Class: NTFS::AttributeList

Inherits:
Object
  • Object
show all
Defined in:
lib/fs/ntfs/attrib_attribute_list.rb

Overview

One $ATTRIBUTE_LIST attribute.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(buf, boot_sector) ⇒ AttributeList

Returns a new instance of AttributeList.



62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/fs/ntfs/attrib_attribute_list.rb', line 62

def initialize(buf, boot_sector)
  @boot_sector = boot_sector
  buf          = buf.read(buf.length) if buf.class.kind_of?(DataRun)

  # Start an attribute list.
  pos   = 0
  @list = []

  # Keep it up til we hit an AT_END type
  # OR until no more data - apparently the end of a list is not always marked.
  loop do
    break if pos + SIZEOF_ATTRIB_ATTRIBUTE_LIST > buf.length
    # Decode this attrib specifier.
    aal = ATTRIB_ATTRIBUTE_LIST.decode(buf[pos, SIZEOF_ATTRIB_ATTRIBUTE_LIST])

    break if aal['attrib_type'] == AT_END

    # If there's a name get it.
    len = aal['name_length'] * 2
    aal['name'] = buf[pos + aal['name_offset'], len].UnicodeToUtf8 if len > 0

    # Log instances of funky references.
    aal['mft'] = NTFS::Utils.MkRef(aal['mft_reference'])[1]

    # Store (if not bad)
    @list << aal  if aal['mft'] <= @boot_sector.maxMft

    # advance to next attribute
    pos += aal['length']
  end
end

Instance Attribute Details

#list ⇒ Object (readonly)

Returns the value of attribute list.



60
61
62
 
# File 'lib/fs/ntfs/attrib_attribute_list.rb', line 60

def list
  @list
end

Instance Method Details

#dump ⇒ Object 



113
114
115
116
117
 
# File 'lib/fs/ntfs/attrib_attribute_list.rb', line 113

def dump
  out = "\#<#{self.class}:0x#{'%08x' % object_id}>, #{@list.size} attributes:\n"
  @list.each { |at| out << dumpElement(at) }
  out
end

#dumpElement(at) ⇒ Object 



119
120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/fs/ntfs/attrib_attribute_list.rb', line 119

def dumpElement(at)
  ref = NTFS::Utils.MkRef(at['mft_reference'])
  out = "\#<#{at.class}:0x#{'%08x' % at.object_id}> (#{TypeName[at['attrib_type']]} - #{at['name'] ? at['name'] : '[unnamed]'})\n"
  out << "Type    : 0x#{'%08x' % at['attrib_type']}\n"
  out << "Length  : 0x#{'%04x' % at['length']}\n"
  out << "NameLen : #{at['name_length']}\n"
  out << "NameOfs : #{at['name_offset']}\n"
  out << "FirstVCN: 0x#{'%016x' % at['first_vcn']}\n"
  out << "BaseRef : #{ref[0]}, #{ref[1]}\n"
  out << "BaseRef : 0x#{'%016x' % ref[1]}\n"
  out << "AttribID: #{at['attrib_id']}\n\n"
  out
end

#loadAttributes(attribType) ⇒ Object

Load attributes of requested type



99
100
101
102
103
104
105
106
107
108
109
110
111
 
# File 'lib/fs/ntfs/attrib_attribute_list.rb', line 99

def loadAttributes(attribType)
  result = []

  # ad is an attribute descriptor.
  @list.each do |ad|
    next unless ad['attrib_type'] == attribType

    # Load referenced attribute and add it to parent.
    result += @boot_sector.mftEntry(ad['mft']).loadAttributes(attribType)
  end

  result
end

#to_s ⇒ Object 



94
95
96
 
# File 'lib/fs/ntfs/attrib_attribute_list.rb', line 94

def to_s
  super
end