当前位置：首页 > news >正文

Ntfs!NtfsReadBootSector函数分析之nt!CcGetVacbMiss中得到一个nt!_VACB结构

news 来源：原创 2025/5/26 6:55:26

第一部分：

1: kd> g
Breakpoint 3 hit
nt!CcGetVacbMiss:
80a1a19e 6a30 push 30h
1: kd> kc
#
00 nt!CcGetVacbMiss
01 nt!CcGetVirtualAddress
02 nt!CcMapData
03 Ntfs!NtfsMapStream
04 Ntfs!NtfsReadBootSector Ntfs!NtfsReadBootSector
05 Ntfs!NtfsMountVolume
06 Ntfs!NtfsCommonFileSystemControl
07 Ntfs!NtfsFspDispatch
08 nt!ExpWorkerThread
09 nt!PspSystemThreadStartup
0a nt!KiThreadStartup

1: kd> kv
# ChildEBP RetAddr Args to Child
00 f78d6994 80a1a947 89901cc8 00000000 00000000 nt!CcGetVacbMiss (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\cache\vacbsup.c @ 492]
01 f78d69c0 80bf97f1 89901d98 00000000 00000000 nt!CcGetVirtualAddress+0xc7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\cache\vacbsup.c @ 414]
02 f78d6a28 f7171729 899c41b0 f78d6a64 00000200 nt!CcMapData+0x89 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\cache\pinsup.c @ 191]
03 f78d6a54 f7196c08 895de328 898ffa10 00000000 Ntfs!NtfsMapStream+0xaf (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\cachesup.c @ 625]
04 f78d6ac0 f7191e0a 895de328 898fe7f8 f78d6c80 Ntfs!NtfsReadBootSector+0x15a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\fsctrl.c @ 5143]
05 f78d6cec f717c5aa 895de328 89456310 895de328 Ntfs!NtfsMountVolume+0x226 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\fsctrl.c @ 1307]
06 f78d6d04 f71484b0 895de328 89456310 8999d020 Ntfs!NtfsCommonFileSystemControl+0x8c (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\fsctrl.c @ 837]
07 f78d6d80 80af2bb9 895de328 00000000 8999d020 Ntfs!NtfsFspDispatch+0x1fe (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\fs\ntfs\fspdisp.c @ 336]
08 f78d6dac 80d391f0 895de328 00000000 00000000 nt!ExpWorkerThread+0x10f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ex\worker.c @ 1153]
09 f78d6ddc 80b00d52 80af2aaa 00000000 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ps\create.c @ 2213]
0a 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 [d:\srv03rtm\base\ntos\ke\i386\threadbg.asm @ 81]

第二部分：

1: kd> dt SHARED_CACHE_MAP 89901cc8
nt!SHARED_CACHE_MAP
   +0x000 NodeTypeCode     : 0n767
   +0x002 NodeByteSize     : 0n304
   +0x004 OpenCount        : 1
   +0x008 FileSize         : _LARGE_INTEGER 0x2200
   +0x010 BcbList          : _LIST_ENTRY [ 0x89901cd8 - 0x89901cd8 ]
   +0x018 SectionSize      : _LARGE_INTEGER 0x100000
   +0x020 ValidDataLength : _LARGE_INTEGER 0x7fffffff`ffffffff
   +0x028 ValidDataGoal    : _LARGE_INTEGER 0x7fffffff`ffffffff
   +0x030 InitialVacbs     : [4] (null)
   +0x040 Vacbs            : 0x89901cf8 -> (null)            +0x040 Vacbs            : 0x89901cf8
   +0x044 FileObject       : 0x899c41b0 _FILE_OBJECT
   +0x048 ActiveVacb       : (null)
   +0x04c NeedToZero       : (null)
   +0x050 ActivePage       : 0
   +0x054 NeedToZeroPage   : 0
   +0x058 ActiveVacbSpinLock : 0
   +0x05c VacbActiveCount : 0               +0x05c VacbActiveCount : 0

1: kd> dd 0x89901cf8
89901cf8 00000000 00000000 00000000 00000000
89901d08 89901cf8 899c41b0 00000000 00000000
89901d18 00000000 00000000 00000000 00000000
89901d28 00000000 80b1cbd0 80b1cbd0 00000204

PVACB
CcGetVacbMiss (
    IN PSHARED_CACHE_MAP SharedCacheMap,
    IN LARGE_INTEGER FileOffset,
    IN OUT PKIRQL OldIrql
    )

1: kd> dv
   SharedCacheMap = 0x89901cc8
       FileOffset = {0}
          OldIrql = 0xf78d69bf ""

    //
    // Mark it in use so no one else will muck with it after
    // we release the spin lock.
    //

Vacb->Overlay.ActiveCount = 1;
SharedCacheMap->VacbActiveCount += 1;

第三部分：预先分析

Vacb = CONTAINING_RECORD( CcVacbFreeList.Flink, VACB, LruList );
CcMoveVacbToReuseTail( Vacb );

1: kd> x nt!CcVacbFreeList
80b1cb58          nt!CcVacbFreeList = struct _LIST_ENTRY [ 0x89988010 - 0x89993fc8 ]
1: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x80b1cb58))
(*((ntkrnlmp!_LIST_ENTRY *)0x80b1cb58))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x89988010 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x89993fc8 [Type: _LIST_ENTRY *]

1: kd> dt _vacb 0x89988010-10
nt!_VACB
   +0x000 BaseAddress      : (null)
   +0x004 SharedCacheMap   : (null)
   +0x008 Overlay          : __unnamed
   +0x010 LruList          : _LIST_ENTRY [ 0x89988028 - 0x80b1cb58 ]

#define CcMoveVacbToReuseTail(V) RemoveEntryList( &(V)->LruList ); \
InsertTailList( &CcVacbLru, &(V)->LruList );

1: kd> x nt!CcVacbLru
80b1cb60          nt!CcVacbLru = struct _LIST_ENTRY [ 0x80b1cb60 - 0x80b1cb60 ]
1: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x80b1cb60))
(*((ntkrnlmp!_LIST_ENTRY *)0x80b1cb60))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x80b1cb60 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x80b1cb60 [Type: _LIST_ENTRY *]

第四部分：调试过程

Vacb = CONTAINING_RECORD( CcVacbFreeList.Flink, VACB, LruList ); //之后

dv
Vacb = 0x89988000

1: kd> dx -r1 ((ntkrnlmp!_VACB *)0x89988000)
((ntkrnlmp!_VACB *)0x89988000)                 : 0x89988000 [Type: _VACB *]
    [+0x000] BaseAddress      : 0x0 [Type: void *]
    [+0x004] SharedCacheMap   : 0x0 [Type: _SHARED_CACHE_MAP *]
    [+0x008] Overlay          [Type: __unnamed]
    [+0x010] LruList          [Type: _LIST_ENTRY]
1: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x89988010))
(*((ntkrnlmp!_LIST_ENTRY *)0x89988010))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x89988028 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x80b1cb58 [Type: _LIST_ENTRY *]

CcMoveVacbToReuseTail( Vacb ); //之后

1: kd> dx -r1 ((ntkrnlmp!_VACB *)0x89988000)
((ntkrnlmp!_VACB *)0x89988000)                 : 0x89988000 [Type: _VACB *]
    [+0x000] BaseAddress      : 0x0 [Type: void *]
    [+0x004] SharedCacheMap   : 0x0 [Type: _SHARED_CACHE_MAP *]
    [+0x008] Overlay          [Type: __unnamed]
    [+0x010] LruList          [Type: _LIST_ENTRY]
1: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x89988010))
(*((ntkrnlmp!_LIST_ENTRY *)0x89988010))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x80b1cb60 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x80b1cb60 [Type: _LIST_ENTRY *]

1: kd> x nt!CcVacbLru
80b1cb60          nt!CcVacbLru = struct _LIST_ENTRY [ 0x89988010 - 0x89988010 ]
1: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x80b1cb60))
(*((ntkrnlmp!_LIST_ENTRY *)0x80b1cb60))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x89988010 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x89988010 [Type: _LIST_ENTRY *]