能力值:
( LV11,RANK:190 )
在线值:
2 楼
POBJECT_NAME_INFORMATION oni = NULL;
oni= (POBJECT_NAME_INFORMATION)malloc(256*sizeof(WCHAR));
status = ZwQueryObject(hFile,
ObjectNameInformation,
oni,
256*sizeof(WCHAR),
&rt);
WCHAR obj_name[256] = {0};
RtlCopyMemory(obj_name,oni->Name.Buffer,oni->Name.Length);
printf("%S\n",obj_name);
------------------------------------
\Device\Harddisk0\DR0
能力值:
( LV9,RANK:210 )
3 楼
呵呵,谢谢指教了,内存分配错误导致执行失败!现在修正了,感谢哦!
type
PUNICODE_STRING = ^UNICODE_STRING;
_UNICODE_STRING = record
Length: Word;
MaximumLength: Word;
Buffer: PWideChar;
end;
UNICODE_STRING = _UNICODE_STRING;
PCUNICODE_STRING = ^UNICODE_STRING;
TUnicodeString = UNICODE_STRING;
PUnicodeString = PUNICODE_STRING; type
_OBJECT_NAME_INFORMATION = record
Name: UNICODE_STRING;
end;
OBJECT_NAME_INFORMATION = _OBJECT_NAME_INFORMATION;
POBJECT_NAME_INFORMATION = ^OBJECT_NAME_INFORMATION;
TObjectNameInformation = OBJECT_NAME_INFORMATION;
PObjectNameInformation = ^OBJECT_NAME_INFORMATION;
type
_OBJECT_INFORMATION_CLASS = (
ObjectBasicInformation,
ObjectNameInformation,
ObjectTypeInformation,
ObjectAllTypesInformation,
ObjectHandleInformation);
OBJECT_INFORMATION_CLASS = _OBJECT_INFORMATION_CLASS;
TObjectInformationClass = OBJECT_INFORMATION_CLASS;
function ZwQueryObject(ObjectHandle: THANDLE; ObjectInformationClass: OBJECT_INFORMATION_CLASS; ObjectInformation: Pointer; ObjectInformationLength: ULONG; ReturnLength: PULONG): DWORD; stdcall; external 'ntdll.dll';
function GetNameByHandle(hFile: THANDLE):string;
var
st,rt:dword;
fsi:POBJECT_NAME_INFORMATION;
begin
result := '';
fsi:=GetMemory(256*2);
st:=ZwQueryObject(
hFile,
ObjectNameInformation,
fsi,
256*2,
@rt
);
if st=0 then Result:=fsi.Name.Buffer;
FreeMemory(fsi);
end;