OBJECT_ATTRIBUTES oa;
FILE_NETWORK_OPEN_INFORMATION fnoi;
UNICODE_STRING strPath = RTL_CONSTANT_STRING(L"\\??\\E:\\安装软件\\win7旗舰版.iso");
LARGE_INTEGER li_temp;

char strTime\[ArrayLength\] = {0};  
ANSI\_STRING as;  
TIME\_FIELDS tf;  
InitializeObjectAttributes(&oa, &strPath, OBJ\_KERNEL\_HANDLE, NULL, NULL);  
ZwQueryFullAttributesFile(&oa, &fnoi);

ExSystemTimeToLocalTime(&fnoi.CreationTime, &li\_temp);  
RtlTimeToTimeFields(&li\_temp, &tf);  
RtlInitEmptyAnsiString(&as, strTime, ArrayLength);  
RtlStringCbPrintfA(as.Buffer, ArrayLength, "%d-%d-%d %d:%d:%d\\n", tf.Year, tf.Month, tf.Day, tf.Hour, tf.Minute, tf.Second);  
KdPrint(("创建时间:%s\\n", as.Buffer));

ExSystemTimeToLocalTime(&fnoi.LastWriteTime, &li\_temp);  
RtlTimeToTimeFields(&li\_temp, &tf);  
RtlInitEmptyAnsiString(&as, strTime, ArrayLength);  
RtlStringCbPrintfA(as.Buffer, ArrayLength, "%d-%d-%d %d:%d:%d\\n", tf.Year, tf.Month, tf.Day, tf.Hour, tf.Minute, tf.Second);  
KdPrint(("修改时间:%s\\n", as.Buffer));

ExSystemTimeToLocalTime(&fnoi.LastAccessTime, &li\_temp);  
RtlTimeToTimeFields(&li\_temp, &tf);  
RtlInitEmptyAnsiString(&as, strTime, ArrayLength);  
RtlStringCbPrintfA(as.Buffer, ArrayLength, "%d-%d-%d %d:%d:%d\\n", tf.Year, tf.Month, tf.Day, tf.Hour, tf.Minute, tf.Second);  
KdPrint(("访问时间:%s\\n", as.Buffer));

KdPrint (("文件大小:%I64d", fnoi.AllocationSize.QuadPart));

版权声明：本文为博主原创文章，未经博主允许不得转载。