[Win32utils-devel] Playing with NtQueryInformationFile

Park Heesob phasis at gmail.com
Wed May 7 10:49:08 EDT 2008


----- Original Message ----- 
From: "Berger, Daniel" <Daniel.Berger at qwest.com>
To: "Development and ideas for win32utils projects" <win32utils-devel at rubyforge.org>
Sent: Wednesday, May 07, 2008 11:16 PM
Subject: Re: [Win32utils-devel] Playing with NtQueryInformationFile


> 
> 
>> -----Original Message-----
>> From: win32utils-devel-bounces at rubyforge.org 
>> [mailto:win32utils-devel-bounces at rubyforge.org] On Behalf Of 
>> Park Heesob
>> Sent: Wednesday, May 07, 2008 7:19 AM
>> To: Development and ideas for win32utils projects
>> Subject: Re: [Win32utils-devel] Playing with NtQueryInformationFile
>> 
>> Hi,
>> ----- Original Message -----
>> From: "Daniel Berger" <djberg96 at gmail.com>
>> To: "Development and ideas for win32utils projects" 
>> <win32utils-devel at rubyforge.org>
>> Sent: Wednesday, May 07, 2008 8:57 PM
>> Subject: Re: [Win32utils-devel] Playing with NtQueryInformationFile
>> 
>> 
>> > On Wed, May 7, 2008 at 12:51 AM, Heesob Park 
>> <phasis at gmail.com> wrote:
>> >> Hi,
>> >>
>> >>  2008/5/7 Berger, Daniel <Daniel.Berger at qwest.com>:
>> >>  >
>> >>  >
>> >>  <snip>
>> >>
>> >> > Many thanks, that works.
>> >>  >
>> >>  > The AllocationSize returns the sectors, but I don't see 
>> a structure that
>> >>  > gives me bytes per sector. Or is it always 512?
>> >>  >
>> >>  >
>> >>  The AllocationSize returns not sectors but bytes.
>> >>  In my case, it returns 4096.
>> >>
>> >>  A file has two size. One is actual file size and the other is disk
>> >>  allocation size.
>> >>  Why do you want to get allocation size?
>> > 
>> > I'm trying to get File::Stat#blksize working. It's easy 
>> enough when I
>> > have the file _name_, but I'd like to get it from the file 
>> _handle_ so
>> > I can make it work properly.
>> > 
>> You must need some function like 'handle_to_fn'.
>> It can be implemented using NtQueryObject with ObjectNameInformation.
> 
> I messed around with it a little bit but couldn't quite make it work. Do
> you have a code sample?
> 
Here is a sample code:

require 'windows/handle'
require 'windows/unicode'
require 'windows/error'
include Windows::Handle
include Windows::Unicode
include Windows::Error

NtQueryObject = API.new('NtQueryObject', 'LLPLP', 'L','ntdll')
ObjectNameInformation = 1

fh = File.open('test.txt', 'r')
handle = get_osfhandle(fh.fileno)
MAX_PATH = 256
object_name_information = 0.chr * (8 + MAX_PATH*2)
status = NtQueryObject.call(
   handle,
   ObjectNameInformation,
   object_name_information,
   object_name_information.size,
   0 
)
puts wide_to_multi(object_name_information[8..-1])
fh.close


Regards,

Park Heesob


More information about the win32utils-devel mailing list