{"id":404,"date":"2009-07-07T12:01:55","date_gmt":"2009-07-07T12:01:55","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2009\/07\/07\/strings-in-the-kernel\/"},"modified":"2026-07-30T22:52:49","modified_gmt":"2026-07-30T22:52:49","slug":"strings-in-the-kernel","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2009\/07\/07\/strings-in-the-kernel\/","title":{"rendered":"Strings in the Kernel"},"content":{"rendered":"
\"\"<\/a><\/div>\n

Is there anything more trivial than manipulating strings? I believe the correct answer would be “It depends<\/span>“. When I had finished my technical course in Industrial Computing in 1995, I thought I knew a lot about the C language. After all, I already knew how to manipulate strings. Copy, concatenate, reverse, search for words… What else should a programmer know? When I started my internship and began dealing with real-world programs, I found out that I knew nothing. But one thing is certain, I knew how to manipulate strings. This post should help a lot the C++ programmers who know everything about Templates<\/a>, Smart Pointers<\/a>, STL<\/a> and magical things that abstract reality, making the programmer’s life easier. With all these reference-counting resources and overloading of every operator there is, things start to get hazy and you begin to wonder: “But where is the buffer, really?”<\/span>. Today we are just going to take a light stroll through the UNICODE_STRING<\/a> and ANSI_STRING<\/a> structures and some functions for converting between them. It may seem silly, but if you do not know how to play with strings, why learn the rest? It is all going to end in a blue screen anyway.<\/p>\n

And back in kindergarten…<\/h3>\n

We learned from the teacher back in kindergarten that strings are chains of characters. So we could tell the story of our lives just by placing one character in front of another.<\/p>\n

\n
CHAR    szExemplo[] = \"Tava ruim l\u00e1 na Bahia, profiss\u00e3o de b\u00f3ia-fria\\n\"<\/span><\/pre>\n
                      \"Trabalhando noite e dia, num era isso que eu queria\\n\"<\/span><\/pre>\n
                      \"Eu vim-me embora pra \\\"Sum Paulo\\\",\\n\"<\/span><\/pre>\n
                      \"Eu vim no lombo dum jumento com pouco conhecimento\\n\"<\/span><\/pre>\n
                      \"Enfrentando chuva e vento e dando uns peido fedorento (vish)\\n\"<\/span><\/pre>\n
                      \"At\u00e9 minha bunda fez um calo\\n\"<\/span><\/pre>\n
                      \"Chegando na capital, uns puta predi\u00e3o legal\\n\"<\/span><\/pre>\n
                      \"As mina pagando um pau, mas meu jumento tava mal\\n\"<\/span><\/pre>\n
                      \"Precisando reformar\\n\"<\/span><\/pre>\n
                      \"Fiz a pintura, importei quatro ferradura\\n\"<\/span><\/pre>\n
                      \"Troquei at\u00e9 dentadura e pra completar a belezura\\n\"<\/span><\/pre>\n
                      \"Eu instalei um Road-Star!\"<\/span>;<\/pre>\n<\/div>\n
Jumento Celestino \/ Mamonas Assassinas<\/span><\/p>\n
There are two things you must know so that you can keep reading this post. One of them is that these characters need to be stored somewhere, whether in a local variable, allocated on the heap or even in the initialized data segment. The other thing is that strings are normally terminated by a NULL character, but the absence of it does not disqualify a string. This means we can have strings without terminators where their size is indicated by another variable. I leave here a hook<\/a> for the Slug to explain these things to the interested boys and girls.<\/p>\n
Another important characteristic is that a character is not always equal to a Byte. There are strings composed of wide characters. Wide characters, contrary to what people think, are not lucky characters, but rather characters formed by 16-bit values. With strings formed by such characters, one can express words in any language. This explains how Windows manages to deal with alien file names when you try to install the drivers for the HiPhone<\/a> you bought in Chinatown.<\/p>\n
Besides, imagine that an error occurs during the encryption process of your hard drive. It would be vital that a detailed error message be displayed to you regardless of the nationality of the product. Whether the information is going to help is another matter.<\/p>\n
\"\"<\/div>\n
Four types of strings<\/h3>\n
Of these, we have two strings that we are already used to seeing in user-Mode, both terminated with a NULL character.<\/p>\n
\n
CHAR    szString[] = \"Uma string de CHAR\"<\/span>;<\/pre>\n
WCHAR   wzString[] = L\"Uma string de WCHAR\"<\/span>;<\/pre>\n<\/div>\n
The other two strings are the ones we normally see in kernel-mode.<\/p>\n
\n
typedef<\/span> struct<\/span> _UNICODE_STRING {<\/pre>\n
  USHORT  Length;<\/pre>\n
  USHORT  MaximumLength;<\/pre>\n
  PWSTR  Buffer;<\/pre>\n
} UNICODE_STRING, *PUNICODE_STRING;<\/pre>\n
 <\/pre>\n
typedef<\/span> struct<\/span> _STRING {<\/pre>\n
  USHORT  Length;<\/pre>\n
  USHORT  MaximumLength;<\/pre>\n
  PCHAR  Buffer;<\/pre>\n
} ANSI_STRING, *PANSI_STRING;<\/pre>\n<\/div>\n
These strings are defined by structures with three members, which I describe below. The behavior of the routines and macros that manipulate them is very similar. For this reason I am going to concentrate my examples on UNICODE_STRING, since the Win32 subsystem converts everything to unicode when it passes a call to the kernel.<\/p>\n