这几天在做解析NTFS文件,遇到点问题...
$INDEX_ALLOCATION
typedef struct {
ULONGLONG MFTnum;
WORD IndexLen;
WORD FileNameOffset;
WORD IndexSign;
WORD Fill;
ULONGLONG FMFTnum;
ULONGLONG CreateTime;
ULONGLONG ModifyTime;
ULONGLONG RecordModifyTime;
ULONGLONG LastVisitTime;
ULONGLONG FileAlloc;
ULONGLONG FileSize;
ULONGLONG FileSign;
BYTE FileNameLen;
BYTE FileNameAir;
BYTE FileName;
}NTFS_INDEX_ITEM, *PNTFS_INDEX_ITEM;
case 0xA0: //$INDEX_ALLOCATION
{
pAss = pData;
pAss = pAss + 0x48;
if(!Run(pAss, FMapOut)){
MyErr("[GetMFTRecordData]run 操作失败!", 0);
return 1;
}
for(DWORD i = 1; i <= FMapOut[0].NumsOfLcn; i++)
{
Lcn = FMapOut[i].StartLcn;
Len.QuadPart = Lcn * VolumeCluUnit * 512;
if(!SetFilePointer(SysHandle, Len.LowPart, &Len.HighPart, FILE_BEGIN)){
MyErr("[GetMFTRecordData]设置文件指针失败!", GetLastError());
return 1;
}
for (DWORD j = 0; j < FMapOut[i].NumsOfLcn / (8 / VolumeCluUnit); j++)
{
if(!ReadFile(SysHandle, pIndex, 4096, &BytesRead, NULL)){
MyErr("[GetMFTRecordData]读取数据出错", GetLastError());
return 1;
}
if(*(DWORD*)pIndex != 0x58444e49)
break;
pAss = pIndex;
pAss = pAss + 0x18;
pAss = pAss + *(DWORD*)pAss;
do
{
IndexNameLen = ((NTFS_INDEX_ITEM*)pAss)->FileNameLen;
if(IndexNameLen != 0){
ZeroMemory(IndexName, MAX_PATH*2);
int k = WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK,
(LPCWSTR)(&((NTFS_INDEX_ITEM*)pAss)->FileName), IndexNameLen,
IndexName, MAX_PATH*2,
NULL, NULL);
if(k == 0){
MyErr("[GetMFTRecordData]Unicode to Ansii 失败!", GetLastError());
continue;
}
IndexName[k] = '\0';
//Flag标志查看指定文件夹下的文件目录
if (Flag == TRUE)
{
if(strcmp(IndexName, File) == 0){
FMapOut[0].StartLcn = ((NTFS_INDEX_ITEM*)pAss)->MFTnum;
return 20;
}
}
else
{
//过滤8.3格式,防止重复列举(无规律)
if(!(IndexName[6] == '~'|| IndexName[5] == '~'|| IndexName[7] == '1'|| IndexName[7] == '~'|| \
strcmp(IndexName, ".") == 0 || strcmp(IndexName, "") == 0)){
MyFileInfo(pAss, IndexName, FileCount);
FileCount++;
}
}
}
Last = ((NTFS_INDEX_ITEM*)pAss)->IndexSign;
pAss = pAss + ((NTFS_INDEX_ITEM*)pAss)->IndexLen;
} while (Last == 0x00 || Last == 0x01);
if(Last == 0x02) //0x02代表Index结束
continue;
if(Last == 0x03) //0x03代表所有的Index项结束
continue;
}
}
}
break;
如何来判断IndexName对应的是文件夹还是文件?
貌似NTFS_INDEX_ITEM结构中的FileSign是用来判断文件夹还是文件.
但是,我不知道具体的标志,就是那个常数代表的是文件夹,那个常数代表的文件?
有谁研究过?知道的,还望给小弟解答一下.谢谢..
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
