当前位置：首页 > backend >正文

Ntfs!FindFirstIndexEntry函数中ReadIndexBuffer函数的作用是新建一个Ntfs!_INDEX_LOOKUP_STACK结构

backend 2025/5/24 8:04:31

第一部分：

0: kd> kc
#
00 Ntfs!FindFirstIndexEntry
01 Ntfs!NtfsRestartIndexEnumeration
02 Ntfs!NtfsQueryDirectory
03 Ntfs!NtfsCommonDirectoryControl
04 Ntfs!NtfsFsdDirectoryControl
05 nt!IofCallDriver
06 nt!IopSynchronousServiceTail
07 nt!NtQueryDirectoryFile
08 nt!_KiSystemService
09 nt!ZwQueryDirectoryFile
0a nt!CcPfPrefetchDirectoryContents
0b nt!CcPfPrefetchMetadata
0c nt!CcPfBootWorker
0d nt!PspSystemThreadStartup
0e nt!KiThreadStartup

第二部分：

        //
        // Otherwise, read the index buffer pointed to by the current
        // Index Entry.
        //

        ReadIndexBuffer( IrpContext,
                         Scb,
                         NtfsIndexEntryBlock((Sp-1)->IndexEntry),
                         FALSE,
                         Sp );

0: kd> dv
     IrpContext = 0xf793291c
            Scb = 0xe13523a8
          Value = 0xe13559b0
   IndexContext = 0xe1352348

0: kd> dx -r1 ((Ntfs!_INDEX_LOOKUP_STACK *)0xe1352388)
((Ntfs!_INDEX_LOOKUP_STACK *)0xe1352388)                 : 0xe1352388 [Type: _INDEX_LOOKUP_STACK *]
    [+0x000] Bcb              : 0x0 [Type: void *]
    [+0x004] StartOfBuffer    : 0xc1241400 [Type: void *]
    [+0x008] IndexHeader      : 0xc1241580 [Type: _INDEX_HEADER *]
    [+0x00c] IndexEntry       : 0xc1241590 [Type: _INDEX_ENTRY *]
    [+0x010] IndexBlock       : 0 [Type: __int64]
    [+0x018] CapturedLsn      : {135165098} [Type: _LARGE_INTEGER]
0: kd> dt Ntfs!_INDEX_LOOKUP_STACK 0xe1352388+20
   +0x000 Bcb              : 0x899880d9 Void
   +0x004 StartOfBuffer    : 0xc14c0000 Void
   +0x008 IndexHeader      : 0xc14c0018 _INDEX_HEADER
   +0x00c IndexEntry       : 0xc14c0058 _INDEX_ENTRY
   +0x010 IndexBlock       : 0n0
   +0x018 CapturedLsn      : _LARGE_INTEGER 0x766987d
0: kd> dt Ntfs!_INDEX_LOOKUP_STACK 0xe1352388+20*2
   +0x000 Bcb              : (null)
   +0x004 StartOfBuffer    : (null)
   +0x008 IndexHeader      : (null)
   +0x00c IndexEntry       : (null)
   +0x010 IndexBlock       : 0n0
   +0x018 CapturedLsn      : _LARGE_INTEGER 0x0