mov     ecx, [ntfs_cur_attr]
566 
@@:
 573 
@@:
567 
        cmp     dword [eax], -1
 574 
        cmp     dword [eax], -1
568 
        jz      .errret_pop
 575 
        jz      .errret_pop
569 
        cmp     dword [eax], ecx
 576 
        cmp     dword [eax], ecx
570 
        jz      @f
 577 
        jz      @f
571 
.l1:
 578 
.l1:
572 
        add     eax, [eax+4]
 579 
        add     eax, [eax+4]
573 
        jmp     @b
 580 
        jmp     @b
574 
@@:
 581 
@@:
575 
        cmp     eax, 0x80
 582 
        cmp     eax, 0x80
576 
        jnz     @f
 583 
        jnz     @f
577 
        cmp     byte [eax+9], 0
 584 
        cmp     byte [eax+9], 0
578 
        jnz     .l1
 585 
        jnz     .l1
579 
@@:
 586 
@@:
580 
        cmp     byte [eax+8], 0
 587 
        cmp     byte [eax+8], 0
581 
        jnz     .sdnores
 588 
        jnz     .sdnores
582 
        mov     eax, [eax+10h]
 589 
        mov     eax, [eax+10h]
583 
        mov     dword [ntfs_attr_size], eax
 590 
        mov     dword [ntfs_attr_size], eax
584 
        and     dword [ntfs_attr_size+4], 0
 591 
        and     dword [ntfs_attr_size+4], 0
585 
        jmp     .testfz
 592 
        jmp     .testfz
586 
.sdnores:
 593 
.sdnores:
587 
        mov     ecx, [eax+30h]
 594 
        mov     ecx, [eax+30h]
588 
        mov     dword [ntfs_attr_size], ecx
 595 
        mov     dword [ntfs_attr_size], ecx
589 
        mov     ecx, [eax+34h]
 596 
        mov     ecx, [eax+34h]
590 
        mov     dword [ntfs_attr_size+4], ecx
 597 
        mov     dword [ntfs_attr_size+4], ecx
591 
.testfz:
 598 
.testfz:
592 
        xor     eax, eax
 599 
        xor     eax, eax
593 
.testf:
 600 
.testf:
594 
        imul    eax, [ntfs_data.sectors_per_cluster]
 601 
        imul    eax, [ntfs_data.sectors_per_cluster]
595 
        cmp     eax, [ntfs_cur_offs]
 602 
        cmp     eax, [ntfs_cur_offs]
596 
        pop     eax
 603 
        pop     eax
597 
        ja      @f
 604 
        ja      @f
598 
        mov     edi, [esi+10h]  ; keep previous iRecord
 605 
        mov     edi, [esi+10h]  ; keep previous iRecord
599 
        jmp     .scanlistcont
 606 
        jmp     .scanlistcont
600 
@@:
 607 
@@:
601 
.scanlistfound:
 608 
.scanlistfound:
602 
        cmp     edi, -1
 609 
        cmp     edi, -1
603 
        jnz     @f
 610 
        jnz     @f
604 
        popad
 611 
        popad
605 
        ret
 612 
        ret
606 
@@:
 613 
@@:
607 
        mov     eax, [ntfs_cur_iRecord]
 614 
        mov     eax, [ntfs_cur_iRecord]
608 
        mov     [ntfs_attr_iBaseRecord], eax
 615 
        mov     [ntfs_attr_iBaseRecord], eax
609 
        mov     eax, edi
 616 
        mov     eax, edi
610 
        jmp     .beginfindattr
 617 
        jmp     .beginfindattr
611 
.sde:
 618 
.sde:
612 
        popad
 619 
        popad
613 
        stc
 620 
        stc
614 
        ret
 621 
        ret
615 
.scanlistdone:
 622 
.scanlistdone:
616 
        sub     ebp, ntfs_attrlist_buf-1Ah
 623 
        sub     ebp, ntfs_attrlist_buf-1Ah
617 
        cmp     [ntfs_cur_iRecord], 0
 624 
        cmp     [ntfs_cur_iRecord], 0
618 
        jnz     @f
 625 
        jnz     @f
619 
        sub     ebp, ntfs_attrlist_mft_buf-ntfs_attrlist_buf
 626 
        sub     ebp, ntfs_attrlist_mft_buf-ntfs_attrlist_buf
620 
@@:
 627 
@@:
621 
        cmp     ebp, 0x400
 628 
        cmp     ebp, 0x400
622 
        jnz     .scanlistfound
 629 
        jnz     .scanlistfound
623 
        inc     edx
 630 
        inc     edx
624 
        push    esi edi
 631 
        push    esi edi
625 
        mov     esi, ntfs_attrlist_buf+0x200
 632 
        mov     esi, ntfs_attrlist_buf+0x200
626 
        mov     edi, ntfs_attrlist_buf
 633 
        mov     edi, ntfs_attrlist_buf
627 
        cmp     [ntfs_cur_iRecord], 0
 634 
        cmp     [ntfs_cur_iRecord], 0
628 
        jnz     @f
 635 
        jnz     @f
629 
        mov     esi, ntfs_attrlist_mft_buf+0x200
 636 
        mov     esi, ntfs_attrlist_mft_buf+0x200
630 
        mov     edi, ntfs_attrlist_mft_buf
 637 
        mov     edi, ntfs_attrlist_mft_buf
631 
@@:
 638 
@@:
632 
        mov     ecx, 0x200/4
 639 
        mov     ecx, 0x200/4
633 
        rep     movsd
 640 
        rep     movsd
634 
        mov     eax, edi
 641 
        mov     eax, edi
635 
        pop     edi esi
 642 
        pop     edi esi
636 
        sub     esi, 0x200
 643 
        sub     esi, 0x200
637 
        push    [ntfs_cur_offs]
 644 
        push    [ntfs_cur_offs]
638 
        push    [ntfs_cur_size]
 645 
        push    [ntfs_cur_size]
639 
        push    [ntfs_cur_read]
 646 
        push    [ntfs_cur_read]
640 
        push    [ntfs_cur_buf]
 647 
        push    [ntfs_cur_buf]
641 
        push    dword [ntfs_attr_size]
 648 
        push    dword [ntfs_attr_size]
642 
        push    dword [ntfs_attr_size+4]
 649 
        push    dword [ntfs_attr_size+4]
643 
        or      dword [ntfs_attr_size], -1
 650 
        or      dword [ntfs_attr_size], -1
644 
        or      dword [ntfs_attr_size+4], -1
 651 
        or      dword [ntfs_attr_size+4], -1
645 
        mov     [ntfs_cur_offs], edx
 652 
        mov     [ntfs_cur_offs], edx
646 
        mov     [ntfs_cur_size], 1
 653 
        mov     [ntfs_cur_size], 1
647 
        and     [ntfs_cur_read], 0
 654 
        and     [ntfs_cur_read], 0
648 
        mov     [ntfs_cur_buf], eax
 655 
        mov     [ntfs_cur_buf], eax
649 
        mov     ecx, [ntfs_attr_list]
 656 
        mov     ecx, [ntfs_attr_list]
650 
        push    esi edx
 657 
        push    esi edx
651 
        call    .doreadattr
 658 
        call    .doreadattr
652 
        pop     edx esi
 659 
        pop     edx esi
653 
        mov     ebp, [ntfs_cur_read]
 660 
        mov     ebp, [ntfs_cur_read]
654 
        pop     dword [ntfs_attr_size+4]
 661 
        pop     dword [ntfs_attr_size+4]
655 
        pop     dword [ntfs_attr_size]
 662 
        pop     dword [ntfs_attr_size]
656 
        pop     [ntfs_cur_buf]
 663 
        pop     [ntfs_cur_buf]
657 
        pop     [ntfs_cur_read]
 664 
        pop     [ntfs_cur_read]
658 
        pop     [ntfs_cur_size]
 665 
        pop     [ntfs_cur_size]
659 
        pop     [ntfs_cur_offs]
 666 
        pop     [ntfs_cur_offs]
660 
        jc      .errret
 667 
        jc      .errret
661 
        add     ebp, ntfs_attrlist_buf+0x200-0x1A
 668 
        add     ebp, ntfs_attrlist_buf+0x200-0x1A
662 
        cmp     [ntfs_cur_iRecord], 0
 669 
        cmp     [ntfs_cur_iRecord], 0
663 
        jnz     .scanliststart
 670 
        jnz     .scanliststart
664 
        add     ebp, ntfs_attrlist_mft_buf-ntfs_attrlist_buf
 671 
        add     ebp, ntfs_attrlist_mft_buf-ntfs_attrlist_buf
665 
        jmp     .scanliststart
 672 
        jmp     .scanliststart
666 
 
 673 
 
667 
.doreadattr:
 674 
.doreadattr:
668 
        mov     [ntfs_bCanContinue], 0
 675 
        mov     [ntfs_bCanContinue], 0
669 
        cmp     byte [ecx+8], 0
 676 
        cmp     byte [ecx+8], 0
670 
        jnz     .nonresident
 677 
        jnz     .nonresident
671 
        mov     eax, [ecx+10h]  ; length
 678 
        mov     eax, [ecx+10h]  ; length
672 
        mov     esi, eax
 679 
        mov     esi, eax
673 
        mov     edx, [ntfs_cur_offs]
 680 
        mov     edx, [ntfs_cur_offs]
674 
        shr     eax, 9
 681 
        shr     eax, 9
675 
        cmp     eax, edx
 682 
        cmp     eax, edx
676 
        jb      .okret
 683 
        jb      .okret
677 
        shl     edx, 9
 684 
        shl     edx, 9
678 
        sub     esi, edx
 685 
        sub     esi, edx
679 
        movzx   eax, word [ecx+14h]
 686 
        movzx   eax, word [ecx+14h]
680 
        add     edx, eax
 687 
        add     edx, eax
681 
        add     edx, ecx        ; edx -> data
 688 
        add     edx, ecx        ; edx -> data
682 
        mov     eax, [ntfs_cur_size]
 689 
        mov     eax, [ntfs_cur_size]
683 
        cmp     eax, (0xFFFFFFFF shr 9)+1
 690 
        cmp     eax, (0xFFFFFFFF shr 9)+1
684 
        jbe     @f
 691 
        jbe     @f
685 
        mov     eax, (0xFFFFFFFF shr 9)+1
 692 
        mov     eax, (0xFFFFFFFF shr 9)+1
686 
@@:
 693 
@@:
687 
        shl     eax, 9
 694 
        shl     eax, 9
688 
        cmp     eax, esi
 695 
        cmp     eax, esi
689 
        jbe     @f
 696 
        jbe     @f
690 
        mov     eax, esi
 697 
        mov     eax, esi
691 
@@:
 698 
@@:
692 
; eax = length, edx -> data
 699 
; eax = length, edx -> data
693 
        mov     [ntfs_cur_read], eax
 700 
        mov     [ntfs_cur_read], eax
694 
        mov     ecx, eax
 701 
        mov     ecx, eax
695 
        mov     eax, edx
 702 
        mov     eax, edx
696 
        mov     ebx, [ntfs_cur_buf]
 703 
        mov     ebx, [ntfs_cur_buf]
697 
        call    memmove
 704 
        call    memmove
698 
        and     [ntfs_cur_size], 0      ; CF=0
 705 
        and     [ntfs_cur_size], 0      ; CF=0
699 
        ret
 706 
        ret
700 
.nonresident:
 707 
.nonresident:
701 
; Not all auxiliary records contain correct FileSize info
 708 
; Not all auxiliary records contain correct FileSize info
702 
        mov     eax, dword [ntfs_attr_size]
 709 
        mov     eax, dword [ntfs_attr_size]
703 
        mov     edx, dword [ntfs_attr_size+4]
 710 
        mov     edx, dword [ntfs_attr_size+4]
704 
        push    eax
 711 
        push    eax
705 
        and     eax, edx
 712 
        and     eax, edx
706 
        cmp     eax, -1
 713 
        cmp     eax, -1
707 
        pop     eax
 714 
        pop     eax
708 
        jnz     @f
 715 
        jnz     @f
709 
        mov     eax, [ecx+30h]  ; FileSize
 716 
        mov     eax, [ecx+30h]  ; FileSize
710 
        mov     edx, [ecx+34h]
 717 
        mov     edx, [ecx+34h]
711 
        mov     dword [ntfs_attr_size], eax
 718 
        mov     dword [ntfs_attr_size], eax
712 
        mov     dword [ntfs_attr_size+4], edx
 719 
        mov     dword [ntfs_attr_size+4], edx
713 
@@:
 720 
@@:
714 
        add     eax, 0x1FF
 721 
        add     eax, 0x1FF
715 
        adc     edx, 0
 722 
        adc     edx, 0
716 
        shrd    eax, edx, 9
 723 
        shrd    eax, edx, 9
717 
        sub     eax, [ntfs_cur_offs]
 724 
        sub     eax, [ntfs_cur_offs]
718 
        ja      @f
 725 
        ja      @f
719 
; return with nothing read
 726 
; return with nothing read
720 
        and     [ntfs_cur_size], 0
 727 
        and     [ntfs_cur_size], 0
721 
.okret:
 728 
.okret:
722 
        clc
 729 
        clc
723 
        ret
 730 
        ret
724 
@@:
 731 
@@:
725 
; reduce read length
 732 
; reduce read length
726 
        and     [ntfs_cur_tail], 0
 733 
        and     [ntfs_cur_tail], 0
727 
        cmp     [ntfs_cur_size], eax
 734 
        cmp     [ntfs_cur_size], eax
728 
        jb      @f
 735 
        jb      @f
729 
        mov     [ntfs_cur_size], eax
 736 
        mov     [ntfs_cur_size], eax
730 
        mov     eax, dword [ntfs_attr_size]
 737 
        mov     eax, dword [ntfs_attr_size]
731 
        and     eax, 0x1FF
 738 
        and     eax, 0x1FF
732 
        mov     [ntfs_cur_tail], eax
 739 
        mov     [ntfs_cur_tail], eax
733 
@@:
 740 
@@:
734 
        cmp     [ntfs_cur_size], 0
 741 
        cmp     [ntfs_cur_size], 0
735 
        jz      .okret
 742 
        jz      .okret
736 
        mov     eax, [ntfs_cur_offs]
 743 
        mov     eax, [ntfs_cur_offs]
737 
        xor     edx, edx
 744 
        xor     edx, edx
738 
        div     [ntfs_data.sectors_per_cluster]
 745 
        div     [ntfs_data.sectors_per_cluster]
739 
        sub     eax, [ecx+10h]  ; first_vbo
 746 
        sub     eax, [ecx+10h]  ; first_vbo
740 
        jb      .okret
 747 
        jb      .okret
741 
; eax = cluster, edx = starting sector
 748 
; eax = cluster, edx = starting sector
742 
        sub     esp, 10h
 749 
        sub     esp, 10h
743 
        movzx   esi, word [ecx+20h]     ; mcb_info_ofs
 750 
        movzx   esi, word [ecx+20h]     ; mcb_info_ofs
744 
        add     esi, ecx
 751 
        add     esi, ecx
745 
        xor     ebp, ebp
 752 
        xor     ebp, ebp
746 
.readloop:
 753 
.readloop:
747 
        call    ntfs_decode_mcb_entry
 754 
        call    ntfs_decode_mcb_entry
748 
        jnc     .break
 755 
        jnc     .break
749 
        add     ebp, [esp+8]
 756 
        add     ebp, [esp+8]
750 
        sub     eax, [esp]
 757 
        sub     eax, [esp]
751 
        jae     .readloop
 758 
        jae     .readloop
752 
        push    ecx
 759 
        push    ecx
753 
        push    eax
 760 
        push    eax
754 
        add     eax, [esp+8]
 761 
        add     eax, [esp+8]
755 
        add     eax, ebp
 762 
        add     eax, ebp
756 
        imul    eax, [ntfs_data.sectors_per_cluster]
 763 
        imul    eax, [ntfs_data.sectors_per_cluster]
757 
        add     eax, edx
 764 
        add     eax, edx
758 
        add     eax, [PARTITION_START]
 765 
        add     eax, [PARTITION_START]
759 
        pop     ecx
 766 
        pop     ecx
760 
        neg     ecx
 767 
        neg     ecx
761 
        imul    ecx, [ntfs_data.sectors_per_cluster]
 768 
        imul    ecx, [ntfs_data.sectors_per_cluster]
762 
        sub     ecx, edx
 769 
        sub     ecx, edx
763 
        cmp     ecx, [ntfs_cur_size]
 770 
        cmp     ecx, [ntfs_cur_size]
764 
        jb      @f
 771 
        jb      @f
765 
        mov     ecx, [ntfs_cur_size]
 772 
        mov     ecx, [ntfs_cur_size]
766 
@@:
 773 
@@:
767 
        mov     ebx, [ntfs_cur_buf]
 774 
        mov     ebx, [ntfs_cur_buf]
768 
@@:
 775 
@@:
769 
        call    hd_read
 776 
        call    hd_read
770 
        cmp     [hd_error], 0
 777 
        cmp     [hd_error], 0
771 
        jnz     .errread2
 778 
        jnz     .errread2
772 
        add     ebx, 0x200
 779 
        add     ebx, 0x200
773 
        mov     [ntfs_cur_buf], ebx
 780 
        mov     [ntfs_cur_buf], ebx
774 
        inc     eax
 781 
        inc     eax
775 
        add     [ntfs_cur_read], 0x200
 782 
        add     [ntfs_cur_read], 0x200
776 
        dec     [ntfs_cur_size]
 783 
        dec     [ntfs_cur_size]
777 
        inc     [ntfs_cur_offs]
 784 
        inc     [ntfs_cur_offs]
778 
        loop    @b
 785 
        loop    @b
779 
        pop     ecx
 786 
        pop     ecx
780 
        xor     eax, eax
 787 
        xor     eax, eax
781 
        xor     edx, edx
 788 
        xor     edx, edx
782 
        cmp     [ntfs_cur_size], 0
 789 
        cmp     [ntfs_cur_size], 0
783 
        jnz     .readloop
 790 
        jnz     .readloop
784 
        add     esp, 10h
 791 
        add     esp, 10h
785 
        mov     eax, [ntfs_cur_tail]
 792 
        mov     eax, [ntfs_cur_tail]
786 
        test    eax, eax
 793 
        test    eax, eax
787 
        jz      .okret
 794 
        jz      .okret
788 
        sub     eax, 0x200
 795 
        sub     eax, 0x200
789 
        add     [ntfs_cur_read], eax
 796 
        add     [ntfs_cur_read], eax
790 
        jmp     .okret
 797 
        jmp     .okret
791 
.errread2:
 798 
.errread2:
792 
        pop     ecx
 799 
        pop     ecx
793 
        add     esp, 10h
 800 
        add     esp, 10h
794 
        jmp     .errret
 801 
        jmp     .errret
795 
.break:
 802 
.break:
796 
        add     esp, 10h        ; CF=0
 803 
        add     esp, 10h        ; CF=0
797 
        mov     [ntfs_bCanContinue], 1
 804 
        mov     [ntfs_bCanContinue], 1
798 
        ret
 805 
        ret
799 
 
 806 
 
800 
ntfs_read_file_record:
 807 
ntfs_read_file_record:
801 
; in: eax=iRecord
 808 
; in: eax=iRecord
802 
; out: [ntfs_data.frs_buffer] contains information
 809 
; out: [ntfs_data.frs_buffer] contains information
803 
;      eax=0 - failed, eax=1 - success
 810 
;      eax=0 - failed, eax=1 - success
804 
; Read attr $DATA of $Mft, starting from eax*[ntfs_data.frs_size]
 811 
; Read attr $DATA of $Mft, starting from eax*[ntfs_data.frs_size]
805 
        push    ecx edx
 812 
        push    ecx edx
806 
        mov     ecx, [ntfs_data.frs_size]
 813 
        mov     ecx, [ntfs_data.frs_size]
807 
        mul     ecx
 814 
        mul     ecx
808 
        shrd    eax, edx, 9
 815 
        shrd    eax, edx, 9
809 
        shr     edx, 9
 816 
        shr     edx, 9
810 
        jnz     .err
 817 
        jnz     .err
811 
        push    [ntfs_attr_iRecord]
 818 
        push    [ntfs_attr_iRecord]
812 
        push    [ntfs_attr_iBaseRecord]
 819 
        push    [ntfs_attr_iBaseRecord]
813 
        push    [ntfs_attr_offs]
 820 
        push    [ntfs_attr_offs]
814 
        push    [ntfs_attr_list]
 821 
        push    [ntfs_attr_list]
815 
        push    dword [ntfs_attr_size+4]
 822 
        push    dword [ntfs_attr_size+4]
816 
        push    dword [ntfs_attr_size]
 823 
        push    dword [ntfs_attr_size]
817 
        push    [ntfs_cur_iRecord]
 824 
        push    [ntfs_cur_iRecord]
818 
        push    [ntfs_cur_attr]
 825 
        push    [ntfs_cur_attr]
819 
        push    [ntfs_cur_offs]
 826 
        push    [ntfs_cur_offs]
820 
        push    [ntfs_cur_size]
 827 
        push    [ntfs_cur_size]
821 
        push    [ntfs_cur_buf]
 828 
        push    [ntfs_cur_buf]
822 
        push    [ntfs_cur_read]
 829 
        push    [ntfs_cur_read]
823 
        mov     [ntfs_cur_attr], 0x80   ; $DATA
 830 
        mov     [ntfs_cur_attr], 0x80   ; $DATA
824 
        and     [ntfs_cur_iRecord], 0   ; $Mft
 831 
        and     [ntfs_cur_iRecord], 0   ; $Mft
825 
        mov     [ntfs_cur_offs], eax
 832 
        mov     [ntfs_cur_offs], eax
826 
        shr     ecx, 9
 833 
        shr     ecx, 9
827 
        mov     [ntfs_cur_size], ecx
 834 
        mov     [ntfs_cur_size], ecx
828 
        mov     eax, [ntfs_data.frs_buffer]
 835 
        mov     eax, [ntfs_data.frs_buffer]
829 
        mov     [ntfs_cur_buf], eax
 836 
        mov     [ntfs_cur_buf], eax
830 
        call    ntfs_read_attr
 837 
        call    ntfs_read_attr
831 
        mov     eax, [ntfs_cur_read]
 838 
        mov     eax, [ntfs_cur_read]
832 
        pop     [ntfs_cur_read]
 839 
        pop     [ntfs_cur_read]
833 
        pop     [ntfs_cur_buf]
 840 
        pop     [ntfs_cur_buf]
834 
        pop     [ntfs_cur_size]
 841 
        pop     [ntfs_cur_size]
835 
        pop     [ntfs_cur_offs]
 842 
        pop     [ntfs_cur_offs]
836 
        pop     [ntfs_cur_attr]
 843 
        pop     [ntfs_cur_attr]
837 
        pop     [ntfs_cur_iRecord]
 844 
        pop     [ntfs_cur_iRecord]
838 
        pop     dword [ntfs_attr_size]
 845 
        pop     dword [ntfs_attr_size]
839 
        pop     dword [ntfs_attr_size+4]
 846 
        pop     dword [ntfs_attr_size+4]
840 
        pop     [ntfs_attr_list]
 847 
        pop     [ntfs_attr_list]
841 
        pop     [ntfs_attr_offs]
 848 
        pop     [ntfs_attr_offs]
842 
        pop     [ntfs_attr_iBaseRecord]
 849 
        pop     [ntfs_attr_iBaseRecord]
843 
        pop     [ntfs_attr_iRecord]
 850 
        pop     [ntfs_attr_iRecord]
844 
        pop     edx ecx
 851 
        pop     edx ecx
845 
        jc      .errret
 852 
        jc      .errret
846 
        cmp     eax, [ntfs_data.frs_size]
 853 
        cmp     eax, [ntfs_data.frs_size]
847 
        jnz     .errret
 854 
        jnz     .errret
848 
        mov     eax, [ntfs_data.frs_buffer]
 855 
        mov     eax, [ntfs_data.frs_buffer]
849 
        cmp     dword [eax], 'FILE'
 856 
        cmp     dword [eax], 'FILE'
850 
        jnz     .errret
 857 
        jnz     .errret
851 
        push    ebx
 858 
        push    ebx
852 
        mov     ebx, eax
 859 
        mov     ebx, eax
853 
        call    ntfs_restore_usa_frs
 860 
        call    ntfs_restore_usa_frs
854 
        pop     ebx
 861 
        pop     ebx
855 
        setnc   al
 862 
        setnc   al
856 
        movzx   eax, al
 863 
        movzx   eax, al
857 
.ret:
 864 
.ret:
858 
        ret
 865 
        ret
859 
.err:
 866 
.err:
860 
        pop     edx ecx
 867 
        pop     edx ecx
861 
.errret:
 868 
.errret:
862 
        xor     eax, eax
 869 
        xor     eax, eax
863 
        ret
 870 
        ret
864 
 
 871 
 
865 
ntfs_restore_usa_frs:
 872 
ntfs_restore_usa_frs:
866 
        mov     eax, [ntfs_data.frs_size]
 873 
        mov     eax, [ntfs_data.frs_size]
867 
ntfs_restore_usa:
 874 
ntfs_restore_usa:
868 
        pushad
 875 
        pushad
869 
        shr     eax, 9
 876 
        shr     eax, 9
870 
        mov     ecx, eax
 877 
        mov     ecx, eax
871 
        inc     eax
 878 
        inc     eax
872 
        cmp     [ebx+6], ax
 879 
        cmp     [ebx+6], ax
873 
        jnz     .err
 880 
        jnz     .err
874 
        movzx   eax, word [ebx+4]
 881 
        movzx   eax, word [ebx+4]
875 
        lea     esi, [eax+ebx]
 882 
        lea     esi, [eax+ebx]
876 
        lodsw
 883 
        lodsw
877 
        mov     edx, eax
 884 
        mov     edx, eax
878 
        lea     edi, [ebx+0x1FE]
 885 
        lea     edi, [ebx+0x1FE]
879 
@@:
 886 
@@:
880 
        cmp     [edi], dx
 887 
        cmp     [edi], dx
881 
        jnz     .err
 888 
        jnz     .err
882 
        lodsw
 889 
        lodsw
883 
        stosw
 890 
        stosw
884 
        add     edi, 0x1FE
 891 
        add     edi, 0x1FE
885 
        loop    @b
 892 
        loop    @b
886 
        popad
 893 
        popad
887 
        clc
 894 
        clc
888 
        ret
 895 
        ret
889 
.err:
 896 
.err:
890 
        popad
 897 
        popad
891 
        stc
 898 
        stc
892 
        ret
 899 
        ret
893 
 
 900 
 
894 
ntfs_decode_mcb_entry:
 901 
ntfs_decode_mcb_entry:
895 
        push    eax ecx edi
 902 
        push    eax ecx edi
896 
        lea     edi, [esp+16]
 903 
        lea     edi, [esp+16]
897 
        xor     eax, eax
 904 
        xor     eax, eax
898 
        lodsb
 905 
        lodsb
899 
        test    al, al
 906 
        test    al, al
900 
        jz      .end
 907 
        jz      .end
901 
        mov     ecx, eax
 908 
        mov     ecx, eax
902 
        and     ecx, 0xF
 909 
        and     ecx, 0xF
903 
        cmp     ecx, 8
 910 
        cmp     ecx, 8
904 
        ja      .end
 911 
        ja      .end
905 
        push    ecx
 912 
        push    ecx
906 
        rep     movsb
 913 
        rep     movsb
907 
        pop     ecx
 914 
        pop     ecx
908 
        sub     ecx, 8
 915 
        sub     ecx, 8
909 
        neg     ecx
 916 
        neg     ecx
910 
        cmp     byte [esi-1], 80h
 917 
        cmp     byte [esi-1], 80h
911 
        jae     .end
 918 
        jae     .end
912 
        push    eax
 919 
        push    eax
913 
        xor     eax, eax
 920 
        xor     eax, eax
914 
        rep     stosb
 921 
        rep     stosb
915 
        pop     ecx
 922 
        pop     ecx
916 
        shr     ecx, 4
 923 
        shr     ecx, 4
917 
        cmp     ecx, 8
 924 
        cmp     ecx, 8
918 
        ja      .end
 925 
        ja      .end
919 
        push    ecx
 926 
        push    ecx
920 
        rep     movsb
 927 
        rep     movsb
921 
        pop     ecx
 928 
        pop     ecx
922 
        sub     ecx, 8
 929 
        sub     ecx, 8
923 
        neg     ecx
 930 
        neg     ecx
924 
        cmp     byte [esi-1], 80h
 931 
        cmp     byte [esi-1], 80h
925 
        cmc
 932 
        cmc
926 
        sbb     eax, eax
 933 
        sbb     eax, eax
927 
        rep     stosb
 934 
        rep     stosb
928 
        stc
 935 
        stc
929 
.end:
 936 
.end:
930 
        pop     edi ecx eax
 937 
        pop     edi ecx eax
931 
        ret
 938 
        ret
932 
 
 939 
 
933 
ntfs_find_lfn:
 940 
ntfs_find_lfn:
934 
; in: esi->name
 941 
; in: esi->name
935 
; out: CF=1 - file not found
 942 
; out: CF=1 - file not found
936 
;      else CF=0, [ntfs_cur_iRecord] valid, eax->record in parent directory
 943 
;      else CF=0, [ntfs_cur_iRecord] valid, eax->record in parent directory
937 
        mov     [ntfs_cur_iRecord], 5   ; start parse from root cluster
 944 
        mov     [ntfs_cur_iRecord], 5   ; start parse from root cluster
938 
.doit2:
 945 
.doit2:
939 
        mov     [ntfs_cur_attr], 0x90   ; $INDEX_ROOT
 946 
        mov     [ntfs_cur_attr], 0x90   ; $INDEX_ROOT
940 
        and     [ntfs_cur_offs], 0
 947 
        and     [ntfs_cur_offs], 0
941 
        mov     eax, [ntfs_data.cur_index_size]
 948 
        mov     eax, [ntfs_data.cur_index_size]
942 
        mov     [ntfs_cur_size], eax
 949 
        mov     [ntfs_cur_size], eax
943 
        mov     eax, [ntfs_data.cur_index_buf]
 950 
        mov     eax, [ntfs_data.cur_index_buf]
944 
        mov     [ntfs_cur_buf], eax
 951 
        mov     [ntfs_cur_buf], eax
945 
        call    ntfs_read_attr
 952 
        call    ntfs_read_attr
946 
        jnc     @f
 953 
        jnc     @f
947 
.ret:
 954 
.ret:
948 
        ret
 955 
        ret
949 
@@:
 956 
@@:
950 
        cmp     [ntfs_cur_read], 0x20
 957 
        cmp     [ntfs_cur_read], 0x20
951 
        jc      .ret
 958 
        jc      .ret
952 
        pushad
 959 
        pushad
953 
        mov     esi, [ntfs_data.cur_index_buf]
 960 
        mov     esi, [ntfs_data.cur_index_buf]
954 
        mov     eax, [esi+14h]
 961 
        mov     eax, [esi+14h]
955 
        add     eax, 10h
 962 
        add     eax, 10h
956 
        cmp     [ntfs_cur_read], eax
 963 
        cmp     [ntfs_cur_read], eax
957 
        jae     .readok1
 964 
        jae     .readok1
958 
        add     eax, 1FFh
 965 
        add     eax, 1FFh
959 
        shr     eax, 9
 966 
        shr     eax, 9
960 
        cmp     eax, [ntfs_data.cur_index_size]
 967 
        cmp     eax, [ntfs_data.cur_index_size]
961 
        ja      @f
 968 
        ja      @f
962 
.stc_ret:
 969 
.stc_ret:
963 
        popad
 970 
        popad
964 
        stc
 971 
        stc
965 
        ret
 972 
        ret
966 
@@:
 973 
@@:
967 
; reallocate
 974 
; reallocate
968 
        push    eax
 975 
        push    eax
969 
        push    [ntfs_data.cur_index_buf]
 976 
        push    [ntfs_data.cur_index_buf]
970 
        call    kernel_free
 977 
        call    kernel_free
971 
        pop     eax
 978 
        pop     eax
972 
        mov     [ntfs_data.cur_index_size], eax
 979 
        mov     [ntfs_data.cur_index_size], eax
973 
        push    eax
 980 
        push    eax
974 
        call    kernel_alloc
 981 
        call    kernel_alloc
975 
        test    eax, eax
 982 
        test    eax, eax
976 
        jnz     @f
 983 
        jnz     @f
977 
        and     [ntfs_data.cur_index_size], 0
 984 
        and     [ntfs_data.cur_index_size], 0
978 
        and     [ntfs_data.cur_index_buf], 0
 985 
        and     [ntfs_data.cur_index_buf], 0
979 
        jmp     .stc_ret
 986 
        jmp     .stc_ret
980 
@@:
 987 
@@:
981 
        mov     [ntfs_data.cur_index_buf], eax
 988 
        mov     [ntfs_data.cur_index_buf], eax
982 
        popad
 989 
        popad
983 
        jmp     .doit2
 990 
        jmp     .doit2
984 
.readok1:
 991 
.readok1:
985 
        mov     ebp, [esi+8]    ; subnode_size
 992 
        mov     ebp, [esi+8]    ; subnode_size
986 
        shr     ebp, 9
 993 
        shr     ebp, 9
987 
        cmp     ebp, [ntfs_data.cur_index_size]
 994 
        cmp     ebp, [ntfs_data.cur_index_size]
988 
        jbe     .ok2
 995 
        jbe     .ok2
989 
        push    esi ebp
 996 
        push    esi ebp
990 
        push    ebp
 997 
        push    ebp
991 
        call    kernel_alloc
 998 
        call    kernel_alloc
992 
        pop     ebp esi
 999 
        pop     ebp esi
993 
        test    eax, eax
 1000 
        test    eax, eax
994 
        jz      .stc_ret
 1001 
        jz      .stc_ret
995 
        mov     edi, eax
 1002 
        mov     edi, eax
996 
        mov     ecx, [ntfs_data.cur_index_size]
 1003 
        mov     ecx, [ntfs_data.cur_index_size]
997 
        shl     ecx, 9-2
 1004 
        shl     ecx, 9-2
998 
        rep     movsd
 1005 
        rep     movsd
999 
        mov     esi, eax
 1006 
        mov     esi, eax
1000 
        mov     [ntfs_data.cur_index_size], ebp
 1007 
        mov     [ntfs_data.cur_index_size], ebp
1001 
        push    esi ebp
 1008 
        push    esi ebp
1002 
        push    [ntfs_data.cur_index_buf]
 1009 
        push    [ntfs_data.cur_index_buf]
1003 
        call    kernel_free
 1010 
        call    kernel_free
1004 
        pop     ebp esi
 1011 
        pop     ebp esi
1005 
        mov     [ntfs_data.cur_index_buf], esi
 1012 
        mov     [ntfs_data.cur_index_buf], esi
1006 
.ok2:
 1013 
.ok2:
1007 
        add     esi, 10h
 1014 
        add     esi, 10h
1008 
        mov     edi, [esp+4]
 1015 
        mov     edi, [esp+4]
1009 
; edi -> name, esi -> current index data, ebp = subnode size
 1016 
; edi -> name, esi -> current index data, ebp = subnode size
1010 
.scanloop:
 1017 
.scanloop:
1011 
        add     esi, [esi]
 1018 
        add     esi, [esi]
1012 
.scanloopint:
 1019 
.scanloopint:
1013 
        test    byte [esi+0Ch], 2
 1020 
        test    byte [esi+0Ch], 2
1014 
        jnz     .subnode
 1021 
        jnz     .subnode
1015 
        push    esi
 1022 
        push    esi
1016 
        add     esi, 0x52
 1023 
        add     esi, 0x52
1017 
        movzx   ecx, byte [esi-2]
 1024 
        movzx   ecx, byte [esi-2]
1018 
        push    edi
 1025 
        push    edi
1019 
@@:
 1026 
@@:
1020 
        lodsw
 1027 
        lodsw
1021 
        call    uni2ansi_char
 1028 
        call    uni2ansi_char
1022 
        call    char_toupper
 1029 
        call    char_toupper
1023 
        push    eax
 1030 
        push    eax
1024 
        mov     al, [edi]
 1031 
        mov     al, [edi]
1025 
        inc     edi
 1032 
        inc     edi
1026 
        call    char_toupper
 1033 
        call    char_toupper
1027 
        cmp     al, [esp]
 1034 
        cmp     al, [esp]
1028 
        pop     eax
 1035 
        pop     eax
1029 
        loopz   @b
 1036 
        loopz   @b
1030 
        jz      .found
 1037 
        jz      .found
1031 
        pop     edi
 1038 
        pop     edi
1032 
        pop     esi
 1039 
        pop     esi
1033 
        jb      .subnode
 1040 
        jb      .subnode
1034 
.scanloopcont:
 1041 
.scanloopcont:
1035 
        movzx   eax, word [esi+8]
 1042 
        movzx   eax, word [esi+8]
1036 
        add     esi, eax
 1043 
        add     esi, eax
1037 
        jmp     .scanloopint
 1044 
        jmp     .scanloopint
1038 
.subnode:
 1045 
.subnode:
1039 
        test    byte [esi+0Ch], 1
 1046 
        test    byte [esi+0Ch], 1
1040 
        jz      .notfound
 1047 
        jz      .notfound
1041 
        movzx   eax, word [esi+8]
 1048 
        movzx   eax, word [esi+8]
1042 
        mov     eax, [esi+eax-8]
 1049 
        mov     eax, [esi+eax-8]
1043 
        mul     [ntfs_data.sectors_per_cluster]
 1050 
        mul     [ntfs_data.sectors_per_cluster]
1044 
        mov     [ntfs_cur_offs], eax
 1051 
        mov     [ntfs_cur_offs], eax
1045 
        mov     [ntfs_cur_attr], 0xA0   ; $INDEX_ALLOCATION
 1052 
        mov     [ntfs_cur_attr], 0xA0   ; $INDEX_ALLOCATION
1046 
        mov     [ntfs_cur_size], ebp
 1053 
        mov     [ntfs_cur_size], ebp
1047 
        mov     eax, [ntfs_data.cur_index_buf]
 1054 
        mov     eax, [ntfs_data.cur_index_buf]
1048 
        mov     esi, eax
 1055 
        mov     esi, eax
1049 
        mov     [ntfs_cur_buf], eax
 1056 
        mov     [ntfs_cur_buf], eax
1050 
        call    ntfs_read_attr
 1057 
        call    ntfs_read_attr
1051 
        mov     eax, ebp
 1058 
        mov     eax, ebp
1052 
        shl     eax, 9
 1059 
        shl     eax, 9
1053 
        cmp     [ntfs_cur_read], eax
 1060 
        cmp     [ntfs_cur_read], eax
1054 
        jnz     .notfound
 1061 
        jnz     .notfound
1055 
        cmp     dword [esi], 'INDX'
 1062 
        cmp     dword [esi], 'INDX'
1056 
        jnz     .notfound
 1063 
        jnz     .notfound
1057 
        mov     ebx, esi
 1064 
        mov     ebx, esi
1058 
        call    ntfs_restore_usa
 1065 
        call    ntfs_restore_usa
1059 
        jc      .notfound
 1066 
        jc      .notfound
1060 
        add     esi, 0x18
 1067 
        add     esi, 0x18
1061 
        jmp     .scanloop
 1068 
        jmp     .scanloop
1062 
.notfound:
 1069 
.notfound:
1063 
        popad
 1070 
        popad
1064 
        stc
 1071 
        stc
1065 
        ret
 1072 
        ret
1066 
.found:
 1073 
.found:
1067 
        cmp     byte [edi], 0
 1074 
        cmp     byte [edi], 0
1068 
        jz      .done
 1075 
        jz      .done
1069 
        cmp     byte [edi], '/'
 1076 
        cmp     byte [edi], '/'
1070 
        jz      .next
 1077 
        jz      .next
1071 
        pop     edi
 1078 
        pop     edi
1072 
        pop     esi
 1079 
        pop     esi
1073 
        jmp     .scanloopcont
 1080 
        jmp     .scanloopcont
1074 
.done:
 1081 
.done:
1075 
.next:
 1082 
.next:
1076 
        pop     esi
 1083 
        pop     esi
1077 
        pop     esi
 1084 
        pop     esi
1078 
        mov     eax, [esi]
 1085 
        mov     eax, [esi]
1079 
        mov     [ntfs_cur_iRecord], eax
 1086 
        mov     [ntfs_cur_iRecord], eax
1080 
        mov     [esp+1Ch], esi
 1087 
        mov     [esp+1Ch], esi
1081 
        mov     [esp+4], edi
 1088 
        mov     [esp+4], edi
1082 
        popad
 1089 
        popad
1083 
        inc     esi
 1090 
        inc     esi
1084 
        cmp     byte [esi-1], 0
 1091 
        cmp     byte [esi-1], 0
1085 
        jnz     .doit2
 1092 
        jnz     .doit2
1086 
        ret
 1093 
        ret
1087 
 
 1094 
 
1088 
;----------------------------------------------------------------
 1095 
;----------------------------------------------------------------
1089 
;
 1096 
;
1090 
;  ntfs_HdRead - read NTFS hard disk
 1097 
;  ntfs_HdRead - read NTFS hard disk
1091 
;
 1098 
;
1092 
;  esi  points to filename
 1099 
;  esi  points to filename
1093 
;  ebx  pointer to 64-bit number = first wanted byte, 0+
 1100 
;  ebx  pointer to 64-bit number = first wanted byte, 0+
1094 
;       may be ebx=0 - start from first byte
 1101 
;       may be ebx=0 - start from first byte
1095 
;  ecx  number of bytes to read, 0+
 1102 
;  ecx  number of bytes to read, 0+
1096 
;  edx  mem location to return data
 1103 
;  edx  mem location to return data
1097 
;
 1104 
;
1098 
;  ret ebx = bytes read or 0xffffffff file not found
 1105 
;  ret ebx = bytes read or 0xffffffff file not found
1099 
;      eax = 0 ok read or other = errormsg
 1106 
;      eax = 0 ok read or other = errormsg
1100 
;
 1107 
;
1101 
;--------------------------------------------------------------
 1108 
;--------------------------------------------------------------
1102 
ntfs_HdRead:
 1109 
ntfs_HdRead:
1103 
        cmp     byte [esi], 0
 1110 
        cmp     byte [esi], 0
1104 
        jnz     @f
 1111 
        jnz     @f
1105 
        or      ebx, -1
 1112 
        or      ebx, -1
1106 
        push    ERROR_ACCESS_DENIED
 1113 
        push    ERROR_ACCESS_DENIED
1107 
        pop     eax
 1114 
        pop     eax
1108 
        ret
 1115 
        ret
1109 
@@:
 1116 
@@:
1110 
        call    ntfs_find_lfn
 1117 
        call    ntfs_find_lfn
1111 
        jnc     .found
 1118 
        jnc     .found
1112 
        or      ebx, -1
 1119 
        or      ebx, -1
1113 
        push    ERROR_FILE_NOT_FOUND
 1120 
        push    ERROR_FILE_NOT_FOUND
1114 
        pop     eax
 1121 
        pop     eax
1115 
        ret
 1122 
        ret
1116 
.found:
 1123 
.found:
1117 
        mov     [ntfs_cur_attr], 0x80   ; $DATA
 1124 
        mov     [ntfs_cur_attr], 0x80   ; $DATA
1118 
        and     [ntfs_cur_offs], 0
 1125 
        and     [ntfs_cur_offs], 0
1119 
        and     [ntfs_cur_size], 0
 1126 
        and     [ntfs_cur_size], 0
1120 
        call    ntfs_read_attr
 1127 
        call    ntfs_read_attr
1121 
        jnc     @f
 1128 
        jnc     @f
1122 
        or      ebx, -1
 1129 
        or      ebx, -1
1123 
        push    ERROR_ACCESS_DENIED
 1130 
        push    ERROR_ACCESS_DENIED
1124 
        pop     eax
 1131 
        pop     eax
1125 
        ret
 1132 
        ret
1126 
@@:
 1133 
@@:
1127 
        pushad
 1134 
        pushad
1128 
        and     dword [esp+10h], 0
 1135 
        and     dword [esp+10h], 0
1129 
        xor     eax, eax
 1136 
        xor     eax, eax
1130 
        test    ebx, ebx
 1137 
        test    ebx, ebx
1131 
        jz      .zero1
 1138 
        jz      .zero1
1132 
        cmp     dword [ebx+4], 0x200
 1139 
        cmp     dword [ebx+4], 0x200
1133 
        jb      @f
 1140 
        jb      @f
1134 
.eof0:
 1141 
.eof0:
1135 
        popad
 1142 
        popad
1136 
        xor     ebx, ebx
 1143 
        xor     ebx, ebx
1137 
.eof:
 1144 
.eof:
1138 
        push    ERROR_END_OF_FILE
 1145 
        push    ERROR_END_OF_FILE
1139 
        pop     eax
 1146 
        pop     eax
1140 
        ret
 1147 
        ret
1141 
@@:
 1148 
@@:
1142 
        mov     eax, [ebx]
 1149 
        mov     eax, [ebx]
1143 
        test    eax, 0x1FF
 1150 
        test    eax, 0x1FF
1144 
        jz      .alignedstart
 1151 
        jz      .alignedstart
1145 
        push    edx
 1152 
        push    edx
1146 
        mov     edx, [ebx+4]
 1153 
        mov     edx, [ebx+4]
1147 
        shrd    eax, edx, 9
 1154 
        shrd    eax, edx, 9
1148 
        pop     edx
 1155 
        pop     edx
1149 
        mov     [ntfs_cur_offs], eax
 1156 
        mov     [ntfs_cur_offs], eax
1150 
        mov     [ntfs_cur_size], 1
 1157 
        mov     [ntfs_cur_size], 1
1151 
        mov     [ntfs_cur_buf], ntfs_bitmap_buf
 1158 
        mov     [ntfs_cur_buf], ntfs_bitmap_buf
1152 
        call    ntfs_read_attr.continue
 1159 
        call    ntfs_read_attr.continue
1153 
        mov     eax, [ebx]
 1160 
        mov     eax, [ebx]
1154 
        and     eax, 0x1FF
 1161 
        and     eax, 0x1FF
1155 
        lea     esi, [ntfs_bitmap_buf+eax]
 1162 
        lea     esi, [ntfs_bitmap_buf+eax]
1156 
        sub     eax, [ntfs_cur_read]
 1163 
        sub     eax, [ntfs_cur_read]
1157 
        jae     .eof0
 1164 
        jae     .eof0
1158 
        neg     eax
 1165 
        neg     eax
1159 
        push    ecx
 1166 
        push    ecx
1160 
        cmp     ecx, eax
 1167 
        cmp     ecx, eax
1161 
        jb      @f
 1168 
        jb      @f
1162 
        mov     ecx, eax
 1169 
        mov     ecx, eax
1163 
@@:
 1170 
@@:
1164 
        mov     [esp+10h+4], ecx
 1171 
        mov     [esp+10h+4], ecx
1165 
        mov     edi, edx
 1172 
        mov     edi, edx
1166 
        rep     movsb
 1173 
        rep     movsb
1167 
        mov     edx, edi
 1174 
        mov     edx, edi
1168 
        pop     ecx
 1175 
        pop     ecx
1169 
        sub     ecx, [esp+10h]
 1176 
        sub     ecx, [esp+10h]
1170 
        jnz     @f
 1177 
        jnz     @f
1171 
.retok:
 1178 
.retok:
1172 
        popad
 1179 
        popad
1173 
        xor     eax, eax
 1180 
        xor     eax, eax
1174 
        ret
 1181 
        ret
1175 
@@:
 1182 
@@:
1176 
        cmp     [ntfs_cur_read], 0x200
 1183 
        cmp     [ntfs_cur_read], 0x200
1177 
        jz      .alignedstart
 1184 
        jz      .alignedstart
1178 
.eof_ebx:
 1185 
.eof_ebx:
1179 
        popad
 1186 
        popad
1180 
        jmp     .eof
 1187 
        jmp     .eof
1181 
.alignedstart:
 1188 
.alignedstart:
1182 
        mov     eax, [ebx]
 1189 
        mov     eax, [ebx]
1183 
        push    edx
 1190 
        push    edx
1184 
        mov     edx, [ebx+4]
 1191 
        mov     edx, [ebx+4]
1185 
        add     eax, 511
 1192 
        add     eax, 511
1186 
        adc     edx, 0
 1193 
        adc     edx, 0
1187 
        shrd    eax, edx, 9
 1194 
        shrd    eax, edx, 9
1188 
        pop     edx
 1195 
        pop     edx
1189 
.zero1:
 1196 
.zero1:
1190 
        mov     [ntfs_cur_offs], eax
 1197 
        mov     [ntfs_cur_offs], eax
1191 
        mov     [ntfs_cur_buf], edx
 1198 
        mov     [ntfs_cur_buf], edx
1192 
        mov     eax, ecx
 1199 
        mov     eax, ecx
1193 
        shr     eax, 9
 1200 
        shr     eax, 9
1194 
        mov     [ntfs_cur_size], eax
 1201 
        mov     [ntfs_cur_size], eax
1195 
        add     eax, [ntfs_cur_offs]
 1202 
        add     eax, [ntfs_cur_offs]
1196 
        push    eax
 1203 
        push    eax
1197 
        call    ntfs_read_attr.continue
 1204 
        call    ntfs_read_attr.continue
1198 
        pop     [ntfs_cur_offs]
 1205 
        pop     [ntfs_cur_offs]
1199 
        mov     eax, [ntfs_cur_read]
 1206 
        mov     eax, [ntfs_cur_read]
1200 
        add     [esp+10h], eax
 1207 
        add     [esp+10h], eax
1201 
        mov     eax, ecx
 1208 
        mov     eax, ecx
1202 
        and     eax, not 0x1FF
 1209 
        and     eax, not 0x1FF
1203 
        cmp     [ntfs_cur_read], eax
 1210 
        cmp     [ntfs_cur_read], eax
1204 
        jnz     .eof_ebx
 1211 
        jnz     .eof_ebx
1205 
        and     ecx, 0x1FF
 1212 
        and     ecx, 0x1FF
1206 
        jz      .retok
 1213 
        jz      .retok
1207 
        add     edx, [ntfs_cur_read]
 1214 
        add     edx, [ntfs_cur_read]
1208 
        mov     [ntfs_cur_size], 1
 1215 
        mov     [ntfs_cur_size], 1
1209 
        mov     [ntfs_cur_buf], ntfs_bitmap_buf
 1216 
        mov     [ntfs_cur_buf], ntfs_bitmap_buf
1210 
        call    ntfs_read_attr.continue
 1217 
        call    ntfs_read_attr.continue
1211 
        cmp     [ntfs_cur_read], ecx
 1218 
        cmp     [ntfs_cur_read], ecx
1212 
        jb      @f
 1219 
        jb      @f
1213 
        mov     [ntfs_cur_read], ecx
 1220 
        mov     [ntfs_cur_read], ecx
1214 
@@:
 1221 
@@:
1215 
        xchg    ecx, [ntfs_cur_read]
 1222 
        xchg    ecx, [ntfs_cur_read]
1216 
        push    ecx
 1223 
        push    ecx
1217 
        mov     edi, edx
 1224 
        mov     edi, edx
1218 
        mov     esi, ntfs_bitmap_buf
 1225 
        mov     esi, ntfs_bitmap_buf
1219 
        add     [esp+10h+4], ecx
 1226 
        add     [esp+10h+4], ecx
1220 
        rep     movsb
 1227 
        rep     movsb
1221 
        pop     ecx
 1228 
        pop     ecx
1222 
        xor     eax, eax
 1229 
        xor     eax, eax
1223 
        cmp     ecx, [ntfs_cur_read]
 1230 
        cmp     ecx, [ntfs_cur_read]
1224 
        jz      @f
 1231 
        jz      @f
1225 
        mov     al, ERROR_END_OF_FILE
 1232 
        mov     al, ERROR_END_OF_FILE
1226 
@@:
 1233 
@@:
1227 
        mov     [esp+1Ch], eax
 1234 
        mov     [esp+1Ch], eax
1228 
        popad
 1235 
        popad
1229 
        ret
 1236 
        ret
1230 
 
 1237 
 
1231 
;----------------------------------------------------------------
 1238 
;----------------------------------------------------------------
1232 
;
 1239 
;
1233 
;  ntfs_HdReadFolder - read NTFS hard disk folder
 1240 
;  ntfs_HdReadFolder - read NTFS hard disk folder
1234 
;
 1241 
;
1235 
;  esi  points to filename
 1242 
;  esi  points to filename
1236 
;  ebx  pointer to structure 32-bit number = first wanted block, 0+
 1243 
;  ebx  pointer to structure 32-bit number = first wanted block, 0+
1237 
;                          & flags (bitfields)
 1244 
;                          & flags (bitfields)
1238 
; flags: bit 0: 0=ANSI names, 1=UNICODE names
 1245 
; flags: bit 0: 0=ANSI names, 1=UNICODE names
1239 
;  ecx  number of blocks to read, 0+
 1246 
;  ecx  number of blocks to read, 0+
1240 
;  edx  mem location to return data
 1247 
;  edx  mem location to return data
1241 
;
 1248 
;
1242 
;  ret ebx = blocks read or 0xffffffff folder not found
 1249 
;  ret ebx = blocks read or 0xffffffff folder not found
1243 
;      eax = 0 ok read or other = errormsg
 1250 
;      eax = 0 ok read or other = errormsg
1244 
;
 1251 
;
1245 
;--------------------------------------------------------------
 1252 
;--------------------------------------------------------------
1246 
ntfs_HdReadFolder:
 1253 
ntfs_HdReadFolder:
1247 
        mov     eax, 5          ; root cluster
 1254 
        mov     eax, 5          ; root cluster
1248 
        cmp     byte [esi], 0
 1255 
        cmp     byte [esi], 0
1249 
        jz      .doit
 1256 
        jz      .doit
1250 
        call    ntfs_find_lfn
 1257 
        call    ntfs_find_lfn
1251 
        jnc     .doit2
 1258 
        jnc     .doit2
1252 
.notfound:
 1259 
.notfound:
1253 
        or      ebx, -1
 1260 
        or      ebx, -1
1254 
        push    ERROR_FILE_NOT_FOUND
 1261 
        push    ERROR_FILE_NOT_FOUND
1255 
.pop_ret:
 1262 
.pop_ret:
1256 
        pop     eax
 1263 
        pop     eax
1257 
        ret
 1264 
        ret
1258 
.doit:
 1265 
.doit:
1259 
        mov     [ntfs_cur_iRecord], eax
 1266 
        mov     [ntfs_cur_iRecord], eax
1260 
.doit2:
 1267 
.doit2:
1261 
        mov     [ntfs_cur_attr], 0x10   ; $STANDARD_INFORMATION
 1268 
        mov     [ntfs_cur_attr], 0x10   ; $STANDARD_INFORMATION
1262 
        and     [ntfs_cur_offs], 0
 1269 
        and     [ntfs_cur_offs], 0
1263 
        mov     [ntfs_cur_size], 1
 1270 
        mov     [ntfs_cur_size], 1
1264 
        mov     [ntfs_cur_buf], ntfs_bitmap_buf
 1271 
        mov     [ntfs_cur_buf], ntfs_bitmap_buf
1265 
        call    ntfs_read_attr
 1272 
        call    ntfs_read_attr
1266 
        jc      .notfound
 1273 
        jc      .notfound
1267 
        mov     [ntfs_cur_attr], 0x90   ; $INDEX_ROOT
 1274 
        mov     [ntfs_cur_attr], 0x90   ; $INDEX_ROOT
1268 
        and     [ntfs_cur_offs], 0
 1275 
        and     [ntfs_cur_offs], 0
1269 
        mov     eax, [ntfs_data.cur_index_size]
 1276 
        mov     eax, [ntfs_data.cur_index_size]
1270 
        mov     [ntfs_cur_size], eax
 1277 
        mov     [ntfs_cur_size], eax
1271 
        mov     eax, [ntfs_data.cur_index_buf]
 1278 
        mov     eax, [ntfs_data.cur_index_buf]
1272 
        mov     [ntfs_cur_buf], eax
 1279 
        mov     [ntfs_cur_buf], eax
1273 
        call    ntfs_read_attr
 1280 
        call    ntfs_read_attr
1274 
        jnc     .ok
 1281 
        jnc     .ok
1275 
        cmp     [hd_error], 0
 1282 
        cmp     [hd_error], 0
1276 
        jz      .notfound
 1283 
        jz      .notfound
1277 
        or      ebx, -1
 1284 
        or      ebx, -1
1278 
        push    11
 1285 
        push    11
1279 
        jmp     .pop_ret
 1286 
        jmp     .pop_ret
1280 
.ok:
 1287 
.ok:
1281 
        cmp     [ntfs_cur_read], 0x20
 1288 
        cmp     [ntfs_cur_read], 0x20
1282 
        jae     @f
 1289 
        jae     @f
1283 
        or      ebx, -1
 1290 
        or      ebx, -1
1284 
.fserr:
 1291 
.fserr:
1285 
        push    ERROR_FAT_TABLE
 1292 
        push    ERROR_FAT_TABLE
1286 
        jmp     .pop_ret
 1293 
        jmp     .pop_ret
1287 
@@:
 1294 
@@:
1288 
        pushad
 1295 
        pushad
1289 
        mov     esi, [ntfs_data.cur_index_buf]
 1296 
        mov     esi, [ntfs_data.cur_index_buf]
1290 
        mov     eax, [esi+14h]
 1297 
        mov     eax, [esi+14h]
1291 
        add     eax, 10h
 1298 
        add     eax, 10h
1292 
        cmp     [ntfs_cur_read], eax
 1299 
        cmp     [ntfs_cur_read], eax
1293 
        jae     .readok1
 1300 
        jae     .readok1
1294 
        add     eax, 1FFh
 1301 
        add     eax, 1FFh
1295 
        shr     eax, 9
 1302 
        shr     eax, 9
1296 
        cmp     eax, [ntfs_data.cur_index_size]
 1303 
        cmp     eax, [ntfs_data.cur_index_size]
1297 
        ja      @f
 1304 
        ja      @f
1298 
        popad
 1305 
        popad
1299 
        jmp     .fserr
 1306 
        jmp     .fserr
1300 
@@:
 1307 
@@:
1301 
; reallocate
 1308 
; reallocate
1302 
        push    eax
 1309 
        push    eax
1303 
        push    [ntfs_data.cur_index_buf]
 1310 
        push    [ntfs_data.cur_index_buf]
1304 
        call    kernel_free
 1311 
        call    kernel_free
1305 
        pop     eax
 1312 
        pop     eax
1306 
        mov     [ntfs_data.cur_index_size], eax
 1313 
        mov     [ntfs_data.cur_index_size], eax
1307 
        push    eax
 1314 
        push    eax
1308 
        call    kernel_alloc
 1315 
        call    kernel_alloc
1309 
        test    eax, eax
 1316 
        test    eax, eax
1310 
        jnz     @f
 1317 
        jnz     @f
1311 
        and     [ntfs_data.cur_index_size], 0
 1318 
        and     [ntfs_data.cur_index_size], 0
1312 
        and     [ntfs_data.cur_index_buf], 0
 1319 
        and     [ntfs_data.cur_index_buf], 0
1313 
.nomem:
 1320 
.nomem:
1314 
        popad
 1321 
        popad
1315 
        or      ebx, -1
 1322 
        or      ebx, -1
1316 
        push    12
 1323 
        push    12
1317 
        pop     eax
 1324 
        pop     eax
1318 
        ret
 1325 
        ret
1319 
@@:
 1326 
@@:
1320 
        mov     [ntfs_data.cur_index_buf], eax
 1327 
        mov     [ntfs_data.cur_index_buf], eax
1321 
        popad
 1328 
        popad
1322 
        jmp     .doit2
 1329 
        jmp     .doit2
1323 
.readok1:
 1330 
.readok1:
1324 
        mov     ebp, [esi+8]    ; subnode_size
 1331 
        mov     ebp, [esi+8]    ; subnode_size
1325 
        shr     ebp, 9
 1332 
        shr     ebp, 9
1326 
        cmp     ebp, [ntfs_data.cur_index_size]
 1333 
        cmp     ebp, [ntfs_data.cur_index_size]
1327 
        jbe     .ok2
 1334 
        jbe     .ok2
1328 
        push    esi ebp
 1335 
        push    esi ebp
1329 
        push    ebp
 1336 
        push    ebp
1330 
        call    kernel_alloc
 1337 
        call    kernel_alloc
1331 
        pop     ebp esi
 1338 
        pop     ebp esi
1332 
        test    eax, eax
 1339 
        test    eax, eax
1333 
        jz      .nomem
 1340 
        jz      .nomem
1334 
        mov     edi, eax
 1341 
        mov     edi, eax
1335 
        mov     ecx, [ntfs_data.cur_index_size]
 1342 
        mov     ecx, [ntfs_data.cur_index_size]
1336 
        shl     ecx, 9-2
 1343 
        shl     ecx, 9-2
1337 
        rep     movsd
 1344 
        rep     movsd
1338 
        mov     esi, eax
 1345 
        mov     esi, eax
1339 
        mov     [ntfs_data.cur_index_size], ebp
 1346 
        mov     [ntfs_data.cur_index_size], ebp
1340 
        push    esi ebp
 1347 
        push    esi ebp
1341 
        push    [ntfs_data.cur_index_buf]
 1348 
        push    [ntfs_data.cur_index_buf]
1342 
        call    kernel_free
 1349 
        call    kernel_free
1343 
        pop     ebp esi
 1350 
        pop     ebp esi
1344 
        mov     [ntfs_data.cur_index_buf], esi
 1351 
        mov     [ntfs_data.cur_index_buf], esi
1345 
.ok2:
 1352 
.ok2:
1346 
        add     esi, 10h
 1353 
        add     esi, 10h
1347 
        mov     ebx, [esp+10h]
 1354 
        mov     ebx, [esp+10h]
1348 
        mov     edx, [esp+14h]
 1355 
        mov     edx, [esp+14h]
1349 
        push    dword [ebx+4]   ; read ANSI/UNICODE name
 1356 
        push    dword [ebx+4]   ; read ANSI/UNICODE name
1350 
        mov     ebx, [ebx]
 1357 
        mov     ebx, [ebx]
1351 
; init header
 1358 
; init header
1352 
        mov     edi, edx
 1359 
        mov     edi, edx
1353 
        mov     ecx, 32/4
 1360 
        mov     ecx, 32/4
1354 
        xor     eax, eax
 1361 
        xor     eax, eax
1355 
        rep     stosd
 1362 
        rep     stosd
1356 
        mov     byte [edx], 1   ; version
 1363 
        mov     byte [edx], 1   ; version
1357 
        mov     ecx, [esp+4+18h]
 1364 
        mov     ecx, [esp+4+18h]
1358 
        push    edx
 1365 
        push    edx
1359 
        mov     edx, esp
 1366 
        mov     edx, esp
1360 
; edi -> BDFE, esi -> current index data, ebp = subnode size, ebx = first wanted block,
 1367 
; edi -> BDFE, esi -> current index data, ebp = subnode size, ebx = first wanted block,
1361 
; ecx = number of blocks to read
 1368 
; ecx = number of blocks to read
1362 
; edx -> parameters block: dd , dd
1369 
; edx -> parameters block: dd , dd
1363 
        cmp     [ntfs_cur_iRecord], 5
 1370 
        cmp     [ntfs_cur_iRecord], 5
1364 
        jz      .skip_specials
 1371 
        jz      .skip_specials
1365 
; dot and dotdot entries
 1372 
; dot and dotdot entries
1366 
        push    esi
 1373 
        push    esi
1367 
        xor     esi, esi
 1374 
        xor     esi, esi
1368 
        call    .add_special_entry
 1375 
        call    .add_special_entry
1369 
        inc     esi
 1376 
        inc     esi
1370 
        call    .add_special_entry
 1377 
        call    .add_special_entry
1371 
        pop     esi
 1378 
        pop     esi
1372 
.skip_specials:
 1379 
.skip_specials:
1373 
; at first, dump index root
 1380 
; at first, dump index root
1374 
        add     esi, [esi]
 1381 
        add     esi, [esi]
1375 
.dump_root:
 1382 
.dump_root:
1376 
        test    byte [esi+0Ch], 2
 1383 
        test    byte [esi+0Ch], 2
1377 
        jnz     .dump_root_done
 1384 
        jnz     .dump_root_done
1378 
        call    .add_entry
 1385 
        call    .add_entry
1379 
        movzx   eax, word [esi+8]
 1386 
        movzx   eax, word [esi+8]
1380 
        add     esi, eax
 1387 
        add     esi, eax
1381 
        jmp     .dump_root
 1388 
        jmp     .dump_root
1382 
.dump_root_done:
 1389 
.dump_root_done:
1383 
; now dump all subnodes
 1390 
; now dump all subnodes
1384 
        push    ecx edi
 1391 
        push    ecx edi
1385 
        mov     edi, ntfs_bitmap_buf
 1392 
        mov     edi, ntfs_bitmap_buf
1386 
        mov     [ntfs_cur_buf], edi
 1393 
        mov     [ntfs_cur_buf], edi
1387 
        mov     ecx, 0x400/4
 1394 
        mov     ecx, 0x400/4
1388 
        xor     eax, eax
 1395 
        xor     eax, eax
1389 
        rep     stosd
 1396 
        rep     stosd
1390 
        mov     [ntfs_cur_attr], 0xB0   ; $BITMAP
 1397 
        mov     [ntfs_cur_attr], 0xB0   ; $BITMAP
1391 
        and     [ntfs_cur_offs], 0
 1398 
        and     [ntfs_cur_offs], 0
1392 
        mov     [ntfs_cur_size], 2
 1399 
        mov     [ntfs_cur_size], 2
1393 
        call    ntfs_read_attr
 1400 
        call    ntfs_read_attr
1394 
        pop     edi ecx
 1401 
        pop     edi ecx
1395 
        push    0       ; save offset in $BITMAP attribute
 1402 
        push    0       ; save offset in $BITMAP attribute
1396 
        and     [ntfs_cur_offs], 0
 1403 
        and     [ntfs_cur_offs], 0
1397 
.dumploop:
 1404 
.dumploop:
1398 
        mov     [ntfs_cur_attr], 0xA0
 1405 
        mov     [ntfs_cur_attr], 0xA0
1399 
        mov     [ntfs_cur_size], ebp
 1406 
        mov     [ntfs_cur_size], ebp
1400 
        mov     eax, [ntfs_data.cur_index_buf]
 1407 
        mov     eax, [ntfs_data.cur_index_buf]
1401 
        mov     esi, eax
 1408 
        mov     esi, eax
1402 
        mov     [ntfs_cur_buf], eax
 1409 
        mov     [ntfs_cur_buf], eax
1403 
        push    [ntfs_cur_offs]
 1410 
        push    [ntfs_cur_offs]
1404 
        mov     eax, [ntfs_cur_offs]
 1411 
        mov     eax, [ntfs_cur_offs]
1405 
        imul    eax, ebp
 1412 
        imul    eax, ebp
1406 
        mov     [ntfs_cur_offs], eax
 1413 
        mov     [ntfs_cur_offs], eax
1407 
        call    ntfs_read_attr
 1414 
        call    ntfs_read_attr
1408 
        pop     [ntfs_cur_offs]
 1415 
        pop     [ntfs_cur_offs]
1409 
        mov     eax, ebp
 1416 
        mov     eax, ebp
1410 
        shl     eax, 9
 1417 
        shl     eax, 9
1411 
        cmp     [ntfs_cur_read], eax
 1418 
        cmp     [ntfs_cur_read], eax
1412 
        jnz     .done
 1419 
        jnz     .done
1413 
        push    eax
 1420 
        push    eax
1414 
        mov     eax, [ntfs_cur_offs]
 1421 
        mov     eax, [ntfs_cur_offs]
1415 
        and     eax, 0x400*8-1
 1422 
        and     eax, 0x400*8-1
1416 
        bt      dword [ntfs_bitmap_buf], eax
 1423 
        bt      dword [ntfs_bitmap_buf], eax
1417 
        pop     eax
 1424 
        pop     eax
1418 
        jnc     .dump_subnode_done
 1425 
        jnc     .dump_subnode_done
1419 
        cmp     dword [esi], 'INDX'
 1426 
        cmp     dword [esi], 'INDX'
1420 
        jnz     .dump_subnode_done
 1427 
        jnz     .dump_subnode_done
1421 
        push    ebx
 1428 
        push    ebx
1422 
        mov     ebx, esi
 1429 
        mov     ebx, esi
1423 
        call    ntfs_restore_usa
 1430 
        call    ntfs_restore_usa
1424 
        pop     ebx
 1431 
        pop     ebx
1425 
        jc      .dump_subnode_done
 1432 
        jc      .dump_subnode_done
1426 
        add     esi, 0x18
 1433 
        add     esi, 0x18
1427 
        add     esi, [esi]
 1434 
        add     esi, [esi]
1428 
.dump_subnode:
 1435 
.dump_subnode:
1429 
        test    byte [esi+0Ch], 2
 1436 
        test    byte [esi+0Ch], 2
1430 
        jnz     .dump_subnode_done
 1437 
        jnz     .dump_subnode_done
1431 
        call    .add_entry
 1438 
        call    .add_entry
1432 
        movzx   eax, word [esi+8]
 1439 
        movzx   eax, word [esi+8]
1433 
        add     esi, eax
 1440 
        add     esi, eax
1434 
        jmp     .dump_subnode
 1441 
        jmp     .dump_subnode
1435 
.dump_subnode_done:
 1442 
.dump_subnode_done:
1436 
        inc     [ntfs_cur_offs]
 1443 
        inc     [ntfs_cur_offs]
1437 
        test    [ntfs_cur_offs], 0x400*8-1
 1444 
        test    [ntfs_cur_offs], 0x400*8-1
1438 
        jnz     .dumploop
 1445 
        jnz     .dumploop
1439 
        mov     [ntfs_cur_attr], 0xB0
 1446 
        mov     [ntfs_cur_attr], 0xB0
1440 
        push    ecx edi
 1447 
        push    ecx edi
1441 
        mov     edi, ntfs_bitmap_buf
 1448 
        mov     edi, ntfs_bitmap_buf
1442 
        mov     [ntfs_cur_buf], edi
 1449 
        mov     [ntfs_cur_buf], edi
1443 
        mov     ecx, 0x400/4
 1450 
        mov     ecx, 0x400/4
1444 
        xor     eax, eax
 1451 
        xor     eax, eax
1445 
        rep     stosd
 1452 
        rep     stosd
1446 
        pop     edi ecx
 1453 
        pop     edi ecx
1447 
        pop     eax
 1454 
        pop     eax
1448 
        push    [ntfs_cur_offs]
 1455 
        push    [ntfs_cur_offs]
1449 
        inc     eax
 1456 
        inc     eax
1450 
        mov     [ntfs_cur_offs], eax
 1457 
        mov     [ntfs_cur_offs], eax
1451 
        mov     [ntfs_cur_size], 2
 1458 
        mov     [ntfs_cur_size], 2
1452 
        push    eax
 1459 
        push    eax
1453 
        call    ntfs_read_attr
 1460 
        call    ntfs_read_attr
1454 
        pop     eax
 1461 
        pop     eax
1455 
        pop     [ntfs_cur_offs]
 1462 
        pop     [ntfs_cur_offs]
1456 
        push    eax
 1463 
        push    eax
1457 
        jmp     .dumploop
 1464 
        jmp     .dumploop
1458 
.done:
 1465 
.done:
1459 
        pop     eax
 1466 
        pop     eax
1460 
        pop     edx
 1467 
        pop     edx
1461 
        mov     ebx, [edx+4]
 1468 
        mov     ebx, [edx+4]
1462 
        pop     edx
 1469 
        pop     edx
1463 
        xor     eax, eax
 1470 
        xor     eax, eax
1464 
        dec     ecx
 1471 
        dec     ecx
1465 
        js      @f
 1472 
        js      @f
1466 
        mov     al, ERROR_END_OF_FILE
 1473 
        mov     al, ERROR_END_OF_FILE
1467 
@@:
 1474 
@@:
1468 
        mov     [esp+1Ch], eax
 1475 
        mov     [esp+1Ch], eax
1469 
        mov     [esp+10h], ebx
 1476 
        mov     [esp+10h], ebx
1470 
        popad
 1477 
        popad
1471 
        ret
 1478 
        ret
1472 
 
 1479 
 
1473 
.add_special_entry:
 1480 
.add_special_entry:
1474 
        mov     eax, [edx]
 1481 
        mov     eax, [edx]
1475 
        inc     dword [eax+8]   ; new file found
 1482 
        inc     dword [eax+8]   ; new file found
1476 
        dec     ebx
 1483 
        dec     ebx
1477 
        jns     .ret
 1484 
        jns     .ret
1478 
        dec     ecx
 1485 
        dec     ecx
1479 
        js      .ret
 1486 
        js      .ret
1480 
        inc     dword [eax+4]   ; new file block copied
 1487 
        inc     dword [eax+4]   ; new file block copied
1481 
        mov     eax, [edx+4]
 1488 
        mov     eax, [edx+4]
1482 
        mov     [edi+4], eax
 1489 
        mov     [edi+4], eax
1483 
;        mov     eax, dword [ntfs_bitmap_buf+0x20]
 1490 
;        mov     eax, dword [ntfs_bitmap_buf+0x20]
1484 
;        or      al, 0x10
 1491 
;        or      al, 0x10
1485 
        mov     eax, 0x10
 1492 
        mov     eax, 0x10
1486 
        stosd
 1493 
        stosd
1487 
        scasd
 1494 
        scasd
1488 
        push    edx
 1495 
        push    edx
1489 
        mov     eax, dword [ntfs_bitmap_buf]
 1496 
        mov     eax, dword [ntfs_bitmap_buf]
1490 
        mov     edx, dword [ntfs_bitmap_buf+4]
 1497 
        mov     edx, dword [ntfs_bitmap_buf+4]
1491 
        call    ntfs_datetime_to_bdfe
 1498 
        call    ntfs_datetime_to_bdfe
1492 
        mov     eax, dword [ntfs_bitmap_buf+0x18]
 1499 
        mov     eax, dword [ntfs_bitmap_buf+0x18]
1493 
        mov     edx, dword [ntfs_bitmap_buf+0x1C]
 1500 
        mov     edx, dword [ntfs_bitmap_buf+0x1C]
1494 
        call    ntfs_datetime_to_bdfe
 1501 
        call    ntfs_datetime_to_bdfe
1495 
        mov     eax, dword [ntfs_bitmap_buf+8]
 1502 
        mov     eax, dword [ntfs_bitmap_buf+8]
1496 
        mov     edx, dword [ntfs_bitmap_buf+0xC]
 1503 
        mov     edx, dword [ntfs_bitmap_buf+0xC]
1497 
        call    ntfs_datetime_to_bdfe
 1504 
        call    ntfs_datetime_to_bdfe
1498 
        pop     edx
 1505 
        pop     edx
1499 
        xor     eax, eax
 1506 
        xor     eax, eax
1500 
        stosd
 1507 
        stosd
1501 
        stosd
 1508 
        stosd
1502 
        mov     al, '.'
 1509 
        mov     al, '.'
1503 
        push    edi ecx
 1510 
        push    edi ecx
1504 
        lea     ecx, [esi+1]
 1511 
        lea     ecx, [esi+1]
1505 
        test    byte [edi-0x24], 1
 1512 
        test    byte [edi-0x24], 1
1506 
        jz      @f
 1513 
        jz      @f
1507 
        rep     stosw
 1514 
        rep     stosw
1508 
        pop     ecx
 1515 
        pop     ecx
1509 
        xor     eax, eax
 1516 
        xor     eax, eax
1510 
        stosw
 1517 
        stosw
1511 
        pop     edi
 1518 
        pop     edi
1512 
        add     edi, 520
 1519 
        add     edi, 520
1513 
        ret
 1520 
        ret
1514 
@@:
 1521 
@@:
1515 
        rep     stosb
 1522 
        rep     stosb
1516 
        pop     ecx
 1523 
        pop     ecx
1517 
        xor     eax, eax
 1524 
        xor     eax, eax
1518 
        stosb
 1525 
        stosb
1519 
        pop     edi
 1526 
        pop     edi
1520 
        add     edi, 264
 1527 
        add     edi, 264
1521 
.ret:
 1528 
.ret:
1522 
        ret
 1529 
        ret
1523 
 
 1530 
 
1524 
.add_entry:
 1531 
.add_entry:
1525 
; do not return DOS 8.3 names
 1532 
; do not return DOS 8.3 names
1526 
        cmp     byte [esi+0x51], 2
 1533 
        cmp     byte [esi+0x51], 2
1527 
        jz      .ret
 1534 
        jz      .ret
1528 
; do not return system files
 1535 
; do not return system files
1529 
; ... note that there will be no bad effects if system files also were reported ...
 1536 
; ... note that there will be no bad effects if system files also were reported ...
1530 
        cmp     dword [esi], 0x10
 1537 
        cmp     dword [esi], 0x10
1531 
        jb      .ret
 1538 
        jb      .ret
1532 
        mov     eax, [edx]
 1539 
        mov     eax, [edx]
1533 
        inc     dword [eax+8]   ; new file found
 1540 
        inc     dword [eax+8]   ; new file found
1534 
        dec     ebx
 1541 
        dec     ebx
1535 
        jns     .ret
 1542 
        jns     .ret
1536 
        dec     ecx
 1543 
        dec     ecx
1537 
        js      .ret
 1544 
        js      .ret
1538 
        inc     dword [eax+4]   ; new file block copied
 1545 
        inc     dword [eax+4]   ; new file block copied
1539 
        mov     eax, [edx+4]    ; flags
 1546 
        mov     eax, [edx+4]    ; flags
1540 
        call    ntfs_direntry_to_bdfe
 1547 
        call    ntfs_direntry_to_bdfe
1541 
        push    ecx esi edi
 1548 
        push    ecx esi edi
1542 
        movzx   ecx, byte [esi+0x50]
 1549 
        movzx   ecx, byte [esi+0x50]
1543 
        add     esi, 0x52
 1550 
        add     esi, 0x52
1544 
        test    byte [edi-0x24], 1
 1551 
        test    byte [edi-0x24], 1
1545 
        jz      .ansi
 1552 
        jz      .ansi
1546 
        shr     ecx, 1
 1553 
        shr     ecx, 1
1547 
        rep     movsd
 1554 
        rep     movsd
1548 
        adc     ecx, ecx
 1555 
        adc     ecx, ecx
1549 
        rep     movsw
 1556 
        rep     movsw
1550 
        and     word [edi], 0
 1557 
        and     word [edi], 0
1551 
        pop     edi
 1558 
        pop     edi
1552 
        add     edi, 520
 1559 
        add     edi, 520
1553 
        pop     esi ecx
 1560 
        pop     esi ecx
1554 
        ret
 1561 
        ret
1555 
.ansi:
 1562 
.ansi:
1556 
        jecxz   .skip
 1563 
        jecxz   .skip
1557 
@@:
 1564 
@@:
1558 
        lodsw
 1565 
        lodsw
1559 
        call    uni2ansi_char
 1566 
        call    uni2ansi_char
1560 
        stosb
 1567 
        stosb
1561 
        loop    @b
 1568 
        loop    @b
1562 
.skip:
 1569 
.skip:
1563 
        xor     al, al
 1570 
        xor     al, al
1564 
        stosb
 1571 
        stosb
1565 
        pop     edi
 1572 
        pop     edi
1566 
        add     edi, 264
 1573 
        add     edi, 264
1567 
        pop     esi ecx
 1574 
        pop     esi ecx
1568 
        ret
 1575 
        ret
1569 
 
 1576 
 
1570 
ntfs_direntry_to_bdfe:
 1577 
ntfs_direntry_to_bdfe:
1571 
        mov     [edi+4], eax    ; ANSI/UNICODE name
 1578 
        mov     [edi+4], eax    ; ANSI/UNICODE name
1572 
        mov     eax, [esi+48h]
 1579 
        mov     eax, [esi+48h]
1573 
        test    eax, 0x10000000
 1580 
        test    eax, 0x10000000
1574 
        jz      @f
 1581 
        jz      @f
1575 
        and     eax, not 0x10000000
 1582 
        and     eax, not 0x10000000
1576 
        or      al, 0x10
 1583 
        or      al, 0x10
1577 
@@:
 1584 
@@:
1578 
        stosd
 1585 
        stosd
1579 
        scasd
 1586 
        scasd
1580 
        push    edx
 1587 
        push    edx
1581 
        mov     eax, [esi+0x18]
 1588 
        mov     eax, [esi+0x18]
1582 
        mov     edx, [esi+0x1C]
 1589 
        mov     edx, [esi+0x1C]
1583 
        call    ntfs_datetime_to_bdfe
 1590 
        call    ntfs_datetime_to_bdfe
1584 
        mov     eax, [esi+0x30]
 1591 
        mov     eax, [esi+0x30]
1585 
        mov     edx, [esi+0x34]
 1592 
        mov     edx, [esi+0x34]
1586 
        call    ntfs_datetime_to_bdfe
 1593 
        call    ntfs_datetime_to_bdfe
1587 
        mov     eax, [esi+0x20]
 1594 
        mov     eax, [esi+0x20]
1588 
        mov     edx, [esi+0x24]
 1595 
        mov     edx, [esi+0x24]
1589 
        call    ntfs_datetime_to_bdfe
 1596 
        call    ntfs_datetime_to_bdfe
1590 
        pop     edx
 1597 
        pop     edx
1591 
        mov     eax, [esi+0x40]
 1598 
        mov     eax, [esi+0x40]
1592 
        stosd
 1599 
        stosd
1593 
        mov     eax, [esi+0x44]
 1600 
        mov     eax, [esi+0x44]
1594 
        stosd
 1601 
        stosd
1595 
        ret
 1602 
        ret
1596 
 
 1603 
 
1597 
iglobal
 1604 
iglobal
1598 
_24             dd      24
 1605 
_24             dd      24
1599 
_60             dd      60
 1606 
_60             dd      60
1600 
_10000000       dd      10000000
 1607 
_10000000       dd      10000000
1601 
days400year     dd      365*400+100-4+1
 1608 
days400year     dd      365*400+100-4+1
1602 
days100year     dd      365*100+25-1
 1609 
days100year     dd      365*100+25-1
1603 
days4year       dd      365*4+1
 1610 
days4year       dd      365*4+1
1604 
days1year       dd      365
 1611 
days1year       dd      365
1605 
months  dd      31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
 1612 
months  dd      31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
1606 
months2 dd      31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
 1613 
months2 dd      31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
1607 
_400            dd      400
 1614 
_400            dd      400
1608 
_100            dd      100
 1615 
_100            dd      100
1609 
endg
 1616 
endg
1610 
 
 1617 
 
1611 
ntfs_datetime_to_bdfe:
 1618 
ntfs_datetime_to_bdfe:
1612 
; edx:eax = number of 100-nanosecond intervals since January 1, 1601, in UTC
 1619 
; edx:eax = number of 100-nanosecond intervals since January 1, 1601, in UTC
1613 
        push    eax
 1620 
        push    eax
1614 
        mov     eax, edx
 1621 
        mov     eax, edx
1615 
        xor     edx, edx
 1622 
        xor     edx, edx
1616 
        div     [_10000000]
 1623 
        div     [_10000000]
1617 
        xchg    eax, [esp]
 1624 
        xchg    eax, [esp]
1618 
        div     [_10000000]
 1625 
        div     [_10000000]
1619 
        pop     edx
 1626 
        pop     edx
1620 
; edx:eax = number of seconds since January 1, 1601
 1627 
; edx:eax = number of seconds since January 1, 1601
1621 
        push    eax
 1628 
        push    eax
1622 
        mov     eax, edx
 1629 
        mov     eax, edx
1623 
        xor     edx, edx
 1630 
        xor     edx, edx
1624 
        div     [_60]
 1631 
        div     [_60]
1625 
        xchg    eax, [esp]
 1632 
        xchg    eax, [esp]
1626 
        div     [_60]
 1633 
        div     [_60]
1627 
        mov     [edi], dl
 1634 
        mov     [edi], dl
1628 
        pop     edx
 1635 
        pop     edx
1629 
; edx:eax = number of minutes
 1636 
; edx:eax = number of minutes
1630 
        div     [_60]
 1637 
        div     [_60]
1631 
        mov     [edi+1], dl
 1638 
        mov     [edi+1], dl
1632 
; eax = number of hours (note that 2^64/(10^7*60*60) < 2^32)
 1639 
; eax = number of hours (note that 2^64/(10^7*60*60) < 2^32)
1633 
        xor     edx, edx
 1640 
        xor     edx, edx
1634 
        div     [_24]
 1641 
        div     [_24]
1635 
        mov     [edi+2], dl
 1642 
        mov     [edi+2], dl
1636 
        mov     [edi+3], byte 0
 1643 
        mov     [edi+3], byte 0
1637 
; eax = number of days since January 1, 1601
 1644 
; eax = number of days since January 1, 1601
1638 
        xor     edx, edx
 1645 
        xor     edx, edx
1639 
        div     [days400year]
 1646 
        div     [days400year]
1640 
        imul    eax, 400
 1647 
        imul    eax, 400
1641 
        add     eax, 1601
 1648 
        add     eax, 1601
1642 
        mov     [edi+6], ax
 1649 
        mov     [edi+6], ax
1643 
        mov     eax, edx
 1650 
        mov     eax, edx
1644 
        xor     edx, edx
 1651 
        xor     edx, edx
1645 
        div     [days100year]
 1652 
        div     [days100year]
1646 
        cmp     al, 4
 1653 
        cmp     al, 4
1647 
        jnz     @f
 1654 
        jnz     @f
1648 
        dec     eax
 1655 
        dec     eax
1649 
        add     edx, [days100year]
 1656 
        add     edx, [days100year]
1650 
@@:
 1657 
@@:
1651 
        imul    eax, 100
 1658 
        imul    eax, 100
1652 
        add     [edi+6], ax
 1659 
        add     [edi+6], ax
1653 
        mov     eax, edx
 1660 
        mov     eax, edx
1654 
        xor     edx, edx
 1661 
        xor     edx, edx
1655 
        div     [days4year]
 1662 
        div     [days4year]
1656 
        shl     eax, 2
 1663 
        shl     eax, 2
1657 
        add     [edi+6], ax
 1664 
        add     [edi+6], ax
1658 
        mov     eax, edx
 1665 
        mov     eax, edx
1659 
        xor     edx, edx
 1666 
        xor     edx, edx
1660 
        div     [days1year]
 1667 
        div     [days1year]
1661 
        cmp     al, 4
 1668 
        cmp     al, 4
1662 
        jnz     @f
 1669 
        jnz     @f
1663 
        dec     eax
 1670 
        dec     eax
1664 
        add     edx, [days1year]
 1671 
        add     edx, [days1year]
1665 
@@:
 1672 
@@:
1666 
        add     [edi+6], ax
 1673 
        add     [edi+6], ax
1667 
        push    esi edx
 1674 
        push    esi edx
1668 
        mov     esi, months
 1675 
        mov     esi, months
1669 
        movzx   eax, word [edi+6]
 1676 
        movzx   eax, word [edi+6]
1670 
        test    al, 3
 1677 
        test    al, 3
1671 
        jnz     .noleap
 1678 
        jnz     .noleap
1672 
        xor     edx, edx
 1679 
        xor     edx, edx
1673 
        push    eax
 1680 
        push    eax
1674 
        div     [_400]
 1681 
        div     [_400]
1675 
        pop     eax
 1682 
        pop     eax
1676 
        test    edx, edx
 1683 
        test    edx, edx
1677 
        jz      .leap
 1684 
        jz      .leap
1678 
        xor     edx, edx
 1685 
        xor     edx, edx
1679 
        div     [_100]
 1686 
        div     [_100]
1680 
        test    edx, edx
 1687 
        test    edx, edx
1681 
        jz      .noleap
 1688 
        jz      .noleap
1682 
.leap:
 1689 
.leap:
1683 
        mov     esi, months2
 1690 
        mov     esi, months2
1684 
.noleap:
 1691 
.noleap:
1685 
        pop     edx
 1692 
        pop     edx
1686 
        xor     eax, eax
 1693 
        xor     eax, eax
1687 
        inc     eax
 1694 
        inc     eax
1688 
@@:
 1695 
@@:
1689 
        sub     edx, [esi]
 1696 
        sub     edx, [esi]
1690 
        jb      @f
 1697 
        jb      @f
1691 
        add     esi, 4
 1698 
        add     esi, 4
1692 
        inc     eax
 1699 
        inc     eax
1693 
        jmp     @b
 1700 
        jmp     @b
1694 
@@:
 1701 
@@:
1695 
        add     edx, [esi]
 1702 
        add     edx, [esi]
1696 
        pop     esi
 1703 
        pop     esi
1697 
        inc     edx
 1704 
        inc     edx
1698 
        mov     [edi+4], dl
 1705 
        mov     [edi+4], dl
1699 
        mov     [edi+5], al
 1706 
        mov     [edi+5], al
1700 
        add     edi, 8
 1707 
        add     edi, 8
1701 
        ret
 1708 
        ret
1702 
 
 1709 
 
1703 
;----------------------------------------------------------------
 1710 
;----------------------------------------------------------------
1704 
;
 1711 
;
1705 
;  ntfs_HdRewrite - write to NTFS hard disk
 1712 
;  ntfs_HdRewrite - write to NTFS hard disk
1706 
;
 1713 
;
1707 
;  esi  points to filename
 1714 
;  esi  points to filename
1708 
;  ebx  ignored (reserved)
 1715 
;  ebx  ignored (reserved)
1709 
;  ecx  number of bytes to write, 0+
 1716 
;  ecx  number of bytes to write, 0+
1710 
;  edx  mem location to data
 1717 
;  edx  mem location to data
1711 
;
 1718 
;
1712 
;  ret ebx = number of written bytes
 1719 
;  ret ebx = number of written bytes
1713 
;      eax = 0 ok read or other = errormsg
 1720 
;      eax = 0 ok read or other = errormsg
1714 
;
 1721 
;
1715 
;--------------------------------------------------------------
 1722 
;--------------------------------------------------------------
1716 
ntfs_HdRewrite:
 1723 
ntfs_HdRewrite:
1717 
        xor     ebx, ebx
 1724 
        xor     ebx, ebx
1718 
        mov     eax, ERROR_UNSUPPORTED_FS
 1725 
        mov     eax, ERROR_UNSUPPORTED_FS
1719 
        ret
 1726 
        ret
1720 
 
 1727 
 
1721 
;----------------------------------------------------------------
 1728 
;----------------------------------------------------------------
1722 
;
 1729 
;
1723 
;  ntfs_HdWrite - write to NTFS hard disk
 1730 
;  ntfs_HdWrite - write to NTFS hard disk
1724 
;
 1731 
;
1725 
;  esi  points to filename
 1732 
;  esi  points to filename
1726 
;  ebx  pointer to 64-bit number = first wanted byte, 0+
 1733 
;  ebx  pointer to 64-bit number = first wanted byte, 0+
1727 
;       may be ebx=0 - start from first byte
 1734 
;       may be ebx=0 - start from first byte
1728 
;  ecx  number of bytes to write, 0+
 1735 
;  ecx  number of bytes to write, 0+
1729 
;  edx  mem location to data
 1736 
;  edx  mem location to data
1730 
;
 1737 
;
1731 
;  ret ebx = bytes written (maybe 0)
 1738 
;  ret ebx = bytes written (maybe 0)
1732 
;      eax = 0 ok write or other = errormsg
 1739 
;      eax = 0 ok write or other = errormsg
1733 
;
 1740 
;
1734 
;--------------------------------------------------------------
 1741 
;--------------------------------------------------------------
1735 
ntfs_HdWrite:
 1742 
ntfs_HdWrite:
1736 
        xor     ebx, ebx
 1743 
        xor     ebx, ebx
1737 
        mov     eax, ERROR_UNSUPPORTED_FS
 1744 
        mov     eax, ERROR_UNSUPPORTED_FS
1738 
        ret
 1745 
        ret
1739 
 
 1746 
 
1740 
;----------------------------------------------------------------
 1747 
;----------------------------------------------------------------
1741 
;
 1748 
;
1742 
;  ntfs_HdSetFileEnd - set end of file on NTFS hard disk
 1749 
;  ntfs_HdSetFileEnd - set end of file on NTFS hard disk
1743 
;
 1750 
;
1744 
;  esi  points to filename
 1751 
;  esi  points to filename
1745 
;  ebx  points to 64-bit number = new file size
 1752 
;  ebx  points to 64-bit number = new file size
1746 
;  ecx  ignored (reserved)
 1753 
;  ecx  ignored (reserved)
1747 
;  edx  ignored (reserved)
 1754 
;  edx  ignored (reserved)
1748 
;
 1755 
;
1749 
;  ret eax = 0 ok or other = errormsg
 1756 
;  ret eax = 0 ok or other = errormsg
1750 
;
 1757 
;
1751 
;--------------------------------------------------------------
 1758 
;--------------------------------------------------------------
1752 
ntfs_HdSetFileEnd:
 1759 
ntfs_HdSetFileEnd:
1753 
ntfs_HdSetFileInfo:
 1760 
ntfs_HdSetFileInfo:
1754 
;----------------------------------------------------------------
 1761 
;----------------------------------------------------------------
1755 
;
 1762 
;
1756 
;  ntfs_HdDelete - delete file or empty folder from NTFS hard disk
 1763 
;  ntfs_HdDelete - delete file or empty folder from NTFS hard disk
1757 
;
 1764 
;
1758 
;  esi  points to filename
 1765 
;  esi  points to filename
1759 
;
 1766 
;
1760 
;  ret  eax = 0 ok or other = errormsg
 1767 
;  ret  eax = 0 ok or other = errormsg
1761 
;
 1768 
;
1762 
;--------------------------------------------------------------
 1769 
;--------------------------------------------------------------
1763 
ntfs_HdDelete:
 1770 
ntfs_HdDelete:
1764 
        mov     eax, ERROR_UNSUPPORTED_FS
 1771 
        mov     eax, ERROR_UNSUPPORTED_FS
1765 
        ret
 1772 
        ret
1766 
 
 1773 
 
1767 
ntfs_HdGetFileInfo:
 1774 
ntfs_HdGetFileInfo:
1768 
        cmp     byte [esi], 0
 1775 
        cmp     byte [esi], 0
1769 
        jnz     @f
 1776 
        jnz     @f
1770 
        push    2
 1777 
        push    2
1771 
        pop     eax
 1778 
        pop     eax
1772 
        ret
 1779 
        ret
1773 
@@:
 1780 
@@:
1774 
        call    ntfs_find_lfn
 1781 
        call    ntfs_find_lfn
1775 
        jnc     .doit
 1782 
        jnc     .doit
1776 
        push    ERROR_FILE_NOT_FOUND
 1783 
        push    ERROR_FILE_NOT_FOUND
1777 
        pop     eax
 1784 
        pop     eax
1778 
        cmp     [hd_error], 0
 1785 
        cmp     [hd_error], 0
1779 
        jz      @f
 1786 
        jz      @f
1780 
        mov     al, 11
 1787 
        mov     al, 11
1781 
@@:
 1788 
@@:
1782 
        ret
 1789 
        ret
1783 
.doit:
 1790 
.doit:
1784 
        push    esi edi
 1791 
        push    esi edi
1785 
        mov     esi, eax
 1792 
        mov     esi, eax
1786 
        mov     edi, edx
 1793 
        mov     edi, edx
1787 
        xor     eax, eax
 1794 
        xor     eax, eax
1788 
        call    ntfs_direntry_to_bdfe
 1795 
        call    ntfs_direntry_to_bdfe
1789 
        pop     edi esi
 1796 
        pop     edi esi
1790 
        xor     eax, eax
 1797 
        xor     eax, eax
1791 
        ret
 1798 
        ret