Add missing defines about INDEX_ROOT attributes and collation rules.
Implemented their support in NtfsDumpFileAttributes().

Sources: http://ftp.kolibrios.org/users/Asper/docs/NTFS/ntfsdoc.html#attribute_index_root and Linux kernel.

svn path=/trunk/; revision=64232
This commit is contained in:
Pierre Schweitzer 2014-09-22 19:59:45 +00:00
parent 8fc3f61465
commit d907725b5d
2 changed files with 35 additions and 1 deletions

View file

@ -161,6 +161,23 @@ NtfsDumpVolumeInformationAttribute(PATTRIBUTE Attribute)
}
static
VOID
NtfsDumpIndexRootAttribute(PATTRIBUTE Attribute)
{
PRESIDENT_ATTRIBUTE ResAttr;
PINDEX_ROOT_ATTRIBUTE IndexRootAttr;
ResAttr = (PRESIDENT_ATTRIBUTE)Attribute;
IndexRootAttr = (PINDEX_ROOT_ATTRIBUTE)((ULONG_PTR)ResAttr + ResAttr->ValueOffset);
if (IndexRootAttr->AttributeType == AttributeFileName)
ASSERT(IndexRootAttr->CollationRule == COLLATION_FILE_NAME);
DbgPrint(" $INDEX_ROOT (%uB, %u) ", IndexRootAttr->SizeOfEntry, IndexRootAttr->ClustersPerIndexRecord);
}
static
VOID
NtfsDumpAttribute (PATTRIBUTE Attribute)
@ -207,7 +224,7 @@ NtfsDumpAttribute (PATTRIBUTE Attribute)
break;
case AttributeIndexRoot:
DbgPrint(" $INDEX_ROOT ");
NtfsDumpIndexRootAttribute(Attribute);
break;
case AttributeIndexAllocation:

View file

@ -186,6 +186,14 @@ typedef enum
AttributeLoggedUtilityStream = 0x100
} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;
#define COLLATION_BINARY 0x00
#define COLLATION_FILE_NAME 0x01
#define COLLATION_UNICODE_STRING 0x02
#define COLLATION_NTOFS_ULONG 0x10
#define COLLATION_NTOFS_SID 0x11
#define COLLATION_NTOFS_SECURITY_HASH 0x12
#define COLLATION_NTOFS_ULONGS 0x13
typedef struct
{
@ -303,6 +311,15 @@ typedef struct
WCHAR Name[1];
} FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE;
typedef struct
{
ULONG AttributeType;
ULONG CollationRule;
ULONG SizeOfEntry;
UCHAR ClustersPerIndexRecord;
UCHAR Padding[3];
} INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE;
typedef struct
{
ULONGLONG Unknown1;