-
Notifications
You must be signed in to change notification settings - Fork 2
/
blf_clfs.hexpat
199 lines (175 loc) · 4.4 KB
/
blf_clfs.hexpat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
#include <type/types/win32.pat>
using CLFS_CLIENT_ID = be UCHAR;
using CLFS_LOG_STATE = be UCHAR;
using LARGE_INTEGER = be ULONGLONG;
#define CLIENT_SYMTBL_SIZE 11
#define CONTAINER_SYMTBL_SIZE 11
#define SHARED_SECURITY_SYMTBL_SIZE 11
#define MAX_CLIENTS_DEFAULT 124
#define MAX_CONTAINERS_DEFAULT 1024
#define CLFS_SECTOR_SIZE 0x200
enum CLFS_EXTEND_STATE : u32
{
ClfsExtendStateNone,
ClfsExtendStateExtendingFsd,
ClfsExtendStateFlushingBlock
};
enum CLFS_METADATA_BLOCK_TYPE : u32
{
ClfsMetaBlockControl,
ClfsMetaBlockControlShadow,
ClfsMetaBlockGeneral,
ClfsMetaBlockGeneralShadow,
ClfsMetaBlockScratch,
ClfsMetaBlockScratchShadow
};
enum CLFS_TRUNCATE_STATE : u32
{
ClfsTruncateStateNone,
ClfsTruncateStateModifyingStream,
ClfsTruncateStateSavingOwner,
ClfsTruncateStateModifyingOwner,
ClfsTruncateStateSavingDiscardBlock,
ClfsTruncateStateModifyingDiscardBlock
};
struct CLFS_METADATA_RECORD_HEADER
{
u64 ullDumpCount;
};
struct CLFS_LSN {
u64 Internal;
};
struct CLFS_TRUNCATE_CONTEXT
{
CLFS_TRUNCATE_STATE eTruncateState;
char cClients;
char iClient;
padding[2];
CLFS_LSN lsnOwnerPage;
CLFS_LSN lsnLastOwnerPage;
u32 cInvalidSector;
padding[4];
};
struct CLFS_METADATA_BLOCK
{
u64 pbImage;
u32 cbImage;
u32 cbOffset;
CLFS_METADATA_BLOCK_TYPE eBlockType;
padding[4];
};
struct CLFS_CONTROL_RECORD
{
CLFS_METADATA_RECORD_HEADER hdrControlRecord;
u64 ullMagicValue;
u32 Version;
CLFS_EXTEND_STATE eExtendState;
u16 iExtendBlock;
u16 iFlushBlock;
u32 cNewBlockSectors;
u32 cExtendStartSectors;
u32 cExtendSectors;
CLFS_TRUNCATE_CONTEXT cxTruncate;
u16 cBlocks;
padding[2];
u32 cReserved;
CLFS_METADATA_BLOCK rgBlocks[6];
};
struct p32{
char *p:u32;
};
struct CLFS_LOG_BLOCK_HEADER
{
char MajorVersion;
char MinorVersion;
char Usn;
char ClientId;
u16 TotalSectorCount;
u16 ValidSectorCount;
u32 Padding;
u32 Checksum;
u32 Flags;
padding[4];
CLFS_LSN CurrentLsn;
CLFS_LSN NextLsn;
p32 RecordOffsets[16];
u64 *SignaturesOffset:u32;
};
struct CLFS_BASE_RECORD_HEADER
{
CLFS_METADATA_RECORD_HEADER hdrBaseRecord;
u128 cidLog;
ULONGLONG rgClientSymTbl[CLIENT_SYMTBL_SIZE];
ULONGLONG rgContainerSymTbl[CONTAINER_SYMTBL_SIZE];
ULONGLONG rgSecuritySymTbl[SHARED_SECURITY_SYMTBL_SIZE];
ULONG cNextContainer;
CLFS_CLIENT_ID cNextClient;
padding[3];
ULONG cFreeContainers;
ULONG cActiveContainers;
ULONG cbFreeContainers;
ULONG cbBusyContainers;
ULONG rgClients[MAX_CLIENTS_DEFAULT];
ULONG rgContainers[MAX_CONTAINERS_DEFAULT];
ULONG cbSymbolZone;
ULONG cbSector;
USHORT bUnused;
CLFS_LOG_STATE eLogState;
UCHAR cUsn;
UCHAR cClients;
padding[3];
};
struct CLFS_NODE_ID
{
ULONG cType; // CLFS node type.
ULONG cbNode;
};
struct CLFS_CLIENT_CONTEXT
{
CLFS_NODE_ID cidNode;
CLFS_CLIENT_ID cidClient;
padding[1];
USHORT fAttributes;
ULONG cbFlushThreshold;
ULONG cShadowSectors;
padding[4];
ULONGLONG cbUndoCommitment;
LARGE_INTEGER llCreateTime;
LARGE_INTEGER llAccessTime;
LARGE_INTEGER llWriteTime;
CLFS_LSN lsnOwnerPage;
CLFS_LSN lsnArchiveTail;
CLFS_LSN lsnBase;
CLFS_LSN lsnLast;
CLFS_LSN lsnRestart;
CLFS_LSN lsnPhysicalBase;
CLFS_LSN lsnUnused1;
CLFS_LSN lsnUnused2;
CLFS_LOG_STATE eState;
padding[7];
ULONGLONG ullAlignment;
};
struct CLFSHASHSYM
{
CLFS_NODE_ID cidNode;
ULONG ulHash;
ULONG cbHash;
ULONGLONG ulBelow;
ULONGLONG ulAbove;
LONG cbSymName;
LONG cbOffset;
BOOLEAN fDeleted;
padding[7];
};
CLFS_LOG_BLOCK_HEADER log_block_hdr0 @0x00;
CLFS_CONTROL_RECORD control_record @ 0x70;
CLFS_LOG_BLOCK_HEADER log_block_hdr1 @control_record.rgBlocks[1].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr2 @control_record.rgBlocks[2].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr3 @control_record.rgBlocks[3].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr4 @control_record.rgBlocks[4].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr5 @control_record.rgBlocks[5].cbOffset;
CLFS_BASE_RECORD_HEADER base_record @control_record.rgBlocks[2].cbOffset + 0x70;
CLFS_CLIENT_CONTEXT client0 @0x1bd8;
CLFS_CLIENT_CONTEXT client1 @0x1cf8;
CLFSHASHSYM hashsym0 @0x1ba8;
CLFSHASHSYM hashsym1 @0x1cc8;