Special characters

Hello everyone! I’m writing a driver, and what I want to do is write a message to a file, but when there is a special character, like: “á”, it returns an invalid character, that when I call “ZwWriteFile”, could someone help me? here’s my code:

VOID Alert(PUNICODE_STRING Message, PUNICODE_STRING FileNameOriginal)
{
	UNICODE_STRING FileName;
	OBJECT_ATTRIBUTES Attributes;

	RtlInitUnicodeString(&FileName, FileNameOriginal);

	InitializeObjectAttributes(&Attributes, &FileName,
		OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
		NULL, NULL);

	HANDLE FileHandle;
	NTSTATUS Status;

	IO_STATUS_BLOCK ioStatusBlock;

	if (KeGetCurrentIrql() != PASSIVE_LEVEL)
		return STATUS_INVALID_DEVICE_STATE;

	Status = ZwCreateFile(&FileHandle,
		GENERIC_WRITE,
		&Attributes, &ioStatusBlock, NULL,
		FILE_ATTRIBUTE_NORMAL,
		0,
		FILE_OVERWRITE_IF,
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL, 0);

	CHAR     buffer[BUFFER_SIZE];
	size_t  cb;

	if (NT_SUCCESS(Status)) 
	{
		Status = RtlStringCbPrintfA(buffer, sizeof(buffer), Message, 0x0);

		if (NT_SUCCESS(Status))
		{
			Status = RtlStringCbLengthA(buffer, sizeof(buffer), &cb);

			if (NT_SUCCESS(Status))
                       {
				Status = ZwWriteFile(FileHandle, NULL, NULL, NULL, &ioStatusBlock,
					buffer, cb, NULL, NULL);
			}
		}
		ZwClose(FileHandle);
	}
}

I got this code from Microsoft

it returns an invalid character

What does “returns an invalid character” mean and “it” being WHAT in that code, exactly?

I can assure you that ZwWriteFile doesn’t look at or care about the contents of the data buffer.

Peter

1 Like

@“Peter_Viscarola_(OSR)” said:

it returns an invalid character

What does “returns an invalid character” mean and “it” being WHAT in that code, exactly?

I can assure you that ZwWriteFile doesn’t look at or care about the contents of the data buffer.

Peter

For example: “á”, it will return a: “:warning:

I’m very sorry, but I still don’t understand what you mean.

“will return” WHERE?? When output/viewed/displayed by WHAT?

Remember, we’re not in your head.

OK… your code looks “problematic” as well. The third argument to RtlStringCbPrintfA (which is just a fancy version of printf) is a format string… but you’re passing a UNICODE_STRING?? And the fourth parameter is the arguments… of which there presumably are none? So, the buffer part of the UNICODE_STRING is (presumably) in UNICODE format, and thus 2 bytes per character. Sooo… that’s not going to work. What do you hope to accomplish with this call, that a simple call to memcpy wouldn’t do?

RtlStringCbLengthA is just a fancy version of strlen… but, it’s not going to work properly with UNICODE characters?

So, yeah… I’m confused.

Let’s go back to the beginning: WHAT is it that you’re trying to accomplish?

Peter

1 Like

@“Peter_Viscarola_(OSR)” said:
I’m very sorry, but I still don’t understand what you mean.

“will return” WHERE?? When output/viewed/displayed by WHAT?

Remember, we’re not in your head.

OK… your code looks “problematic” as well. The third argument to RtlStringCbPrintfA (which is just a fancy version of printf) is a format string… but you’re passing a UNICODE_STRING?? And the fourth parameter is the arguments… of which there presumably are none? So, the buffer part of the UNICODE_STRING is (presumably) in UNICODE format, and thus 2 bytes per character. Sooo… that’s not going to work. What do you hope to accomplish with this call, that a simple call to memcpy wouldn’t do?

RtlStringCbLengthA is just a fancy version of strlen… but, it’s not going to work properly with UNICODE characters?

So, yeah… I’m confused.

Let’s go back to the beginning: WHAT is it that you’re trying to accomplish?

Peter

Excuse me if I’m not clear, the question is: I try to write a message in a file, like “Olá todos” because I’m Brazilian, but when I write this, “Olá” does not return the original message, it will be: "Ol⚠ ", how do I resolve this?

I got this code from Microsoft and I don’t have much experience in developing mini filters. Can you help me?

Well, to start: You seem to be missing the fact that UNICODE_STRING is a data structure that implies a particular string encoding.

And you seem to have ignored the last two thirds of what I wrote…

Does that help at all?

Peter

1 Like

@“Peter_Viscarola_(OSR)” said:
Well, to start: You seem to be missing the fact that UNICODE_STRING is a data structure that implies a particular string encoding.

And you seem to have ignored the last two thirds of what I wrote…

Does that help at all?

Peter

Thanks for the answer, you try to fix my code, sorry I took too long to answer.