Uncover the dirty secrets of NTFS

Under NTFS, a special concept is supported, that is, ' flow '. What's the flow? First look at the definition of ' flow ':

Stream

A sequence of bits, bytes, or other small structurally uniform units.

Bit sequences, or small unified structural units. Of course, small unified structure unit does not mean that must be uniform size, uniform format.

Stream is attached to a file and you can store 2 of data in the stream, text or something. It's like a file. A file can contain more than one stream. But the stream is different from the file. The opening of each stream requires a separate creatfile (...). operation, not opening the file to open the stream.

The name and filename of the stream are separated by ': '. For example: Abc:a.

ABC is the filename, and the name of the stream is a. When we manipulate the flow, we can use the following simple method:

ECHO stream1>abc:stream1

ECHO stream2>abc:stream2

Now, ABC has: STREAM1 and: STREAM2 A total of 2 streams.

and the readout stream can be used:

More <abc:stream1

More <abc:stream2

In this way, the content is read out. CreateFile ("abc:stream1",...);

If you use a programmatic approach. The operation is the same as the file operation.

So why use the flow? The benefit of streaming is concealment. Winnt No tool is used to discover the existence of a stream. Let's see.

C:\>ECHO "Hi Reader" > XX.TXT:MyStream
C:\>DIR XX.TXT
Volume in drive C is Wizard
Volume Serial Number is 40E5-92D4
Directory of C:\
03/18/98　08:36a　　　　　　　　　　　0 XX.TXT
　　　　　　　  1 File(s)　　　　　　　0 bytes
　　　　　　　  0 Dir(s)　 3,399,192,576 bytes free

That's the benefit. So, in the Green Corps, there is an article devoted to the flow. It is a deep hidden file access format.

Really deep, but NT just doesn't provide the tools. And we still have the presence of a stream to detect. That is, Inside programming for everyone to provide Stream.Exe. The tool can see the files that contain the stream and the names of all the streams.

Of course, NT provides a api,backupread (...) For the read out of the stream name. Since it's inside programming, the introduction of this API obviously does not provide more help, followed by a native api:ntqueryinformationfile (...)

The following is a section of the API that involves streaming:

/*+++
Streaminfo.h
Author:lulin
date:2000.8.25
Abstract:
Interface to Ntqueryinformationfile
Stream portion.
---*/
#ifndef __streaminfo_h__
#define __STREAMINFO_H__
#include <windef.h>
extern "C" {
typedef LONG NTSTATUS;　　　
typedef struct {
 union {
 ntstatus Status;
 pvoid pointer;
 };
 ulong *information;
} io_status_block, *pio_status_block;
typedef struct {//infoclass
ULONG nextentryoffset;
ULONG streamnamelength;
Large_integer Endofstream;
Large_integer allocationsize;
WCHAR streamname[1];
}file_stream_information,*pfile_stream_information;
__declspec (dllimport) NTSTATUS __stdcall ntqueryinformationfile (
HANDLE HANDLE,
Pio_status_block io_ Status_block,
pvoid fileinformation,
ULONG fileinformationlength,
int fileinfomationclass
);
}
#endif//__streaminfo_h__

When NTFS really stores the stream name, the name adds: $DATA, for example: abc:stream1 when stored, the stream name is saved as: STREAM1: $DATA, so you need to remove it in the query result: $DATA. Here, I don't discuss how STREAM.EXE works in detail.