I found this founction in ntifs.h
NTKERNELAPI
NTSTATUS
IoQueryFileInformation(
IN PFILE_OBJECT FileObject,
IN FILE_INFORMATION_CLASS FileInformationClass,
IN ULONG Length,
OUT PVOID FileInformation,
OUT PULONG ReturnedLength
);
and I used it like this:
Filename = ExAllocatePool(NonPagedPool, length);
ULONG length = sizeof (FILE_NAME_INFORMATION) + (sizeof (WCHAR)*(MAXIMUM_FILENAME_LENGTH -1));
ntStatus = IoQueryFileInformation(FileObject, FileNameInformation,length,nameInformation,&length);
but the IoQueryFileInformation() returned STATUS_INVALID_PARAMETER.
please give me a hint.