标签:
一、文件系统的结构
超级块的数据结构是:
struct super_block { unsigned short s_ninodes; unsigned short s_nzones; unsigned short s_imap_blocks; unsigned short s_zmap_blocks; unsigned short s_firstdatazone; unsigned short s_log_zone_size; unsigned long s_max_size; unsigned short s_magic; /* These are only in memory */ struct buffer_head * s_imap[8]; struct buffer_head * s_zmap[8]; unsigned short s_dev; struct m_inode * s_isup; struct m_inode * s_imount; unsigned long s_time; struct task_struct * s_wait; unsigned char s_lock; unsigned char s_rd_only; unsigned char s_dirt; };
其中s_zmap[8]指向了逻辑块位图的buffer_head结构。buffer_head里面的b_data指向了真正的逻辑块位图数据。
i节点的第一个数据块,共1024个字节,1024再除以如下inode数据结构的大小,就可以知道每个数据块中inode节点的个数。第一个inode节点就是根节点,也就是/。
inode的数据结构(i节点):
struct m_inode { unsigned short i_mode; unsigned short i_uid; unsigned long i_size; unsigned long i_mtime; unsigned char i_gid; unsigned char i_nlinks; unsigned short i_zone[9]; /* these are in memory also */ struct task_struct * i_wait; unsigned long i_atime; unsigned long i_ctime; unsigned short i_dev; unsigned short i_num; unsigned short i_count; unsigned char i_lock; unsigned char i_dirt; unsigned char i_pipe; unsigned char i_mount; unsigned char i_seek; unsigned char i_update; };
dir_entry的数据结构(目录项):
struct dir_entry { unsigned short inode; char name[NAME_LEN]; };
例如获取/bin/sh的最终代码。
1、首先根据根节点i_zone[9],也就是数据块的块号,读取对应的数据块到缓冲区,此时缓冲区的数据,就是多个目录项结构。根据bin和dir_entry里面的name对比,找到对应的目录项。
2、再根据dir_entry里面的inode,也就是i节点的块号,找到bin的i节点。
3、再根据bin的i节点i_zone[9],也就是数据块的块号,读取对应的数据块到缓冲区,此时缓冲区的数据,就是多个目录项结构。根据sh和dir_entry里面的name对比,找到对应的目录项。
4、再根据dir_entry里面的inode,也就是i节点的块号,找到sh的i节点。
5、sh的i节点i_zone[9],对应的是真实代码的块号,而不再是目录项的集合。
标签:
原文地址:http://blog.csdn.net/jltxgcy/article/details/43671853