当前位置：首页 > ops >正文

nt!CcMapData函数分析之Loop to touch each page触发nt!MmAccessFault函数----NTFS源代码分析之四

ops 2025/6/28 9:36:23

返回到这里：

if ((TempVacb = GetVacb( SharedCacheMap, FileOffset )) == NULL) {

TempVacb = CcGetVacbMiss( SharedCacheMap, FileOffset, &OldIrql );

}
返回到这里：

ASSERT( TempVacb->BaseAddress != NULL );

return (PVOID)((PCHAR)TempVacb->BaseAddress + VacbOffset);
}

0: kd> p
nt!CcGetVirtualAddress+0x197:
80a1aa17 c9 leave
0: kd> p
nt!CcGetVirtualAddress+0x198:
80a1aa18 c21400 ret 14h
0: kd> r
eax=c14c0000

            //
            // Loop to touch each page       关键代码：
            //

BeyondLastByte.LowPart = 0;

while (PageCount != 0) {

MmSetPageFaultReadAhead( Thread, PageCount - 1 );

ch = *((volatile UCHAR *)(*Buffer) + BeyondLastByte.LowPart);

                BeyondLastByte.LowPart += PAGE_SIZE;
                PageCount -= 1;
            }

80bf989a 8b09            mov     ecx,dword ptr [ecx]
0: kd> p
nt!CcMapData+0x134:
80bf989c 8b55c0          mov     edx,dword ptr [ebp-40h]
0: kd> p
Breakpoint 8 hit
nt!CcMapData+0x137:
80bf989f 8a0c0a          mov     cl,byte ptr [edx+ecx]
0: kd> p
Breakpoint 3 hit
nt!MmAccessFault:
80abcfda 55              push    ebp
0: kd> kc
#
00 nt!MmAccessFault
01 nt!_KiTrap0E
02 nt!CcMapData
03 Ntfs!NtfsMapStream
04 Ntfs!ReadIndexBuffer
05 Ntfs!FindFirstIndexEntry
06 Ntfs!NtfsUpdateFileNameInIndex
07 Ntfs!NtfsUpdateDuplicateInfo
08 Ntfs!NtfsInitializeSecurity
09 Ntfs!NtfsInitializeSecurityFile
0a Ntfs!NtfsMountVolume
0b Ntfs!NtfsCommonFileSystemControl
0c Ntfs!NtfsFspDispatch
0d nt!ExpWorkerThread
0e nt!PspSystemThreadStartup
0f nt!KiThreadStartup