Ntfs!FindFirstIndexEntry函数中ReadIndexBuffer函数的作用是新建一个Ntfs!_INDEX_LOOKUP_STACK结构

第一部分:

0: kd> kc

00 Ntfs!FindFirstIndexEntry

01 Ntfs!NtfsRestartIndexEnumeration

02 Ntfs!NtfsQueryDirectory

03 Ntfs!NtfsCommonDirectoryControl

04 Ntfs!NtfsFsdDirectoryControl

05 nt!IofCallDriver

06 nt!IopSynchronousServiceTail

07 nt!NtQueryDirectoryFile

08 nt!_KiSystemService

09 nt!ZwQueryDirectoryFile

0a nt!CcPfPrefetchDirectoryContents

0b nt!CcPfPrefetchMetadata

0c nt!CcPfBootWorker

0d nt!PspSystemThreadStartup

0e nt!KiThreadStartup

第二部分:

//

// Otherwise, read the index buffer pointed to by the current

// Index Entry.

//

ReadIndexBuffer( IrpContext,

Scb,

NtfsIndexEntryBlock((Sp-1)->IndexEntry),

FALSE,

Sp );

0: kd> dv

IrpContext = 0xf793291c

Scb = 0xe13523a8

Value = 0xe13559b0

IndexContext = 0xe1352348

0: kd> dx -r1 ((Ntfs!_INDEX_LOOKUP_STACK *)0xe1352388)

((Ntfs!_INDEX_LOOKUP_STACK *)0xe1352388) : 0xe1352388 [Type: _INDEX_LOOKUP_STACK *]

+0x000\] Bcb : 0x0 \[Type: void \*

+0x004\] StartOfBuffer : 0xc1241400 \[Type: void \*

+0x008\] IndexHeader : 0xc1241580 \[Type: _INDEX_HEADER \*

+0x00c\] IndexEntry : 0xc1241590 \[Type: _INDEX_ENTRY \*

+0x010\] IndexBlock : 0 \[Type: __int64

+0x018\] CapturedLsn : {135165098} \[Type: _LARGE_INTEGER

0: kd> dt Ntfs!_INDEX_LOOKUP_STACK 0xe1352388+20

+0x000 Bcb : 0x899880d9 Void

+0x004 StartOfBuffer : 0xc14c0000 Void

+0x008 IndexHeader : 0xc14c0018 _INDEX_HEADER

+0x00c IndexEntry : 0xc14c0058 _INDEX_ENTRY

+0x010 IndexBlock : 0n0

+0x018 CapturedLsn : _LARGE_INTEGER 0x766987d

0: kd> dt Ntfs!_INDEX_LOOKUP_STACK 0xe1352388+20*2

+0x000 Bcb : (null)

+0x004 StartOfBuffer : (null)

+0x008 IndexHeader : (null)

+0x00c IndexEntry : (null)

+0x010 IndexBlock : 0n0

+0x018 CapturedLsn : _LARGE_INTEGER 0x0