1581, 1/80 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   havu
   http://havu.tistory.com
   [ÀÚÀÛ]Æ÷·»½ÄÀ»À§ÇÑNTFS±¸Á¶

http://www.hackerschool.org/HS_Boards/zboard.php?id=Free_Lectures&no=1923 [º¹»ç]


¿¾³¯¿¡ µ¿¿µ»ó º¸¸é¼­ Á¤¸®Çصаǵ¥
µµ¿òµÇ½Ã¶ó°í ¿Ã·Áº¾´Ï´Ù.



## MFT(Master File Table)

# MFT¶õ
- MFT EntryµéÀÇ ¸ðÀ½
- MFTÀÇ ½ÃÀÛÀ§Ä¡´Â BR¿¡¼­ È®ÀÎÇÑ´Ù.
- MFTÀÇ Å©±â´Â º¼·ý¿¡ ÀÖ´Â ÆÄÀÏ°ú µð·ºÅ丮ÀÇ °³¼ö¿¡ ºñ·ÊÇÑ´Ù.
  ¿¹)º¼·ý¿¡ ÆÄÀÏ°ú µð·ºÅ丮ÀÇ °³¼ö°¡ 60000°³ÀÏ ¶§ MFT Entry°³¼ö´Â ´ë·« 60000°³ ÀÌ»ó Â÷ÁöÇÑ´Ù.
  60000 * 1KB = 60000 KB = ¾à 60 MB

# MFT Entry
- ÆÄÀÏ ¶Ç´Â µð·ºÅ丮¿¡ ´ëÇÑ Á¤º¸¸¦ ´ã°í ÀÖ´Ù.ÆÄÀϸí,Å©±â,½Ã°£,ÆÄÀϳ»¿ë,À§Ä¡,±ÇÇÑ,ÇÒ´ç·® ...
- ±âº»ÀûÀ¸·Î ÆÄÀÏÀ̳ª µð·ºÅ丮´Â ÇϳªÀÇ Entry¸¦ »ç¿ëÇÏ¸ç ±â·ÏÇÒ ³»¿ëÀÌ ¸¹Àº °æ¿ì Entry¸¦  
   ¿©·¯ °³ »ç¿ëÇÒ ¼öµµ ÀÖ´Ù.
- ±âº» Å©±â´Â 1KBÀÌ´Ù.(BR ¶Ç´Â MFT Entry Header¿¡¼­ È®Àΰ¡´É)
- MFT Entry´Â ¼½ÅÍ 2°³¸¦ Â÷ÁöÇÑ´Ù.
- MFT Entry Header¿Í ¿©·¯ °³ÀÇ ¼Ó¼ºµé(Attributes)·Î ±¸¼ºµÈ´Ù.
- MFT Entry ¸¶Áö¸· ¼Ó¼ºÀÇ µÞºÎºÐ¿¡ End Marker(0xFFFFFFFF)·Î ³¡³­´Ù.


## MFT Entry Header
- Å©±â°¡ 42 bytes

# Signature
- MFT EntryÀÓÀ» ³ªÅ¸³»´Â Ç¥½ÃÀÌ´Ù.
- À§Ä¡: 0~3¹ø ¹ÙÀÌÆ®
- Å©±â: 4 Bytes
- Á¤»ó Entry¿¡´Â FILE À̶ó´Â ¹®ÀÚ¿­ÀÌ ÀûÇôÀÖ´Ù.
- ¹®Á¦°¡ ¹ß°ßµÈ Entry¿¡´Â BAAD¶ó°í ÀûÇôÀÖ´Ù.


# Offset of Fixup Array
- MFT Entry ½ÃÀÛ À§Ä¡·ÎºÎÅÍ  Fixup ¹è¿­±îÁöÀÇ °Å¸®
- À§Ä¡: 4~5¹ø ¹ÙÀÌÆ®
- Å©±â: 2 Bytes
- º¸Åë 0x48À̶ó°í ÀûÇôÀÖ´Ù.

(Âü°í) Fixup Array
- µ¥ÀÌÅÍ°¡ ÀúÀåµÈ ¼½ÅÍÀÇ ³»¿ëÀÇ ¼Õ»ó¿©ºÎ¸¦ È®ÀÎÇϱâ À§ÇÑ ±â¹ý
- ¼½ÅÍÀÇ ¸¶Áö¸· 2¹ÙÀÌÆ®¸¦ ƯÁ¤ Signature·Î ¹Ù²ã³õ°í ¿ø·¡ÀÇ 2¹ÙÀÌÆ® °ªÀº Fixup¹è¿­¿¡
   ±â·ÏÇØ µÐ´Ù.
- Signature°ªÀº Fixup ¹è¿­ÀÇ ¸Ç¾Õ¿¡ ±â·ÏÇÑ´Ù.
- ¼½Å͸¦ ÀÐÀ» ¶§ Signature°ªÀÌ Æ²¸®¸é ¼Õ»óµÈ ¼½ÅÍ·Î °£ÁÖÇÑ´Ù.
- À§Ä¡: º¸Åë MFT Entry Header°¡ ³¡³ª°í ¹Ù·Î À̾îÁø´Ù. Offset to Fixup ArrayÇ׸ñ¿¡¼­ È®ÀÎ
- Å©±â: Count of Fixup Values Ç׸ñ¿¡¼­ È®ÀÎ
- ÀÌ ±â¹ýÀÌ »ç¿ëµÇ´Â Ç׸ñÀº MFT Entry,Index Record, RCRD Record, RSTR Record µîÀÌ´Ù.
- ÆÄÀÏ ³»¿ëÀÌ µé¾î°¡´Â Ŭ·¯½ºÅÍÀÇ ¼½ÅÍ¿¡´Â Àû¿ëÇÏÁö ¾Ê´Â´Ù.

# Count of Fixup Values
- Fixup ¹è¿­(Array)ÀÇ Å©±â(Ç׸ñÀÇ °³¼ö)
- MFT Entry´Â ±âº»ÀûÀ¸·Î 3ÀÌ´Ù.
   (MFT Entry°¡ 1KBÀ̹ǷΠ¼½ÅÍ 2°³¸¦ »ç¿ë + Signature°¡ 1°³ Ç׸ñ »ç¿ë)
- À§Ä¡: 6~7¹ø ¹ÙÀÌÆ®
- Å©±â: 2 ¹ÙÀÌÆ®

# $LogFile Sequence Number(LSN)
- ¼³¸íÀº µÚ¿¡¼­ ´Ù½Ã ´Ù·é´Ù.
- ³»¿ëÀº ´Ù¾çÇÑ °ªÀ» °¡Áú ¼ö ÀÖ´Ù.
- À§Ä¡: 8~15¹ø ¹ÙÀÌÆ®
- Å©±â: 8 ¹ÙÀÌÆ®

# Sequence Value
- MFT Entry°¡ ÇÒ´ç ¶Ç´Â ÇØÁ¦µÉ ¶§ °ªÀÌ Áõ°¡ÇÑ´Ù.
- MFT Entry¸¦ ÀçÇÒ´çÇϸé ÀÌ°ªÀÌ ¹Ù²î¹Ç·Î ³»¿ëÀÌ ¹Ù²î¾ú´Ù´Â °ÍÀ» ÃßÃøÇÒ ¼ö ÀÖ´Ù.
- À§Ä¡: 16~17¹ø ¹ÙÀÌÆ®
- Å©±â: 2 ¹ÙÀÌÆ®(16 bit)

(Âü°í) File Reference Address (64 bit)
Seqence Value(16 bit) + MFT Entry Address(48 bit)

# Hard Link Count
- ÇÏµå ¸µÅ©ÀÇ °³¼ö
- º¸Åë 1 ÀÌ´Ù. Base MFT Entry¿¡¼­¸¸ »ç¿ëµÈ´Ù.
- Hard Link °³³äÀ» À©µµ¿ì¿¡¼­µµ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ÇÏÁö¸¸ ½ÇÁ¦ µµ±¸°¡ ¾ø¾î¼­ »ç¿ëÇÒ
  ¼ö ¾ø´Ù. ±×·¯³ª MS¿¡¼­ Á¦°øµÇ´Â µµ±¸°¡ ÀÖ´Ù.
- À§Ä¡: 18~19
- Å©±â: 2 Bytes

# Offset to First Attribute
- MFT EntryÀÇ Ã¹ ¹ø° ¼Ó¼º(Attribute)ÀÇ À§Ä¡(Offset)
- º¸Åë 56(D)=0x38 ÀÌÁö¸¸ ¾ó¸¶µçÁö ´Ù¸¥ °ªÀÌ ¿Ã ¼ö ÀÖ´Ù. È®ÀÎ Çʼö
- À§Ä¡: 20~21
- Å©±â: 2 Bytes

# Flags
- MFT EntryÀÇ »óÅÂÁ¤º¸
- ³»¿ëÀÌ 0x1 À̸é MFT Entry°¡ »ç¿ë ÁßÀÓÀ» ³ªÅ¸³½´Ù.
- ³»¿ëÀÌ 0x2 À̸é MFT Entry°¡ µð·ºÅ丮¿¡ »ç¿ëµÇ°í ÀÖÀ½À» ³ªÅ¸³½´Ù.
- À§Ä¡: 22~23¹ø ¹ÙÀÌÆ®
- Å©±â: 2 ¹ÙÀÌÆ®

# Used Size of MFT Entry
- MFT Entry Àüüũ±â(º¸Åë 1KB)Áß¿¡¼­ »ç¿ëÁßÀÎ °ø°£ÀÇ Å©±â¸¦ ³ªÅ¸³½´Ù. Á¤È®ÇÏÁö´Â
   ¾Ê°í 8ÀÇ ¹è¼ö·Î ±â·ÏµÈ´Ù.
- ³»¿ë: ´Ù¾çÇÑ °ªÀ» °¡Áú ¼ö ÀÖÀ½.
- À§Ä¡: 24~27¹ø ¹ÙÀÌÆ®
- Å©±â: 4 ¹ÙÀÌÆ®

# Allocated Size of MFT Entry
- MFT Entry Àüüũ±â¸¦ ³ªÅ¸³½´Ù.
- º¸Åë 1024 °¡ ÀûÇôÀÖ´Ù. (MFT Entry´Â 1KB·Î °íÁ¤µÇ¾î ÀÖÀ½)
- À§Ä¡: 28~31¹ø ¹ÙÀÌÆ®
- Å©±â: 4 ¹ÙÀÌÆ®

# File Reference to Base MFT Entry
- Non-Base MFT EntryÀÇ Base MFT EntryÀÇ À§Ä¡¸¦ ³ªÅ¸³½´Ù.
- File Reference Address·Î ±â·ÏµÇ¾î ÀÖ´Ù.
- Non-Base MFT Entry ¿¡¼­¸¸ ±â·ÏµÈ´Ù.
- Base MFT Entry¿¡¼­´Â ¾ðÁ¦³ª 0 ÀÌ´Ù.
- À§Ä¡: 32~39¹ø ¹ÙÀÌÆ®
- Å©±â: 8 ¹ÙÀÌÆ®

(Âü°í) Base MFT Entry & Non base MFT Entry

# Next Attribute ID
- ÇöÀç MFT Entry¿¡ »õ·Î¿î ¼Ó¼ºÀÌ ±â·ÏµÉ ¶§ »ç¿ëÇÒ ¼Ó¼ºID(°íÀ¯ÇÑ °ª, ¼Ó¼º TYPE ID¿Í ´Ù¸§)
- À§Ä¡: 40~41¹ø ¹ÙÀÌÆ®
- Å©±â: 2 ¹ÙÀÌÆ®

## Attribute(¼Ó¼º)

# ±¸¼º
- ¼Ó¼º Çì´õ(Header) + ¼Ó¼º ³»¿ë(Content)

# ¼Ó¼º Çì´õ ±¸Á¶ (Resident)
- Resident ÇüÅÂÀÇ ¼Ó¼ºÀº ³»¿ëÀÌ MFT Entry³»¿¡ ÀÖ´Ù
- $FILE_NAME (ÆÄÀÏ À̸§ ¼Ó¼º)

# ¼Ó¼º Çì´õ ±¸Á¶ (Non-Resident)
- Non-resident ÇüÅÂÀÇ ¼Ó¼ºÀº ³»¿ëÀÌ ´Ù¸¥ Ŭ·¯½ºÅÍ¿¡ µé¾îÀÖ°í ¼Ó¼º¿¡´Â À§Ä¡¸¸ ±â·ÏµÊ.

# ¼Ó¼º Á¾·ù(Attribure Type)
$STANDARD_INFORMATION                
$ATTRIBUTE_LIST
$FILE_NAME
$VOLUME_VERSION
$OBJECT_ID
$SECURITY_DESCRIPTOR
$VOLUME_NAME
$VOLUME_INFORMATION
$DATA
$INDEX_ROOT
$INDEX_ALLOCATION
$BITMAP
$SYMBOLIC_LINK
$REPARSE_POINT
$EA_INFORMATION
$EA
$LOGGED_UTILITY_STREAM


# $STANDARD_INFORMATION
- ÆÄÀÏ°ú µð·ºÅ丮¿¡ ´ëÇÑ ½Ã°£Á¤º¸/¼ÒÀ¯ÀÚ/º¸¾È¼³Á¤/ÆÄÀÏÁ¾·ù/ÇÒ´ç·® µîÀÇ Á¤º¸¸¦ ´ã´Â´Ù.
- ¸ðµç ÆÄÀÏ°ú µð·ºÅ丮¿¡ ´ëÇÑ Base MFT Entry¿¡´Â ¹Ýµå½Ã Á¸ÀçÇÏ´Â ¼Ó¼º
- ¼Ó¼º ŸÀÔ ¹øÈ£ : 0x16                 
- ÀúÀå ÇüÅÂ: ¹Ýµå½Ã Resident ÇüŸ¸ °¡´ÉÇÔ
- Å©±â: º¸Åë 72(Byte), ´Ù¸¦ ¼ö ÀÖÀ½, È®ÀÎ ÇÊ¿ä

- ¼Ó¼º ±¸Á¶ ¿ä¾à

Ç׸ñ À̸§        ¼³¸í        À§Ä¡        Å©±â          
Created Time        Ã³À½À¸·Î ÆÄÀÏÀÌ »ý¼ºµÈ ½Ã°£ Á¤º¸        0~7        8          
Modified Time        ¸¶Áö¸·À¸·Î ÆÄÀÏ ³»¿ëÀÌ ¼öÁ¤µÈ ½Ã°£        8~15        8          
MFT Modified Time        MFT Entry ³»¿ëÀÌ ¸¶Áö¸·À¸·Î ¼öÁ¤µÈ ½Ã°£        16~23        8          
Accessed Time        ¸¶Áö¸·À¸·Î ÆÄÀÏ ³»¿ëÀ» Á¢±ÙÇÑ ½Ã°£        24~31        8          
Flags        ÆÄÀÏÀÇ Æ¯¼º        32~35        4          
Maximum number of version                36~39        4          
Version Number                40~43        4          
Class ID                44~47        4          
Owner ID        ÆÄÀÏÀÇ ¼ÒÀ¯ÀÚÀÇ ID        48~51        4          
Security ID                52~55        4          
Quota Charged                56~63        8          
Update Sequence Number                64~71        8        


# $FILE_NAME
- ÆÄÀÏÀ̳ª µð·ºÅ丮ÀÇ À̸§°ú À̸§¿¡ °ü·ÃµÈ Ãß°¡ Á¤º¸°¡ ÀúÀåµÇ´Â ¼Ó¼ºÀÌ´Ù.
- ÀÌ ¼Ó¼ºÀº ¹Ýµå½Ã Base MFT Entry¿¡ ÀÖ¾î¾ß ÀÐÀ» ¼ö ÀÖ´Ù.
- ¼Ó¼º ŸÀÔ ¹øÈ£ : 0x48
- ÀúÀå ÇüÅÂ: ¹Ýµå½Ã Resident ÇüŸ¸ °¡´ÉÇÔ
- $FILE_NAMEÀÇ Attribute Content ±¸Á¶

À§Ä¡        Å©±â        ¼³¸í          
0~7        8        ºÎ¸ð µð·ºÅ丮ÀÇ File Reference Address          
8~15        8        Created Time          
16~23        8        Modified Time          
24~31        8        MFT Modified Time          
32~39        8        Accessed Time          
40~47        8        ÆÄÀÏÀÇ ÇÒ´ç Å©±â          
48~55        8        ÆÄÀÏÀÇ ½ÇÁ¦ Å©±â          
56~59        4        Flag          
60~63        4        Reparse Value          
64~64        1        À̸§ÀÇ ±æÀÌ          
65~65        1        À̸§ÀÇ Çü½Ä          
66~??        µ¿Àû        À̸§        
- ÀÌ ¼Ó¼ºÀº Index Entry¿¡µµ Á¸ÀçÇϸç Index Entry¿¡ ÀÖ´Â $FILE_NAME¼Ó¼ºÀ» ¿ì¼±ÀûÀ¸·Î °»½ÅÇÑ´Ù.
- Flag Ç׸ñÀº $STANDARD_INFORMATION ¼Ó¼ºÀÇ flag¿Í µ¿ÀÏÇÑ ±¸Á¶ÀÌ´Ù.

# $DATA
- ½ÇÁ¦ ÆÄÀÏÀ̳ª µð·ºÅ丮ÀÇ ³»¿ëÀÌ ÀúÀåµÇ´Â °ø°£ÀÌ´Ù.
- ¼Ó¼º ŸÀÔ ¹øÈ£ : 0x128
- ÀúÀå ÇüÅÂ: 700 Byte¸¦ ±âÁ¡À¸·Î ÀÛÀ¸¸é Resident ÇüÅ·ΠÀúÀåµÇ°í Å©¸é Non-Resident ÇüÅ·ΠÀúÀåµÈ´Ù.

# $DATA¼Ó¼ºÀÇ ADS Ç׸ñ
- Alternate Data Stream
- ÆÄÀÏÀ̳ª µð·ºÅ丮¿¡ Ãß°¡µÇ´Â $DATA ¼Ó¼º

  Hit : 11970     Date : 2012/01/11 11:47



    
ktmahacker ÀÌ°Í °øºÎÇÏ´À¶ó°í °í»ý¸¹ÀÌ Çߴµ¥
¶Ç »ç¿ëÇÏÁö ¾ÊÀ¸´Ï±î Àؾî¹ö·È³×¿ä.
´Ù½Ã °øºÎÇØ¾ß ÇÒ °Í °°³×¿ä
2012/01/13  
havu ktmahacker // µ¿±âºÎ¿©°¡ ‰ç´Ù¸é ÁÁÀº°ÅÁÒ! È­ÀÌÆà 2012/01/13  
     [°øÁö] °­Á¸¦ ¿Ã¸®½Ç ¶§´Â ¸»¸Ó¸®¸¦ ´Þ¾ÆÁÖ¼¼¿ä^¤Ñ^ [29] ¸Û¸Û 02/27 18684
1580   °í¼ö´ÔµéÀÇ µµ¿òÀ» ¹Þ°í ½Í½À´Ï´Ù     vbnm111
02/11 140
1579   ¸®´ª½º Ä¿³Î 2.6 ¹öÀü ÀÌÈÄÀÇ LKM     jdo
07/25 647
1578   ½©ÄÚµå ¸ðÀ½     ÇØÅ·ÀßÇÏ°í½Í´Ù
01/15 1457
1577   Call by value VS Call by Reference     ÇØÅ·ÀßÇÏ°í½Í´Ù
01/15 847
1576   (²Ä¼ö) L.O.B Çѹ濡 Ŭ¸®¾îÇϱâ[2]     ÇØÅ·ÀßÇÏ°í½Í´Ù
01/14 1162
1575   towelroot.c (zip) ÄÚ¸àÆÃ.[1]     scube
08/18 3686
1574   levitator.c (¾Èµå·ÎÀÌµå ·çÆÃ) °ø°Ý ºÐ¼® ¼Ò½º ÄÚµå °øÀ¯.[4]     scube
08/17 3614
1573   ¹«·á Á¤º¸º¸¾È ±â¼úÀÎÀç ¾ç¼º °úÁ¤ ±³À°»ý ¸ðÁý     chanjung111
06/17 4406
1572   K-Shield ÁִϾî 5±â ¸ðÁý     lrtk
06/17 4150
1571   [ÆÁ] ÆÄÀ̽ã 2¼Ò½º¸¦ 3À¸·Î º¯°æÇØÁÖ´Â »çÀÌÆ®[3]     ÇѽÂÀç
05/13 3843
1570   ±¸±Û ¹é¸µÅ© ÀÛ¾÷ Áú¹®¿ä     wkatnxka
03/30 3297
1569   [ÆÁ] ¿ìºÐÅõ ¹Ì·¯¸µ¼­¹ö     ÇѽÂÀç
03/09 3984
1568 ºñ¹Ð±ÛÀÔ´Ï´Ù  °¨À»¸øÀâ°Ú³×¿ä¤Ì¤Ì     À×À×À×
01/15 3
1567   µ¥ºñ¾È °è¿­ ¸®´ª½º ÀÇÁ¸¼º ±úÁ³À»¶§ ÇØ°á¹ý     ÇѽÂÀç
11/27 4460
1566   È«º¸ÇÕ´Ï´Ù. ½Å»ý º¸¾ÈÄ¿¹Â´ÏƼÀÔ´Ï´Ù.     kimwoojin0952
10/26 4195
1565   ½Å±âÇÑ ÇÁ·Î±×·¡¹Ö ¾ð¾î[3]     koreal33t
09/06 4591
1564   À©µµ¿ì,¸®´ª½º¿¡¼­ ³» ip¸¦ È®ÀÎÇØ º¸ÀÚ [1]     koreal33t
09/06 3792
1563   CTF »çÀÌÆ®[1]     koreal33t
09/06 4444
1562   ÀÚ°ÝÁõ (¹®Á¦)»çÀÌÆ® [2]     koreal33t
09/06 4262
1 [2][3][4][5][6][7][8][9][10]..[80]

Copyright 1999-2024 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org