挂钩ZwOpenFile中怎样得到文件的全路经？（附代码）

在hook_ZwOpenFile中怎么样得到文件的全路经？我用了ObReferenceObjectByHandle
ObQueryNameString的经典方法，一般情况还可以，但是进到dos的控制台时候，出现了8.3文件名，这样我的识别规则就失效了，怎么处理啊？


我的代码如下：

NTSTATUS my_ZwOpenFile (
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG ShareAccess,
IN ULONG OpenOptions
)
{
int rc;
char ParentDirectory[1024];
PUNICODE_STRING Parent=NULL;
int BytesReturned;

ParentDirectory[0]='\0';
if (ObjectAttributes->RootDirectory!=0)
{
PVOID Object;
Parent=(PUNICODE_STRING)ParentDirectory;
rc=ObReferenceObjectByHandle(myFileHandle,0,0,KernelMode,
&Object,NULL);
if (rc==STATUS_SUCCESS)
{
rc=ObQueryNameString(Object,(PUNICODE_STRING)ParentDirectory,sizeof(ParentDirectory),&BytesReturned);
ObDereferenceObject(Object);
if (rc!=STATUS_SUCCESS)
{
RtlInitUnicodeString(Parent,L"Unknown\\");
}
}
else{
RtlInitUnicodeString(Parent,L"Unknown\\");
}
}
DbgPrint("ZwOpenFile : Filename = %S%S%S\n",Parent?Parent->Buffer:L"",
Parent?L"\\":L"", ObjectAttributes->ObjectName->Buffer);

rc = Real_ZwOpenFile (FileHandle, DesiredAccess, ObjectAttributes,
IoStatusBlock, ShareAccess, OpenOptions);
DbgPrint("ZwOpenFile : rc = %x\n", rc);
return rc;
}

看看OBJECT_ATTRIBUTES结构就知道了

代码没有贴全吧！

ParentDirectory[0]='\0';
if (ObjectAttributes->RootDirectory!=0)
{
PVOID Object;
Parent=(PUNICODE_STRING)ParentDirectory;

rc=ObReferenceObjectByHandle(myFileHandle,0,0,KernelMode,
&Object,NULL);
if (rc==STATUS_SUCCESS)
{
rc=ObQueryNameString(Object,(PUNICODE_STRING)ParentDirectory,sizeof(ParentDirectory),&BytesReturned);
ObDereferenceObject(Object);
if (rc!=STATUS_SUCCESS)
{
RtlInitUnicodeString(Parent,L"Unknown\\");
}
}
else{
RtlInitUnicodeString(Parent,L"Unknown\\");
}
}
DbgPrint("ZwOpenFile : Filename = %S%S%S\n",Parent?Parent->Buffer:L"",
Parent?L"\\":L"", ObjectAttributes->ObjectName->Buffer);

rc = Real_ZwOpenFile (FileHandle, DesiredAccess, ObjectAttributes,
IoStatusBlock, ShareAccess, OpenOptions);
DbgPrint("ZwOpenFile : rc = %x\n", rc);
return rc;
}