通过扇区读取文件内容

通过网络资料，自己再修改了一些，在VS2005上编译通过，正常运行！

代码如下（注意包含头文件和定义）：

==============================================================================

//!start

#include "stdafx.h"

#define WINVER 0x0501

#define _WIN32_WINNT 0x0501

#include<stdio.h>

#include <iostream>

#include <windows.h>

#include <tchar.h>

#include <Winioctl.h>

typedef /*__success(return >= 0)*/ LONG NTSTATUS;

typedef NTSTATUS *PNTSTATUS;

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)

typedef struct _IO_STATUS_BLOCK {

union {

NTSTATUS Status;

PVOID Pointer;

};

ULONG_PTR Information;

} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef enum _ATTRIBUTE_TYPE{

AttributeStandardInformation = 0x10,

AttributeAttributeList = 0x20,

AttributeFileName = 0x30,

AttributeObjectId = 0x40,

AttributeSecurityDescriptor = 0x50,

AttributeVolumeName = 0x60,

AttributeVolumeInformation = 0x70,

AttributeData = 0x80,

AttributeIndexRoot = 0x90,

AttributeIndexAllocation = 0xA0,

AttributeBitmap = 0xB0,

AttributeReparsePoint = 0xC0,

AttributeEAInformation = 0xD0,

AttributeEA = 0xE0,

AttributePropertySet = 0xF0,

AttributeLoggedUtilityStream = 0x100,

AttributeTerminate=-1

} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;

typedef struct _NTFS_RECORD_HEADER{

ULONG Type;

USHORT UsaOffset;

USHORT UsaCount;

USN Usn;

} NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER;

typedef struct _FILE_RECORD_HEADER{

NTFS_RECORD_HEADER Header;

USHORT SequenceNumber;

USHORT LinkCount;

USHORT AttributesOffset;

USHORT Flags; // 0x0001 = InUse, 0x0002 = Directory

ULONG BytesInUse;

ULONG BytesAllocated;

ULONGLONG BaseFileRecord;

USHORT NextAttributeNumber;

} FILE_RECORD_HEADER, *PFILE_RECORD_HEADER;

typedef struct _ATTRIBUTE{

ATTRIBUTE_TYPE AttributeType;

ULONG Length;

BOOLEAN Nonresident;

UCHAR NameLength;

USHORT NameOffset;

USHORT Flags; // 0x0001 = Compressed

USHORT AttributeNumber;

} ATTRIBUTE, *PATTRIBUTE;

typedef struct _RESIDENT_ATTRIBUTE{

ATTRIBUTE Attribute;

ULONG ValueLength;

USHORT ValueOffset;

USHORT Flags; // 0x0001 = Indexed

} RESIDENT_ATTRIBUTE, *PRESIDENT_ATTRIBUTE;

typedef struct _NONRESIDENT_ATTRIBUTE{

ATTRIBUTE Attribute;

ULONGLONG LowVcn;

ULONGLONG HighVcn;

USHORT RunArrayOffset;

UCHAR CompressionUnit;

UCHAR AlignmentOrReserved[5];

ULONGLONG AllocatedSize;

ULONGLONG DataSize;

ULONGLONG InitializedSize;

ULONGLONG CompressedSize; // Only when compressed

} NONRESIDENT_ATTRIBUTE, *PNONRESIDENT_ATTRIBUTE;

typedef NTSTATUS (__stdcall

*TNtQueryInformationFile)(

IN HANDLE FileHandle,

PIO_STATUS_BLOCK IoStatusBlock,

PVOID FileInformation,

ULONG FileInformationLength,

ULONG FileInformationClass

);

#define ReadResidentAttribute(Attribute) (void*)((ULONG_PTR)(Attribute)+((PRESIDENT_ATTRIBUTE)(Attribute))->ValueOffset)

PATTRIBUTE GetNextAttribute(PFILE_RECORD_HEADER FileRecord,ATTRIBUTE_TYPE AttributeType,PATTRIBUTE CurrentPosition)

{

PATTRIBUTE Attribute;

for(Attribute=CurrentPosition?(PATTRIBUTE)((ULONG_PTR)CurrentPosition+CurrentPosition->Length):(PATTRIBUTE)((ULONG_PTR)FileRecord+FileRecord->AttributesOffset);Attribute->AttributeType!=-1&&Attribute->AttributeType!=0;Attribute=(PATTRIBUTE)((ULONG_PTR)Attribute+Attribute->Length))

if(Attribute->AttributeType==AttributeType)

return Attribute;

return 0;

}

TNtQueryInformationFile NtQueryInformationFile;

int copyfile(wchar_t*Destination,wchar_t*Source)

{

HANDLE hFile,hNewFile,hVolume;STARTING_VCN_INPUT_BUFFER inbuf;RETRIEVAL_POINTERS_BUFFER*outbuf;ULONG len,c;wchar_t RootPath[4]=L"C:\\",VolumeName[]=L"\\\\.\\C:";

LARGE_INTEGER Offset,FileId;LARGE_INTEGER LastVcn,FileSize;unsigned __int64 C;int Result=0,r;SIZE_T i;long offlong;

DWORD SectorsPerCluster,BytesPerSector,FreeClusters,TotalClusters,ClusterSize,Err;void*Buffer;IO_STATUS_BLOCK iosb;

NTFS_VOLUME_DATA_BUFFER NtfsData;PNTFS_FILE_RECORD_OUTPUT_BUFFER FileRec;

i=wcscspn(Source,L":");

RootPath[0]=Source[i-1];

VolumeName[4]=Source[i-1];

if(!GetDiskFreeSpaceW(RootPath,&SectorsPerCluster,&BytesPerSector,&FreeClusters,&TotalClusters))return 0;

ClusterSize=SectorsPerCluster*BytesPerSector;

Buffer=VirtualAllocEx((HANDLE)-1,0,ClusterSize,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);;

hFile=CreateFileW(Source,GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,0,0);

if(hFile!=INVALID_HANDLE_VALUE)

{

FlushFileBuffers(hFile);

CloseHandle(hFile);

}

hFile=CreateFileW(Source,FILE_READ_ATTRIBUTES,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,0,0);

if(hFile!=INVALID_HANDLE_VALUE)

{

outbuf=(PRETRIEVAL_POINTERS_BUFFER)VirtualAllocEx((HANDLE)-1,0,4096,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);

if(outbuf)

{

hVolume=CreateFileW(VolumeName,GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,FILE_FLAG_NO_BUFFERING,0);

if(hVolume!=INVALID_HANDLE_VALUE)

{

hNewFile=CreateFileW(Destination,GENERIC_WRITE,FILE_SHARE_READ,0,CREATE_ALWAYS,0x80 | FILE_FLAG_WRITE_THROUGH,0);

if(hNewFile!=INVALID_HANDLE_VALUE)

{

GetFileSizeEx(hFile,&FileSize);

SetFilePointer(hNewFile,FileSize.LowPart,&FileSize.HighPart,0);

SetEndOfFile(hNewFile);

offlong=0;

SetFilePointer(hNewFile,0,&offlong,0);

inbuf.StartingVcn.QuadPart=0;

do

{

r=DeviceIoControl(hFile,FSCTL_GET_RETRIEVAL_POINTERS,&inbuf,sizeof(STARTING_VCN_INPUT_BUFFER),outbuf,4096,&len,0);

if(r)Err=0;else Err=GetLastError();

if(r||Err==ERROR_MORE_DATA||Err==NO_ERROR)

{

for(c=0,LastVcn=outbuf->StartingVcn;c<outbuf->ExtentCount;LastVcn=outbuf->Extents[c].NextVcn,c++)

{

Offset.QuadPart=outbuf->Extents[c].Lcn.QuadPart*ClusterSize;

SetFilePointer(hVolume,Offset.LowPart,&Offset.HighPart,0);

for(C=0;C<outbuf->Extents[c].NextVcn.QuadPart-LastVcn.QuadPart;C++)

{

ReadFile(hVolume,Buffer,ClusterSize,&len,0);

WriteFile(hNewFile,Buffer,len,&len,0);

}

}

}

if(Err==ERROR_MORE_DATA)inbuf.StartingVcn=LastVcn;else break;

}while(1);

if(Err==ERROR_HANDLE_EOF&&inbuf.StartingVcn.QuadPart==0)

{

if(NtQueryInformationFile(hFile,&iosb,&FileId,sizeof(LARGE_INTEGER),6)==0)

{

r=DeviceIoControl(hVolume,FSCTL_GET_NTFS_VOLUME_DATA,0,0,&NtfsData,sizeof(NTFS_VOLUME_DATA_BUFFER),&len,0);

if(r)

{

len=sizeof (NTFS_FILE_RECORD_OUTPUT_BUFFER)+ NtfsData.BytesPerFileRecordSegment- 1;

FileRec=(PNTFS_FILE_RECORD_OUTPUT_BUFFER)VirtualAllocEx((HANDLE)-1,0,len,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);

if(FileRec)

{

r=DeviceIoControl(hVolume,FSCTL_GET_NTFS_FILE_RECORD,&FileId,sizeof(LARGE_INTEGER),FileRec,len,&len,0);

if(r)

{

Result=WriteFile(hNewFile,ReadResidentAttribute(GetNextAttribute((PFILE_RECORD_HEADER)FileRec->FileRecordBuffer,AttributeData,0)),FileSize.LowPart,&len,0);

}

VirtualFreeEx((HANDLE)-1,FileRec,0,MEM_RELEASE);

}

}

}

}

if(r||Err==0)Result=1;

SetFilePointer(hNewFile,FileSize.LowPart,&FileSize.HighPart,0);

SetEndOfFile(hNewFile);

CloseHandle(hNewFile);

}

CloseHandle(hVolume);

}

CloseHandle(hFile);

}

VirtualFreeEx((HANDLE)-1,outbuf,0,MEM_RELEASE);

}

VirtualFreeEx((HANDLE)-1,Buffer,0,MEM_RELEASE);

return Result;

}

int _tmain(int argc, _TCHAR* argv[])

{

//static wchar_t src[255];

//wscanf(L"%s",src);

NtQueryInformationFile=(TNtQueryInformationFile)GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"NtQueryInformationFile");

if(copyfile(L"I:\\dest.txt", L"I:\\src.txt"))

printf("ok");else printf("........");

getchar();

return 0;

}

//!end

=========================================================================================