还是老问题:打开文件成功,也能取得文件长度,就是ZwReadFile取不到文件内容?

打开文件成功,也能取得文件长度,就是ZwReadFile的时候取不到内容,头都快大了!

WCHAR filename[] = L\"\\\\??\\\\e:\\\\filelist.dat\";

    RtlInitUnicodeString( &fileNameUnicodeString, filename );
    InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,
                                OBJ_CASE_INSENSITIVE, NULL, NULL );
AllocationSize = NULL;
    ntStatus = ZwCreateFile( &ntFileHandle,
SYNCHRONIZE | FILE_READ_DATA,
&objectAttributes,
&ioStatus,
AllocationSize,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_SEQUENTIAL_ONLY | FILE_NO_INTERMEDIATE_BUFFERING,
NULL,
0 );

    if( !NT_SUCCESS( ntStatus ) )
{

        DbgPrint(\"file :Could not open file\");
        return ;
    }

ntStatus = ZwQueryInformationFile( ntFileHandle,
 &ioStatus,
 &StandardInfo,
 sizeof(FILE_STANDARD_INFORMATION),
 FileStandardInformation );


    if( !NT_SUCCESS( ntStatus ) )
{
DbgPrint (\"Error querying info on file %x\\n\", ntStatus );
ZwClose( ntFileHandle );
return ;
}
DbgPrint( \"File length is  %d\\n\", StandardInfo.EndOfFile.QuadPart);

//创建存放文件内容的缓冲区
byteoffset.QuadPart =0;
ntStatus = ZwReadFile( ntFileHandle,
 NULL,
 NULL,
 NULL,
 &IoFileReadStatus,
 pBuffer,
 7,//StandardInfo.EndOfFile.QuadPart,
 &byteoffset,
 NULL );

    if( !NT_SUCCESS( ntStatus ) )
{
DbgPrint( \"ZwReadFile Error!!\\n\");
return ;
}

DbgPrint(\"Status returned from ZwReadFile  says we just read: 0x%d bytes.\\n\", IoFileReadStatus.Information);

DbgPrint( \"File:%s \\n\", pBuffer);

因为有了FILE_NO_INTERMEDIATE_BUFFERING,因为没有中间缓存,所以所有操作都要512*N
所以
ntStatus = ZwReadFile( ntFileHandle,
NULL,
NULL,
NULL,
&IoFileReadStatus,
pBuffer,
512,//StandardInfo.EndOfFile.QuadPart,(至少要512)
&byteoffset,
NULL );