Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Special characters

elDimaselDimas Member Posts: 8

Hello everyone! I'm writing a driver, and what I want to do is write a message to a file, but when there is a special character, like: "á", it returns an invalid character, that when I call "ZwWriteFile", could someone help me? here's my code:

VOID Alert(PUNICODE_STRING Message, PUNICODE_STRING FileNameOriginal)
{
    UNICODE_STRING FileName;
    OBJECT_ATTRIBUTES Attributes;

    RtlInitUnicodeString(&FileName, FileNameOriginal);

    InitializeObjectAttributes(&Attributes, &FileName,
        OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
        NULL, NULL);

    HANDLE FileHandle;
    NTSTATUS Status;

    IO_STATUS_BLOCK ioStatusBlock;

    if (KeGetCurrentIrql() != PASSIVE_LEVEL)
        return STATUS_INVALID_DEVICE_STATE;

    Status = ZwCreateFile(&FileHandle,
        GENERIC_WRITE,
        &Attributes, &ioStatusBlock, NULL,
        FILE_ATTRIBUTE_NORMAL,
        0,
        FILE_OVERWRITE_IF,
        FILE_SYNCHRONOUS_IO_NONALERT,
        NULL, 0);

    CHAR     buffer[BUFFER_SIZE];
    size_t  cb;

    if (NT_SUCCESS(Status)) 
    {
        Status = RtlStringCbPrintfA(buffer, sizeof(buffer), Message, 0x0);

        if (NT_SUCCESS(Status))
        {
            Status = RtlStringCbLengthA(buffer, sizeof(buffer), &cb);

            if (NT_SUCCESS(Status))
                       {
                Status = ZwWriteFile(FileHandle, NULL, NULL, NULL, &ioStatusBlock,
                    buffer, cb, NULL, NULL);
            }
        }
        ZwClose(FileHandle);
    }
}

I got this code from Microsoft

Comments

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,158

    it returns an invalid character

    What does "returns an invalid character" mean and "it" being WHAT in that code, exactly?

    I can assure you that ZwWriteFile doesn't look at or care about the contents of the data buffer.

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • elDimaselDimas Member Posts: 8

    @Peter_Viscarola_(OSR) said:

    it returns an invalid character

    What does "returns an invalid character" mean and "it" being WHAT in that code, exactly?

    I can assure you that ZwWriteFile doesn't look at or care about the contents of the data buffer.

    Peter

    For example: "á", it will return a: "⚠"

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,158

    I'm very sorry, but I still don't understand what you mean.

    "will return" WHERE?? When output/viewed/displayed by WHAT?

    Remember, we're not in your head.

    OK... your code looks "problematic" as well. The third argument to RtlStringCbPrintfA (which is just a fancy version of printf) is a format string... but you're passing a UNICODE_STRING?? And the fourth parameter is the arguments... of which there presumably are none? So, the buffer part of the UNICODE_STRING is (presumably) in UNICODE format, and thus 2 bytes per character. Sooo.... that's not going to work. What do you hope to accomplish with this call, that a simple call to memcpy wouldn't do?

    RtlStringCbLengthA is just a fancy version of strlen... but, it's not going to work properly with UNICODE characters?

    So, yeah... I'm confused.

    Let's go back to the beginning: WHAT is it that you're trying to accomplish?

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • elDimaselDimas Member Posts: 8

    @Peter_Viscarola_(OSR) said:
    I'm very sorry, but I still don't understand what you mean.

    "will return" WHERE?? When output/viewed/displayed by WHAT?

    Remember, we're not in your head.

    OK... your code looks "problematic" as well. The third argument to RtlStringCbPrintfA (which is just a fancy version of printf) is a format string... but you're passing a UNICODE_STRING?? And the fourth parameter is the arguments... of which there presumably are none? So, the buffer part of the UNICODE_STRING is (presumably) in UNICODE format, and thus 2 bytes per character. Sooo.... that's not going to work. What do you hope to accomplish with this call, that a simple call to memcpy wouldn't do?

    RtlStringCbLengthA is just a fancy version of strlen... but, it's not going to work properly with UNICODE characters?

    So, yeah... I'm confused.

    Let's go back to the beginning: WHAT is it that you're trying to accomplish?

    Peter

    Excuse me if I'm not clear, the question is: I try to write a message in a file, like "Olá todos" because I'm Brazilian, but when I write this, "Olá" does not return the original message, it will be: "Ol⚠ ", how do I resolve this?

    I got this code from Microsoft and I don't have much experience in developing mini filters. Can you help me?

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,158

    Well, to start: You seem to be missing the fact that UNICODE_STRING is a data structure that implies a particular string encoding.

    And you seem to have ignored the last two thirds of what I wrote...

    Does that help at all?

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • elDimaselDimas Member Posts: 8

    @Peter_Viscarola_(OSR) said:
    Well, to start: You seem to be missing the fact that UNICODE_STRING is a data structure that implies a particular string encoding.

    And you seem to have ignored the last two thirds of what I wrote...

    Does that help at all?

    Peter

    Thanks for the answer, you try to fix my code, sorry I took too long to answer.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE