typedef struct _UNICODE_STRING {
USHORT Length;//字符长度，单位字节，如果N个字符，那么Length=N*2
USHORT MaximumLength;//整个字符串缓冲区的最大长度，单位字节。
#ifdef MIDL_PASS
[size_is(MaximumLength / 2), length_is((Length) / 2) ] USHORT * Buffer;
#else // MIDL_PASS
PWSTR Buffer;
#endif // MIDL_PASS
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
打印log
ANSI_STRING ansistring
KdPrint("%Z\n",&ansistring);
UNICODE_STRING unistring;
KdPrint("%wZ\n",&unistring);
初始化ANSI_STRING
VOID
RtlInitAnsiString(
IN OUT PANSI_STRING DestinationString,//要初始化的字符串
IN PCSZ SourceString//字符串的内容
);
Parameters
DestinationString
Points to the buffer for a counted ANSI string to be initialized.
SourceString
Points to a zero-terminated string with which to initialize the counted string.
Include
wdm.h or ntddk.h
初始化UNICODE_STRING
VOID
RtlInitUnicodeString(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);
Parameters
DestinationString
Points to the buffer for a counted Unicode string to be initialized.
SourceString
Points to a zero-terminated Unicode string with which to initialize the counted string.
Include
wdm.h or ntddk.h
使用方法
ANSI_STING ansistring;
CHAR * string1="my first";=>char *
RtlInitAnsiString(&ansistring,string1);
将ansistring中的Buffer指针等于string1的指针[指向同一个地址]
这样初始化用完后不城要清理内存，但是改了string1的话那么ansistring也会改变
ANSI_STRING ansistring;
CHAR * string1="study driver ^_^!";//若是在C++中CHAR * a="af";是会变成const char* a="af";修改a[0]会出错
//因为在C++中"asdf"是属于const char*
//可以char a[]="asdf";定义一个数组刚，可以放下字符串常量大小，这样就可以更改
RtlInitAnsiString(&ansistring,string1);
KdPrint(("ansistring1:%Z\n",&ansistring));//打印出string1
ULONG slen=strlen(string1);// [wcslen计算宽字符长度 wcslen(L"asdf哈哈"); 这样a这些都会按16位存放]
for (ULONG i=0;i<slen;i++)
{
if (string1[i]>='a') && (string1[i]<='z'))
{
string1[i]=string1[i]-32;
}
}
KdPrint(("ansistring:%Z\n",&ansistring));
ANSI_STRING字符串复制函数
RtlCopyString copies a source string to a destination string.
VOID
RtlCopyString(
IN OUT PSTRING DestinationString,
IN PSTRING SourceString OPTIONAL
);
Parameters
DestinationString
Points to the destination string buffer.
SourceString
Points to the source string buffer.
Include
wdm.h or ntddk.h
UNICODE_STRING字符串复制函数
RtlCopyUnicodeString copies a source string to a destination string.
VOID
RtlCopyUnicodeString(
IN OUT PUNICODE_STRING DestinationString,
IN PUNICODE_STRING SourceString
);
Parameters
DestinationString
Points to the destination string buffer.
SourceString
Points to the source string buffer.
Include
wdm.h or ntddk.h
ANSI_STRING字符串比较
RtlCompareString
RtlCompareString compares two counted strings.
LONG
RtlCompareString(
IN PSTRING String1,
IN PSTRING String2,
BOOLEAN CaseInSensitive
);
Parameters
String1
Points to the first string.
String2
Points to the second string.
CaseInSensitive
If TRUE, case should be ignored when doing the comparison. //若是TRUE则忽略大小写
Return Value
RtlCompareString returns a signed value that gives the results of the comparison:
Zero
String1 equals String2. //返回0则相等
< Zero
String1 is less than String2. //小于0则第一个参数小于第二个参数
> Zero
String1 is greater than String2. //大于0则第一个参数大于第二个参数
UNICODE_STRING字符串比较
RtlCompareUnicodeString
RtlCompareUnicodeString compares two Unicode strings.
LONG
RtlCompareUnicodeString(
IN PUNICODE_STRING String1,
IN PUNICODE_STRING String2,
IN BOOLEAN CaseInSensitive
);
Parameters
String1
Points to the first string.
String2
Points to the second string.
CaseInSensitive
If TRUE, case should be ignored when doing the comparison.
Include
wdm.h or ntddk.h
Return Value
RtlCompareUnicodeString returns a signed value that gives the results of the comparison:
Zero
String1 equals String2.
< Zero
String1 is less than String2.
> Zero
String1 is greater than String2.
字符串转化成大写
RtlUpperString
RtlUpperString copies the given SourceString to the DestinationString buffer, converting it to
uppercase.把源字符串copy到目的字符串的buffer中，并转换为大写
VOID
RtlUpperString(
IN OUT PSTRING DestinationString,
IN PSTRING SourceString
);
Parameters
DestinationString
Points to the buffer for the converted destination string.
SourceString
Points to the source string to be converted to uppercase.
Include
ntddk.h
Comments
The MaximumLength and Buffer fields of DestinationString are not modified by this routine.
The number of bytes copied from SourceString is either the Length of SourceString or the MaximumLength
of DestinationString, whichever is smaller.
Callers of RtlUpperString must be running at IRQL PASSIVE_LEVEL.//必须运行在PASSIVE级
RtlUpcaseUnicodeString
RtlUpcaseUnicodeString converts a copy of the source string to upper case and writes the converted
string in the destination buffer.
NTSTATUS
RtlUpcaseUnicodeString(
IN OUT PUNICODE_STRING DestinationString OPTIONAL,
IN PCUNICODE_STRING SourceString,
IN BOOLEAN AllocateDestinationString //是否为目的字符串分配内存
);//源与目的可以是同一个字符串
Parameters
DestinationString
Points to a caller-allocated buffer for the converted Unicode string or is NULL if
AllocateDestinationString is set to TRUE.
SourceString
Points to the source Unicode string to be converted to upper case.
AllocateDestinationString
TRUE if RtlUpcaseUnicodeString is to allocate the buffer space for the DestinationString. If it does,
the buffer must be deallocated by calling RtlFreeUnicodeString.
Include
ntddk.h
Return Value
If the operation succeeds, RtlUpcaseUnicodeString returns STATUS_SUCCESS. Otherwise, no storage was
allocated, and no conversion was done.
Comments
Callers of RtlUpcaseUnicodeString must be running at IRQL PASSIVE_LEVEL.
///////////////////////
UNICODE_STRING unicodestring;
RtlInitUnicodeString(&unicodestring,L"study driver");
RtlUpcaseUnicodeString(&unicodestring,&unicodestring,FALSE);
///////////////////////
UNICODE_STRING字符串与整数相互转换
RtlUnicodeStringToInteger
RtlUnicodeStringToInteger converts a Unicode string representation of an integer into its integer
equivalent.
NTSTATUS
RtlUnicodeStringToInteger(
IN PUNICODE_STRING String,
IN ULONG Base OPTIONAL,
OUT PULONG Value
);
Parameters
String
Points to the Unicode string to be converted to its integer equivalent.
Base
An optional argument that indicates the base of the number expressed as a Unicode string.
//转换的数进制 2/8/10/16
Value
Points to caller supplied storage of type ULONG. RtlUnicodeStringToInteger returns the integer
conversion results in Value.
Include
wdm.h or ntddk.h
Return Value
If the conversion is successful, RtlUnicodeStringToInteger returns STATUS_SUCCESS and Value is set to
the integer equivalent of the Unicode string. Otherwise, the Value is set to 0, and
If the first character of the string is a "–", the sign of the output Value is negative, otherwise if
the first character is a "+" or there is no sign character, the sign of Value is positive.
//如果字符第一个字符是 - 那么输出的值是负的，反之是正的。
整数转换成UNICODE_STRING字符串
RtlIntegerToUnicodeString
RtlIntegerToUnicodeString converts an unsigned integer value to a NULL-terminated string of one or more
Unicode characters in the specified base.
NTSTATUS
RtlIntegerToUnicodeString(
IN ULONG Value,
IN ULONG Base OPTIONAL,
IN OUT PUNICODE_STRING String
);
Parameters
Value
Identifies an unsigned integer of type ULONG.
Base
Optional. If not zero, this must be 2, 8, 10, or 16, to specify that the returned string should
represent the integer as a binary, octal, decimal, or hexadecimal number. If zero, the integer is
represented as a decimal number.-
String
Points to a buffer large enough to contain the Unicode string.
Include
wdm.h or ntddk.h
Return Value
If RtlIntegerToUnicodeString succeeds, it returns STATUS_SUCCESS. Otherwise, it can return
STATUS_INVALID_PARAMETER if Base is not 0, 2, 8, 10, or 16, or STATUS_BUFFER_OVERFLOW if an internal
////////////////////////////////////////////////////////////////////
RtlUnicodeStringToAnsiString
RtlUnicodeStringToAnsiString converts a given Unicode string into an ANSI string.
NTSTATUS
RtlUnicodeStringToAnsiString(
IN OUT PANSI_STRING DestinationString,
IN PUNICODE_STRING SourceString,
IN BOOLEAN AllocateDestinationString
);
RtlAnsiStringToUnicodeString
RtlAnsiStringToUnicodeString converts the given ANSI source string into a Unicode string.
NTSTATUS
RtlAnsiStringToUnicodeString(
IN OUT PUNICODE_STRING DestinationString,
IN PANSI_STRING SourceString,
IN BOOLEAN AllocateDestinationString
);
