Generated from Manticore v1.1.5 • 201 packages. View on pkg.go.dev

filesystem

import "github.com/TheManticoreProject/Manticore/windows/filesystem"

Package filesystem holds Windows file-system data structures used over SMB and by the local file-system APIs.

Today it implements the [MS-FSCC] information classes exchanged via SMB2 QUERY_INFO / SET_INFO (and locally by NtQueryInformationFile / NtSetInformationFile) — the FILE_*_INFORMATION and FILE_FS_*_INFORMATION structures. The class numbers that select them live in the infoclass subpackage. More file-system structures (reparse points, EAs, control codes, …) can be added here as they are needed.

Index

Constants

FSCTL control codes carried in an SMB2 IOCTL request (with the SMB2_0_IOCTL_IS_FSCTL flag) or issued locally via DeviceIoControl.

[MS-FSCC] 2.3 FSCTL Structures: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/9d34c7c6-c0f6-46b4-9c00-c8b78f3b3041

const (
    // FSCTL_PIPE_TRANSCEIVE writes a message to a named pipe and reads the reply in
    // a single round-trip — the basis of DCE/RPC over SMB2 (ncacn_np).
    FSCTL_PIPE_TRANSCEIVE uint32 = 0x0011C017
    // FSCTL_PIPE_WAIT waits for a named-pipe instance to become available.
    FSCTL_PIPE_WAIT uint32 = 0x00110018
    // FSCTL_PIPE_PEEK reads data from a named pipe without removing it.
    FSCTL_PIPE_PEEK uint32 = 0x0011400C

    // FSCTL_DFS_GET_REFERRALS requests the DFS referrals for a path.
    FSCTL_DFS_GET_REFERRALS    uint32 = 0x00060194
    FSCTL_DFS_GET_REFERRALS_EX uint32 = 0x000601B0

    // FSCTL_VALIDATE_NEGOTIATE_INFO confirms the negotiated dialect/capabilities
    // were not tampered with (SMB 3.x).
    FSCTL_VALIDATE_NEGOTIATE_INFO uint32 = 0x00140204

    // Server-side copy.
    FSCTL_SRV_REQUEST_RESUME_KEY  uint32 = 0x00140078
    FSCTL_SRV_COPYCHUNK           uint32 = 0x001440F2
    FSCTL_SRV_COPYCHUNK_WRITE     uint32 = 0x001480F2
    FSCTL_SRV_ENUMERATE_SNAPSHOTS uint32 = 0x00144064

    // Reparse points.
    FSCTL_GET_REPARSE_POINT uint32 = 0x000900A8
    FSCTL_SET_REPARSE_POINT uint32 = 0x000900A4
)

CompletionFilter flags for a directory change notification: the set of changes to report (SMB2 CHANGE_NOTIFY CompletionFilter / FILE_NOTIFY_CHANGE_*).

[MS-SMB2] 2.2.35 SMB2 CHANGE_NOTIFY Request: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/598f395a-e7a2-4cc8-afb3-ccb30dd2df7c

const (
    FILE_NOTIFY_CHANGE_FILE_NAME    uint32 = 0x00000001
    FILE_NOTIFY_CHANGE_DIR_NAME     uint32 = 0x00000002
    FILE_NOTIFY_CHANGE_ATTRIBUTES   uint32 = 0x00000004
    FILE_NOTIFY_CHANGE_SIZE         uint32 = 0x00000008
    FILE_NOTIFY_CHANGE_LAST_WRITE   uint32 = 0x00000010
    FILE_NOTIFY_CHANGE_LAST_ACCESS  uint32 = 0x00000020
    FILE_NOTIFY_CHANGE_CREATION     uint32 = 0x00000040
    FILE_NOTIFY_CHANGE_EA           uint32 = 0x00000080
    FILE_NOTIFY_CHANGE_SECURITY     uint32 = 0x00000100
    FILE_NOTIFY_CHANGE_STREAM_NAME  uint32 = 0x00000200
    FILE_NOTIFY_CHANGE_STREAM_SIZE  uint32 = 0x00000400
    FILE_NOTIFY_CHANGE_STREAM_WRITE uint32 = 0x00000800
)

FileBasicInformationSize is the fixed wire size of FILE_BASIC_INFORMATION.

const FileBasicInformationSize = 40

FileFsDeviceInformationSize is the fixed wire size of FILE_FS_DEVICE_INFORMATION.

const FileFsDeviceInformationSize = 8

FileFsFullSizeInformationSize is the fixed wire size of FILE_FS_FULL_SIZE_INFORMATION.

const FileFsFullSizeInformationSize = 32

FileFsSizeInformationSize is the fixed wire size of FILE_FS_SIZE_INFORMATION.

const FileFsSizeInformationSize = 24

FileNetworkOpenInformationSize is the fixed wire size of FILE_NETWORK_OPEN_INFORMATION.

const FileNetworkOpenInformationSize = 56

FileStandardInformationSize is the fixed wire size of FILE_STANDARD_INFORMATION.

const FileStandardInformationSize = 24

type FileAction

FileAction is the change reported for a directory entry in a FILE_NOTIFY_INFORMATION record.

type FileAction uint32
const (
    FileActionAdded          FileAction = 0x00000001
    FileActionRemoved        FileAction = 0x00000002
    FileActionModified       FileAction = 0x00000003
    FileActionRenamedOldName FileAction = 0x00000004
    FileActionRenamedNewName FileAction = 0x00000005
)

func (FileAction) String

func (a FileAction) String() string

String renders the action name.

type FileAllInformation

FileAllInformation is FILE_ALL_INFORMATION (FileInformationClass 18): the aggregate query result combining the Basic, Standard, Internal, EA, Access, Position, Mode, Alignment, and Name information classes for an open file.

The small single-field classes are flattened into scalar fields here: IndexNumber (FILE_INTERNAL_INFORMATION), EaSize (FILE_EA_INFORMATION), AccessFlags (FILE_ACCESS_INFORMATION), CurrentByteOffset (FILE_POSITION_INFORMATION), Mode (FILE_MODE_INFORMATION), and AlignmentRequirement (FILE_ALIGNMENT_INFORMATION). FileName is the FILE_NAME_INFORMATION value (UTF-16LE on the wire).

[MS-FSCC] 2.4.2 FileAllInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/95f3056a-ebc1-4f5d-b938-3f68a44677a6

type FileAllInformation struct {
    Basic                FileBasicInformation
    Standard             FileStandardInformation
    IndexNumber          int64  // FILE_INTERNAL_INFORMATION
    EaSize               uint32 // FILE_EA_INFORMATION
    AccessFlags          uint32 // FILE_ACCESS_INFORMATION
    CurrentByteOffset    int64  // FILE_POSITION_INFORMATION
    Mode                 uint32 // FILE_MODE_INFORMATION
    AlignmentRequirement uint32 // FILE_ALIGNMENT_INFORMATION
    FileName             string // FILE_NAME_INFORMATION
}

func (*FileAllInformation) Marshal

func (fi *FileAllInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its wire form (fixed prefix + FileName).

func (*FileAllInformation) Unmarshal

func (fi *FileAllInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form. A buffer carrying only the fixed prefix (FileNameLength 0 or a truncated name) yields an empty FileName.

type FileBasicInformation

FileBasicInformation is FILE_BASIC_INFORMATION (FileInformationClass 4): the timestamps and attributes of a file. FILETIME fields are 100ns ticks since 1601-01-01 UTC. Fixed 40-byte wire layout.

[MS-FSCC] 2.4.7 FileBasicInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/16023025-8a78-492f-8b96-c873b042ac50

type FileBasicInformation struct {
    CreationTime   uint64
    LastAccessTime uint64
    LastWriteTime  uint64
    ChangeTime     uint64
    FileAttributes uint32
    Reserved       uint32
}

func (*FileBasicInformation) Marshal

func (fi *FileBasicInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 40-byte wire form.

func (*FileBasicInformation) Unmarshal

func (fi *FileBasicInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileBothDirectoryInformation

FileBothDirectoryInformation is FILE_BOTH_DIR_INFORMATION (FileInformationClass 3): a FILE_FULL_DIR_INFORMATION entry plus the 8.3 short name.

[MS-FSCC] 2.4.8 FileBothDirectoryInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/270df317-9ba5-4ccb-ba00-8d22be139bc5

type FileBothDirectoryInformation struct {
    NextEntryOffset uint32
    FileIndex       uint32
    CreationTime    uint64
    LastAccessTime  uint64
    LastWriteTime   uint64
    ChangeTime      uint64
    EndOfFile       int64
    AllocationSize  int64
    FileAttributes  uint32
    EaSize          uint32
    ShortName       string // 8.3 name, UTF-16LE, max 12 chars
    FileName        string
}

func ParseFileBothDirectoryInformationList

func ParseFileBothDirectoryInformationList(buf []byte) []FileBothDirectoryInformation

ParseFileBothDirectoryInformationList decodes a chained buffer of FILE_BOTH_DIR_INFORMATION entries.

func (*FileBothDirectoryInformation) Marshal

func (fi *FileBothDirectoryInformation) Marshal() ([]byte, error)

Marshal encodes a single entry (fixed prefix + FileName).

func (*FileBothDirectoryInformation) Unmarshal

func (fi *FileBothDirectoryInformation) Unmarshal(data []byte) error

Unmarshal decodes a single entry from the start of data.

type FileDispositionInformation

FileDispositionInformation is FILE_DISPOSITION_INFORMATION (FileInformationClass 13): marks a file for deletion when its last handle is closed.

[MS-FSCC] 2.4.11 FileDispositionInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/12c3dd1c-14f6-4229-9d29-75fb2cb392f6

type FileDispositionInformation struct {
    DeletePending bool
}

func (*FileDispositionInformation) Marshal

func (fi *FileDispositionInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 1-byte wire form.

func (*FileDispositionInformation) Unmarshal

func (fi *FileDispositionInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileEndOfFileInformation

FileEndOfFileInformation is FILE_END_OF_FILE_INFORMATION (FileInformationClass 20): sets the logical end-of-file (size) of a file.

[MS-FSCC] 2.4.13 FileEndOfFileInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/75241cca-3167-472f-8058-a52d77c6bb17

type FileEndOfFileInformation struct {
    EndOfFile int64
}

func (*FileEndOfFileInformation) Marshal

func (fi *FileEndOfFileInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 8-byte wire form.

func (*FileEndOfFileInformation) Unmarshal

func (fi *FileEndOfFileInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileFsAttributeInformation

FileFsAttributeInformation is FILE_FS_ATTRIBUTE_INFORMATION (FsInformationClass 5): the file system’s attribute flags, maximum component name length, and file system name. The fixed 12-byte prefix is followed by the UTF-16LE FileSystemName.

[MS-FSCC] 2.5.1 FileFsAttributeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/ebc7e6e5-4650-4e54-b17c-cf60f6fbeeaa

type FileFsAttributeInformation struct {
    FileSystemAttributes       uint32
    MaximumComponentNameLength int32
    FileSystemName             string
}

func (*FileFsAttributeInformation) Marshal

func (fi *FileFsAttributeInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its wire form (fixed prefix + FileSystemName).

func (*FileFsAttributeInformation) Unmarshal

func (fi *FileFsAttributeInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileFsDeviceInformation

FileFsDeviceInformation is FILE_FS_DEVICE_INFORMATION (FsInformationClass 4): the underlying device type and its characteristics. Fixed 8-byte wire layout.

[MS-FSCC] 2.5.10 FileFsDeviceInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/616b66d5-b335-4e1c-8f87-b4a55e8d3e4a

type FileFsDeviceInformation struct {
    DeviceType      uint32
    Characteristics uint32
}

func (*FileFsDeviceInformation) Marshal

func (fi *FileFsDeviceInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 8-byte wire form.

func (*FileFsDeviceInformation) Unmarshal

func (fi *FileFsDeviceInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileFsFullSizeInformation

FileFsFullSizeInformation is FILE_FS_FULL_SIZE_INFORMATION (FsInformationClass 7): like FileFsSizeInformation but distinguishing the caller’s available allocation units (quota-limited) from the volume’s actual free units. Fixed 32-byte wire layout.

[MS-FSCC] 2.5.4 FileFsFullSizeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/63768db7-9012-4209-8cca-00781e7322f5

type FileFsFullSizeInformation struct {
    TotalAllocationUnits           int64
    CallerAvailableAllocationUnits int64
    ActualAvailableAllocationUnits int64
    SectorsPerAllocationUnit       uint32
    BytesPerSector                 uint32
}

func (*FileFsFullSizeInformation) Marshal

func (fi *FileFsFullSizeInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 32-byte wire form.

func (*FileFsFullSizeInformation) Unmarshal

func (fi *FileFsFullSizeInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileFsSizeInformation

FileFsSizeInformation is FILE_FS_SIZE_INFORMATION (FsInformationClass 3): the total/available allocation units and the sector geometry of a volume. Fixed 24-byte wire layout.

[MS-FSCC] 2.5.8 FileFsSizeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/e13e068c-e3a7-4dd4-bff4-87d57c30ac0c

type FileFsSizeInformation struct {
    TotalAllocationUnits     int64
    AvailableAllocationUnits int64
    SectorsPerAllocationUnit uint32
    BytesPerSector           uint32
}

func (*FileFsSizeInformation) AvailableBytes

func (fi *FileFsSizeInformation) AvailableBytes() uint64

AvailableBytes returns the free capacity of the volume in bytes.

func (*FileFsSizeInformation) TotalBytes

func (fi *FileFsSizeInformation) TotalBytes() uint64

TotalBytes returns the total capacity of the volume in bytes.

func (*FileFsSizeInformation) Unmarshal

func (fi *FileFsSizeInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileFsVolumeInformation

FileFsVolumeInformation is FILE_FS_VOLUME_INFORMATION (FsInformationClass 1): the volume creation time, serial number, label, and object-id support flag. VolumeCreationTime is a FILETIME (100ns ticks since 1601-01-01 UTC). The fixed 18-byte prefix is followed by the UTF-16LE VolumeLabel.

[MS-FSCC] 2.5.9 FileFsVolumeInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/bf691378-c34e-4a13-976e-404ea1a87738

type FileFsVolumeInformation struct {
    VolumeCreationTime uint64
    VolumeSerialNumber uint32
    SupportsObjects    bool
    VolumeLabel        string
}

func (*FileFsVolumeInformation) Marshal

func (fi *FileFsVolumeInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its wire form (fixed prefix + VolumeLabel).

func (*FileFsVolumeInformation) Unmarshal

func (fi *FileFsVolumeInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileFullDirectoryInformation

FileFullDirectoryInformation is FILE_FULL_DIR_INFORMATION (FileInformationClass 2): a directory entry with timestamps, sizes, attributes, and EA size.

[MS-FSCC] 2.4.14 FileFullDirectoryInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/e6d24f0e-fa87-4d8d-aa9d-a30c5cf75c0e

type FileFullDirectoryInformation struct {
    NextEntryOffset uint32
    FileIndex       uint32
    CreationTime    uint64
    LastAccessTime  uint64
    LastWriteTime   uint64
    ChangeTime      uint64
    EndOfFile       int64
    AllocationSize  int64
    FileAttributes  uint32
    EaSize          uint32
    FileName        string
}

func ParseFileFullDirectoryInformationList

func ParseFileFullDirectoryInformationList(buf []byte) []FileFullDirectoryInformation

ParseFileFullDirectoryInformationList decodes a chained buffer of FILE_FULL_DIR_INFORMATION entries.

func (*FileFullDirectoryInformation) Marshal

func (fi *FileFullDirectoryInformation) Marshal() ([]byte, error)

Marshal encodes a single entry (fixed prefix + FileName). NextEntryOffset is written verbatim; callers chaining entries set it themselves.

func (*FileFullDirectoryInformation) Unmarshal

func (fi *FileFullDirectoryInformation) Unmarshal(data []byte) error

Unmarshal decodes a single entry from the start of data.

type FileIdBothDirectoryInformation

FileIdBothDirectoryInformation is FILE_ID_BOTH_DIR_INFORMATION (FileInformationClass 37): a FILE_BOTH_DIR_INFORMATION entry plus the 64-bit file id.

[MS-FSCC] 2.4.17 FileIdBothDirectoryInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/9b0b9971-85aa-4651-8438-f1c4298bcb0d

type FileIdBothDirectoryInformation struct {
    NextEntryOffset uint32
    FileIndex       uint32
    CreationTime    uint64
    LastAccessTime  uint64
    LastWriteTime   uint64
    ChangeTime      uint64
    EndOfFile       int64
    AllocationSize  int64
    FileAttributes  uint32
    EaSize          uint32
    ShortName       string
    FileId          uint64
    FileName        string
}

func ParseFileIdBothDirectoryInformationList

func ParseFileIdBothDirectoryInformationList(buf []byte) []FileIdBothDirectoryInformation

ParseFileIdBothDirectoryInformationList decodes a chained buffer of FILE_ID_BOTH_DIR_INFORMATION entries.

func (*FileIdBothDirectoryInformation) Marshal

func (fi *FileIdBothDirectoryInformation) Marshal() ([]byte, error)

Marshal encodes a single entry (fixed prefix + FileName).

func (*FileIdBothDirectoryInformation) Unmarshal

func (fi *FileIdBothDirectoryInformation) Unmarshal(data []byte) error

Unmarshal decodes a single entry from the start of data.

type FileNamesInformation

FileNamesInformation is FILE_NAMES_INFORMATION (FileInformationClass 12): a directory entry carrying only the file name.

[MS-FSCC] 2.4.26 FileNamesInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/a289f7a8-83d2-4927-8c88-b2d328dde5b5

type FileNamesInformation struct {
    NextEntryOffset uint32
    FileIndex       uint32
    FileName        string
}

func ParseFileNamesInformationList

func ParseFileNamesInformationList(buf []byte) []FileNamesInformation

ParseFileNamesInformationList decodes a chained buffer of FILE_NAMES_INFORMATION entries.

func (*FileNamesInformation) Marshal

func (fi *FileNamesInformation) Marshal() ([]byte, error)

Marshal encodes a single entry (fixed prefix + FileName).

func (*FileNamesInformation) Unmarshal

func (fi *FileNamesInformation) Unmarshal(data []byte) error

Unmarshal decodes a single entry from the start of data.

type FileNetworkOpenInformation

FileNetworkOpenInformation is FILE_NETWORK_OPEN_INFORMATION (FileInformationClass 34): the timestamps, sizes, and attributes returned for a network-open query, equivalent to the data a CREATE response carries. FILETIME fields are 100ns ticks since 1601-01-01 UTC. Fixed 56-byte wire layout.

[MS-FSCC] 2.4.29 FileNetworkOpenInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/b8e3957e-f16e-49b8-b8b1-58b9b22f3f54

type FileNetworkOpenInformation struct {
    CreationTime   uint64
    LastAccessTime uint64
    LastWriteTime  uint64
    ChangeTime     uint64
    AllocationSize int64
    EndOfFile      int64
    FileAttributes uint32
    Reserved       uint32
}

func (*FileNetworkOpenInformation) Marshal

func (fi *FileNetworkOpenInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 56-byte wire form.

func (*FileNetworkOpenInformation) Unmarshal

func (fi *FileNetworkOpenInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileNotifyInformation

FileNotifyInformation is one FILE_NOTIFY_INFORMATION record: a change to a named entry within a watched directory.

[MS-FSCC] 2.7.1 FILE_NOTIFY_INFORMATION: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/634043d7-7b39-47e9-9e26-bda64685e4c9

type FileNotifyInformation struct {
    Action   FileAction
    FileName string // directory-relative, backslash-separated
}

func ParseFileNotifyInformation

func ParseFileNotifyInformation(buf []byte) []FileNotifyInformation

ParseFileNotifyInformation decodes a buffer of chained FILE_NOTIFY_INFORMATION records (as returned by SMB2 CHANGE_NOTIFY) into FileNotifyInformation values. FileName is UTF-16LE.

type FileRenameInformation

FileRenameInformation is the SMB2 form of FILE_RENAME_INFORMATION (FileInformationClass 10): renames or moves a file. FileName is the new (share-relative) name; RootDirectory MUST be 0 for network operations.

[MS-FSCC] 2.4.34.2 FileRenameInformation for SMB2: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/52aa0b70-8094-4971-862d-79793f41e6a8

type FileRenameInformation struct {
    ReplaceIfExists bool
    RootDirectory   uint64
    FileName        string
}

func (*FileRenameInformation) Marshal

func (fi *FileRenameInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its wire form: ReplaceIfExists(1) Reserved(7) RootDirectory(8) FileNameLength(4) FileName(UTF-16LE, not NUL-terminated).

func (*FileRenameInformation) Unmarshal

func (fi *FileRenameInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

type FileStandardInformation

FileStandardInformation is FILE_STANDARD_INFORMATION (FileInformationClass 5): size, link count, and delete/directory flags. Fixed 24-byte wire layout.

[MS-FSCC] 2.4.41 FileStandardInformation: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/5afa7f66-619c-48f3-955f-68c4ece704ae

type FileStandardInformation struct {
    AllocationSize int64
    EndOfFile      int64
    NumberOfLinks  uint32
    DeletePending  bool
    Directory      bool
}

func (*FileStandardInformation) Marshal

func (fi *FileStandardInformation) Marshal() ([]byte, error)

Marshal encodes the structure to its 24-byte wire form.

func (*FileStandardInformation) Unmarshal

func (fi *FileStandardInformation) Unmarshal(data []byte) error

Unmarshal decodes the structure from its wire form.

Subpackages