注册
登录
NTFS文件系统有着非常优秀的特性，其安全性、可靠性都远胜于我们常用的FAT文件系统，但是微软公司出于商业目的没有公布它的规范，使得这种优秀的文件系统只能在Windows NT架构的操作系统中使用。 不过先辈们唱得好：“没有枪没有炮，敌人给我们造!”。不管微软再怎么保密，它自己总要使用NTFS文件系统。那我们就通过分析它的代码来研究NTFS文件系统的规范呐。下面就列出小弟在仔细分析之后制做的Windows 2000 build 2195版格式化的NTFS分区的引导记录的源代码，以此与各位同好共勉。 本代码在MASM 6.11下编译通过。其中与分区结构相关的数据仅适用于在下自己分的分区，各位引用时请自行代入正确的值。 .486 Title NTFS $Boot of Windows 2000 build 2195 Code SEGMENT BYTE PUBLIC USE16 'CODE' ASSUME CS:Code,DS:Code NTFS PROC FAR START: JMP SHORT Loader DB 90H PartitionID DB 'NTFS ' BytePerSector DW 512 SectorPerCluster DB 1 SectorNumWanted DW 0 SectorWanted DD 0 SupportExtendInt13Flag DB 0 StorageMedia DB 0F8H DB 0,0 SectorPerTrack DW 3FH Heads DW 0FFH HiddenSector DD 3FH CHSMaxSectorNum DD 0 CurrentDisk DB 81H DB 0,8,0 SectorsInPartition DD 3E81FFH DD 0 MFTPosition DD 0C5A70H DD 0 MFTMirrPosition DD 1FCD0AH DD 0 ClusterPerFRS DD 2 DB 08H,0,0,0,0F6H,79H DB 58H,5CH,0BBH,58H,5CH,0F4H DB 0,0,0,0 Loader: CLI ; Disable interrupts XOR AX,AX MOV SS,AX MOV SP,7C00H ; Initalize stack STI ; Enable interrupts MOV AX,7C0H MOV DS,AX CALL GetCHSMaxSectorNum MOV AX,0D00H MOV ES,AX XOR BX,BX MOV BYTE PTR DS:[SectorNumWanted],10H CALL ReadSector PUSH 0D00H PUSH 26AH RETF NTFS ENDP ;----------------------------------------------------------------------------- GetCHSMaxSectorNum PROC NEAR MOV DL,DS:[CurrentDisk] MOV AH,8 INT 13H JNC Lost MOV CX,0FFFFH MOV DH,CL Lost: MOVZX EAX,DH INC AX MOVZX EDX,CL AND DL,3FH MUL DX XCHG CL,CH SHR CH,6 INC CX MOVZX ECX,CX MUL ECX MOV DS:CHSMaxSectorNum,EAX RET GetCHSMaxSectorNum ENDP ;----------------------------------------------------------------------------- IsSupportExtendInt13 PROC NEAR MOV AH,41H MOV BX,55AAH MOV DL,DS:CurrentDisk INT 13H ; Is support extend int 13h JC SHORT NotSupport ; Jump if carry Set CMP BX,0AA55H JNE SHORT NotSupport ; Jump if not equal TEST CL,1 JZ SHORT NotSupport ; Jump if zero INC BYTE PTR DS:SupportExtendInt13Flag NotSupport: RET IsSupportExtendInt13 ENDP ;----------------------------------------------------------------------------- ;Function : read number indicated by [WantedSecotrNum] sectors at [WantedSector] to ES:BX ReadSector PROC NEAR PUSHAD ; Save all regs PUSH DS PUSH ES GetReadParam: MOV EAX,DS:[SectorWanted] ADD EAX,DS:[HiddenSector] CMP EAX,DS:[CHSMaxSectorNum] JB NEAR PTR ReadByOldInt13 ; Sector number is less than CHSMaxSectorNum , use origin int 13h PUSH DS ; PUSH DWORD PTR 0 DB 66H,6AH,0 PUSH EAX PUSH ES PUSH BX PUSH DWORD PTR 10010H CMP BYTE PTR DS:SupportExtendInt13Flag,0 JNE NEAR PTR Supported CALL IsSupportExtendInt13 CMP BYTE PTR DS:SupportExtendInt13Flag,0 JE NEAR PTR FatalFault Supported: MOV AH,42H MOV DL,DS:[CurrentDisk] PUSH SS POP DS MOV SI,SP INT 13H ; read sector POP EAX POP BX POP ES POP EAX POP EAX POP DS JMP SHORT OneSectorRead ReadByOldInt13: XOR EDX,EDX MOVZX ECX,WORD PTR DS:[SectorPerTrack] DIV ECX INC DL MOV CL,DL MOV EDX,EAX SHR EDX,10H DIV WORD PTR DS:[Heads] XCHG DL,DH MOV DL,DS:[CurrentDisk] MOV CH,AL SHL AH,6 OR CL,AH ; Build read sector parameters MOV AX,201H INT 13H ; Read sector OneSectorRead: JC NEAR PTR FatalFault ; Read error,shut down MOV AX,ES ADD AX,20H MOV ES,AX INC DWORD PTR DS:[SectorWanted] DEC WORD PTR DS:[SectorNumWanted] JNZ GetReadParam ; Fixup parameters POP ES POP DS POPAD ; Restore all regs RET FatalFault:: MOV AL,ReadDiskErrorOffset ReadSector ENDP ;----------------------------------------------------------------------------- DispFatalMsg:: CALL PrintString MOV AL,ShutDownMsgOffset CALL PrintString ; Display shutdown message STI ; Enable interrupts ShutDown: JMP SHORT ShutDown ; Crash ;----------------------------------------------------------------------------- PrintString PROC NEAR MOV AH,1 MOV SI,AX LoadChar: LODSB CMP AL,0 JZ SHORT PrintStringEnd MOV AH,0EH MOV BX,7 INT 10H JMP SHORT LoadChar PrintStringEnd: RET PrintString ENDP ;----------------------------------------------------------------------------- ReadDiskError DB 0DH, 0AH, 'A disk read error occurred', 0 MissNTLDRError DB 0DH, 0AH, 'NTLDR is missing', 0 NTLDRCompressed DB 0DH, 0AH, 'NTLDR is compressed', 0 ShutDownMsg DB 0DH, 0AH, 'Press Ctrl+Alt+Del to restart',0DH,0AH,0 DB 13 DUP (0) ReadDiskErrorOffset DB 83H ;OFFSET ReadDiskError MissNTLDRErrorMsg DB 0A0H ;OFFSET MissNTLDRError NTLDRComperssedOffset DB 0B3H ;OFFSET NTLDRCompressed ShutDownMsgOffset DB 0C9H ;OFFSET ShutDownMsg DB 0, 0 BootValidFlag DW 0AA55H UnicodeNTLDR DW 5 DB "N",0,"T",0,"L",0,"D",0,"R",0 UnicodeDirectory: DW 4 DB "S",0,"I",0,"3",0,"0",0 AttributePoint DD 0E000H MFTPoint DD 3000H MFTNumber DD 0 TempRootBuffer DD 0 TempDirBuffer DD 0 TempBitmapBuf DD 0 RootAttribute DD 0 DirEntryList DD 0 BitmapAttribute DD 0 TempMFT DD 0 DD 0 TempDataBuf DD 0 BitampPoint DD 0 ParamTailPoint DD 0 BytePerCluster DD 0 MFTSize DD 0 MFTSizeBySector DD 909012EBH MFTTail DD 0 BytePerRecord DD 0 DATA_46 DD 0 SectorPerRecord DD 0 Booting: MOV AX,CS MOV DS,AX SHL AX,4 CLI MOV SP,AX ; Initalize stack STI ; Enable interrupts CALL GetCHSMaxSectorNum MOVZX EAX,WORD PTR [BytePerSector] MOVZX EBX,BYTE PTR [SectorPerCluster] MUL EBX MOV [BytePerCluster],EAX MOV ECX,[ClusterPerFRS] CMP CL,0 JG NEAR PTR IsMFTSize NEG CL MOV EAX,1 SHL EAX,CL JMP SHORT LOC_14 DB 90H IsMFTSize: MOV EAX,BytePerCluster MUL ECX LOC_14: MOV [MFTSize],EAX MOVZX EBX,WORD PTR [BytePerSector] XOR EDX,EDX DIV EBX MOV [MFTSizeBySector],EAX ; Count sector number occurpied by MFT CALL FindLastMFT MOV ECX,[ParamTailPoint] MOV [TempRootBuffer],ECX ADD ECX,[MFTSize] MOV [TempDirBuffer],ECX ADD ECX,[MFTSize] MOV [TempBitmapBuf],ECX ADD ECX,[MFTSize] MOV [TempMFT],ECX ADD ECX,[MFTSize] MOV [TempDataBuf],ECX MOV EAX,90H MOV ECX,[TempRootBuffer] CALL GetAttributePos OR EAX,EAX JZ FatalFault MOV [RootAttribute],EAX MOV EAX,0A0H MOV ECX,[TempDirBuffer] CALL GetAttributePos MOV [DirEnt |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
