Lines Matching defs:buf
214 char *buf;
232 buf = buffer->block.data;
234 if ((buf[xusa] == buf[j*NTFSBLKLTH - 2])
235 && (buf[xusa+1] == buf[j*NTFSBLKLTH - 1])) {
236 buf[j*NTFSBLKLTH - 2] = buf[xusa + 2*j];
237 buf[j*NTFSBLKLTH - 1] = buf[xusa + 2*j + 1];
389 void hexdump(const char *buf, unsigned int lth)
397 printf((j & 3 ? "%02x" : " %02x"),buf[j] & 255);
400 if ((buf[j] > 0x20) && (buf[j] < 0x7f))
401 printf("%c",buf[j]);
932 static u16 searchlikely(const struct BUFFER *buf)
940 data = buf->block.data;
941 k = buf->headsz;
971 static u16 firstrecord(int skipped, const struct BUFFER *buf,
983 rph = &buf->block.record;
984 data = buf->block.data;
1018 k = searchlikely(buf);
1052 k = buf->headsz;
1061 (int)buf->num, (int)k);
1070 if (k && prevbuf && (prevbuf->num > buf->num)) {
1079 k = searchlikely(buf);
1097 static const struct BUFFER *findprevious(CONTEXT *ctx, const struct BUFFER *buf)
1109 prevblk = buf->num;
1120 rph = &buf->block.record;
1174 void copy_attribute(struct ATTR *pa, const char *buf, int length)
1182 panew = (const ATTR_NEW*)buf;
1189 memcpy(&old_aligned,buf,sizeof(old_aligned));
1206 const char *buf;
1218 buf = ((const char*)logr) + get_redo_offset(logr);
1229 len = fixnamelen(&buf[extra], len);
1235 copy_attribute(pa, buf, length);
1238 memcpy(pa->name,&buf[extra],len);
1244 step = getle16(buf, 8);
1245 used = getle16(buf, 12);
1253 copy_attribute(pa, buf + i, step);
1262 len = getle16(buf, i + 2);
1263 key = getle16(buf, i);
1276 &buf[i+4],len);
1295 static void fixup(CONTEXT *ctx, const LOG_RECORD *logr, const char *buf,
1341 mftrecsz = (getle16(buf,6) - 1)*512;
1353 printf(" seq number 0x%04x\n",(int)getle16(buf, 16));
1355 printf(" link count %d\n",(int)getle16(buf, 18));
1359 flags = getle16(buf, 22);
1373 base = getle16(buf, 4) + ((getle16(buf, 6)*2 - 1) | 7) + 1;
1375 mftattr = feedle32(buf, base);
1380 showname(" name ",&buf[base + 90],
1381 buf[base + 88] & 255);
1382 inode = feedle64(buf, base + 24);
1386 lth = getle32(buf, base + 4);
1404 switch (getle32(buf,0)) {
1410 &buf[base + 66],buf[base + 64] & 255);
1412 showdate(" created ",feedle64(buf,base + 8));
1414 showdate(" modified ",feedle64(buf,base + 16));
1416 showdate(" changed ",feedle64(buf,base + 24));
1418 showdate(" read ",feedle64(buf,base + 32));
1419 size = feedle64(buf,base + 40);
1422 size = feedle64(buf,base + 48);
1425 v = feedle32(buf,base + 56);
1436 printf(" tag 0x%lx\n",(long)getle32(buf, base));
1438 &buf[base + 20 + getle16(buf, base + 12)],
1439 getle16(buf, base + 14)/2);
1465 feedle64(buf,base));
1468 feedle64(buf,base + 8));
1471 feedle64(buf,base + 16));
1474 feedle64(buf,base + 24));
1476 v = feedle32(buf, base + 32);
1481 v = feedle32(buf, base + 52);
1490 memcpy(&w, &buf[base + 64], 8);
1511 (long)getle32(buf, 0));
1514 (long)getle32(buf, 4));
1517 (long)getle32(buf, 16));
1520 if (!memcmp(buf, "INDX", 4))
1524 inode = feedle64(buf, base);
1527 inode = feedle64(buf, base + 16);
1530 showname(" file ",&buf[base + 82],
1531 buf[base + 80] & 255);
1532 showdate(" date ",feedle64(buf, base + 32));
1544 size = feedle64(buf,0);
1546 size = feedle64(buf,8);
1548 size = feedle64(buf,16);
1566 p = getle16(buf, base + 8);
1570 memcpy(&inode, &buf[base + 20], 8); /* bad align */
1575 (long)getle32(buf, 16));
1580 (long)getle32(buf, 16));
1582 (long)getle32(buf, 20));
1587 (long)getle32(buf, 20));
1589 (long)getle32(buf, 16));
1594 lth = buf[base + 80] & 255;
1596 if (getle16(buf,10) == (u32)(2*lth + 66)) {
1598 inode = feedle64(buf,16);
1601 if (feedle32(buf,72)
1604 &buf[base + 82],
1605 buf[base + 80] & 255);
1608 &buf[base + 82],
1609 buf[base + 80] & 255);
1610 inode = feedle64(buf,0);
1613 size = feedle64(buf,64);
1617 feedle64(buf,base + 24));
1619 feedle64(buf,base + 32));
1621 feedle64(buf,base + 40));
1623 feedle64(buf,base + 48));
1635 printf(" vcn %lld\n", (long long)getle64(buf,0));
1654 showdate(" created ",feedle64(buf,
1657 showdate(" modified ",feedle64(buf,
1660 showdate(" changed ",feedle64(buf,
1663 showdate(" read ",feedle64(buf,
1666 size = feedle64(buf,base + 56);
1671 size = feedle64(buf,base + 64);
1676 v = feedle32(buf,base + 72);
1695 showdate(" created ",feedle64(buf, base + 8));
1697 showdate(" modified ",feedle64(buf, base + 16));
1699 showdate(" changed ",feedle64(buf, base + 24));
1701 showdate(" read ",*(const le64*)&buf[base + 32]);
1703 size = feedle64(buf, base + 40);
1708 size = feedle64(buf, base + 48);
1713 v = feedle32(buf, base + 56);
1728 v = feedle32(buf, 0);
1730 v = feedle32(buf, 4);
1743 len = fixnamelen(&buf[extra], len);
1752 copy_attribute(pa, buf, length);
1755 memcpy(pa->name,&buf[extra],len);
1765 showname(" extra : attr name ", &buf[extra], len/2);
1780 step = getle16(buf, 8);
1781 used = getle16(buf, 12);
1794 copy_attribute(pa, &buf[i], step);
1828 l = le16_to_cpu(*(const le16*)&buf[i+2]);
1829 key = le16_to_cpu(*(const le16*)&buf[i]);
1840 memcpy(pa->name,&buf[i+4],l);
1844 showname(" ",&buf[i+4],l/2);
2453 static u16 overlapshow(CONTEXT *ctx, u16 k, u32 blk, const struct BUFFER *buf,
2466 data = buf->block.data;
2469 blkheadsz = buf->headsz;
2579 if (firstrecord(skip,buf,buf) != next)
2613 const struct BUFFER *buf, const struct BUFFER *nextbuf)
2622 rph = &buf->block.record;
2624 data = buf->block.data;
2626 k = buf->headsz;
2637 k = searchlikely(buf);
2663 (long)size, (long)buf->num, (int)k);
2693 buf, nextbuf);
2921 const struct BUFFER *buf;
2940 buf = read_buffer(ctx,0);
2942 buf = (const struct BUFFER*)NULL;
2946 buf = (const struct BUFFER*)NULL;
2953 buf = read_buffer(ctx,0);
2955 if (buf) {
2958 magic = buf->block.restart.magic;
2976 dorest(ctx, 0, &buf->block.restart, TRUE);
2977 major = sle16_to_cpu(buf->block.restart.major_ver);
2978 minor = sle16_to_cpu(buf->block.restart.minor_ver);
2995 buf = (const struct BUFFER*)NULL;
2998 return (buf);
3044 static const struct BUFFER *best_start(const struct BUFFER *buf,
3052 if (!buf || !altbuf)
3053 best = (buf ? buf : altbuf);
3055 head = &buf->block.record;
3063 best = buf;
3076 static BOOL getboot(const char *buf)
3085 bytespersect = (buf[11] & 255) + ((buf[12] & 255) << 8);
3086 sectpercluster = buf[13] & 255;
3091 sectors = getle64(buf, 0x28);
3093 mftlcn = getle64(buf, 0x30);
3094 if (buf[0x40] & 0x80)
3095 mftrecsz = 1 << (16 - (buf[0x40] & 15));
3097 mftrecsz = (buf[0x40] & 127)*clustersz;
3268 char buf[1024];
3285 got = fread(boot.buf,1,1024,ctx->file);
3287 && (!memcmp(boot.buf, "RSTR", 4)
3288 || !memcmp(boot.buf, "CHKD", 4))) {
3291 ok = getvolumedata(ctx, boot.buf);
3307 ok = getvolumedata(ctx, boot.buf);
3316 static u16 dorcrd(CONTEXT *ctx, u32 blk, u16 pos, const struct BUFFER *buf,
3321 hexdump(buf->block.data,blocksz);
3330 return (forward_rcrd(ctx, blk, pos, buf, nextbuf));
3433 const struct BUFFER *buf, const struct BUFFER *prevbuf,
3451 rph = &buf->block.record;
3455 data = buf->block.data;
3461 if (buf->rnum != blk)
3464 (long)blk,(long)blk,(long)buf->rnum,
3476 k = buf->headsz;
3478 k = firstrecord(skipped, buf, prevbuf);
3496 k = searchlikely(buf);
3583 static int walkback(CONTEXT *ctx, const struct BUFFER *buf, u32 blk,
3592 if ((log_major >= 2) && (buf->rnum != blk))
3594 (int)buf->rnum,(int)blk,
3595 (long long)loclogblk(ctx, buf->rnum));
3604 state = backward_rcrd(ctx, blk, 0, buf,
3611 nextbuf = buf;
3612 buf = prevbuf;
3615 prevbuf = findprevious(ctx, buf);
3648 && (buf->rnum != blk))
3650 (long)buf->rnum,
3653 ctx,buf->rnum));
3661 buf, prevbuf, nextbuf);
3758 const struct BUFFER *buf;
3772 buf = read_buffer(ctx, blk);
3773 if (buf && (buf->block.record.magic == magic_RCRD)) {
3775 buf->block.record.copy.last_lsn);
3781 buf = read_buffer(ctx, blk + (BASEBLKS2 - RSTBLKS)/2);
3783 if (buf && (buf->block.record.magic == magic_RCRD)) {
3785 buf->block.record.copy.last_lsn);
3810 buf = read_buffer(ctx, target_blk);
3811 if (buf && (buf->block.record.magic == magic_RCRD)) {
3813 buf->block.record.copy.last_lsn);
3840 const struct BUFFER *buf;
3857 buf = (struct BUFFER*)NULL;
3869 buf = read_restart(ctx);
3870 if (buf) {
3901 magic = buf->block.record.magic;
3905 dirty = dorest(ctx, blk, &buf->block.restart,
3910 pos = buf->headsz;
3911 pos = dorcrd(ctx, blk, pos, buf, nextbuf);
3982 buf = nextbuf;
3984 /* The latest buf may be more recent
3986 rph = &buf->block.record;
4012 buf = nextbuf;
4014 startbuf = best_start(buf,nextbuf);
4017 if (optv && buf) {
4022 hexdump(buf->block.data,
4024 showheadrcrd(blk, &buf->block.record);
4027 buf = nextbuf;
4029 /* buf is better, show blk + 1 */
4043 buf = startbuf = find_latest_block(ctx,
4046 buf->block.record.last_end_lsn);
4049 buf = startbuf = read_buffer(ctx, blk);
4053 /* The latest buf may be more recent than restart */
4054 rph = &buf->block.record;
4062 prevbuf = findprevious(ctx, buf);
4085 err = walkback(ctx, buf, blk,