ZwQueryInformationFile 函数
The ZwQueryInformationFile routine returns various kinds of information about a given file object.

NTSTATUS
  ZwQueryInformationFile(
    IN HANDLE  FileHandle,
    OUT PIO_STATUS_BLOCK  IoStatusBlock,
    OUT PVOID  FileInformation,
    IN ULONG  Length,
    IN FILE_INFORMATION_CLASS  FileInformationClass
    );
Parameters
FileHandle
Handle to a file object. The handle is created by a successful call to ZwCreateFile or ZwOpenFile.
IoStatusBlock
Pointer to a variable that receives the final completion status and information about the operation.
FileInformation
Pointer to a caller-allocated buffer or variable that receives the desired information about the file. The contents of FileInformation are defined by the FileInformationClass parameter, described later.
Length
Specifies the size in bytes of FileInformation, which the caller should set according to the given FileInformationClass.
FileInformationClass
Specifies the type of information to be returned about the file, in the buffer specified by FileInformation. Device and intermediate drivers, can specify any of the following. FileInformationClass Value Meaning
FileAlignmentInformation Return a FILE_ALIGNMENT_INFORMATION structure. The caller can query this information as long as the file is open, without any particular requirements for DesiredAccess. This information is useful if the file was opened with the CreateOptions FILE_NO_INTERMEDIATE_BUFFERING flag set.
FileAttributeTagInformation Returns a FILE_ATTRIBUTE_TAG_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FileBasicInformation Return a FILE_BASIC_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FileNameInformation Return a FILE_NAME_INFORMATION structure. This might include the full file path or only a portion of the path.
See the comments below for details on the file name syntax.
FileNetworkOpenInformation Return a FILE_NETWORK_OPEN_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FilePositionInformation Return a FILE_POSITION_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_DATA or FILE_WRITE_DATA flag set and with either of the CreateOptions FILE_SYNCHRONOUS_IO_ALERT or FILE_SYNCHRONOUS_IO_NONALERT.
FileStandardInformation Return a FILE_STANDARD_INFORMATION structure. The caller can query this information as long as the file is open, without any particular requirements for DesiredAccess.

Return Value
ZwQueryInformationFile returns STATUS_SUCCESS or an appropriate error status. It also returns the number of bytes actually written to the given FileInformation buffer in the Information member of IoStatusBlock.

Headers
Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Comments
ZwQueryInformationFile returns information about the given file. Note that it returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular device or file system.

When FileInformationClass equals FileNameInformation, the file name is returned in the FILE_NAME_INFORMATION structure. The precise syntax of the file name depends on a number of factors:

If the file was opened by submitting a full path and file name to ZwCreateFile, then ZwQueryInformationFile returns that full path and file name.

If the ObjectAttributes->RootDirectory handle was opened by name in a call to ZwCreateFile, and subsequently the file was opened by ZwCreateFile relative to this root directory handle, then the full path and file name are returned.

If the ObjectAttributes->RootDirectory handle was opened by file ID (using the FILE_OPEN_BY_FILE_ID flag) in a call to ZwCreateFile, and subsequently the file was opened by ZwCreateFile relative to this root directory handle, then only the relative path will be returned.

However, if the user has SeChangeNotifyPrivilege (described in Platform SDK documentation), the full path and file name will be returned in all cases.

If only the relative path is returned, the file name string will not begin with a backslash.

If the full path and file name are returned, the string will begin with a single backslash, regardless of its location. Thus the file C:/dir1/dir2/filename.ext will appear as /dir1/dir2/filename.ext, while the file //server/share/dir1/dir2/filename.ext will appear as /server/share/dir1/dir2/filename.ext.

Callers of ZwQueryInformationFile must be running at IRQL = PASSIVE_LEVEL.

See Also
FILE_ALIGNMENT_INFORMATION, FILE_ATTRIBUTE_TAG_INFORMATION, FILE_BASIC_INFORMATION, FILE_NAME_INFORMATION, FILE_NETWORK_OPEN_INFORMATION, FILE_POSITION_INFORMATION, FILE_STANDARD_INFORMATION, ZwCreateFile, ZwSetInformationFile

Built on Friday, April 11, 2003 

来源:http://www.osronline.com/DDKx/kmarch/k111_9pyq.htm