第一部分：
LfsUpdateLfcbFromRestart( ThisLfcb,
FileSize,
DiskRestartArea,
FirstRestar
1: kd> p
Ntfs!LfsRestartLogFile+0x317:
f71fc8dd e820e5ffff call Ntfs!LfsUpdateLfcbFromRestart (f71fae02)
1: kd> t
Ntfs!LfsUpdateLfcbFromRestart:
f71fae02 55 push ebp
1: kd> kc
#
00 Ntfs!LfsUpdateLfcbFromRestart
01 Ntfs!LfsRestartLogFile
02 Ntfs!LfsOpenLogFile
03 Ntfs!NtfsStartLogFile
04 Ntfs!NtfsMountVolume
05 Ntfs!NtfsCommonFileSystemControl
06 Ntfs!NtfsFspDispatch
07 nt!ExpWorkerThread
08 nt!PspSystemThreadStartup
09 nt!KiThreadStartup
1: kd> dv
Lfcb = 0xe1364008
FileSize = 0n67108864
RestartArea = 0xc1140030
RestartOffset = 0x30
LsnFileOffset = 0n67108864
Wrapped = 0x00 ''
LsnFinalOffset = 0n38505786882
第二部分：
Lfcb->SeqNumber = LfsLsnToSeqNumber( Lfcb, Lfcb->LastFlushedLsn );
#define LfsLsnToSeqNumber(LFCB,LSN) \
/*xxShr*/Int64ShrlMod32( ((ULONGLONG)(LSN).QuadPart), (LFCB)->FileDataBits )
逻辑右移：数字向右移动，左边补0。Windows中支持的函数为：Int64ShrlMod32
1: kd> dt _LFS_RESTART_AREA 0xc1140030
Ntfs!_LFS_RESTART_AREA
+0x000 CurrentLsn : _LARGE_INTEGER 0x8117464
+0x008 LogClients : 1
+0x00a ClientFreeList : 0xffff
+0x00c ClientInUseList : 0
+0x00e Flags : 0
+0x010 SeqNumberBits : 0x28
+0x014 RestartAreaLength : 0xe0
+0x016 ClientArrayOffset : 0x40
+0x018 FileSize : 0n67108864
+0x020 LastLsnDataLength : 0x68
+0x024 RecordHeaderLength : 0x30
+0x026 LogPageDataOffset : 0x40
+0x028 RestartOpenLogCount : 0x85e1225b
+0x02c LastFailedFlushStatus : 0
+0x030 LastFailedFlushOffset : 0n0
+0x038 LastFailedFlushLsn : _LARGE_INTEGER 0x0
+0x040 LogClientArray : [1] _LFS_CLIENT_RECORD
第三部分：
Lfcb->SeqNumberBits = RestartArea->SeqNumberBits;
Lfcb->FileDataBits = (sizeof( LSN ) * 8) - Lfcb->SeqNumberBits;
+0x010 SeqNumberBits : 0x28
1: kd> dt _LARGE_INTEGER -v
hal!_LARGE_INTEGER
union _LARGE_INTEGER, 4 elements, 0x8 bytes
+0x000 LowPart : Uint4B
+0x004 HighPart : Int4B
+0x000 u : struct __unnamed, 2 elements, 0x8 bytes
+0x000 QuadPart : Int8B
0x40-0x28=0x18
第四部分：
} else {
Lfcb->FileSize = min( FileSize, RestartArea->FileSize );
}
[+0x018] FileSize : 67108864 [Type: __int64]
第五部分：
//
// We get the sequence number bits from the restart area and compute the
// file data bits.
//
Lfcb->SeqNumberBits = RestartArea->SeqNumberBits;
Lfcb->FileDataBits = (sizeof( LSN ) * 8) - Lfcb->SeqNumberBits;
[+0x080] SeqNumberBits : 0x28 [Type: unsigned long]
[+0x084] FileDataBits : 0x18 [Type: unsigned long]
Lfcb->SeqNumber = LfsLsnToSeqNumber( Lfcb, Lfcb->LastFlushedLsn ); =0x8
[+0x0c8] LastFlushedLsn : {135361636} [Type: _LARGE_INTEGER]
1: kd> ?0n135361636
Evaluate expression: 135361636 = 08117464
#define LfsLsnToSeqNumber(LFCB,LSN) \
/*xxShr*/Int64ShrlMod32( ((ULONGLONG)(LSN).QuadPart), (LFCB)->FileDataBits )
逻辑右移：数字向右移动，左边补0。Windows中支持的函数为：Int64ShrlMod32
Lfcb->SeqNumber = LfsLsnToSeqNumber( Lfcb, Lfcb->LastFlushedLsn );
Lfcb->SeqNumberForWrap = Lfcb->SeqNumber + 1;
[+0x070] SeqNumber : 8 [Type: __int64]
[+0x078] SeqNumberForWrap : 9 [Type: __int64]
第六部分：
1: kd> dv
Lfcb = 0x00000018
FileSize = 0n135361636
RestartArea = 0xc1140030
RestartOffset = 0x30
//
// Compute the restart page values from the restart offset.
//
Lfcb->RestartDataOffset = RestartOffset;
Lfcb->RestartDataSize = (ULONG)Lfcb->LogPageSize - RestartOffset;
[+0x04c] RestartDataOffset : 0x30 [Type: unsigned long]
[+0x050] LogPageDataOffset : 0 [Type: __int64]
[+0x058] RestartDataSize : 0xfd0 [Type: unsigned long]
if (FlagOn( Lfcb->Flags, LFCB_PACK_LOG )) {
Lfcb->RecordHeaderLength = RestartArea->RecordHeaderLength;
Lfcb->ClientArrayOffset = RestartArea->ClientArrayOffset;
Lfcb->RestartAreaSize = RestartArea->RestartAreaLength;
(ULONG)Lfcb->LogPageDataOffset = RestartArea->LogPageDataOffset;
Lfcb->LogPageDataSize = Lfcb->LogPageSize - Lfcb->LogPageDataOffset;
[+0x024] RecordHeaderLength : 0x30 [Type: unsigned short]
[+0x016] ClientArrayOffset : 0x40 [Type: unsigned short]
[+0x014] RestartAreaLength : 0xe0 [Type: unsigned short]
[+0x026] LogPageDataOffset : 0x40 [Type: unsigned short]
第七部分：
LfsAllocateLbcb( Lfcb, &Lfcb->PrevTail );
Lfcb->PrevTail->FileOffset = Lfcb->FirstLogPage - Lfcb->LogPageSize;
LfsAllocateLbcb( Lfcb, &Lfcb->ActiveTail );
Lfcb->ActiveTail->FileOffset = Lfcb->PrevTail->FileOffset - Lfcb->LogPageSize;
1: kd> dt _LFCB 0xe1364008
Ntfs!_LFCB
+0x000 NodeTypeCode : 0n2051
+0x002 NodeByteSize : 0n352
+0x004 LfcbLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x00c LchLinks : _LIST_ENTRY [ 0xe1364014 - 0xe1364014 ]
+0x014 FileObject : 0x89811f90 _FILE_OBJECT
+0x018 FileSize : 0n67108864
+0x020 LogPageSize : 0n4096
+0x028 LogPageMask : 0xfff
+0x02c LogPageInverseMask : 0n-4096
+0x030 LogPageShift : 0xc
+0x038 FirstLogPage : 0n16384
1: kd> ?0n16384
Evaluate expression: 16384 = 00004000
+0x098 ActiveTail : 0xe13417e8 _LBCB
+0x09c PrevTail : 0xe1278640 _LBCB
1: kd> dx -id 0,0,899a2278 -r1 ((Ntfs!_LBCB *)0xe1278640)
((Ntfs!_LBCB *)0xe1278640) : 0xe1278640 [Type: _LBCB *]
[+0x000] NodeTypeCode : 2050 [Type: short]
[+0x002] NodeByteSize : 96 [Type: short]
[+0x004] WorkqueLinks [Type: _LIST_ENTRY]
[+0x00c] ActiveLinks [Type: _LIST_ENTRY]
[+0x018] FileOffset : 12288 [Type: __int64] 0x3000
[+0x020] Length : 0 [Type: __int64]
[+0x028] SeqNumber : 0 [Type: __int64]
[+0x030] BufferOffset : 0 [Type: __int64]
[+0x038] PageHeader : 0x0 [Type: void *]
[+0x03c] LogPageBcb : 0x0 [Type: void *]
[+0x040] LastLsn : {0} [Type: _LARGE_INTEGER]
[+0x048] LastEndLsn : {0} [Type: _LARGE_INTEGER]
[+0x050] Flags : 0x0 [Type: unsigned long]
[+0x054] LbcbFlags : 0x0 [Type: unsigned long]
[+0x058] ResourceThread : 0x0 [Type: unsigned long]
1: kd> dx -id 0,0,899a2278 -r1 ((Ntfs!_LBCB *)0xe13417e8)
((Ntfs!_LBCB *)0xe13417e8) : 0xe13417e8 [Type: _LBCB *]
[+0x000] NodeTypeCode : 2050 [Type: short]
[+0x002] NodeByteSize : 96 [Type: short]
[+0x004] WorkqueLinks [Type: _LIST_ENTRY]
[+0x00c] ActiveLinks [Type: _LIST_ENTRY]
[+0x018] FileOffset : 8192 [Type: __int64] 0x2000
[+0x020] Length : 0 [Type: __int64]
[+0x028] SeqNumber : 0 [Type: __int64]
[+0x030] BufferOffset : 0 [Type: __int64]
[+0x038] PageHeader : 0x0 [Type: void *]
[+0x03c] LogPageBcb : 0x0 [Type: void *]
[+0x040] LastLsn : {0} [Type: _LARGE_INTEGER]
[+0x048] LastEndLsn : {0} [Type: _LARGE_INTEGER]
[+0x050] Flags : 0x0 [Type: unsigned long]
[+0x054] LbcbFlags : 0x0 [Type: unsigned long]
[+0x058] ResourceThread : 0x0 [Type: unsigned long]
第八部分：
(ULONG)Lfcb->ReservedLogPageSize = (ULONG)Lfcb->LogPageDataSize - Lfcb->RecordHeaderLength;
+0x060 LogPageDataSize : 0n4032
1: kd> ?0n4032
Evaluate expression: 4032 = 00000fc0
[+0x100] ReservedLogPageSize : 3984 [Type: __int64] 00000f90
#define LfsLsnToFileOffset(LFCB,LSN) \
/*xxShr*/( ((ULONGLONG)/*xxShl*/( (LSN).QuadPart << (LFCB)->SeqNumberBits )) >> ((LFCB)->SeqNumberBits - 3) )
第九部分：
LsnFileOffset = LfsLsnToFileOffset( Lfcb, Lfcb->LastFlushedLsn );
[+0x0c8] LastFlushedLsn : {135361636} [Type: _LARGE_INTEGER]
1: kd> ?0n135361636
Evaluate expression: 135361636 = 08117464
[+0x080] SeqNumberBits : 0x28 [Type: unsigned long]
[+0x084] FileDataBits : 0x18 [Type: unsigned long]
0x8117464
1000 0001 0001 0111 0100 0110 0100
1000 0001 0001 0111 0100 0110 0100 000
100 0 000 1 000 1 011 1 010 0 011 0 010 0 000
1: kd> ?0x117464*8
Evaluate expression: 9151264 = 008ba320
1: kd> p
Ntfs!LfsUpdateLfcbFromRestart+0x1f9:
f71faffb e8c0b8f4ff call Ntfs!aullshr (f71468c0)
1: kd> p
Ntfs!LfsUpdateLfcbFromRestart+0x1fe:
f71fb000 8b4e38 mov ecx,dword ptr [esi+38h]
1: kd> r
eax=008ba320
1: kd> dv
Lfcb = 0x00000018
FileSize = 0n9151264
RestartArea = 0xc1140030
RestartOffset = 0x30
LsnFileOffset = 0n9151264
Wrapped = 0x00 ''
LsnFinalOffset = 0n38654705673
1: kd> ?0n9151264
Evaluate expression: 9151264 = 008ba320
第十部分：
} else {
LONGLONG LsnFinalOffset;
BOOLEAN Wrapped;
ULONG DataLength;
ULONG RemainingPageBytes;
DataLength = RestartArea->LastLsnDataLength;
//
// Find the end of this log record.
//
LfsLsnFinalOffset( Lfcb,
Lfcb->LastFlushedLsn,
DataLength,
&LsnFinalOffset );
[+0x020] LastLsnDataLength : 0x68 [Type: unsigned long]
1: kd> p
Ntfs!LfsUpdateLfcbFromRestart+0x23b:
f71fb03d e8183a0000 call Ntfs!LfsLsnFinalOffset (f71fea5a)
1: kd> t
Ntfs!LfsLsnFinalOffset:
f71fea5a 55 push ebp
1: kd> kc
#
00 Ntfs!LfsLsnFinalOffset
01 Ntfs!LfsUpdateLfcbFromRestart
02 Ntfs!LfsRestartLogFile
03 Ntfs!LfsOpenLogFile
04 Ntfs!NtfsStartLogFile
05 Ntfs!NtfsMountVolume
06 Ntfs!NtfsCommonFileSystemControl
07 Ntfs!NtfsFspDispatch
08 nt!ExpWorkerThread
09 nt!PspSystemThreadStartup
0a nt!KiThreadStartup
1: kd> dv
Lfcb = 0xe1364008
Lsn = {135361636}
DataLength = 0x68
FinalOffset = 0xf78d2934
RemainingPageBytes = 0xf78d2934
Wrapped = 0xe1 ''
))
