S
sadnui
Unregistered / Unconfirmed
GUEST, unregistred user!
#include <windows.h>
#pragma comment(lib, "ntdll.lib")
#pragma comment(linker, "/subsystem:windows")
#pragma comment(linker, "/entry:start")
#pragma comment(linker, "/filealign:0x200")
typedef struct _IO_STATUS_BLOCK
{
LONG Status;
LONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
typedef struct _FILE_NAME_INFORMATION
{
ULONG FileNameLength;
WCHAR FileName[MAX_PATH];
} FILE_NAME_INFORMATION;
__declspec(dllimport) LONG __stdcall ZwQueryInformationFile(
IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG FileInformationLength,
IN ULONG FileInformationClass
);
void start()
{
char szFileName[MAX_PATH];
HANDLE hFile;
IO_STATUS_BLOCK isb;
FILE_NAME_INFORMATION fni;
GetModuleFileName(NULL, szFileName, MAX_PATH);
hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile != (HANDLE)-1)
{
if (ZwQueryInformationFile(hFile, &isb, &fni, sizeof(fni), 9) == 0)
{
fni.FileName[fni.FileNameLength/2] = 0;
MessageBoxW(0, fni.FileName, L"hFile", 0);
}
CloseHandle(hFile);
}
ExitProcess(0);
}
这个是能从文件句柄返回文件名的代码。
我自己测试翻译了一份确总不能正确执行
还请高手们帮忙分析一下
(代码来自看雪论坛)
#pragma comment(lib, "ntdll.lib")
#pragma comment(linker, "/subsystem:windows")
#pragma comment(linker, "/entry:start")
#pragma comment(linker, "/filealign:0x200")
typedef struct _IO_STATUS_BLOCK
{
LONG Status;
LONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
typedef struct _FILE_NAME_INFORMATION
{
ULONG FileNameLength;
WCHAR FileName[MAX_PATH];
} FILE_NAME_INFORMATION;
__declspec(dllimport) LONG __stdcall ZwQueryInformationFile(
IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG FileInformationLength,
IN ULONG FileInformationClass
);
void start()
{
char szFileName[MAX_PATH];
HANDLE hFile;
IO_STATUS_BLOCK isb;
FILE_NAME_INFORMATION fni;
GetModuleFileName(NULL, szFileName, MAX_PATH);
hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile != (HANDLE)-1)
{
if (ZwQueryInformationFile(hFile, &isb, &fni, sizeof(fni), 9) == 0)
{
fni.FileName[fni.FileNameLength/2] = 0;
MessageBoxW(0, fni.FileName, L"hFile", 0);
}
CloseHandle(hFile);
}
ExitProcess(0);
}
这个是能从文件句柄返回文件名的代码。
我自己测试翻译了一份确总不能正确执行
还请高手们帮忙分析一下
(代码来自看雪论坛)