Extracting pathname components from UNICODE_STRING within a WDK Driver using win32 and C

Question

I am trying to separate the components of a UNICODE_STRING path name in order to create the directory tree from the device root to the file leaf. This needs to be done in a WDK driver.

I need to build up the directory structure a piece at a time using ZwCreateFile() since it can only create the final directory or leaf rather than the entire path in a single call.

Apologies for such a simple question for you C engineers but I am having issues getting my head around it and utilising it in a driver.

My current approach is to convert a UNICODE_STRING to char and use the strtok_s() function to break the path name into its component directories and file.

I am looking to use

char string1[] =
    "\\Device\\HarddiskVolume";

char seps[] = "\\";
char *token1 = NULL;

char *next_token1 = NULL;

token1 = strtok_s(string1, seps, &next_token1);

But I need to convert a UNICODE_STRING to char string.

Answer 1

Here is an example that you can start with. The function PathBuf() walks through a string copying the parts of a pathname into a destination buffer. The function does this by being called multiple times until it reaches the end of the string.

You will need to check that this satisfies your needs and to do any additional tweaks you may need to get what you want.

I also used wchar_t in order to do my testing. You will probably need to change to UNICODE_STRING or something similar.

Notice that there are a few edge cases such as two path separators without any intervening text. Spaces should be just another character in the pathname piece.

In Windows pathnames there is network device type of syntax such as "\device\file" so you may need to add something to know whether the first piece is a device being introduced with two slashes or not.

I also made this so that it will handle either Windows pathname separators (backslash) or Linux pathname separators (forward slash) which seems to be fairly standard approach.

#include <stdlib.h>
#include <stdio.h>

wchar_t *PathBuf(wchar_t *pDest, const wchar_t *pSrc)
{
    // if not NULL source string and not the end of the source string, process it.
    if (pSrc && *pSrc) {
        short iState = 0;  // start state off as no characters found.
        do {
            // determine whether this is a path separator or a file path
            // path component text character. set the current state based
            // on the current character in the source text string.
            switch (*pSrc) {
                case L'\\':    // backslash path separator found
                case L'/':     // forward slash path separator found
                    iState = (iState == 0) ? 1 : 2;  // first instance or not?
                    break;
                default:
                    *pDest++ = *pSrc;  // copy the character from source to destination buffer
                    iState = 1;  // indicate at least one character found
                    break;
            }
            // continue the loop until either ending path separator found
            // or we have reached end of the source string.
            // we will continue on the next call after the path separator.
        } while (*pSrc && *pSrc++ && iState < 2);
    }
    *pDest = 0;   // end of string terminator for destination buffer

    return pSrc;  // return our current place in the source string
}

int testfunc(void)
{
    wchar_t *list[] = {
        L"\\state",
        L"state2",
        L"\\\\state3\\",
        L"\\statex\\state4",
        L"xx"
    };
    int i;

    for (i = 0; i < sizeof(list) / sizeof(list[0]); i++) {
        wchar_t *p1;         // pointer to source string which is updated
        wchar_t buff[128];   // destination buffer for each component
        p1 = list[i];        // start the source string with the next test item
        printf("Doing %S\n", p1);   // print out the entire test string
        while (*p1) {
            p1 = PathBuf(buff, p1);    // copy first path component into buff, update source string pointer
            printf ("  \"%S\"", buff);  // print out the path component found within double quotes
            // at this point you could use ZwCreateFile() to create the path component.
            // a sanity check on the text such as empty string may be in order.
        }
        printf("\n");
    }
}

This source will output the following:

Doing \state
  "state"
Doing state2
  "state2"
Doing \\state3\
  ""  "state3"
Doing \statex\state4
  "statex"  "state4"
Doing xx
  "xx"

See also

Directory relative ZwCreateFile

The Definitive Guide on Win32 to NT Path Conversion

Nt vs. Zw - Clearing Confusion On The Native API

Answer 2

Here's a piece of code.

code.c:

#include <Windows.h>
#include <SubAuth.h>


char* unicodeStringToPChar(UNICODE_STRING *pUS) {
    size_t wcLen = 0, cLen = 0;
    wchar_t *pWBuf = NULL;
    char *pBuf = NULL;
    errno_t res = 0;
    if (!pUS || !pUS->Length) {
        return NULL;
    }
    wcLen = pUS->Length / sizeof(wchar_t) + 1;
    pWBuf = calloc(1, wcLen * sizeof(wchar_t));
    if (!pWBuf) {
        return NULL;
    }
    if (wcsncpy_s(pWBuf, wcLen, pUS->Buffer, wcLen - 1)) {
        free(pWBuf);
        return NULL;
    }
    wcstombs_s(&cLen, NULL, 0, pWBuf, 0);
    if (!cLen) {
        free(pWBuf);
        return NULL;
    }
    pBuf = calloc(1, cLen);
    if (!pBuf) {
        free(pWBuf);
        return NULL;
    }
    res = wcstombs_s(NULL, pBuf, cLen, pWBuf, cLen - 1);
    free(pWBuf);
    if (res) {
        free(pBuf);
        return NULL;
    }
    return pBuf;
}

Notes:

• Function receives a pointer to an UNICODE_STRING (don't forget to reference if you have a plain structure)
• Returns a char*, NULL if it can't convert the string (whether it's empty, or some error occurred)
  • You can add some output messages (e.g. printf) before return NULL; statements
  • Don't forget to free the returned value once you're done with it to avoid memory leaks (in the caller)

• There are 2 steps:

  • "Save" the UNICODE_STRING contents in a wchar_t*:
    • Allocate the wchar_t* (calloc)
    • Copy the contents (wcsncpy_s)
    • This step might not be necessary (one could operate on the UNICODE_STRING.Buffer directly - and thus consider this step an overkill), but I wanted to be rigorous and only allocate the required number of bytes for the return value (check next item)

  • Convert the wchar_t* to a char*:

    • Again, allocate the char* (calloc)

    • Perform the conversion (wcstombs_s)

      • The 1^st call to wcstombs_s is used to determine how much space is needed for the char* buffer. I used the (intermediary) wchar_t* because according to:

        • [MS.Docs]: UNICODE_STRING structure ((some) emphasis is mine):

          Buffer
                     Pointer to a wide-character string. Note that the strings returned by the various LSA functions might not be null-terminated

        • [MS.Docs]: wcstombs_s, _wcstombs_s_l:

          If wcstombs_s successfully converts the source string, it puts the size in bytes of the converted string, including the null terminator, into *pReturnValue (provided pReturnValue is not NULL). This occurs even if the mbstr argument is NULL and provides a way to determine the required buffer size. Note that if mbstr is NULL*, count **is ignored.

        there are cases when that's not possible from UNICODE\_STRING.Buffer (when it doesn't end with NULL char, and contains special (wide) chars (that take 2 bytes))

I didn't test the function thoroughly, let me know how it works out for you.

After more clarification, I understood that none of the above is usable in a driver. However on [CodeGuru]: ZwCreatefile/ ZwReadfile, there's an example of using ZwCreatefile and UNICODE_STRING (via RtlInitUnicodeString and InitializeObjectAttributes) that I'm going to paste from below (didn't test anything):

#include <ntddk.h>

HANDLE handle;
NTSTATUS ntstatus;
UNICODE_STRING uniName;
OBJECT_ATTRIBUTES  objAttr;
RtlInitUnicodeString(&uniName, L"\\SystemRoot\\native.txt");
InitializeObjectAttributes(&objAttr, &uniName,
                           OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                           NULL, NULL);
ntstatus = ZwCreateFile(&handle,
                        GENERIC_READ,
                        &objAttr, &ioStatusBlock,
                        NULL,
                        FILE_ATTRIBUTE_NORMAL,
                        0,
                        FILE_OPEN, 
                        FILE_SYNCHRONOUS_IO_NONALERT,
                        NULL, 0);