第一部分：

1: kd> kc
?#
00 nt!CcGetVirtualAddressIfMapped
01 nt!CcFlushCache
02 Ntfs!LfsFlushLfcb
03 Ntfs!LfsFlushToLsnPriv
04 Ntfs!LfsWriteLfsRestart
05 Ntfs!LfsWriteRestartArea
06 Ntfs!NtfsCheckpointVolume
07 Ntfs!NtfsCheckpointAllVolumes
08 nt!ExpWorkerThread
09 nt!PspSystemThreadStartup
0a nt!KiThreadStartup
1: kd> dv
?SharedCacheMap = 0x89469530
???? FileOffset = 0n7884800
?????????? Vacb = 0xf78d279c
?ReceivedLength = 0xf78d27ac
???? VacbOffset = 8
??????? OldIrql = 0xf7 ''

??? if ((*Vacb = GetVacb( SharedCacheMap, *(PLARGE_INTEGER)&FileOffset )) != NULL) {

??????? if ((*Vacb)->Overlay.ActiveCount == 0) {
??????????? SharedCacheMap->VacbActiveCount += 1;
??????? }

#define GetVacb(SCM,OFF) (??????????????????????????????????????????????????????????????? \
??? ((SCM)->SectionSize.QuadPart > VACB_SIZE_OF_FIRST_LEVEL) ???????????????????????????? \
??? CcGetVacbLargeOffset((SCM),(OFF).QuadPart) :????????????????????????????????????????? \
??? (SCM)->Vacbs[(OFF).LowPart >> VACB_OFFSET_SHIFT]????????????????????????????????????? \
)

第二部分：

1: kd> dx -r1 ((ntkrnlmp!_SHARED_CACHE_MAP *)0x89469530)
((ntkrnlmp!_SHARED_CACHE_MAP *)0x89469530)???????????????? : 0x89469530 [Type: _SHARED_CACHE_MAP *]
??? [+0x000] NodeTypeCode???? : 767 [Type: short]
??? [+0x002] NodeByteSize???? : 304 [Type: short]
??? [+0x004] OpenCount??????? : 0x2 [Type: unsigned long]
??? [+0x008] FileSize???????? : {67108864} [Type: _LARGE_INTEGER]
??? [+0x010] BcbList????????? [Type: _LIST_ENTRY]
??? [+0x018] SectionSize????? : {67108864} [Type: _LARGE_INTEGER]
??? [+0x020] ValidDataLength? : {9223372036854775807} [Type: _LARGE_INTEGER]
??? [+0x028] ValidDataGoal??? : {9223372036854775807} [Type: _LARGE_INTEGER]
??? [+0x030] InitialVacbs???? [Type: _VACB * [4]]
??? [+0x040] Vacbs??????????? : 0x89469320 [Type: _VACB * *]
1: kd> dd 0x89469320
89469320? 894d1008 00000000 00000000 00000000
89469330? 00000000 00000000 00000000 00000000

1: kd> p
nt!CcGetVirtualAddressIfMapped+0xa7:
80a19007 e8eefbffff????? call??? nt!CcGetVacbLargeOffset (80a18bfa)
1: kd> t
nt!CcGetVacbLargeOffset:
80a18bfa 55????????????? push??? ebp
1: kd> kc
?#
00 nt!CcGetVacbLargeOffset
01 nt!CcGetVirtualAddressIfMapped
02 nt!CcFlushCache
03 Ntfs!LfsFlushLfcb
04 Ntfs!LfsFlushToLsnPriv
05 Ntfs!LfsWriteLfsRestart
06 Ntfs!LfsWriteRestartArea
07 Ntfs!NtfsCheckpointVolume
08 Ntfs!NtfsCheckpointAllVolumes
09 nt!ExpWorkerThread
0a nt!PspSystemThreadStartup
0b nt!KiThreadStartup

1: kd> dv
?SharedCacheMap = 0x89469530
???? FileOffset = 0x00785000
????????? Level = 8

??? Shift -= VACB_LEVEL_SHIFT;
??? while (((Vacb = (PVACB)VacbArray[FileOffset >> Shift]) != NULL) && (Level != 0)) {

??????? Level -= 1;

??????? VacbArray = (PVACB *)Vacb;
??????? FileOffset &= ((LONGLONG)1 << Shift) - 1;

??????? Shift -= VACB_LEVEL_SHIFT;
??? }

1: kd> p
nt!CcGetVacbLargeOffset+0x6d:
80a18c67 e8c4af0d00????? call??? nt!_allshr (80af3c30)
1: kd> r
eax=00785000 ebx=89469320 ecx=00000019

1: kd> p
nt!CcGetVacbLargeOffset+0x94:
80a18c8e 21450c????????? and???? dword ptr [ebp+0Ch],eax
1: kd> r
eax=01ffffff ebx=00000000 ecx=00000019 edx=00000000 esi=894d1008 edi=00000019
eip=80a18c8e esp=f78d26f4 ebp=f78d270c

1: kd> dd f78d270c+0Ch
f78d2718? 00785000

1: kd> p
nt!CcGetVacbLargeOffset+0xa0:
80a18c9a 83ef07????????? sub???? edi,7
1: kd> p
nt!CcGetVacbLargeOffset+0xa3:
80a18c9d 8bcf??????????? mov???? ecx,edi
1: kd> r
eax=00785000 ebx=00000000 ecx=00000019 edx=00000000 esi=894d1008 edi=00000012

edi=00000012

?????? Shift -= VACB_LEVEL_SHIFT;?? ?=edi=00000012

第三部分：第二次循環

00785000

0111 1000 1001 0000 0000 0000

01?? ?11 10

0x1e

1: kd> dd 0x894d1008
894d1008? 89988018 00000000 00000000 00000000
894d1018? 00000000 00000000 00000000 00000000
894d1028? 00000000 00000000 00000000 00000000
894d1038? 00000000 00000000 00000000 00000000
894d1048? 00000000 00000000 00000000 00000000
894d1058? 00000000 00000000 00000000 00000000
894d1068? 00000000 00000000 00000000 00000000
894d1078? 00000000 89988048 89988498 00000000
1: kd> dd 0x894d1008+1e*4
894d1080? 89988498

1: kd> dt _vacb 89988498
nt!_VACB
?? +0x000 BaseAddress????? : 0xc2c40000 Void
?? +0x004 SharedCacheMap?? : 0x89469530 _SHARED_CACHE_MAP
?? +0x008 Overlay????????? : __unnamed
?? +0x010 LruList????????? : _LIST_ENTRY [ 0x80b1cb60 - 0x89988010 ]

1: kd> p
nt!CcGetVacbLargeOffset+0xb1:
80a18cab 3bf3??????????? cmp???? esi,ebx
1: kd> r
eax=0000001e ebx=00000000 ecx=00000012 edx=00000000 esi=89988498 edi=00000012

esi=89988498