Distributive file : "Win32 FileID APIs 1.1.EXE"
Function : 'GetFileInformationByHandleEx ()'
Requested : 'GetFileInformationByHandleEx (file_handle, FileNameInfo, buffer, BUFFER_SIZE);'
After function request, in the buffer I have file name,
but seems the function truncate 4 bytes of it's beginning,
perhaps because it put file name not in the 'FILE_NAME_INFO.FileName',
but exactly where points my 'buffer',
and then overwrites first 4 bytes of it
(in 'FILE_NAME_INFO.FileNameLength', where it (the length) is intended to be)
with the value of string bytes in the truncated file name.
So I got {0x00000036, "\WINDOWS\System32\ntdll.dll"},
instead of {0x0000003a, "C:\WINDOWS\System32\ntdll.dll"} (in Unicode).
*'buffer' and 'BUFFER_SIZE' has been aligned by 8 bytes boundary,
and I hope that the linker doesn't doing any realignment.
Tested on the MSVC 2003 and 6.0, on Windows XP SP2.
*by the way, maybe you will be so nice, and try to compile "Fileextd.lib",
that it could be possible to use in the MSVC 6.0,
cause I am getting "LNK1103: debugging information corrupt; recompile module" link error,
and can't debug then in C mode, only in Disassembly.
I will do teporary a hack in my program (replace first two symbols to "C:"),
but hope you will repair it soon :)
have a problem with the 'GetFileInformationByHandleEx ()' function
Javfarary
Oook, I see - exactly the same results are given by these functions too :
'NtQueryInformationFile ()'
'ZwQueryInformationFile ()'
so - it is not "Fileextd.lib" problem (or it is ).
'GetMappedFileName ()' returns what had returned 'NtQueryVirtualMemory ()',
or 'ZwQueryVirtualMemory ()'
"\Device\HarddiskVolume1\Windows\System32\ntdll.dll"
"\Device\HarddiskVolume1", - it is device name, instead of "C:",
and workaround about that, is again - long work
look 'GetFileNameFromHandle ()' example :
http://windowssdk.msdn.microsoft.com/en-us/library/ms687138.aspx
It have : 'CreateFileMapping ()', then 'MapViewOfFile ()', then 'GetMappedFileName ()',
then 'GetLogicalDriveStrings ()', then 'while () {}' loop including 'QueryDosDevice ()' inside,
and then - string reconcatenation.
For whom can I show my code then, if I will include that "Microsoft recommended" stuff ( ).
I will try to do some library with that FileHandle->FileName finction.
But not sure about resulting quality of that (is hard to find manuals about ntoskrnl.dll).
p.s.
I remember, I had that problem a year ago, but avoid it, by using .exe filename from the source,
but now met it again - because for the dlls (which are loaded by that .exe) I have no source names.
So - it isn't these days problem.