当前位置：首页 > web >正文

Ntfs!LFS_RECORD_HEADER结构的一个例子RecordType两种LfsClientRestart和LfsClientRecord

web 2025/6/20 17:40:08

第一部分：

//
// The following type defines the different log record types.
//

typedef enum _LFS_RECORD_TYPE {

LfsClientRecord = 1,
LfsClientRestart

} LFS_RECORD_TYPE, *PLFS_RECORD_TYPE;

第二部分：

0: kd> dt LFS_RECORD_HEADER c11b0bc8-18
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee176
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee189
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x80edbd0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x28
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 1 ( LfsClientRecord )
   +0x024 TransactionId    : 0x18
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee194
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee1a7
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30+68+30+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee1ba
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30+68+30+68+30+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee1cd
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30+68+30+68+30+68+30+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee1e0
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30+68+30+68+30+68+30+68+30+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x80ee1f3
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0x68
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 2 ( LfsClientRestart )
   +0x024 TransactionId    : 0
   +0x028 Flags            : 1
   +0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11b0bc8-18+68+30+28+30+68+30+68+30+68+30+68+30+68+30+68+30
Ntfs!LFS_RECORD_HEADER
   +0x000 ThisLsn          : _LARGE_INTEGER 0x0
   +0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
   +0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
   +0x018 ClientDataLength : 0
   +0x01c ClientId         : _LFS_CLIENT_ID
   +0x020 RecordType       : 0x80ee1e0 (No matching name)
   +0x024 TransactionId    : 0
   +0x028 Flags            : 0x1000
   +0x02a AlignWord        : 0
0: kd> dd c11b0bc8-18+68+30+28+30+68+30+68+30+68+30+68+30+68+30+68+30
c11b1030 00000000 00000000 00000000 00000000
c11b1040 00000000 00000000 00000000 00000000
c11b1050 080ee1e0 00000000 00001000 00000000
c11b1060 00000000 00000000 00000000 00000000
c11b1070 080ee20e 00000000 00000000 00000000
c11b1080 00000000 00000000 00000060 00000000
c11b1090 00000001 00000018 00000000 00000000
c11b10a0 0000001c 002c0028 00080058 00000018
0: kd> dd c11b0bc8-18+68+30+28+30+68+30+68+30+68+30+68+30+68+30
c11b0f98 080ee1f3 00000000 00000000 00000000
c11b0fa8 00000000 00000000 00000068 00000000
c11b0fb8 00000002 00000000 00000001 00000000
c11b0fc8 00000000 00000000 080ee1e0 00000000
c11b0fd8 00000000 00000000 00000000 00000000
c11b0fe8 00000000 00000000 00000000 00000000
c11b0ff8 00000000 00000000 44524352 00090028
c11b1008 080ee239 00000000 00000001 00020002