NTFS SCB

typedef struct _EX_PUSH_LOCK
{
     union
     {
          ULONG Locked: 1;
          ULONG Waiting: 1;
          ULONG Waking: 1;
          ULONG MultipleShared: 1;
          ULONG Shared: 28;
          ULONG Value;
          PVOID Ptr;
     };
} EX_PUSH_LOCK, *PEX_PUSH_LOCK;

typedef struct _FSRTL_COMMON_FCB_HEADER {
  CSHORT  NodeTypeCode;                        0
  CSHORT  NodeByteSize;                        2
  UCHAR  Flags;                                4
  UCHAR  IsFastIoPossible;                5
  UCHAR  Flags2;                        6
  UCHAR  Reserved : 4;                        7
  UCHAR  Version : 4;                        
  PERESOURCE  Resource;                        8
  PERESOURCE  PagingIoResource;                c
  LARGE_INTEGER  AllocationSize;        10
  LARGE_INTEGER  FileSize;                18
  LARGE_INTEGER  ValidDataLength;        20
} FSRTL_COMMON_FCB_HEADER;
typedef FSRTL_COMMON_FCB_HEADER *PFSRTL_COMMON_FCB_HEADER;

typedef struct _FSRTL_ADVANCED_FCB_HEADER {
  FSRTL_COMMON_FCB_HEADER;
  PFAST_MUTEX  FastMutex;                28
  LIST_ENTRY  FilterContexts;                2c
  EX_PUSH_LOCK  PushLock;                34
  PVOID*  FileContextSupportPointer;        38
} FSRTL_ADVANCED_FCB_HEADER;
typedef FSRTL_ADVANCED_FCB_HEADER *PFSRTL_ADVANCED_FCB_HEADER;

typedef struct _SCB {

    //
    //  The following field is used for fast I/O.  It contains the node
    //  type code and size, indicates if fast I/O is possible, contains
    //  allocation, file, and valid data size, a resource, and call back
    //  pointers for FastIoRead and FastMdlRead.
    //
    //  The node type codes for the Scb must be either NTFS_NTC_SCB_INDEX,
    //  NTFS_NTC_SCB_ROOT_INDEX, or NTFS_NTC_SCB_DATA.  Which one it is
    //  determines the state of the union below.
    //

    FSRTL_ADVANCED_FCB_HEADER Header;

    //
    //  The links for the queue of Scb off of a given Fcb.  And a pointer
    //  back to the Fcb.  Corresponds to Fcb->ScbQueue
    //

    LIST_ENTRY FcbLinks;                <-0x3C
    PFCB Fcb;                                <-0x44

    //
    //  A pointer to the Vcb containing this Scb
    //

    PVCB Vcb;                                <-0x48

    //
    //  The internal state of the Scb.
    //

    ULONG ScbState;

    //
    //  A count of the number of file objects opened on this stream
    //  which represent user non-cached handles.  We use this count to
    //  determine when to flush and purge the data section in only
    //  non-cached handles remain on the file.
    //

    CLONG NonCachedCleanupCount;

    //
    //  A count of the number of file objects that have been opened for
    //  this attribute, but not yet been cleaned up yet.
    //  This count gets decremented in NtfsCommonCleanup,
    //  while the CloseCount below gets decremented in NtfsCommonClose.
    //

    CLONG CleanupCount;

    //
    //  A count of the number of file objects that have opened
    //  this attribute.
    //

    CLONG CloseCount;

    //
    //  Share Access structure for this stream.
    //

    SHARE_ACCESS ShareAccess;

    //
    //  The following two fields identify the actual attribute for this
    //  Scb with respect to its file.   We identify the attribute by
    //  its type code and name.
    //

    ATTRIBUTE_TYPE_CODE AttributeTypeCode;
    UNICODE_STRING AttributeName;

    //
    //  Stream File Object for internal use.  This field is NULL if the
    //  file stream is not being accessed internally.
    //

    PFILE_OBJECT FileObject;

    //
    //  These pointers are used to detect writes that eminated from the
    //  cache manager's worker thread.  It prevents lazy writer threads,
    //  who already have the Fcb shared, from trying to acquire it
    //  exclusive, and thus causing a deadlock.  We have to store two
    //  threads, because the second thread could be writing the compressed
    //  stream
    //

    PVOID LazyWriteThread[2];

    //
    //  Pointer to the non-paged section objects and open attribute
    //  table index.
    //

    PSCB_NONPAGED NonpagedScb;

    //
    //  The following field contains the mcb for this Scb and some initial
    //  structures for small and medium files.
    //

    NTFS_MCB Mcb;
    NTFS_MCB_INITIAL_STRUCTS McbStructs;

    //
    //  Compression unit from attribute record.
    //

    ULONG CompressionUnit;

    //
    //  AttributeFlags and CompressionUnitShift from attribute record
    //

    USHORT AttributeFlags;
    UCHAR CompressionUnitShift;
    UCHAR PadUchar;

    //
    //  Valid Data to disk - as updated by NtfsPrepareBuffers
    //

    LONGLONG ValidDataToDisk;

    //
    //  Number of clusters added due to Split Mcb calls.  The user has
    //  not asked for this allocation.
    //

    LONGLONG ExcessFromSplitMcb;

    //
    //  Actual allocated bytes for this file.
    //

    LONGLONG TotalAllocated;

    //
    //  Used by advanced Scb Header
    //

    LIST_ENTRY EofListHead;

    //
    // Defragmentation parameters
    //

    union {

        PMOVE_FILE_DATA MoveData;

    } Union;

    //
    //  Pointer to structure containing snapshotted Scb values, or NULL
    //  if the values have not been snapshotted.
    //

    struct _SCB_SNAPSHOT * ScbSnapshot;
    ULONG PadUlong;

    //
    //  Scb Type union, for different types of Scbs
    //

    union {

        SCB_DATA Data;
        SCB_INDEX Index;
        SCB_MFT Mft;

    } ScbType;

} SCB;
typedef SCB *PSCB;

  neak47 大哥，先谢过；
http://bbs.driverdevelop.com/htm_data/39/0909/118199.html
在NTFS下不是FCB而是SCB？？？

引用第1楼skymelai于2009-09-25 11:37发表的  :
  neak47 大哥，先谢过；
http://bbs.driverdevelop.com/htm_data/39/0909/118199.html
在NTFS下不是FCB而是SCB？？？

Yes....

呵呵，刚刚赶上：
UCHAR  Flags;                                4
这里分号后的4编译不会有语法错误？？
还有LIST_ENTRY FcbLinks;                <-0x3C
这里的<-0x3C，是啥意思？应该没这种语法吧

typedef struct _FSRTL_COMMON_FCB_HEADER {
  CSHORT  NodeTypeCode;                        0
  CSHORT  NodeByteSize;                        2
  UCHAR  Flags;                                4
  UCHAR  IsFastIoPossible;                5
  UCHAR  Flags2;                        6
  UCHAR  Reserved : 4;                        7
  UCHAR  Version : 4;                        
  PERESOURCE  Resource;                        8
  PERESOURCE  PagingIoResource;                c
  LARGE_INTEGER  AllocationSize;        10
  LARGE_INTEGER  FileSize;                18
  LARGE_INTEGER  ValidDataLength;        20
} FSRTL_COMMON_FCB_HEADER;

必须要完整的NTFS头文件才行呢，里面好多结构如NTFS_MCB
都没有。。。。