驱动开发 常用字符串操作函数

#ifndef __KFunction_String__

#define __KFunction_String__

#include <fltKernel.h>

/******************************************** 字符串操作函数 *****************************************************/

#define KASS_STRING_TAG 'KStr'

//初始化字符串--指定分配的内存长度(所有的 UNICODE_STRING 字符串对象都需要通过该函数来进行初始化)

VOID KStr_Init(IN OUT PUNICODE_STRING DestinationString, IN USHORT MaxSize){

DestinationString->MaximumLength = MaxSize;

DestinationString->Length = 0;

DestinationString->Buffer = ExAllocatePoolWithTag(NonPagedPool, MaxSize, KASS_STRING_TAG);

RtlZeroMemory(DestinationString->Buffer, MaxSize);

}

//释放字符串( 该字符串由 KStr_Init 函数所初始化的字符串 )，该函数与 KStr_Init 函数成对出现

VOID KStr_Free(IN OUT PUNICODE_STRING string){

if(string==NULL)

return;

try{

if(string->Buffer!=NULL)

ExFreePoolWithTag(string->Buffer, KASS_STRING_TAG);

string->Buffer = NULL;

string->Length = string->MaximumLength = 0;

}__except(EXCEPTION_EXECUTE_HANDLER){

//TODO

}

}

//字符串赋值--克隆

VOID KStr_SetValue_Clone(OUT PUNICODE_STRING DestinationString, IN PUNICODE_STRING SourceString){

RtlCopyUnicodeString(DestinationString, SourceString);

DestinationString->Length = SourceString->Length;

}

//字符串赋值--WCHAR数组

VOID KStr_SetValue_WChar(OUT PUNICODE_STRING DestinationString, IN PWCHAR SourceString){

DestinationString->Length = wcslen(SourceString)*sizeof(WCHAR);

RtlCopyMemory(DestinationString->Buffer, SourceString, DestinationString->Length);

}

//字符串赋值--自然数(10进制数字)

VOID KStr_SetValue_Integer(OUT PUNICODE_STRING DestinationString, IN ULONG Value){

RtlIntegerToUnicodeString(Value, 10, DestinationString);

}

//字符串相加(str1+str2 --> str_result)

VOID KStr_Add(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, OUT PUNICODE_STRING DestinationString){

RtlCopyUnicodeString(DestinationString, str1);

RtlAppendUnicodeStringToString(DestinationString, str2);

}

//3个字符串相加(str1+str2+str3 -> str_result)

VOID KStr_Add3(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, OUT PUNICODE_STRING DestinationString){

RtlCopyUnicodeString(DestinationString, str1);

RtlAppendUnicodeStringToString(DestinationString, str2);

RtlAppendUnicodeStringToString(DestinationString, str3);

}

//4个字符串相加(str1+str2+str3+str4 -> str_result)

VOID KStr_Add4(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, IN PUNICODE_STRING str4, OUT PUNICODE_STRING DestinationString){

RtlCopyUnicodeString(DestinationString, str1);

RtlAppendUnicodeStringToString(DestinationString, str2);

RtlAppendUnicodeStringToString(DestinationString, str3);

RtlAppendUnicodeStringToString(DestinationString, str4);

}

//5个字符串相加

VOID KStr_Add5(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, IN PUNICODE_STRING str4, IN PUNICODE_STRING str5, OUT PUNICODE_STRING DestinationString){

RtlCopyUnicodeString(DestinationString, str1);

RtlAppendUnicodeStringToString(DestinationString, str2);

RtlAppendUnicodeStringToString(DestinationString, str3);

RtlAppendUnicodeStringToString(DestinationString, str4);

RtlAppendUnicodeStringToString(DestinationString, str5);

}

//字符串大写转换

VOID KStr_ToUpperCase(IN PUNICODE_STRING SourceString, OUT PUNICODE_STRING DestinationString){

RtlUpcaseUnicodeString(DestinationString, SourceString, FALSE);

}

//取字符串的子字符串(startIndex为起始位置, stopIndex为终止位置, 包含stopIndex位置的字符)

VOID KStr_Sub(IN PUNICODE_STRING str, IN USHORT startIndex, IN USHORT stopIndex, OUT PUNICODE_STRING str_result){

USHORT startIndex2 = startIndex;

USHORT stopIndex2 = stopIndex;

if(startIndex2<0)

startIndex2 = 0;

if(startIndex2>str->Length-1)

startIndex2 = str->Length-1;

if(stopIndex2<startIndex2)

stopIndex2 = startIndex2;

if(stopIndex2>str->Length-1)

stopIndex2 = str->Length-1;

RtlCopyMemory(str_result->Buffer, str->Buffer+startIndex2/sizeof(WCHAR), stopIndex2-startIndex2+1);

str_result->Length = stopIndex2-startIndex2+1;

}

//判断字符串是否相等

//CaseInSensitive=True 表示不区分大小写

BOOLEAN KStr_Equals(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){

return RtlEqualUnicodeString(str1, str2, CaseInSensitive);

}

//判断字符串 str1 是否以 字符串 str2 开头 CaseInSensitive=True 表示不区分大小写

BOOLEAN KStr_StartWith(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){

UNICODE_STRING tmp;

BOOLEAN result;

if(str1->Length < str2->Length)

return FALSE;

if(str2->Length==0){

return TRUE;

}

KStr_Init(&tmp, str2->Length+1);

KStr_Sub(str1, 0, str2->Length-1, &tmp);

result = KStr_Equals(str2, &tmp, CaseInSensitive);

KStr_Free(&tmp);

return result;

}

//判断字符串 str1 是否以 字符串 str2 结尾 CaseInSensitive=True 表示不区分大小写

BOOLEAN KStr_EndWith(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){

UNICODE_STRING tmp;

BOOLEAN result;

if(str1->Length < str2->Length)

return FALSE;

if(str2->Length==0){

return TRUE;

}

KStr_Init(&tmp, str2->Length+1);

KStr_Sub(str1, str1->Length-str2->Length, str1->Length-1, &tmp);

result = KStr_Equals(str2, &tmp, CaseInSensitive);

KStr_Free(&tmp);

return result;

}

//字符串 --> Long

NTSTATUS KStr_ToInteger(IN PUNICODE_STRING str, OUT PULONG Value){

return RtlUnicodeStringToInteger(str, 10, Value);

}

//字符串str中查找子字符串substr(不区分大小写)，如果找到，返回substr在str中的首次出现位置，如果未找到，返回-1

BOOLEAN KStr_IndexOf(IN PUNICODE_STRING str, IN PUNICODE_STRING substr, OUT PUSHORT pos){

USHORT index;

if( KStr_Equals(str, substr, TRUE) ){

*pos = 0;

return TRUE;

}

for(index=0; index+(substr->Length/sizeof(WCHAR)) <= (str->Length/sizeof(WCHAR)); index++) {

if (_wcsnicmp( &str->Buffer[index],

substr->Buffer,

(substr->Length / sizeof(WCHAR)) ) == 0) {

*pos = index*sizeof(WCHAR);

return TRUE;

}

}

return FALSE;

}

//字符串str中查找子字符串substr(不区分大小写)，如果找到，返回substr在str中的最后一次出现位置，如果未找到，返回-1

BOOLEAN KStr_LastIndexOf(IN PUNICODE_STRING str, IN PUNICODE_STRING substr, OUT PUSHORT pos){

USHORT tmpPos;

USHORT tmpPos2;

UNICODE_STRING tmpStr;

if( KStr_IndexOf(str, substr, &tmpPos) ){

KStr_Init(&tmpStr, str->Length - substr->Length - tmpPos + 1);

KStr_Sub(str, tmpPos + substr->Length, str->Length-1, &tmpStr);

if( KStr_LastIndexOf(&tmpStr, substr, &tmpPos2) ){

*pos = tmpPos + substr->Length + tmpPos2;

}else{

*pos = tmpPos;

}

return TRUE;

}else{

return FALSE;

}

}

#endif

BOOLEAN
SpyFindSubString (
__in PUNICODE_STRING String,
__in PUNICODE_STRING SubString
)
/*++

Routine Description:
This routine looks to see if SubString is a substring of String.  This
does a case insensitive test.

Arguments:
String - the string to search in
SubString - the substring to find in String

Return Value:
Returns TRUE if the substring is found in string and FALSE otherwise.

--*/
{
ULONG index;

//
//  First, check to see if the strings are equal.
//

if (RtlEqualUnicodeString( String, SubString, TRUE )) {

return TRUE;
}

//
//  String and SubString aren't equal, so now see if SubString
//  is in String any where.
//

for (index = 0;
index + (SubString->Length/sizeof(WCHAR)) <= (String->Length/sizeof(WCHAR));
index++) {

if (_wcsnicmp( &String->Buffer[index],
SubString->Buffer,
(SubString->Length / sizeof(WCHAR)) ) == 0) {

//
//  SubString is found in String, so return TRUE.
//

return TRUE;
}
}

return FALSE;
}