/// <summary>
///
/// </summary>
/// <param name="bytes"></param>
/// <param name="volume"></param>
/// <returns></returns>
internal static DataRun[] GetInstances(byte[] bytes, string volume)
{
List <DataRun> datarunList = new List <DataRun>();
int i = 0;
DataRun dr = new DataRun();
while (i < bytes.Length - 1)
{
int DataRunLengthByteCount = bytes[i] & 0x0F;
int DataRunOffsetByteCount = ((bytes[i] & 0xF0) >> 4);
if (DataRunLengthByteCount == 0)
{
break;
}
else if ((i + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length)
{
break;
}
dr = Get(bytes, i, DataRunLengthByteCount, DataRunOffsetByteCount, dr, volume);
datarunList.Add(dr);
i += (1 + DataRunLengthByteCount + DataRunOffsetByteCount);
}
return(datarunList.ToArray());
}
/// <summary>
///
/// </summary>
/// <param name="volume"></param>
/// <returns></returns>
public byte[] GetSlack()
{
Helper.getVolumeName(ref this.Volume);
using (FileStream streamToRead = Helper.getFileStream(this.Volume))
{
if (this.DataRun.Length != 0)
{
VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead);
ulong slackSize = this.AllocatedSize - this.RealSize;
if ((slackSize > 0) && (slackSize <= (ulong)VBR.BytesPerCluster))
{
DataRun dr = this.DataRun[this.DataRun.Length - 1];
long lastCluster = dr.StartCluster + dr.ClusterLength - 1;
byte[] dataRunBytes = Helper.readDrive(streamToRead, VBR.BytesPerCluster * lastCluster, VBR.BytesPerCluster);
byte[] slackBytes = new byte[slackSize];
Array.Copy(dataRunBytes, VBR.BytesPerCluster - ((int)this.AllocatedSize - (int)this.RealSize), slackBytes, 0x00, slackBytes.Length);
return(slackBytes);
}
else
{
return(null);
}
}
else
{
return(null);
}
}
}
public static DataRun[] GetInstances(byte[] bytes, int offset)
{
List<DataRun> datarunList = new List<DataRun>();
int i = offset;
DataRun dr = new DataRun();
while (i < bytes.Length - 1)
{
int DataRunLengthByteCount = bytes[i] & 0x0F;
int DataRunOffsetByteCount = ((bytes[i] & 0xF0) >> 4);
if (DataRunLengthByteCount == 0)
{
break;
}
else if ((i + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length)
{
break;
}
dr = Get(bytes, i, DataRunLengthByteCount, DataRunOffsetByteCount, dr);
datarunList.Add(dr);
i += (1 + DataRunLengthByteCount + DataRunOffsetByteCount);
}
return datarunList.ToArray();
}
public byte[] GetSlack(string volume)
{
NativeMethods.getVolumeName(ref volume);
IntPtr hVolume = NativeMethods.getHandle(volume);
using (FileStream streamToRead = NativeMethods.getFileStream(hVolume))
{
if (this.DataRun != null)
{
VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead);
ulong slackSize = this.AllocatedSize - this.RealSize;
if (slackSize <= VBR.BytesPerCluster)
{
DataRun dr = this.DataRun[this.DataRun.Length - 1];
ulong lastCluster = (ulong)dr.StartCluster + (ulong)dr.ClusterLength - 1;
byte[] dataRunBytes = NativeMethods.readDrive(streamToRead, VBR.BytesPerCluster * lastCluster, VBR.BytesPerCluster);
byte[] slackBytes = new byte[slackSize];
Array.Copy(dataRunBytes, (long)VBR.BytesPerCluster - ((long)this.AllocatedSize - (long)this.RealSize), slackBytes, 0x00, slackBytes.Length);
return(slackBytes);
}
else
{
return(null);
}
}
else
{
return(null);
}
}
}
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName)
{
// Attr Object
Name = (ATTR_TYPE)header.commonHeader.ATTRType;
NameString = attrName;
NonResident = header.commonHeader.NonResident;
AttributeId = header.commonHeader.Id;
// NonResident Attribute
commonHeader = header.commonHeader;
StartVCN = header.StartVCN;
LastVCN = header.LastVCN;
DataRunOffset = header.DataRunOffset;
CompUnitSize = header.CompUnitSize;
AllocatedSize = header.AllocatedSize;
RealSize = header.RealSize;
InitializedSize = header.InitializedSize;
int DataRunLengthByteCount = bytes[0] & 0x0F;
int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4);
if (DataRunLengthByteCount != 0)
{
// DataRun
int offset = 0;
long startCluster = 0;
List <DataRun> dataRunList = new List <DataRun>();
do
{
if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length)
{
break;
}
// Instantiate a DataRun object
DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster);
// Add DataRun Object to dataRunList
dataRunList.Add(dataRun);
// Increment offset
offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount;
if (offset <= (bytes.Length - 1))
{
DataRunLengthByteCount = bytes[offset] & 0x0F;
DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4);
}
else
{
break;
}
} while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunOffsetByteCount <= 3) && (DataRunLengthByteCount != 0));
DataRun = dataRunList.ToArray();
}
}
private DataRun(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR)
{
if (offsetByteCount == 0)
{
Sparse = true;
}
byte[] DataRunLengthBytes = new byte[8];
Array.Copy(bytes, offset + 1, DataRunLengthBytes, 0, lengthByteCount);
ClusterLength = BitConverter.ToInt64(DataRunLengthBytes, 0);
byte[] offsetBytes = new byte[0x08];
int arrayOffset = 0x08 - offsetByteCount;
Array.Copy(bytes, offset + 0x01 + lengthByteCount, offsetBytes, arrayOffset, offsetByteCount);
long relativeOffset = BitConverter.ToInt64(offsetBytes, 0x00) >> arrayOffset * 0x08;
StartCluster = previousDR.StartCluster + relativeOffset;
}
private DataRun(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR, string volume)
{
Volume = volume;
if (offsetByteCount == 0)
{
Sparse = true;
}
if (!((lengthByteCount > 8) || (offsetByteCount > 8)))
{
byte[] DataRunLengthBytes = new byte[0x08];
Array.Copy(bytes, offset + 1, DataRunLengthBytes, 0x00, lengthByteCount);
ClusterLength = BitConverter.ToInt64(DataRunLengthBytes, 0x00);
byte[] offsetBytes = new byte[0x08];
int arrayOffset = 0x08 - offsetByteCount;
Array.Copy(bytes, offset + 0x01 + lengthByteCount, offsetBytes, arrayOffset, offsetByteCount);
long relativeOffset = BitConverter.ToInt64(offsetBytes, 0x00) >> arrayOffset * 0x08;
StartCluster = previousDR.StartCluster + relativeOffset;
}
}
/// <summary>
///
/// </summary>
/// <param name="bytes"></param>
/// <param name="offset"></param>
/// <param name="lengthByteCount"></param>
/// <param name="offsetByteCount"></param>
/// <param name="previousDR"></param>
/// <param name="volume"></param>
/// <returns></returns>
private static DataRun Get(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR, string volume)
{
return(new DataRun(bytes, offset, lengthByteCount, offsetByteCount, previousDR, volume));
}
internal ulong StartVCN; // Starting VCN
#endregion Fields
#region Constructors
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName)
{
// Attr Object
Name = (ATTR_TYPE)header.commonHeader.ATTRType;
NameString = attrName;
NonResident = header.commonHeader.NonResident;
AttributeId = header.commonHeader.Id;
// NonResident Attribute
commonHeader = header.commonHeader;
StartVCN = header.StartVCN;
LastVCN = header.LastVCN;
DataRunOffset = header.DataRunOffset;
CompUnitSize = header.CompUnitSize;
AllocatedSize = header.AllocatedSize;
RealSize = header.RealSize;
InitializedSize = header.InitializedSize;
int DataRunLengthByteCount = bytes[0] & 0x0F;
int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4);
if (DataRunLengthByteCount != 0)
{
// DataRun
int offset = 0;
long startCluster = 0;
List<DataRun> dataRunList = new List<DataRun>();
do
{
if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length)
{
break;
}
// Instantiate a DataRun object
DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster);
// Add DataRun Object to dataRunList
dataRunList.Add(dataRun);
// Increment offset
offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount;
if (offset <= (bytes.Length - 1))
{
DataRunLengthByteCount = bytes[offset] & 0x0F;
DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4);
}
else
{
break;
}
} while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunLengthByteCount != 0));
DataRun = dataRunList.ToArray();
}
}
public static DataRun Get(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR)
{
return new DataRun(bytes, offset, lengthByteCount, offsetByteCount, previousDR);
}
public static DataRun Get(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR)
{
return(new DataRun(bytes, offset, lengthByteCount, offsetByteCount, previousDR));
}
