当前位置：首页 > news >正文

Ntfs!ReadIndexBuffer函数调用Ntfs!NtfsMapStream函数的参数FileOffset为什么是0

news 2025/5/24 11:04:24

FileOffset = 0n0 为什么是0

0: kd> t
Breakpoint 1 hit
Ntfs!NtfsMapStream:
f717167a 55              push    ebp
0: kd> kc
#
00 Ntfs!NtfsMapStream
01 Ntfs!ReadIndexBuffer
0: kd> dv
     IrpContext = 0xf793291c
            Scb = 0xe1363d20
     FileOffset = 0n0
         Length = 0x1000
            Bcb = 0xe13523a8
         Buffer = 0xe13523ac

    NtfsMapStream( IrpContext,
                   Scb,
                   LlBytesFromIndexBlocks( IndexBlock, Scb->ScbType.Index.IndexBlockByteShift ),
                   Scb->ScbType.Index.BytesPerIndexBuffer,
                   &Sp->Bcb,
                   &Sp->StartOfBuffer );

#define LlBytesFromIndexBlocks(B,S) ( \
Int64ShllMod32((B), (S)) \
)

[+0x05d] IndexBlockByteShift : 0xc [Type: unsigned char]

0: kd> t
Breakpoint 3 hit
Ntfs!ReadIndexBuffer:
f7173886 55 push ebp
0: kd> kc
#
00 Ntfs!ReadIndexBuffer
01 Ntfs!FindFirstIndexEntry
02 Ntfs!NtfsRestartIndexEnumeration
03 Ntfs!NtfsQueryDirectory

0: kd> dv
     IrpContext = 0xf793291c
            Scb = 0xe1363d20
     IndexBlock = 0n0
         Reread = 0x00 ''
             Sp = 0xe13523a8

0: kd> dv
     IrpContext = 0xf793291c
            Scb = 0xe1363d20
     IndexBlock = 0n0
         Reread = 0x00 ''
             Sp = 0xe13523a8           原来的是0xe13523a8-20=0xe1352388

0: kd> dx -r1 ((Ntfs!_INDEX_LOOKUP_STACK *)0xe13523a8)
((Ntfs!_INDEX_LOOKUP_STACK *)0xe13523a8)                 : 0xe13523a8 [Type: _INDEX_LOOKUP_STACK *]
    [+0x000] Bcb              : 0x0 [Type: void *]
    [+0x004] StartOfBuffer    : 0x0 [Type: void *]
    [+0x008] IndexHeader      : 0x0 [Type: _INDEX_HEADER *]
    [+0x00c] IndexEntry       : 0x0 [Type: _INDEX_ENTRY *]
    [+0x010] IndexBlock       : 0 [Type: __int64]
    [+0x018] CapturedLsn      : {0} [Type: _LARGE_INTEGER]

一个新的sp，数据全是0。

0: kd> kv
# ChildEBP RetAddr Args to Child
00 f7932560 f7174231 f793291c e1363d20 00000000 Ntfs!ReadIndexBuffer+0xd8 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\indexsup.c @ 2827]
01 f7932590 f71774e8 f793291c e13523a8 e13559b0 Ntfs!FindFirstIndexEntry+0x1c7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\indexsup.c @ 3449]
02 f79326b8 f717623d f793291c e1363eb8 e1363d20 Ntfs!NtfsRestartIndexEnumeration+0xc4 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\indexsup.c @ 1397]

        //
        // Otherwise, read the index buffer pointed to by the current
        // Index Entry.
        //

        ReadIndexBuffer( IrpContext,
                         Scb,
                         NtfsIndexEntryBlock((Sp-1)->IndexEntry),
                         FALSE,
                         Sp );

FileOffset = 0n0 为什么是0 END

查看全文

http://www.xdnf.cn/news/616771.html