Function IsSubstringInUnicodeString

RedEdrDriver/utils.c:29–47

TODO SLOW

// TODO SLOW
int IsSubstringInUnicodeString(PUNICODE_STRING pDestString, PCWSTR pSubString) {
    if (pDestString->Length == 0 || pDestString->Buffer == NULL || pSubString == NULL) {
        return FALSE;
    }
    size_t lengthInWchars = pDestString->Length / sizeof(WCHAR);
    WCHAR tempBuffer[PATH_LEN];
    
    // Ensure we don't overflow the temp buffer
    if (lengthInWchars >= sizeof(tempBuffer) / sizeof(WCHAR)) {
        return FALSE;
    }
    
    // Safely copy and null-terminate
    RtlCopyMemory(tempBuffer, pDestString->Buffer, pDestString->Length);
    tempBuffer[lengthInWchars] = L'\0';
    
    int result = wcsstr(tempBuffer, pSubString) != NULL;
    return result;
}


void Unicodestring2wcharAlloc(const UNICODE_STRING* ustr, wchar_t* dest, size_t destSize)