/// <param name="segmentLength">This refers to the maximum length of FileRecord as defined in the Volume's BootRecord</param> public byte[] GetBytes(int bytesPerFileRecordSegment, ushort minorNTFSVersion) { int strideCount = bytesPerFileRecordSegment / MultiSectorHelper.BytesPerStride; ushort updateSequenceArraySize = (ushort)(1 + strideCount); ushort updateSequenceArrayOffset; if (minorNTFSVersion == 0) { updateSequenceArrayOffset = NTFS30UpdateSequenceArrayOffset; } else { updateSequenceArrayOffset = NTFS31UpdateSequenceArrayOffset; } MultiSectorHeader multiSectorHeader = new MultiSectorHeader(ValidSignature, updateSequenceArrayOffset, updateSequenceArraySize); ushort firstAttributeOffset = GetFirstAttributeOffset(bytesPerFileRecordSegment, minorNTFSVersion); byte[] buffer = new byte[bytesPerFileRecordSegment]; multiSectorHeader.WriteBytes(buffer, 0x00); LittleEndianWriter.WriteUInt64(buffer, 0x08, LogFileSequenceNumber); LittleEndianWriter.WriteUInt16(buffer, 0x10, m_sequenceNumber); LittleEndianWriter.WriteUInt16(buffer, 0x12, ReferenceCount); LittleEndianWriter.WriteUInt16(buffer, 0x14, firstAttributeOffset); LittleEndianWriter.WriteUInt16(buffer, 0x16, (ushort)m_flags); LittleEndianWriter.WriteInt32(buffer, 0x1C, bytesPerFileRecordSegment); m_baseFileRecordSegment.WriteBytes(buffer, 0x20); LittleEndianWriter.WriteUInt16(buffer, 0x28, NextAttributeInstance); if (minorNTFSVersion == 1) { LittleEndianWriter.WriteUInt32(buffer, 0x2C, (uint)m_segmentNumber); } // write attributes int position = firstAttributeOffset; foreach (AttributeRecord attribute in m_immediateAttributes) { byte[] attributeBytes = attribute.GetBytes(); ByteWriter.WriteBytes(buffer, position, attributeBytes); position += attributeBytes.Length; } byte[] marker = GetEndMarker(); ByteWriter.WriteBytes(buffer, position, marker); position += marker.Length; position += 4; // record (length) is aligned to 8-byte boundary uint segmentLength = (uint)position; LittleEndianWriter.WriteUInt32(buffer, 0x18, segmentLength); // Write UpdateSequenceNumber and UpdateSequenceReplacementData List <byte[]> updateSequenceReplacementData = MultiSectorHelper.EncodeSegmentBuffer(buffer, 0, bytesPerFileRecordSegment, UpdateSequenceNumber); MultiSectorHelper.WriteUpdateSequenceArray(buffer, updateSequenceArrayOffset, updateSequenceArraySize, UpdateSequenceNumber, updateSequenceReplacementData); return(buffer); }
public override void WriteBytes(byte[] buffer, int offset) { LittleEndianWriter.WriteUInt32(buffer, offset + 0x00, AllocatedOrNextFree); ByteWriter.WriteByte(buffer, offset + 0x04, (byte)TransactionState); LittleEndianWriter.WriteUInt64(buffer, offset + 0x08, FirstLsn); LittleEndianWriter.WriteUInt64(buffer, offset + 0x10, PreviousLsn); LittleEndianWriter.WriteUInt64(buffer, offset + 0x18, UndoNextLsn); LittleEndianWriter.WriteUInt32(buffer, offset + 0x20, UndoRecords); LittleEndianWriter.WriteInt32(buffer, offset + 0x24, UndoBytes); }
public override void WriteDataBytes(byte[] buffer, ref int offset) { ByteWriter.WriteByte(buffer, offset + 0, (byte)btype); ByteWriter.WriteByte(buffer, offset + 1, cLevel); LittleEndianWriter.WriteInt32(buffer, offset + 2, rgentries.Count); offset = 8; for (int index = 0; index < rgentries.Count; index++) { rgentries[index].WriteBytes(buffer, offset); offset += SubnodeIntermediateEntry.Length; } }
public override void WriteDataBytes(byte[] buffer, ref int offset) { ByteWriter.WriteByte(buffer, offset + 0, (byte)btype); ByteWriter.WriteByte(buffer, offset + 1, (byte)cLevel); LittleEndianWriter.WriteInt32(buffer, offset + 2, rgbid.Count); LittleEndianWriter.WriteUInt32(buffer, offset + 4, lcbTotal); offset = 8; for (int index = 0; index < rgbid.Count; index++) { LittleEndianWriter.WriteUInt64(buffer, offset, rgbid[index].Value); offset += 8; } }
public byte[] GetBytes() { byte[] buffer = new byte[Length]; LittleEndianWriter.WriteInt32(buffer, 0, lBias); LittleEndianWriter.WriteInt32(buffer, 4, lStandardBias); LittleEndianWriter.WriteInt32(buffer, 8, lDaylightBias); LittleEndianWriter.WriteUInt16(buffer, 12, stStandardDate.wYear); stStandardDate.WriteBytes(buffer, 14); LittleEndianWriter.WriteUInt16(buffer, 30, stDaylightDate.wYear); stDaylightDate.WriteBytes(buffer, 32); return(buffer); }
public void WriteBytes(byte[] buffer, int offset) { ByteWriter.WriteByte(buffer, offset + 0, MajorVersion); ByteWriter.WriteByte(buffer, offset + 1, MinorVersion); LittleEndianWriter.WriteUInt16(buffer, offset + 2, Reserved); LittleEndianWriter.WriteUInt16(buffer, offset + 4, (ushort)TZRuleFlags); LittleEndianWriter.WriteUInt16(buffer, offset + 6, wYear); // 14 unused bytes LittleEndianWriter.WriteInt32(buffer, offset + 22, lBias); LittleEndianWriter.WriteInt32(buffer, offset + 26, lStandardBias); LittleEndianWriter.WriteInt32(buffer, offset + 30, lDaylightBias); stStandardDate.WriteBytes(buffer, offset + 34); stDaylightDate.WriteBytes(buffer, offset + 50); }
// ExtendedException Structure: // http://msdn.microsoft.com/en-us/library/ee159855%28v=exchg.80%29 public void WriteExtendedException(Stream stream, WriterCompatibilityMode writerCompatibilityMode) { if (writerCompatibilityMode >= WriterCompatibilityMode.Outlook2007RTM) { // Change highlight structure: uint changeHighlightSize = 4; LittleEndianWriter.WriteUInt32(stream, changeHighlightSize); int changeHighlightValue = 0; // Apparently Outlook 2010 uses 0 regardless of the actual changes LittleEndianWriter.WriteInt32(stream, changeHighlightValue); } uint reservedBlockEE1Size = 0; LittleEndianWriter.WriteUInt32(stream, reservedBlockEE1Size); if (HasModifiedSubject || HasModifiedLocation) { DateTimeHelper.WriteDateTimeInMinutes(stream, NewStartDT); DateTimeHelper.WriteDateTimeInMinutes(stream, NewEndDT); DateTimeHelper.WriteDateTimeInMinutes(stream, OriginalStartDT); if (HasModifiedSubject) { LittleEndianWriter.WriteUInt16(stream, (ushort)Subject.Length); ByteWriter.WriteBytes(stream, Encoding.Unicode.GetBytes(Subject)); } if (HasModifiedLocation) { LittleEndianWriter.WriteUInt16(stream, (ushort)Location.Length); ByteWriter.WriteBytes(stream, Encoding.Unicode.GetBytes(Location)); } uint reservedBlockEE2Size = 0; LittleEndianWriter.WriteUInt32(stream, reservedBlockEE2Size); } }
/// <param name="segmentLength">This refers to the maximum length of FileRecord as defined in the Volume's BootRecord</param> public byte[] GetBytes(int segmentLength, int bytesPerCluster, ushort minorNTFSVersion) { int strideCount = segmentLength / MultiSectorHelper.BytesPerStride; ushort updateSequenceArraySize = (ushort)(1 + strideCount); ushort updateSequenceArrayOffset; if (minorNTFSVersion == 0) { updateSequenceArrayOffset = NTFS30UpdateSequenceArrayOffset; } else { updateSequenceArrayOffset = NTFS31UpdateSequenceArrayOffset; } ushort firstAttributeOffset = GetFirstAttributeOffset(segmentLength, minorNTFSVersion); byte[] buffer = new byte[segmentLength]; ByteWriter.WriteAnsiString(buffer, 0, Signature, 4); LittleEndianWriter.WriteUInt16(buffer, 0x04, updateSequenceArrayOffset); LittleEndianWriter.WriteUInt16(buffer, 0x06, updateSequenceArraySize); LittleEndianWriter.WriteUInt64(buffer, 0x08, LogFileSequenceNumber); LittleEndianWriter.WriteUInt16(buffer, 0x10, SequenceNumber); LittleEndianWriter.WriteUInt16(buffer, 0x12, HardLinkCount); LittleEndianWriter.WriteUInt16(buffer, 0x14, firstAttributeOffset); LittleEndianWriter.WriteUInt16(buffer, 0x16, (ushort)m_flags); LittleEndianWriter.WriteInt32(buffer, 0x1C, segmentLength); LittleEndianWriter.WriteUInt64(buffer, 0x20, BaseFileRecordSegmentNumber); LittleEndianWriter.WriteUInt16(buffer, 0x28, NextAttributeId); if (minorNTFSVersion == 1) { LittleEndianWriter.WriteUInt32(buffer, 0x2C, MftSegmentNumberXP); } // write attributes int position = firstAttributeOffset; foreach (AttributeRecord attribute in m_immediateAttributes) { byte[] attributeBytes = attribute.GetBytes(bytesPerCluster); ByteWriter.WriteBytes(buffer, position, attributeBytes); position += attributeBytes.Length; } byte[] marker = GetEndMarker(); ByteWriter.WriteBytes(buffer, position, marker); position += marker.Length; position += 4; // record (length) is aligned to 8-byte boundary uint segmentRealSize = (uint)position; LittleEndianWriter.WriteUInt32(buffer, 0x18, segmentRealSize); // write UpdateSequenceNumber and UpdateSequenceReplacementData List <byte[]> updateSequenceReplacementData = MultiSectorHelper.EncodeSegmentBuffer(buffer, 0, segmentLength, UpdateSequenceNumber); position = updateSequenceArrayOffset; LittleEndianWriter.WriteUInt16(buffer, position, UpdateSequenceNumber); position += 2; foreach (byte[] endOfSectorBytes in updateSequenceReplacementData) { ByteWriter.WriteBytes(buffer, position, endOfSectorBytes); position += 2; } return(buffer); }
public byte[] GetBytes(int bytesPerFileRecordSegment, ushort minorNTFSVersion, bool applyUsaProtection) { int strideCount = bytesPerFileRecordSegment / MultiSectorHelper.BytesPerStride; ushort updateSequenceArraySize = (ushort)(1 + strideCount); ushort updateSequenceArrayOffset; if (minorNTFSVersion == 0) { updateSequenceArrayOffset = NTFS30UpdateSequenceArrayOffset; } else { updateSequenceArrayOffset = NTFS31UpdateSequenceArrayOffset; } MultiSectorHeader multiSectorHeader = new MultiSectorHeader(ValidSignature, updateSequenceArrayOffset, updateSequenceArraySize); ushort firstAttributeOffset = GetFirstAttributeOffset(bytesPerFileRecordSegment, minorNTFSVersion); int length = applyUsaProtection ? bytesPerFileRecordSegment : GetNumberOfBytesInUse(bytesPerFileRecordSegment, minorNTFSVersion); byte[] buffer = new byte[length]; multiSectorHeader.WriteBytes(buffer, 0x00); LittleEndianWriter.WriteUInt64(buffer, 0x08, LogFileSequenceNumber); LittleEndianWriter.WriteUInt16(buffer, 0x10, m_sequenceNumber); LittleEndianWriter.WriteUInt16(buffer, 0x12, ReferenceCount); LittleEndianWriter.WriteUInt16(buffer, 0x14, firstAttributeOffset); LittleEndianWriter.WriteUInt16(buffer, 0x16, (ushort)m_flags); LittleEndianWriter.WriteInt32(buffer, 0x1C, bytesPerFileRecordSegment); m_baseFileRecordSegment.WriteBytes(buffer, 0x20); LittleEndianWriter.WriteUInt16(buffer, 0x28, NextAttributeInstance); if (minorNTFSVersion == 1) { LittleEndianWriter.WriteUInt32(buffer, 0x2C, (uint)m_segmentNumber); } LittleEndianWriter.WriteUInt32(buffer, updateSequenceArrayOffset, UpdateSequenceNumber); // write attributes int position = firstAttributeOffset; foreach (AttributeRecord attribute in m_immediateAttributes) { byte[] attributeBytes = attribute.GetBytes(); ByteWriter.WriteBytes(buffer, position, attributeBytes); position += attributeBytes.Length; } LittleEndianWriter.WriteUInt32(buffer, position, AttributesEndMarker); position += AttributesEndMarkerLength; // End marker + alignment to 8-byte boundary uint segmentLength = (uint)position; LittleEndianWriter.WriteUInt32(buffer, 0x18, segmentLength); if (applyUsaProtection) { MultiSectorHelper.ApplyUsaProtection(buffer, 0); } return(buffer); }