cstring-matchingwindows-kernel

FsRtlIsNameInExpression never matches anything


I do string matching in a kernel driver using the Boyer-Moore algorithm, but I also need to implement basic wildcard support. This answer on SO mentioned the function FsRtlIsNameInExpression, which looks just right for my needs. It even looks like it handles case insensitivity for Unicode strings.

But I can't even get it to match a simple string with itself.

I tried a few things, but FsRtlIsNameInExpression never matches anything. Here is some code I used to test (I put the call to MyTest at the end of my DriverEntry routine).

NTSTATUS MyTest()
{
    int matches = 0;

    UNICODE_STRING a3times;
    UNICODE_STRING A5times;
    UNICODE_STRING bbb;
    UNICODE_STRING patterna;
    UNICODE_STRING patternb;

    RtlInitUnicodeString(&a3times, L"aaa");
    RtlInitUnicodeString(&A5times, L"AAAAA");
    RtlInitUnicodeString(&bbb, L"bbb");

    RtlInitUnicodeString(&patterna, L"a*a");
    RtlInitUnicodeString(&patternb, L"b*");

    if(FsRtlIsNameInExpression(&patterna, &a3times, TRUE, 0)) 
        ++matches;            // a*a should match aaa

    if(FsRtlIsNameInExpression(&patterna, &A5times, FALSE, 0))
        ++matches;            // a*a should match (insensitive) AAAAA

    if(FsRtlIsNameInExpression(&a3times, &a3times, TRUE, 0))
        ++matches;            //aaa should match aaa

    if(FsRtlIsNameInExpression(&patternb, &bbb, TRUE, 0))
        ++matches;            //b* should match bbb

    return matches;   //Should be 4, but is 0
}

For the record :

What is the obvious thing that I am missing ?


Solution

  • The documentation says

    If IgnoreCase is TRUE, Expression must be uppercase.

    Note that, per your comments, you misunderstood the case-sensitivity parameter. It is IgnoreCase not CaseSensitive.

    As for the results:

    1. Lower-case expression with IgnoreCase set to TRUE - won't work
    2. Lower-case expression, IgnoreCase set to FALSE, upper case pattern - won't match
    3. Lower-case expression with IgnoreCase set to TRUE - won't work
    4. Lower-case expression with IgnoreCase set to TRUE - won't work

    Just really bad luck that not a single one worked :)