UnicodeString基本操作(Ring0)

// 纯粹做个记录，微软源码
  1 #include "Unicode_String_Ring0.h"

//bp Unicode_String_Ring0!DriverEntry
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
    NTSTATUS Status = STATUS_SUCCESS;
    PDEVICE_OBJECT  DeviceObject = NULL;
    
    DriverObject->DriverUnload = DriverUnload;
    
    Test();

    return Status;
}


void Test()
{
    //初始化
    //StringInitTest();

    //拷贝操作
    //StringCopyTest();

    //字符串比较
    //StringCompareTest();

    //字符串变大写
    //StringToUpperTest();

    //字符串与整型相互转化
    //StringToIntegerTest();


    //ANSI_STRING字符串与UNICODE_STRING字符串相互转换
    StringConverTest();


}

//初始化
void StringInitTest()
{
    //Sub_1();//常量初始化
    //Sub_2();
    Sub_3();//堆
}
void Sub_1()
{
    //UNICODE_STRING
    //常量初始化
    UNICODE_STRING v1;
    RtlInitUnicodeString(&v1, L"HelloWorld");
    
    //v1.Buffer = 常量指针
    //v1.Length = 20
    //v1.MaximumLength = 22

    DbgPrint("%wZ
", &v1);//Unicode打印L""
    

    /*
    //常量初始化ANSI_STRING
    //(1)用RtlInitAnsiString初始化字符串
    ANSI_STRING  AnsiString;
    CHAR * string = "hello";
    //初始化ANSI_STRING字符串
    RtlInitAnsiString(&AnsiString, string);
    DbgPrint("AnsiString:%Z
", &AnsiString);
    */
}
void Sub_2()
{
    UNICODE_STRING v1;
    WCHAR BufferData[] = L"HelloWorld";
    v1.Buffer = BufferData;
    v1.Length = wcslen(BufferData) * sizeof(WCHAR);
    v1.MaximumLength = (wcslen(BufferData) + 1) * sizeof(WCHAR);
    
    DbgPrint("%wZ
", &v1);
}
void Sub_3()
{
    UNICODE_STRING v1;
    WCHAR BufferData[] = L"HelloWorld";

    v1.Length = wcslen(BufferData) * sizeof(WCHAR);
    v1.MaximumLength = (wcslen(BufferData) + 1) * sizeof(WCHAR);
    v1.Buffer = ExAllocatePool(PagedPool, v1.MaximumLength);

    RtlZeroMemory(v1.Buffer, v1.MaximumLength);
    RtlCopyMemory(v1.Buffer, BufferData, v1.Length);

    DbgPrint("%wZ
", &v1);
    
    if (v1.Buffer != NULL)
    {
        ExFreePool(v1.Buffer);
        v1.Buffer = NULL;
        v1.Length = v1.MaximumLength = 0;
    }
}

//拷贝操作
void StringCopyTest()
{
    UNICODE_STRING SourceString;
    RtlInitUnicodeString(&SourceString, L"HelloWorld");

    UNICODE_STRING DestinationString = { 0 };
    DestinationString.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);
    DestinationString.MaximumLength = BUFFER_SIZE;

    RtlCopyUnicodeString(&DestinationString, &SourceString);

    DbgPrint("SourceString:%wZ
", &SourceString);
    DbgPrint("DestinationString:%wZ
", &DestinationString);

    RtlFreeUnicodeString(&DestinationString);
}

//字符串比较
void StringCompareTest()
{
    //初始化UnicodeString1
    UNICODE_STRING UnicodeString1;
    RtlInitUnicodeString(&UnicodeString1,L"HELLOWORLD");

    //初始化UnicodeString2
    UNICODE_STRING UnicodeString2;
    //RtlInitUnicodeString(&UnicodeString2, L"Hello");
    //RtlInitUnicodeString(&UnicodeString2, L"HELLOWORLD");
    RtlInitUnicodeString(&UnicodeString2, L"helloworld");


    if (RtlEqualUnicodeString(
        &UnicodeString1, 
        &UnicodeString2, 
        TRUE
        //If TRUE, 
        //case should be ignored when doing the comparison.
    )
        )
    {
        DbgPrint("UnicodeString1 and UnicodeString2 are equal
");
    }
    else
    {
        DbgPrint("UnicodeString1 and UnicodeString2 are NOT equal
");
    }





}

//字符串变大写
void StringToUpperTest()
{
    UNICODE_STRING SourceString;
    RtlInitUnicodeString(&SourceString, L"Hello World");

    UNICODE_STRING DestinationString;
    DestinationString.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);
    DestinationString.MaximumLength = BUFFER_SIZE;
    
    //变化前
    DbgPrint("变化前:%wZ
", &SourceString);
    //变大写
    RtlUpcaseUnicodeString(
        &DestinationString, //DestinationString
        &SourceString, //SourceString
        FALSE//Specifies if RtlUpcaseUnicodeString is to allocate the buffer space for the DestinationString. 
             //If it does, the buffer must be deallocated by calling RtlFreeUnicodeString.
    );

    //变化后
    DbgPrint("变化后:%wZ
", &DestinationString);

    RtlFreeUnicodeString(&DestinationString);
}



//字符串与整型相互转化
void StringToIntegerTest()
{
    //(1)字符串转换成数字
    UNICODE_STRING UnicodeString1;
    RtlInitUnicodeString(&UnicodeString1, L"-100");
    
    ULONG lNumber;
    NTSTATUS Status = 
        RtlUnicodeStringToInteger(//第二个参数Base
            &UnicodeString1, 
            //10,//-100是10进制 //输出-100
            //16,//-100是16进制  //输出-256
            8,   //-100是8进制 //输出-64
            &lNumber
        );

    if (NT_SUCCESS(Status))
    {
        DbgPrint("Conver to integer succussfully!
");
        DbgPrint("Result:%d
", lNumber);
    }
    else
    {
        DbgPrint("Conver to integer unsuccessfully!
");
    }
    //(2)数字转换成字符串
    UNICODE_STRING UnicodeString2 = { 0 };
    UnicodeString2.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);
    UnicodeString2.MaximumLength = BUFFER_SIZE;

    Status = RtlIntegerToUnicodeString(//同上 第二参数是Base
        200, 
        //10, //输出200
        //8,  //输出310
        16,   //输出  C8
        &UnicodeString2
    );

    /*
    HEX C8
    DEC 200
    OCT 310
    */

    if (NT_SUCCESS(Status))
    {
        DbgPrint("Conver to string succussfully!
");
        DbgPrint("Result:%wZ
", &UnicodeString2);
    }
    else
    {
        DbgPrint("Conver to string unsuccessfully!
");
    }

    //销毁UnicodeString2
    //注意!!UnicodeString1不用销毁
    RtlFreeUnicodeString(&UnicodeString2);


}



//ANSI_STRING字符串与UNICODE_STRING字符串相互
void StringConverTest()
{
    //(1)将UNICODE_STRING字符串转换成ANSI_STRING字符串
    //初始化UnicodeString1
    UNICODE_STRING UnicodeString1;
    RtlInitUnicodeString(&UnicodeString1, L"HelloWorld");

    ANSI_STRING AnsiString1;
    NTSTATUS Status = RtlUnicodeStringToAnsiString(
        &AnsiString1, 
        &UnicodeString1, 
        TRUE
        //TRUE if this routine is to allocate the buffer space for the DestinationString. 
        //If it does, the buffer must be deallocated by calling RtlFreeAnsiString.
    );

    if (NT_SUCCESS(Status))
    {
        DbgPrint("Conver succussfully!
");
        DbgPrint("Result:%Z
", &AnsiString1);
    }
    else
    {
        DbgPrint("Conver unsuccessfully!
");
    }

    //销毁AnsiString1
    RtlFreeAnsiString(&AnsiString1);

    //(2)将ANSI_STRING字符串转换成UNICODE_STRING字符串

    ANSI_STRING AnsiString2;
    RtlInitString(&AnsiString2, "HelloWorld");

    UNICODE_STRING UnicodeString2;
    Status = RtlAnsiStringToUnicodeString(
        &UnicodeString2, 
        &AnsiString2, 
        TRUE
        //Specifies if this routine should allocate the buffer space for the destination string. 
        //If it does, the caller must deallocate the buffer by calling RtlFreeUnicodeString.
        

    );

    if (NT_SUCCESS(Status))
    {
        DbgPrint("Conver succussfully!
");
        DbgPrint("Result:%wZ
", &UnicodeString2);
    }
    else
    {
        DbgPrint("Conver unsuccessfully!
");
    }

    //销毁UnicodeString2
    RtlFreeUnicodeString(&UnicodeString2);
}

VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
    DbgPrint("DriverUnload()
");
}

#include <ntifs.h>


#define BUFFER_SIZE 0x400

void Test();

//初始化操作
void StringInitTest();
void Sub_1();//常量初始化
void Sub_2();
void Sub_3();

//拷贝操作
void StringCopyTest();

//字符串比较
void StringCompareTest();

//字符串变大写
void StringToUpperTest();

//字符串与整型相互转化
void StringToIntegerTest();

//ANSI_STRING字符串与UNICODE_STRING字符串相互
void StringConverTest();


VOID DriverUnload(PDRIVER_OBJECT DriverObject);

 Ring3层的话不能直接使用UnicodeString、AnsiString，需要自己定义出来，并且部分相关的函数需要自己实现，得参照微软的源代码，本人正在写，写好了发出来，也是Ring0的这些基本的操作。

老实说字符串操作是很大的一个部分，之前就被一个String的输出到txt文件的问题卡过，还是要好好总结这些基础的东西，感觉要是能有完全的手册就好了MSDN。。。String Manipulation (CRT)。。。。唉看英语还是慢，个人琐碎。

vs自动生成的ReadMe.txt是UTF-8  开头有EF BB BF