通过句柄查询文件名或设备名

BOOL CKlAntiApiCall::GetFileNameFromHandle(HANDLE hFile,TCHAR * pszFilename) 
 {
  BOOL bSuccess=FALSE;
  POBJECT_NAME_INFORMATION oni = NULL;
  oni= (POBJECT_NAME_INFORMATION) new WCHAR[256];
  if(oni)
  {
   ULONG rt=0;
   
   HMODULE hModule=LoadLibrary(_T("ntdll.dll"));
   if( !hModule)
   {
     delete [](WCHAR *)oni;
    return FALSE;
   }
  m_PZwQueryObject=(P_ZWQUERYOBJECT)GetProcAddress(hModule,"ZwQueryObject");
   if(m_PZwQueryObject)
   {
  
    NTSTATUS status = m_PZwQueryObject(hFile,
     ObjectNameInformation,
     oni,
     256*sizeof(WCHAR),
     &rt);
    if(NT_SUCCESS(status))
    {
     RtlCopyMemory(pszFilename,oni->Name.Buffer,oni->Name.Length);
     bSuccess =TRUE;
    }
   
     }
  delete [](WCHAR *)oni;
  FreeLibrary(hModule);
  }

  
 
  return(bSuccess);
 }