在驱动下面如何得到一个文件的大小?

在驱动下面如何得到一个文件的大小?
  
好像用ZwQueryInformationFile()只能得到AllocationSize，
  
例如我一个34字节的文件，而allocationsize.QuadPart=2048.

//IFW_GetFileSize
//
ULONG IFW_GetFileSize(PUCHAR pProcessName)
{
NTSTATUS status;
OBJECT_ATTRIBUTES oa;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;              //  the output from this process
FILE_STANDARD_INFORMATION si;
ULONG FileLength;
ANSI_STRING ansiPathName;
UNICODE_STRING uniPathName;
UCHAR TempPathName[255];

//Combile the PathName
//
RtlZeroMemory(TempPathName,255);
strcpy(TempPathName,\"\\\\??\\\\\");
strcat(TempPathName,pProcessName);
ansiPathName.Buffer=(PUCHAR)TempPathName;
ansiPathName.Length=(USHORT)strlen((PUCHAR)TempPathName);
ansiPathName.MaximumLength=(USHORT)strlen((PUCHAR)TempPathName);
status=RtlAnsiStringToUnicodeString(&uniPathName,&ansiPathName,TRUE);
if(!NT_SUCCESS(status))
{
return 0;
}

InitializeObjectAttributes(
&oa,
&uniPathName,//PUNICODE_STRING
OBJ_CASE_INSENSITIVE,
NULL,
NULL);

status = ZwCreateFile(&hfile,
 GENERIC_READ,
 &oa,
 &iostatus,
 NULL,
 FILE_ATTRIBUTE_NORMAL,
 FILE_SHARE_READ,
 FILE_OPEN,
 FILE_SYNCHRONOUS_IO_NONALERT,
 NULL,
 0);
if(NT_SUCCESS(status))
{
ZwQueryInformationFile(hfile, &iostatus, &si, sizeof(si), FileStandardInformation);
FileLength = si.EndOfFile.LowPart;
RtlFreeUnicodeString(&uniPathName);
ZwClose(hfile);
return FileLength;
}
else
{
RtlFreeUnicodeString(&uniPathName);
return 0;
}
}

放在这里EndOfFile.QuadPart

最后参考：ifs kit for xp sp1:irpmain.pdf,你有想要的。

这是从我一个PROJ中扣出来的代码. 看思路巴.

PIRP Irp = 0;
PDEVICE_OBJECT TargetFs = 0;
PKEVENT CompleteEvent = (PKEVENT)ExAllocateFromNPagedLookasideList(&GlobalVar.EventPool); //KEVENT size is 12 bytes,
PIO_STACK_LOCATION IrpSp = 0;
PFILE_OBJECT fobj;
IO_STATUS_BLOCK IoStatusBlock = {0};
FILE_STANDARD_INFORMATION fsi = {0};

//build irp
fobj = pFobj;
TargetFs = IoGetRelatedDeviceObject(fobj);
Irp = IoAllocateIrp(TargetFs->StackSize,0);
if (!Irp)
{
IoStatusBlock.Status = STATUS_INSUFFICIENT_RESOURCES;
IoStatusBlock.Information = 0;
//KdPrint((\"SecuDisk: STATUS_INSUFFICIENT_RESOURCES when build fast QUERY IRP\\n\"));
return 0;
}
KeInitializeEvent(CompleteEvent,NotificationEvent,0);
IrpSp = IoGetNextIrpStackLocation(Irp);
IrpSp->DeviceObject = TargetFs;
Irp->Flags = 0;
Irp->AssociatedIrp.SystemBuffer = &fsi;
Irp->MdlAddress = 0;
Irp->UserBuffer = 0;
Irp->UserIosb = &IoStatusBlock;
Irp->UserEvent = CompleteEvent;
Irp->Tail.Overlay.Thread = PsGetCurrentThread();
Irp->Tail.Overlay.OriginalFileObject= fobj;
Irp->RequestorMode = KernelMode;
IrpSp->FileObject = fobj;
IrpSp->MajorFunction = IRP_MJ_QUERY_INFORMATION;
IrpSp->MinorFunction = 0;
IrpSp->Parameters.QueryFile.FileInformationClass = FileStandardInformation;
IrpSp->Parameters.QueryFile.Length = sizeof(fsi);
IoSetCompletionRoutine(Irp, FileOpCompletion, 0, TRUE, TRUE, TRUE);
//KdPrint((\"Call device %x for file size \\n\",TargetFs));
IoCallDriver(TargetFs,Irp);
KeWaitForSingleObject(CompleteEvent, Executive, KernelMode, TRUE, 0);
IoFreeIrp(Irp);
ExFreeToNPagedLookasideList(&GlobalVar.EventPool,CompleteEvent);
return fsi.EndOfFile.QuadPart;

楼上那位说的对啊。
AllocationSize表示这个文件在硬盘上占有多大的空间，应该和你的磁盘的簇（分配单元）的大小是有关，因为你的文件很小，所以AllocationSize就为一个簇的大小。

在驱动下面如何得到一个文件的大小?
  
好像用ZwQueryInformationFile()只能得到AllocationSize，
  
例如我一个34字节的文件，而allocationsize.QuadPart=2048.

 

除了AllocationSize之外那个结构里面还有一个成员叫做EndOfFile。