page06ntfileinfo.cpp
来自「This ZIP archive includes the sources (a」· C++ 代码 · 共 1,751 行 · 第 1/5 页
CPP
1,751 行
{_T("ObjectInformationLength"), TYPE_UINT32, sizeof(ULONG)},
{_T("ObjectInformation"), TYPE_UINT8, sizeof(CHAR)}, // TODO: TYPE_FTI_NAME
{NULL, TYPE_NONE, 0}
};
TStructMember FileIdBothDirectoryInformationMembers[] =
{
{_T("NextEntryOffset"), TYPE_UINT32, sizeof(ULONG)},
{_T("FileIndex"), TYPE_UINT32, sizeof(ULONG)},
{_T("CreationTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("LastAccessTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("LastWriteTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("ChangeTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("EndOfFile"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("AllocationSize"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("FileAttributes"), TYPE_UINT32, sizeof(ULONG)},
{_T("FileNameLength"), TYPE_UINT32, sizeof(ULONG)},
{_T("EaSize"), TYPE_UINT32, sizeof(ULONG)},
{_T("ShortNameLength"), TYPE_UINT8, sizeof(USHORT)}, // Although CCHAR, it has 2 bytes because of alignment
{_T("ShortName"), TYPE_FIBD_NAME1, sizeof(WCHAR[13])}, // One more WCHAR due to alignment
{_T("FileId"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("FileName"), TYPE_FIBD_NAME2, sizeof(WCHAR)},
{NULL}
};
TStructMember FileIdFullDirectoryInformationMembers[] =
{
{_T("NextEntryOffset"), TYPE_UINT32, sizeof(ULONG)},
{_T("FileIndex"), TYPE_UINT32, sizeof(ULONG)},
{_T("CreationTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("LastAccessTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("LastWriteTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("ChangeTime"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("EndOfFile"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("AllocationSize"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("FileAttributes"), TYPE_UINT32, sizeof(ULONG)},
{_T("FileNameLength"), TYPE_UINT32, sizeof(ULONG)},
{_T("EaSize"), TYPE_UINT32, sizeof(LARGE_INTEGER)}, // Size is larger due to alignment
{_T("FileId"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("FileName"), TYPE_FIFD_NAME, sizeof(WCHAR)},
{NULL}
};
TStructMember FileValidDataLengthInformationMembers[] =
{
{_T("ValidDataLength"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{NULL, TYPE_NONE, 0}
};
TStructMember FileLinkEntryMembers[] =
{
{_T("NextEntryOffset"), TYPE_UINT32, sizeof(LARGE_INTEGER)}, // alignment
{_T("ParentFileId"), TYPE_UINT64, sizeof(LARGE_INTEGER)},
{_T("FileNameLength"), TYPE_UINT32, sizeof(ULONG)},
{_T("FileName"), TYPE_LE_NAME, sizeof(WCHAR)},
{NULL, TYPE_NONE, 0}
};
TStructMember FileHardLinkInformationMembers[] =
{
{_T("BytesNeeded"), TYPE_UINT32, sizeof(ULONG)},
{_T("EntriesReturned"), TYPE_UINT32, sizeof(ULONG)}, // alignment
{_T("Entry"), TYPE_STRUCT, sizeof(FILE_LINK_ENTRY_INFORMATION), FileLinkEntryMembers},
{NULL, TYPE_NONE, 0}
};
TFileInfoData FileInfoData[] =
{
FILE_INFO_READONLY (FileDirectoryInformation, FILE_DIRECTORY_INFORMATION, TRUE),
FILE_INFO_READONLY (FileFullDirectoryInformation, FILE_FULL_DIR_INFORMATION, TRUE),
FILE_INFO_READONLY (FileBothDirectoryInformation, FILE_BOTH_DIR_INFORMATION, TRUE),
FILE_INFO_EDITABLE (FileBasicInformation, FILE_BASIC_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileStandardInformation, FILE_STANDARD_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileInternalInformation, FILE_INTERNAL_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileEaInformation, FILE_EA_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileAccessInformation, FILE_ACCESS_INFORMATION, FALSE),
FILE_INFO_READONLY (FileNameInformation, FILE_NAME_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileRenameInformation, FILE_RENAME_INFORMATION, FALSE),
FILE_INFO_UNSUPPORTED(FileLinkInformation, NULL, FALSE),
FILE_INFO_READONLY (FileNamesInformation, FILE_NAMES_INFORMATION, TRUE),
FILE_INFO_EDITABLE (FileDispositionInformation, FILE_DISPOSITION_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FilePositionInformation, FILE_POSITION_INFORMATION, FALSE),
FILE_INFO_READONLY (FileFullEaInformation, FILE_FULL_EA_INFORMATION, TRUE),
FILE_INFO_EDITABLE (FileModeInformation, FILE_MODE_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileAlignmentInformation, FILE_ALIGNMENT_INFORMATION, FALSE),
FILE_INFO_READONLY (FileAllInformation, FILE_ALL_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileAllocationInformation, FILE_ALLOCATION_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileEndOfFileInformation, FILE_END_OF_FILE_INFORMATION, FALSE),
FILE_INFO_READONLY (FileAlternateNameInformation, FILE_NAME_INFORMATION, FALSE),
FILE_INFO_READONLY (FileStreamInformation, FILE_STREAM_INFORMATION, TRUE),
FILE_INFO_EDITABLE (FilePipeInformation, FILE_PIPE_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FilePipeLocalInformation, FILE_PIPE_LOCAL_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FilePipeRemoteInformation, FILE_PIPE_REMOTE_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileMailslotQueryInformation, FILE_MAILSLOT_QUERY_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileMailslotSetInformation, FILE_MAILSLOT_SET_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileCompressionInformation, FILE_COMPRESSION_INFORMATION, FALSE),
FILE_INFO_READONLY (FileObjectIdInformation, FILE_OBJECTID_INFORMATION, FALSE),
FILE_INFO_READONLY (FileCompletionInformation, FILE_COMPLETION_INFORMATION, FALSE),
FILE_INFO_UNSUPPORTED(FileMoveClusterInformation, FILE_MOVE_CLUSTER_INFORMATION, FALSE),
FILE_INFO_READONLY (FileQuotaInformation, FILE_QUOTA_INFORMATION, TRUE),
FILE_INFO_READONLY (FileReparsePointInformation, FILE_REPARSE_POINT_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileNetworkOpenInformation, FILE_NETWORK_OPEN_INFORMATION, FALSE),
FILE_INFO_EDITABLE (FileAttributeTagInformation, FILE_ATTRIBUTE_TAG_INFORMATION, FALSE),
FILE_INFO_READONLY (FileTrackingInformation, FILE_TRACKING_INFORMATION, FALSE),
FILE_INFO_READONLY (FileIdBothDirectoryInformation, FILE_ID_BOTH_DIR_INFORMATION, TRUE),
FILE_INFO_READONLY (FileIdFullDirectoryInformation, FILE_ID_FULL_DIR_INFORMATION, TRUE),
FILE_INFO_EDITABLE (FileValidDataLengthInformation, FILE_VALID_DATA_LENGTH_INFORMATION, FALSE),
FILE_INFO_READONLY (FileShortNameInformation, FILE_NAME_INFORMATION, FALSE),
FILE_INFO_UNSUPPORTED(FileIoCompletionNotificationInformation, XXX, FALSE),
FILE_INFO_UNSUPPORTED(FileIoStatusBlockRangeInformation, XXX, FALSE),
FILE_INFO_UNSUPPORTED(FileIoPriorityHintInformation, XXX, FALSE),
FILE_INFO_UNSUPPORTED(FileSfioReserveInformation, XXX, FALSE),
FILE_INFO_UNSUPPORTED(FileSfioVolumeInformation, XXX, FALSE),
FILE_INFO_READONLY (FileHardLinkInformation, FILE_LINKS_INFORMATION, FALSE),
{FileMaximumInformation}
};
//-----------------------------------------------------------------------------
// Helper functions
// Converts the string to long. this function was written because
// the builtin strtol does not work correctly (try to convert 0xAABBCCDD !!!)
int StrToInt(LPTSTR ptr, LPTSTR * end, int root)
{
int nDigit;
int acc = 0;
// Skip the hexa prefix, if any
if(ptr[0] == _T('0') && tolower(ptr[1]) == _T('x'))
{
root = 16;
ptr += 2;
}
// Convert the number
while((nDigit = toupper(*ptr)) != 0)
{
// If the character is not an alphanumeric, break
if(!isalnum(nDigit))
break;
// Convert to digit
nDigit -= _T('0');
if(nDigit > 9)
nDigit -= (_T('A') - _T('9') - 1);
if(nDigit > root-1)
break;
// Move the value to the next rank and add the digit
acc *= root;
acc += nDigit;
ptr++;
}
*end = (TCHAR *)ptr;
return acc;
}
static LPTSTR VarStringToItemText(
LPTSTR szBuffer,
LPWSTR VarString,
ULONG LengthInBytes,
size_t nMaxChars,
BOOL bFullItem)
{
size_t nNameLength = LengthInBytes / sizeof(WCHAR);
// Calculate the maximum length of the file thatwe can copy to the buffer.
// If full item, we have to add two quotation marks (") there
if(bFullItem)
nMaxChars -= 2;
// If the maximum character count is lower than the name length,
// truncate it
if(nNameLength > nMaxChars)
nNameLength = nMaxChars;
// Include the preceding qiotas, if necessary
if(bFullItem)
*szBuffer++ = _T('\"');
// Copy the string itself
wcsncpy(szBuffer, VarString, nNameLength);
szBuffer+= nNameLength;
// Include the terminating quotation mark, if necessary
// and terminate the string with zero
if(bFullItem)
*szBuffer++ = _T('\"');
*szBuffer = 0;
return szBuffer;
}
static LPTSTR FullEaToItemText(
LPTSTR szBuffer,
PFILE_FULL_EA_INFORMATION FullEaInfo,
size_t nMaxChars,
BOOL bFullItem)
{
LPTSTR szEaAsText;
LPTSTR szTemp = szBuffer;
PCHAR pDataPtr = FullEaInfo->EaName;
size_t nEaTextLength;
UNREFERENCED_PARAMETER(bFullItem);
// Allocate buffer
szEaAsText = new TCHAR[FullEaInfo->EaNameLength + (FullEaInfo->EaValueLength * 3) + 0x10];
szTemp = szEaAsText;
// Convert EAs to ["Name"; "00 11 21 33"]
if(szBuffer != NULL)
{
// Store the EA name
*szTemp++ = _T('[');
*szTemp++ = _T('"');
if(FullEaInfo->EaNameLength > 0)
{
szTemp += MultiByteToWideChar(CP_ACP,
MB_PRECOMPOSED,
pDataPtr,
FullEaInfo->EaNameLength,
szTemp,
FullEaInfo->EaNameLength);
pDataPtr += FullEaInfo->EaNameLength + 1;
}
*szTemp++ = _T('"');
*szTemp++ = _T(';');
*szTemp++ = _T(' ');
// Store the EA value
*szTemp++ = _T('"');
for(USHORT Index = 0; Index < FullEaInfo->EaValueLength; Index++)
szTemp += _stprintf(szTemp, _T("%02lX "), *pDataPtr++);
*szTemp++ = _T('"');
*szTemp++ = _T(']');
*szTemp++ = 0;
// Get the number of chars that is safe to copy to the out buffer
nEaTextLength = (szTemp - szEaAsText);
if(nEaTextLength > nMaxChars)
nEaTextLength = nMaxChars;
// Copy the string to the target buffer
_tcsncpy(szBuffer, szEaAsText, nEaTextLength);
szBuffer[nEaTextLength - 1] = 0;
szBuffer += nEaTextLength;
// Free the work buffer
delete [] szEaAsText;
}
return szBuffer;
}
/*
static ULONG ItemTextToVarString(LPCTSTR szItemText, LPWSTR VarString)
{
size_t nNameLength = wcslen(szItemText);
// Setup the structure
wcsncpy(VarString, szItemText, nNameLength);
return nNameLength * sizeof(WCHAR);
}
*/
static int DataToItemText(TStructMember * pMember, LPTSTR szBuffer, size_t nMaxChars, BOOL bFullItem)
{
// Insert "[MemberName]: " prefix
if(bFullItem)
szBuffer += _stprintf(szBuffer, _T("%s: "), pMember->szMemberName);
// Now insert the member value
switch(pMember->nDataType)
{
case TYPE_BOOLEAN:
{
PBOOLEAN pbValue = (PBOOLEAN)pMember->pDataPtr;
_stprintf(szBuffer, _T("%s"), *pbValue ? _T("TRUE") : _T("FALSE"));
break;
}
case TYPE_UINT8:
{
PUCHAR pucValue = (PUCHAR)pMember->pDataPtr;
_stprintf(szBuffer, _T("0x%02lX"), *pucValue);
break;
}
case TYPE_UINT16:
{
PUSHORT pusValue = (PUSHORT)pMember->pDataPtr;
_stprintf(szBuffer, _T("0x%04lX"), *pusValue);
break;
}
case TYPE_UINT32:
{
PULONG pulValue = (PULONG)pMember->pDataPtr;
_stprintf(szBuffer, _T("0x%08lX"), *pulValue);
break;
}
case TYPE_UINT64:
{
PLARGE_INTEGER pliValue = (PLARGE_INTEGER)pMember->pDataPtr;
_stprintf(szBuffer, _T("%08lX-%08lX"), pliValue->HighPart, pliValue->LowPart);
break;
}
case TYPE_UCHAR16:
{
PUCHAR AnsiString16 = (PUCHAR)pMember->pDataPtr;
PWCHAR szTemp;
WCHAR szString16[16 * 3 + 4];
size_t nLength;
// Convert UCHAR16 to series of hexa values
szTemp = szString16;
*szTemp++ = _T('"');
for(int i = 0; i < 16; i++)
szTemp += _stprintf(szTemp, _T("%02lX "), *AnsiString16++);
*szTemp++ = _T('"');
*szTemp++ = 0;
// Limit the length
nLength = szTemp - szString16;
if(nLength > nMaxChars)
nLength = nMaxChars;
// Copy to the target buffer
_tcsncpy(szBuffer, szString16, nLength);
szBuffer[nLength - 1] = 0;
break;
}
case TYPE_HANDLE:
case TYPE_POINTER:
{
PHANDLE phHandle = (PHANDLE)pMember->pDataPtr;
⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?