内存清理常用函数

内存清理常用函数

0x01.RtlSecureZeroMemory

PVOID RtlSecureZeroMemory(
    _Out_ PVOID  ptr,
    _In_  SIZE_T cnt
);

• The RtlSecureZeroMemory routine fills a block of memory with zeros in a way that is guaranteed to be secure.

Parameters

ptr [out]
    Pointer to the memory buffer to be filled with zeros.//需要清零的指针
cnt [in]
    Specifies the number of bytes to be filled with zeros.//需要填充长度
Return value

Return value

None

Remarks

The effect of RtlSecureZeroMemory is identical to that of RtlZeroMemory, except that it is guaranteed to zero the memory location, even if it is not subsequently written to. (The compiler can optimize away a call to RtlZeroMemory, if it determines that the caller does not access that memory range again.)

Use RtlSecureZeroMemory to guarantee that sensitive information has been zeroed out. For example, suppose that a function uses a local array variable to store password information. Once the function exits, the password information can remain in the same memory location unless zeroed out by RtlSecureZeroMemory.

RtlSecureZeroMemory is slower than RtlZeroMemory; therefore, if security is not an issue, use RtlZeroMemory instead.

Callers of RtlSecureZeroMemory can be running at any IRQL if the ptr block is in nonpaged pool. Otherwise, the caller must be running at IRQL <= APC_LEVEL.

Requirements

Target platform
Version	Available in Windows Server 2003 and later versions of Windows. (Because the routine is declared inline, the body of the routine can be included in earlier versions of the operating system.)
Header	Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)
IRQL	Any level (See Remarks section)

0x02.RtlFillMemory

VOID RtlFillMemory(
  _Out_ VOID UNALIGNED *Destination,
  _In_  SIZE_T         Length,
  _In_  UCHAR          Fill
);

Parameters

Destination [out]
    A pointer to the block of memory to be filled.
Length [in]
    The number of bytes in the block of memory to be filled.
Fill [in]
    The value to fill the destination memory block with. This value is copied to every byte in the memory block that is defined by Destination and Length.

Return value
None

Remarks

Callers of RtlFillMemory can be running at any IRQL if the destination memory block is in nonpaged system memory. Otherwise, the caller must be running at IRQL <= APC_LEVEL.

0x03.RtlZeroMemory

VOID RtlZeroMemory(
  _Out_ VOID UNALIGNED *Destination,
  _In_  SIZE_T         Length
);

Parameters

Destination [out]
    A pointer to the memory block to be filled with zeros.
Length [in]
    The number of bytes to fill with zeros.

Return value

None

Remarks

To zero out a memory buffer to erase security-sensitive data, use RtlSecureZeroMemory instead.
Callers of RtlZeroMemory can be running at any IRQL if the destination memory block is in nonpaged system memory. Otherwise, the caller must be running at IRQL <= APC_LEVEL.