 |
OpenCore
1.0.4
OpenCore Bootloader
|
|
OpenCore
1.0.4
OpenCore Bootloader
|
Go to the source code of this file.
Data Structures | |
| struct | FILE_RECORD_HEADER |
| struct | ATTR_HEADER_RES |
| struct | ATTR_HEADER_NONRES |
| struct | ATTR_LIST_RECORD |
| struct | INDEX_ENTRY |
| struct | INDEX_HEADER |
| struct | INDEX_RECORD_HEADER |
| struct | INDEX_ROOT |
| struct | ATTR_INDEX_ROOT |
| struct | ATTR_FILE_NAME |
| struct | BOOT_FILE_DATA |
| struct | SYMLINK |
| struct | NTFS_ATTR |
| struct | _NTFS_FILE |
| struct | _EFI_NTFS_FILE |
| struct | _EFI_FS |
| struct | UNIT_ELEMENT |
| struct | COMPRESSED |
| struct | RUNLIST |
Macros | |
| #define | NTFS_MAX_MFT 4096 |
| #define | NTFS_MAX_IDX 16384 |
| #define | COMPRESSION_BLOCK 4096 |
| #define | NTFS_DRIVER_VERSION 0x00020000 |
| #define | MAX_PATH 1024 |
| #define | MINIMUM_INFO_LENGTH (sizeof (EFI_FILE_INFO) + MAX_PATH * sizeof(CHAR16)) |
| #define | MINIMUM_FS_INFO_LENGTH (sizeof (EFI_FILE_SYSTEM_INFO) + MAX_PATH * sizeof(CHAR16)) |
| #define | ATTRIBUTES_END_MARKER 0xFFFFFFFF |
| #define | MAX_FILE_SIZE (MAX_UINT32 & ~7ULL) |
| #define | S_FILENAME 0x3 |
| #define | S_SYMLINK 0xC |
Typedefs | |
| typedef struct _NTFS_FILE | NTFS_FILE |
| typedef struct _EFI_NTFS_FILE | EFI_NTFS_FILE |
| typedef struct _EFI_FS | EFI_FS |
Copyright (c) 2022, Mikhail Krichanov. All rights reserved. SPDX-License-Identifier: BSD-3-Clause
Functional and structural descriptions follow NTFS Documentation by Richard Russon and Yuval Fledel
Definition in file Driver.h.
| #define MINIMUM_FS_INFO_LENGTH (sizeof (EFI_FILE_SYSTEM_INFO) + MAX_PATH * sizeof(CHAR16)) |
| #define MINIMUM_INFO_LENGTH (sizeof (EFI_FILE_INFO) + MAX_PATH * sizeof(CHAR16)) |
| typedef struct _EFI_NTFS_FILE EFI_NTFS_FILE |
| typedef struct _NTFS_FILE NTFS_FILE |
| anonymous enum |
FILE ***
Everything on an NTFS volume is a File. Files are composed of Attributes (usually 4: $STANDARD_INFORMATION, $FILE_NAME, $SECURITY_DESCRIPTOR, $DATA).
Information about all the Attributes available in a volume is stored in a File named $AttrDef.
File named $MFT (Master File Table) is an index of every File on the volume. The description of each File is packed into FILE Records. A FILE Record is built up from a header, several variable length Attributes and an end marker (simply 0xFFFFFFFF). The first FILE Record that describes a given file is called the Base FILE Record and the others are called Extension FILE Records. Only the Base FILE Record is used for referencing the File it describes. Attribute named $ATTRIBUTE_LIST provides the references to all the Extension FILE Records.
The $MFT lists the Boot Sector File ($Boot), located at the beginning of the disk. $Boot also lists where to find the $MFT. The $MFT also lists itself.
Every Attribute has a standard header and specific fields. The header stores information about the Attribute's type, size, name (optional) and whether it is resident (in $MFT), or not.
Non-resident Attributes are stored in intervals of Clusters called Data Runs. Each Data Run is represented by its starting Cluster and its length.
The number of sectors that make up a Cluster is always a power of 2, and this number is fixed when the volume is formatted. The Cluster Size for a volume is stored in a File named $Boot.
Each Cluster in a volume is given a sequential number. This is its Logical Cluster Number. LCN 0 (zero) refers to the first cluster in the volume (the Boot Sector).
Each Cluster of a non-resident stream is given a sequential number. This is its Virtual Cluster Number. VCN 0 (zero) refers to the first cluster of the stream.
INDEX ***
Under NTFS every object on the volume is a file, even directories. A directory is a sequence of Index Entries containing a filename Attribute. An Index Entry is created for each $FILE_NAME Attribute of each file contained in the folder.
$INDEX_ROOT Attribute is the root node of the B+ tree that implements an index (e.g. a directory). This file attribute is always resident.
Every Index Record has a standard header and a set of blocks containing an Index Key and Index Data. The size of an Index Record is defined in $Boot File and always seems to be 4KB.
$INDEX_ALLOCATION Attribute is the storage location for all sub-nodes of the B+ tree that implements an index (e.g. a directory). It is simply a sequence of all Index Records that belong to the Index. This file attribute is never resident.
A sequence of Index Entries follows each INDEX_HEADER structure. Together they make up a complete index. The index follows either an $INDEX_ROOT Attribute or an $INDEX_ALLOCATION Attribute.
RUNLIST ***
Runlist is a table written in the content part of a non-resident file Attribute, which allows to have access to its stream. (Table 4.10.)
The Runlist is a sequence of elements: each element stores an offset to the starting LCN of the previous element and the length in clusters of a Data Run.
The layout of the Runlist must take account of the data compression: the set of VCNs containing the stream of a compressed file attribute is divided in compression units (also called chunks) of 16 clusters.
Data are compressed using a modified LZ77 algorithm. The basic idea is that substrings of the block which have been seen before are compressed by referencing the string rather than mentioning it again.
Only $DATA Attribute can be compressed, or sparse, and only when it is non-resident. Table 2.1. Standard NTFS Attribute Types
| anonymous enum |
| anonymous enum |
| anonymous enum |
| anonymous enum |
| anonymous enum |
| anonymous enum |
| anonymous enum |
1.12.0