UNICODE_STRING__ZC

1、KdPrint_DbgPrint and UNICODE_STRING_ANSI_STRING - swanabin的专栏 - 博客频道 - CSDN.NET.html

http://blog.csdn.net/swanabin/article/details/23457793

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef struct _STRING {
    USHORT Length;
    USHORT MaximumLength;
    PCHAR Buffer;
} STRING;
typedef STRING *PSTRING;

typedef STRING ANSI_STRING;
typedef PSTRING PANSI_STRING;

To make life easier MS have extended kernel CRTL output() function with Z format specifier. This works for all kernel functions those understand formatted strings (e.g. sprintf, _vsnprintf, KdPrint/DbgPrint). For example:
PUNICODE_STRING pUStr;
PANSI_STRING    pAStr;
...
KdPrint(("Unicode string: %wZ\n", pUStr));
KdPrint(("ANSI    string: %Z\n",  pAStr));
Though, you can use a little more complicated documented way. Btw, this form is suitable for printing byte array of strictly defined length.
KdPrint(("Unicode string: %*.*ws\n",pUStr->Length/sizeof(WCHAR),
    pUStr->Length/sizeof(WCHAR), pUStr));
KdPrint(("Unicode string: %*.*S\n",pUStr->Length/sizeof(WCHAR),
    pUStr->Length/sizeof(WCHAR), pUStr));
KdPrint(("ANSI    string: %*.*s\n", pAStr->Length/sizeof(CHAR),
    pAStr->Length/sizeof(CHAR),  pAStr));
Or, if you want to take into account NULL-terminator, but limit output length to specified number of characters:
KdPrint(("Unicode string: %.*ws\n",
    pUStr->Length/sizeof(WCHAR), pUStr));
KdPrint(("Unicode string: %.*S\n",
    pUStr->Length/sizeof(WCHAR), pUStr));
KdPrint(("ANSI    string: %.*s\n",
    pAStr->Length/sizeof(CHAR),  pAStr));

 

2、DbgPrint_KdPrint输出格式控制 - whatday的专栏 - 博客频道 - CSDN.NET.html

http://blog.csdn.net/whatday/article/details/9530723

 

在驱动编程学习中，往往需要通过DbgPrint或者KdPrint来输出调试信息，对于Check版本，KdPrint只是DbgPrint的一个宏定义，而对于Free版本，KdPrint将被优化掉。这些输出信息可以通过DebugView对内核的监控来看到。

KdPrint is identical to the DbgPrint routine in code that is compiled in achecked build environment. This routine has no effect if compiled in a free build environment. Only kernel-mode drivers can call theKdPrint routine.

下面还是说一下他们的输出格式控制吧：

符号	格式说明符	类型
%c, %lc	ANSI字符	char
%C, %wc	宽字符	wchar_t
%d, %i	十进制有符号整数	int
%D	十进制__int64	__int64
%L	十六进制的LARGE_INTEGER	LARGE_INTEGER
%s, %ls	NULL终止的ANSI字符串	char*
%S, %ws	NULL终止的宽字符串	wchar_t*
%Z	ANSI_STRING字符串	ANSI_STRING
%wZ	UNICODE_STRING字符串	UNICODE_STRING
%u	十进制的ULONG	ULONG
%x	小写字符十六进制的ULONG	ULONG
%X	大写字符十六进制的ULONG	ULONG
%p	指针Pointer 32/64位

就那么多。根据DDK上说明,Unicode格式(%C, %S, %lc, %ls, %wc, %ws, and %wZ)只能在 IRQL = PASSIVE_LEVEL时才能使用。

需要注意 中文的 WCHAR 和 UNICODE_STRING可能会被截断打印不出来 需要转化为 CHAR 和 ANSI_STRING来打印

具体实例：

ANSI_STRING ansiString;
//省去对ansiString初始化
KdPrint(("%Z\n", &ansiString));    //注意是%Z

UNICODE_STRING uniString;
//省去对uniString初始化
KdPrint(("%wZ\n", &uniString));    //注意是%wZ

 

3、

4、

5、