fsd hook里获取文件全路径

NTSTATUS MyFsdCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
PDRIVER_DISPATCH        RealDispatch;
NTSTATUS                    ntStatus;
NTSTATUS                    status;
PFILE_OBJECT              FileObject;
ULONG              retSize;
PIO_STACK_LOCATION        ispSp;
POBJECT_NAME_INFORMATION      fileNameInformation;;


if(DeviceObject->DriverObject==fsdNtfs)
    RealDispatch = NtfsCreate;
else
    RealDispatch = FastfatCreate;

ispSp = IoGetCurrentIrpStackLocation(Irp);
FileObject = ispSp->FileObject;
 
ntStatus = RealDispatch(DeviceObject, Irp);

fileNameInformation = ExAllocatePool(NonPagedPool, 1024);
if(! fileNameInformation)
    return ntStatus;

status = ObQueryNameString(FileObject, fileNameInformation, 1024, &retSize);

if(! NT_SUCCESS(status) )
{
    DbgPrint("ObQueryNameString failed %d /n", status);
}
else
{
    DbgPrint("file name: %ws /n", fileNameInformation->Name.Buffer);
}

ExFreePool(fileNameInformation);

return ntStatus;
}

需要注意的是FileObject 必须在call RealDispatch 之前去获取，否则的话你将面临bsod。