U E D R , A S I H C RSS
ZeroWiki

새싹교실/2012/세싹

1.

  • 명 .
  • : 매 15:00~16:00
    12:00~13:00
    • 면 됩.
  • 목: everything you want

2.

  • 메 : pkccr1@gmail.com
  • : pkccr@nate.com

3. feedback

  • ZeroPage 는만 4F(ThreeFs + Future Action Plan) 맞 feedback .
    • Facts, Feelings, Findings, Future Action Plan. , , 느낀 , , .
    • 를 들 돈를 먹 대 를 면 : " 남 5만는 돈를 먹.() 대를 는데 맛 .(느낌) 남 만 보 맛 대면 는 .() 는 미리 보 높 돈 봐.( )"
      • 마 보 더 ? 믿
  • feedback 대 .
    • ZeroWiki . 를 만는 .
    • 러들 배 내 리. 더 .

  • ZeroWiki는 MoniWiki Engine 며 Google Chrome Mozila Firefox, Safari보는 Internet Explorer 돌는 .

4.

4.1. 1(2012 3 16)

4.1.1.

O
O
O

4.1.2. 내

  • wiki를 는, 떻 는 대 배.
  • gcc 는 보.
    1) https://www.virtualbox.org 맞는 VirtualBux를
    2) http://ftp.daum.net -> Ubuntu-releases -> 11.10 -> ubuntu-11.10-deskto-amd64.iso
    3) Virtualbox -> 만들 -> : Linux : Ubuntu -> 메모리1024MB 머 디
    4) 만들 ubuntu -> 미디 ISO 마 ->
    ( 는 : 배를 (101/104 ) 됨!)
  • gcc hello world를 보.
    1) gcc &
    2) 는 빈 문 만들 (는 .c )
    3) 문
    4) terminal -> .c 는 동 (ls cd를 .)
    5) gcc . (gcc 명.c -o 는명 -std=c99) 러 .
    6) . (./명)
  • w3schools를 . (www.w3schools.com)
  • 대 .
    • 문, 리, 리 등 만 부 들는 .

4.1.3.

  • wiki
    1) 만들 - 를 면 됩. 본 말 .
    2) - 란 눌러 를 남면됩. feedback 목 .
  • gcc
    1) virtual box linux hello world 린 메 보내.

4.1.4.

  • 는 만 봤면 :D
    1) w3schools html 보
    2) linux 명 보
    3) gcc 보

4.1.5.

  • . 른 들는 른 리럼 , 무 민 많( 보). 듣는럼 말 면 . -
  • . 들봐 많 . 듣는 , 보는 면들 많만 미 대 됩. 보. 부립. -
  • . Wiki 매 미, 대 . 만 들보 럼 볼 들 보 . 부립. -
  • 를 를 . 는 문 는데 는 방 듣 7z 는 방 . 데몬 iso 7z . -
    • ... iso 바 마는데.. 대 됬? -
    • 리 . 7z ... 러를 번 는 . 메뉴 보 cmd . 는데 msi 는. --
    • amd64 더 cpu문 머 는. i386 . -

4.2. 2(2012 3 20)

4.2.1.

O
O
O

4.2.2. 내

  • 대 .
    1) gcc . - gcc 대부 리 보를 는 목. 냥 :D
  • 대 보.
    1) 리 는 방 를 목 보내는 럼 동는 .
    2) 대 보.
    - app : 리 는 를 는 . http, smtp, ftp등 .
    - transport : 데를 떻 보낼 는 . 데를 떻 묶 보낼, 리는 떻 대 . TCP/UDP등 .
    - ip : , 목 데 묶() 는 . .
    - link : 노 노 데를 받는 . , 브릿등 됩.
    - physical : 들 물리 동는 . 블, 무 매 .
    3) 만 리 모 램 는 .
    - 런 능들 눈 는, 내 떤 몰 능 .
    - , 밍 들 동리를 모르더 떤 능 는만 면 밍 .
    4) 럼 무?
    - (Internet socket, socket' network socket 부르 ) 는 .
    램들 , 데를 . - wikipedia
    - 는 :P 명면 byte stream 받는 마 듯 는 .
    fopen() connect()
    read()/write() read()/write()
    close() close()
    5) http://forum.falinux.com/zbxe/?document_srl=441104 를 .

4.2.3.

  • c
    1) 를 를 봅.
    2) 보내 메를 대문 바 보내는 .
    3) 높 므 . 번 보 보.
    4) 리눅 gcc를 봅.
    5) 댓 .

4.2.4.

  • 는 만 봤면 :D
    1) w3schools는 보 바랍.

4.2.5.

  • 내 보 는 =_= 밌 -
  • 밍 . 대 는 들 떻 념 많 민 는 fail . 부 는 는 ..... 리 .. 대 바 벅벅 . 대를 들만 돌 . -
  • C 밍 보 미듯 -
  • 빡 르 들… 맨 딩는 돌 러대는 듯… -
  • 면 들 능 리 . -
    • ... ... -
      • 2만 료를 명.(?) -
  • 밍 대 배. 내 따 못 많 는데 명 내 . 딸 보 들 막 . 복 . 리 노 났. -
    • ... -
    • 를 . VS 뭔 막 는데 는 못 를 를 . 런 명 봐 번 들. 리 를 문데. 램 는 데 번 는 Bind러 . 매번 마 . 런 문 ? -
      • 맞린 bind 는, 내 눌러(bind) 보 른 놈 미 bind 못는 . 램 bind bind를 면 런 . bind 를 . -
      • ! . :) -
        • 방. 바 setsockopt(mySocket, SOL_SOCKET, SO_REUSEADDR, &anyIntegerVariableThatContainsNonZero, sizeof(anyIntegerVariableThatContainsNonZero)); 를 면 명 는 리 됩. -

4.3. 3(2012 3 23)

4.3.1.

O
O
O

4.3.2. 내

  • 내 대 .
    1) 복 떻 ?
    - 문
    를 를 .
    - 면 는 대 .
    2) 는 는 떻 ?
    - . 보 :D
    3) 를 따 무 불. 떻 방 ?
    - thread를 를 리 는
    concurrent 밍 부 .
    4) 는 무 .
    - 방 off-line 메 능
    를 push 메를 받. 를 C2DM .
  • Thread 대 보.
    - thread 떤 는 떻 는 .
    떻 밍 보.

4.3.3.

  • 는 뮬
    - terminal 러 보.
  • 는 봅.
  • 는 번만 메를 받는데, 봅.
    - while문만 면 .

4.3.4.


4.3.5.

4.4. 4(2012 3 27)

4.4.1.

O
O

4.4.2. 내

4.4.3.

  • socket thread를 메를 받 는 램 .

4.4.4.


4.4.5.

  • 번 데 늦. 빡 .. 바는 . 더 는 들. 리 리럼대 는 냥 는대 . 물 딩 . -

4.5. 5(2012 3 30)

4.5.1.

O
O
O

4.5.2. 내


4.5.3.


4.5.4.


4.5.5.

  • /리눅멀 료. 는 ... -
  • 는 . 는 는 료. 만 - 며...

4.6. 6(2012 4 3)

4.6.1.

O
O
O

4.6.2. 내

  • NTFS 대 략 명.

  •   // 더 : ntfs.h
#pragma once
#define _WIN32_WINNT 0x0500

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>

typedef BOOLEAN TF;
typedef	UCHAR U8;
typedef USHORT U16;
typedef ULONG U32;
typedef ULONGLONG U64;

typedef struct {
	U32 Type;
	U16 UsaOffset;
	U16 UsaCount;
	U64 Usn;
} NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER;

typedef struct {
	NTFS_RECORD_HEADER Ntfs;
	U16 SequenceNumber;
	U16 LinkCount;
	U16 AttributeOffset;
	U16 Flags;		// inUse 0x0001 Directory 0x0002
	U32 BytesInUse;
	U32 BytesAllocated;
	U64 BaseFileRecord;
	U16 NextAttributeNumber;
} FILE_RECORD_HEADR, *PFILE_RECORD_HEADER;

// Standard Attribute

typedef enum {
	AttributeStandardInformation = 0x10,
	AttributeAttributeList = 0x20,
	AttributeFileName = 0x30,
	AttributeObjectId = 0x40,
	AttributeSecurityDesciptor = 0x50,
	AttributeVolumeName = 0x60,
	AttributeVolumeInformation = 0x70,
	AttributeData = 0x80,
	AttributeIndexRoot = 0x90,
	AttributeIndexAllocation = 0xA0,
	AttributeBitmap = 0xB0,
	AttributeReparsePoint = 0xC0,
	AttributeEAInformation = 0xD0,
	AttributeEA = 0xE0,
	AttributePropertySet = 0xF0,
	AttributeLoggedUtilityStream = 0x100
} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;

typedef struct {
	ATTRIBUTE_TYPE AttributeType;
	U32 Length;
	TF Nonresident;
	U8 NameLength;
	U16 NameOffset;
	U16 Flags;
	U16 AttributeNumber;
} ATTRIBUTE, *PATTRIBUTE;

typedef struct {
	ATTRIBUTE Attribute;
	U32 ValueLength;
	U16 ValueOffset;
	U16 Flags;
} RESIDENT_ATTRIBUTE,*PRESIDENT_ATTRIBUTE;



#pragma pack(push, 1)
typedef struct {
	U8 Jump[3];
	U8 Format[8];
	U16 BytesPerSector;	// 바 
	U8 SectorsPerCluster;	// 러
	U16 BootSectors;
	U8 Mbz1;
	U16 Mbz2;
	U16 Reserved1;
	U8 MediaType;
	U16 Mbz3;
	U16 SectorsPerTrack;
	U16 NumberOfHeads;
	U32 PartitionOffset;
	U32 Reserved2[2];
	U64 TotalSectors;	//디  .
	U64 MftStartLcn;	//MFT 는 .
	U64 Mft2StartLcn;	// MFT Mirror 부 는 
	U32 ClustersPerFileRecord;	//   러
	U32 ClustersPerIndexBlock;	//	덱 블럭 러
	U64 VolumeSerialNumber;
	U8 Code[0x1AE];
	U16 BootSignature;
} BOOT_BLOCK, *PBOOT_BLOCK;
#pragma pack(pop)
    - main.cpp

#include "ntfs.h"

U32 BytesPerFileRecord;
BOOT_BLOCK boot_block;
HANDLE hVolume;
U32 cnt;
CHAR drive[] = "\\\\.\\C:";
PFILE_RECORD_HEADER MFT;


void ReadSector(U64 sector, U32 count, void* buffer);
void LoadMFT();

void main()
{

	hVolume = CreateFile(drive, GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE, 0,OPEN_EXISTING, 0, 0);
	ReadFile(hVolume, &boot_block, sizeof(boot_block), &cnt, 0);
	
	printf("======My FILE SYSTEM INFO==========\n");
	printf("File System : %s \n",boot_block.Format);
	printf("Total Sectors : %u \n",boot_block.TotalSectors);
	printf("Sector per Bytes : %u \n",boot_block.BytesPerSector);
	printf("Cluster per Sectors : %u\n",boot_block.SectorsPerCluster);
	printf("Clusters Per FileRecord : %u\n",boot_block.ClustersPerFileRecord);
	printf("Clusters Per IndexBlock : %u\n",boot_block.ClustersPerIndexBlock);

}

void LoadMFT()
{
	BytesPerFileRecord = boot_block.ClustersPerFileRecord < 0x80? boot_block.ClustersPerFileRecord* boot_block.SectorsPerCluster* boot_block.BytesPerSector : 1 << (0x100 - boot_block.ClustersPerFileRecord);
	MFT = PFILE_RECORD_HEADER(new U8[BytesPerFileRecord]);
	ReadSector(boot_block.MftStartLcn * boot_block.SectorsPerCluster,	BytesPerFileRecord / boot_block.BytesPerSector, MFT);
	printf("buffer : %s\n", MFT+0x27);
}

void ReadSector(U64 sector, U32 count, void* buffer)
{
	ULARGE_INTEGER offset;
	OVERLAPPED overlap = {0};
	U32 n;
	
	offset.QuadPart = sector * boot_block.BytesPerSector;
	overlap.Offset = offset.LowPart; 
	overlap.OffsetHigh = offset.HighPart;
	ReadFile(hVolume, buffer, count * boot_block.BytesPerSector, &n, &overlap);
	
}

4.6.3.

4.6.4.

  • 를 보 봅. - cpp ,

4.6.5.

  • 대 를 . -
  • 듯 . 뒤는 맡 . -

4.7. 7(2012 4 6)

4.7.1.

O
O
X

4.7.2. 내

  • NTFS 는 방

4.7.3.

  • 는 를 MFT

4.7.4.

4.7.5.

  • URP . 내 는 는 :D -
    • 리 배 F빵 맞. -
  • NTFS 대 배. 들 . 배는 말 .
    램 대 못. 명 . -

4.8. 8(2012 4 10)

4.8.1.

O
O
O

4.8.2. 내


4.8.3.


4.8.4.

  • NTFS 대 부봅.

4.8.5.


4.9. 9(2012 4 13)

4.9.1.

O
O
O

4.9.2. 내 

#include "ntfs.h"

U32 BytesPerFileRecord;
BOOT_BLOCK boot_block;
HANDLE hVolume;
U32 cnt;
CHAR drive[] = "\\\\.\\C:";
//WCHAR drive[] = TEXT("\\\\.\\C:");
PFILE_RECORD_HEADER MFT;


void ReadSector(U64 sector, U32 count, void* buffer);
void LoadMFT();

void main()
{

	hVolume = CreateFile(drive, GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE, 0,OPEN_EXISTING, 0, 0);
	ReadFile(hVolume, &boot_block, sizeof(boot_block), &cnt, 0);
//	FILE *fp=fopen(drive,"rb");
//	fread((void*)&boot_block,sizeof(boot_block),1,fp);

	printf("======My FILE SYSTEM INFO==========\n");
	printf("File System : %s \n",boot_block.Format);
	printf("Total Sectors : %u \n",boot_block.TotalSectors);
	printf("Sector per Bytes : %u \n",boot_block.BytesPerSector);
	printf("Cluster per Sectors : %u\n",boot_block.SectorsPerCluster);
	printf("Clusters Per FileRecord : %u\n",boot_block.ClustersPerFileRecord);
	printf("Clusters Per IndexBlock : %u\n",boot_block.ClustersPerIndexBlock);
	printf("\n\n");
	LoadMFT();
}

void LoadMFT()
{
	int i;
	BytesPerFileRecord = boot_block.ClustersPerFileRecord < 0x80? boot_block.ClustersPerFileRecord* boot_block.SectorsPerCluster* boot_block.BytesPerSector : 1 << (0x100 - boot_block.ClustersPerFileRecord);
	MFT = PFILE_RECORD_HEADER(new U8[BytesPerFileRecord]);

	ReadSector(boot_block.MftStartLcn * boot_block.SectorsPerCluster,	BytesPerFileRecord / boot_block.BytesPerSector, MFT);

	printf("$MFT's Signaturer : %s\n", MFT);//+0x27);
	printf("Offset to fixup array : 0x%02x%02x\n", *((unsigned char*)MFT+5),*((unsigned char*)MFT+4));
	printf("Number of this MFT Entry : 0x%02x%02x%02x%02x\n"
		, *((unsigned char*)MFT+47),*((unsigned char*)MFT+46),*((unsigned char*)MFT+45),*((unsigned char*)MFT+44));

	
	printf("Offset to first attribute : 0x%02x%02x \n"
		, *((unsigned char*)MFT+21),*((unsigned char*)MFT+20));



	i=((int)(*((unsigned char*)MFT+21))<<8)+*((unsigned char*)MFT+20);//Offset  동
	printf("First Attribute : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
	i+=4;// 4바 동
	printf("First Attribute Size : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
	printf("\n");

	

	i=	i+
		((int)(*((unsigned char*)MFT+i+3))<<24)+
		((int)(*((unsigned char*)MFT+i+2))<<16)+
		((int)(*((unsigned char*)MFT+i+1))<<8)+
		*((unsigned char*)MFT+i)
		-4;//를   4바를 .

	printf("Second Attribute : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
	i+=4;// 4바 동
	printf("Second Attribute Size : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
	printf("\n");


	i=	i+
		((int)(*((unsigned char*)MFT+i+3))<<24)+
		((int)(*((unsigned char*)MFT+i+2))<<16)+
		((int)(*((unsigned char*)MFT+i+1))<<8)+
		*((unsigned char*)MFT+i)
		-4;//를   4바를 .

	printf("Third Attribute : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
	i+=4;// 4바 동
	printf("Third Attribute Size : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
	printf("\n");
	
/*
	ReadSector(boot_block.Mft2StartLcn * boot_block.SectorsPerCluster,	BytesPerFileRecord / boot_block.BytesPerSector, MFT);

	printf("$MFT Mirr's Signaturer : %s\n", MFT);//+0x27);
	printf("Offset to fixup array : 0x%02x%02x\n", *((unsigned char*)MFT+5),*((unsigned char*)MFT+4));
	printf("Number of this MFT Entry : 0x%02x%02x%02x%02x\n"
		, *((unsigned char*)MFT+47),*((unsigned char*)MFT+46),*((unsigned char*)MFT+45),*((unsigned char*)MFT+44));
	printf("\n");
//*/

	printf("MftStartLcn : %d\n",boot_block.MftStartLcn);
	printf("Mft2StartLcn : %d\n",boot_block.Mft2StartLcn);
}


void ReadSector(U64 sector, U32 count, void* buffer)
{
	ULARGE_INTEGER offset;
	OVERLAPPED overlap = {0};
	U32 n;
	
	offset.QuadPart = sector * boot_block.BytesPerSector;
	overlap.Offset = offset.LowPart; 
	overlap.OffsetHigh = offset.HighPart;
	ReadFile(hVolume, buffer, count * boot_block.BytesPerSector, &n, &overlap);
}

4.9.3.


4.9.4.

  • 리디 방
  • 부

4.9.5.

  • 뒤 는 는 , 리디 빅디 변는 는 .
    브러리를 .
    htons, htonl
  • HxD는 디 . 4 바 대 8 바 . 리 리.
    http://mh-nexus.de/en/hxd/ -
  • Code jam 불더 ... -
  • 는 료 . 4bit unsigned 부 3byte,7byte unsigned . -


4.10. 10(2012 4 17)

4.10.1.

O
O
O

4.10.2. 내 

#include "ntfs.h"

U32 BytesPerFileRecord;
BOOT_BLOCK boot_block;
HANDLE hVolume;
U32 cnt;
CHAR drive[] = "\\\\.\\C:";
//WCHAR drive[] = TEXT("\\\\.\\C:");
PFILE_RECORD_HEADER MFT;


void ReadSector(U64 sector, U32 count, void* buffer);
void LoadMFT();
unsigned int LoadAttribute(int i);

unsigned __int64 htonll(unsigned __int64);
unsigned int htonl(unsigned int);
//unsigned short htons(unsigned short);

void main()
{

	hVolume = CreateFile(drive, GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE, 0,OPEN_EXISTING, 0, 0);
	ReadFile(hVolume, &boot_block, sizeof(boot_block), &cnt, 0);
//	FILE *fp=fopen(drive,"rb");
//	fread((void*)&boot_block,sizeof(boot_block),1,fp);

	printf("======My FILE SYSTEM INFO==========\n");
	printf("File System : %s \n",boot_block.Format);
	printf("Total Sectors : %u \n",boot_block.TotalSectors);
	printf("Sector per Bytes : %u \n",boot_block.BytesPerSector);
	printf("Cluster per Sectors : %u\n",boot_block.SectorsPerCluster);
	printf("Clusters Per FileRecord : %u\n",boot_block.ClustersPerFileRecord);
	printf("Clusters Per IndexBlock : %u\n",boot_block.ClustersPerIndexBlock);
	printf("\n\n");
	LoadMFT();
	system("pause");
}

void LoadMFT()
{
	int point;
	unsigned __int64 num;
	BytesPerFileRecord = boot_block.ClustersPerFileRecord < 0x80? boot_block.ClustersPerFileRecord* boot_block.SectorsPerCluster* boot_block.BytesPerSector : 1 << (0x100 - boot_block.ClustersPerFileRecord);
	MFT = PFILE_RECORD_HEADER(new U8[BytesPerFileRecord]);

	printf("MftStartLcn : %016x\n",boot_block.MftStartLcn);
	printf("Mft2StartLcn : %016x\n",boot_block.Mft2StartLcn);
	printf("\n");

	//0 대  대면 른 MFT entry를 볼  .
	ReadSector((boot_block.MftStartLcn+0) * boot_block.SectorsPerCluster,	BytesPerFileRecord / boot_block.BytesPerSector, MFT);
	

	printf("MFT's Signaturer : %s\n", MFT);//+0x27);
	printf("Offset to fixup array : 0x%02x%02x\n", *((unsigned char*)MFT+5),*((unsigned char*)MFT+4));
	printf("Number of this MFT Entry : 0x%02x%02x%02x%02x\n"
		, *((unsigned char*)MFT+47),*((unsigned char*)MFT+46),*((unsigned char*)MFT+45),*((unsigned char*)MFT+44));

	printf("Offset to first attribute : 0x%02x%02x \n"
		, *((unsigned char*)MFT+21),*((unsigned char*)MFT+20));
	printf("\n");


	point=((int)(*((unsigned char*)MFT+21))<<8)+*((unsigned char*)MFT+20);//Offset  동
	
	printf("Attribute List Start\n\n");
	while(htonl(*((unsigned int*)((unsigned char*)MFT+point)))!=0xFFFFFFFF)
		point+=LoadAttribute(point);
	printf("Attribute List End\n");

	printf("\n");

}

unsigned int LoadAttribute(int point)
{
	int i=0,j=0,k=0;
	int HeaderSize;

	/*
		*((unsigned char*)MFT+i+9) = Attribute Name Size
		Resident=24 / Non-resident=64
	*/

	if(*((unsigned char*)MFT+point+8))
		HeaderSize=64+*((unsigned char*)MFT+point+9);
	else
		HeaderSize=24+*((unsigned char*)MFT+point+9);


	switch(htonl(*((unsigned int*)((unsigned char*)MFT+point))))
	{
	case 0x10://$STANDARD_INFORMATION
		printf("Attribute type : Standard Information\n");
		break;

	case 0x20://$ATTRIBUTE_LIST
		printf("Attribute type : Attribute List\n");
		break;

	case 0x30://$FILE_NAME
		printf("Attribute type : File Name\n");
		printf("File Name Size : %d\n",*((unsigned char*)MFT+point+HeaderSize+64));	
		printf("File NameSpace : ");
		switch(*((unsigned char*)MFT+point+HeaderSize+65))
		{
		case 0:
			printf("POSIX\n");
			break;
		case 1:
			printf("Win32\n");
			break;
		case 2:
			printf("DOS\n");
			break;
		case 3:
			printf("Win32 & DOS\n");
			break;
		}
		printf("File Name : ");
		for(j=0;j<2**((unsigned char*)MFT+point+HeaderSize+64);j++)
			printf("%c",*((unsigned char*)MFT+point+HeaderSize+66+j));
		printf("\n");
		break;

	case 0x40://$
		printf("Attribute type : \n");
		break;

	case 0x50://$SECURITY_DESCRIPTOR
		printf("Attribute type : Security Descriptor\n");
		break;

	case 0x60://$
		printf("Attribute type : \n");
		break;

	case 0x70://$
		printf("Attribute type : \n");
		break;

	case 0x80://$DATA
		printf("Attribute type : Data\n");

		//__int64는 메모리 little endian 됨.    만...
		printf("Run List  Start VCN : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+16)));
		printf("Run List   End  VCN : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+24)));
		printf("Run List Start Offset : 0x%02x%02x\n",*((unsigned char*)MFT+point+33),*((unsigned char*)MFT+point+32));

//		printf("Cluster Size : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+40)));
//		printf("Attribute Size : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+48)));
//		printf("real Size : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+56)));

		i=(int)*((unsigned char*)MFT+point+33)+*((unsigned char*)MFT+point+32);

		for(j=0;j<(*((unsigned char*)MFT+point+i)&0x0F);j++)//*((unsigned __int64*)((unsigned char*)MFT+point+24));j++)
		{
			printf("Cluster %d lenth : 0x",j);
			for(k=0;k<(*((unsigned char*)MFT+point+i)&0x0F);k++)
				printf("%02x",*((unsigned char*)MFT+point+i+(*((unsigned char*)MFT+point+i)&0x0F)-k));
			printf("\n");

			printf("Cluster %d offset : 0x",j);
			for(;k<(*((unsigned char*)MFT+point+i)&0x0F)+((*((unsigned char*)MFT+point+i)&0xF0)>>4);k++)
				printf("%02x",*((unsigned char*)MFT+point+i
					+(*((unsigned char*)MFT+point+i)&0x0F)+((*((unsigned char*)MFT+point+i)&0xF0)>>4)
					-k+(*((unsigned char*)MFT+point+i)&0x0F)));
			printf("\n");
			i+=(*((unsigned char*)MFT+point+i)&0x0F)+((*((unsigned char*)MFT+point+i)&0xF0)>>4)+1;
		}
		break;
	case 0xB0:
		printf("Attribute type : Bitmap\n");
		break;
	}

	printf("\n");

	return htonl(*((unsigned int*)((unsigned char*)MFT+point+4)));
}

void ReadSector(U64 sector, U32 count, void* buffer)
{
	ULARGE_INTEGER offset;
	OVERLAPPED overlap = {0};
	U32 n;
	
	offset.QuadPart = sector * boot_block.BytesPerSector;
	overlap.Offset = offset.LowPart; 
	overlap.OffsetHigh = offset.HighPart;
	ReadFile(hVolume, buffer, count * boot_block.BytesPerSector, &n, &overlap);
}



unsigned __int64 htonll(unsigned __int64 LittleEndian)
{
	unsigned __int64 BigEndian;
	int i;
	LittleEndian>>=16;
	BigEndian=0;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+7))<<54;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+6))<<48;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+5))<<40;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+4))<<32;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+3))<<24;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+2))<<16;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+1))<<8;
	BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+0));
	return BigEndian;
}


unsigned int htonl(unsigned int LittleEndian)
{
	unsigned int BigEndian;
	BigEndian=
		((unsigned int)(*((unsigned char*)&LittleEndian+3))<<24)+
		((unsigned int)(*((unsigned char*)&LittleEndian+2))<<16)+
		((unsigned int)(*((unsigned char*)&LittleEndian+1))<<8)+
		*((unsigned char*)&LittleEndian)
		;
	return BigEndian;
}



/*
unsigned short htons(unsigned short LittleEndian)
{
	unsigned short BigEndian;
	BigEndian=
		((unsigned short)(*((unsigned char*)&LittleEndian+1))<<8)+
		*((unsigned char*)&LittleEndian)
		;
	return BigEndian;
}
/*/


4.10.3.


4.10.4.


4.10.5.

Valid XHTML 1.0! Valid CSS! powered by MoniWiki
last modified 2021-02-07 05:29:46
Processing time 0.1229 sec