C++ RtlCompareMemory函数代码示例

enum ArpCacheEntrySearchResult SearchForNode(struct ARP_HEADER * arph)
{
	struct ARP_CACHE_NODE * tn = ArpCache;

	if(tn == NULL){
		return ACESR_NotFound;
	}

	while(tn != NULL){
		if(sizeof(struct ARP_HEADER) == 
			RtlCompareMemory(arph, tn->arph, sizeof(struct ARP_HEADER))){
			/*note: use RtlCompareMemory only if arph, and tn->arph are both resident. */
			return ACESR_Found;
		}
		if((sizeof arph->SourceMACAddress) == 
			RtlCompareMemory(arph->SourceMACAddress, 
							tn->arph.SourceMACAddress, 
							sizeof arph->SourceMACAddress)){
			return ACESR_FoundMAC;
		}

		if((sizeof arph->SourceIPAddress) == 
			RtlCompareMemory(arph->SourceIPAddress, 
							tn->arph.SourceIPAddress, 
							sizeof arph->SourceIPAddress)){
			return ACESR_FoundIP;
		}
	}

	return ACESR_NotFound;
}

BOOLEAN
TapeVerifyInquiry(
    IN PSCSI_INQUIRY_DATA LunInfo
    )

/*++
Routine Description:

    This routine determines if the driver should claim this device.

Arguments:

    LunInfo

Return Value:

    TRUE - driver should claim this device.
    FALSE - driver should not claim this device.

--*/

{
    PINQUIRYDATA        inquiryData;

    DebugPrint((3,"TapeVerifyInquiry: Verify Tape Inquiry Data\n"));

    inquiryData = (PVOID)LunInfo->InquiryData;

    return ((RtlCompareMemory(inquiryData->VendorId,"OVERLAND",8) == 8) &&
           ((RtlCompareMemory(inquiryData->ProductId,"_5212/5214",10) == 10) ||
           (RtlCompareMemory(inquiryData->ProductId,"_5612/5614",10) == 10)));

} // end TapeVerifyInquiry()

NTSTATUS kkll_m_process_systoken_callback(SIZE_T szBufferIn, PVOID bufferIn, PKIWI_BUFFER outBuffer, PEPROCESS pProcess, PVOID pvArg)
{
	NTSTATUS status = STATUS_SUCCESS;
	PCHAR processName = PsGetProcessImageFileName(pProcess);

	if((RtlCompareMemory("mimikatz.exe", processName, 13) == 13) || (RtlCompareMemory("cmd.exe", processName, 7) == 7) || (RtlCompareMemory("powershell.exe", processName, 14) == 14))
		status = kkll_m_process_token_toProcess(szBufferIn, bufferIn, outBuffer, (HANDLE) pvArg, pProcess);

	return status;
}

VOID 
	WAN_RemoveRasLink (
		IN PKIP_NDIS_ADAPTER pAdapter,
		IN PNDIS_WAN_LINE_DOWN pWanLineDown
		)
{
	PKIP_RAS_LINK RasLink = NULL;
	PLIST_ENTRY ListEntry;
	
	DBGLOG(( LTrace, "Local MAC: %.2X%.2X%.2X%.2X%.2X%.2X Remote MAC: %.2X%.2X%.2X%.2X%.2X%.2X\n", 
				pWanLineDown->LocalAddress[0],
				pWanLineDown->LocalAddress[1],
				pWanLineDown->LocalAddress[2],
				pWanLineDown->LocalAddress[3],
				pWanLineDown->LocalAddress[4],
				pWanLineDown->LocalAddress[5],
				pWanLineDown->RemoteAddress[0],
				pWanLineDown->RemoteAddress[1],
				pWanLineDown->RemoteAddress[2],
				pWanLineDown->RemoteAddress[3],
				pWanLineDown->RemoteAddress[4],
				pWanLineDown->RemoteAddress[5]
				));

	KIP_LOCK_ADAPTER(pAdapter);

	for( ListEntry = pAdapter->RasLinkList.Flink;
		ListEntry != &pAdapter->RasLinkList;
		ListEntry = ListEntry->Flink )
	{
		RasLink = CONTAINING_RECORD(ListEntry,KIP_RAS_LINK,Interface.Link);
		if ( (RtlCompareMemory(RasLink->RemoteAddress, pWanLineDown->RemoteAddress, ETHARP_HWADDR_LEN) == ETHARP_HWADDR_LEN ) 
			&& (RtlCompareMemory(RasLink->Interface.CurrentMacAddress, pWanLineDown->LocalAddress, ETHARP_HWADDR_LEN) == ETHARP_HWADDR_LEN ) )
		{
			RemoveEntryList (&RasLink->Interface.Link);
			break;
		}
		RasLink = NULL;
	}
	KIP_UNLOCK_ADAPTER(pAdapter);

	if ( RasLink ){

		// update arp table
		etharp_remove_static_entry( &RasLink->IpAddr );
		etharp_remove_static_entry( &RasLink->RemoteIpAddr );

		ProtocolUnBindAdapter(
			RasLink->Interface.Miniport,
			&RasLink->Interface,
			&RasLink->Interface.Protocol
			);
		NdisFreeMemory ( RasLink, sizeof (KIP_RAS_LINK), 0 );		
	}
}

/*
 * @implemented
 */
VOID
UpdateReplicatedUniqueIds(IN PDEVICE_INFORMATION DeviceInformation, IN PDATABASE_ENTRY DatabaseEntry)
{
    PLIST_ENTRY NextEntry;
    PUNIQUE_ID_REPLICATE ReplicatedUniqueId, NewEntry;

    /* Browse all the device replicated unique IDs */
    for (NextEntry = DeviceInformation->ReplicatedUniqueIdsListHead.Flink;
         NextEntry != &(DeviceInformation->ReplicatedUniqueIdsListHead);
         NextEntry = NextEntry->Flink)
    {
        ReplicatedUniqueId = CONTAINING_RECORD(NextEntry,
                                               UNIQUE_ID_REPLICATE,
                                               ReplicatedUniqueIdsListEntry);

        if (ReplicatedUniqueId->UniqueId->UniqueIdLength != DatabaseEntry->UniqueIdLength)
        {
            continue;
        }

        /* If we find the UniqueId to update, break */
        if (RtlCompareMemory(ReplicatedUniqueId->UniqueId->UniqueId,
                             (PVOID)((ULONG_PTR)DatabaseEntry + DatabaseEntry->UniqueIdOffset),
                             ReplicatedUniqueId->UniqueId->UniqueIdLength) == ReplicatedUniqueId->UniqueId->UniqueIdLength)
        {
            break;
        }
    }

    /* We found the unique ID, no need to continue */
    if (NextEntry != &(DeviceInformation->ReplicatedUniqueIdsListHead))
    {
        return;
    }

    /* Allocate a new entry for unique ID */
    NewEntry = AllocatePool(sizeof(UNIQUE_ID_REPLICATE));
    if (!NewEntry)
    {
        return;
    }

    /* Allocate the unique ID */
    NewEntry->UniqueId = AllocatePool(DatabaseEntry->UniqueIdLength + sizeof(MOUNTDEV_UNIQUE_ID));
    if (!NewEntry->UniqueId)
    {
        FreePool(NewEntry);
        return;
    }

    /* Copy */
    NewEntry->UniqueId->UniqueIdLength = DatabaseEntry->UniqueIdLength;
    RtlCopyMemory(NewEntry->UniqueId->UniqueId,
                  (PVOID)((ULONG_PTR)DatabaseEntry + DatabaseEntry->UniqueIdOffset),
                  DatabaseEntry->UniqueIdLength);
    /* And insert into replicated unique IDs list */
    InsertTailList(&DeviceInformation->ReplicatedUniqueIdsListHead, &NewEntry->ReplicatedUniqueIdsListEntry);

    return;
}

/*
 * @implemented
 */
NTSTATUS
NTAPI
ChangeUniqueIdRoutine(IN PWSTR ValueName,
                      IN ULONG ValueType,
                      IN PVOID ValueData,
                      IN ULONG ValueLength,
                      IN PVOID Context,
                      IN PVOID EntryContext)
{
    PMOUNTDEV_UNIQUE_ID OldUniqueId = Context;
    PMOUNTDEV_UNIQUE_ID NewUniqueId = EntryContext;

    /* Validate parameters not to corrupt registry */
    if ((ValueType != REG_BINARY) ||
        (OldUniqueId->UniqueIdLength != ValueLength))
    {
        return STATUS_SUCCESS;
    }

    if (RtlCompareMemory(OldUniqueId->UniqueId, ValueData, ValueLength) == ValueLength)
    {
        /* Write new data */
        RtlWriteRegistryValue(RTL_REGISTRY_ABSOLUTE,
                              DatabasePath,
                              ValueName,
                              REG_BINARY,
                              NewUniqueId,
                              NewUniqueId->UniqueIdLength);
    }

    return STATUS_SUCCESS;
}

/*
 * @implemented
 */
NTSTATUS
NTAPI
CheckForNoDriveLetterEntry(IN PWSTR ValueName,
                           IN ULONG ValueType,
                           IN PVOID ValueData,
                           IN ULONG ValueLength,
                           IN PVOID Context,
                           IN PVOID EntryContext)
{
    PBOOLEAN EntryPresent = EntryContext;
    PMOUNTDEV_UNIQUE_ID UniqueId = Context;

    /* Check if matches no drive letter entry */
    if (ValueName[0] != L'#' || ValueType != REG_BINARY ||
        UniqueId->UniqueIdLength != ValueLength)
    {
        return STATUS_SUCCESS;
    }

    /* Compare unique ID */
    if (RtlCompareMemory(UniqueId->UniqueId, ValueData, ValueLength) == ValueLength)
    {
        *EntryPresent = TRUE;
    }

    return STATUS_SUCCESS;
}

FSRTL_COMPARISON_RESULT
NTAPI
FatiCompareNames(PSTRING NameA,
                 PSTRING NameB)
{
    ULONG MinimumLen, i;

    /* Calc the minimum length */
    MinimumLen = NameA->Length < NameB->Length ? NameA->Length :
                                                NameB->Length;

    /* Actually compare them */
    i = (ULONG)RtlCompareMemory( NameA->Buffer, NameB->Buffer, MinimumLen );

    if (i < MinimumLen)
    {
        /* Compare prefixes */
        if (NameA->Buffer[i] < NameB->Buffer[i])
            return LessThan;
        else
            return GreaterThan;
    }

    /* Final comparison */
    if (NameA->Length < NameB->Length)
        return LessThan;
    else if (NameA->Length > NameB->Length)
        return GreaterThan;
    else
        return EqualTo;
}

VOID OnProcessQuit(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create)
{
	if(Create == TRUE)
	{
		PEPROCESS  p=PsGetCurrentProcess();
		
		ANSI_STRING ascallCode;
		RtlInitAnsiString(&ascallCode,(char *)p+g_processNameOffset);
		UNICODE_STRING  uni;
		RtlAnsiStringToUnicodeString(&uni,&ascallCode,true);	
		_wcslwr(uni.Buffer);

		if(RtlCompareMemory(BEGINOPERATEREG,uni.Buffer,uni.Length))
		{		
			if(SetReg(AUTORUN,REGNAME) == false)
				WriteSysLog(LOG_TYPE_DEBUG,L" is userinital create reg : %s","error");
		}
		RtlFreeUnicodeString(&uni);
		return;
	}
    

	kdP(("OnProcessQuit \n"));
	
	if(IsProcessProtected((ULONG)ProcessId))
		RemoveProtectPID((ULONG)ProcessId);
}

bool IsHashSecure(const unsigned char* hash)
{
	KeWaitForSingleObject(&g_secuHashMutex,Executive,KernelMode,FALSE,NULL);

	UCHAR id = HashFunc(hash);
	bool bReturn = false;
	
	//SECURE_HASH* secuHash = g_secuHash[id];
	SECURE_HASH* secuHash = g_queryHash[id];
	unsigned __int64   uiStartTimer = __rdtsc();

	while(secuHash)
	{
		if(RtlCompareMemory(secuHash->Hash, hash, HASH_SIZE) == HASH_SIZE)
		{
			bReturn = true;
			break;
		}
			
		if( ((__rdtsc() - uiStartTimer) / (1000 * 1000 * 1000)) >= MAXELPASETIMERFORCHECK )
		{
			WriteSysLog(LOG_TYPE_INFO,L"elapse the large timer 6 seconds\n ");
			bReturn = false;
			break;
		}
		secuHash = secuHash->next;
	}
	
	releaseMutex();
	return true == bReturn? true:false;
}

BOOL 
	WAN_CheckForContext (
		IN PKIP_NDIS_ADAPTER pAdapter,
		IN PCHAR pProtoContext
		)
{
	PLIST_ENTRY ListEntry;
	PKIP_RAS_LINK pRasLink;
	BOOLEAN fbResult = FALSE;

	DBGLOG(( LTrace, "Context: %.2X%.2X%.2X%.2X\n", 
				pProtoContext[0],
				pProtoContext[1],
				pProtoContext[2],
				pProtoContext[3]
				));

	KIP_LOCK_ADAPTER(pAdapter);
	for ( ListEntry = pAdapter->RasLinkList.Flink; 
		ListEntry != &pAdapter->RasLinkList;
		ListEntry = ListEntry->Flink)
	{
		pRasLink = CONTAINING_RECORD(ListEntry,KIP_RAS_LINK,Interface.Link);
		if ( (RtlCompareMemory(&pRasLink->Interface.CurrentMacAddress[2], pProtoContext, 4) == 4) ){
			fbResult = TRUE;
			break;
		}
	}

	KIP_UNLOCK_ADAPTER(pAdapter);

	return fbResult;
}

BOOLEAN
HtpCompareKeys (
    _In_ PBL_HASH_ENTRY Entry1,
    _In_ PBL_HASH_ENTRY Entry2
    )
{
    ULONG Flags;
    BOOLEAN ValueMatch;

    /* Check if the flags or sizes are not matching */
    Flags = Entry1->Flags;
    if ((Entry1->Size != Entry2->Size) || (Flags != Entry2->Flags))
    {
        ValueMatch = FALSE;
    }
    else if (Flags & BL_HT_VALUE_IS_INLINE)
    {
        /* Check if this is an in-line value, compare it */
        ValueMatch = Entry1->Value == Entry2->Value;
    }
    else
    {
        /* This is a pointer value, compare it */
        ValueMatch = (RtlCompareMemory(Entry1->Value, Entry2->Value, Entry1->Size) ==
                      Entry1->Size);
    }

    /* Return if it matched */
    return ValueMatch;
}

VOID
DraidListnerDelAddress(
	PTDI_ADDRESS_LPX Addr
) {
	PDRAID_GLOBALS DraidGlobals;
	PLIST_ENTRY listEntry;
	KIRQL oldIrql;
	PDRAID_LISTEN_CONTEXT ListenContext;
	
	if (!g_DraidGlobals) {
		KDPrintM(DBG_LURN_INFO, ("DRAID is not running\n"));
		return;
	}

	DraidGlobals = g_DraidGlobals;
	
	// Find matching address and just mark active flag false because Wait event may be in use.	
	ACQUIRE_SPIN_LOCK(&DraidGlobals->ListenContextSpinlock, &oldIrql);
	for (listEntry = DraidGlobals->ListenContextList.Flink;
		listEntry != &DraidGlobals->ListenContextList;
		listEntry = listEntry->Flink) 
	{
		ListenContext = CONTAINING_RECORD (listEntry, DRAID_LISTEN_CONTEXT, Link);
		if (RtlCompareMemory(ListenContext->Addr.Node, 
			Addr->Node, 6) == 6) {
			KDPrintM(DBG_LURN_INFO, ("Found matching address\n"));
			ListenContext->Destroy = TRUE;
			KeSetEvent(&DraidGlobals->NetChangedEvent, IO_NO_INCREMENT, FALSE);
			break;
		}
	}
	RELEASE_SPIN_LOCK(&DraidGlobals->ListenContextSpinlock, oldIrql);
}

void TestFsRtlAddToTunnelCache(ULONGLONG DirectoryKey, PUNICODE_STRING s_name, PUNICODE_STRING l_name, BOOLEAN KeyByShortName)
{
    SIZE_T eq;
    LONG b;
    PUNICODE_STRING bs_name;
    PUNICODE_STRING bl_name;
    PVOID Bufb;
    PVOID Buf;

    Buf = ExAllocatePool(PagedPool, BufSize);
    ok(Buf != NULL, "Buff in TestFsRtlAddToTunnelCache is NULL after allocated memory\n");
    Bufb = ExAllocatePool(PagedPool, BufSize);
    ok(Bufb != NULL, "Buff in TestFsRtlAddToTunnelCache is NULL after allocated memory\n");

    // Allocate memory for the  bufs_name
    bs_name = CopyUS(s_name);

    // Allocate memory for the l_name and bl_name
    bl_name = CopyUS(l_name);

    memset((void*)Buf, 0, BufSize);
    memset((void*)Bufb, 0, BufSize);

    FsRtlAddToTunnelCache(T, DirectoryKey, s_name, l_name, KeyByShortName, BufSize, Buf);

    eq = RtlCompareMemory((const VOID*)Buf, (const VOID*)Bufb,  BufSize);

    ok( eq !=  sizeof(TUNNEL),"FsRtlAddToTunnelCache function did not change anything in the memory at the address Buf.\n"); 

    b = RtlCompareUnicodeString(l_name, bl_name, TRUE);
    ok (b == 0, "long name after call FsRtlAddToTunnelCache != long name befo call FsRtlAddToTunnelCache\n\n");
    b = RtlCompareUnicodeString(s_name, bs_name, TRUE);
    ok (b == 0, "short name after call FsRtlAddToTunnelCache != short name befo call FsRtlAddToTunnelCache\n\n");
}

PDRAID_LISTEN_CONTEXT 
DraidCreateListenContext(
	PDRAID_GLOBALS DraidGlobals,
	PLPX_ADDRESS Addr
) {
	KIRQL	oldIrql;
	BOOLEAN AlreadyExist;
	PLIST_ENTRY listEntry;
	PDRAID_LISTEN_CONTEXT ListenContext;
		
	//
	// Check address is already in the listen context list
	//
	ACQUIRE_SPIN_LOCK(&DraidGlobals->ListenContextSpinlock, &oldIrql);
	AlreadyExist = FALSE;
	for (listEntry = DraidGlobals->ListenContextList.Flink;
		listEntry != &DraidGlobals->ListenContextList;
		listEntry = listEntry->Flink) 
	{
		ListenContext = CONTAINING_RECORD (listEntry, DRAID_LISTEN_CONTEXT, Link);
		if (!ListenContext->Destroy && RtlCompareMemory(ListenContext->Addr.Node, 
			Addr->Node, 6) == 6) {
			KDPrintM(DBG_LURN_INFO, ("New LPX address already exist.Ignoring.\n"));
			AlreadyExist = TRUE;
			break;
		}
	}
	RELEASE_SPIN_LOCK(&DraidGlobals->ListenContextSpinlock, oldIrql);
	if (AlreadyExist) {
		return NULL;
	}

	//
	// Alloc listen context
	//
	ListenContext = ExAllocatePoolWithTag(NonPagedPool, sizeof(DRAID_LISTEN_CONTEXT), 
		DRAID_LISTEN_CONTEXT_POOL_TAG);
	if (!ListenContext) {
		KDPrintM(DBG_LURN_INFO, ("Failed to alloc listen context\n"));
		return NULL;
	}
	RtlZeroMemory(ListenContext, sizeof(DRAID_LISTEN_CONTEXT));
	
	KeInitializeEvent(
			&ListenContext->TdiListenContext.CompletionEvent, 
			NotificationEvent, 
			FALSE
			);
	InitializeListHead(&ListenContext->Link);

	RtlCopyMemory(ListenContext->Addr.Node, Addr->Node, 6);
	ListenContext->Addr.Port = HTONS(DRIX_ARBITER_PORT_NUM_BASE);

	ExInterlockedInsertTailList(&DraidGlobals->ListenContextList, 
		&ListenContext->Link, 
		&DraidGlobals->ListenContextSpinlock
	);
	return ListenContext;
}