C++ RtlMoveMemory函数代码示例

/*
 * Dump to text one entry of a ll_bitlockerAccountInfo linked list
 */
void Bitlocker_Dump(s_bitlockerAccountInfo *bitlockerAccountEntry,LPSTR szOut) {
	WCHAR szVolumeGUID[128],szRecoveryGUID[128];
	WCHAR szKeyPackageFileName[MAX_PATH+1];

	StringFromGUID2(bitlockerAccountEntry->msFVE_VolumeGUID,szVolumeGUID,sizeof(szVolumeGUID));
	StringFromGUID2(bitlockerAccountEntry->msFVE_RecoveryGUID,szRecoveryGUID,sizeof(szRecoveryGUID));

	RtlZeroMemory(szKeyPackageFileName,sizeof(szKeyPackageFileName));
	RtlMoveMemory(szKeyPackageFileName,szRecoveryGUID+1,2*(lstrlenW(szRecoveryGUID)-2));
	lstrcatW(szKeyPackageFileName,L".pk");

	if(!BitLocker_DumpKeyPackage(bitlockerAccountEntry,szKeyPackageFileName))
		lstrcpynW(szKeyPackageFileName,L"(Error while saving)",MAX_PATH);

	sprintf_s(szOut,2048,"Bitlocker entry\r\n\tVolume GUID: %ls\r\n\tRecovery GUID: %ls\r\n\tRecovery password: %ls\r\n\tKey-package: saved to binary file %ls\r\n",
		szVolumeGUID,szRecoveryGUID,
		bitlockerAccountEntry->msFVE_RecoveryPassword,
		szKeyPackageFileName);

}

VAPI(VanillaImage) VanillaLoadImageFromBinary(VanillaBinary Binary) {
	if (!Binary || Binary->Length <= 0) {
		return NULL;
	}
	CoInitialize(NULL);

	VanillaImage Image = new VImage;

	Image->GMem = GlobalAlloc(GMEM_FIXED, Binary->Length);
	LPVOID Mem = GlobalLock(Image->GMem);
	RtlMoveMemory(Mem, Binary->Address, Binary->Length);
	GlobalUnlock(Image->GMem);
	CreateStreamOnHGlobal(Image->GMem, false, &Image->Stream);	
	Image->Image = new Gdiplus::Bitmap(Image->Stream);
	Image->Width = Image->Image->GetWidth();
	Image->Height = Image->Image->GetHeight();

	CoUninitialize();
	return Image;
}

NTSTATUS HwlTerminateProcess64(PEPROCESS Process)
{
	//get pspterminatethreadbypointer
	ULONG32 callcode=0;
	ULONG64 AddressOfPspTTBP=0, AddressOfPsTST=0, i=0;
	PETHREAD Thread=NULL;
	PEPROCESS tProcess=NULL;
	NTSTATUS status=0;
	if(PspTerminateThreadByPointer==NULL)
	{
		AddressOfPsTST=(ULONG64)GetFunctionAddr(L"PsTerminateSystemThread");
		if(AddressOfPsTST==0)
			return STATUS_UNSUCCESSFUL;
		for(i=1;i<0xff;i++)
		{
			if(MmIsAddressValid((PVOID)(AddressOfPsTST+i))!=FALSE)
			{
				if(*(BYTE *)(AddressOfPsTST+i)==0x01 && *(BYTE *)(AddressOfPsTST+i+1)==0xe8) //目标地址-原始地址-5=机器码 ==> 目标地址=机器码+5+原始地址
				{
					RtlMoveMemory(&callcode,(PVOID)(AddressOfPsTST+i+2),4);
					AddressOfPspTTBP=(ULONG64)callcode + 5 + AddressOfPsTST+i+1;
				}
			}
		}
		PspTerminateThreadByPointer=(PSPTERMINATETHREADBYPOINTER)AddressOfPspTTBP;
	}
	//loop call pspterminatethreadbypointer
	for(i=4;i<0x40000;i+=4)
	{
		status=PsLookupThreadByThreadId((HANDLE)i, &Thread);
		if(NT_SUCCESS(status))
		{
			tProcess=IoThreadToProcess(Thread);
			if(tProcess==Process)
				PspTerminateThreadByPointer(Thread,0,1);
			ObDereferenceObject(Thread);
		}
	}
	//return status
	return STATUS_SUCCESS;
}

bool initializeLog()
{
	wchar_t buf[255];
	if(true == QueryReg(L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\MoneyHubPrt",L"ImagePath",buf,sizeof(buf)) )
	{
		wchar_t *p = wcsrchr(buf,L'\\');
		if(p != NULL)
		{
			*((p-buf+1)+buf) = L'\0';
			//wcscat_s(buf,sizeof(255),L"sysLog.txt");
			RtlMoveMemory(buf+wcslen(buf),L"syslog.txt",24);

			LogInitialize(LOG_TYPE_DEBUG,buf);
			return true;
		}
		else
			return false;
	}
	else
		return false;
}

NTSTATUS Reg_GetGuidValue(_In_ HANDLE hKey, _In_ LPCWSTR pszValueName, _Out_ PGUID pValue)
{
	NTSTATUS Status = STATUS_SUCCESS;
	UNICODE_STRING ValueName;
	RtlInitUnicodeString(&ValueName, pszValueName);
	struct {
		KEY_VALUE_PARTIAL_INFORMATION Info;
		GUID Extra;
	} Buffer;
	ULONG ResultLength;
	Status = ZwQueryValueKey(hKey, &ValueName, KeyValuePartialInformation, &Buffer, sizeof(Buffer), &ResultLength);
	if (NT_SUCCESS(Status))
	{
		if (REG_BINARY == Buffer.Info.Type && sizeof(GUID) == Buffer.Info.DataLength) {
			RtlMoveMemory(pValue, Buffer.Info.Data, sizeof(GUID));
		}
		else
			Status = STATUS_INVALID_BUFFER_SIZE;
	}
	return Status;
}

static VOID RefillSocketBuffer( PAFD_FCB FCB )
{
    /* Make sure nothing's in flight first */
    if (FCB->ReceiveIrp.InFlightRequest) return;

    /* Now ensure that receive is still allowed */
    if (FCB->TdiReceiveClosed) return;

    /* Check if the buffer is full */
    if (FCB->Recv.Content == FCB->Recv.Size)
    {
        /* If there are bytes used, we can solve this problem */
        if (FCB->Recv.BytesUsed != 0)
        {
            /* Reposition the unused portion to the beginning of the receive window */
            RtlMoveMemory(FCB->Recv.Window,
                          FCB->Recv.Window + FCB->Recv.BytesUsed,
                          FCB->Recv.Content - FCB->Recv.BytesUsed);

            FCB->Recv.Content -= FCB->Recv.BytesUsed;
            FCB->Recv.BytesUsed = 0;
        }
        else
        {
            /* No space in the buffer to receive */
            return;
        }
    }

    AFD_DbgPrint(MID_TRACE,("Replenishing buffer\n"));

    TdiReceive( &FCB->ReceiveIrp.InFlightRequest,
                FCB->Connection.Object,
                TDI_RECEIVE_NORMAL,
                FCB->Recv.Window + FCB->Recv.Content,
                FCB->Recv.Size - FCB->Recv.Content,
                &FCB->ReceiveIrp.Iosb,
                ReceiveComplete,
                FCB );
}

HRESULT STDMETHODCALLTYPE IActiveScriptSite_Create(
    __RPC__inout IActiveScriptSite_ **This
    )
{
    *This = (IActiveScriptSite_ *) GlobalAlloc(GPTR, sizeof(_IActiveScriptSite_));
    if (*This)
    {
        _IActiveScriptSite_ * hObject = (_IActiveScriptSite_ *) *This;

        hObject->lpVtbl = GlobalAlloc(GPTR, sizeof(IActiveScriptSite_Vtbl));
        RtlMoveMemory(hObject->lpVtbl, &_IActiveScriptSite_Vtbl, sizeof(*(hObject->lpVtbl)));
        hObject->RefCount = 0;
        hObject->lpVtbl->AddRef(*This);

        IHost_Create(&hObject->hHost);
        return S_OK;
    }
    else
    {
        return E_OUTOFMEMORY;
    }
}

static NTSTATUS
CmiAddKeyToHashTable(
	IN PCMHIVE RegistryHive,
	IN OUT PCM_KEY_FAST_INDEX HashCell,
   IN HCELL_INDEX HashCellIndex,
	IN PCM_KEY_NODE NewKeyCell,
	IN HCELL_INDEX NKBOffset)
{
	ULONG i;
	ULONG HashKey = 0;

	if (NewKeyCell->Flags & KEY_COMP_NAME)
	{
		RtlCopyMemory(
			&HashKey,
			NewKeyCell->Name,
			min(NewKeyCell->NameLength, sizeof(ULONG)));
	}

	for (i = 0; i < HashCell->Count; i++)
	{
		if (HashCell->List[i].HashKey > HashKey)
			break;
	}

	if (i < HashCell->Count)
	{
		RtlMoveMemory(HashCell->List + i + 1,
		              HashCell->List + i,
		              (HashCell->Count - i) *
		              sizeof(HashCell->List[0]));
	}

	HashCell->List[i].Cell = NKBOffset;
	HashCell->List[i].HashKey = HashKey;
   HashCell->Count++;
	HvMarkCellDirty(&RegistryHive->Hive, HashCellIndex, FALSE);
	return STATUS_SUCCESS;
}

/*
 * @implemented
 */
BOOLEAN
NTAPI
Ke386SetIoAccessMap(IN ULONG MapNumber,
                    IN PKIO_ACCESS_MAP IopmBuffer)
{
    PKPROCESS CurrentProcess;
    PKPRCB Prcb;
    PVOID pt;

    if ((MapNumber > IOPM_COUNT) || (MapNumber == IO_ACCESS_MAP_NONE))
        return FALSE;

    Prcb = KeGetCurrentPrcb();

    // Copy the IOP map and load the map for the current process.
    pt = &(KeGetPcr()->TSS->IoMaps[MapNumber-1].IoMap);
    RtlMoveMemory(pt, (PVOID)IopmBuffer, IOPM_SIZE);
    CurrentProcess = Prcb->CurrentThread->ApcState.Process;
    KeGetPcr()->TSS->IoMapBase = CurrentProcess->IopmOffset;

    return TRUE;
}

PUNICODE_STRING Uwcsdup(PUNICODE_STRING src) {
  PUNICODE_STRING rtn;
  if (!src) return NULL;

  rtn =
    ExAllocatePoolWithTag ( PagedPool,
			    sizeof(UNICODE_STRING)+src->Length+
			    sizeof(UNICODE_NULL),
			    CRASH_TAG);
  if (!rtn) {
    debugOutput(L"Allocate paged pool failed, Uwcsdup\n");
  }
  else {
    rtn->Length = src->Length;
    rtn->MaximumLength = src->Length + sizeof(UNICODE_NULL);
    rtn->Buffer = (WCHAR *)(((unsigned char *)rtn)+
			    sizeof(UNICODE_STRING));
    RtlMoveMemory(rtn->Buffer, src->Buffer, src->Length);
    *(rtn->Buffer+src->Length/sizeof(WCHAR)) = UNICODE_NULL;
  }
  return rtn;
}

VOID
StatReadStats (PULONG Buffer)
{
    PACCUMULATORS   Accum;
    ULONG           i, r1;
    pPSTATS         Inf;
    PKPCR           Pcr;

    PAGED_CODE();

    Buffer[0] = sizeof (PSTATS);
    Inf = (pPSTATS)(Buffer + 1);

    for (i = 0; i < MAXIMUM_PROCESSORS; i++, Inf++) {
        Pcr = KiProcessorControlRegister[i];
        if (Pcr == NULL) {
            continue;
        }

        Accum = StatProcessorAccumulators[i];

        do {
            r1 = Accum->CountStart;
            Inf->Counters[0] = Accum->Counters[0];
            Inf->Counters[1] = Accum->Counters[1];
            Inf->TSC         = Accum->TSC;

            Inf->SpinLockAcquires   = Pcr->KernelReserved[0];
            Inf->SpinLockCollisions = Pcr->KernelReserved[1];
            Inf->SpinLockSpins      = Pcr->KernelReserved[2];
            Inf->Irqls              = Pcr->KernelReserved[3];

        } while (r1 != Accum->CountEnd);

        RtlMoveMemory (Inf->ThunkCounters, (CONST VOID *)(Accum->ThunkCounters),
            StatMaxThunkCounter * sizeof (ULONG));

    }
}

__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName)
{

    if(expTableData != NULL)
    {
        ExporterCleanup();
    }
    expExportData.Base = ExportOrdinalBase;
    expTableData = VirtualAlloc(NULL, MemorySize, MEM_COMMIT, PAGE_READWRITE);
    if(szExportModuleName != NULL)
    {
        RtlMoveMemory(expTableData, szExportModuleName, lstrlenA(szExportModuleName));
        expTableDataCWP = (LPVOID)((ULONG_PTR)expTableData + lstrlenA(szExportModuleName) + 2);
        expNamePresent = true;
    }
    else
    {
        expTableDataCWP = expTableData;
        expNamePresent = false;
    }
    expImageBase = ImageBase;
}

NTSTATUS
NTAPI
PinWavePciAudioPosition(
    IN PIRP Irp,
    IN PKSIDENTIFIER Request,
    IN OUT PVOID Data)
{
    CPortPinWavePci *Pin;
    PSUBDEVICE_DESCRIPTOR Descriptor;

    // get sub device descriptor 
    Descriptor = (PSUBDEVICE_DESCRIPTOR)KSPROPERTY_ITEM_IRP_STORAGE(Irp);

    // sanity check 
    PC_ASSERT(Descriptor);
    PC_ASSERT(Descriptor->PortPin);
    PC_ASSERT_IRQL(DISPATCH_LEVEL);

    // cast to pin impl
    Pin = (CPortPinWavePci*)Descriptor->PortPin;

    //sanity check
    PC_ASSERT(Pin->m_Stream);

    if (Request->Flags & KSPROPERTY_TYPE_GET)
    {
        // FIXME non multithreading-safe
        // copy audio position
        RtlMoveMemory(Data, &Pin->m_Position, sizeof(KSAUDIO_POSITION));

        DPRINT("Play %lu Record %lu\n", Pin->m_Position.PlayOffset, Pin->m_Position.WriteOffset);
        Irp->IoStatus.Information = sizeof(KSAUDIO_POSITION);
        return STATUS_SUCCESS;
    }

    // not supported
    return STATUS_NOT_SUPPORTED;
}

VOID
xmsMoveMemory(
    ULONG Destination,
    ULONG Source,
    ULONG Count
    )
/*++

Routine Description:

    This routine moves a block of memory, and notifies the emulator.
    It correctly handles overlapping source and destination

Arguments:

    Destination -- Supplies a pointer to the destination Linear
        Address
    Source -- Supplies a pointer to the source Linear Address
    Count -- Supplies the number of bytes to move
    
Return Value:

    None.

--*/
{
   
    //
    // Move the memory
    //
    RtlMoveMemory(
        (PVOID)Destination,
        (PVOID)Source,
        Count
        );

}

NTSTATUS
EvtWmiInstanceSetInstance(
    IN  WDFWMIINSTANCE WmiInstance,
    IN  ULONG InBufferSize,
    IN  PVOID InBuffer
    )
{
    FireflyDeviceInformation* pInfo;
    ULONG length;
    NTSTATUS status;

    PAGED_CODE();

    UNREFERENCED_PARAMETER(InBufferSize);

    pInfo = InstanceGetInfo(WmiInstance);

    //
    // Our mininum buffer size has been checked by the Framework
    // and failed automatically if too small.
    //
    length = sizeof(*pInfo);

    RtlMoveMemory(pInfo, InBuffer, length);

    //
    // Tell the HID device about the new tail light state
    //
    status = FireflySetFeature(
        WdfObjectGet_DEVICE_CONTEXT(WdfWmiInstanceGetDevice(WmiInstance)),
        TAILLIGHT_PAGE,
        TAILLIGHT_FEATURE,
        pInfo->TailLit
        );

    return status;
}