Implement GetStandardInformationFromRecord() which will return $STANDARD_INFORMATION attribute from a file record

svn path=/trunk/; revision=65591
This commit is contained in:
Pierre Schweitzer 2014-12-08 19:19:30 +00:00
parent 229c947271
commit a91d0a5297
2 changed files with 25 additions and 0 deletions

View file

@ -330,6 +330,28 @@ GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
return NULL;
}
PSTANDARD_INFORMATION
GetStandardInformationFromRecord(PFILE_RECORD_HEADER FileRecord)
{
PNTFS_ATTR_RECORD Attribute;
PSTANDARD_INFORMATION StdInfo;
Attribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->AttributeOffset);
while (Attribute < (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->BytesInUse) &&
Attribute->Type != AttributeEnd)
{
if (Attribute->Type == AttributeStandardInformation)
{
StdInfo = (PSTANDARD_INFORMATION)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
return StdInfo;
}
Attribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Attribute + Attribute->Length);
}
return NULL;
}
PFILENAME_ATTRIBUTE
GetBestFileNameFromRecord(PFILE_RECORD_HEADER FileRecord)
{

View file

@ -465,6 +465,9 @@ DecodeRun(PUCHAR DataRun,
VOID
NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord);
PSTANDARD_INFORMATION
GetStandardInformationFromRecord(PFILE_RECORD_HEADER FileRecord);
PFILENAME_ATTRIBUTE
GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord, UCHAR NameType);