Author Topic: How to read Windows MFT  (Read 1342 times)

hutch--

  • Administrator
  • Member
  • ******
  • Posts: 4926
  • Mnemonic Driven API Grinder
    • The MASM32 SDK
Re: How to read Windows MFT
« Reply #15 on: September 19, 2017, 08:38:18 PM »
Having read JJ's last post, I know why I detest C++, endless clutter, unnecessary complexity and lousy performance.
hutch at movsd dot com
http://www.masm32.com    :biggrin:  :biggrin:

aw27

  • Member
  • ****
  • Posts: 852
  • Let's Make ASM Great Again!
Re: How to read Windows MFT
« Reply #16 on: September 19, 2017, 08:42:52 PM »
Congrats, so you finally realised that shared access had nothing to do with the problem :bgrin:
No wonder, your default is actually shared access.
Should be a bug somewhere in your libs.   :idea:

Quote
M$ doesn't lile your code
I always use M$ and normally the latest version. Builds without warnings or errors.

aw27

  • Member
  • ****
  • Posts: 852
  • Let's Make ASM Great Again!
Re: How to read Windows MFT
« Reply #17 on: September 19, 2017, 08:46:48 PM »
Having read JJ's last post, I know why I detest C++, endless clutter, unnecessary complexity and lousy performance.
I am not talking about C++ with objects, straight C++ is as performant as C and in many cases outperforms no optimized ASM. I have proven that and am still waiting for a contradiction.

hutch--

  • Administrator
  • Member
  • ******
  • Posts: 4926
  • Mnemonic Driven API Grinder
    • The MASM32 SDK
Re: How to read Windows MFT
« Reply #18 on: September 19, 2017, 09:00:51 PM »
Jose,

Forgive my humour here but I have heard this one many times.
Quote
performant as C and in many cases outperforms no optimized ASM

The simple answer is,
Quote
performant as [put any language you like here] and in many cases outperforms no optimized [put any language you like here]

 :P
hutch at movsd dot com
http://www.masm32.com    :biggrin:  :biggrin:

aw27

  • Member
  • ****
  • Posts: 852
  • Let's Make ASM Great Again!
Re: How to read Windows MFT
« Reply #19 on: September 19, 2017, 09:10:21 PM »
Forgive my humour here but I have heard this one many times.
Hutch,
This is small talk, actually with some sense of humour.
But I prefer this one for a good laugh:
Please translate this French sentence:
dans la cuisine=

habran

  • Member
  • *****
  • Posts: 1116
    • uasm
Re: How to read Windows MFT
« Reply #20 on: September 19, 2017, 09:16:59 PM »
Hi aw27 :biggrin:
nice proggy :t
It can be build as C or CPP
It builds instantly from the box with MSVS 2013 Community, however, it gives me:
Code: [Select]
Can't open MBR. Are you launching as Administrator? even though I run it as administrator
That doesn't mean tat it is something wrong with your proggy, it is probably my windows 8.1 fault

JJ, you need to set up your MSVS properly as it is obvious that it doesn't like you because it is aware that the filing is mutual :biggrin:
 
Cod-Father

jj2007

  • Member
  • *****
  • Posts: 7740
  • Assembler is fun ;-)
    • MasmBasic
Re: How to read Windows MFT
« Reply #21 on: September 19, 2017, 09:25:03 PM »
JJ, you need to set up your MSVS properly as it is obvious that it doesn't like you because it is aware that the filing is mutual :biggrin:

My C or C++ stuff builds just fine with MS VC and GCC. Even José's code builds without errors with GCC if I add a "W":

CreateFile(L"\\\\.\\PhysicalDrive0", ....  //WRONG
CreateFileW(L"\\\\.\\PhysicalDrive0", .... //RIGHT

Which won't help for the M$ compiler, its linker complains about "error LNK2019: unresolved external symbol ___report_rangecheckfailure referenced in function "void __cdecl hexDump(void *,int)" (?hexDump@@YAXPAXH@Z)" :greensml:

Having read JJ's last post, I know why I detest C++, endless clutter, unnecessary complexity and lousy performance.

But it keeps Google happy: Countless C/C++ coders searching the internet in a desperate attempt to understand their endless error messages. Trial and error as the ultimate programming paradigm. Even ML64 is more compatible and consistent than the average C++ compiler :biggrin:

habran

  • Member
  • *****
  • Posts: 1116
    • uasm
Re: How to read Windows MFT
« Reply #22 on: September 19, 2017, 09:26:58 PM »
aw27, I'd suggest you to rewrite it in asm 32 and 64 bit and post it here
we can include it in Sample folder for UASM
 :biggrin:
Cod-Father

habran

  • Member
  • *****
  • Posts: 1116
    • uasm
Re: How to read Windows MFT
« Reply #23 on: September 19, 2017, 09:35:57 PM »
JJ, you just said it wouldn't build and I have done it instantly, so, what conclusion we can draw from that?
 :biggrin:
I am not trying to make you stupid or something, I appreciate you and your programming skills as well as your personality :t
However, if your M$ refuses to build such a simple proggy than I have to come to conclusion that something is wrong with it.
Wouldn't you agree with that logic?

Cod-Father

aw27

  • Member
  • ****
  • Posts: 852
  • Let's Make ASM Great Again!
Re: How to read Windows MFT
« Reply #24 on: September 19, 2017, 09:38:07 PM »
That doesn't mean tat it is something wrong with your proggy, it is probably my windows 8.1 fault
Hi habran!
I tested in Windows 8.1 and it works, a possible cause might be security software.

Quote
I'd suggest you to rewrite it in asm 32 and 64 bit and post it here
All right, I will put on the agenda. :t


jj2007

  • Member
  • *****
  • Posts: 7740
  • Assembler is fun ;-)
    • MasmBasic
Re: How to read Windows MFT
« Reply #25 on: September 19, 2017, 09:40:05 PM »
However, if your M$ refuses to build such a simple proggy than I have to come to conclusion that something is wrong with it.
Wouldn't you agree with that logic?

Absolutely :t

Btw José's code works, when compiled with GCC and run as admin, see attachment. A bit bloated at 29k but ok, let's be generous :bgrin:

aw27

  • Member
  • ****
  • Posts: 852
  • Let's Make ASM Great Again!
Re: How to read Windows MFT
« Reply #26 on: September 19, 2017, 09:43:13 PM »
CreateFileW(L"\\\\.\\PhysicalDrive0", .... //RIGHT
JJ, the default for M$ in this century is Use Unicode Character Set. But M$ is flexible and will let you use Multibytes (select it in Project Properties), in which case you need to remove the L", which means (guess what?)

jj2007

  • Member
  • *****
  • Posts: 7740
  • Assembler is fun ;-)
    • MasmBasic
Re: How to read Windows MFT
« Reply #27 on: September 19, 2017, 09:47:00 PM »
JJ, the default for M$ in this century is Use Unicode Character Set.

Is it? My M$ C compiler is version 19.00.24215.1, 21st century. Besides, GCC uses another default. Aren't C compiler supposed to be "compatible", whatever that means...?

habran

  • Member
  • *****
  • Posts: 1116
    • uasm
Re: How to read Windows MFT
« Reply #28 on: September 19, 2017, 09:51:36 PM »
aw27,
I have no idea what is wrong with my system, there is quite a few issues with it, I was not even able to install MSVS 2017 because of some administrator's bull**it, however, other people had the same problem
However, I am happy for now with MSVS 2013 Community :t
Cod-Father

jj2007

  • Member
  • *****
  • Posts: 7740
  • Assembler is fun ;-)
    • MasmBasic
Re: How to read Windows MFT
« Reply #29 on: September 19, 2017, 10:03:58 PM »
I have no idea what is wrong with my system

OMG, your M$ is also rotten? It seems the World is full of rotten M$ systems and compilers :dazzled:

(hint: Masm32 works out of the box on all Windows versions since the beginning of the 21st Century ;))