驱动开发 常用字符串操作函数

 

#ifndef __KFunction_String__ 

#define __KFunction_String__ 



#include <fltKernel.h> 





/******************************************** 字符串操作函数 *****************************************************/ 

#define KASS_STRING_TAG 'KStr' 



//初始化字符串--指定分配的内存长度(所有的 UNICODE_STRING 字符串对象都需要通过该函数来进行初始化) 

VOID KStr_Init(IN OUT PUNICODE_STRING DestinationString, IN USHORT MaxSize){ 

DestinationString->MaximumLength = MaxSize; 

DestinationString->Length = 0; 

DestinationString->Buffer = ExAllocatePoolWithTag(NonPagedPool, MaxSize, KASS_STRING_TAG); 

RtlZeroMemory(DestinationString->Buffer, MaxSize); 

} 

//释放字符串( 该字符串由 KStr_Init 函数所初始化的字符串 )，该函数与 KStr_Init 函数成对出现 

VOID KStr_Free(IN OUT PUNICODE_STRING string){ 

if(string==NULL) 

return; 

try{ 

if(string->Buffer!=NULL) 

ExFreePoolWithTag(string->Buffer, KASS_STRING_TAG); 

string->Buffer = NULL; 

string->Length = string->MaximumLength = 0; 

}__except(EXCEPTION_EXECUTE_HANDLER){ 

//TODO 

} 

} 

//字符串赋值--克隆 

VOID KStr_SetValue_Clone(OUT PUNICODE_STRING DestinationString, IN PUNICODE_STRING SourceString){ 

RtlCopyUnicodeString(DestinationString, SourceString); 

DestinationString->Length = SourceString->Length; 

} 

//字符串赋值--WCHAR数组 

VOID KStr_SetValue_WChar(OUT PUNICODE_STRING DestinationString, IN PWCHAR SourceString){ 

DestinationString->Length = wcslen(SourceString)*sizeof(WCHAR); 

RtlCopyMemory(DestinationString->Buffer, SourceString, DestinationString->Length); 

} 

//字符串赋值--自然数(10进制数字) 

VOID KStr_SetValue_Integer(OUT PUNICODE_STRING DestinationString, IN ULONG Value){ 

RtlIntegerToUnicodeString(Value, 10, DestinationString); 

} 

//字符串相加(str1+str2 --> str_result) 

VOID KStr_Add(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, OUT PUNICODE_STRING DestinationString){ 

RtlCopyUnicodeString(DestinationString, str1); 

RtlAppendUnicodeStringToString(DestinationString, str2); 

} 

//3个字符串相加(str1+str2+str3 -> str_result) 

VOID KStr_Add3(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, OUT PUNICODE_STRING DestinationString){ 

RtlCopyUnicodeString(DestinationString, str1); 

RtlAppendUnicodeStringToString(DestinationString, str2); 

RtlAppendUnicodeStringToString(DestinationString, str3); 

} 

//4个字符串相加(str1+str2+str3+str4 -> str_result) 

VOID KStr_Add4(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, IN PUNICODE_STRING str4, OUT PUNICODE_STRING DestinationString){ 

RtlCopyUnicodeString(DestinationString, str1); 

RtlAppendUnicodeStringToString(DestinationString, str2); 

RtlAppendUnicodeStringToString(DestinationString, str3); 

RtlAppendUnicodeStringToString(DestinationString, str4); 

} 

//5个字符串相加 

VOID KStr_Add5(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, IN PUNICODE_STRING str4, IN PUNICODE_STRING str5, OUT PUNICODE_STRING DestinationString){ 

RtlCopyUnicodeString(DestinationString, str1); 

RtlAppendUnicodeStringToString(DestinationString, str2); 

RtlAppendUnicodeStringToString(DestinationString, str3); 

RtlAppendUnicodeStringToString(DestinationString, str4); 

RtlAppendUnicodeStringToString(DestinationString, str5); 

} 





//字符串大写转换 

VOID KStr_ToUpperCase(IN PUNICODE_STRING SourceString, OUT PUNICODE_STRING DestinationString){ 

RtlUpcaseUnicodeString(DestinationString, SourceString, FALSE); 

} 

//取字符串的子字符串(startIndex为起始位置, stopIndex为终止位置, 包含stopIndex位置的字符) 

VOID KStr_Sub(IN PUNICODE_STRING str, IN USHORT startIndex, IN USHORT stopIndex, OUT PUNICODE_STRING str_result){ 

USHORT startIndex2 = startIndex; 

USHORT stopIndex2 = stopIndex; 



if(startIndex2<0) 

startIndex2 = 0; 

if(startIndex2>str->Length-1) 

startIndex2 = str->Length-1; 

if(stopIndex2<startIndex2) 

stopIndex2 = startIndex2; 

if(stopIndex2>str->Length-1) 

stopIndex2 = str->Length-1; 



RtlCopyMemory(str_result->Buffer, str->Buffer+startIndex2/sizeof(WCHAR), stopIndex2-startIndex2+1); 

str_result->Length = stopIndex2-startIndex2+1; 

} 

//判断字符串是否相等 

//CaseInSensitive=True 表示不区分大小写 

BOOLEAN KStr_Equals(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){ 

return RtlEqualUnicodeString(str1, str2, CaseInSensitive); 

} 

//判断字符串 str1 是否以 字符串 str2 开头 CaseInSensitive=True 表示不区分大小写 

BOOLEAN KStr_StartWith(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){ 

UNICODE_STRING tmp; 

BOOLEAN result; 



if(str1->Length < str2->Length) 

return FALSE; 

if(str2->Length==0){ 

return TRUE; 

} 



KStr_Init(&tmp, str2->Length+1); 

KStr_Sub(str1, 0, str2->Length-1, &tmp); 

result = KStr_Equals(str2, &tmp, CaseInSensitive); 

KStr_Free(&tmp); 

return result; 

} 

//判断字符串 str1 是否以 字符串 str2 结尾 CaseInSensitive=True 表示不区分大小写 

BOOLEAN KStr_EndWith(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){ 

UNICODE_STRING tmp; 

BOOLEAN result; 



if(str1->Length < str2->Length) 

return FALSE; 

if(str2->Length==0){ 

return TRUE; 

} 



KStr_Init(&tmp, str2->Length+1); 

KStr_Sub(str1, str1->Length-str2->Length, str1->Length-1, &tmp); 

result = KStr_Equals(str2, &tmp, CaseInSensitive); 

KStr_Free(&tmp); 

return result; 

} 

//字符串 --> Long 

NTSTATUS KStr_ToInteger(IN PUNICODE_STRING str, OUT PULONG Value){ 

return RtlUnicodeStringToInteger(str, 10, Value); 

} 

//字符串str中查找子字符串substr(不区分大小写)，如果找到，返回substr在str中的首次出现位置，如果未找到，返回-1 

BOOLEAN KStr_IndexOf(IN PUNICODE_STRING str, IN PUNICODE_STRING substr, OUT PUSHORT pos){ 

USHORT index; 



if( KStr_Equals(str, substr, TRUE) ){ 

*pos = 0; 

return TRUE; 

} 



for(index=0; index+(substr->Length/sizeof(WCHAR)) <= (str->Length/sizeof(WCHAR)); index++) { 

if (_wcsnicmp( &str->Buffer[index], 

substr->Buffer, 

(substr->Length / sizeof(WCHAR)) ) == 0) { 

*pos = index*sizeof(WCHAR); 

return TRUE; 

} 

} 

return FALSE; 

} 

//字符串str中查找子字符串substr(不区分大小写)，如果找到，返回substr在str中的最后一次出现位置，如果未找到，返回-1 

BOOLEAN KStr_LastIndexOf(IN PUNICODE_STRING str, IN PUNICODE_STRING substr, OUT PUSHORT pos){ 

USHORT tmpPos; 

USHORT tmpPos2; 

UNICODE_STRING tmpStr; 





if( KStr_IndexOf(str, substr, &tmpPos) ){ 

KStr_Init(&tmpStr, str->Length - substr->Length - tmpPos + 1); 

KStr_Sub(str, tmpPos + substr->Length, str->Length-1, &tmpStr); 

if( KStr_LastIndexOf(&tmpStr, substr, &tmpPos2) ){ 

*pos = tmpPos + substr->Length + tmpPos2; 

}else{ 

*pos = tmpPos; 

} 

return TRUE; 

}else{ 

return FALSE; 

} 

} 



#endif 

 

后来又找的一个，加上去

BOOLEAN 
SpyFindSubString ( 
    __in PUNICODE_STRING String, 
    __in PUNICODE_STRING SubString 
    ) 
/*++ 

Routine Description: 
    This routine looks to see if SubString is a substring of String.  This 
    does a case insensitive test. 

Arguments: 
    String - the string to search in 
    SubString - the substring to find in String 

Return Value: 
    Returns TRUE if the substring is found in string and FALSE otherwise. 

--*/ 
{ 
    ULONG index; 

    // 
    //  First, check to see if the strings are equal. 
    // 

    if (RtlEqualUnicodeString( String, SubString, TRUE )) { 

        return TRUE; 
    } 

    // 
    //  String and SubString aren't equal, so now see if SubString 
    //  is in String any where. 
    // 

    for (index = 0; 
        index + (SubString->Length/sizeof(WCHAR)) <= (String->Length/sizeof(WCHAR)); 
        index++) { 

        if (_wcsnicmp( &String->Buffer[index], 
                      SubString->Buffer, 
                      (SubString->Length / sizeof(WCHAR)) ) == 0) { 

            // 
            //  SubString is found in String, so return TRUE. 
            // 

            return TRUE; 
        } 
    } 

    return FALSE; 
}