几个结构体

typedef struct _EX_PUSH_LOCK
{
  union
  {
  ULONG Locked: 1;
  ULONG Waiting: 1;
  ULONG Waking: 1;
  ULONG MultipleShared: 1;
  ULONG Shared: 28;
  ULONG Value;
  PVOID Ptr;
  };
} EX_PUSH_LOCK, *PEX_PUSH_LOCK;

typedef struct _FSRTL_COMMON_FCB_HEADER {
  CSHORT NodeTypeCode; 0
  CSHORT NodeByteSize; 2
  UCHAR Flags; 4
  UCHAR IsFastIoPossible; 5
  UCHAR Flags2; 6
  UCHAR Reserved : 4; 7
  UCHAR Version : 4;  
  PERESOURCE Resource; 8
  PERESOURCE PagingIoResource; c
  LARGE_INTEGER AllocationSize; 10
  LARGE_INTEGER FileSize; 18
  LARGE_INTEGER ValidDataLength; 20
} FSRTL_COMMON_FCB_HEADER;
typedef FSRTL_COMMON_FCB_HEADER *PFSRTL_COMMON_FCB_HEADER;

typedef struct _FSRTL_ADVANCED_FCB_HEADER {
  FSRTL_COMMON_FCB_HEADER;
  PFAST_MUTEX FastMutex; 28
  LIST_ENTRY FilterContexts; 2c
  EX_PUSH_LOCK PushLock; 34
  PVOID* FileContextSupportPointer; 38
} FSRTL_ADVANCED_FCB_HEADER;
typedef FSRTL_ADVANCED_FCB_HEADER *PFSRTL_ADVANCED_FCB_HEADER;

typedef struct _SCB {

  //
  // The following field is used for fast I/O. It contains the node
  // type code and size, indicates if fast I/O is possible, contains
  // allocation, file, and valid data size, a resource, and call back
  // pointers for FastIoRead and FastMdlRead.
  //
  // The node type codes for the Scb must be either NTFS_NTC_SCB_INDEX,
  // NTFS_NTC_SCB_ROOT_INDEX, or NTFS_NTC_SCB_DATA. Which one it is
  // determines the state of the union below.
  //

  FSRTL_ADVANCED_FCB_HEADER Header;

  //
  // The links for the queue of Scb off of a given Fcb. And a pointer
  // back to the Fcb. Corresponds to Fcb->ScbQueue
  //

  LIST_ENTRY FcbLinks; <-0x3C
  PFCB Fcb; <-0x44

  //
  // A pointer to the Vcb containing this Scb
  //

  PVCB Vcb; <-0x48

  //
  // The internal state of the Scb.
  //

  ULONG ScbState;

  //
  // A count of the number of file objects opened on this stream
  // which represent user non-cached handles. We use this count to
  // determine when to flush and purge the data section in only
  // non-cached handles remain on the file.
  //

  CLONG NonCachedCleanupCount;

  //
  // A count of the number of file objects that have been opened for
  // this attribute, but not yet been cleaned up yet.
  // This count gets decremented in NtfsCommonCleanup,
  // while the CloseCount below gets decremented in NtfsCommonClose.
  //

  CLONG CleanupCount;

  //
  // A count of the number of file objects that have opened
  // this attribute.
  //

  CLONG CloseCount;

  //
  // Share Access structure for this stream.
  //

  SHARE_ACCESS ShareAccess;

  //
  // The following two fields identify the actual attribute for this
  // Scb with respect to its file. We identify the attribute by
  // its type code and name.
  //

  ATTRIBUTE_TYPE_CODE AttributeTypeCode;
  UNICODE_STRING AttributeName;

  //
  // Stream File Object for internal use. This field is NULL if the
  // file stream is not being accessed internally.
  //

  PFILE_OBJECT FileObject;

  //
  // These pointers are used to detect writes that eminated from the
  // cache manager's worker thread. It prevents lazy writer threads,
  // who already have the Fcb shared, from trying to acquire it
  // exclusive, and thus causing a deadlock. We have to store two
  // threads, because the second thread could be writing the compressed
  // stream
  //

  PVOID LazyWriteThread[2];

  //
  // Pointer to the non-paged section objects and open attribute
  // table index.
  //

  PSCB_NONPAGED NonpagedScb;

  //
  // The following field contains the mcb for this Scb and some initial
  // structures for small and medium files.
  //

  NTFS_MCB Mcb;
  NTFS_MCB_INITIAL_STRUCTS McbStructs;

  //
  // Compression unit from attribute record.
  //

  ULONG CompressionUnit;

  //
  // AttributeFlags and CompressionUnitShift from attribute record
  //

  USHORT AttributeFlags;
  UCHAR CompressionUnitShift;
  UCHAR PadUchar;

  //
  // Valid Data to disk - as updated by NtfsPrepareBuffers
  //

  LONGLONG ValidDataToDisk;

  //
  // Number of clusters added due to Split Mcb calls. The user has
  // not asked for this allocation.
  //

  LONGLONG ExcessFromSplitMcb;

  //
  // Actual allocated bytes for this file.
  //

  LONGLONG TotalAllocated;

  //
  // Used by advanced Scb Header
  //

  LIST_ENTRY EofListHead;

  //
  // Defragmentation parameters
  //

  union {

  PMOVE_FILE_DATA MoveData;

  } Union;

  //
  // Pointer to structure containing snapshotted Scb values, or NULL
  // if the values have not been snapshotted.
  //

  struct _SCB_SNAPSHOT * ScbSnapshot;
  ULONG PadUlong;

  //
  // Scb Type union, for different types of Scbs
  //

  union {

  SCB_DATA Data;
  SCB_INDEX Index;
  SCB_MFT Mft;

  } ScbType;

} SCB;
typedef SCB *PSCB;