第一部分：

                NtfsWriteLog( IrpContext,
                              Vcb->MftScb,                    //注意：Vcb->MftScb
                              NULL,
                              OpenAttributeTableDump,
                              Vcb->OnDiskOat->Table,
                              SizeOfRestartTable( Vcb->OnDiskOat ),
                              Noop,
                              NULL,
                              0,
                              (LONGLONG)0,
                              0,
                              0,
                              0 );

第二部分：

F:\srv03rtm>grep "OpenAttributeTableDump" -rn F:\srv03rtm\base\fs |grep -v "inary"
F:\srv03rtm\base\fs/ntfs/logsup.c:2279:                              OpenAttributeTableDump,
F:\srv03rtm\base\fs/ntfs/ntfskd/ntfskd.c:258:    { "OpenAttributeTableDump       " },
F:\srv03rtm\base\fs/ntfs/ntfslog.h:63:    OpenAttributeTableDump =       0x1D, //  OPEN_ATTRIBUTE_ENTRY array
F:\srv03rtm\base\fs/ntfs/restrsup.c:2466:            case OpenAttributeTableDump:
F:\srv03rtm\base\fs/ntfs/restrsup.c:4475:    case OpenAttributeTableDump:

第三部分：

VOID
AnalysisPass (
    IN PIRP_CONTEXT IrpContext,
    IN PVCB Vcb,
    IN LSN CheckpointLsn,
    IN OUT PRESTART_POINTERS DirtyPageTable,
    OUT PLSN RedoLsn
    )
{

            //
            //  The following cases require no action in the Analysis Pass.
            //

            case Noop:
            case OpenAttributeTableDump:
            case AttributeNamesDump:
            case DirtyPageTableDump:
            case TransactionTableDump:

第四部分：

VOID
DoAction (
    IN PIRP_CONTEXT IrpContext,
    IN PVCB Vcb,
    IN PNTFS_LOG_RECORD_HEADER LogRecord,
    IN NTFS_LOG_OPERATION Operation,
    IN PVOID Data,
    IN ULONG Length,
    IN ULONG LogRecordLength,
    IN PLSN RedoLsn OPTIONAL,
    IN PSCB Scb OPTIONAL,
    OUT PBCB *Bcb,
    OUT PLSN *PageLsn
    )
{
    //
    //  The following cases require no action during the Redo or Undo Pass.
    //

    case Noop:
    case DeleteDirtyClusters:
    case HotFix:
    case EndTopLevelAction:
    case PrepareTransaction:
    case CommitTransaction:
    case ForgetTransaction:
    case CompensationLogRecord:
    case OpenNonresidentAttribute:
    case OpenAttributeTableDump:
    case AttributeNamesDump:
    case DirtyPageTableDump:
    case TransactionTableDump:

        break;