typedef struct _EX_PUSH_LOCK
{
union
{
ULONG Locked: 1;
ULONG Waiting: 1;
ULONG Waking: 1;
ULONG MultipleShared: 1;
ULONG Shared: 28;
ULONG Value;
PVOID Ptr;
};
} EX_PUSH_LOCK, *PEX_PUSH_LOCK;
typedef struct _FSRTL_COMMON_FCB_HEADER {
CSHORT NodeTypeCode; 0
CSHORT NodeByteSize; 2
UCHAR Flags; 4
UCHAR IsFastIoPossible; 5
UCHAR Flags2; 6
UCHAR Reserved : 4; 7
UCHAR Version : 4;
PERESOURCE Resource; 8
PERESOURCE PagingIoResource; c
LARGE_INTEGER AllocationSize; 10
LARGE_INTEGER FileSize; 18
LARGE_INTEGER ValidDataLength; 20
} FSRTL_COMMON_FCB_HEADER;
typedef FSRTL_COMMON_FCB_HEADER *PFSRTL_COMMON_FCB_HEADER;
typedef struct _FSRTL_ADVANCED_FCB_HEADER {
FSRTL_COMMON_FCB_HEADER;
PFAST_MUTEX FastMutex; 28
LIST_ENTRY FilterContexts; 2c
EX_PUSH_LOCK PushLock; 34
PVOID* FileContextSupportPointer; 38
} FSRTL_ADVANCED_FCB_HEADER;
typedef FSRTL_ADVANCED_FCB_HEADER *PFSRTL_ADVANCED_FCB_HEADER;
typedef struct _SCB {
//
// The following field is used for fast I/O. It contains the node
// type code and size, indicates if fast I/O is possible, contains
// allocation, file, and valid data size, a resource, and call back
// pointers for FastIoRead and FastMdlRead.
//
// The node type codes for the Scb must be either NTFS_NTC_SCB_INDEX,
// NTFS_NTC_SCB_ROOT_INDEX, or NTFS_NTC_SCB_DATA. Which one it is
// determines the state of the union below.
//
FSRTL_ADVANCED_FCB_HEADER Header;
//
// The links for the queue of Scb off of a given Fcb. And a pointer
// back to the Fcb. Corresponds to Fcb->ScbQueue
//
LIST_ENTRY FcbLinks; <-0x3C
PFCB Fcb; <-0x44
//
// A pointer to the Vcb containing this Scb
//
PVCB Vcb; <-0x48
//
// The internal state of the Scb.
//
ULONG ScbState;
//
// A count of the number of file objects opened on this stream
// which represent user non-cached handles. We use this count to
// determine when to flush and purge the data section in only
// non-cached handles remain on the file.
//
CLONG NonCachedCleanupCount;
//
// A count of the number of file objects that have been opened for
// this attribute, but not yet been cleaned up yet.
// This count gets decremented in NtfsCommonCleanup,
// while the CloseCount below gets decremented in NtfsCommonClose.
//
CLONG CleanupCount;
//
// A count of the number of file objects that have opened
// this attribute.
//
CLONG CloseCount;
//
// Share Access structure for this stream.
//
SHARE_ACCESS ShareAccess;
//
// The following two fields identify the actual attribute for this
// Scb with respect to its file. We identify the attribute by
// its type code and name.
//
ATTRIBUTE_TYPE_CODE AttributeTypeCode;
UNICODE_STRING AttributeName;
//
// Stream File Object for internal use. This field is NULL if the
// file stream is not being accessed internally.
//
PFILE_OBJECT FileObject;
//
// These pointers are used to detect writes that eminated from the
// cache manager's worker thread. It prevents lazy writer threads,
// who already have the Fcb shared, from trying to acquire it
// exclusive, and thus causing a deadlock. We have to store two
// threads, because the second thread could be writing the compressed
// stream
//
PVOID LazyWriteThread[2];
//
// Pointer to the non-paged section objects and open attribute
// table index.
//
PSCB_NONPAGED NonpagedScb;
//
// The following field contains the mcb for this Scb and some initial
// structures for small and medium files.
//
NTFS_MCB Mcb;
NTFS_MCB_INITIAL_STRUCTS McbStructs;
//
// Compression unit from attribute record.
//
ULONG CompressionUnit;
//
// AttributeFlags and CompressionUnitShift from attribute record
//
USHORT AttributeFlags;
UCHAR CompressionUnitShift;
UCHAR PadUchar;
//
// Valid Data to disk - as updated by NtfsPrepareBuffers
//
LONGLONG ValidDataToDisk;
//
// Number of clusters added due to Split Mcb calls. The user has
// not asked for this allocation.
//
LONGLONG ExcessFromSplitMcb;
//
// Actual allocated bytes for this file.
//
LONGLONG TotalAllocated;
//
// Used by advanced Scb Header
//
LIST_ENTRY EofListHead;
//
// Defragmentation parameters
//
union {
PMOVE_FILE_DATA MoveData;
} Union;
//
// Pointer to structure containing snapshotted Scb values, or NULL
// if the values have not been snapshotted.
//
struct _SCB_SNAPSHOT * ScbSnapshot;
ULONG PadUlong;
//
// Scb Type union, for different types of Scbs
//
union {
SCB_DATA Data;
SCB_INDEX Index;
SCB_MFT Mft;
} ScbType;
} SCB;
typedef SCB *PSCB;
几个结构体
最新推荐文章于 2023-10-06 23:39:13 发布