如何根据 CreateFile 返回的句丙 求出文件名？(300分)

我是想 HOOK WriteFile 这个 API，以实现一些功能。<br>由于 被 HOOK 程序启动太早，没办法 HOOK 到 CreateFile 。<br>所以想知道能不能根据句丙求出文件名。

给个思路<br>CreateFileMapping<br>MapViewOfFile<br>GetMappedFileName

CreateFile可以打开com口，驱动器……

你可以换一个思路,比如:查找进程的方法...

通过句柄取文件名,貌似不行<br>我想知道哪个进程在以独占方式打开文件....谁知道?

tseug <br> &nbsp;你说的那是内存文件影射 你似乎没明白我的问题.<br><br>0桁骀 <br> &nbsp;这个我晓得,只是参数里文件名的不同而已.我就是想知道那个参数.<br><br>linuxping<br> &nbsp;那个进程打开了N个文件诶~~~ 我还是不知道....<br><br>Milpas<br> &nbsp;不晓得看模块列表可行不?

找到一段 VC 的代码. 哪位兄弟帮翻译下?<br><br>#include &lt;windows.h&gt;<br>#include &lt;stdio.h&gt;<br>#include &lt;tchar.h&gt;<br>#include &lt;string.h&gt;<br>#include &lt;psapi.h&gt;<br><br>#define BUFSIZE 512<br><br>BOOL GetFileNameFromHandle(HANDLE hFile) <br>{<br> &nbsp;BOOL bSuccess = FALSE;<br> &nbsp;TCHAR pszFilename[MAX_PATH+1];<br> &nbsp;HANDLE hFileMap;<br><br> &nbsp;// Get the file size.<br> &nbsp;DWORD dwFileSizeHi = 0;<br> &nbsp;DWORD dwFileSizeLo = GetFileSize(hFile, &dwFileSizeHi); <br><br> &nbsp;if( dwFileSizeLo == 0 && dwFileSizeHi == 0 )<br> &nbsp;{<br> &nbsp; &nbsp; printf(&quot;Cannot map a file with a length of zero./n&quot;<br> &nbsp; &nbsp; return FALSE;<br> &nbsp;}<br><br> &nbsp;// Create a file mapping object.<br> &nbsp;hFileMap = CreateFileMapping(hFile, <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;NULL, <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PAGE_READONLY,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0, <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;NULL);<br><br> &nbsp;if (hFileMap) <br> &nbsp;{<br> &nbsp; &nbsp;// Create a file mapping to get the file name.<br> &nbsp; &nbsp;void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);<br><br> &nbsp; &nbsp;if (pMem) <br> &nbsp; &nbsp;{<br> &nbsp; &nbsp; &nbsp;if (GetMappedFileName (GetCurrentProcess(), <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pMem, <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pszFilename,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MAX_PATH)) <br> &nbsp; &nbsp; &nbsp;{<br><br> &nbsp; &nbsp; &nbsp; &nbsp;// Translate path with device name to drive letters.<br> &nbsp; &nbsp; &nbsp; &nbsp;TCHAR szTemp[BUFSIZE];<br> &nbsp; &nbsp; &nbsp; &nbsp;szTemp[0] = '/0';<br><br> &nbsp; &nbsp; &nbsp; &nbsp;if (GetLogicalDriveStrings(BUFSIZE-1, szTemp)) <br> &nbsp; &nbsp; &nbsp; &nbsp;{<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TCHAR szName[MAX_PATH];<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TCHAR szDrive[3] = TEXT(&quot; :&quot;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;BOOL bFound = FALSE;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TCHAR* p = szTemp;<br><br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;do <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// Copy the drive letter to the template string<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;*szDrive = *p;<br><br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// Look up each device name<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if (QueryDosDevice(szDrive, szName, BUFSIZE))<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;UINT uNameLen = _tcslen(szName);<br><br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if (uNameLen &lt; MAX_PATH) <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bFound = _tcsnicmp(pszFilename, szName, <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;uNameLen) == 0;<br><br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if (bFound) <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// Reconstruct pszFilename using szTemp<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// Replace device path with DOS path<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TCHAR szTempFile[MAX_PATH];<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;_stprintf(szTempFile,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TEXT(&quot;%s%s&quot,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;szDrive,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pszFilename+uNameLen);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;_tcsncpy(pszFilename, szTempFile, MAX_PATH);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br><br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// Go to the next NULL character.<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;while (*p++);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} while (!bFound && *p); // end of string<br> &nbsp; &nbsp; &nbsp; &nbsp;}<br> &nbsp; &nbsp; &nbsp;}<br> &nbsp; &nbsp; &nbsp;bSuccess = TRUE;<br> &nbsp; &nbsp; &nbsp;UnmapViewOfFile(pMem);<br> &nbsp; &nbsp;} <br><br> &nbsp; &nbsp;CloseHandle(hFileMap);<br> &nbsp;}<br> &nbsp;printf(&quot;File name is %s/n&quot;, pszFilename);<br> &nbsp;return(bSuccess);<br>}

你上面的代码就和我的思路一样，我怎么没理解你的问题？[][]

给你翻译了一下，测试通过。<br>function GetFileNameFromHandle(hFile:THandle):String;<br>Const<br> &nbsp; &nbsp;BUFSIZE=512;<br>Var<br> &nbsp; &nbsp;pszFilename:Array[0..BUFSIZE+1] of CHAR;<br> &nbsp; &nbsp;hFileMap:THandle;<br> &nbsp; &nbsp;//dwFileSizeHiWORD;<br> &nbsp; &nbsp;//dwFileSizeLoWORD;<br> &nbsp; &nbsp;pMemointer;<br> &nbsp; &nbsp;szTemp:Array[0..MAX_PATH-1] of CHAR;<br> &nbsp; &nbsp;pChar;<br> &nbsp; &nbsp;Str:String;<br>begin<br> &nbsp; &nbsp;Result:='';<br> &nbsp; &nbsp;FillChar(pszFilename,sizeof(pszFilename),0);<br> &nbsp; &nbsp;hFileMap := CreateFileMapping(hFile,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nil,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PAGE_READONLY,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nil);<br><br> &nbsp; &nbsp;if hFileMap&lt;&gt;INVALID_HANDLE_VALUE then<br> &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp;pMem := MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);<br> &nbsp; &nbsp; &nbsp; &nbsp;if Assigned(pMem) then<br> &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if GetMappedFileName (GetCurrentProcess,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pMem,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pszFilename,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MAX_PATH)&lt;&gt;0 then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Str:=StrPas(pszFileName);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if GetLogicalDriveStrings(BUFSIZE-1, @pszFileName)&lt;&gt;0 then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;p:=@pszFileName;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Repeat<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Inc(p,2);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;p^:=#0;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Dec(p,2);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;FillChar(szTemp,sizeof(szTemp),0);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if QueryDosDevice(p, @szTemp, MAX_PATH)&lt;&gt;0 then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if AnsiPos(szTemp,Str)&lt;&gt;0 then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Result := p+AnsiReplaceStr(Str,szTemp,'');<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Exit;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Inc(p,4);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Until p^=#0;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;UnmapViewOfFile(pMem);<br> &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp;CloseHandle(hFileMap);<br> &nbsp; &nbsp;end;<br>end;

真快，uses psapi, StrUtils

tseug 果然强人,最开始没理解.