首页
社区
课程
招聘
[求助]如何通过文件句柄得到文件路径?
发表于: 2008-1-5 19:15 10495

[求助]如何通过文件句柄得到文件路径?

2008-1-5 19:15
10495
初学HOOK挂钩,尝试挂钩WriteFile函数,以下是该函数原形
function WriteFile(hFile: THandle; const Buffer; nNumberOfBytesToWrite: DWORD; var lpNumberOfBytesWritten: DWORD; lpOverlapped: POverlapped): BOOL; stdcall;
如何通过文件句柄hFile得到文件路径?Delphi语言实现...

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (4)
雪    币: 398
活跃值: (343)
能力值: (RANK:650 )
在线值:
发帖
回帖
粉丝
2
我只会这样

#include <windows.h>
#pragma comment(lib, "ntdll.lib")
#pragma comment(linker, "/subsystem:windows")
#pragma comment(linker, "/entry:start")
#pragma comment(linker, "/filealign:0x200")


typedef struct _IO_STATUS_BLOCK
{
    LONG Status;
    LONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef struct _FILE_NAME_INFORMATION
{
	ULONG FileNameLength;
	WCHAR FileName[MAX_PATH];
} FILE_NAME_INFORMATION;

__declspec(dllimport) LONG __stdcall ZwQueryInformationFile(
IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG FileInformationLength,
IN ULONG FileInformationClass
);


void start()
{
	char	szFileName[MAX_PATH];
	HANDLE	hFile;
	IO_STATUS_BLOCK	isb;
	FILE_NAME_INFORMATION fni;
	


	GetModuleFileName(NULL, szFileName, MAX_PATH);
	hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile != (HANDLE)-1)
	{
		if (ZwQueryInformationFile(hFile, &isb, &fni, sizeof(fni), 9) == 0)
		{
			fni.FileName[fni.FileNameLength/2] = 0;
			MessageBoxW(0, fni.FileName, L"hFile", 0);

		}
		CloseHandle(hFile);

	}
	ExitProcess(0);
}


我感觉应该从取得对象信息来弄这块会好一些
上传的附件:
2008-1-5 20:00
0
雪    币: 66
活跃值: (16)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
3
俺也是ZwQueryInformationFile
2008-1-5 20:42
0
雪    币: 101
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
GetFileInformationByHandle函数可以得到文件的相关信息,不过得不到文件的路径.
还有楼上的代码是C的,看不懂.哪位大牛帮忙翻译一下?
2008-1-6 19:19
0
雪    币: 325
活跃值: (97)
能力值: ( LV13,RANK:530 )
在线值:
发帖
回帖
粉丝
5
GetFileInformationByHandleEx Function

Retrieves file information for the specified file.

BOOL WINAPI GetFileInformationByHandleEx(
  __in          HANDLE hFile,
  __in          FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
  __out         LPVOID lpFileInformation,
  __in          DWORD dwBufferSize
);

Parameters
hFile
A handle to the file.

This handle should not be a pipe handle. The GetFileInformationByHandleEx function does not work with pipe handles.

FileInformationClass
The type of information to be returned to the calling application. For a list of values, see FILE_INFO_BY_HANDLE_CLASS.

lpFileInformation
A pointer to the buffer that receives the requested file information. The structure that is returned corresponds to the class that is specified by FileInformationClass.

FileInformationClass FileInformation structure returned
FileBasicInfo  FILE_BASIC_INFO
FileStandardInfo FILE_STANDARD_INFO
FileNameInfo FILE_NAME_INFO
FileStreamInfo FILE_STREAM_INFO
FileCompressionInfo FILE_COMPRESSION_INFO
FileAttributeTagInfo FILE_ATTRIBUTE_TAG_INFO
FileIdBothDirectoryInfo FILE_ID_BOTH_DIR_INFO
FileIdBothDirectoryRestartInfo FILE_ID_BOTH_DIR_INFO

dwBufferSize
The size of the lpFileInformation buffer, in bytes.

Return Value
If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks
If FileInformationClass is FileStreamInfo and the calls succeed but no streams are returned, the error that is returned by GetLastError is ERROR_HANDLE_EOF.

Certain file information classes behave slightly differently on different operating system releases. These classes are supported by the underlying drivers, and any information they return is subject to change between operating system releases.

This function is declared in Fileextd.h and implemented in Fileextd.lib; both are available for download at MSDN on the Win32 FileID API Library page.

Transacted Operations
If there is a transaction bound to the thread at the time of the call, then the function returns the compressed file size of the isolated file view.

Requirements

这个函数貌似可以返回。。 只是我感觉你的SDK 里面没有的可能性极大。
2008-1-6 19:50
0
游客
登录 | 注册 方可回帖
返回
//