none
DbgPrint UNICODE_STRING comes empty in DebugView RRS feed

  • Question

  • I have following code:

    CHAR sKernelPath[1024] = { 0 };
    PVOID pKernelAddres = NULL;
    PCHAR pKrnlMod;
    ANSI_STRING aFileName;
    UNICODE_STRING uFileName;
    
     RtlStringCbPrintfA(sKernelPath, 1024, "\\\\SystemRoot\\\\System32\\\\%s", pKrnlMod);
     RtlInitAnsiString(&aFileName, sKernelPath);
     
     if (NT_SUCCESS(RtlAnsiStringToUnicodeString(&uFileName, &aFileName, TRUE))) {
     
         DbgPrint("%wZ\n", uFileName.Buffer);
     
     }

    How print content of uFileName variable correctly?

    Thursday, January 19, 2017 4:39 AM

Answers

  • %wZ expects a pointer to the UNICODE_STRING structure, passing the Buffer value to %s or %S is dangerous as they expect null termination and Buffer is not necessarily null terminated.

    DbgPrint("%wZ\n", &ufFileName);


    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Thursday, January 19, 2017 6:04 AM