如何在Windows内核中获取文件大小

#include <ntifs.h>

NTSTATUS GetFileSize(PUNICODE_STRING filePath, PLARGE_INTEGER fileSize)
{
    NTSTATUS status;
    OBJECT_ATTRIBUTES objAttr;
    HANDLE fileHandle;
    IO_STATUS_BLOCK ioStatusBlock;
    FILE_STANDARD_INFORMATION fileInfo;

    InitializeObjectAttributes(&objAttr, filePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    status = ZwCreateFile(&fileHandle, FILE_READ_ATTRIBUTES, &objAttr, &ioStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
    if (!NT_SUCCESS(status))
    {
        return status;
    }

    status = ZwQueryInformationFile(fileHandle, &ioStatusBlock, &fileInfo, sizeof(fileInfo), FileStandardInformation);
    if (!NT_SUCCESS(status))
    {
        ZwClose(fileHandle);
        return status;
    }

    *fileSize = fileInfo.EndOfFile;

    ZwClose(fileHandle);

    return STATUS_SUCCESS;
}