|
|
楼主 |
发表于 2009-2-22 07:37:18
|
显示全部楼层
翻译的英文版（Google）
exFAT structural analysis
2008/06/27 K. Takata
1. Early
In this document, Windows Vista SP1 and Windows CE 6.0 was adopted in New
ExFAT file system that shows the result of a unique structure.
Two. Specifications Overview
ExFAT outline specification. Below, WinHEC 2006 slides [1] and,
MSDN information [2,3] are excerpts.
File system for flash media
Corresponds to a larger media 32GB
Handle more than a thousand files in one directory
Available SUPESUBITTOMAPPU
- Allocate space fast, fast delete
64bit file size management
Large cluster size (up to 2 ^ 255 is the theoretical maximum on the implementation 32MB)
Scalability for the future
- Flexible and scalable directory structure
- You can add features while maintaining compatibility
Hash of the file name
- The file name uppercase 2 BAITOCHEKKUSAMU
- Check the speed of the file name
OEM-specific parameters
Transaction-Safe FAT (TFAT)
FAT32 has no backwards compatibility with
No short file name
In addition, the following specifications to be inferred from the analysis results.
The maximum volume size, sector size × 2 ^ 64 (512B sectors 8ZiB)
32bit cluster number
- How to handle the same cluster number
Conversion table for a calculated sensitivity of the hash of the file name
As with FAT32, the root directory are treated in a special subdirectory
- The size of the root directory can be expanded
Conversion table SUPESUBITTOMAPPU and sensitive handling of space is a special file
Three. Analysis results
3.1. The volume
Sector 0
+00 H: BYTE [3] Jump instruction
+03 H: BYTE [8] OEM name ( "EXFAT")
+0 Bh: BPB32 (00h)
+40 H: DWORD??? (78h)
+44 H: DWORD??? (00h)
+48 H: QWORD number of sectors in volume
+50 H: DWORD FAT start sector number
+54 H: DWORD FAT Number of sectors
+58 H: DWORD starting sector number cluster head
+5 Ch: DWORD number of clusters of volume
+60 H: DWORD root directory start cluster number
+64 H: DWORD Volume ID
+68 H: DWORD??? (0100h)
+6 Ch: BYTE SectorSizeShift
+6 Dh: BYTE ClusterShift
+6 Eh: BYTE??? (01h)
+6 Fh: BYTE??? (80h)
+1 Feh: WORD Signature (AA55h)
Equivalent to the FAT32 BPB +0 bh ~ +3 fh parts are filled with 0.
SectorSize = 1 <<SectorSizeShift
ClusterSize = SectorSize <<ClusterShift
Sector 0-8
+00 H: BYTE [510] Data (00h)
+1 Feh: WORD Signature (AA55h)
Sectors 9-10
Available?
Sector 11
Unknown (ex. 3ah cbh 3fh abh ...)
Sector 12-23
Sector backup 0-11
24 ~ FAT sector just before
Available
3.2. Directory entry
One directory entry consists of 32bytes, a combination of single and multiple
Representing the information of the file. 1byte top of the directory entry, the type of entry
And shows the remaining 31bytes be different depending on the information stored in the seed.
Now you can type the entries are as follows. For details, see below.
81h, 82h, 83h, 85h, C0h, C1h, 05h, 40h, 41h, 00h
The root directory is usually the first 83h, 81h, 82h Directory>
Order entry, and then stand in the public file.
Directory entries of files and subdirectories of the public, 85h, C0h, C1h of
Stand in order. If the file name exceeds 15 characters, C1h multiple stand.
(Example: 85h, C0h, C1h, C1h ... C1h)
FAT Unlike conventional, sub-directory, which contains the directory and their parents
".." Or "." And the directory entry is not created.
○ DirectoryEntry
+00 H: BYTE type
+01 H: BYTE [31] Data
○ type = 83h VolumeID
+00 H: BYTE type (83h)
+01 H: BYTE len (max: 11)
+02 H: WCHAR [11] VolumeID
+18 H: BYTE [8] reserved
Entry to store the volume name.
○ type = 81h ClusterBitmapFile
+00 H: BYTE type (81h)
+01 H: BYTE reserved (00h)
+02 H: BYTE [18] reserved
+14 H: DWORD StartCluster (0002h)
+18 H: QWORD FileSize
The position and size stored in a special file containing a bitmap that indicates the use of cluster
Show entry.
○ type = 82h CharUpperTableFile
+00 H: BYTE type (82h)
+01 H: BYTE reserved (00h)
+02 H: BYTE [2] reserved
+04 H: DWORD???
+08 H: BYTE [12] reserved
+14 H: DWORD StartCluster
+18 H: QWORD FileSize
Used to calculate the hash of the file name, a special file containing the sensitive conversion table
Entry indicating the position and size of the store.
○ type = 85h FileAttributes1
+00 H: BYTE type (85h)
+01 H: BYTE AdditionalEntryNum (2 ~ 18?)
+02 H: WORD Checksum
+04 H: DWORD Attributes
+08 H: DWORD CreationTime
+0 Ch: DWORD LastWriteTime
+10 H: DWORD LastAccessTime
+14 H: BYTE CreationTime (10ms)
+15 H: BYTE [3] reserved
+18 H: BYTE [8] reserved
Entries and attributes to store the file.
Date format is similar to conventional FAT.
Checksum calculation method is described below.
Attributes values are similar to conventional FAT.
○ type = C0h FileAttributes2
+00 H: BYTE type (C0h)
+01 H: BYTE FragmentFlag??? (01h or 03h)
+02 H: BYTE reserved???
+03 H: BYTE FileNameLength WCHAR filename length of unit
+04 H: WORD FileNameHash
+06 H: WORD reserved
+08 H: QWORD FileSize1
+10 H: DWORD reserved
+14 H: DWORD StartCluster
+18 H: QWORD FileSize2
Entries and attributes to store the file.
2 is a single file size, NTFS, and assumes that the compression of files, such as
Be. After the compressed file size or both is unknown. (Current value is the same
Are stored. )
FragmentFlag is 0 when the file size, or that the file division
When is 01h, while a continuous pattern file and 03h. (Unspecified)
FileNameHash calculation method is described below.
Unlike conventional FAT, is written as if the directory size.
(KURASUTABITTOMAPPU just because I do not know how far and in the end.)
Size is the multiple of the cluster size.
○ type = C1h FileName
+00 H: BYTE type (C1h)
+01 H: BYTE reserved
+02 H: WCHAR [15] FileName
Entry to store the file name.
If the file name exceeds 15 characters is used. The file name from the top
Stored sequentially. (Conventional FAT is not as backwards.)
○ type = 05h, 40h, 41h DeletedEntry
Deleted entry.
If you delete a file, type the most significant bit is zero.
When removed, the checksum is not recalculated.
○ type = 00h LastEntry
The last entry.
Checksum calculation method
That shows how to calculate the checksum to verify the integrity of the directory entry.
Typically, files are stored across multiple directory entries,
Checksum is calculated over the entire entry to them. The Checksum
When calculated, the checksum is calculated to skip areas.
WORD CalcChecksum (LPCBYTE entry)
(
WORD chk = 0;
int len, i;
len = 32 * (entry [1] + 1);
for (i = 0; i <len; i + +) (
if (i == 2 | | i == 3)
continue;
chk = (WORD) (((chk <<15) | (chk>> 1)) + entry);
)
return chk;
)
How to calculate file hashes
Hash of the file names, Unicode and then converted to uppercase in a calculation in bytes
Do. Converted to uppercase, the following code CharUpperW () is used to actually
Sensitive to the use of conversion tables below.
WORD CalcFileNameHash (LPCWSTR filename)
(
WORD chk = 0;
int len, i;
len = lstrlenW (filename);
for (i = 0; i <len; i + +) (
WCHAR c = (WCHAR) CharUpperW ((LPWSTR) filename);
chk = (WORD) (((chk <<15) | (chk>> 1)) + LOBYTE (c));
chk = (WORD) (((chk <<15) | (chk>> 1)) + HIBYTE (c));
)
return chk;
)
3.3. FAT
The structure of the FAT and FAT32 similar. However, the cluster number 28bit instead, 32bit
Said.
A number of the FAT. (TFAT to use two?)
KURASUTABITTOMAPPU, uppercase conversion table, root directory, be sure to FAT
The use of the cluster is written for the other file directory
Is written to use only the case of cluster division.
3.4. KURASUTABITTOMAPPU
Bitmap usage of the cluster. 1bit the one which corresponds to the cluster,
No.2 is the cluster head of cluster 0 of the corresponding byte 0bit.
If the bit is on, the cluster is in use.
FAT on usage and, if not identical to the usage of the bitmap,
Preference is given to the bitmap.
3.5. Uppercase conversion table
Table is converted to uppercase when used to calculate the hash of the file name.
WCHAR unit, U +0000 to U + FFFF are stored information is converted to size
To reduce any part of the conversion should not have been omitted. The end of the section is valid
FFFFH is stored, the next two bytes are stored in the number of characters to skip.
The following table shows an example of transformation capitalized.
+0000 H: 0000h (U +0000)
+0002 H: 0001h (U +0001)
+0004 H: 0002h (U +0002)
:
+0 B0Ch: 0556h (U +0586)
+0 B0Eh: FFFFh termination
+0 B10h: 17F6h number of skipped
+0 B12h: 2C63h (U +1 D7D) (0586h + 17F6h + 1 = 1D7Dh)
+0 B14h: 1D7Eh (U +1 D7E)
:
+1320 H: 2183h (U +2184)
+1322 H: FFFFh termination
+1324 H: 034Bh number of skipped
+1326 H: 24B6h (U +24 D0) (2184h + 034Bh + 1 = 24D0h)
:
+1358 H: 24CFh (U +24 E9)
+135 Ah: FFFFh termination
+135 Ch: 0746h number of skipped
+135 Eh: 2C00h (U +2 C30) (24E9h + 0746h + 1 = 2C30h)
:
+1548 H: 10C5h (U +2 D25)
+154 Ah: FFFFh termination
+154 Ch: D21Bh number of skipped
+154 Eh: FF21h (U + FF41) (2D25h + D12Bh + 1 = FF41h)
:
+16 C8h: FFFEh (U + FFFE)
+16 CAh: FFFFh (U + FFFF) termination
Four. History
2008/06/25
First published.
2008/06/27
Minor change. |
|
IP卡
狗仔卡
发表于 2009-2-22 07:33:04
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
发表于 2009-2-28 21:43:32