如何得到一个文件的大小？

在内核模式的驱动程序中，如何得到一个文件的大小？用什么函数？

这个
ZwQueryInformationFile
ZwQueryInformationFile returns various kinds of information about a given file object.

NTSTATUS
  ZwQueryInformationFile(
    IN HANDLE  FileHandle,
    OUT PIO_STATUS_BLOCK  IoStatusBlock,
    OUT PVOID  FileInformation,
    IN ULONG  Length,
    IN FILE_INFORMATION_CLASS  FileInformationClass
    );
Parameters
FileHandle
Is the handle returned by a successful call to ZwCreateFile.
IoStatusBlock
Pointer to a variable that receives the final completion status and information about the operation.
FileInformation
Pointer to a caller-allocated buffer or variable that receives the desired information about the file. The contents of FileInformation are defined by the FileInformationClass parameter, described later.
Length
Specifies the size in bytes of FileInformation, which the caller should set according to the given FileInformationClass.
FileInformationClass
Specifies the type of information to be returned about the file, in the buffer specified by FileInformation. Device and intermediate drivers, can specify any of the following. FileInformationClass Value Meaning
FileAlignmentInformation Return a FILE_ALIGNMENT_INFORMATION structure. The caller can query this information as long as the file is open, without any particular requirements for DesiredAccess. This information is useful if the file was opened with the CreateOptions FILE_NO_INTERMEDIATE_BUFFERING flag set.
FileAttributeTagInformation Returns a FILE_ATTRIBUTE_TAG_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FileBasicInformation Return a FILE_BASIC_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FileNameInformation Return a FILE_NAME_INFORMATION structure. This might include the full file path or only a portion of the path.
See the comments below for details on the file name syntax.
FileNetworkOpenInformation Return a FILE_NETWORK_OPEN_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FilePositionInformation Return a FILE_POSITION_INFORMATION structure. The caller must have opened the file with the DesiredAccess FILE_READ_DATA or FILE_WRITE_DATA flag set and with either of the CreateOptions FILE_SYNCHRONOUS_IO_ALERT or FILE_SYNCHRONOUS_IO_NONALERT.
FileStandardInformation Return a FILE_STANDARD_INFORMATION structure. The caller can query this information as long as the file is open, without any particular requirements for DesiredAccess.


Return Value
ZwQueryInformationFile returns STATUS_SUCCESS or an appropriate error status. It also returns the number of bytes actually written to the given FileInformation buffer in the Information member of IoStatusBlock.

Headers
Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Comments
ZwQueryInformationFile returns information about the given file. Note that it returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular device or file system.

When FileInformationClass equals FileNameInformation, the file name is returned in the FILE_NAME_INFORMATION structure. The precise syntax of the file name depends on a number of factors:

If the file was opened by submitting a full path and file name to ZwCreateFile, then ZwQueryInformationFile returns that full path and file name.

If the ObjectAttributes->RootDirectory handle was opened by name in a call to ZwCreateFile, and subsequently the file was opened by ZwCreateFile relative to this root directory handle, then the full path and file name are returned.

If the ObjectAttributes->RootDirectory handle was opened by file ID (using the FILE_OPEN_BY_FILE_ID flag) in a call to ZwCreateFile, and subsequently the file was opened by ZwCreateFile relative to this root directory handle, then only the relative path will be returned.

However, if the user has SeChangeNotifyPrivilege (described in Platform SDK documentation), the full path and file name will be returned in all cases.

If only the relative path is returned, the file name string will not begin with a backslash.

If the full path and file name are returned, the string will begin with a single backslash, regardless of its location. Thus the file C:\\dir1\\dir2\\filename.ext will appear as \\dir1\\dir2\\filename.ext, while the file \\\\server\\share\\dir1\\dir2\\filename.ext will appear as \\server\\share\\dir1\\dir2\\filename.ext.

Callers of ZwQueryInformationFile must be running at IRQL = PASSIVE_LEVEL.

FileInformationClass中的哪一个参数是获取文件大小的呢？我怎么没有看到啊！

FileInformationClass中的哪一个参数是获取文件大小的呢？我怎么没有看到啊！

FILE_STANDARD_INFORMATION
The FILE_STANDARD_INFORMATION structure is used as an argument to routines that query or set file information.

typedef struct FILE_STANDARD_INFORMATION {
  LARGE_INTEGER  AllocationSize;
  LARGE_INTEGER  EndOfFile;
  ULONG  NumberOfLinks;
  BOOLEAN  DeletePending;
  BOOLEAN  Directory;
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
Members
AllocationSize
The file allocation size in bytes. Usually, this value is a multiple of the sector or cluster size of the underlying physical device.
EndOfFile
The end of file location as a byte offset.
NumberOfLinks
The number of hard links to the file.
DeletePending
The delete pending status. TRUE indicates that a file deletion has been requested.
Directory
The file directory status. TRUE indicates the file object represents a directory.
Headers
Defined in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Comments
EndOfFile specifies the byte offset to the end of the file. Because this value is zero-based, it actually refers to the first free byte in the file; that is, it is the offset to the byte immediately following the last valid byte in the file.

EndOfFile就是啦

谢谢bmyyyud，解决了我的问题。

那就给分吧！