内存管理相关内核API

 A、RtlCopyMemory,RtlCopyBytes和RtlMoveMemory

 C、RtlZeroMemory和RtlFillMemory

 D、RtlEqualMemory

 E、ExAllocatePool和 ExFreePool

 F、重载new和delete操作符

RtlCopyMemory

//把地址Source开始的长度为Length这块内存数据 复制到Destination

VOID RtlCopyMemory(

__in  VOID UNALIGNED *Destination,
  IA64 表示逐字节对齐 #pragma packed(1) byte

__in  const VOID UNALIGNED *Source,
 

__in  SIZE_T Length
);

RtlCopyBytes //memcpy

VOID RtlCopyBytes(
 

 __in  PVOID Destination,
 

 __in  const VOID *Source,

 __in  SIZE_T Length
);

 

RtlMoveMemory //重叠内存 A B C D p1=AD p2=BC

// memmove

VOID RtlMoveMemory(
 

__in  VOID UNALIGNED *Destination,

__in  const VOID UNALIGNED *Source,
 

__in  SIZE_T Length
);

RtlZeroMemory //清零内存块，清零长度为Length

VOID RtlZeroMemory(

__in  VOID UNALIGNED *Destination,
 

__in  SIZE_T Length
);
//字节

RtlFillMemory//为字符fill填充Destination 填充长度为Length

VOID RtlFillMemory(

 __in  VOID UNALIGNED *Destination,
 

 __in  SIZE_T Length,
 

 __in  UCHAR Fill
);

RtlEqualMemory //比较内存块source1和Source2 长度为Length这个范围内是否相等

LOGICAL RtlEqualMemory(

__in  const VOID *Source1,
 

__in  const VOID *Source2,
 

__in  SIZE_T Length
);

SIZE_T RtlCompareMemory(
 

__in  const VOID *Source1,
 

__in  const VOID *Source2,
 

__in  SIZE_T Length
);

 

ExAllocatePool

PVOID ExAllocatePool(
 

 __in  POOL_TYPE PoolType,
 

__in  SIZE_T NumberOfBytes
);

ExFreePool

VOID ExFreePool(
 __in  PVOID P
);
 

重载new和delete操作符

//重载new

void * __cdecl operator new(size_t size,POOL_TYPE PoolType=PagedPool)

{

       KdPrint(("global operator new\n"));

       KdPrint(("Allocate size :%d\n",size));

       return ExAllocatePool(PagedPool,size);

}

//重载delete

void __cdecl operator delete(void* pointer)

{

       KdPrint(("Global delete operator\n"));

       ExFreePool(pointer);

}

The POOL_TYPE enumeration type specifies the type of system memory to allocate.

Syntax

Copy

typedef enum _POOL_TYPE {

  NonPagedPool                    = 0,  //不分页

  PagedPool                       = 1,   //分页

  NonPagedPoolMustSucceed         = 2, //指定分配 非分页内存，要求必须成功。

  DontUseThisType                 = 3, //未指定，留给系统使用

  NonPagedPoolCacheAligned        = 4,//非分页内存，要求内存边界对齐。

  PagedPoolCacheAligned           = 5,//分页内存，要求内存边界对齐。

  NonPagedPoolCacheAlignedMustS   = 6 //指定分配 非分页内存，要求内存边界对齐，要求必须成功。

} POOL_TYPE;

#define RtlCopyBytes  RtlCopyMemory

#define RtlZeroBytes   RtlZeroMemory

#define RtlFillBytes   RtlFillMemory

Constants

NonPagedPool

Nonpaged pool, which is nonpageable system memory. Nonpaged pool can be accessed from any IRQL, but it is a scarce resource and drivers should allocate it only when necessary.

The system can allocate buffers larger than PAGE_SIZE from nonpaged pool only in multiples of PAGE_SIZE. Requests for buffers larger than PAGE_SIZE, but not a PAGE_SIZE multiple, waste nonpageable memory.

PagedPool

Paged pool, which is pageable system memory. Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.

NonPagedPoolMustSucceed

This value is for internal use only, and is allowed only during system startup. Drivers must not specify this value at times other than system startup, because a "must succeed" request crashes the system if the requested memory size is unavailable.

DontUseThisType

Reserved for system use.

NonPagedPoolCacheAligned

Nonpaged pool, aligned on processor cache boundaries. This value is for internal use only.

PagedPoolCacheAligned

Paged pool, aligned on processor cache boundaries. This value is for internal use only.

NonPagedPoolCacheAlignedMustS

This value is for internal use only, and is allowed only during system startup. It is the cache-aligned equivalent of NonPagedPoolMustSucceed.

Remarks

When the system allocates a buffer from pool memory of PAGE_SIZE or greater, it aligns the buffer on a page boundary. Memory requests smaller than PAGE_SIZE are not necessarily aligned on page boundaries, but these requests always fit within a single page and are aligned on an 8-byte boundary.

Requirements

Header

Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)

__unaligned 关键字会让指针逐字节读取

#pragma packed(1)