内核模式下的字符串操作示例

//////////////////////////////////////////////////////////////////////////
//文件：MyDriver.h
//作者：Hot_VC
//功能：内核模式下字符串操作 示例
//////////////////////////////////////////////////////////////////////////

#pragma once
#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#include <windef.h>
#ifdef  __cplusplus
};
#endif

#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")

#define PAGEDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")

#define arraysize(p) (sizeof(p)/sizeof((p)[0]))

#define BUFF_SIZE 1024
typedef struct _DEVICE_EXTENSION{
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName;
UNICODE_STRING ustrSymLinkName;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObject );
VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp);

VOID CharTest();
VOID AnsiStringTest();
VOID UnicodeStringTest();

VOID StringToIntegerTest();

//////////////////////////////////////////////////////////////////////////
//文件：MyDriver.cpp
//作者：Hot_VC
//功能：内核模式下字符串操作 示例
//////////////////////////////////////////////////////////////////////////
#include "MyDriver.h"

#pragma PAGEDCODE
extern "C" NTSTATUS DriverEntry(
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath )
{
/*
#if DBG
__asm int 3
#endif*/
NTSTATUS status;
KdPrint(("EnterDriverEntry\n"));

//CharTest();		//CHAR使用例子
AnsiStringTest(); //ANSI_STRING 使用例子
//UnicodeStringTest();

//StringToIntegerTest();

//注册其他驱动调用函数入口
pDriverObject->DriverUnload = HelloDDKUnload;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;

//创建设备驱动对象
status = CreateDevice(pDriverObject);

KdPrint(("DriverEntry end \n"));

return status;
}

//初始化设备对象
NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObject )
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;

//创建设备名称
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");

//创建设备
status = IoCreateDevice(pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)devName,
FILE_DEVICE_UNKNOWN,
0, TRUE,
&pDevObj);

if(!NT_SUCCESS(status))
return status;

pDevObj->Flags |= DO_BUFFERED_IO;
pDevExt = (PDEVICE_EXTENSION) pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;

//创建符号链接
UNICODE_STRING systemLinkName;
RtlInitUnicodeString(&systemLinkName, L"\\??\\HelloDDK");
pDevExt->ustrSymLinkName = systemLinkName;
status = IoCreateSymbolicLink(&systemLinkName, &devName);

if (NT_SUCCESS(status))
{
IoDeleteDevice(pDevObj);
return status;
}

return STATUS_SUCCESS;
}

#pragma INITCODE
VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject )
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload\n"));

pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pNextObj->DeviceExtension;

//删除符号链接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice(pDevExt->pDevice);
}
}

NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutine\n"));

NTSTATUS status = STATUS_SUCCESS;

//完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
KdPrint(("Leave HelloDDKDispatchRoutine\n"));
return status;
}

VOID CharTest()
{
KdPrint(("******************************************************\n"));
KdPrint(("                      CHAR测试"));
//驱动中一般不直接使用CHAR WCHAR 容易造成缓冲区溢出
CHAR *pszCharTest = "CHAR 测试";
KdPrint(("%s\n", pszCharTest));			//注意小写s

WCHAR *pwszWCharTest = L"WCHAR 测试";
KdPrint(("%S\n", pwszWCharTest));		//注意大写S
KdPrint(("******************************************************\n"));
}

VOID AnsiStringTest()
{
#if DBG
__asm int 3
#endif
KdPrint(("******************************************************\n"));
KdPrint(("                    ANSI_STRING测试\n"));
//ANSI_STRING
ANSI_STRING AnsiStringTest;
RtlInitAnsiString(&AnsiStringTest, "ANSI_STRING测试");
KdPrint(("AnsiString初始化测试：%Z\n", &AnsiStringTest));

//ANSI_STRING复制测试
ANSI_STRING AnsiStringCopyTest;
RtlInitAnsiString(&AnsiStringCopyTest, "ANSI_STRING复制测试");
KdPrint(("AnsiString复制测试（复制前）：%Z\n", &AnsiStringTest));
RtlCopyString(&AnsiStringTest, &AnsiStringCopyTest);
KdPrint(("AnsiString复制测试（复制后）：%Z\n", &AnsiStringTest));

//ANSI_STRING小写转大写测试
RtlInitAnsiString(&AnsiStringTest, "abCdEFFGG!13");
KdPrint(("小写转大写测试(未转换)：%Z\n", &AnsiStringTest));

ANSI_STRING AnsiStringUpperTest;
AnsiStringUpperTest.MaximumLength = BUFF_SIZE;
AnsiStringUpperTest.Buffer = (PSTR)ExAllocatePool(PagedPool,BUFF_SIZE);

RtlUpperString(&AnsiStringUpperTest, &AnsiStringTest);
KdPrint(("小写转大写测试(已转换)：%Z\n", &AnsiStringUpperTest));
RtlFreeAnsiString(&AnsiStringUpperTest);
KdPrint(("******************************************************\n"));
}

VOID UnicodeStringTest()
{
KdPrint(("******************************************************\n"));
KdPrint(("                    UNICODE_STRING测试\n"));
//UNICODE_STRING
UNICODE_STRING UnicodeStringTest;
RtlInitUnicodeString(&UnicodeStringTest, L"UNICODE_STRING测试");
KdPrint(("AnsiString初始化测试：%wZ\n", &UnicodeStringTest));

//UNICODE_STRING复制测试
UNICODE_STRING UnicodeStringCopyTest;
RtlInitUnicodeString(&UnicodeStringCopyTest, L"UNICODE_STRING复制测试");
KdPrint(("UnicodeString复制测试（复制前）：%wZ\n\n", &UnicodeStringTest));
RtlCopyUnicodeString(&UnicodeStringTest, &UnicodeStringCopyTest);
KdPrint(("UnicodeString复制测试（复制后）：%wZ\n\n", &UnicodeStringTest));

//ANSI_STRING小写转大写测试
RtlInitUnicodeString(&UnicodeStringTest, L"abCdEFFGG!");
KdPrint(("小写转大写测试(未转换)：%wZ\n", &UnicodeStringTest));
UNICODE_STRING UnicodeStringUpperTest;
//第三个参数表示是否为目的字符串分配内存
//如果目的字符串与源字符串为同一个字符串则填否
RtlUpcaseUnicodeString(&UnicodeStringUpperTest, &UnicodeStringTest, TRUE);
//销毁字符串
//UnicodeStringUpperTest不是用RtlInitUnicodeString初始化过的需要销毁
//UnicodeStringTest用RtlInitUnicodeString初始化过的不需要销毁
RtlFreeUnicodeString(&UnicodeStringUpperTest);
KdPrint(("小写转大写测试(已转换)：%wZ\n", &UnicodeStringUpperTest));
KdPrint(("******************************************************\n"));
}

VOID StringToIntegerTest()
{
//字符串转换成数字
UNICODE_STRING unisUnicodeString;
RtlInitUnicodeString(&unisUnicodeString, L"-100");

ULONG ulNumber;
NTSTATUS staus = RtlUnicodeStringToInteger(&unisUnicodeString, 10, &ulNumber);

if (NT_SUCCESS(staus))
{
KdPrint(("转换成功！！\n"));
KdPrint(("结果是：%d\n", ulNumber));
}else
{
KdPrint(("转换失败！！"));
}

//数字转换成字符串
UNICODE_STRING unisUnicodeString2 = {0};
unisUnicodeString2.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFF_SIZE);
unisUnicodeString2.MaximumLength = BUFF_SIZE;
staus = RtlIntegerToUnicodeString(300, 10, &unisUnicodeString2);

if (NT_SUCCESS(staus))
{
KdPrint(("转换成功！！\n"));
KdPrint(("结果是：%wZ\n", &unisUnicodeString2));
}else
{
KdPrint(("转换失败！！"));
}

//销毁unisUnicodeSt
4000
ring2
RtlFreeUnicodeString(&unisUnicodeString2);
}