第一部分：
VOID
FindFirstIndexEntry (
IN PIRP_CONTEXT IrpContext,
IN PSCB Scb,
IN PVOID Value,
IN OUT PINDEX_CONTEXT IndexContext
)
{
。。。。。。
//
// Lookup the attribute record from the Scb.
//
if (!NtfsLookupAttributeByName( IrpContext,
Scb->Fcb,
&Scb->Fcb->FileReference,
$INDEX_ROOT,
&Scb->AttributeName,
NULL,
FALSE,
&IndexContext->AttributeContext )) {
第二部分：
0: kd> p
Ntfs!FindFirstIndexEntry+0x68:
f71740d2 84c0 test al,al
0: kd> dv
IrpContext = 0xf793291c
Scb = 0xe1363d20
Value = 0xe13559b0
IndexContext = 0xe1352348
Attribute = 0x00000000
IndexRoot = 0xe1352348
Sp = 0xe1363d20
0: kd> dx -r1 ((Ntfs!_SCB *)0xe1363d20)
((Ntfs!_SCB *)0xe1363d20) : 0xe1363d20 [Type: _SCB *]
[+0x000] Header [Type: _NTFS_ADVANCED_FCB_HEADER]
[+0x040] FcbLinks [Type: _LIST_ENTRY]
[+0x048] Fcb : 0xe1363c58 [Type: _FCB *]
[+0x04c] Vcb : 0x895d5100 [Type: _VCB *]
[+0x050] ScbState : 0x100006a0 [Type: unsigned long]
[+0x054] NonCachedCleanupCount : 0x0 [Type: unsigned long]
[+0x058] CleanupCount : 0x1 [Type: unsigned long]
[+0x05c] CloseCount : 0x2 [Type: unsigned long]
[+0x060] ShareAccess [Type: _SHARE_ACCESS]
[+0x07c] AttributeTypeCode : 0xa0 [Type: unsigned long]
[+0x080] AttributeName : "$I30" [Type: _UNICODE_STRING]
[+0x088] FileObject : 0x8962b128 [Type: _FILE_OBJECT *]
[+0x08c] NonpagedScb : 0x89954e60 [Type: _SCB_NONPAGED *]
[+0x090] Mcb [Type: _NTFS_MCB]
[+0x0a8] McbStructs [Type: NTFS_MCB_INITIAL_STRUCTS]
[+0x0f0] CompressionUnit : 0x0 [Type: unsigned long]
[+0x0f4] AttributeFlags : 0x0 [Type: unsigned short]
[+0x0f6] CompressionUnitShift : 0x0 [Type: unsigned char]
[+0x0f7] PadUchar : 0x0 [Type: unsigned char]
[+0x0f8] ValidDataToDisk : 0 [Type: __int64]
[+0x100] TotalAllocated : 8192 [Type: __int64]
[+0x108] EofListHead [Type: _LIST_ENTRY]
[+0x110] CcbQueue [Type: _LIST_ENTRY]
[+0x118] ScbSnapshot : 0x0 [Type: _SCB_SNAPSHOT *]
[+0x11c] EncryptionContext : 0x0 [Type: void *]
[+0x120] EncryptionContextLength : 0x0 [Type: unsigned long]
[+0x124] ScbPersist : 0x0 [Type: unsigned long]
[+0x128] IoAtEofThread : 0x0 [Type: unsigned long *]
[+0x130] ScbType [Type: __unnamed]
第三部分：
BOOLEAN
NtfsFindInFileRecord (
IN PIRP_CONTEXT IrpContext,
IN PATTRIBUTE_RECORD_HEADER Attribute,
OUT PATTRIBUTE_RECORD_HEADER *ReturnAttribute,
IN ATTRIBUTE_TYPE_CODE QueriedTypeCode,
IN PCUNICODE_STRING QueriedName OPTIONAL,
IN BOOLEAN IgnoreCase,
IN PVOID QueriedValue OPTIONAL,
IN ULONG QueriedValueLength
)
{
while ( TRUE ) {
。。。。。。
NtfsInitializeStringFromAttribute( &AttributeName, Attribute );
//
// See if we have a name match.
//
if (NtfsAreNamesEqual( UpcaseTable,
&AttributeName,
QueriedName,
IgnoreCase )) {
break;
}
return TRUE;
}
第四部分：
NtfsInitializeStringFromAttribute( &AttributeName, Attribute );
#define NtfsInitializeStringFromAttribute(NAME,ATTRIBUTE) { \
(NAME)->Length = (USHORT)(ATTRIBUTE)->NameLength << 1; \
(NAME)->MaximumLength = (NAME)->Length; \
(NAME)->Buffer = (PWSTR)Add2Ptr((ATTRIBUTE), (ATTRIBUTE)->NameOffset); \
}
(NAME)->Buffer (ATTRIBUTE)->NameLength +0x009 NameLength : 0x4 ''
(NAME)->Buffer (ATTRIBUTE)->NameOffset +0x00a NameOffset : 0x18
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER 0xc1241438+48+60+28+48
+0x000 TypeCode : 0x90
+0x004 RecordLength : 0xe0
+0x008 FormCode : 0 ''
+0x009 NameLength : 0x4 ''
+0x00a NameOffset : 0x18
+0x00c Flags : 0
+0x00e Instance : 6
+0x010 Form : __unnamed
0: kd> db 0xc1241438+48+60+28+48+18
c1241568 24 00 49 00 33 00 30 00-30 00 00 00 01 00 00 00 $.I.3.0.0.......
第五部分：
0: kd> p
Ntfs!NtfsFindInFileRecord+0x92:
f7171ac2 384d1c cmp byte ptr [ebp+1Ch],cl
0: kd> dv
IrpContext = 0xf793291c
Attribute = 0xc1241438
0: kd> dx -r1 ((Ntfs!_ATTRIBUTE_RECORD_HEADER *)0xc1241438)
((Ntfs!_ATTRIBUTE_RECORD_HEADER *)0xc1241438) : 0xc1241438 [Type: _ATTRIBUTE_RECORD_HEADER *]
[+0x000] TypeCode : 0x10 [Type: unsigned long]
[+0x004] RecordLength : 0x48 [Type: unsigned long]
[+0x008] FormCode : 0x0 [Type: unsigned char]
[+0x009] NameLength : 0x0 [Type: unsigned char]
[+0x00a] NameOffset : 0x18 [Type: unsigned short]
[+0x00c] Flags : 0x0 [Type: unsigned short]
[+0x00e] Instance : 0x0 [Type: unsigned short]
[+0x010] Form [Type: __unnamed]
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER 0xc1241438
+0x000 TypeCode : 0x10
+0x004 RecordLength : 0x48
+0x008 FormCode : 0 ''
+0x009 NameLength : 0 ''
+0x00a NameOffset : 0x18
+0x00c Flags : 0
+0x00e Instance : 0
+0x010 Form : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER 0xc1241438+48
+0x000 TypeCode : 0x30
+0x004 RecordLength : 0x60
+0x008 FormCode : 0 ''
+0x009 NameLength : 0 ''
+0x00a NameOffset : 0x18
+0x00c Flags : 0
+0x00e Instance : 1
+0x010 Form : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER 0xc1241438+48+60
+0x000 TypeCode : 0x40
+0x004 RecordLength : 0x28
+0x008 FormCode : 0 ''
+0x009 NameLength : 0 ''
+0x00a NameOffset : 0
+0x00c Flags : 0
+0x00e Instance : 9
+0x010 Form : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER 0xc1241438+48+60+28
+0x000 TypeCode : 0x50
+0x004 RecordLength : 0x48
+0x008 FormCode : 0x1 ''
+0x009 NameLength : 0 ''
+0x00a NameOffset : 0x40
+0x00c Flags : 0
+0x00e Instance : 2
+0x010 Form : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER 0xc1241438+48+60+28+48
+0x000 TypeCode : 0x90
+0x004 RecordLength : 0xe0
+0x008 FormCode : 0 ''
+0x009 NameLength : 0x4 ''
+0x00a NameOffset : 0x18
+0x00c Flags : 0
+0x00e Instance : 6
+0x010 Form : __unnamed
