Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to read and modify NTFS Alternate Data Streams using .NET [closed]

How can I read and modify "NTFS Alternate Data Streams" using .NET?

It seems there is no native .NET support for it. Which Win32 API's would I use? Also, how would I use them, as I don't think this is documented?

like image 848
user72491 Avatar asked Mar 03 '09 03:03

user72491


People also ask

What are NTFS alternate data streams?

NTFS file streams, also known as alternate data streams (ADS), are part of every file, as well as directories (folders), in a Windows NTFS volume. NTFS files and folders are comprised of attributes one of which is $Data. The content we normally associate with a file such as the text in a .

How do I use alternate stream view?

Using AlternateStreamViewAfter running it, choose the drive or folder that you wish to scan, and click Ok. AlternateStreamView will scan the selected folder, and then it'll display all alternate streams found in the selected drive/folder.

What are some dangers of having alternate data streams?

Alternate Data Streams enables information to be hidden within other files. As such, it can be a security risk. An attacker can easily store malicious codes or payloads and use them to cause damages to your system.

Which command can you use in Windows Vista and later to display alternate data streams?

Windows Vista does have a switch (-R) on the command line DIR command that will display alternate streams.


1 Answers

Here is a version for C#

using System.Runtime.InteropServices;  class Program {     static void Main(string[] args)     {         var mainStream = NativeMethods.CreateFileW(             "testfile",             NativeConstants.GENERIC_WRITE,             NativeConstants.FILE_SHARE_WRITE,             IntPtr.Zero,             NativeConstants.OPEN_ALWAYS,             0,             IntPtr.Zero);          var stream = NativeMethods.CreateFileW(             "testfile:stream",             NativeConstants.GENERIC_WRITE,             NativeConstants.FILE_SHARE_WRITE,             IntPtr.Zero,             NativeConstants.OPEN_ALWAYS,             0,             IntPtr.Zero);     } }  public partial class NativeMethods {      /// Return Type: HANDLE->void*     ///lpFileName: LPCWSTR->WCHAR*     ///dwDesiredAccess: DWORD->unsigned int     ///dwShareMode: DWORD->unsigned int     ///lpSecurityAttributes: LPSECURITY_ATTRIBUTES->_SECURITY_ATTRIBUTES*     ///dwCreationDisposition: DWORD->unsigned int     ///dwFlagsAndAttributes: DWORD->unsigned int     ///hTemplateFile: HANDLE->void*     [DllImportAttribute("kernel32.dll", EntryPoint = "CreateFileW")]     public static extern System.IntPtr CreateFileW(         [InAttribute()] [MarshalAsAttribute(UnmanagedType.LPWStr)] string lpFileName,          uint dwDesiredAccess,          uint dwShareMode,          [InAttribute()] System.IntPtr lpSecurityAttributes,          uint dwCreationDisposition,          uint dwFlagsAndAttributes,          [InAttribute()] System.IntPtr hTemplateFile     );  }   public partial class NativeConstants {      /// GENERIC_WRITE -> (0x40000000L)     public const int GENERIC_WRITE = 1073741824;      /// FILE_SHARE_DELETE -> 0x00000004     public const int FILE_SHARE_DELETE = 4;      /// FILE_SHARE_WRITE -> 0x00000002     public const int FILE_SHARE_WRITE = 2;      /// FILE_SHARE_READ -> 0x00000001     public const int FILE_SHARE_READ = 1;      /// OPEN_ALWAYS -> 4     public const int OPEN_ALWAYS = 4; } 
like image 196
JaredPar Avatar answered Oct 03 '22 11:10

JaredPar