ntfs 数据流

前几天看到了一片关于ntfs数据流的老文章，依此写了一个枚举文件中命名数据流的小软件，现在把源代码贴出来。

以下内容为程序代码:

// ntfs.cpp : Defines the entry point for the console application.
//

// 1.0.0.0: First version.
// 1.0.0.1: All error info output to stderr.
char* VERSION_INFO = "1.0.0.1";

//#include "stdafx.h"
#include <stdio.h>
#include <tchar.h>
#include <Windows.h>

void PrintUsage()
{
        printf("usage: nsinfo [-q][-p][-d] file/n/
  -q: query streams/n/
  -p: print stream/n/
  -d: delete stream/n/
  -v: version info/n"[img]/images/wink.gif[/img];
}

void QueryStreamInfo(_TCHAR* pszFilePath)
{
        WIN32_STREAM_ID wsid;
        ZeroMemory(&wsid, sizeof(WIN32_STREAM_ID));

        HANDLE hfile = CreateFile(pszFilePath/*"i://stream.txt"*/,
                                  GENERIC_READ,
                                  0,
                                  NULL,
                                  OPEN_EXISTING,
                                  0,
                                  0);

        if (hfile == INVALID_HANDLE_VALUE)
        {
                fprintf(stderr, "Cound not open file %s./n", pszFilePath);
                return;
        }

        DWORD dwStreamHeaderSize = (DWORD)((LPBYTE)&wsid.cStreamName - (LPBYTE)&wsid + wsid.dwStreamNameSize);

        LPBYTE lpContext = NULL;
        DWORD dwRead = 0;
        UINT unCounter = 0;
        BOOL bContinue = TRUE;

        while(bContinue)
        {
                bContinue = BackupRead(hfile, (LPBYTE)&wsid, dwStreamHeaderSize, &dwRead, FALSE, FALSE, (LPVOID*)&lpContext);
                if (!bContinue)
                {
                        break;
                }
                WCHAR szStreamname[MAX_PATH] = L"/0";
                bContinue = BackupRead(hfile,
                        (LPBYTE)szStreamname,
                        wsid.dwStreamNameSize,
                        &dwRead,
                        FALSE,
                        FALSE,
                        (LPVOID*)&lpContext);
                if (!bContinue || dwRead == 0)
                {
                        break;
                }
                wprintf(L"%s/n", szStreamname);
                unCounter++;

                DWORD dw1, dw2;
                bContinue = BackupSeek(hfile, wsid.Size.LowPart, wsid.Size.HighPart, &dw1, &dw2, (LPVOID*)&lpContext);
        }
        if (unCounter == 1)
        {
                printf("There is only %d named streams in %s./n", unCounter, pszFilePath);
        } else {
                printf("There are %d named streams in %s./n", unCounter, pszFilePath);
        }
}

void ReadStreamInfo(_TCHAR* pszFilePath)
{
        HANDLE hfile = CreateFile(pszFilePath/*"i://stream.txt"*/,
                                  GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, 0);

        if (hfile == INVALID_HANDLE_VALUE)
        {
                fprintf(stderr, "Cound not open file %s./n", pszFilePath);
                return;
        }
        DWORD dwReaded = 1;
        BOOL bReault = TRUE;
        while (bReault && dwReaded != 0)
        {
                BYTE szBuffer[512] = "/0";
                bReault = ReadFile(hfile, szBuffer, 510, &dwReaded, NULL);
                printf("%s", szBuffer);
        }
}

int _tmain(int argc, _TCHAR* argv[])
{
        _TCHAR *pszFilePath = NULL;
        BOOL bDeleteStream = FALSE;
        BOOL bQueryStream = FALSE;
        BOOL bReadStream = FALSE;
       
        // do with the params
        if (argc == 1)
        {
                PrintUsage();
        }
        if (argc == 2)  //default enable query option.
        {
                bQueryStream = TRUE;
        }

        for (int i = 1; i < argc; i++)
        {
                if (argv[i][0] == '-')
                {
                        switch(argv[i][1]) {
                        case 'd':
                                bDeleteStream = TRUE;
                         break;
                        case 'p':
                                bReadStream = TRUE;
                                break;
                        case 'q':
                                bQueryStream = TRUE;
                                break;
                        case 'v':
                                printf("nsinfo: show named streams under ntfs(win2k, or above)./nVersion: %s/n",
                                       VERSION_INFO);
                                printf("Author: WilliamX/nEmail: sam.feng@sohu.com/n"[img]/images/wink.gif[/img];
                                break;
                        default:
                                break;
                        }
                } else {
                       pszFilePath = argv[i];
                }
        }
        // do with the params

        if (pszFilePath == NULL)
        {
                return 0;
        }
        // delete file or stream
        if (bDeleteStream)
        {
                if (DeleteFile(pszFilePath))
                {
                        printf("Delete %s OK./n", pszFilePath);
                } else {
                        printf("Delete %s Failed./n", pszFilePath);
                }
        }

        if (bQueryStream)
        {
                QueryStreamInfo(pszFilePath);
        }

        if (bReadStream)
        {
                ReadStreamInfo(pszFilePath);
        }
return 0;
}