|
ZwQueryInformationFile得到的是文件设备名称,转换一下前面的部分就可以了。
- NTSTATUS FileDeviceNameToDosName(
- IN PUNICODE_STRING pusDeviceFileName,
- OUT PWSTR buf OPTIONAL,
- IN ULONG ulBufSize OPTIONAL,
- OUT PULONG pulSize OPTIONAL)
- {
- NTSTATUS s = STATUS_SUCCESS;
- UNICODE_STRING usDrive;
- WCHAR szDrive[] = L"\\DosDevices\\A:";
- OBJECT_ATTRIBUTES oa;
- HANDLE hLink = NULL;
- BOOLEAN bSucceeded = FALSE;
- RtlInitUnicodeString(&usDrive, szDrive);
- for (szDrive[12] = L'A'; szDrive[12] <= L'Z'; ++szDrive[12])
- {
- WCHAR szName[MAX_PATH];
- UNICODE_STRING usName;
- ULONG cbSize;
- // 获取DOS盘符的符号链接对象
- InitializeObjectAttributes(&oa, &usDrive, OBJ_CASE_INSENSITIVE, NULL, NULL);
- s = ZwOpenSymbolicLinkObject(&hLink, SYMBOLIC_LINK_QUERY, &oa);
- if (!NT_SUCCESS(s))
- continue;
- // 查询符号链接对象对应的名称
- usName.Buffer = szName;
- usName.Length = 0;
- usName.MaximumLength = sizeof(szName);
- s = ZwQuerySymbolicLinkObject(hLink, &usName, &cbSize);
- if (NT_SUCCESS(s))
- {
- ULONG ulCnt = usName.Length / sizeof (WCHAR);
- if (0 == _wcsnicmp(pusDeviceFileName->Buffer, usName.Buffer, ulCnt)
- && L'\\' == pusDeviceFileName->Buffer[ulCnt])
- {
- // 找到!
- ULONG ulSizeNeeded = 2 + pusDeviceFileName->Length / sizeof(WCHAR) - ulCnt;
- if (ARGUMENT_PRESENT(pulSize))
- *pulSize = ulSizeNeeded;
- bSucceeded = TRUE;
- if (NULL == buf || 0 == ulBufSize)
- {
- s = STATUS_BUFFER_TOO_SMALL;
- }
- else
- {
- wcscpy(buf, &usDrive.Buffer[12]);
- wcsncat(buf, pusDeviceFileName->Buffer + ulCnt,
- ulBufSize / sizeof(WCHAR) - 2);
- }
- }
- }
- NtClose(hLink);
- hLink = NULL;
- if (bSucceeded)
- break;
- }
- if (!bSucceeded)
- s = STATUS_UNSUCCESSFUL;
- return s;
- }
复制代码 |
|