200分求助-关于文件句柄 ( 积分: 200 )

各位大侠：
我现在已经用ZwQuerySystemInformation得到了我需要的文件句柄，但是如何根据文件句柄获得文件的路径呢？听说要用驱动从windows内核中读取句柄的FILE_OBJECT属性，但是如何来做呢？请大家指点。

BOOL GetFileNameFromHandle(HANDLE hFile)
{
BOOL bSuccess = FALSE;
TCHAR pszFilename[MAX_PATH+1];

// Get the file size.
DWORD dwFileSizeHi = 0;
DWORD dwFileSizeLo = GetFileSize(hFile, &dwFileSizeHi);

// Create a file mapping object.
HANDLE hFileMap = CreateFileMapping(hFile,
NULL,
PAGE_READONLY,
0,
dwFileSizeLo,
NULL);

if (hFileMap)
{
// Create a file mapping to get the file name.
void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);

if (pMem)
{
if (GetMappedFileName (GetCurrentProcess(),
pMem,
pszFilename,
MAX_PATH))
{

// Translate path with device name to drive letters.
TCHAR szTemp[BUFSIZE];
szTemp[0] = '/0';

if (GetLogicalDriveStrings(BUFSIZE-1, szTemp))
{
TCHAR szName[MAX_PATH];
TCHAR szDrive[3] = TEXT(" :"
BOOL bFound = FALSE;
TCHAR* p = szTemp;

do
{
// Copy the drive letter to the template string
*szDrive = *p;

// Look up each device name
if (QueryDosDevice(szDrive, szName, BUFSIZE))
{
UINT uNameLen = _tcslen(szName);

if (uNameLen < MAX_PATH)
{
bFound = _tcsnicmp(pszFilename, szName,
uNameLen) == 0;

if (bFound)
{
// Reconstruct pszFilename using szTemp
// Replace device path with DOS path
TCHAR szTempFile[MAX_PATH];
_stprintf(szTempFile,
TEXT("%s%s&quot,
szDrive,
pszFilename+uNameLen);
_tcsncpy(pszFilename, szTempFile, MAX_PATH);
}
}
}

// Go to the next NULL character.
while (*p++);
} while (!bFound && *p); // end of string
}
}
bSuccess = TRUE;
UnmapViewOfFile(pMem);
}

CloseHandle(hFileMap);
}
printf("File name is %s/n", pszFilename);
return(bSuccess);
}
似乎可行，你试试看

不好意思，小弟对delphi尚不太熟，其它语言都没有接触过啊