1、
内存管理相关内核API
A、RtlCopyMemory,RtlCopyBytes和RtlMoveMemory
C、RtlZeroMemory和RtlFillMemory
D、RtlEqualMemory
E、ExAllocatePool和 ExFreePool
F、重载new和delete操作符
【225】下面是从MSDN里面，复制出来的函数的说明
“
RtlCopyMemory
//把地址Source开始的长度为Length这块内存数据 复制到Destination
VOID RtlCopyMemory(
__in VOID UNALIGNED *Destination, ////IA64 表示逐字节对齐 #pragma packed(1) byte
__in const VOID UNALIGNED *Source,
__in SIZE_T Length
);
”
【310】"UNALIGNED" 表示 不对其的一个方式，它也是一个宏。它一般表示 在32位的系统下面 相当于是一个空宏；在64位平台 及一些其他的平台下面，它表示 比如说 IA64的平台下面 表示逐字节对齐（有点像 前面学过的 "#pragma packed(1)"）。【505】也就是说，相当于 其实这个指针("VOID UNALIGNED *Destination")的话有点相当于byte*，我是这样理解的
ZC: 自己再看看 这个宏的定义到底是啥... 个人理解，偏向于 不管什么平台都是相当于 byte*。
【950】
“
RtlCopyBytes // memcpy
VOID RtlCopyBytes(
__in PVOID Destination,
__in const VOID *Source,
__in SIZE_T Length
);
”
ZC: RtlCopyBytes 和 RtlCopyMemory，区别是啥？
【1015】
“
RtlMoveMemory // 重叠内存 A B C D p1=AD p2=BC
// memmove
VOID RtlMoveMemory(
__in VOID UNALIGNED *Destination,
__in const VOID UNALIGNED *Source,
__in SIZE_T Length
);
”
2、
RtlZeroMemory //清零内存块，清零长度为Length
VOID RtlZeroMemory(
__in VOID UNALIGNED *Destination,
__in SIZE_T Length
);
//字节
RtlFillMemory//为字符fill填充Destination 填充长度为Length
VOID RtlFillMemory(
__in VOID UNALIGNED *Destination,
__in SIZE_T Length,
__in UCHAR Fill
);
RtlEqualMemory //比较内存块source1和Source2 长度为Length这个范围内是否相等
LOGICAL RtlEqualMemory(
__in const VOID *Source1,
__in const VOID *Source2,
__in SIZE_T Length
);
SIZE_T RtlCompareMemory(
__in const VOID *Source1,
__in const VOID *Source2,
__in SIZE_T Length
);
ExAllocatePool
PVOID ExAllocatePool(
__in POOL_TYPE PoolType,
__in SIZE_T NumberOfBytes
);
ExFreePool
VOID ExFreePool(
__in PVOID P
);
重载new和delete操作符
//重载new
void * __cdecl operator new(size_t size, POOL_TYPE PoolType=PagedPool)
{
KdPrint(("global operator new\n"));
KdPrint(("Allocate size :%d\n",size));
return ExAllocatePool(PagedPool,size);
}
//重载delete
void __cdecl operator delete(void* pointer)
{
KdPrint(("Global delete operator\n"));
ExFreePool(pointer);
}
The POOL_TYPE enumeration type specifies the type of system memory to allocate.
Syntax
Copy
typedef enum _POOL_TYPE {
NonPagedPool = 0, //不分页
PagedPool = 1, //分页
NonPagedPoolMustSucceed = 2, //指定分配 非分页内存，要求必须成功。
DontUseThisType = 3, //未指定，留给系统使用
NonPagedPoolCacheAligned = 4,//非分页内存，要求内存边界对齐。
PagedPoolCacheAligned = 5,//分页内存，要求内存边界对齐。
NonPagedPoolCacheAlignedMustS = 6 //指定分配 非分页内存，要求内存边界对齐，要求必须成功。
} POOL_TYPE;
#define RtlCopyBytes RtlCopyMemory
#define RtlZeroBytes RtlZeroMemory
#define RtlFillBytes RtlFillMemory
Constants
NonPagedPool
Nonpaged pool, which is nonpageable system memory. Nonpaged pool can be accessed from any IRQL, but it is a scarce resource and drivers should allocate it only when necessary.
The system can allocate buffers larger than PAGE_SIZE from nonpaged pool only in multiples of PAGE_SIZE. Requests for buffers larger than PAGE_SIZE, but not a PAGE_SIZE multiple, waste nonpageable memory.
PagedPool
Paged pool, which is pageable system memory. Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.
NonPagedPoolMustSucceed
This value is for internal use only, and is allowed only during system startup. Drivers must not specify this value at times other than system startup, because a "must succeed" request crashes the system if the requested memory size is unavailable.
DontUseThisType
Reserved for system use.
NonPagedPoolCacheAligned
Nonpaged pool, aligned on processor cache boundaries. This value is for internal use only.
PagedPoolCacheAligned
Paged pool, aligned on processor cache boundaries. This value is for internal use only.
NonPagedPoolCacheAlignedMustS
This value is for internal use only, and is allowed only during system startup. It is the cache-aligned equivalent of NonPagedPoolMustSucceed.
Remarks
When the system allocates a buffer from pool memory of PAGE_SIZE or greater, it aligns the buffer on a page boundary. Memory requests smaller than PAGE_SIZE are not necessarily aligned on page boundaries, but these requests always fit within a single page and are aligned on an 8-byte boundary.
Requirements
Header Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)
__unaligned 关键字会让指针逐字节读取
#pragma packed(1)