第一部分：

VOID
FindFirstIndexEntry (
??? IN PIRP_CONTEXT IrpContext,
??? IN PSCB Scb,
??? IN PVOID Value,
??? IN OUT PINDEX_CONTEXT IndexContext
??? )
{

。。。。。。

??? //
??? //? Lookup the attribute record from the Scb.
??? //

??? if (!NtfsLookupAttributeByName( IrpContext,
??????????????????????????????????? Scb->Fcb,
??????????????????????????????????? &Scb->Fcb->FileReference,
??????????????????????????????????? $INDEX_ROOT,
??????????????????????????????????? &Scb->AttributeName,
??????????????????????????????????? NULL,
??????????????????????????????????? FALSE,
??????????????????????????????????? &IndexContext->AttributeContext )) {

第二部分：

0: kd> p
Ntfs!FindFirstIndexEntry+0x68:
f71740d2 84c0??????????? test??? al,al
0: kd> dv

???? IrpContext = 0xf793291c
??????????? Scb = 0xe1363d20
????????? Value = 0xe13559b0
?? IndexContext = 0xe1352348
????? Attribute = 0x00000000
????? IndexRoot = 0xe1352348
???????????? Sp = 0xe1363d20
0: kd> dx -r1 ((Ntfs!_SCB *)0xe1363d20)
((Ntfs!_SCB *)0xe1363d20)???????????????? : 0xe1363d20 [Type: _SCB *]
??? [+0x000] Header?????????? [Type: _NTFS_ADVANCED_FCB_HEADER]
??? [+0x040] FcbLinks???????? [Type: _LIST_ENTRY]
??? [+0x048] Fcb????????????? : 0xe1363c58 [Type: _FCB *]
??? [+0x04c] Vcb????????????? : 0x895d5100 [Type: _VCB *]
??? [+0x050] ScbState???????? : 0x100006a0 [Type: unsigned long]
??? [+0x054] NonCachedCleanupCount : 0x0 [Type: unsigned long]
??? [+0x058] CleanupCount???? : 0x1 [Type: unsigned long]
??? [+0x05c] CloseCount?????? : 0x2 [Type: unsigned long]
??? [+0x060] ShareAccess????? [Type: _SHARE_ACCESS]
??? [+0x07c] AttributeTypeCode : 0xa0 [Type: unsigned long]
??? [+0x080] AttributeName??? : "$I30" [Type: _UNICODE_STRING]
??? [+0x088] FileObject?????? : 0x8962b128 [Type: _FILE_OBJECT *]
??? [+0x08c] NonpagedScb????? : 0x89954e60 [Type: _SCB_NONPAGED *]
??? [+0x090] Mcb????????????? [Type: _NTFS_MCB]
??? [+0x0a8] McbStructs?????? [Type: NTFS_MCB_INITIAL_STRUCTS]
??? [+0x0f0] CompressionUnit? : 0x0 [Type: unsigned long]
??? [+0x0f4] AttributeFlags?? : 0x0 [Type: unsigned short]
??? [+0x0f6] CompressionUnitShift : 0x0 [Type: unsigned char]
??? [+0x0f7] PadUchar???????? : 0x0 [Type: unsigned char]
??? [+0x0f8] ValidDataToDisk? : 0 [Type: __int64]
??? [+0x100] TotalAllocated?? : 8192 [Type: __int64]
??? [+0x108] EofListHead????? [Type: _LIST_ENTRY]
??? [+0x110] CcbQueue???????? [Type: _LIST_ENTRY]
??? [+0x118] ScbSnapshot????? : 0x0 [Type: _SCB_SNAPSHOT *]
??? [+0x11c] EncryptionContext : 0x0 [Type: void *]
??? [+0x120] EncryptionContextLength : 0x0 [Type: unsigned long]
??? [+0x124] ScbPersist?????? : 0x0 [Type: unsigned long]
??? [+0x128] IoAtEofThread??? : 0x0 [Type: unsigned long *]
??? [+0x130] ScbType????????? [Type: __unnamed]

第三部分：

BOOLEAN
NtfsFindInFileRecord (
??? IN PIRP_CONTEXT IrpContext,
??? IN PATTRIBUTE_RECORD_HEADER Attribute,
??? OUT PATTRIBUTE_RECORD_HEADER *ReturnAttribute,
??? IN ATTRIBUTE_TYPE_CODE QueriedTypeCode,
??? IN PCUNICODE_STRING QueriedName OPTIONAL,
??? IN BOOLEAN IgnoreCase,
??? IN PVOID QueriedValue OPTIONAL,
??? IN ULONG QueriedValueLength
??? )
{

??? while ( TRUE ) {

。。。。。。

??????????????? NtfsInitializeStringFromAttribute( &AttributeName, Attribute );

??????????????? //
??????????????? //? See if we have a name match.
??????????????? //

??????????????? if (NtfsAreNamesEqual( UpcaseTable,
?????????????????????????????????????? &AttributeName,
?????????????????????????????????????? QueriedName,
?????????????????????????????????????? IgnoreCase )) {

??????????????????? break;
??????????????? }

??? return TRUE;
}

第四部分：

??????????????? NtfsInitializeStringFromAttribute( &AttributeName, Attribute );

#define NtfsInitializeStringFromAttribute(NAME,ATTRIBUTE) {??????????????? \
??? (NAME)->Length = (USHORT)(ATTRIBUTE)->NameLength << 1;???????????????? \
??? (NAME)->MaximumLength = (NAME)->Length;??????????????????????????????? \?? ??? ??? ?
??? (NAME)->Buffer = (PWSTR)Add2Ptr((ATTRIBUTE), (ATTRIBUTE)->NameOffset); \
}

(NAME)->Buffer?? ??? ?(ATTRIBUTE)->NameLength?? ??? ??? ?+0x009 NameLength?????? : 0x4 ''
(NAME)->Buffer?? ??? ?(ATTRIBUTE)->NameOffset?? ??? ??? ?+0x00a NameOffset?????? : 0x18

0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER? 0xc1241438+48+60+28+48
?? +0x000 TypeCode???????? : 0x90
?? +0x004 RecordLength???? : 0xe0
?? +0x008 FormCode???????? : 0 ''
?? +0x009 NameLength?????? : 0x4 ''
?? +0x00a NameOffset?????? : 0x18
?? +0x00c Flags??????????? : 0
?? +0x00e Instance???????? : 6
?? +0x010 Form???????????? : __unnamed

0: kd> db 0xc1241438+48+60+28+48+18
c1241568? 24 00 49 00 33 00 30 00-30 00 00 00 01 00 00 00? $.I.3.0.0.......

第五部分：

0: kd> p
Ntfs!NtfsFindInFileRecord+0x92:
f7171ac2 384d1c????????? cmp???? byte ptr [ebp+1Ch],cl
0: kd> dv
??????? IrpContext = 0xf793291c
???????? Attribute = 0xc1241438

0: kd> dx -r1 ((Ntfs!_ATTRIBUTE_RECORD_HEADER *)0xc1241438)
((Ntfs!_ATTRIBUTE_RECORD_HEADER *)0xc1241438)???????????????? : 0xc1241438 [Type: _ATTRIBUTE_RECORD_HEADER *]
??? [+0x000] TypeCode???????? : 0x10 [Type: unsigned long]
??? [+0x004] RecordLength???? : 0x48 [Type: unsigned long]
??? [+0x008] FormCode???????? : 0x0 [Type: unsigned char]
??? [+0x009] NameLength?????? : 0x0 [Type: unsigned char]
??? [+0x00a] NameOffset?????? : 0x18 [Type: unsigned short]
??? [+0x00c] Flags??????????? : 0x0 [Type: unsigned short]
??? [+0x00e] Instance???????? : 0x0 [Type: unsigned short]
??? [+0x010] Form???????????? [Type: __unnamed]
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER? 0xc1241438
?? +0x000 TypeCode???????? : 0x10
?? +0x004 RecordLength???? : 0x48
?? +0x008 FormCode???????? : 0 ''
?? +0x009 NameLength?????? : 0 ''
?? +0x00a NameOffset?????? : 0x18
?? +0x00c Flags??????????? : 0
?? +0x00e Instance???????? : 0
?? +0x010 Form???????????? : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER? 0xc1241438+48
?? +0x000 TypeCode???????? : 0x30
?? +0x004 RecordLength???? : 0x60
?? +0x008 FormCode???????? : 0 ''
?? +0x009 NameLength?????? : 0 ''
?? +0x00a NameOffset?????? : 0x18
?? +0x00c Flags??????????? : 0
?? +0x00e Instance???????? : 1
?? +0x010 Form???????????? : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER? 0xc1241438+48+60
?? +0x000 TypeCode???????? : 0x40
?? +0x004 RecordLength???? : 0x28
?? +0x008 FormCode???????? : 0 ''
?? +0x009 NameLength?????? : 0 ''
?? +0x00a NameOffset?????? : 0
?? +0x00c Flags??????????? : 0
?? +0x00e Instance???????? : 9
?? +0x010 Form???????????? : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER? 0xc1241438+48+60+28
?? +0x000 TypeCode???????? : 0x50
?? +0x004 RecordLength???? : 0x48
?? +0x008 FormCode???????? : 0x1 ''
?? +0x009 NameLength?????? : 0 ''
?? +0x00a NameOffset?????? : 0x40
?? +0x00c Flags??????????? : 0
?? +0x00e Instance???????? : 2
?? +0x010 Form???????????? : __unnamed
0: kd> dt Ntfs!_ATTRIBUTE_RECORD_HEADER? 0xc1241438+48+60+28+48
?? +0x000 TypeCode???????? : 0x90
?? +0x004 RecordLength???? : 0xe0
?? +0x008 FormCode???????? : 0 ''
?? +0x009 NameLength?????? : 0x4 ''
?? +0x00a NameOffset?????? : 0x18
?? +0x00c Flags??????????? : 0
?? +0x00e Instance???????? : 6
?? +0x010 Form???????????? : __unnamed