Thank you very much for your patience,
i’ve tried it by concating the string hash-values, convert them to a byte array and pass it down to driver by the following code:
string _HashValues =
*14cf73d771fa977a9f1cbaa5c301f912*7f0e061f5b6f311013968503d4c1d052*
static byte GetBytes(string str)
{
byte bytes = new byte[str.Length * sizeof(char)];
System.Buffer.BlockCopy(str.ToCharArray(), 0, bytes, 0, bytes.Length);
return bytes;
}
byte inBuffer = GetBytes(_HashValues);
DeviceIoControl(handle, ServiceInstaller.IOCTL_UPDATE_PROG_TABLE, inBuffer, inBuffer.Length, outBuffer, 0, out bytesReturned, IntPtr.Zero);
My last problem (and question, i promise) is that sometimes not the correct string-value appears in the driver:
wchar_t* test = (wchar_t*)Irp->AssociatedIrp.SystemBuffer;
DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, “test-wchar_t: %ls\n”,test);
The output looks like this (at the end of the string additional character are appended):
*14cf73d771fa977a9f1cbaa5c301f912*7f0e061f5b6f311013968503d4c1d052*e2-806e6f6e6963
or
*14cf73d771fa977a9f1cbaa5c301f912*7f0e061f5b6f311013968503d4c1d052*???}}}
(but not always)
I think i make a great mistake somewhere