详解C语言内核字符串拷贝与比较

#include <ntifs.h>

VOID UnDriver(PDRIVER_OBJECT driver)
{
	DbgPrint("驱动已卸载 \n");
}

// PowerBy: LyShark
NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	UNICODE_STRING uncode_buffer = { 0 };

	DbgPrint("hello lyshark \n");

	wchar_t * wchar_string = L"hello lyshark";

	// 设置最大长度
	uncode_buffer.MaximumLength = 1024;

	// 分配内存空间
	uncode_buffer.Buffer = (PWSTR)ExAllocatePool(PagedPool, 1024);

	// 设置字符长度 因为是宽字符，所以是字符长度的 2 倍
	uncode_buffer.Length = wcslen(wchar_string) * 2;

	// 保证缓冲区足够大，否则程序终止
	ASSERT(uncode_buffer.MaximumLength >= uncode_buffer.Length);

	// 将 wchar_string 中的字符串拷贝到 uncode_buffer.Buffer
	RtlCopyMemory(uncode_buffer.Buffer, wchar_string, uncode_buffer.Length);

	// 设置字符串长度 并输出
	uncode_buffer.Length = wcslen(wchar_string) * 2;
	DbgPrint("输出字符串: %wZ \n", uncode_buffer);

	// 释放堆空间
	ExFreePool(uncode_buffer.Buffer);
	uncode_buffer.Buffer = NULL;
	uncode_buffer.Length = uncode_buffer.MaximumLength = 0;

	DbgPrint("驱动已加载 \n");
	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

#include <ntifs.h>

VOID UnDriver(PDRIVER_OBJECT driver)
{
	DbgPrint("驱动已卸载 \n");
}

// PowerBy: LyShark
NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	UNICODE_STRING uncode_buffer[10] = { 0 };
	wchar_t * wchar_string = L"hello lyshark";

	DbgPrint("hello lyshark \n");

	int size = sizeof(uncode_buffer) / sizeof(uncode_buffer[0]);
	DbgPrint("数组长度: %d \n", size);

	for (int x = 0; x < size; x++)
	{
		// 分配空间
		uncode_buffer[x].Buffer = (PWSTR)ExAllocatePool(PagedPool, 1024);

		// 设置长度
		uncode_buffer[x].MaximumLength = 1024;
		uncode_buffer[x].Length = wcslen(wchar_string) * sizeof(WCHAR);
		ASSERT(uncode_buffer[x].MaximumLength >= uncode_buffer[x].Length);

		// 拷贝字符串并输出
		RtlCopyMemory(uncode_buffer[x].Buffer, wchar_string, uncode_buffer[x].Length);
		uncode_buffer[x].Length = wcslen(wchar_string) * sizeof(WCHAR);
		DbgPrint("循环: %d 输出字符串: %wZ \n", x, uncode_buffer[x]);

		// 释放内存
		ExFreePool(uncode_buffer[x].Buffer);
		uncode_buffer[x].Buffer = NULL;
		uncode_buffer[x].Length = uncode_buffer[x].MaximumLength = 0;
	}

	DbgPrint("驱动加载成功 \n");
	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

#include <ntifs.h>

VOID UnDriver(PDRIVER_OBJECT driver)
{
	DbgPrint("驱动已卸载 \n");
}

// PowerBy: LyShark
NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	UNICODE_STRING uncode_buffer_source = { 0 };
	UNICODE_STRING uncode_buffer_target = { 0 };

	// 该函数可用于初始化字符串
	RtlInitUnicodeString(&uncode_buffer_source, L"hello lyshark");

	// 初始化target字符串,分配空间
	uncode_buffer_target.Buffer = (PWSTR)ExAllocatePool(PagedPool, 1024);
	uncode_buffer_target.MaximumLength = 1024;

	// 将source中的内容拷贝到target中
	RtlCopyUnicodeString(&uncode_buffer_target, &uncode_buffer_source);

	// 输出结果
	DbgPrint("source = %wZ \n", &uncode_buffer_source);
	DbgPrint("target = %wZ \n", &uncode_buffer_target);

	// 释放空间 source 无需销毁
	// 如果强制释放掉source则会导致系统蓝屏,因为source是在栈上的
	RtlFreeUnicodeString(&uncode_buffer_target);

	DbgPrint("驱动加载成功 \n");

	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

#include <ntifs.h>

VOID UnDriver(PDRIVER_OBJECT driver)
{
	DbgPrint("驱动已卸载 \n");
}

// PowerBy: LyShark
NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	UNICODE_STRING uncode_buffer_source = { 0 };
	UNICODE_STRING uncode_buffer_target = { 0 };

	// 该函数可用于初始化字符串
	RtlInitUnicodeString(&uncode_buffer_source, L"hello lyshark");
	RtlInitUnicodeString(&uncode_buffer_target, L"hello lyshark");

	// 比较字符串是否相等
	if (RtlEqualUnicodeString(&uncode_buffer_source, &uncode_buffer_target, TRUE))
	{
		DbgPrint("字符串相等 \n");
	}
	else
	{
		DbgPrint("字符串不相等 \n");
	}

	DbgPrint("驱动加载成功 \n");

	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

#include <ntifs.h>

VOID UnDriver(PDRIVER_OBJECT driver)
{
	DbgPrint("驱动已卸载 \n");
}

// PowerBy: LyShark
NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	UNICODE_STRING uncode_buffer_source = { 0 };
	UNICODE_STRING uncode_buffer_target = { 0 };

	// 该函数可用于初始化字符串
	RtlInitUnicodeString(&uncode_buffer_source, L"hello lyshark");
	RtlInitUnicodeString(&uncode_buffer_target, L"HELLO LYSHARK");

	// 字符串小写变大写
	RtlUpcaseUnicodeString(&uncode_buffer_target, &uncode_buffer_source, TRUE);
	DbgPrint("小写输出: %wZ \n", &uncode_buffer_source);
	DbgPrint("变大写输出: %wZ \n", &uncode_buffer_target);

	// 销毁字符串
	RtlFreeUnicodeString(&uncode_buffer_target);

	DbgPrint("驱动加载成功 \n");

	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}