内存清理常用函数
0x01.RtlSecureZeroMemory
PVOID RtlSecureZeroMemory(
_Out_ PVOID ptr,
_In_ SIZE_T cnt
);
- The RtlSecureZeroMemory routine fills a block of memory with zeros in a way that is guaranteed to be secure.
Parameters
ptr [out]
Pointer to the memory buffer to be filled with zeros.//需要清零的指针
cnt [in]
Specifies the number of bytes to be filled with zeros.//需要填充长度
Return value
Return value
None
Remarks
The effect of RtlSecureZeroMemory
is identical to that of RtlZeroMemory
, except that it is guaranteed to zero the memory location, even if it is not subsequently written to. (The compiler can optimize away a call to RtlZeroMemory
, if it determines that the caller does not access that memory range again.)
Use RtlSecureZeroMemory
to guarantee that sensitive information has been zeroed out. For example, suppose that a function uses a local array variable to store password information. Once the function exits, the password information can remain in the same memory location unless zeroed out by RtlSecureZeroMemory
.
RtlSecureZeroMemory
is slower than RtlZeroMemory
; therefore, if security is not an issue, use RtlZeroMemory
instead.
Callers of RtlSecureZeroMemory
can be running at any IRQL if the ptr block is in nonpaged pool. Otherwise, the caller must be running at IRQL <= APC_LEVEL.
Requirements
Target platform | |
---|---|
Version | Available in Windows Server 2003 and later versions of Windows. (Because the routine is declared inline, the body of the routine can be included in earlier versions of the operating system.) |
Header | Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h) |
IRQL | Any level (See Remarks section) |
0x02.RtlFillMemory
VOID RtlFillMemory(
_Out_ VOID UNALIGNED *Destination,
_In_ SIZE_T Length,
_In_ UCHAR Fill
);
Parameters
Destination [out]
A pointer to the block of memory to be filled.
Length [in]
The number of bytes in the block of memory to be filled.
Fill [in]
The value to fill the destination memory block with. This value is copied to every byte in the memory block that is defined by Destination and Length.
Return value
None
Remarks
Callers of RtlFillMemory
can be running at any IRQL if the destination memory block is in nonpaged system memory. Otherwise, the caller must be running at IRQL <= APC_LEVEL.
0x03.RtlZeroMemory
VOID RtlZeroMemory(
_Out_ VOID UNALIGNED *Destination,
_In_ SIZE_T Length
);
Parameters
Destination [out]
A pointer to the memory block to be filled with zeros.
Length [in]
The number of bytes to fill with zeros.
Return value
None
Remarks
To zero out a memory buffer to erase security-sensitive data, use RtlSecureZeroMemory
instead.
Callers of RtlZeroMemory
can be running at any IRQL if the destination memory block is in nonpaged system memory. Otherwise, the caller must be running at IRQL <= APC_LEVEL.