filesystem
import "github.com/TheManticoreProject/Manticore/windows/filesystem"
Package filesystem holds Windows file-system data structures used over SMB and by the local file-system APIs.
Today it implements the [MS-FSCC] information classes exchanged via SMB2 QUERY_INFO / SET_INFO (and locally by NtQueryInformationFile / NtSetInformationFile) — the FILE_*_INFORMATION and FILE_FS_*_INFORMATION structures. The class numbers that select them live in the infoclass subpackage. More file-system structures (reparse points, EAs, control codes, …) can be added here as they are needed.
Index
- Constants
- type FileAction
- type FileAllInformation
- type FileBasicInformation
- type FileBothDirectoryInformation
- type FileDispositionInformation
- type FileEndOfFileInformation
- type FileFsAttributeInformation
- type FileFsDeviceInformation
- type FileFsFullSizeInformation
- type FileFsSizeInformation
- type FileFsVolumeInformation
- type FileFullDirectoryInformation
- type FileIdBothDirectoryInformation
- type FileNamesInformation
- type FileNetworkOpenInformation
- type FileNotifyInformation
- type FileRenameInformation
- type FileStandardInformation
Constants
FSCTL control codes carried in an SMB2 IOCTL request (with the SMB2_0_IOCTL_IS_FSCTL flag) or issued locally via DeviceIoControl.
[MS-FSCC] 2.3 FSCTL Structures: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/9d34c7c6-c0f6-46b4-9c00-c8b78f3b3041
const (
// FSCTL_PIPE_TRANSCEIVE writes a message to a named pipe and reads the reply in
// a single round-trip — the basis of DCE/RPC over SMB2 (ncacn_np).
FSCTL_PIPE_TRANSCEIVE uint32 = 0x0011C017
// FSCTL_PIPE_WAIT waits for a named-pipe instance to become available.
FSCTL_PIPE_WAIT uint32 = 0x00110018
// FSCTL_PIPE_PEEK reads data from a named pipe without removing it.
FSCTL_PIPE_PEEK uint32 = 0x0011400C
// FSCTL_DFS_GET_REFERRALS requests the DFS referrals for a path.
FSCTL_DFS_GET_REFERRALS uint32 = 0x00060194
FSCTL_DFS_GET_REFERRALS_EX uint32 = 0x000601B0
// FSCTL_VALIDATE_NEGOTIATE_INFO confirms the negotiated dialect/capabilities
// were not tampered with (SMB 3.x).
FSCTL_VALIDATE_NEGOTIATE_INFO uint32 = 0x00140204
// Server-side copy.
FSCTL_SRV_REQUEST_RESUME_KEY uint32 = 0x00140078
FSCTL_SRV_COPYCHUNK uint32 = 0x001440F2
FSCTL_SRV_COPYCHUNK_WRITE uint32 = 0x001480F2
FSCTL_SRV_ENUMERATE_SNAPSHOTS uint32 = 0x00144064
// Reparse points.
FSCTL_GET_REPARSE_POINT uint32 = 0x000900A8
FSCTL_SET_REPARSE_POINT uint32 = 0x000900A4
)
CompletionFilter flags for a directory change notification: the set of changes to report (SMB2 CHANGE_NOTIFY CompletionFilter / FILE_NOTIFY_CHANGE_*).
[MS-SMB2] 2.2.35 SMB2 CHANGE_NOTIFY Request: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/598f395a-e7a2-4cc8-afb3-ccb30dd2df7c
const (
FILE_NOTIFY_CHANGE_FILE_NAME uint32 = 0x00000001
FILE_NOTIFY_CHANGE_DIR_NAME uint32 = 0x00000002
FILE_NOTIFY_CHANGE_ATTRIBUTES uint32 = 0x00000004
FILE_NOTIFY_CHANGE_SIZE uint32 = 0x00000008
FILE_NOTIFY_CHANGE_LAST_WRITE uint32 = 0x00000010
FILE_NOTIFY_CHANGE_LAST_ACCESS uint32 = 0x00000020
FILE_NOTIFY_CHANGE_CREATION uint32 = 0x00000040
FILE_NOTIFY_CHANGE_EA uint32 = 0x00000080
FILE_NOTIFY_CHANGE_SECURITY uint32 = 0x00000100
FILE_NOTIFY_CHANGE_STREAM_NAME uint32 = 0x00000200
FILE_NOTIFY_CHANGE_STREAM_SIZE uint32 = 0x00000400
FILE_NOTIFY_CHANGE_STREAM_WRITE uint32 = 0x00000800
)
FileBasicInformationSize is the fixed wire size of FILE_BASIC_INFORMATION.
const FileBasicInformationSize = 40
FileFsDeviceInformationSize is the fixed wire size of FILE_FS_DEVICE_INFORMATION.
const FileFsDeviceInformationSize = 8
FileFsFullSizeInformationSize is the fixed wire size of FILE_FS_FULL_SIZE_INFORMATION.
const FileFsFullSizeInformationSize = 32
FileFsSizeInformationSize is the fixed wire size of FILE_FS_SIZE_INFORMATION.
const FileFsSizeInformationSize = 24
FileNetworkOpenInformationSize is the fixed wire size of FILE_NETWORK_OPEN_INFORMATION.
const FileNetworkOpenInformationSize = 56
FileStandardInformationSize is the fixed wire size of FILE_STANDARD_INFORMATION.
const FileStandardInformationSize = 24
type FileAction
FileAction is the change reported for a directory entry in a FILE_NOTIFY_INFORMATION record.
type FileAction uint32
const (
FileActionAdded FileAction = 0x00000001
FileActionRemoved FileAction = 0x00000002
FileActionModified FileAction = 0x00000003
FileActionRenamedOldName FileAction = 0x00000004
FileActionRenamedNewName FileAction = 0x00000005
)
func (FileAction) String
func (a FileAction) String() string
String renders the action name.
type FileAllInformation
FileAllInformation is FILE_ALL_INFORMATION (FileInformationClass 18): the aggregate query result combining the Basic, Standard, Internal, EA, Access, Position, Mode, Alignment, and Name information classes for an open file.
The small single-field classes are flattened into scalar fields here: IndexNumber (FILE_INTERNAL_INFORMATION), EaSize (FILE_EA_INFORMATION), AccessFlags (FILE_ACCESS_INFORMATION), CurrentByteOffset (FILE_POSITION_INFORMATION), Mode (FILE_MODE_INFORMATION), and AlignmentRequirement (FILE_ALIGNMENT_INFORMATION). FileName is the FILE_NAME_INFORMATION value (UTF-16LE on the wire).
[MS-FSCC] 2.4.2 FileAllInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/95f3056a-ebc1-4f5d-b938-3f68a44677a6
type FileAllInformation struct {
Basic FileBasicInformation
Standard FileStandardInformation
IndexNumber int64 // FILE_INTERNAL_INFORMATION
EaSize uint32 // FILE_EA_INFORMATION
AccessFlags uint32 // FILE_ACCESS_INFORMATION
CurrentByteOffset int64 // FILE_POSITION_INFORMATION
Mode uint32 // FILE_MODE_INFORMATION
AlignmentRequirement uint32 // FILE_ALIGNMENT_INFORMATION
FileName string // FILE_NAME_INFORMATION
}
func (*FileAllInformation) Marshal
func (fi *FileAllInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its wire form (fixed prefix + FileName).
func (*FileAllInformation) Unmarshal
func (fi *FileAllInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form. A buffer carrying only the fixed prefix (FileNameLength 0 or a truncated name) yields an empty FileName.
type FileBasicInformation
FileBasicInformation is FILE_BASIC_INFORMATION (FileInformationClass 4): the timestamps and attributes of a file. FILETIME fields are 100ns ticks since 1601-01-01 UTC. Fixed 40-byte wire layout.
[MS-FSCC] 2.4.7 FileBasicInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/16023025-8a78-492f-8b96-c873b042ac50
type FileBasicInformation struct {
CreationTime uint64
LastAccessTime uint64
LastWriteTime uint64
ChangeTime uint64
FileAttributes uint32
Reserved uint32
}
func (*FileBasicInformation) Marshal
func (fi *FileBasicInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 40-byte wire form.
func (*FileBasicInformation) Unmarshal
func (fi *FileBasicInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileBothDirectoryInformation
FileBothDirectoryInformation is FILE_BOTH_DIR_INFORMATION (FileInformationClass 3): a FILE_FULL_DIR_INFORMATION entry plus the 8.3 short name.
[MS-FSCC] 2.4.8 FileBothDirectoryInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/270df317-9ba5-4ccb-ba00-8d22be139bc5
type FileBothDirectoryInformation struct {
NextEntryOffset uint32
FileIndex uint32
CreationTime uint64
LastAccessTime uint64
LastWriteTime uint64
ChangeTime uint64
EndOfFile int64
AllocationSize int64
FileAttributes uint32
EaSize uint32
ShortName string // 8.3 name, UTF-16LE, max 12 chars
FileName string
}
func ParseFileBothDirectoryInformationList
func ParseFileBothDirectoryInformationList(buf []byte) []FileBothDirectoryInformation
ParseFileBothDirectoryInformationList decodes a chained buffer of FILE_BOTH_DIR_INFORMATION entries.
func (*FileBothDirectoryInformation) Marshal
func (fi *FileBothDirectoryInformation) Marshal() ([]byte, error)
Marshal encodes a single entry (fixed prefix + FileName).
func (*FileBothDirectoryInformation) Unmarshal
func (fi *FileBothDirectoryInformation) Unmarshal(data []byte) error
Unmarshal decodes a single entry from the start of data.
type FileDispositionInformation
FileDispositionInformation is FILE_DISPOSITION_INFORMATION (FileInformationClass 13): marks a file for deletion when its last handle is closed.
[MS-FSCC] 2.4.11 FileDispositionInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/12c3dd1c-14f6-4229-9d29-75fb2cb392f6
type FileDispositionInformation struct {
DeletePending bool
}
func (*FileDispositionInformation) Marshal
func (fi *FileDispositionInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 1-byte wire form.
func (*FileDispositionInformation) Unmarshal
func (fi *FileDispositionInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileEndOfFileInformation
FileEndOfFileInformation is FILE_END_OF_FILE_INFORMATION (FileInformationClass 20): sets the logical end-of-file (size) of a file.
[MS-FSCC] 2.4.13 FileEndOfFileInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/75241cca-3167-472f-8058-a52d77c6bb17
type FileEndOfFileInformation struct {
EndOfFile int64
}
func (*FileEndOfFileInformation) Marshal
func (fi *FileEndOfFileInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 8-byte wire form.
func (*FileEndOfFileInformation) Unmarshal
func (fi *FileEndOfFileInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileFsAttributeInformation
FileFsAttributeInformation is FILE_FS_ATTRIBUTE_INFORMATION (FsInformationClass 5): the file system’s attribute flags, maximum component name length, and file system name. The fixed 12-byte prefix is followed by the UTF-16LE FileSystemName.
[MS-FSCC] 2.5.1 FileFsAttributeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/ebc7e6e5-4650-4e54-b17c-cf60f6fbeeaa
type FileFsAttributeInformation struct {
FileSystemAttributes uint32
MaximumComponentNameLength int32
FileSystemName string
}
func (*FileFsAttributeInformation) Marshal
func (fi *FileFsAttributeInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its wire form (fixed prefix + FileSystemName).
func (*FileFsAttributeInformation) Unmarshal
func (fi *FileFsAttributeInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileFsDeviceInformation
FileFsDeviceInformation is FILE_FS_DEVICE_INFORMATION (FsInformationClass 4): the underlying device type and its characteristics. Fixed 8-byte wire layout.
[MS-FSCC] 2.5.10 FileFsDeviceInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/616b66d5-b335-4e1c-8f87-b4a55e8d3e4a
type FileFsDeviceInformation struct {
DeviceType uint32
Characteristics uint32
}
func (*FileFsDeviceInformation) Marshal
func (fi *FileFsDeviceInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 8-byte wire form.
func (*FileFsDeviceInformation) Unmarshal
func (fi *FileFsDeviceInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileFsFullSizeInformation
FileFsFullSizeInformation is FILE_FS_FULL_SIZE_INFORMATION (FsInformationClass 7): like FileFsSizeInformation but distinguishing the caller’s available allocation units (quota-limited) from the volume’s actual free units. Fixed 32-byte wire layout.
[MS-FSCC] 2.5.4 FileFsFullSizeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/63768db7-9012-4209-8cca-00781e7322f5
type FileFsFullSizeInformation struct {
TotalAllocationUnits int64
CallerAvailableAllocationUnits int64
ActualAvailableAllocationUnits int64
SectorsPerAllocationUnit uint32
BytesPerSector uint32
}
func (*FileFsFullSizeInformation) Marshal
func (fi *FileFsFullSizeInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 32-byte wire form.
func (*FileFsFullSizeInformation) Unmarshal
func (fi *FileFsFullSizeInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileFsSizeInformation
FileFsSizeInformation is FILE_FS_SIZE_INFORMATION (FsInformationClass 3): the total/available allocation units and the sector geometry of a volume. Fixed 24-byte wire layout.
[MS-FSCC] 2.5.8 FileFsSizeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/e13e068c-e3a7-4dd4-bff4-87d57c30ac0c
type FileFsSizeInformation struct {
TotalAllocationUnits int64
AvailableAllocationUnits int64
SectorsPerAllocationUnit uint32
BytesPerSector uint32
}
func (*FileFsSizeInformation) AvailableBytes
func (fi *FileFsSizeInformation) AvailableBytes() uint64
AvailableBytes returns the free capacity of the volume in bytes.
func (*FileFsSizeInformation) TotalBytes
func (fi *FileFsSizeInformation) TotalBytes() uint64
TotalBytes returns the total capacity of the volume in bytes.
func (*FileFsSizeInformation) Unmarshal
func (fi *FileFsSizeInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileFsVolumeInformation
FileFsVolumeInformation is FILE_FS_VOLUME_INFORMATION (FsInformationClass 1): the volume creation time, serial number, label, and object-id support flag. VolumeCreationTime is a FILETIME (100ns ticks since 1601-01-01 UTC). The fixed 18-byte prefix is followed by the UTF-16LE VolumeLabel.
[MS-FSCC] 2.5.9 FileFsVolumeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/bf691378-c34e-4a13-976e-404ea1a87738
type FileFsVolumeInformation struct {
VolumeCreationTime uint64
VolumeSerialNumber uint32
SupportsObjects bool
VolumeLabel string
}
func (*FileFsVolumeInformation) Marshal
func (fi *FileFsVolumeInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its wire form (fixed prefix + VolumeLabel).
func (*FileFsVolumeInformation) Unmarshal
func (fi *FileFsVolumeInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileFullDirectoryInformation
FileFullDirectoryInformation is FILE_FULL_DIR_INFORMATION (FileInformationClass 2): a directory entry with timestamps, sizes, attributes, and EA size.
[MS-FSCC] 2.4.14 FileFullDirectoryInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/e6d24f0e-fa87-4d8d-aa9d-a30c5cf75c0e
type FileFullDirectoryInformation struct {
NextEntryOffset uint32
FileIndex uint32
CreationTime uint64
LastAccessTime uint64
LastWriteTime uint64
ChangeTime uint64
EndOfFile int64
AllocationSize int64
FileAttributes uint32
EaSize uint32
FileName string
}
func ParseFileFullDirectoryInformationList
func ParseFileFullDirectoryInformationList(buf []byte) []FileFullDirectoryInformation
ParseFileFullDirectoryInformationList decodes a chained buffer of FILE_FULL_DIR_INFORMATION entries.
func (*FileFullDirectoryInformation) Marshal
func (fi *FileFullDirectoryInformation) Marshal() ([]byte, error)
Marshal encodes a single entry (fixed prefix + FileName). NextEntryOffset is written verbatim; callers chaining entries set it themselves.
func (*FileFullDirectoryInformation) Unmarshal
func (fi *FileFullDirectoryInformation) Unmarshal(data []byte) error
Unmarshal decodes a single entry from the start of data.
type FileIdBothDirectoryInformation
FileIdBothDirectoryInformation is FILE_ID_BOTH_DIR_INFORMATION (FileInformationClass 37): a FILE_BOTH_DIR_INFORMATION entry plus the 64-bit file id.
[MS-FSCC] 2.4.17 FileIdBothDirectoryInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/9b0b9971-85aa-4651-8438-f1c4298bcb0d
type FileIdBothDirectoryInformation struct {
NextEntryOffset uint32
FileIndex uint32
CreationTime uint64
LastAccessTime uint64
LastWriteTime uint64
ChangeTime uint64
EndOfFile int64
AllocationSize int64
FileAttributes uint32
EaSize uint32
ShortName string
FileId uint64
FileName string
}
func ParseFileIdBothDirectoryInformationList
func ParseFileIdBothDirectoryInformationList(buf []byte) []FileIdBothDirectoryInformation
ParseFileIdBothDirectoryInformationList decodes a chained buffer of FILE_ID_BOTH_DIR_INFORMATION entries.
func (*FileIdBothDirectoryInformation) Marshal
func (fi *FileIdBothDirectoryInformation) Marshal() ([]byte, error)
Marshal encodes a single entry (fixed prefix + FileName).
func (*FileIdBothDirectoryInformation) Unmarshal
func (fi *FileIdBothDirectoryInformation) Unmarshal(data []byte) error
Unmarshal decodes a single entry from the start of data.
type FileNamesInformation
FileNamesInformation is FILE_NAMES_INFORMATION (FileInformationClass 12): a directory entry carrying only the file name.
[MS-FSCC] 2.4.26 FileNamesInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/a289f7a8-83d2-4927-8c88-b2d328dde5b5
type FileNamesInformation struct {
NextEntryOffset uint32
FileIndex uint32
FileName string
}
func ParseFileNamesInformationList
func ParseFileNamesInformationList(buf []byte) []FileNamesInformation
ParseFileNamesInformationList decodes a chained buffer of FILE_NAMES_INFORMATION entries.
func (*FileNamesInformation) Marshal
func (fi *FileNamesInformation) Marshal() ([]byte, error)
Marshal encodes a single entry (fixed prefix + FileName).
func (*FileNamesInformation) Unmarshal
func (fi *FileNamesInformation) Unmarshal(data []byte) error
Unmarshal decodes a single entry from the start of data.
type FileNetworkOpenInformation
FileNetworkOpenInformation is FILE_NETWORK_OPEN_INFORMATION (FileInformationClass 34): the timestamps, sizes, and attributes returned for a network-open query, equivalent to the data a CREATE response carries. FILETIME fields are 100ns ticks since 1601-01-01 UTC. Fixed 56-byte wire layout.
[MS-FSCC] 2.4.29 FileNetworkOpenInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/b8e3957e-f16e-49b8-b8b1-58b9b22f3f54
type FileNetworkOpenInformation struct {
CreationTime uint64
LastAccessTime uint64
LastWriteTime uint64
ChangeTime uint64
AllocationSize int64
EndOfFile int64
FileAttributes uint32
Reserved uint32
}
func (*FileNetworkOpenInformation) Marshal
func (fi *FileNetworkOpenInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 56-byte wire form.
func (*FileNetworkOpenInformation) Unmarshal
func (fi *FileNetworkOpenInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileNotifyInformation
FileNotifyInformation is one FILE_NOTIFY_INFORMATION record: a change to a named entry within a watched directory.
[MS-FSCC] 2.7.1 FILE_NOTIFY_INFORMATION: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/634043d7-7b39-47e9-9e26-bda64685e4c9
type FileNotifyInformation struct {
Action FileAction
FileName string // directory-relative, backslash-separated
}
func ParseFileNotifyInformation
func ParseFileNotifyInformation(buf []byte) []FileNotifyInformation
ParseFileNotifyInformation decodes a buffer of chained FILE_NOTIFY_INFORMATION records (as returned by SMB2 CHANGE_NOTIFY) into FileNotifyInformation values. FileName is UTF-16LE.
type FileRenameInformation
FileRenameInformation is the SMB2 form of FILE_RENAME_INFORMATION (FileInformationClass 10): renames or moves a file. FileName is the new (share-relative) name; RootDirectory MUST be 0 for network operations.
[MS-FSCC] 2.4.34.2 FileRenameInformation for SMB2: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/52aa0b70-8094-4971-862d-79793f41e6a8
type FileRenameInformation struct {
ReplaceIfExists bool
RootDirectory uint64
FileName string
}
func (*FileRenameInformation) Marshal
func (fi *FileRenameInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its wire form: ReplaceIfExists(1) Reserved(7) RootDirectory(8) FileNameLength(4) FileName(UTF-16LE, not NUL-terminated).
func (*FileRenameInformation) Unmarshal
func (fi *FileRenameInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.
type FileStandardInformation
FileStandardInformation is FILE_STANDARD_INFORMATION (FileInformationClass 5): size, link count, and delete/directory flags. Fixed 24-byte wire layout.
[MS-FSCC] 2.4.41 FileStandardInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/5afa7f66-619c-48f3-955f-68c4ece704ae
type FileStandardInformation struct {
AllocationSize int64
EndOfFile int64
NumberOfLinks uint32
DeletePending bool
Directory bool
}
func (*FileStandardInformation) Marshal
func (fi *FileStandardInformation) Marshal() ([]byte, error)
Marshal encodes the structure to its 24-byte wire form.
func (*FileStandardInformation) Unmarshal
func (fi *FileStandardInformation) Unmarshal(data []byte) error
Unmarshal decodes the structure from its wire form.