OBJECT_ATTRIBUTES oa;
FILE_NETWORK_OPEN_INFORMATION fnoi;
UNICODE_STRING strPath = RTL_CONSTANT_STRING(L"\\??\\E:\\安装软件\\win7旗舰版.iso");
LARGE_INTEGER li_temp;
char strTime[ArrayLength] = {0};
ANSI_STRING as;
TIME_FIELDS tf;
InitializeObjectAttributes(&oa, &strPath, OBJ_KERNEL_HANDLE, NULL, NULL);
ZwQueryFullAttributesFile(&oa, &fnoi);
ExSystemTimeToLocalTime(&fnoi.CreationTime, &li_temp);
RtlTimeToTimeFields(&li_temp, &tf);
RtlInitEmptyAnsiString(&as, strTime, ArrayLength);
RtlStringCbPrintfA(as.Buffer, ArrayLength, "%d-%d-%d %d:%d:%d\n", tf.Year, tf.Month, tf.Day, tf.Hour, tf.Minute, tf.Second);
KdPrint(("创建时间:%s\n", as.Buffer));
ExSystemTimeToLocalTime(&fnoi.LastWriteTime, &li_temp);
RtlTimeToTimeFields(&li_temp, &tf);
RtlInitEmptyAnsiString(&as, strTime, ArrayLength);
RtlStringCbPrintfA(as.Buffer, ArrayLength, "%d-%d-%d %d:%d:%d\n", tf.Year, tf.Month, tf.Day, tf.Hour, tf.Minute, tf.Second);
KdPrint(("修改时间:%s\n", as.Buffer));
ExSystemTimeToLocalTime(&fnoi.LastAccessTime, &li_temp);
RtlTimeToTimeFields(&li_temp, &tf);
RtlInitEmptyAnsiString(&as, strTime, ArrayLength);
RtlStringCbPrintfA(as.Buffer, ArrayLength, "%d-%d-%d %d:%d:%d\n", tf.Year, tf.Month, tf.Day, tf.Hour, tf.Minute, tf.Second);
KdPrint(("访问时间:%s\n", as.Buffer));
KdPrint (("文件大小:%I64d", fnoi.AllocationSize.QuadPart));
windows driver 获取文件属性
最新推荐文章于 2020-12-17 15:40:00 发布