Function 70, subfunction 1 - read folder with long names support.
Parameters:
- eax = 70 - function number
- ebx = pointer to the information structure
Format of the information structure:
- +0: dword: 1 = subfunction number
- +4: dword: index of starting block (beginning from 0)
- +8: dword: flags field:
- bit 0 (mask 1): in what format to return names,
0=ANSI, 1=UNICODE
- other bits are reserved and must be set to 0 for the future
compatibility
- +12 = +0xC: dword: number of blocks to read
- +16 = +0x10: dword: pointer to buffer for data, buffer size
must be not less than 32 + [+12]*560 bytes
- +20 = +0x14: ASCIIZ-name of folder, the rules of names forming are
given in the general description
or
- +20 = +0x14: db 0
- +21 = +0x15: dd pointer to ASCIIZ-string with file name
Returned value:
- eax = 0 - success, otherwise file system error code
- ebx = number of files, information on which was written to
the buffer, or -1=0xffffffff, if folder was not found
Structure of the buffer:
- +0: 32*byte: header
- +32 = +0x20: n1*byte: block with information on file 1
- +32+n1: n2*byte: block with information on file 2
- ...
Structure of header:
- +0: dword: version of structure (current is 1)
- +4: dword: number of placed blocks; is not greater than requested
in the field +12 of information structure; can be less, if
there are no more files in folder (the same as in ebx)
- +8: dword: total number of files in folder
- +12 = +0xC: 20*byte: reserved (zeroed)
Structure of block of data for folder entry (BDFE):
- +0: dword: attributes of file:
- bit 0 (mask 1): file is read-only
- bit 1 (mask 2): file is hidden
- bit 2 (mask 4): file is system
- bit 3 (mask 8): this is not a file but volume label
(for one partition meets no more than once and
only in root folder)
- bit 4 (mask 0x10): this is a folder
- bit 5 (mask 0x20): file was not archived - many archivation
programs have an option to archive only files with this bit set,
and after archiving this bit is cleared - it can be useful
for automatically creating of backup-archives as at writing
this bit is usually set
- +4: byte: type of name data:
(coincides with bit 0 of flags in the information structure)
- 0 = ASCII = 1-byte representation of each character
- 1 = UNICODE = 2-byte representation of each character
- +5: 3*byte: reserved (zero)
- +8: 4*byte: time of file creation
- +12 = +0xC: 4*byte: date of file creation
- +16 = +0x10: 4*byte: time of last access (read or write)
- +20 = +0x14: 4*byte: date of last access
- +24 = +0x18: 4*byte: time of last modification
- +28 = +0x1C: 4*byte: date of last modification
- +32 = +0x20: qword: file size in bytes (up to 16777216 Tb)
- +40 = +0x28: name
- for ASCII format: maximum length is 263 characters
(263 bytes), byte after the name has value 0
- for UNICODE format: maximum length is 259 characters
(518 bytes), 2 bytes after the name have value 0
Time format:
- +0: byte: seconds
- +1: byte: minutes
- +2: byte: hours
- +3: byte: reserved (0)
- for example, 23.59.59 is written as (in hex) 3B 3B 17 00
Date format:
- +0: byte: day
- +1: byte: month
- +2: word: year
- for example, 25.11.1979 is written as (in hex) 19 0B BB 07
Remarks:
- If BDFE contains ASCII name, the length of BDFE is 304 bytes,
if UNICODE name - 560 bytes. Value of length is aligned
on 16-byte bound (to accelerate processing in CPU cache).
- First character after a name is zero (ASCIIZ-string). The further
data contain garbage.
- If files in folder were ended before requested number was read,
the function will read as many as it can, and after that return
eax=6 (EOF).
- Any folder on the disk, except for root, contains two special
entries "." and "..", identifying accordingly the folder itself
and the parent folder.
- The function allows also to read virtual folders "/", "/rd",
"/fd", "/hd[n]", thus attributes of subfolders are set to 0x10,
and times and dates are zeroed. An alternative way to get the
equipment information - subfunction 11 of function 18.