Rev 265 | Rev 321 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
| Rev 265 | Rev 273 | ||
|---|---|---|---|
| Line 286... | Line 286... | ||
| 286 | ntfs_cur_read dd ? ; [output] |
286 | ntfs_cur_read dd ? ; [output] |
| 287 | ntfs_bCanContinue db ? |
287 | ntfs_bCanContinue db ? |
| 288 | rb 3 |
288 | rb 3 |
| Line 289... | Line 289... | ||
| 289 | 289 | ||
| - | 290 | ntfs_attrlist_buf rb 0x400 |
|
| 290 | ntfs_attrlist_buf rb 0x400 |
291 | ntfs_attrlist_mft_buf rb 0x400 |
| Line 291... | Line 292... | ||
| 291 | ntfs_bitmap_buf rb 0x400 |
292 | ntfs_bitmap_buf rb 0x400 |
| 292 | 293 | ||
| 293 | ntfs_attr_iRecord dd ? |
294 | ntfs_attr_iRecord dd ? |
| 294 | ntfs_attr_iBaseRecord dd ? |
295 | ntfs_attr_iBaseRecord dd ? |
| 295 | ntfs_attr_offs dd ? |
296 | ntfs_attr_offs dd ? |
| 296 | ntfs_attr_list dd ? |
297 | ntfs_attr_list dd ? |
| 297 | ntfs_attr_size dq ? |
298 | ntfs_attr_size dq ? |
| Line 298... | Line -... | ||
| 298 | ntfs_cur_tail dd ? |
- | |
| 299 | endg |
299 | ntfs_cur_tail dd ? |
| 300 | 300 | endg |
|
| 301 | 301 | ||
| 302 | ntfs_read_attr: |
302 | ntfs_read_attr: |
| 303 | ; in: global variables |
303 | ; in: global variables |
| Line 432... | Line 432... | ||
| 432 | cmp dword [eax], 0x20 ; $ATTR_LIST |
432 | cmp dword [eax], 0x20 ; $ATTR_LIST |
| 433 | jnz .scancont |
433 | jnz .scancont |
| 434 | mov [ntfs_attr_list], eax |
434 | mov [ntfs_attr_list], eax |
| 435 | jmp .scancont |
435 | jmp .scancont |
| 436 | .okattr: |
436 | .okattr: |
| - | 437 | ; ignore named $DATA attributes (aka NTFS streams) |
|
| - | 438 | cmp ecx, 0x80 |
|
| - | 439 | jnz @f |
|
| - | 440 | cmp byte [eax+9], 0 |
|
| - | 441 | jnz .scancont |
|
| - | 442 | @@: |
|
| 437 | mov [ntfs_attr_offs], eax |
443 | mov [ntfs_attr_offs], eax |
| 438 | .scancont: |
444 | .scancont: |
| 439 | add eax, [eax+4] |
445 | add eax, [eax+4] |
| 440 | jmp .scanattr |
446 | jmp .scanattr |
| 441 | .continue: |
447 | .continue: |
| Line 491... | Line 497... | ||
| 491 | push [ntfs_cur_buf] |
497 | push [ntfs_cur_buf] |
| 492 | push dword [ntfs_attr_size] |
498 | push dword [ntfs_attr_size] |
| 493 | push dword [ntfs_attr_size+4] |
499 | push dword [ntfs_attr_size+4] |
| 494 | or dword [ntfs_attr_size], -1 |
500 | or dword [ntfs_attr_size], -1 |
| 495 | or dword [ntfs_attr_size+4], -1 |
501 | or dword [ntfs_attr_size+4], -1 |
| 496 | xor edx, edx |
- | |
| 497 | mov [ntfs_cur_offs], edx |
502 | and [ntfs_cur_offs], 0 |
| 498 | mov [ntfs_cur_size], 2 |
503 | mov [ntfs_cur_size], 2 |
| 499 | and [ntfs_cur_read], 0 |
504 | and [ntfs_cur_read], 0 |
| 500 | mov [ntfs_cur_buf], ntfs_attrlist_buf |
505 | mov eax, ntfs_attrlist_buf |
| - | 506 | cmp [ntfs_cur_iRecord], 0 |
|
| - | 507 | jnz @f |
|
| - | 508 | mov eax, ntfs_attrlist_mft_buf |
|
| - | 509 | @@: |
|
| - | 510 | mov [ntfs_cur_buf], eax |
|
| 501 | push edx |
511 | push eax |
| 502 | call .doreadattr |
512 | call .doreadattr |
| 503 | pop edx |
513 | pop esi |
| - | 514 | mov edx, 1 |
|
| 504 | pop dword [ntfs_attr_size+4] |
515 | pop dword [ntfs_attr_size+4] |
| 505 | pop dword [ntfs_attr_size] |
516 | pop dword [ntfs_attr_size] |
| 506 | mov ebp, [ntfs_cur_read] |
517 | mov ebp, [ntfs_cur_read] |
| 507 | pop [ntfs_cur_buf] |
518 | pop [ntfs_cur_buf] |
| 508 | pop [ntfs_cur_read] |
519 | pop [ntfs_cur_read] |
| 509 | pop [ntfs_cur_size] |
520 | pop [ntfs_cur_size] |
| 510 | pop [ntfs_cur_offs] |
521 | pop [ntfs_cur_offs] |
| 511 | jc .errret |
522 | jc .errret |
| 512 | mov esi, ntfs_attrlist_buf |
- | |
| 513 | or edi, -1 |
523 | or edi, -1 |
| 514 | .scanliststart: |
- | |
| 515 | lea ebp, [ebp+esi-1Ah] |
524 | lea ebp, [ebp+esi-1Ah] |
| - | 525 | .scanliststart: |
|
| 516 | mov eax, [ntfs_cur_attr] |
526 | mov eax, [ntfs_cur_attr] |
| 517 | .scanlist: |
527 | .scanlist: |
| 518 | cmp esi, ebp |
528 | cmp esi, ebp |
| 519 | jae .scanlistdone |
529 | jae .scanlistdone |
| 520 | cmp eax, [esi] |
530 | cmp eax, [esi] |
| Line 522... | Line 532... | ||
| 522 | .scanlistcont: |
532 | .scanlistcont: |
| 523 | movzx ecx, word [esi+4] |
533 | movzx ecx, word [esi+4] |
| 524 | add esi, ecx |
534 | add esi, ecx |
| 525 | jmp .scanlist |
535 | jmp .scanlist |
| 526 | @@: |
536 | @@: |
| - | 537 | ; ignore named $DATA attributes (aka NTFS streams) |
|
| - | 538 | cmp eax, 0x80 |
|
| - | 539 | jnz @f |
|
| - | 540 | cmp byte [esi+6], 0 |
|
| - | 541 | jnz .scanlistcont |
|
| - | 542 | @@: |
|
| 527 | push eax |
543 | push eax |
| 528 | mov eax, [esi+8] |
544 | mov eax, [esi+8] |
| 529 | test eax, eax |
545 | test eax, eax |
| 530 | jnz .testf |
546 | jnz .testf |
| 531 | mov eax, dword [ntfs_attr_size] |
547 | mov eax, dword [ntfs_attr_size] |
| Line 548... | Line 564... | ||
| 548 | @@: |
564 | @@: |
| 549 | cmp dword [eax], -1 |
565 | cmp dword [eax], -1 |
| 550 | jz .errret_pop |
566 | jz .errret_pop |
| 551 | cmp dword [eax], ecx |
567 | cmp dword [eax], ecx |
| 552 | jz @f |
568 | jz @f |
| - | 569 | .l1: |
|
| 553 | add eax, [eax+4] |
570 | add eax, [eax+4] |
| 554 | jmp @b |
571 | jmp @b |
| 555 | @@: |
572 | @@: |
| - | 573 | cmp eax, 0x80 |
|
| - | 574 | jnz @f |
|
| - | 575 | cmp byte [eax+9], 0 |
|
| - | 576 | jnz .l1 |
|
| - | 577 | @@: |
|
| 556 | cmp byte [eax+8], 0 |
578 | cmp byte [eax+8], 0 |
| 557 | jnz .sdnores |
579 | jnz .sdnores |
| 558 | mov eax, [eax+10h] |
580 | mov eax, [eax+10h] |
| 559 | mov dword [ntfs_attr_size], eax |
581 | mov dword [ntfs_attr_size], eax |
| 560 | and dword [ntfs_attr_size+4], 0 |
582 | and dword [ntfs_attr_size+4], 0 |
| Line 588... | Line 610... | ||
| 588 | popad |
610 | popad |
| 589 | stc |
611 | stc |
| 590 | ret |
612 | ret |
| 591 | .scanlistdone: |
613 | .scanlistdone: |
| 592 | sub ebp, ntfs_attrlist_buf-1Ah |
614 | sub ebp, ntfs_attrlist_buf-1Ah |
| 593 | test ebp, 1FFh |
- | |
| 594 | jnz .scanlistfound |
615 | cmp [ntfs_cur_iRecord], 0 |
| 595 | test edx, edx |
- | |
| 596 | jnz @f |
616 | jnz @f |
| 597 | inc edx |
617 | sub ebp, ntfs_attrlist_mft_buf-ntfs_attrlist_buf |
| - | 618 | @@: |
|
| 598 | cmp ebp, 0x400 |
619 | cmp ebp, 0x400 |
| 599 | jnz .scanlistfound |
620 | jnz .scanlistfound |
| 600 | @@: |
- | |
| 601 | inc edx |
621 | inc edx |
| 602 | push esi edi |
622 | push esi edi |
| 603 | mov esi, ntfs_attrlist_buf+0x200 |
623 | mov esi, ntfs_attrlist_buf+0x200 |
| 604 | mov edi, ntfs_attrlist_buf |
624 | mov edi, ntfs_attrlist_buf |
| - | 625 | cmp [ntfs_cur_iRecord], 0 |
|
| - | 626 | jnz @f |
|
| - | 627 | mov esi, ntfs_attrlist_mft_buf+0x200 |
|
| - | 628 | mov edi, ntfs_attrlist_mft_buf |
|
| - | 629 | @@: |
|
| 605 | mov ecx, 0x200/4 |
630 | mov ecx, 0x200/4 |
| 606 | rep movsd |
631 | rep movsd |
| - | 632 | mov eax, edi |
|
| 607 | pop edi esi |
633 | pop edi esi |
| 608 | sub esi, 0x200 |
634 | sub esi, 0x200 |
| 609 | push [ntfs_cur_offs] |
635 | push [ntfs_cur_offs] |
| 610 | push [ntfs_cur_size] |
636 | push [ntfs_cur_size] |
| 611 | push [ntfs_cur_read] |
637 | push [ntfs_cur_read] |
| 612 | push [ntfs_cur_buf] |
638 | push [ntfs_cur_buf] |
| - | 639 | push dword [ntfs_attr_size] |
|
| - | 640 | push dword [ntfs_attr_size+4] |
|
| - | 641 | or dword [ntfs_attr_size], -1 |
|
| - | 642 | or dword [ntfs_attr_size+4], -1 |
|
| 613 | mov [ntfs_cur_offs], edx |
643 | mov [ntfs_cur_offs], edx |
| 614 | mov [ntfs_cur_size], 1 |
644 | mov [ntfs_cur_size], 1 |
| 615 | and [ntfs_cur_read], 0 |
645 | and [ntfs_cur_read], 0 |
| 616 | mov [ntfs_cur_buf], ntfs_attrlist_buf+0x200 |
646 | mov [ntfs_cur_buf], eax |
| - | 647 | mov ecx, [ntfs_attr_list] |
|
| 617 | push esi edx |
648 | push esi edx |
| 618 | call .doreadattr |
649 | call .doreadattr |
| 619 | pop edx esi |
650 | pop edx esi |
| 620 | mov ebp, [ntfs_cur_read] |
651 | mov ebp, [ntfs_cur_read] |
| - | 652 | pop dword [ntfs_attr_size+4] |
|
| - | 653 | pop dword [ntfs_attr_size] |
|
| 621 | pop [ntfs_cur_buf] |
654 | pop [ntfs_cur_buf] |
| 622 | pop [ntfs_cur_read] |
655 | pop [ntfs_cur_read] |
| 623 | pop [ntfs_cur_size] |
656 | pop [ntfs_cur_size] |
| 624 | pop [ntfs_cur_offs] |
657 | pop [ntfs_cur_offs] |
| 625 | jc .errret |
658 | jc .errret |
| - | 659 | add ebp, ntfs_attrlist_buf+0x200-0x1A |
|
| - | 660 | cmp [ntfs_cur_iRecord], 0 |
|
| - | 661 | jnz .scanliststart |
|
| - | 662 | add ebp, ntfs_attrlist_mft_buf-ntfs_attrlist_buf |
|
| 626 | jmp .scanliststart |
663 | jmp .scanliststart |
| Line 627... | Line 664... | ||
| 627 | 664 | ||
| 628 | .doreadattr: |
665 | .doreadattr: |
| 629 | mov [ntfs_bCanContinue], 0 |
666 | mov [ntfs_bCanContinue], 0 |