Click here to Skip to main content
15,886,519 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hi I've used the following code for this :
C#
DbgPrint("\n File name volume is %wZ",&dosName);
    str.MaximumLength = (USHORT)dosName.Length;
    //status = RtlAppendUnicodeStringToString(&teststr, &Data->Iopb->TargetFileObject->FileName);
    status = RtlUnicodeStringToAnsiString(&str, &dosName, TRUE);
    DbgPrint("\n status is :  %s",status);
    DbgPrint("\n New  Data %Z", str);

    DbgPrint("\n Data %wZ", &Data->Iopb->TargetFileObject->FileName);


but this one is not working at all and status is showing null value in DebugView

please suggest me some alternatives
Posted

The status value returned by RtlUnicodeStringToAnsiString is not a string but a numeric value: see https://msdn.microsoft.com/en-gb/library/cc704588.aspx[^].
 
Share this answer
 
C#
NameLength = (USHORT)dosName.MaximumLength + Data->Iopb->TargetFileObject->FileName.MaximumLength + 2;
    NameBuffer = ExAllocatePoolWithTag(PagedPool,NameLength,NC_MAPPING_TAG);
    NameString.Length = 0;
    NameString.MaximumLength = NameLength;
    NameString.Buffer = NameBuffer;
    RtlCopyUnicodeString(&NameString, &dosName);
    RtlAppendUnicodeStringToString(&NameString, &Data->Iopb->TargetFileObject->FileName);

Here we need to allocate pool for string. But Be careful pool allocation may lead to BSOD.
 
Share this answer
 
Comments
Dale Seeley 18-May-22 2:39am    
This post is old but I came across it with limited understanding at first and can confirm this works great! the code is basically the same in pure C if anyone needs it.

ULONG PROC_TAG = 0;
UNICODE_STRING processName;

processName.Length = 0;
processName.MaximumLength = (USHORT)DoSPath.MaximumLength + Data->Iopb->TargetFileObject->FileName.MaximumLength + 2;
processName.Buffer = ExAllocatePoolWithTag(PagedPool, processName.MaximumLength, PROC_TAG);

RtlCopyUnicodeString(&processName, &DoSPath);
RtlAppendUnicodeStringToString(&processName, &Data->Iopb->TargetFileObject->FileName);
KdPrint(("%wZ \r\n", processName));

cheers and thank you to the original solution!

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900