多谢5楼!同时这两天看了看sysinternal的FileMon和RegMon,颇有收获!
本问题,从FILE_OBJECT到该文件的完整路径的方法,我个人总结如下:
代码:
//相关变量
HANDLE filehandle=0;
PFILE_OBJECT file=0;
PFILE_OBJECT relatedfile=0;
POBJECT_HANDLE_INFORMATION info=0;
char filefullname_c[1024];
ANSI_STRING filefullname_a;
UNICODE_STRING filefullname_u;
int relatedfilelength;
POBJECT_NAME_INFORMATION fileNameInformation;
ULONG retSize;
//先得到盘符
RtlVolumeDeviceToDosName(file->DeviceObject,&filefullname_u);
RtlUnicodeStringToAnsiString(&filefullname_a,&filefullname_u,1);
strncpy(filefullname_c,filefullname_a.Buffer,filefullname_a.Length);
filefullname_c[filefullname_a.Length]='\0';
relatedfilelength=filefullname_a.Length;
//相对路径
relatedfile=file->RelatedFileObject;
RtlUnicodeStringToAnsiString(&filefullname_a,&relatedfile->FileName,1);
strncat(filefullname_c,filefullname_a.Buffer,filefullname_a.Length);
filefullname_c[relatedfilelength+filefullname_a.Length]='\0';
relatedfilelength+=filefullname_a.Length;
//文件名
RtlUnicodeStringToAnsiString(&filefullname_a,&file->FileName,1);
strcat(filefullname_c,"\\");
strncat(filefullname_c,filefullname_a.Buffer,filefullname_a.Length);
filefullname_c[relatedfilelength+filefullname_a.Length+1]='\0';
最终的文件路径就放在:filefullname_c