发放内核函数库【第一篇】： 常用字符串操作函数

本人驱动小菜，来驱动开发网淘了一个多月了，为免更多小菜和我一样辛苦，贡献部分代码供大家参考。
我们的代码目前是用于minifilter中。
有错误的地方，也望高手斧正。


#ifndef __KFunction_String__
#define __KFunction_String__

#include <fltKernel.h>


/******************************************** 字符串操作函数 *****************************************************/
#define KASS_STRING_TAG 'KStr'

//初始化字符串--指定分配的内存长度(所有的 UNICODE_STRING 字符串对象都需要通过该函数来进行初始化)
VOID KStr_Init(IN OUT PUNICODE_STRING DestinationString, IN USHORT MaxSize){
DestinationString->MaximumLength = MaxSize;
DestinationString->Length = 0;
DestinationString->Buffer = ExAllocatePoolWithTag(NonPagedPool, MaxSize, KASS_STRING_TAG);
RtlZeroMemory(DestinationString->Buffer, MaxSize);
}
//释放字符串( 该字符串由 KStr_Init 函数所初始化的字符串 )，该函数与 KStr_Init 函数成对出现
VOID KStr_Free(IN OUT PUNICODE_STRING string){
if(string==NULL)
return;
try{
if(string->Buffer!=NULL)
ExFreePoolWithTag(string->Buffer, KASS_STRING_TAG);
string->Buffer = NULL;
string->Length = string->MaximumLength = 0;
}__except(EXCEPTION_EXECUTE_HANDLER){
//TODO
}
}
//字符串赋值--克隆
VOID KStr_SetValue_Clone(OUT PUNICODE_STRING DestinationString, IN PUNICODE_STRING SourceString){
RtlCopyUnicodeString(DestinationString, SourceString);
DestinationString->Length = SourceString->Length;
}
//字符串赋值--WCHAR数组
VOID KStr_SetValue_WChar(OUT PUNICODE_STRING DestinationString, IN PWCHAR SourceString){
DestinationString->Length = wcslen(SourceString)*sizeof(WCHAR);
RtlCopyMemory(DestinationString->Buffer, SourceString, DestinationString->Length);
}
//字符串赋值--自然数(10进制数字)
VOID KStr_SetValue_Integer(OUT PUNICODE_STRING DestinationString, IN ULONG Value){
RtlIntegerToUnicodeString(Value, 10, DestinationString);
}
//字符串相加(str1+str2 --> str_result)
VOID KStr_Add(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, OUT PUNICODE_STRING DestinationString){
RtlCopyUnicodeString(DestinationString, str1);
RtlAppendUnicodeStringToString(DestinationString, str2);
}
//3个字符串相加(str1+str2+str3 -> str_result)
VOID KStr_Add3(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, OUT PUNICODE_STRING DestinationString){
RtlCopyUnicodeString(DestinationString, str1);
RtlAppendUnicodeStringToString(DestinationString, str2);
RtlAppendUnicodeStringToString(DestinationString, str3);
}
//4个字符串相加(str1+str2+str3+str4 -> str_result)
VOID KStr_Add4(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, IN PUNICODE_STRING str4, OUT PUNICODE_STRING DestinationString){
RtlCopyUnicodeString(DestinationString, str1);
RtlAppendUnicodeStringToString(DestinationString, str2);
RtlAppendUnicodeStringToString(DestinationString, str3);
RtlAppendUnicodeStringToString(DestinationString, str4);
}
//5个字符串相加
VOID KStr_Add5(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, IN PUNICODE_STRING str3, IN PUNICODE_STRING str4, IN PUNICODE_STRING str5, OUT PUNICODE_STRING DestinationString){
RtlCopyUnicodeString(DestinationString, str1);
RtlAppendUnicodeStringToString(DestinationString, str2);
RtlAppendUnicodeStringToString(DestinationString, str3);
RtlAppendUnicodeStringToString(DestinationString, str4);
RtlAppendUnicodeStringToString(DestinationString, str5);
}


//字符串大写转换
VOID KStr_ToUpperCase(IN PUNICODE_STRING SourceString, OUT PUNICODE_STRING DestinationString){
RtlUpcaseUnicodeString(DestinationString, SourceString, FALSE);
}
//取字符串的子字符串(startIndex为起始位置, stopIndex为终止位置, 包含stopIndex位置的字符)
VOID KStr_Sub(IN PUNICODE_STRING str, IN USHORT startIndex, IN USHORT stopIndex, OUT PUNICODE_STRING str_result){
USHORT startIndex2 = startIndex;
USHORT stopIndex2 = stopIndex;

if(startIndex2<0)
startIndex2 = 0;
if(startIndex2>str->Length-1)
startIndex2 = str->Length-1;
if(stopIndex2<startIndex2)
stopIndex2 = startIndex2;
if(stopIndex2>str->Length-1)
stopIndex2 = str->Length-1;

RtlCopyMemory(str_result->Buffer, str->Buffer+startIndex2/sizeof(WCHAR), stopIndex2-startIndex2+1);
str_result->Length = stopIndex2-startIndex2+1;
}
//判断字符串是否相等
//CaseInSensitive=True 表示不区分大小写
BOOLEAN KStr_Equals(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){
return RtlEqualUnicodeString(str1, str2, CaseInSensitive);
}
//判断字符串 str1 是否以 字符串 str2 开头 CaseInSensitive=True 表示不区分大小写
BOOLEAN KStr_StartWith(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){
UNICODE_STRING tmp;
BOOLEAN result;

if(str1->Length < str2->Length)
return FALSE;
if(str2->Length==0){
return TRUE;
}

KStr_Init(&tmp, str2->Length+1);
KStr_Sub(str1, 0, str2->Length-1, &tmp);
result = KStr_Equals(str2, &tmp, CaseInSensitive);
KStr_Free(&tmp);
return result;
}
//判断字符串 str1 是否以 字符串 str2 结尾 CaseInSensitive=True 表示不区分大小写
BOOLEAN KStr_EndWith(IN PUNICODE_STRING str1, IN PUNICODE_STRING str2, BOOLEAN CaseInSensitive){
UNICODE_STRING tmp;
BOOLEAN result;

if(str1->Length < str2->Length)
return FALSE;
if(str2->Length==0){
return TRUE;
}

KStr_Init(&tmp, str2->Length+1);
KStr_Sub(str1, str1->Length-str2->Length, str1->Length-1, &tmp);
result = KStr_Equals(str2, &tmp, CaseInSensitive);
KStr_Free(&tmp);
return result;
}
//字符串 --> Long
NTSTATUS KStr_ToInteger(IN PUNICODE_STRING str, OUT PULONG Value){
return RtlUnicodeStringToInteger(str, 10, Value);
}
//字符串str中查找子字符串substr(不区分大小写)，如果找到，返回substr在str中的首次出现位置，如果未找到，返回-1
BOOLEAN KStr_IndexOf(IN PUNICODE_STRING str, IN PUNICODE_STRING substr, OUT PUSHORT pos){
USHORT index;

if( KStr_Equals(str, substr, TRUE) ){
*pos = 0;
return TRUE;
}

for(index=0; index+(substr->Length/sizeof(WCHAR)) <= (str->Length/sizeof(WCHAR)); index++) {
if (_wcsnicmp( &str->Buffer[index],
substr->Buffer,
(substr->Length / sizeof(WCHAR)) ) == 0) {
*pos = index*sizeof(WCHAR);
return TRUE;
}
}
return FALSE;
}
//字符串str中查找子字符串substr(不区分大小写)，如果找到，返回substr在str中的最后一次出现位置，如果未找到，返回-1
BOOLEAN KStr_LastIndexOf(IN PUNICODE_STRING str, IN PUNICODE_STRING substr, OUT PUSHORT pos){
USHORT tmpPos;
USHORT tmpPos2;
UNICODE_STRING tmpStr;


if( KStr_IndexOf(str, substr, &tmpPos) ){
KStr_Init(&tmpStr, str->Length - substr->Length - tmpPos + 1);
KStr_Sub(str, tmpPos + substr->Length, str->Length-1, &tmpStr);
if( KStr_LastIndexOf(&tmpStr, substr, &tmpPos2) ){
*pos = tmpPos + substr->Length + tmpPos2;
}else{
*pos = tmpPos;
}
return TRUE;
}else{
return FALSE;
}
}

#endif

Usage:

UNICODE_STRING test1;
UNICODE_STRING test2;
UNICODE_STRING test3;
WCHAR s[] = L"abcdefg";

KStr_Init(&test1, 300);
KStr_Init(&test2, 300);
KStr_Init(&test3, 300);

KStr_SetValue_WChar(&test1, s);
KStr_SetValue_Clone(&test2, &test1);
KStr_Sub(&test1, 0, 3, &test3);

KStr_Free(&test1);
KStr_Free(&test2);
KStr_Free(&test3);

支持一下 很需要