Hello everyone! I’m writing a driver, and what I want to do is write a message to a file, but when there is a special character, like: “á”, it returns an invalid character, that when I call “ZwWriteFile”, could someone help me? here’s my code:
VOID Alert(PUNICODE_STRING Message, PUNICODE_STRING FileNameOriginal)
{
UNICODE_STRING FileName;
OBJECT_ATTRIBUTES Attributes;
RtlInitUnicodeString(&FileName, FileNameOriginal);
InitializeObjectAttributes(&Attributes, &FileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL, NULL);
HANDLE FileHandle;
NTSTATUS Status;
IO_STATUS_BLOCK ioStatusBlock;
if (KeGetCurrentIrql() != PASSIVE_LEVEL)
return STATUS_INVALID_DEVICE_STATE;
Status = ZwCreateFile(&FileHandle,
GENERIC_WRITE,
&Attributes, &ioStatusBlock, NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OVERWRITE_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0);
CHAR buffer[BUFFER_SIZE];
size_t cb;
if (NT_SUCCESS(Status))
{
Status = RtlStringCbPrintfA(buffer, sizeof(buffer), Message, 0x0);
if (NT_SUCCESS(Status))
{
Status = RtlStringCbLengthA(buffer, sizeof(buffer), &cb);
if (NT_SUCCESS(Status))
{
Status = ZwWriteFile(FileHandle, NULL, NULL, NULL, &ioStatusBlock,
buffer, cb, NULL, NULL);
}
}
ZwClose(FileHandle);
}
}
I got this code from Microsoft
it returns an invalid character
What does “returns an invalid character” mean and “it” being WHAT in that code, exactly?
I can assure you that ZwWriteFile doesn’t look at or care about the contents of the data buffer.
Peter
1 Like
@“Peter_Viscarola_(OSR)” said:
it returns an invalid character
What does “returns an invalid character” mean and “it” being WHAT in that code, exactly?
I can assure you that ZwWriteFile doesn’t look at or care about the contents of the data buffer.
Peter
For example: “á”, it will return a: “”
I’m very sorry, but I still don’t understand what you mean.
“will return” WHERE?? When output/viewed/displayed by WHAT?
Remember, we’re not in your head.
OK… your code looks “problematic” as well. The third argument to RtlStringCbPrintfA (which is just a fancy version of printf) is a format string… but you’re passing a UNICODE_STRING?? And the fourth parameter is the arguments… of which there presumably are none? So, the buffer part of the UNICODE_STRING is (presumably) in UNICODE format, and thus 2 bytes per character. Sooo… that’s not going to work. What do you hope to accomplish with this call, that a simple call to memcpy wouldn’t do?
RtlStringCbLengthA is just a fancy version of strlen… but, it’s not going to work properly with UNICODE characters?
So, yeah… I’m confused.
Let’s go back to the beginning: WHAT is it that you’re trying to accomplish?
Peter
1 Like
@“Peter_Viscarola_(OSR)” said:
I’m very sorry, but I still don’t understand what you mean.
“will return” WHERE?? When output/viewed/displayed by WHAT?
Remember, we’re not in your head.
OK… your code looks “problematic” as well. The third argument to RtlStringCbPrintfA (which is just a fancy version of printf) is a format string… but you’re passing a UNICODE_STRING?? And the fourth parameter is the arguments… of which there presumably are none? So, the buffer part of the UNICODE_STRING is (presumably) in UNICODE format, and thus 2 bytes per character. Sooo… that’s not going to work. What do you hope to accomplish with this call, that a simple call to memcpy wouldn’t do?
RtlStringCbLengthA is just a fancy version of strlen… but, it’s not going to work properly with UNICODE characters?
So, yeah… I’m confused.
Let’s go back to the beginning: WHAT is it that you’re trying to accomplish?
Peter
Excuse me if I’m not clear, the question is: I try to write a message in a file, like “Olá todos” because I’m Brazilian, but when I write this, “Olá” does not return the original message, it will be: "Ol⚠ ", how do I resolve this?
I got this code from Microsoft and I don’t have much experience in developing mini filters. Can you help me?
Well, to start: You seem to be missing the fact that UNICODE_STRING is a data structure that implies a particular string encoding.
And you seem to have ignored the last two thirds of what I wrote…
Does that help at all?
Peter
1 Like
@“Peter_Viscarola_(OSR)” said:
Well, to start: You seem to be missing the fact that UNICODE_STRING is a data structure that implies a particular string encoding.
And you seem to have ignored the last two thirds of what I wrote…
Does that help at all?
Peter
Thanks for the answer, you try to fix my code, sorry I took too long to answer.