ntkrnlmp!_SHARED_CACHE_MAP结构中的成员DirtyPages=0x6(5)的一个例子和成员BcbList链表节点的数量一致

第一部分:

1: kd> g

Breakpoint 30 hit

Ntfs!DirtyPageRoutine:

f71451f2 55 push ebp

1: kd> g

Breakpoint 33 hit

nt!CcGetDirtyPages+0x115:

80a15cd3 8b45c4 mov eax,dword ptr [ebp-3Ch]

1: kd> dt DIRTY_PAGE_ENTRY_V0 0x89539000+18+2c*6f

Ntfs!DIRTY_PAGE_ENTRY_V0

+0x000 AllocatedOrNextFree : 0xffffffff

+0x004 TargetAttribute : 0x338

+0x008 LengthOfTransfer : 0x1000

+0x00c LcnsToFollow : 0

+0x010 Reserved : 0

+0x014 Vcn : 0n16384

+0x01c OldestLsn : _LARGE_INTEGER 0x80ef7cb

+0x024 LcnsForPage : [1] 0n0

1: kd> dt DIRTY_PAGE_CONTEXT 0xf78d2aa4

Ntfs!DIRTY_PAGE_CONTEXT

+0x000 DirtyPageTable : 0xf78d2b90 _RESTART_POINTERS

+0x004 DirtyPageIndex : 0x44

+0x008 OldestFileObject : 0x89455df0 _FILE_OBJECT

+0x010 OldestLsn : _LARGE_INTEGER 0x80ee220

+0x018 Overflow : 0 ''

1: kd> dx -id 0,0,899a2278 -r1 ((Ntfs!_RESTART_POINTERS *)0xf78d2b90)

((Ntfs!_RESTART_POINTERS *)0xf78d2b90) : 0xf78d2b90 [Type: _RESTART_POINTERS *]

+0x000\] Resource \[Type: _ERESOURCE

+0x038\] Table : 0x89537000 \[Type: _RESTART_TABLE \*

+0x03c\] SpinLock : 0x0 \[Type: unsigned long

+0x040\] ResourceInitialized : 0x1 \[Type: unsigned char

+0x041\] DrainPending : 0x0 \[Type: unsigned char

+0x042\] Unused \[Type: unsigned char \[6\]

1: kd> dx -id 0,0,899a2278 -r1 ((Ntfs!_RESTART_TABLE *)0x89537000)

((Ntfs!_RESTART_TABLE *)0x89537000) : 0x89537000 [Type: _RESTART_TABLE *]

+0x000\] EntrySize : 0x2c \[Type: unsigned short

+0x002\] NumberEntries : 0x80 \[Type: unsigned short

+0x004\] NumberAllocated : 0x71 \[Type: unsigned short

+0x006\] Reserved \[Type: unsigned short \[3\]

+0x00c\] FreeGoal : 0xffffffff \[Type: unsigned long

+0x010\] FirstFree : 0x1384 \[Type: unsigned long

+0x014\] LastFree : 0x15ec \[Type: unsigned long

1: kd> dt DIRTY_PAGE_ENTRY_V0 0x89537000+18+2c*70

Ntfs!DIRTY_PAGE_ENTRY_V0

+0x000 AllocatedOrNextFree : 0xffffffff

+0x004 TargetAttribute : 0x338

+0x008 LengthOfTransfer : 0x1000

+0x00c LcnsToFollow : 0

+0x010 Reserved : 0

+0x014 Vcn : 0n12288

+0x01c OldestLsn : _LARGE_INTEGER 0x80ef5c9

+0x024 LcnsForPage : [1] 0n0

1: kd> r

eax=00000000 ebx=00001000 ecx=080ef5c9 edx=080ef5c9 esi=895351b0

eip=80a15cd3 esp=f78d2928 ebp=f78d298c iopl=0 nv up ei pl nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206

nt!CcGetDirtyPages+0x115:

80a15cd3 8b45c4 mov eax,dword ptr [ebp-3Ch] ss:0010:f78d2950=080ef5c9

1: kd> dt _bcb 895351b0

nt!_BCB

+0x000 Dummy : _MBCB

+0x000 NodeTypeCode : 0n765

+0x002 Dirty : 0x1 ''

+0x003 Reserved : 0 ''

+0x004 ByteLength : 0x1000

+0x008 FileOffset : _LARGE_INTEGER 0x3000

+0x010 BcbLinks : _LIST_ENTRY [ 0x894d0ea0 - 0x8950a0b8 ]

+0x018 BeyondLastByte : _LARGE_INTEGER 0x4000

+0x020 OldestLsn : _LARGE_INTEGER 0x80ef5c9

+0x028 NewestLsn : _LARGE_INTEGER 0x80ef5c9

+0x030 Vacb : (null)

+0x034 PinCount : 1

+0x038 Resource : _ERESOURCE

+0x070 SharedCacheMap : 0x894553a8 _SHARED_CACHE_MAP

+0x074 BaseAddress : (null)

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_SHARED_CACHE_MAP *)0x894553a8)

((ntkrnlmp!_SHARED_CACHE_MAP *)0x894553a8) : 0x894553a8 [Type: _SHARED_CACHE_MAP *]

+0x000\] NodeTypeCode : 767 \[Type: short

+0x002\] NodeByteSize : 304 \[Type: short

+0x004\] OpenCount : 0x2 \[Type: unsigned long

+0x008\] FileSize : {20480} \[Type: _LARGE_INTEGER

+0x010\] BcbList \[Type: _LIST_ENTRY

+0x018\] SectionSize : {1048576} \[Type: _LARGE_INTEGER

+0x020\] ValidDataLength : {9223372036854775807} \[Type: _LARGE_INTEGER

+0x028\] ValidDataGoal : {9223372036854775807} \[Type: _LARGE_INTEGER

+0x030\] InitialVacbs \[Type: _VACB \* \[4\]

+0x040\] Vacbs : 0x894553d8 \[Type: _VACB \* \*

+0x044\] FileObject : 0x89455500 \[Type: _FILE_OBJECT \*

+0x048\] ActiveVacb : 0x0 \[Type: _VACB \*

+0x04c\] NeedToZero : 0x0 \[Type: void \*

+0x050\] ActivePage : 0x0 \[Type: unsigned long

+0x054\] NeedToZeroPage : 0x0 \[Type: unsigned long

+0x058\] ActiveVacbSpinLock : 0x0 \[Type: unsigned long

+0x05c\] VacbActiveCount : 0x0 \[Type: unsigned long

+0x060\] DirtyPages : 0x6 \[Type: unsigned long

1: kd> g

Breakpoint 30 hit

Ntfs!DirtyPageRoutine:

f71451f2 55 push ebp

1: kd> g

Breakpoint 33 hit

nt!CcGetDirtyPages+0x115:

80a15cd3 8b45c4 mov eax,dword ptr [ebp-3Ch]

1: kd> dt DIRTY_PAGE_ENTRY_V0 0x89537000+18+2c*71

Ntfs!DIRTY_PAGE_ENTRY_V0

+0x000 AllocatedOrNextFree : 0xffffffff

+0x004 TargetAttribute : 0x338

+0x008 LengthOfTransfer : 0x1000

+0x00c LcnsToFollow : 0

+0x010 Reserved : 0

+0x014 Vcn : 0n8192

+0x01c OldestLsn : _LARGE_INTEGER 0x80ef80e

+0x024 LcnsForPage : [1] 0n0

1: kd> dt DIRTY_PAGE_ENTRY_V0 0x89537000+18+2c*72

Ntfs!DIRTY_PAGE_ENTRY_V0

+0x000 AllocatedOrNextFree : 0xffffffff

+0x004 TargetAttribute : 0x338

+0x008 LengthOfTransfer : 0x1000

+0x00c LcnsToFollow : 0

+0x010 Reserved : 0

+0x014 Vcn : 0n4096

+0x01c OldestLsn : _LARGE_INTEGER 0x80ef625

+0x024 LcnsForPage : [1] 0n0

1: kd> g

Breakpoint 30 hit

Ntfs!DirtyPageRoutine:

f71451f2 55 push ebp

1: kd> g

Breakpoint 33 hit

nt!CcGetDirtyPages+0x115:

80a15cd3 8b45c4 mov eax,dword ptr [ebp-3Ch]

1: kd> dt DIRTY_PAGE_ENTRY_V0 0x89537000+18+2c*73

Ntfs!DIRTY_PAGE_ENTRY_V0

+0x000 AllocatedOrNextFree : 0xffffffff

+0x004 TargetAttribute : 0x338

+0x008 LengthOfTransfer : 0x1000

+0x00c LcnsToFollow : 0

+0x010 Reserved : 0

+0x014 Vcn : 0n0

+0x01c OldestLsn : _LARGE_INTEGER 0x80ef4dd

+0x024 LcnsForPage : [1] 0n0

1: kd> g

Breakpoint 30 hit

Ntfs!DirtyPageRoutine:

f71451f2 55 push ebp

1: kd> g

Breakpoint 33 hit

nt!CcGetDirtyPages+0x115:

80a15cd3 8b45c4 mov eax,dword ptr [ebp-3Ch]

1: kd> dt DIRTY_PAGE_ENTRY_V0 0x89537000+18+2c*74

Ntfs!DIRTY_PAGE_ENTRY_V0

+0x000 AllocatedOrNextFree : 0xffffffff

+0x004 TargetAttribute : 0x360

+0x008 LengthOfTransfer : 0x1000

+0x00c LcnsToFollow : 0

+0x010 Reserved : 0

+0x014 Vcn : 0n0

+0x01c OldestLsn : _LARGE_INTEGER 0x80ef73c

+0x024 LcnsForPage : [1] 0n0

第二部分:

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_SHARED_CACHE_MAP *)0x894553a8)

((ntkrnlmp!_SHARED_CACHE_MAP *)0x894553a8) : 0x894553a8 [Type: _SHARED_CACHE_MAP *]

+0x000\] NodeTypeCode : 767 \[Type: short

+0x002\] NodeByteSize : 304 \[Type: short

+0x004\] OpenCount : 0x1 \[Type: unsigned long

+0x008\] FileSize : {20480} \[Type: _LARGE_INTEGER

+0x010\] BcbList \[Type: _LIST_ENTRY

1: kd> dx -id 0,0,899a2278 -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x894553b8))

(*((ntkrnlmp!_LIST_ENTRY *)0x894553b8)) [Type: _LIST_ENTRY]

+0x000\] Flink : 0x8950a0b8 \[Type: _LIST_ENTRY \*

+0x004\] Blink : 0x89535948 \[Type: _LIST_ENTRY \*

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_LIST_ENTRY *)0x8950a0b8)

((ntkrnlmp!_LIST_ENTRY *)0x8950a0b8) : 0x8950a0b8 [Type: _LIST_ENTRY *]

+0x000\] Flink : 0x895351c0 \[Type: _LIST_ENTRY \*

+0x004\] Blink : 0x894553b8 \[Type: _LIST_ENTRY \*

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_LIST_ENTRY *)0x895351c0)

((ntkrnlmp!_LIST_ENTRY *)0x895351c0) : 0x895351c0 [Type: _LIST_ENTRY *]

+0x000\] Flink : 0x894d0ea0 \[Type: _LIST_ENTRY \*

+0x004\] Blink : 0x8950a0b8 \[Type: _LIST_ENTRY \*

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_LIST_ENTRY *)0x894d0ea0)

((ntkrnlmp!_LIST_ENTRY *)0x894d0ea0) : 0x894d0ea0 [Type: _LIST_ENTRY *]

+0x000\] Flink : 0x8950af90 \[Type: _LIST_ENTRY \*

+0x004\] Blink : 0x895351c0 \[Type: _LIST_ENTRY \*

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_LIST_ENTRY *)0x8950af90)

((ntkrnlmp!_LIST_ENTRY *)0x8950af90) : 0x8950af90 [Type: _LIST_ENTRY *]

+0x000\] Flink : 0x89535948 \[Type: _LIST_ENTRY \*

+0x004\] Blink : 0x894d0ea0 \[Type: _LIST_ENTRY \*

1: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_LIST_ENTRY *)0x89535948)

((ntkrnlmp!_LIST_ENTRY *)0x89535948) : 0x89535948 [Type: _LIST_ENTRY *]

+0x000\] Flink : 0x894553b8 \[Type: _LIST_ENTRY \*

+0x004\] Blink : 0x8950af90 \[Type: _LIST_ENTRY \*