UNICODE_STRING到标准字符串的转换 [英] UNICODE_STRING to std String Conversion

问题描述

我正在使用 pFileObject-> FileName 来获取在内核模式过滤器驱动程序中打开的文件的名称.此文件名以

I am using pFileObject->FileName to get the name of file opened in a kernel mode filter driver.This file name returned by this is in the form of UNICODE_STRING. I want to convert it into std String. What is the method ??? Please do provide example if possible... Below is the code

NTSTATUS FsFilterDispatchCreate(
    __in PDEVICE_OBJECT DeviceObject,
    __in PIRP           Irp
    )
{
    PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;

    DbgPrint("%wZ\n", &pFileObject->FileName);

    return FsFilterDispatchPassThrough(DeviceObject, Irp);
}

推荐答案

我同意汉斯的评论.使std ::类在Windows内核模式下工作非常困难，即使不是不可能.默认的WinDDK环境是C而不是C ++.最好的选择是将UNICODE_STRING转换为以NULL终止的ANSI字符串. (您可以使用DbgPrint(％s" ...)等进行打印).参见下面的示例.

I agree with Hans' comment. Making std:: classes work in Windows kernel mode is extremely difficult if not impossible. The default WinDDK environment is C rather than C++. Your best bet is to convert UNICODE_STRING to ANSI null-terminated string. (You can print it with DbgPrint("%s"...) etc). See example below.

UNICODE_STRING tmp;

// ...

ANSI_STRING dest;
ULONG unicodeBufferSize = tmp.Length;
// Length of unicode string in bytes must be enough to keep ANSI string
dest.Buffer = (PCHAR)ExAllocatePool(NonPagedPool, unicodeBufferSize+1);
// check for allocation failure... 
dest.Length = 0;
dest.MaximumLength = unicodeBufferSize+1;

RtlUnicodeStringToAnsiString(&dest, &tmp, FALSE);
// check for failure...
dest.Buffer[dest.Length] = 0; // now we get it in dest.Buffer

这篇关于UNICODE_STRING到标准字符串的转换的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！