Ejemplo n.º 1
0
        internal override void ParseAttributeResidentBody(byte[] data, int maxLength, int offset)
        {
            base.ParseAttributeResidentBody(data, maxLength, offset);

            // Debug.Assert(maxLength >= ResidentHeader.ContentLength);

            List <AttributeListItem> results = new List <AttributeListItem>();

            int pointer = offset;

            while (pointer + 26 <= offset + maxLength)      // 26 is the smallest possible MFTAttributeListItem
            {
                AttributeListItem item = AttributeListItem.ParseListItem(data, Math.Min(data.Length - pointer, maxLength), pointer);

                if (item.Type == AttributeType.EndOfAttributes)
                {
                    break;
                }

                results.Add(item);

                pointer += item.Length;
            }

            Items = results;
        }
Ejemplo n.º 2
0
        public static AttributeListItem ParseListItem(byte[] data, int maxLength, int offset)
        {
            // Debug.Assert(maxLength >= 26);

            AttributeListItem res = new AttributeListItem();

            res.Type        = (AttributeType)BitConverter.ToUInt32(data, offset);
            res.Length      = BitConverter.ToUInt16(data, offset + 4);
            res.NameLength  = data[offset + 6];
            res.NameOffset  = data[offset + 7];
            res.StartingVCN = BitConverter.ToUInt64(data, offset + 8);
            res.BaseFile    = new FileReference(BitConverter.ToUInt64(data, offset + 16));
            res.AttributeId = BitConverter.ToUInt16(data, offset + 24);

            // Debug.Assert(maxLength >= res.NameOffset + res.NameLength * 2);
            res.Name = Encoding.Unicode.GetString(data, offset + res.NameOffset, res.NameLength * 2);

            return(res);
        }
Ejemplo n.º 3
0
        internal override void ParseAttributeNonResidentBody(Ntfs ntfsInfo)
        {
            base.ParseAttributeNonResidentBody(ntfsInfo);

            // Get all chunks
            byte[] data = NtfsUtils.ReadFragments(ntfsInfo, NonResidentHeader.Fragments);

            // Parse
            List <AttributeListItem> results = new List <AttributeListItem>();

            int pointer     = 0;
            int contentSize = (int)NonResidentHeader.ContentSize;

            while (pointer + 26 <= contentSize)     // 26 is the smallest possible MFTAttributeListItem
            {
                AttributeListItem item = AttributeListItem.ParseListItem(data, data.Length - pointer, pointer);

                if (item.Type == AttributeType.EndOfAttributes)
                {
                    break;
                }

                if (item.Length == 0)
                {
                    break;
                }

                results.Add(item);

                pointer += item.Length;
            }

            // Debug.Assert(pointer == contentSize);

            Items = results;
        }