C++ RtlEqualUnicodeString函数代码示例

BOOL TryIsProbeProcess(PCWSTR ApplicationName, PWSTR CommandLine)
{
    UNICODE_STRING  AppName, CmdLine;

    RtlInitUnicodeString(&AppName, ApplicationName);
    RtlInitUnicodeString(&CmdLine, CommandLine);

    SEH_TRY
    {
        if (CmdLine.Length < ProbeCommandLine.Length)
            return FALSE;

        CmdLine.Buffer = PtrAdd(CmdLine.Buffer, CmdLine.Length - ProbeCommandLine.Length);
        CmdLine.Length = ProbeCommandLine.Length;

        if (!RtlEqualUnicodeString(&CmdLine, &ProbeCommandLine, TRUE))
            return FALSE;

        if (!RtlEqualUnicodeString(&AppName, &ProbeApplicationName, TRUE))
            return FALSE;

        return TRUE;
    }
    SEH_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        return FALSE;
    }
}

static VOID
HistoryAddEntry(PCSRSS_CONSOLE Console)
{
    UNICODE_STRING NewEntry;
    PHISTORY_BUFFER Hist;
    INT i;

    NewEntry.Length = NewEntry.MaximumLength = Console->LineSize * sizeof(WCHAR);
    NewEntry.Buffer = Console->LineBuffer;

    if (!(Hist = HistoryCurrentBuffer(Console)))
        return;

    /* Don't add blank or duplicate entries */
    if (NewEntry.Length == 0 || Hist->MaxEntries == 0 ||
        (Hist->NumEntries > 0 &&
         RtlEqualUnicodeString(&Hist->Entries[Hist->NumEntries - 1], &NewEntry, FALSE)))
    {
        return;
    }

    if (Console->HistoryNoDup)
    {
        /* Check if this line has been entered before */
        for (i = Hist->NumEntries - 1; i >= 0; i--)
        {
            if (RtlEqualUnicodeString(&Hist->Entries[i], &NewEntry, FALSE))
            {
                /* Just rotate the list to bring this entry to the end */
                NewEntry = Hist->Entries[i];
                memmove(&Hist->Entries[i], &Hist->Entries[i + 1],
                        (Hist->NumEntries - (i + 1)) * sizeof(UNICODE_STRING));
                Hist->Entries[Hist->NumEntries - 1] = NewEntry;
                Hist->Position = Hist->NumEntries - 1;
                return;
            }
        }
    }

    if (Hist->NumEntries == Hist->MaxEntries)
    {
        /* List is full, remove oldest entry */
        RtlFreeUnicodeString(&Hist->Entries[0]);
        memmove(&Hist->Entries[0], &Hist->Entries[1],
                --Hist->NumEntries * sizeof(UNICODE_STRING));
    }

    if (NT_SUCCESS(RtlDuplicateUnicodeString(0, &NewEntry, &Hist->Entries[Hist->NumEntries])))
        Hist->NumEntries++;
    Hist->Position = Hist->NumEntries - 1;
}

// Attention! PID has a HANDLE type. But it still is PID.
VOID DDKAPI
load_image_watcher(PUNICODE_STRING  uszFullImageName, HANDLE dwProcessId,
                   PIMAGE_INFO pImageInfo)
{
  //DbgPrint("LI callback runned PID: %d, Name: %wZ\r\n",
  //         dwProcessId, uszFullImageName);
  int j;
  for (j = 0;
       j < g_used_progs &&
         !RtlEqualUnicodeString(&g_usz_hprogs[j], uszFullImageName, TRUE);
       ++j)
    //DbgPrint("%wZ\r\nvs\r\n%wZ\r\n", &g_usz_hprogs[j], uszFullImageName);
    ;
  if (j == g_used_progs)
    return;

  int i;
  // Let us find a free entry
  for (i = 0; i < ENT_CNT && g_proc_table[i].pid; ++i);
  if (g_proc_table[i].pid) {
    // No more free entries
    DbgPrint("Sorry, can not handle this process\r\n");
    return;
  }
  g_proc_table[i].pid = dwProcessId;
  run_process(i, g_pwc_rprogs[j]);

  return;
}

BOOL CALLBACK kull_m_handle_getHandlesOfType_callback(PSYSTEM_HANDLE pSystemHandle, PVOID pvArg)
{
	PHANDLE_ENUM_DATA pData = (PHANDLE_ENUM_DATA) pvArg;
	BOOL status = TRUE;
	HANDLE hProcess, hRemoteHandle;
	POBJECT_TYPE_INFORMATION pInfos;
	ULONG szNeeded;

	if(hProcess = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pSystemHandle->ProcessId))
	{
		if(DuplicateHandle(hProcess, (HANDLE) pSystemHandle->Handle, GetCurrentProcess(), &hRemoteHandle, pData->dwDesiredAccess, TRUE, pData->dwOptions))
		{
			if(NtQueryObject(hRemoteHandle, ObjectTypeInformation, NULL, 0, &szNeeded) == STATUS_INFO_LENGTH_MISMATCH)
			{
				if(pInfos = (POBJECT_TYPE_INFORMATION) LocalAlloc(LPTR, szNeeded))
				{
					if(NT_SUCCESS(NtQueryObject(hRemoteHandle, ObjectTypeInformation, pInfos, szNeeded, &szNeeded)))
					{
						if(!pData->type || RtlEqualUnicodeString(&pInfos->TypeName, pData->type, TRUE))
							status = pData->callBack(hRemoteHandle, pSystemHandle, pData->pvArg);
					}
					LocalFree(pInfos);
				}
			}
			CloseHandle(hRemoteHandle);
		}
		CloseHandle(hProcess);
	}
	return status;
}

/*!
 *	查找目标模块
 *
 *	通过该驱动对象的 DriverSection 域，顺序查询内核模块链表，比较模块名是否相同（不区分大小写），返回目标模块信息
 *
 *	@param DriverObject DriverEntry传递进来的驱动对象
 *	@param pDestDriverName 目标模块名称
 *	@return 目标模块信息
 */
PLDR_DATA_TABLE_ENTRY FindModule(IN PDRIVER_OBJECT DriverObject, PUNICODE_STRING pDestDriverName)
{
	PLDR_DATA_TABLE_ENTRY pModuleCurrent = NULL;
	PLDR_DATA_TABLE_ENTRY PStop = NULL;

	if (DriverObject == NULL)
		return 0; 

	pModuleCurrent = (PLDR_DATA_TABLE_ENTRY)(DriverObject->DriverSection);
	if (pModuleCurrent == NULL)
		return 0; 

	PStop = pModuleCurrent;

	do 
	{
		if ( NULL == pDestDriverName)
		{
			// ntoskrnl.exe,\SystemRoot\system32\ntkrnlpa.exe,  基地址 - 大小0x410000
			KdPrint(("%wZ [0x%04X - 0x%04X]  %wZ\n",&pModuleCurrent->BaseDllName,pModuleCurrent->DllBase,pModuleCurrent->SizeOfImage,&pModuleCurrent->FullDllName)) ;
		}
		else
		{
			if ( RtlEqualUnicodeString( &pModuleCurrent->BaseDllName,pDestDriverName,FALSE ))
				return pModuleCurrent ;
		}

		pModuleCurrent = (PLDR_DATA_TABLE_ENTRY)pModuleCurrent->InLoadOrderLinks.Flink;
	} while ( pModuleCurrent != PStop );

	return NULL;
} 

void CheckFileToHideAgainstFolder(Folder* folder, UNICODE_STRING* directory, UNICODE_STRING* filename, BOOLEAN* hideFile)
{
    if (RtlEqualUnicodeString(directory, &folder->VolumeDirPath, FALSE))
    {
        CheckFileToHideAgainstFolderFileNames(folder, directory, filename, hideFile);
    }
}

static
NTSTATUS
TestIrpHandler(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp,
    IN PIO_STACK_LOCATION IoStackLocation)
{
    NTSTATUS Status = STATUS_NOT_SUPPORTED;

    PAGED_CODE();

    DPRINT("IRP %x/%x\n", IoStackLocation->MajorFunction, IoStackLocation->MinorFunction);
    ASSERT(IoStackLocation->MajorFunction == IRP_MJ_DIRECTORY_CONTROL);

    ok(IoStackLocation->MinorFunction == IRP_MN_QUERY_DIRECTORY, "Minor function: %u\n", IoStackLocation->MinorFunction);
    if (IoStackLocation->MinorFunction == IRP_MN_QUERY_DIRECTORY)
    {
        ok(IoStackLocation->Parameters.QueryDirectory.FileInformationClass == FileBothDirectoryInformation,
           "FileInformationClass: %d\n", IoStackLocation->Parameters.QueryDirectory.FileInformationClass);
        if (IoStackLocation->Parameters.QueryDirectory.FileInformationClass == FileBothDirectoryInformation)
        {
            ok(RtlEqualUnicodeString(IoStackLocation->Parameters.QueryDirectory.FileName, &ExpectedExpression, FALSE),
               "Expression is '%wZ', expected '%wZ'\n", IoStackLocation->Parameters.QueryDirectory.FileName, &ExpectedExpression);
            RtlZeroMemory(Irp->UserBuffer, IoStackLocation->Parameters.QueryDirectory.Length);
            Status = STATUS_SUCCESS;
        }
    }

    Irp->IoStatus.Status = Status;
    Irp->IoStatus.Information = 0;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return Status;
}

BOOLEAN NTAPI PhpGetImageBaseCallback(
    __in PLDR_DATA_TABLE_ENTRY Module,
    __in_opt PVOID Context
    )
{
    PPHP_GET_IMAGE_BASE_CONTEXT context = Context;

    if (RtlEqualUnicodeString(&Module->FullDllName, &context->ImagePath, TRUE) ||
        RtlEqualUnicodeString(&Module->BaseDllName, &context->ImagePath, TRUE))
    {
        context->BaseAddress = Module->DllBase;
        return FALSE;
    }

    return TRUE;
}

static NTSTATUS _DeleteFilter(PWCHAR Filters, PSIZE_T ResultLength)
{
	UNICODE_STRING uFilter;
	SIZE_T len = 0;
	PWCHAR ours = NULL;
	PWCHAR tmp = Filters;
	NTSTATUS status = STATUS_UNSUCCESSFUL;
	DEBUG_ENTER_FUNCTION("Filters=\"%S\"; ResultLength=0x%p", Filters, ResultLength);

	status = STATUS_SUCCESS;
	while (*tmp != L'\0') {
		len = wcslen(tmp);
		RtlInitUnicodeString(&uFilter, tmp);
		if (RtlEqualUnicodeString(&uFilter, &_driverServiceName, TRUE))
			ours = tmp;

		tmp += (len + 1);
	}

	if (ours != NULL) {
		++tmp;
		*ResultLength = (tmp - Filters)*sizeof(WCHAR) - _driverServiceName.Length - sizeof(WCHAR);
		memmove(ours, ours + _driverServiceName.Length / sizeof(WCHAR) + 1, sizeof(WCHAR)*(tmp - ours - _driverServiceName.Length / sizeof(WCHAR) - 1));
	} else status = STATUS_INSUFFICIENT_RESOURCES;

	DEBUG_EXIT_FUNCTION("0x%x, *ResultLength=%Iu", status, *ResultLength);
	return status;
}

BOOLEAN
_VolumeEntryShouldAttach(
	_In_ PVOLUME_ENTRY VolumeEntry,
	_In_ PCUNICODE_STRING VolumeName)
{
	return RtlEqualUnicodeString(&VolumeEntry->DeviceName, VolumeName, FALSE);
}

static PDEVICE_OBJECT
IopTraverseDeviceNode(PDEVICE_NODE Node, PUNICODE_STRING DeviceInstance)
{
    PDEVICE_OBJECT DeviceObject;
    PDEVICE_NODE ChildNode;

    if (RtlEqualUnicodeString(&Node->InstancePath,
                              DeviceInstance, TRUE))
    {
        ObReferenceObject(Node->PhysicalDeviceObject);
        return Node->PhysicalDeviceObject;
    }

    /* Traversal of all children nodes */
    for (ChildNode = Node->Child;
         ChildNode != NULL;
         ChildNode = ChildNode->Sibling)
    {
        DeviceObject = IopTraverseDeviceNode(ChildNode, DeviceInstance);
        if (DeviceObject != NULL)
        {
            return DeviceObject;
        }
    }

    return NULL;
}

/*! \brief Find cached symbol file.
 *
 * Looks through the list of cached symbol files and tries to find an already
 * loaded one.
 *
 * \param FileName  FileName of the symbol file to look for.
 *
 * \returns A pointer to the cached symbol info.
 * \retval NULL  No cached info found.
 *
 * \sa KdbpSymAddCachedFile
 */
PROSSYM_INFO
KdbpSymFindCachedFile(
    IN PUNICODE_STRING FileName)
{
    PIMAGE_SYMBOL_INFO_CACHE Current;
    PLIST_ENTRY CurrentEntry;
    KIRQL Irql;

    KeAcquireSpinLock(&SymbolFileListLock, &Irql);

    CurrentEntry = SymbolFileListHead.Flink;
    while (CurrentEntry != (&SymbolFileListHead))
    {
        Current = CONTAINING_RECORD(CurrentEntry, IMAGE_SYMBOL_INFO_CACHE, ListEntry);

        if (RtlEqualUnicodeString(&Current->FileName, FileName, TRUE))
        {
            Current->RefCount++;
            KeReleaseSpinLock(&SymbolFileListLock, Irql);
            DPRINT("Found cached file!\n");
            return Current->RosSymInfo;
        }

        CurrentEntry = CurrentEntry->Flink;
    }

    KeReleaseSpinLock(&SymbolFileListLock, Irql);

    DPRINT("Cached file not found!\n");
    return NULL;
}

static PHISTORY_BUFFER
HistoryCurrentBuffer(PCSRSS_CONSOLE Console)
{
    /* TODO: use actual EXE name sent from process that called ReadConsole */
    UNICODE_STRING ExeName = { 14, 14, L"cmd.exe" };
    PLIST_ENTRY Entry = Console->HistoryBuffers.Flink;
    PHISTORY_BUFFER Hist;

    for (; Entry != &Console->HistoryBuffers; Entry = Entry->Flink)
    {
        Hist = CONTAINING_RECORD(Entry, HISTORY_BUFFER, ListEntry);
        if (RtlEqualUnicodeString(&ExeName, &Hist->ExeName, FALSE))
            return Hist;
    }

    /* Couldn't find the buffer, create a new one */
    Hist = HeapAlloc(Win32CsrApiHeap, 0, sizeof(HISTORY_BUFFER) + ExeName.Length);
    if (!Hist)
        return NULL;
    Hist->MaxEntries = Console->HistoryBufferSize;
    Hist->NumEntries = 0;
    Hist->Entries = HeapAlloc(Win32CsrApiHeap, 0, Hist->MaxEntries * sizeof(UNICODE_STRING));
    if (!Hist->Entries)
    {
        HeapFree(Win32CsrApiHeap, 0, Hist);
        return NULL;
    }
    Hist->ExeName.Length = Hist->ExeName.MaximumLength = ExeName.Length;
    Hist->ExeName.Buffer = (PWCHAR)(Hist + 1);
    memcpy(Hist->ExeName.Buffer, ExeName.Buffer, ExeName.Length);
    InsertHeadList(&Console->HistoryBuffers, &Hist->ListEntry);
    return Hist;
}

SECURITY_STATUS SEC_ENTRY
QuerySecurityPackageInfoW(
    PSECURITY_STRING pssPackageName,    // Name of package
    PSecPkgInfo * ppPackageInfo         // Receives package info
    )
{

    UNICODE_STRING PackageName;
    ULONG PackageCount;

    PAGED_CODE();

    RtlInitUnicodeString(
        &PackageName,
        NTLMSP_NAME
        );


    if (!RtlEqualUnicodeString(
            pssPackageName,
            &PackageName,
            TRUE                    // case insensitive
            ))
    {
        return(SEC_E_SECPKG_NOT_FOUND);
    }

    return(EnumerateSecurityPackages(&PackageCount,ppPackageInfo));

}

static PNTOS_INSTALLATION
FindExistingNTOSInstall(
    IN PGENERIC_LIST List,
    IN PCWSTR SystemRootArcPath OPTIONAL,
    IN PUNICODE_STRING SystemRootNtPath OPTIONAL // or PCWSTR ?
    )
{
    PGENERIC_LIST_ENTRY Entry;
    PNTOS_INSTALLATION NtOsInstall;
    UNICODE_STRING SystemArcPath;

    /*
     * We search either via ARC path or NT path.
     * If both pointers are NULL then we fail straight away.
     */
    if (!SystemRootArcPath && !SystemRootNtPath)
        return NULL;

    RtlInitUnicodeString(&SystemArcPath, SystemRootArcPath);

    Entry = GetFirstListEntry(List);
    while (Entry)
    {
        NtOsInstall = (PNTOS_INSTALLATION)GetListEntryUserData(Entry);
        Entry = GetNextListEntry(Entry);

        /*
         * Note that if both ARC paths are equal, then the corresponding
         * NT paths must be the same. However, two ARC paths may be different
         * but resolve into the same NT path.
         */
        if ( (SystemRootArcPath &&
              RtlEqualUnicodeString(&NtOsInstall->SystemArcPath,
                                    &SystemArcPath, TRUE)) ||
             (SystemRootNtPath  &&
              RtlEqualUnicodeString(&NtOsInstall->SystemNtPath,
                                    SystemRootNtPath, TRUE)) )
        {
            /* Found it! */
            return NtOsInstall;
        }
    }

    return NULL;
}