[NTOSKRNL] In !filecache, try to display FCB name

When no name is set in the file object, try to read the name
from the FCB. We only support FastFAT (ours) FCB for now.

This is clearly a hack, but for a kdbg command, so ;-)
This commit is contained in:
Pierre Schweitzer 2018-04-27 18:57:30 +02:00
parent 315f9a13d4
commit 43836b0fbb
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B

View file

@ -1463,6 +1463,7 @@ ExpKdbgExtFileCache(ULONG Argc, PCHAR Argv[])
ULONG Valid = 0, Dirty = 0;
PROS_SHARED_CACHE_MAP SharedCacheMap;
PUNICODE_STRING FileName;
PWSTR Extra = L"";
SharedCacheMap = CONTAINING_RECORD(ListEntry, ROS_SHARED_CACHE_MAP, SharedCacheMapLinks);
@ -1489,13 +1490,22 @@ ExpKdbgExtFileCache(ULONG Argc, PCHAR Argv[])
{
FileName = &SharedCacheMap->FileObject->FileName;
}
else if (SharedCacheMap->FileObject != NULL &&
SharedCacheMap->FileObject->FsContext != NULL &&
((PFSRTL_COMMON_FCB_HEADER)(SharedCacheMap->FileObject->FsContext))->NodeTypeCode == 0x0502 &&
((PFSRTL_COMMON_FCB_HEADER)(SharedCacheMap->FileObject->FsContext))->NodeByteSize == 0x1F8 &&
((PUNICODE_STRING)(((PUCHAR)SharedCacheMap->FileObject->FsContext) + 0x100))->Length != 0)
{
FileName = (PUNICODE_STRING)(((PUCHAR)SharedCacheMap->FileObject->FsContext) + 0x100);
Extra = L" (FastFAT)";
}
else
{
FileName = &NoName;
}
/* And print */
KdbpPrint("%p\t%d\t%d\t%wZ\n", SharedCacheMap, Valid, Dirty, FileName);
KdbpPrint("%p\t%d\t%d\t%wZ%S\n", SharedCacheMap, Valid, Dirty, FileName, Extra);
}
return TRUE;