API备忘录

字符类型转换

Ring3	
	mbstowcs wcstombs #include <locale.h>
	MultiByteToWideChar()
	WideCharToMultiByte()
Ring0
	RtlUnicodeToMultiByteN()
	RtlMultiByteToUnicodeN()

格式化字符串

Ring0
	//RtlStringCbPrintfW(wstr, 260, L"%hs", pProcName);
	//RtlStringCbPrintfA();

Ring3自用轮子_DbgPrint

void DbgPrintf(char const* const _Format, ...)
{
	char str[1024] = { 0 };
	va_list args;
	va_start(args, _Format);
	//sprintf编译时会固定参数，所以用vsprintf
	vsprintf(str, _Format, args);
	OutputDebugStringA(str);
	va_end(args);
}

Ring0自用轮子_Sleep

VOID KeSleep(IN LONG lSeccond)
{
	LARGE_INTEGER my_interval;
	my_interval.QuadPart = -10 * 1000;
	my_interval.QuadPart *= lSeccond;
	KeDelayExecutionThread(KernelMode, 0, &my_interval);
}// lSeccond*1000为1秒

常用技巧

UNREFERENCED_PARAMETER(X)//屏蔽未引用警告
#pragma warning(disable:4996)//屏蔽#4996警告
#include <crtdbg.h> _CrtDumpMemoryLeaks(); //内存泄漏检测