blf_clfs.hexpat

#include <type/types/win32.pat>

using CLFS_CLIENT_ID = be UCHAR;
using CLFS_LOG_STATE = be UCHAR;
using LARGE_INTEGER = be ULONGLONG;


#define CLIENT_SYMTBL_SIZE 11
#define CONTAINER_SYMTBL_SIZE 11
#define SHARED_SECURITY_SYMTBL_SIZE 11
#define MAX_CLIENTS_DEFAULT 124
#define MAX_CONTAINERS_DEFAULT 1024
#define CLFS_SECTOR_SIZE 0x200

enum CLFS_EXTEND_STATE : u32
{
    ClfsExtendStateNone,
    ClfsExtendStateExtendingFsd,
    ClfsExtendStateFlushingBlock
};

enum CLFS_METADATA_BLOCK_TYPE : u32
{
    ClfsMetaBlockControl,
    ClfsMetaBlockControlShadow,
    ClfsMetaBlockGeneral,
    ClfsMetaBlockGeneralShadow,
    ClfsMetaBlockScratch,
    ClfsMetaBlockScratchShadow
};

enum CLFS_TRUNCATE_STATE : u32
{
    ClfsTruncateStateNone,
    ClfsTruncateStateModifyingStream,
    ClfsTruncateStateSavingOwner,
    ClfsTruncateStateModifyingOwner,
    ClfsTruncateStateSavingDiscardBlock,
    ClfsTruncateStateModifyingDiscardBlock
};

struct CLFS_METADATA_RECORD_HEADER
{
    u64 ullDumpCount;
};


struct CLFS_LSN {
    u64 Internal;
};

struct CLFS_TRUNCATE_CONTEXT
{
    CLFS_TRUNCATE_STATE eTruncateState;
    char cClients;
    char iClient;
    padding[2];
    CLFS_LSN lsnOwnerPage;
    CLFS_LSN lsnLastOwnerPage;
    u32 cInvalidSector;
    padding[4];
};

struct CLFS_METADATA_BLOCK
{
    u64 pbImage;

    u32 cbImage;
    u32 cbOffset;
    CLFS_METADATA_BLOCK_TYPE eBlockType;
    padding[4];
};

struct CLFS_CONTROL_RECORD
{
    CLFS_METADATA_RECORD_HEADER hdrControlRecord;
    u64 ullMagicValue;
    u32 Version;
    CLFS_EXTEND_STATE eExtendState;
    u16 iExtendBlock;
    u16 iFlushBlock;
    u32 cNewBlockSectors;
    u32 cExtendStartSectors;
    u32 cExtendSectors;
    CLFS_TRUNCATE_CONTEXT cxTruncate;
    u16 cBlocks;
    padding[2];
    u32 cReserved;
    CLFS_METADATA_BLOCK rgBlocks[6];
};

struct p32{
    char *p:u32;
};

struct CLFS_LOG_BLOCK_HEADER
{
    char MajorVersion;
    char MinorVersion;
    char Usn;
    char ClientId;
    u16 TotalSectorCount;
    u16 ValidSectorCount;
    u32 Padding;
    u32 Checksum;
    u32 Flags;
    padding[4];
    CLFS_LSN CurrentLsn;
    CLFS_LSN NextLsn;
    p32 RecordOffsets[16];
    u64 *SignaturesOffset:u32;
};

struct CLFS_BASE_RECORD_HEADER
{
    CLFS_METADATA_RECORD_HEADER hdrBaseRecord;
    u128 cidLog;
    ULONGLONG rgClientSymTbl[CLIENT_SYMTBL_SIZE];
    ULONGLONG rgContainerSymTbl[CONTAINER_SYMTBL_SIZE];
    ULONGLONG rgSecuritySymTbl[SHARED_SECURITY_SYMTBL_SIZE];
    ULONG cNextContainer;
    CLFS_CLIENT_ID cNextClient;
    padding[3];
    ULONG cFreeContainers;
    ULONG cActiveContainers;
    ULONG cbFreeContainers;
    ULONG cbBusyContainers;
    ULONG rgClients[MAX_CLIENTS_DEFAULT];
    ULONG rgContainers[MAX_CONTAINERS_DEFAULT];
    ULONG cbSymbolZone;
    ULONG cbSector;
    USHORT bUnused;
    CLFS_LOG_STATE eLogState;
    UCHAR cUsn;
    UCHAR cClients;
    padding[3];
};

struct CLFS_NODE_ID
{
    ULONG   cType;                                      // CLFS node type.
    ULONG   cbNode;             
};

struct CLFS_CLIENT_CONTEXT
{
    CLFS_NODE_ID cidNode;
    CLFS_CLIENT_ID cidClient;
    padding[1];
    USHORT fAttributes;
    ULONG cbFlushThreshold;
    ULONG cShadowSectors;
    padding[4];
    ULONGLONG cbUndoCommitment;
    LARGE_INTEGER llCreateTime;
    LARGE_INTEGER llAccessTime;
    LARGE_INTEGER llWriteTime;
    CLFS_LSN lsnOwnerPage;
    CLFS_LSN lsnArchiveTail;
    CLFS_LSN lsnBase;
    CLFS_LSN lsnLast;
    CLFS_LSN lsnRestart;
    CLFS_LSN lsnPhysicalBase;
    CLFS_LSN lsnUnused1;
    CLFS_LSN lsnUnused2;
    CLFS_LOG_STATE eState;
    padding[7];
    ULONGLONG ullAlignment;
};

struct CLFSHASHSYM
{
    CLFS_NODE_ID cidNode;
    ULONG ulHash;
    ULONG cbHash;
    ULONGLONG ulBelow;
    ULONGLONG ulAbove;
    LONG cbSymName;
    LONG cbOffset;
    BOOLEAN fDeleted;
    padding[7];
};

CLFS_LOG_BLOCK_HEADER log_block_hdr0 @0x00;
CLFS_CONTROL_RECORD control_record @ 0x70;

CLFS_LOG_BLOCK_HEADER log_block_hdr1 @control_record.rgBlocks[1].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr2 @control_record.rgBlocks[2].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr3 @control_record.rgBlocks[3].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr4 @control_record.rgBlocks[4].cbOffset;
CLFS_LOG_BLOCK_HEADER log_block_hdr5 @control_record.rgBlocks[5].cbOffset;

CLFS_BASE_RECORD_HEADER base_record @control_record.rgBlocks[2].cbOffset + 0x70;

CLFS_CLIENT_CONTEXT client0 @0x1bd8;
CLFS_CLIENT_CONTEXT client1 @0x1cf8;

CLFSHASHSYM hashsym0 @0x1ba8;
CLFSHASHSYM hashsym1 @0x1cc8;