for ReFS file system research

Windows ReFS.md

Non-workstation version, fast formatting of ReFS file system partitions.

"refs-format.js"

/* https://github.com/nblog/my-fridajs-example/blob/dev/aobscan.ts */
class addr_transform {

    #moduleName = ''

    constructor(moduleName='') {
        this.#moduleName = moduleName || Process.enumerateModules()[0].name;
    };

    module() { return Process.getModuleByName(this.#moduleName); };

    base() { return this.module().base; };

    va(rva) { return this.base().add(rva); };

    rva(va) { return Number(va.sub(this.base()).and(0x7fffffff)); };

    imm8(addr) { return addr.readU8(); };

    imm16(addr) { return addr.readU16(); };

    imm32(addr) { return addr.readU32(); };

    imm64(addr) { return addr.readU64(); }

    mem32(addr) { return this.rva(addr.add(addr.readS32()).add(4)); };

    call(addr) { return this.mem32(addr.add(1)); };

    equal(addr, cmd='call') {
        let info = Instruction.parse(addr);
        return [ info.mnemonic, info.opStr ].join(' ').includes(cmd.toLowerCase());
    };

    aobscan(pattern) {
        for (const m of this.module().enumerateRanges('--x')) {
            let match = Memory.scanSync(m.base, m.size, pattern);
            if (0 < match.length) return match;
        }
        return [];
    };
}


Module.load('uRefs.dll')

const FormatEx = Module.getExportByName('uRefs.dll', 'FormatEx');

console.log(`found: ${FormatEx}`);

const m = Memory.scanSync(FormatEx, 256, 'E8 ?? ?? ?? ?? 85 C0');

console.log(`${'uRefs::FormatEx'}: ${JSON.stringify(m)}`);

const helper = new addr_transform('uRefs.dll');
let IsRefsFormatEnabled = helper.va(helper.call(m[0].address));

console.log(`${'uRefs::IsRefsFormatEnabled'}: ${IsRefsFormatEnabled}`); 


Interceptor.attach(IsRefsFormatEnabled, {
    onEnter: function (args) { },
    onLeave: function (retval) { retval.replace(1); }
});


/*
frida -l "refs-format.js" -f %SystemRoot%\System32\format.com /FS:ReFS /Y /Q /V: E:
fsutil fsinfo refsinfo E: | FIND "REFS "
*/

Install python and install the dependency python -m pip install -U frida frida-tools, start cmd with administrator to begin