function NewZwQueryDirectoryFile(FileHandle: THANDLE;
                                 Event: THANDLE;
                                 ApcRoutine: PIO_APC_ROUTINE;
                                 ApcContext: PVOID;
                                 IoStatusBlock: PIO_STATUS_BLOCK;
                                 FileInformation: PVOID;
                                 FileInformationLength: ULONG;
                                 FileInformationClass: DWORD;
                                 ReturnSingleEntry: Bool;
                                 FileName: PUnicodeString;
                                 RestartScan: Bool): NTStatus; stdcall;
 function PWideToString(  pw : PWideChar  ) : string;
 var
    p : PChar;
    iLen : integer;
 begin
       {Get memory for the string}
    iLen := lstrlenw(  pw  )   1;
    GetMem(  p,  iLen  );           {Convert a unicode (PWideChar) to a string}
    WideCharToMultiByte(  CP_ACP,  0,  pw,  iLen,  p,  iLen * 2,  nil,  nil  );        Result := p;
    FreeMem(  p,  iLen  );
 end;    Var
  rc : NTStatus;
  CR0VALUE : ULONG;
  ansiFileName,ansiDirName,HideDirFile : PAnsiString;
  uniFileName : PUnicodeString;
  pFileInfo : PFILE_BOTH_DIR_INFORMATION;
  bLastOne : BOOL;
  iPos, iLeft : Integer;
  sPWS : PWideChar;
begin
  //RtlInitAnsiString(HideDirFile, 'HIDEPROCESS.EXE');      rc := TrueZwQueryDirectoryFile(FileHandle,
                                 Event,
                                 ApcRoutine,
                                 ApcContext,
                                 IoStatusBlock,
                                 FileInformation,
                                 FileInformationLength,
                                 FileInformationClass,
                                 ReturnSingleEntry,
                                 FileName,
                                 RestartScan);
                                 
  if (rc = STATUS_SUCCESS) And (FileInformationClass=FileBothDirectoryInformation) then
  begin
    pFileInfo := PFILE_BOTH_DIR_INFORMATION(FileInformation);        While pFileInfo.NextEntryOffset<>0 Do
    begin
      RtlInitUnicodeString(uniFileName,pFileInfo.FileName);
      RtlUnicodeStringToAnsiString(ansiFileName,uniFileName,TRUE);
      RtlUnicodeStringToAnsiString(ansiDirName,ansiDirName,TRUE);
      RtlUpperString(ansiFileName,ansiDirName);
      //ansiFileName.Buffer -> 这里根本没取到文件名字
        //过滤........
      //...........
      pFileInfo := PFILE_BOTH_DIR_INFORMATION(PChar(pFileInfo)   pFileInfo.NextEntryOffset);
    end;
  end;      RtlFreeAnsiString(ansiDirName);
  RtlFreeAnsiString(ansiFileName);      Result := rc;
end;