📄 logfile.h
字号:
/* 22*/ le16 client_array_offset;/* Offset from the start of this record to the first log client record if versions are matched. When creating, set this to be after this restart area structure, aligned to 8-bytes boundary. If the versions do not match, this is ignored and the offset is assumed to be (sizeof(RESTART_AREA) + 7) & ~7, i.e. rounded up to first 8-byte boundary. Either way, client_array_offset has to be aligned to an 8-byte boundary. Also, restart_area_offset + client_array_offset has to be <= 510. Finally, client_array_offset + (log_clients * sizeof(log client record)) has to be <= system_page_size. On Win2k and presumably earlier, this is 0x30, i.e. immediately following this record. On WinXP and presumably later, this is 0x40, i.e. there are 16 extra bytes between this record and the client array. This probably means that the RESTART_AREA record is actually bigger in WinXP and later. *//* 24*/ sle64 file_size; /* Usable byte size of the log file. If the restart_area_offset + the offset of the file_size are > 510 then corruption has occurred. This is the very first check when starting with the restart_area as if it fails it means that some of the above values will be corrupted by the multi sector transfer protection. The file_size has to be rounded down to be a multiple of the log_page_size in the RESTART_PAGE_HEADER and then it has to be at least big enough to store the two restart pages and 48 (0x30) log record pages. *//* 32*/ le32 last_lsn_data_length;/* Length of data of last LSN, not including the log record header. On create set to 0. *//* 36*/ le16 log_record_header_length;/* Byte size of the log record header. If the version matches then check that the value of log_record_header_length is a multiple of 8, i.e. (log_record_header_length + 7) & ~7 == log_record_header_length. When creating set it to sizeof(LOG_RECORD_HEADER), aligned to 8 bytes. *//* 38*/ le16 log_page_data_offset;/* Offset to the start of data in a log record page. Must be a multiple of 8. On create set it to immediately after the update sequence array of the log record page. *//* 40*/ le32 restart_log_open_count;/* A counter that gets incremented every time the logfile is restarted which happens at mount time when the logfile is opened. When creating set to a random value. Win2k sets it to the low 32 bits of the current system time in NTFS format (see time.h). *//* 44*/ le32 reserved; /* Reserved/alignment to 8-byte boundary. *//* sizeof() = 48 (0x30) bytes */} __attribute__((__packed__)) RESTART_AREA;/** * struct LOG_CLIENT_RECORD - Log client record. * * The offset of this record is found by adding the offset of the * RESTART_AREA to the client_array_offset value found in it. */typedef struct {/*Ofs*//* 0*/ leLSN oldest_lsn; /* Oldest LSN needed by this client. On create set to 0. *//* 8*/ leLSN client_restart_lsn;/* LSN at which this client needs to restart the volume, i.e. the current position within the log file. At present, if clean this should = current_lsn in restart area but it probably also = current_lsn when dirty most of the time. At create set to 0. *//* 16*/ le16 prev_client; /* The offset to the previous log client record in the array of log client records. LOGFILE_NO_CLIENT means there is no previous client record, i.e. this is the first one. This is always LOGFILE_NO_CLIENT. *//* 18*/ le16 next_client; /* The offset to the next log client record in the array of log client records. LOGFILE_NO_CLIENT means there are no next client records, i.e. this is the last one. This is always LOGFILE_NO_CLIENT. *//* 20*/ le16 seq_number; /* On Win2k and presumably earlier, this is set to zero every time the logfile is restarted and it is incremented when the logfile is closed at dismount time. Thus it is 0 when dirty and 1 when clean. On WinXP and presumably later, this is always 0. *//* 22*/ u8 reserved[6]; /* Reserved/alignment. *//* 28*/ le32 client_name_length;/* Length of client name in bytes. Should always be 8. *//* 32*/ ntfschar client_name[64];/* Name of the client in Unicode. Should always be "NTFS" with the remaining bytes set to 0. *//* sizeof() = 160 (0xa0) bytes */} __attribute__((__packed__)) LOG_CLIENT_RECORD;/** * struct RECORD_PAGE_HEADER - Log page record page header. * * Each log page begins with this header and is followed by several LOG_RECORD * structures, starting at offset 0x40 (the size of this structure and the * following update sequence array and then aligned to 8 byte boundary, but is * this specified anywhere?). */typedef struct {/* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */ NTFS_RECORD_TYPES magic;/* Usually the magic is "RCRD". */ u16 usa_ofs; /* See NTFS_RECORD definition in layout.h. When creating, set this to be immediately after this header structure (without any alignment). */ u16 usa_count; /* See NTFS_RECORD definition in layout.h. */ union { LSN last_lsn; s64 file_offset; } __attribute__((__packed__)) copy; u32 flags; u16 page_count; u16 page_position; union { struct { u16 next_record_offset; u8 reserved[6]; LSN last_end_lsn; } __attribute__((__packed__)) packed; } __attribute__((__packed__)) header;} __attribute__((__packed__)) RECORD_PAGE_HEADER;/** * enum LOG_RECORD_FLAGS - Possible 16-bit flags for log records. * * (Or is it log record pages?) */typedef enum { LOG_RECORD_MULTI_PAGE = const_cpu_to_le16(0x0001), /* ??? */ LOG_RECORD_SIZE_PLACE_HOLDER = 0xffff, /* This has nothing to do with the log record. It is only so gcc knows to make the flags 16-bit. */} __attribute__((__packed__)) LOG_RECORD_FLAGS;/** * struct LOG_CLIENT_ID - The log client id structure identifying a log client. */typedef struct { u16 seq_number; u16 client_index;} __attribute__((__packed__)) LOG_CLIENT_ID;/** * struct LOG_RECORD - Log record header. * * Each log record seems to have a constant size of 0x70 bytes. */typedef struct { LSN this_lsn; LSN client_previous_lsn; LSN client_undo_next_lsn; u32 client_data_length; LOG_CLIENT_ID client_id; u32 record_type; u32 transaction_id; u16 flags; u16 reserved_or_alignment[3];/* Now are at ofs 0x30 into struct. */ u16 redo_operation; u16 undo_operation; u16 redo_offset; u16 redo_length; u16 undo_offset; u16 undo_length; u16 target_attribute; u16 lcns_to_follow; /* Number of lcn_list entries following this entry. *//* Now at ofs 0x40. */ u16 record_offset; u16 attribute_offset; u32 alignment_or_reserved; VCN target_vcn;/* Now at ofs 0x50. */ struct { /* Only present if lcns_to_follow is not 0. */ LCN lcn; } __attribute__((__packed__)) lcn_list[0];} __attribute__((__packed__)) LOG_RECORD;extern BOOL ntfs_check_logfile(ntfs_attr *log_na, RESTART_PAGE_HEADER **rp);extern BOOL ntfs_is_logfile_clean(ntfs_attr *log_na, RESTART_PAGE_HEADER *rp);extern int ntfs_empty_logfile(ntfs_attr *na);#endif /* defined _NTFS_LOGFILE_H */
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -