📄 fatstruc.h
字号:
#define CCB_FLAG_QUERY_TEMPLATE_MIXED (0x1000)
//
// This flag indicates that reads and writes via this DASD handle
// are allowed to start or extend past the end of file.
//
#define CCB_FLAG_ALLOW_EXTENDED_DASD_IO (0x2000)
//
// This flag indicates we want to match volume labels in directory
// searches (important for the root dir defrag).
//
#define CCB_FLAG_MATCH_VOLUME_ID (0x4000)
//
// This flag indicates the ccb has been converted over into a
// close context for asynchronous/delayed closing of the handle.
//
#define CCB_FLAG_CLOSE_CONTEXT (0x8000)
//
// This flag indicates that when the handle is closed, we want
// a physical dismount to occur.
//
#define CCB_FLAG_COMPLETE_DISMOUNT (0x10000)
//
// This flag indicates the handle may not call priveleged
// FSCTL which modify the volume.
//
#define CCB_FLAG_MANAGE_VOLUME_ACCESS (0x20000)
typedef struct _CCB {
//
// Type and size of this record (must be FAT_NTC_CCB)
//
NODE_TYPE_CODE NodeTypeCode;
NODE_BYTE_SIZE NodeByteSize;
//
// Define a 24bit wide field for Flags, but a UCHAR for Wild Cards Present
// since it is used so often. Line these up on byte boundaries for grins.
//
ULONG Flags:24;
BOOLEAN ContainsWildCards;
//
// Overlay a close context on the data of the CCB. The remaining
// fields are not useful during close, and we would like to avoid
// paying extra pool for it.
//
union {
struct {
//
// Save the offset to start search from.
//
VBO OffsetToStartSearchFrom;
//
// The query template is used to filter directory query requests.
// It originally is set to null and on the first call the NtQueryDirectory
// it is set to the input filename or "*" if the name is not supplied.
// All subsquent queries then use this template.
//
// The Oem structure are unions because if the name is wild we store
// the arbitrary length string, while if the name is constant we store
// 8.3 representation for fast comparison.
//
union {
//
// If the template contains a wild card use this.
//
OEM_STRING Wild;
//
// If the name is constant, use this part.
//
FAT8DOT3 Constant;
} OemQueryTemplate;
UNICODE_STRING UnicodeQueryTemplate;
//
// The field is compared with the similar field in the Fcb to determine
// if the Ea's for a file have been modified.
//
ULONG EaModificationCount;
//
// The following field is used as an offset into the Eas for a
// particular file. This will be the offset for the next
// Ea to return. A value of 0xffffffff indicates that the
// Ea's are exhausted.
//
ULONG OffsetOfNextEaToReturn;
};
CLOSE_CONTEXT CloseContext;
};
} CCB;
typedef CCB *PCCB;
//
// The Irp Context record is allocated for every orginating Irp. It is
// created by the Fsd dispatch routines, and deallocated by the FatComplete
// request routine. It contains a structure called of type REPINNED_BCBS
// which is used to retain pinned bcbs needed to handle abnormal termination
// unwinding.
//
#define REPINNED_BCBS_ARRAY_SIZE (4)
typedef struct _REPINNED_BCBS {
//
// A pointer to the next structure contains additional repinned bcbs
//
struct _REPINNED_BCBS *Next;
//
// A fixed size array of pinned bcbs. Whenever a new bcb is added to
// the repinned bcb structure it is added to this array. If the
// array is already full then another repinned bcb structure is allocated
// and pointed to with Next.
//
PBCB Bcb[ REPINNED_BCBS_ARRAY_SIZE ];
} REPINNED_BCBS;
typedef REPINNED_BCBS *PREPINNED_BCBS;
typedef struct _IRP_CONTEXT {
//
// Type and size of this record (must be FAT_NTC_IRP_CONTEXT)
//
NODE_TYPE_CODE NodeTypeCode;
NODE_BYTE_SIZE NodeByteSize;
//
// This structure is used for posting to the Ex worker threads.
//
WORK_QUEUE_ITEM WorkQueueItem;
//
// A pointer to the originating Irp.
//
PIRP OriginatingIrp;
//
// Originating Device (required for workque algorithms)
//
PDEVICE_OBJECT RealDevice;
//
// Originating Vcb (required for exception handling)
// On mounts, this will be set before any exceptions
// indicating corruption can be thrown.
//
PVCB Vcb;
//
// Major and minor function codes copied from the Irp
//
UCHAR MajorFunction;
UCHAR MinorFunction;
//
// The following fields indicate if we can wait/block for a resource
// or I/O, if we are to do everything write through, and if this
// entry into the Fsd is a recursive call.
//
UCHAR PinCount;
ULONG Flags;
//
// The following field contains the NTSTATUS value used when we are
// unwinding due to an exception
//
NTSTATUS ExceptionStatus;
//
// The following context block is used for non-cached Io
//
struct _FAT_IO_CONTEXT *FatIoContext;
//
// For a abnormal termination unwinding this field contains the Bcbs
// that are kept pinned until the Irp is completed.
//
REPINNED_BCBS Repinned;
} IRP_CONTEXT;
typedef IRP_CONTEXT *PIRP_CONTEXT;
#define IRP_CONTEXT_FLAG_DISABLE_DIRTY (0x00000001)
#define IRP_CONTEXT_FLAG_WAIT (0x00000002)
#define IRP_CONTEXT_FLAG_WRITE_THROUGH (0x00000004)
#define IRP_CONTEXT_FLAG_DISABLE_WRITE_THROUGH (0x00000008)
#define IRP_CONTEXT_FLAG_RECURSIVE_CALL (0x00000010)
#define IRP_CONTEXT_FLAG_DISABLE_POPUPS (0x00000020)
#define IRP_CONTEXT_FLAG_DEFERRED_WRITE (0x00000040)
#define IRP_CONTEXT_FLAG_VERIFY_READ (0x00000080)
#define IRP_CONTEXT_STACK_IO_CONTEXT (0x00000100)
#define IRP_CONTEXT_FLAG_IN_FSP (0x00000200)
#define IRP_CONTEXT_FLAG_USER_IO (0x00000400) // for performance counters
#define IRP_CONTEXT_FLAG_DISABLE_RAISE (0x00000800)
#define IRP_CONTEXT_FLAG_PARENT_BY_CHILD (0x80000000)
//
// Context structure for non-cached I/O calls. Most of these fields
// are actually only required for the Read/Write Multiple routines, but
// the caller must allocate one as a local variable anyway before knowing
// whether there are multiple requests are not. Therefore, a single
// structure is used for simplicity.
//
typedef struct _FAT_IO_CONTEXT {
//
// These two field are used for multiple run Io
//
LONG IrpCount;
PIRP MasterIrp;
//
// MDL to describe partial sector zeroing
//
PMDL ZeroMdl;
union {
//
// This element handles the asychronous non-cached Io
//
struct {
PERESOURCE Resource;
PERESOURCE Resource2;
ERESOURCE_THREAD ResourceThreadId;
ULONG RequestedByteCount;
PFILE_OBJECT FileObject;
PNON_PAGED_FCB NonPagedFcb;
} Async;
//
// and this element the sycnrhonous non-cached Io
//
KEVENT SyncEvent;
} Wait;
} FAT_IO_CONTEXT;
typedef FAT_IO_CONTEXT *PFAT_IO_CONTEXT;
//
// An array of these structures is passed to FatMultipleAsync describing
// a set of runs to execute in parallel.
//
typedef struct _IO_RUNS {
LBO Lbo;
VBO Vbo;
ULONG Offset;
ULONG ByteCount;
PIRP SavedIrp;
} IO_RUN;
typedef IO_RUN *PIO_RUN;
//
// This structure is used by FatDeleteDirent to preserve the first cluster
// and file size info for undelete utilities.
//
typedef struct _DELETE_CONTEXT {
ULONG FileSize;
ULONG FirstClusterOfFile;
} DELETE_CONTEXT;
typedef DELETE_CONTEXT *PDELETE_CONTEXT;
//
// This record is used with to set a flush to go off one second after the
// first write on slow devices with a physical indication of activity, like
// a floppy. This is an attempt to keep the red light on.
//
typedef struct _DEFERRED_FLUSH_CONTEXT {
KDPC Dpc;
KTIMER Timer;
WORK_QUEUE_ITEM Item;
PFILE_OBJECT File;
} DEFERRED_FLUSH_CONTEXT;
typedef DEFERRED_FLUSH_CONTEXT *PDEFERRED_FLUSH_CONTEXT;
//
// This structure is used for the FatMarkVolumeClean callbacks.
//
typedef struct _CLEAN_AND_DIRTY_VOLUME_PACKET {
WORK_QUEUE_ITEM Item;
PIRP Irp;
PVCB Vcb;
PKEVENT Event;
} CLEAN_AND_DIRTY_VOLUME_PACKET, *PCLEAN_AND_DIRTY_VOLUME_PACKET;
//
// This structure is used when a page fault is running out of stack.
//
typedef struct _PAGING_FILE_OVERFLOW_PACKET {
PIRP Irp;
PFCB Fcb;
} PAGING_FILE_OVERFLOW_PACKET, *PPAGING_FILE_OVERFLOW_PACKET;
//
// This structure is used to access the EaFile.
//
#define EA_BCB_ARRAY_SIZE 8
typedef struct _EA_RANGE {
PCHAR Data;
ULONG StartingVbo;
ULONG Length;
USHORT BcbChainLength;
BOOLEAN AuxilaryBuffer;
PBCB *BcbChain;
PBCB BcbArray[EA_BCB_ARRAY_SIZE];
} EA_RANGE, *PEA_RANGE;
#define EA_RANGE_HEADER_SIZE (FIELD_OFFSET( EA_RANGE, BcbArray ))
//
// These symbols are used by the upcase/downcase routines.
//
#define WIDE_LATIN_CAPITAL_A (0xff21)
#define WIDE_LATIN_CAPITAL_Z (0xff3a)
#define WIDE_LATIN_SMALL_A (0xff41)
#define WIDE_LATIN_SMALL_Z (0xff5a)
//
// These values are returned by FatInterpretClusterType.
//
typedef enum _CLUSTER_TYPE {
FatClusterAvailable,
FatClusterReserved,
FatClusterBad,
FatClusterLast,
FatClusterNext
} CLUSTER_TYPE;
#endif // _FATSTRUC_
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -