ObjectAttributes->RootDirectory  判断是否为 NULL
获取路径
NTSTATUS GetFullFilePath(IN HANDLE Handle = ObjectAttributes->RootDirectory, IN OUT PUNICODE_STRING pFilePath)
{
    NTSTATUS status;
    PVOID pObj;
    ULONG BufLength;
    ULONG i;
    POBJECT_NAME_INFORMATION pTmpStr;
   
    status = ObReferenceObjectByHandle(Handle, 0, NULL, KernelMode, &pObj, NULL );
    if (!NT_SUCCESS(status)) {
        return status;
    }
    BufLength = pFilePath->MaximumLength+sizeof(UNICODE_STRING);
    if (BufLength < 1024) {
        BufLength = 1024;
    }
    pTmpStr = (POBJECT_NAME_INFORMATION)ExAllocatePoolWithTag(PagedPool, BufLength, FILETAG);
    if (pTmpStr == NULL) {
        ObDereferenceObject(pObj);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    memset(pTmpStr, 0, BufLength);
    i = BufLength;
    status = ObQueryNameString(pObj, pTmpStr, i, &BufLength);
    ObDereferenceObject(pObj);
    if (NT_SUCCESS(status)) {
        RtlCopyUnicodeString(pFilePath, &(pTmpStr->Name));
    }
    ExFreePoolWithTag(pTmpStr, FILETAG);
    return status;
}

否则就从 ObjectAttributes->ObjectName 中得到

我试试你给的代码哈，谢谢你。