_UNICODE_STRING

Posted 2020-10-04 CrisCzy

#pragma once
#include <ntifs.h>

#define  MAX_PATH 260
#define  BUFFER_SIZE 0x400
/********************************************/
/* 初始化                                    */
/********************************************/
void Sub_1(); //常量内存
void Sub_2(); //栈区内存
void Sub_3(); //动态内存
void Sub_4();//利用WCHAR
void SubI_1();//初始化常数字符串的一个宏
void Sub_9();//初始化为空

/************************************************************************/
/* 拷贝操作                                                             */
/************************************************************************/
void Sub_5();


/************************************************************************/
/*//字符串串联                                                         */
/************************************************************************/
void Sub_10();

/************************************************************************/
/*//字符串打印                                                       */
/************************************************************************/
void Sub_11();

/************************************************************************/
/* 转换                                                                 */
/************************************************************************/

BOOLEAN UnicodeStringToChar(char* DestinationString, PUNICODE_STRING SourceString);




BOOLEAN IsUnicodeStringValid(PUNICODE_STRING SourceString);


VOID DriverUnload(PDRIVER_OBJECT DriverObject);

　　

#include "UnicodeString(Kernel).h"
//bp MyDriver1!DriverEntry


NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
	NTSTATUS Status = STATUS_SUCCESS;

	PDEVICE_OBJECT  DeviceObject = NULL;
	

	DriverObject->DriverUnload = DriverUnload;
	//Sub_1();
	Sub_10();
	return Status;
}

void Sub_1()
{
	UNICODE_STRING v1;
	RtlInitUnicodeString(&v1, L"HelloWorld");
	CHAR v2[20] = { 0 };
	/*
	v1.Buffer = 常量指针
	v1.Length = 20
	v1.MaximumLength = 22
	*/
	UnicodeStringToChar(v2, &v1);
	DbgPrint("%s\r\n", v2);
	DbgPrint("%wZ\r\n", &v1); //UNICODE_STRING要用 wZ输出 记住！！！
}

void Sub_2()
{
	UNICODE_STRING v1;
	WCHAR BufferData[] = L"HelloWorld";
	v1.Buffer = BufferData;
	v1.Length = wcslen(BufferData)*sizeof(WCHAR);
	v1.MaximumLength = (wcslen(BufferData)+1)*sizeof(WCHAR);
	DbgPrint("%wZ\r\n", &v1);

}

void Sub_3()
{
	UNICODE_STRING v1;
	WCHAR BufferData[] = L"HelloWorld";
	v1.Length = wcslen(BufferData) * sizeof(WCHAR);
	v1.MaximumLength = (wcslen(BufferData) + 1) * sizeof(WCHAR);
	v1.Buffer = ExAllocatePool(PagedPool, v1.MaximumLength);
	RtlZeroMemory(v1.Buffer, v1.MaximumLength);
	RtlCopyMemory(v1.Buffer,BufferData,v1.Length);

	DbgPrint("%wZ\r\n", &v1);
	if (v1.Buffer!=NULL)
	{
		ExFreePool(v1.Buffer);
		v1.Buffer = NULL;
		v1.Length = v1.MaximumLength = 0;
	}
}
void Sub_4()
{
	UNICODE_STRING str = { 0 };
	WCHAR strBuf[128] = { 0 };
	str.Buffer = strBuf;
	wcscpy(str.Buffer, L"hello");
	str.Length = str.MaximumLength = wcslen(L"hello") * sizeof(WCHAR);
	DbgPrint("%wZ\r\n", &str);
}
void SubI_1()
{
	UNICODE_STRING str = RTL_CONSTANT_STRING(L"hello");//用于初始化常数字符串的一个宏
	DbgPrint("%wZ\r\n", &str);
}
void Sub_9()//初始化为拥有缓冲长度为256的UNICODE_STRING空串
{
	UNICODE_STRING str;
	WCHAR str_buf[256] ;
	RtlInitEmptyUnicodeString(&str, str_buf ,256 * sizeof(WCHAR));
}

//拷贝操作
void Sub_5()
{
	UNICODE_STRING SourceString;
	RtlInitUnicodeString(&SourceString, L"HelloWorld");


	UNICODE_STRING DestinationString = { 0 };
	DestinationString.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);
	DestinationString.MaximumLength = BUFFER_SIZE;


    RtlCopyUnicodeString(&DestinationString, &SourceString);
	KdPrint(("SourceString:%wZ\n", &SourceString));
	KdPrint(("DestinationString:%wZ\n", &DestinationString));
	RtlFreeUnicodeString(&DestinationString);

}




//字符串串联

void Sub_10()
{
	UNICODE_STRING SourceString;
	RtlInitUnicodeString(&SourceString, L"HelloWorld");


	UNICODE_STRING DestinationString = { 0 };
	DestinationString.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);
	DestinationString.MaximumLength = BUFFER_SIZE;


    RtlCopyUnicodeString(&DestinationString, &SourceString);
	KdPrint(("SourceString:%wZ\n", &SourceString));
	KdPrint(("DestinationString:%wZ\n", &DestinationString));
	RtlAppendUnicodeStringToString(&DestinationString, &SourceString);
	KdPrint(("DestinationString:%wZ\n", &DestinationString));
	DbgPrint("%wZ\r\n", &DestinationString);
	RtlFreeUnicodeString(&DestinationString);
}


//字符串打印
void Sub_11()
{
	//在不能保证字符串的结尾为空时，尽量不要用%ws %s来打印
		UNICODE_STRING SourceString;
	RtlInitUnicodeString(&SourceString, L"HelloWorld");


	UNICODE_STRING DestinationString = { 0 };
	DestinationString.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);
	DestinationString.MaximumLength = BUFFER_SIZE;


    RtlCopyUnicodeString(&DestinationString, &SourceString);
	KdPrint(("SourceString:%wZ\n", &SourceString));
	KdPrint(("DestinationString:%wZ\n", &DestinationString));
	RtlAppendUnicodeStringToString(&DestinationString, &SourceString);
	KdPrint(("DestinationString:%wZ\n", &DestinationString));//Dbgprint无论是发行般还是调试般都有效，可以定义个宏 即 Kdprint（a）要用双重括号
	DbgPrint("%wZ\r\n", &DestinationString);//必须是PASSIVE_LEVEL  
	RtlFreeUnicodeString(&DestinationString);
}
VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
	DbgPrint("DriverUnload()\r\n");
}



BOOLEAN UnicodeStringToChar(char* DestinationString, PUNICODE_STRING SourceString)
{
	ANSI_STRING	v1;
	NTSTATUS	Status;
	char*		v2 = NULL;
	__try
	{
		Status = RtlUnicodeStringToAnsiString(&v1, SourceString, TRUE);
		if (v1.Length < MAX_PATH)
		{
			v2 = (PCHAR)v1.Buffer;
			strcpy(DestinationString, _strupr(v2));
		}
		RtlFreeAnsiString(&v1);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		return FALSE;
	}
	return TRUE;
}


BOOLEAN IsUnicodeStringValid(PUNICODE_STRING SourceString)
{
	ULONG i = 0;

	__try
	{
		if (!MmIsAddressValid(SourceString))
		{
			return FALSE;
		}
		if (SourceString->Buffer == NULL || SourceString->Length == 0)
		{
			return FALSE;
		}
		for (i = 0; i < SourceString->Length; i++)
		{
			if (!MmIsAddressValid((PUCHAR)SourceString->Buffer + i))
			{
				return FALSE;
			}
		}
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		return FALSE;
	}
	return TRUE;
}

　　

typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWCHAR Buffer;
}UNICODE_STRING,*PUNICODE_STRING;

kd> dt v1
dtx is unsupported for this scenario. It only recognizes dtx [<type>] [<address>] with -a, -h, and -r. Reverting to dt.
Local var @ 0x8df079c0 Type _UNICODE_STRING
"HelloWorld"
+0x000 Length : 0x14
+0x002 MaximumLength : 0x16
+0x004 Buffer : 0xa60e4082 "HelloWorld"
kd> db 0xa60e4082
a60e4082 48 00 65 00 6c 00 6c 00-6f 00 57 00 6f 00 72 00 H.e.l.l.o.W.o.r.
a60e4092 6c 00 64 00 00 00 25 77-5a 0d 0a 00 44 72 69 76 l.d...%wZ...Driv
a60e40a2 65 72 55 6e 6c 6f 61 64-28 29 0d 0a 00 00 00 00 erUnload()......
a60e40b2 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
a60e40c2 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
a60e40d2 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
a60e40e2 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
a60e40f2 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................