cKernel.h

Go to the documentation of this file.

//
 
#ifndef _INC_CKernel_H
#define _INC_CKernel_H
#if _MSC_VER >= 1000
#pragma once
#endif // _MSC_VER >= 1000
 
#if DBG || defined(_DEBUG)
// either DBG or _DEBUG is set then both MUST be set.
#ifndef DBG
#define DBG 1
#elif ! DBG
#error "DBG conflicts with _DEBUG"
#endif
#ifndef _DEBUG
#define _DEBUG
#endif
#endif
 
#ifdef _DEBUG
// #define USE_WINXP // just for testing purposes.
#endif
 
#include <ntddk.h>
 
#include <stddef.h>     // offsetof
#include <stdarg.h>     // va_list
 
#ifndef _countof
#define _countof(a) (sizeof(a)/sizeof((a)[0]))  // same as dimensionof(a) ? = count of elements of an array
#endif
#define HANDLE_NULL NULL
typedef int COMPARE_t;
 
// Useful partly documented Kernel Functions.
extern "C"
{
        NTSYSAPI NTSTATUS NTAPI ObOpenObjectByPointer( // opposite of ObReferenceObjectByHandle
                PVOID Object,
                ULONG HandleAttributes,
                PACCESS_STATE PassedAccessState, // optional
                ACCESS_MASK DesiredAccess,
                POBJECT_TYPE ObjectType,
                KPROCESSOR_MODE AccessMode,
                PHANDLE Handle);
 
        NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess( // like NtQueryInformationProcess but for kernel mode.
                IN HANDLE          ProcessHandle,
                IN PROCESSINFOCLASS ProcessInformationClass,
                OUT PVOID          ProcessInformation,
                IN ULONG            ProcessInformationLength,
                OUT PULONG          uReturnLength OPTIONAL);
};
 
namespace GrayKernel
{
#ifdef _DEBUG
        enum DL_TYPE
        {
                DL_DEFAULT = -2,        
                DL_NONE = -1,
                DL_ERROR = 0,   
                DL_WARN,                
                DL_TRACE,               
                DL_BLAB,                
        };
 
#ifndef DEBUG_VARIABLE
#define DEBUG_VARIABLE DBG_DebugLevel
        extern DL_TYPE DBG_DebugLevel;
#endif
 
#define DBG_CR "\n"
 
#ifndef DBG_PREFIX
#define DBG_PREFIX "KCOM: "
#endif
#ifndef DBG_COMPONENTID
#define DBG_COMPONENTID DPFLTR_IHVDRIVER_ID     // DPFLTR_SYSTEM_ID
#endif
 
#if 0
#define DBG_MSG_F(_Level) ::GrayKernel::DBG_##_Level##_F
#define DBG_MSG_F_DECL(_Level) \
inline void _cdecl DBG_MSG_F(_Level)( const char* pszFormat, ... ) \
{ \
        va_list vargs; \
        va_start( vargs, pszFormat ); \
        vDbgPrintExWithPrefix( DBG_PREFIX, DBG_COMPONENTID, DL_##_Level, (PCH) pszFormat, vargs ); \
        va_end( vargs ); \
}
        DBG_MSG_F_DECL(ERROR)
                DBG_MSG_F_DECL(WARN)
                DBG_MSG_F_DECL(TRACE)
                DBG_MSG_F_DECL(BLAB)
#else
#define DBG_MSG_F(_Level) DbgPrint( DBG_PREFIX ); DbgPrint
#endif
 
        // Saves the runtime overhead of pushing the args if the call is not required.
#define DBG_ERROR(_stmt) { if (DEBUG_VARIABLE>=DL_ERROR) { DBG_MSG_F(ERROR) _stmt; }}
#define DBG_WARN(_stmt) { if (DEBUG_VARIABLE>=DL_WARN) { DBG_MSG_F(WARN) _stmt; }}
#define DBG_TRACE(_stmt) { if (DEBUG_VARIABLE>=DL_TRACE) { DBG_MSG_F(TRACE) _stmt; }}
#define DBG_BLAB(_stmt) { if (DEBUG_VARIABLE>=DL_BLAB) { DBG_MSG_F(BLAB) _stmt; }}
 
// Assert/Halt with ULONG arguments.
#define ASSERT3(exp, p1, p2, p3) { if (!(exp)) { ::KeBugCheckEx(0xDEAD1FE0, (DBG_FILE_ID << 16) + __LINE__, p1, p2, p3); }}
 
#undef ASSERT
#define ASSERT(exp)     { if (!(exp)) { DBG_ERROR(( "ASSERT:'%s'" DBG_CR, #exp )); DbgBreakPoint(); }}
 
#else // _DEBUG
 
        // No debug
#define DBG_ERROR(stmt)
#define DBG_WARN(stmt)
#define DBG_TRACE(stmt)
#define DBG_BLAB(stmt)
 
#define ASSERT3(exp, p1, p2, p3)
#endif    // ! _DEBUG
 
//*******************************************************************
 
#ifdef USE_WINXP        // works for XP only.
#define CKeMem_Free(p,_UTAG)    ::ExFreePoolWithTag(p,_UTAG);
#else
#define CKeMem_Free(p,_UTAG)    ::ExFreePool(p);
#endif
 
        template <class TYPE, ULONG _UTAG = 'IKUn' >
        struct CKeMem
        {
        public:
                TYPE * m_p;
        public:
                void InitMem(TYPE* p = nullptr)
                {
                        m_p = p;
                }
                bool AllocMem(POOL_TYPE ePoolType, SIZE_T nNumberOfBytes = sizeof(TYPE))
                {
                        m_p = (TYPE*) ::ExAllocatePoolWithTag(ePoolType, nNumberOfBytes, _UTAG);
                        return IsValidMem();
                }
                NTSTATUS AllocMemQuota(POOL_TYPE ePoolType, SIZE_T nNumberOfBytes = sizeof(TYPE))
                {
                        NTSTATUS lStatus = STATUS_SUCCESS;
                        m_p = nullptr;
                        // This can throw an exception. so try to catch it.
                        __try
                        {
                                m_p = (TYPE*)ExAllocatePoolWithQuotaTag(ePoolType, nNumberOfBytes, _UTAG);
                        }
                        __except (EXCEPTION_EXECUTE_HANDLER)
                        {
                                lStatus = GetExceptionCode();
                        }
                        return lStatus;
                }
                void FreeLast()
                {
                        if (m_p == nullptr)
                                return;
                        CKeMem_Free(m_p, _UTAG);
                }
                void Free()
                {
                        if (m_p == nullptr)
                                return;
                        CKeMem_Free(m_p, _UTAG);
                        m_p = nullptr;
                }
                TYPE* DetachMem()
                {
                        TYPE* p = m_p;
                        ASSERT(p != nullptr);
                        m_p = nullptr;
                        return p;
                }
                bool IsValidMem() const
                {
                        return m_p != nullptr;
                }
                operator const TYPE*() const
                {
                        return m_p;
                }
                operator TYPE*()
                {
                        return m_p;
                }
                TYPE* operator ->()
                {
                        return m_p;
                }
        };
 
        template< ULONG _UTAG >
        struct CKeDynamic
        {
        public:
                void DestroyThis()
                {
                        CKeMem_Free(this, _UTAG);
                }
        };
 
        //**************************************************************************
 
        struct __declspec(novtable) CKeMDL : public _MDL
        {
        public:
                void FreeMdl()
                {
                        ASSERT(this != nullptr);
                        ::IoFreeMdl(this);
                }
                void ProbeAndLockPages(IN KPROCESSOR_MODE eAccessMode = KernelMode, IN LOCK_OPERATION eOperation = IoModifyAccess)
                {
                        ASSERT(this != nullptr);
                        ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        MmProbeAndLockPages(this, eAccessMode, eOperation);
                }
                void MapLockedPages(KPROCESSOR_MODE eAccessMode = KernelMode)
                {
                        ASSERT(this != nullptr);
                        MmMapLockedPages(this, eAccessMode);
                }
                void UnlockPages()
                {
                        ASSERT(this != nullptr);
                        MmUnlockPages(this);
                }
        };
 
        //**************************************************************************
 
        struct CKeInterlockedLong
        {
        public:
                LONG m_lVal;
        public:
                void Init(LONG lVal = 0)
                {
                        m_lVal = lVal;
                }
                LONG Increment()
                {
                        return InterlockedIncrement(&m_lVal);
                }
                LONG Decrement()
                {
                        return InterlockedDecrement(&m_lVal);
                }
                LONG Exchange(LONG lVal = 0)
                {
                        return InterlockedExchange(&m_lVal, lVal);
                }
                LONG ExchangeAdd(LONG lValAdd)
                {
                        return InterlockedExchangeAdd(&m_lVal, lValAdd);
                }
                LONG ExchangeIf(LONG lValCompare, LONG lVal = 0)
                {
                        return InterlockedCompareExchange(&m_lVal, lVal, lValCompare);
                }
                operator LONG() const
                {
                        return m_lVal;
                }
        };
 
#if defined(_M_IA64)
        struct CKeInterlocked64
        {
        public:
                LONGLONG m_qVal;
        public:
                CKeInterlocked64()
                {}
                CKeInterlocked64(LONGLONG qVal) : m_qVal(qVal)
                {}
                void Init(LONGLONG qVal = 0)
                {
                        m_qVal = qVal;
                }
                LONGLONG Increment()
                {
                        return InterlockedIncrement64(&m_qVal);
                }
                LONGLONG Decrement()
                {
                        return InterlockedDecrement64(&m_qVal);
                }
                LONGLONG Exchange(LONGLONG qVal = 0)
                {
                        return InterlockedExchange64(&m_qVal, qVal);
                }
                LONGLONG ExchangeAdd(LONGLONG qValAdd)
                {
                        return InterlockedExchangeAdd64(&m_qVal, qValAdd);
                }
                LONGLONG ExchangeIf(LONGLONG qValCompare, LONGLONG qVal = 0)
                {
                        return InterlockedCompareExchange64(&m_qVal, qVal, qValCompare);
                }
                operator LONGLONG() const
                {
                        return m_qVal;
                }
        };
#endif
 
        template <class TYPE>
        struct CKeInterlockedPtr
        {
        public:
                TYPE * m_pVal;
        public:
                void InitPtr(TYPE* pVal = nullptr)
                {
                        m_pVal = pVal;
                }
                TYPE* Exchange(TYPE* pVal = nullptr)
                {
                        return (TYPE*)InterlockedExchangePointer(&m_pVal, pVal);
                }
                TYPE* ExchangeIf(TYPE* pValCompare, TYPE* pVal = nullptr)
                {
                        return (TYPE*)InterlockedCompareExchangePointer(&m_pVal, pVal, pValCompare);
                }
                operator TYPE*() const
                {
                        return m_pVal;
                }
                TYPE*& InitRef()
                {
                        return m_pVal;
                }
        };
 
        template <class TYPE>
        struct CKeInterlockedPtrX : public CKeInterlockedPtr<TYPE>
        {
        public:
                CKeInterlockedPtrX(TYPE* pVal = nullptr)
                {
                        InitPtr(pVal);
                }
        };
 
        //**************************************************************************
        struct CKeSpinLock
        {
        public:
                KSPIN_LOCK m_SpinLock;
        public:
                void InitSpinLock()
                {
                        ::KeInitializeSpinLock(&m_SpinLock);
                }
                operator KSPIN_LOCK&()
                {
                        return m_SpinLock;
                }
                operator PKSPIN_LOCK()
                {
                        return &m_SpinLock;
                }
        };
 
        struct CKeSpinLockLock
        {
        public:
                PKSPIN_LOCK m_pSpinLock;        
                KIRQL m_OldIrql;        
        public:
                CKeSpinLockLock(PKSPIN_LOCK pSpinLock)
                        : m_pSpinLock(pSpinLock)
                {
                        ASSERT(pSpinLock != nullptr);
#if 0
                        m_OldIrql = KeAcquireSpinLockRaiseToDpc(pSpinLock);
#else
                        m_OldIrql = ::KfAcquireSpinLock(pSpinLock);
#endif
                }
                ~CKeSpinLockLock()
                {
                        ::KeReleaseSpinLock(m_pSpinLock, m_OldIrql);
                }
        };
 
        struct CKeSpinLockDpcLevel
        {
        public:
                PKSPIN_LOCK m_pSpinLock;        
        public:
                CKeSpinLockDpcLevel(PKSPIN_LOCK pSpinLock)
                        : m_pSpinLock(pSpinLock)
                {
                        // ASSUME KeInitializeSpinLock(pSpinLock) was called.
                        ASSERT(pSpinLock != nullptr);
                        ::KeAcquireSpinLockAtDpcLevel(pSpinLock);
                }
                ~CKeSpinLockDpcLevel()
                {
                        ::KeReleaseSpinLockFromDpcLevel(m_pSpinLock);
                }
        };
 
        //********************************************************************
 
        struct CKeSpinLockLargeInteger
        {
        private:
                LARGE_INTEGER m_Val;
                CKeSpinLock m_SpinLock;
        public:
                void InitLargeInteger()
                {
                        RtlZeroMemory(&m_Val, sizeof(m_Val));
                        m_SpinLock.InitSpinLock();
                }
                void Add(ULONG uDelta = 1)
                {
                        CKeSpinLockLock lock(m_SpinLock);
                        RtlLargeIntegerAdd(m_Val, (RtlConvertUlongToLargeInteger(uDelta)));
                }
                void Subtract(ULONG uDelta = 1)
                {
                        CKeSpinLockLock lock(m_SpinLock);
                        RtlLargeIntegerSubtract(m_Val, (RtlConvertUlongToLargeInteger(uDelta)));
                }
                bool IsZero()
                {
                        CKeSpinLockLock lock(m_SpinLock);
                        ASSERT(RtlLargeIntegerGreaterOrEqualToZero(m_Val));
                        return RtlLargeIntegerEqualToZero(m_Val) ? true : false;
                }
                ULONG get_Low() const
                {
                        return m_Val.LowPart;
                }
        };
 
        //********************************************************************
 
        struct CKeTime
        {
 
                void InitTime()
                {
                        m_TimeVal.QuadPart = 0;
                }
                void QuerySystemTime()
                {
                        ::KeQuerySystemTime(&m_TimeVal);
                }
                int get_AgeSec() const
                {
                        // @return Time diff in seconds.
                        LARGE_INTEGER uTimeNow;
                        ::KeQuerySystemTime(&uTimeNow);
                        LONGLONG nDiff = uTimeNow.QuadPart - m_TimeVal.QuadPart;
                        int iDiffSec = (int)(nDiff / (1000 * 1000 * 10));
                        return iDiffSec;
                }
                void MakeLocalTime()
                {
#ifndef _WDMDDK_
                        LARGE_INTEGER localTime;
                        ::ExSystemTimeToLocalTime(&m_TimeVal, &localTime);
                        m_TimeVal = localTime;
#else
#define LOCAL_TIME_SHIFT (5*60*60) // in minutes.
                        m_TimeVal.QuadPart += (LONGLONG)(10000) * 1000 * LOCAL_TIME_SHIFT;
#endif // ! _WDMDDK_
                }
                void GetTimeFields(PTIME_FIELDS pTimeFields)
                {
                        ASSERT(pTimeFields != nullptr);
                        ::RtlTimeToTimeFields(&m_TimeVal, pTimeFields);
                }
        public:
                LARGE_INTEGER m_TimeVal;        
        };
 
        //**************************************************************************
 
        template <class TYPE>
        struct __declspec(novtable) CKeObject : public TYPE
        {
 
                void ReferenceObject()
                {
                        // Increment the ref on this.
                        ASSERT(this != nullptr);
                        ASSERT(::KeGetCurrentIrql() == PASSIVE_LEVEL);
                        ::ObReferenceObject(this);
                }
                void ReleaseObject()
                {
                        ASSERT(this != nullptr);
                        ASSERT(::KeGetCurrentIrql() == PASSIVE_LEVEL);
                        ::ObDereferenceObject(this);
                }
 
                TYPE* get_Ptr()
                {
                        return this;
                }
                const TYPE* get_CPtr() const
                {
                        return this;
                }
                CSHORT get_ObjectType() const
                {
                        // @return IO_TYPE_FILE,IO_TYPE_DEVICE,IO_TYPE_IRP,etc..
                        // ASSUME _DRIVER_OBJECT type header.
                        ASSERT(this != nullptr);
                        return Type;
                }
                CSHORT get_ObjectSize() const
                {
                        // ASSUME _DRIVER_OBJECT type header.
                        ASSERT(this != nullptr);
                        return Size;
                }
        };
 
        template <class TYPE>
        struct CKeObjectPtr
        {
 
                CKeObjectPtr(TYPE* pObject = nullptr)
                        : m_pObject((CKeObject<TYPE>*) pObject)
                {
                        // Assume already referenced 1 time.
                }
                NTSTATUS ReferenceByHandle(IN HANDLE Handle,
                        IN ACCESS_MASK uDesiredAccess = FILE_ANY_ACCESS,
                        IN POBJECT_TYPE pObjectType = nullptr,
                        IN KPROCESSOR_MODE eAccessMode = KernelMode,
                        OUT POBJECT_HANDLE_INFORMATION pHandleInformation = nullptr)
                {
                        // Set and reference by handle.
                        ASSERT(m_pObject == nullptr);
                        ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
                        return ObReferenceObjectByHandle(Handle, // Object Handle
                                uDesiredAccess,         // Desired Access
                                pObjectType,            // Object Type
                                eAccessMode,            // Processor mode
                                (PVOID*)&m_pObject,     // File Object pointer
                                pHandleInformation              // Object Handle information
                        );
                }
                void ReferenceObject()
                {
                        // Increment the ref on this.
                        ASSERT(m_pObject != nullptr);
                        m_pObject->ReferenceObject();
                }
                void ReleaseObject()
                {
                        if (m_pObject == nullptr)
                                return;
                        m_pObject->ReleaseObject();
                        m_pObject = nullptr;
                }
                CKeObject<TYPE>* DetachObject()
                {
                        CKeObject<TYPE>* pObject = m_pObject;
                        m_pObject = nullptr;
                        return pObject;
                }
                void ReleaseLast()
                {
                        if (m_pObject == nullptr)
                                return;
                        m_pObject->ReleaseObject();
                }
                TYPE** get_ObjectPPtr()
                {
                        return (TYPE**)&m_pObject;
                }
                CKeObject<TYPE>* get_ObjectPtr() const
                {
                        return m_pObject;
                }
                bool IsValidObj() const
                {
                        return m_pObject != nullptr;
                }
                operator const TYPE*() const
                {
                        return m_pObject;
                }
                operator TYPE*()
                {
                        return m_pObject;
                }
                TYPE* operator ->()
                {
                        return m_pObject;
                }
        private:
                CKeObject<TYPE>* m_pObject;
        };
 
#if 0
        template <class TYPE>
        struct CKeObjectPtrX : public CKeObjectPtr<TYPE>
        {
        public:
                CKeObjectPtrX(TYPE* pObject = nullptr)
                        : CKeObjectPtr(pObject)
                {
                        // Assume already referenced 1 time.
                }
                ~CKeObjectPtrX()
                {
                        ReleaseLast();
                }
        };
#endif
 
        struct CKeHandle
        {
 
                CKeHandle(HANDLE Handle = HANDLE_NULL)
                        : m_Handle(Handle)
                {}
                ~CKeHandle()
                {
                        if (m_Handle != HANDLE_NULL)
                        {
                                ZwClose(m_Handle);
                        }
                }
                HANDLE* get_HandlePtr()
                {
                        ASSERT(m_Handle == HANDLE_NULL);        // prevent leaks.
                        return &m_Handle;
                }
                NTSTATUS CloseHandle()
                {
                        if (m_Handle == HANDLE_NULL)
                                return STATUS_SUCCESS;
                        HANDLE HandleTmp = m_Handle;
                        m_Handle = HANDLE_NULL;
                        return ZwClose(HandleTmp);
                }
                NTSTATUS OpenByPointer(PVOID pObject,
                        ULONG uHandleAttributes = OBJ_KERNEL_HANDLE,
                        PACCESS_STATE pPassedAccessState = nullptr, // optional
                        ACCESS_MASK uDesiredAccess = FILE_ANY_ACCESS,
                        POBJECT_TYPE pObjectType = nullptr,
                        KPROCESSOR_MODE eAccessMode = KernelMode
                )
                {
                        // NOTE: This is documented on MSDN
                        return ::ObOpenObjectByPointer(pObject, // Object
                                uHandleAttributes,      // HandleAttributes = OBJ_EXCLUSIVE,OBJ_INHERIT
                                pPassedAccessState,     // PassedAccessState
                                uDesiredAccess,         // DesiredAccess
                                pObjectType,            // ObjectType
                                eAccessMode,            // AccessMode = UserMode,KernelMode
                                &m_Handle);
                }
                operator HANDLE() const
                {
                        return m_Handle;
                }
        protected:
                HANDLE m_Handle;
        };
 
        //**************************************************************************
 
        struct CKeTimerD
        {
        public:
                void InitTimer(IN PKDEFERRED_ROUTINE DeferredRoutine, IN PVOID DeferredContext)
                {
                        ::KeInitializeTimer(&m_Timer);
                        ::KeInitializeDpc(&m_Dpc, DeferredRoutine, DeferredContext);
                }
                void SetTimer(LARGE_INTEGER& dueTime)
                {
                        ::KeSetTimer(
                                &m_Timer,
                                dueTime,
                                &m_Dpc);
                }
                void SetTimerEx(LARGE_INTEGER& dueTime, ULONG period)
                {
                        ::KeSetTimerEx(
                                &m_Timer,
                                dueTime, period,
                                &m_Dpc);
                }
                void CancelTimer()
                {
                        ::KeCancelTimer(&m_Timer);
                }
                void CancelTimerEx()
                {
                        CancelTimer();
                        ::KeRemoveQueueDpc(&m_Dpc);
                }
        public:
                KTIMER  m_Timer;
                KDPC    m_Dpc;  // defer procedure call.
        };
 
        //**************************************************************************
 
        struct CKeEvent : public _KEVENT
        {
                void InitEvent()
                {
                        ::KeInitializeEvent(this, NotificationEvent, false);
                }
                void ClearEvent()
                {
                        ASSERT(::KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        ::KeClearEvent(this);
                }
                LONG SetEvent()
                {
                        ASSERT(::KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        return ::KeSetEvent(this, IO_NO_INCREMENT, false);
                }
                NTSTATUS WaitForEvent()
                {
                        ASSERT(::KeGetCurrentIrql() == PASSIVE_LEVEL);
                        return ::KeWaitForSingleObject(
                                this,     // Object to wait on.
                                Executive,  // Reason for waiting
                                KernelMode, // Processor mode
                                false,      // Alertable
                                nullptr        // Timeout
                        );
                }
        };
 
        //**************************************************************************
        struct CKeStringUS : public UNICODE_STRING
        {
                void UpcaseString()
                {
                        if (Buffer != nullptr)
                                RtlUpcaseUnicodeString(nullptr, this, false);
                }
                void InitStr()
                {
                        Length = 0;
                        MaximumLength = 0;
                        Buffer = nullptr;
                }
                void InitStatic(const WCHAR* pStr, USHORT wLength)
                {
                        ASSERT(pStr != nullptr);
                        Length = wLength;
                        MaximumLength = wLength + 1;
                        Buffer = (PWSTR)pStr;
                }
                void InitStatic(const WCHAR* pStr)
                {
                        ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        ASSERT(pStr != nullptr);
                        RtlInitUnicodeString(this, (PWSTR)pStr);
                        ASSERT(Length < MaximumLength);
                }
                void InitBuffer(PWSTR pBuffer, USHORT uMaximumLength)
                {
                        Length = 0;
                        MaximumLength = uMaximumLength;
                        Buffer = pBuffer;
                }
                void InitBufferZ(PWSTR pBuffer, USHORT uMaximumLength)
                {
                        RtlZeroMemory(pBuffer, uMaximumLength);
                        InitBuffer(pBuffer, uMaximumLength);
                }
                bool IsValidStr() const
                {
                        return(Buffer != nullptr);
                }
                operator PCWSTR() const
                {
                        return Buffer;
                }
                operator PWSTR()
                {
                        return Buffer;
                }
                PWSTR DetachStr()
                {
                        PWSTR pBuffer = Buffer;
                        ASSERT(pBuffer != nullptr);
                        InitStr();
                        return pBuffer;
                }
 
                COMPARE_t CompareStr(const UNICODE_STRING& rString2, BOOLEAN bCaseInSensitive = false) const
                {
                        return RtlCompareUnicodeString((UNICODE_STRING*)this, (UNICODE_STRING*)&rString2, bCaseInSensitive);
                }
 
                NTSTATUS FromInteger(IN ULONG uValue, IN ULONG uBase = 10)
                {
                        return RtlIntegerToUnicodeString(uValue, uBase, this);
                }
                NTSTATUS ToInteger(ULONG& uValue, ULONG nBase = 10) const
                {
                        return RtlUnicodeStringToInteger((UNICODE_STRING*)(this), nBase, &uValue);
                }
                NTSTATUS FromInt64(IN ULONGLONG Value, IN ULONG nBase = 10)
                {
                        return RtlInt64ToUnicodeString(Value, nBase, this);
                }
                NTSTATUS FromAnsi(PANSI_STRING pStr, bool bAlloc = false)
                {
                        return RtlAnsiStringToUnicodeString(this, pStr, bAlloc);
                }
                NTSTATUS AppendStr(const UNICODE_STRING& str)
                {
                        return RtlAppendUnicodeStringToString((UNICODE_STRING*)this, (UNICODE_STRING*)&str);
                }
                NTSTATUS AppendStr(PCWSTR pwSource)
                {
                        return RtlAppendUnicodeToString(this, pwSource);
                }
                void AppendStr(NTSTATUS& lStatus, PCWSTR pwSource)
                {
                        if (!NT_SUCCESS(lStatus))
                                return;
                        lStatus = RtlAppendUnicodeToString(this, pwSource);
                }
 
                NTSTATUS AppendInteger(ULONG uValue, ULONG uBase = 10)
                {
                        WCHAR numStrBuf[20];
                        CKeStringUS numStr;
                        numStr.InitBuffer(numStrBuf, sizeof(numStrBuf));
                        NTSTATUS lStatus = numStr.FromInteger(uValue, uBase);
                        if (!NT_SUCCESS(lStatus))
                                return lStatus;
                        return AppendStr(numStr);
                }
                void FreeSys()
                {
                        if (Buffer != nullptr)
                        {
                                RtlFreeUnicodeString(this);
                                InitStr();
                        }
                }
        };
 
        struct CKeStringU : public CKeStringUS
        {
                static const ULONG CKeStringU_TAG = 'KStU';
        public:
                CKeStringU()
                {
                        InitStr();
                }
                CKeStringU(PCWSTR pStr)
                {
                        CreateStr(pStr);        // Make copy of pStr
                }
                ~CKeStringU()
                {
                        FreeStringLast();
                }
                void FreeString()
                {
                        if (Buffer != nullptr)
                        {
                                CKeMem_Free(Buffer, CKeStringU_TAG);
                                InitStr();
                        }
                }
                NTSTATUS AppendStr(PCWSTR pStr, USHORT nLengthStr)
                {
                        ASSERT(pStr != nullptr);
                        ASSERT(!(nLengthStr & 1));
                        if (nLengthStr <= 0)
                                return STATUS_SUCCESS;
                        size_t nLengthNew = Length + nLengthStr;
                        if (nLengthNew >= MaximumLength)
                        {
                                // must reallocate string.
                                PWSTR pBufferOld = Buffer;
                                Buffer = (PWSTR)ExAllocatePoolWithTag(PagedPool, nLengthNew + sizeof(WCHAR), CKeStringU_TAG);
                                if (Buffer == nullptr)
                                {
                                        Buffer = pBufferOld; // just put the old one back.
                                        return STATUS_INSUFFICIENT_RESOURCES;
                                }
                                MaximumLength = (USHORT)nLengthNew + sizeof(WCHAR);
                                if (pBufferOld != nullptr)
                                {
                                        RtlCopyMemory(Buffer, pBufferOld, Length);
                                        CKeMem_Free(pBufferOld, CKeStringU_TAG);
                                }
                        }
                        ASSERT(Buffer != nullptr);
                        RtlCopyMemory(((PUCHAR)Buffer) + Length, pStr, nLengthStr);
                        Buffer[nLengthNew / sizeof(WCHAR)] = '\0';
                        Length = (USHORT)nLengthNew; // in bytes.
                        ASSERT(Length < MaximumLength);
                        return STATUS_SUCCESS;
                }
                NTSTATUS AppendStr(PCWSTR pStr)
                {
                        ASSERT(pStr != nullptr);
                        return AppendStr(pStr, (USHORT)(wcslen(pStr) * sizeof(WCHAR))); // len in chars to bytes.
                }
                NTSTATUS AppendStr(const UNICODE_STRING& str)
                {
                        return AppendStr(str.Buffer, str.Length);
                }
 
                void AppendStr(NTSTATUS& lStatus, PCWSTR pStr)
                {
                        if (!NT_SUCCESS(lStatus))
                                return;
                        lStatus = AppendStr(pStr);
                }
                void AppendStr(NTSTATUS& lStatus, PCWSTR pStr, USHORT nLengthStr)
                {
                        if (!NT_SUCCESS(lStatus))
                                return;
                        lStatus = AppendStr(pStr, nLengthStr);
                }
                void AppendStr(NTSTATUS& lStatus, const UNICODE_STRING& str)
                {
                        if (!NT_SUCCESS(lStatus))
                                return;
                        lStatus = AppendStr(str);
                }
 
                NTSTATUS AppendInteger(ULONG uValue, ULONG uBase = 10)
                {
                        WCHAR numStrBuf[20];
                        CKeStringUS numStr;
                        numStr.InitBuffer(numStrBuf, sizeof(numStrBuf));
                        NTSTATUS lStatus = numStr.FromInteger(uValue, uBase);
                        if (!NT_SUCCESS(lStatus))
                                return lStatus;
                        return AppendStr(numStr);
                }
                void AppendInteger(NTSTATUS& lStatus, ULONG uValue, ULONG uBase = 10)
                {
                        // AppendStr( lStatus, str.Buffer, str.Length );
                        if (!NT_SUCCESS(lStatus))
                                return;
                        lStatus = AppendInteger(uValue, uBase);
                }
 
                // Dangerous functions can cause leaks.
                NTSTATUS CreateStr(PCWSTR pStr, USHORT nLengthStr)
                {
                        ASSERT(KeGetCurrentIrql() <= PASSIVE_LEVEL);
                        ASSERT(!(nLengthStr & 1));
                        ASSERT(pStr != nullptr);
                        Buffer = (PWSTR)ExAllocatePoolWithTag(PagedPool, nLengthStr + sizeof(WCHAR), CKeStringU_TAG);
                        if (Buffer == nullptr)
                        {
                                Length = 0;
                                MaximumLength = 0;
                                return STATUS_INSUFFICIENT_RESOURCES;
                        }
                        MaximumLength = (USHORT)nLengthStr;     // int bytes.
                        ASSERT(Buffer != nullptr);
                        RtlCopyMemory(Buffer, pStr, nLengthStr);
                        Buffer[nLengthStr / sizeof(WCHAR)] = '\0';
                        Length = (USHORT)nLengthStr; // int bytes.
                        return STATUS_SUCCESS;
                }
                NTSTATUS CreateStr(const UNICODE_STRING& str)
                {
                        return CreateStr(str.Buffer, str.Length);
                }
                NTSTATUS CreateStr(PCWSTR pStr)
                {
                        ASSERT(pStr != nullptr);
                        return CreateStr(pStr, (USHORT)(wcslen(pStr) * sizeof(WCHAR))); // len in chars to bytes.
                }
        protected:
                void FreeStringLast()
                {
                        if (Buffer != nullptr)
                        {
                                CKeMem_Free(Buffer, CKeStringU_TAG);
                        }
                }
        };
 
        //**************************************************************************
        struct CKeStringAS : public ANSI_STRING
        {
 
                void InitStr()
                {
                        Length = 0;
                        MaximumLength = 0;
                        Buffer = nullptr;
                }
                void InitStatic(const char* pStr)
                {
                        RtlInitAnsiString(this, (PCHAR)pStr);
                }
                void InitBuffer(char* pBuffer, USHORT uMaximumLength)
                {
                        Length = 0;
                        MaximumLength = uMaximumLength;
                        Buffer = pBuffer;
                }
                bool IsValidStr() const
                {
                        return(Buffer != nullptr);
                }
                operator PCHAR()
                {
                        return Buffer;
                }
                NTSTATUS ToInteger(ULONG& uValue, ULONG nBase = 10) const
                {
                        return RtlCharToInteger(Buffer, nBase, &uValue);
                }
 
#if 0
                void FromInteger(ULONG uValue, ULONG nBase = 10, int iWidth = 32)
                {
                        CHAR buffer[32];
                        if (iWidth >= sizeof(buffer) - 1)
                                iWidth = sizeof(buffer) - 1;
                        PCHAR pBufEnd = buffer + sizeof(buffer) - 1;
                        *pBufEnd = '\0';
                        PCHAR pBuf = pBufEnd;
                        do
                        {
                                ULONG d = uValue % nBase;
                                *(--pBuf) = (CHAR)(d + ((d < 10) ? '0' : ('A' - 10)));
                                uValue /= nBase;
                                iWidth--;
                        } while (uValue);
                        for (; iWidth > 0; iWidth--)
                        {
                                *(--pBuf) = '0';
                        }
                        AppendStr(pBuf, pBufEnd - pBuf);
                }
#endif
 
                NTSTATUS FromUnicode(PUNICODE_STRING pStr, bool bAlloc = false)
                {
                        return RtlUnicodeStringToAnsiString(this, pStr, bAlloc);
                }
 
                NTSTATUS AppendStr(const char* pStr, USHORT uLenStr)
                {
                        // Append the string for as much room as we have. then fail.
                        ASSERT(pStr != nullptr);
                        ASSERT(Length < MaximumLength);
                        NTSTATUS lStatus;
                        if (Length + uLenStr >= MaximumLength)
                        {
                                // Not long enough to hold it all.
                                lStatus = STATUS_BUFFER_TOO_SMALL;
                                uLenStr = (MaximumLength - Length) - 1;
                        }
                        else
                        {
                                lStatus = STATUS_SUCCESS;
                        }
                        RtlCopyMemory(Buffer + Length, pStr, uLenStr);
                        Length += uLenStr;
                        Buffer[Length] = '\0';
                        ASSERT(Length < MaximumLength);
                        return lStatus;
                }
                NTSTATUS AppendStr(const ANSI_STRING& str)
                {
                        return AppendStr(str.Buffer, str.Length);
                }
                NTSTATUS AppendStr(const char* pStr)
                {
                        ASSERT(pStr != nullptr);
                        return AppendStr(pStr, strlen(pStr));
                }
 
                NTSTATUS AppendStr(const WCHAR* pStr, USHORT uLenStr)
                {
                        ASSERT(pStr != nullptr);
                        ASSERT(Length < MaximumLength);
                        NTSTATUS lStatus;
                        if (Length + uLenStr >= MaximumLength)
                        {
                                // Not long enough to hold it all.
                                lStatus = STATUS_BUFFER_TOO_SMALL;
                                uLenStr = (MaximumLength - Length) - 1;
                        }
                        else
                        {
                                lStatus = STATUS_SUCCESS;
                        }
                        USHORT uLenChars = uLenStr / sizeof(WCHAR);
                        for (; uLenChars--; Length++, pStr++)
                        {
                                WCHAR ch = *pStr;
                                Buffer[Length] = (ch & 0xFF00) ? '?' : (CHAR)(ch);
                        }
                        Buffer[Length] = '\0';
                        ASSERT(Length < MaximumLength);
                        return lStatus;
                }
                NTSTATUS AppendStr(const WCHAR* pStr)
                {
                        ASSERT(pStr != nullptr);
                        return AppendStr(pStr, (USHORT)(wcslen(pStr) * sizeof(WCHAR)));
                }
                void FreeSys()
                {
                        if (Buffer != nullptr)
                        {
                                RtlFreeAnsiString(this);
                                InitStr();
                        }
                }
        };
 
        //**************************************************************************
 
        struct CKeList : public LIST_ENTRY
        {
 
                //*****************************************
                // This is a list head.
                void InitList()
                {
                        ::InitializeListHead(this); // points to itself. (Flink==this)
                        ASSERT(Flink == this);
                }
                bool IsListEmptyX() const
                {
                        return ::IsListEmpty(this) ? true : false;
                }
                PLIST_ENTRY get_Head() const
                {
                        ASSERT(Flink != nullptr);       // must be init and in a list.
                        return(Flink);
                }
                int get_Count() const
                {
                        ASSERT(Flink != nullptr);
                        PLIST_ENTRY pEntry = Flink;
                        int iCount = 0;
                        for (; pEntry != this; iCount++)
                        {
                                pEntry = pEntry->Flink;
                        }
                        return iCount;
                }
                PLIST_ENTRY RemoveHead()
                {
                        if (IsListEmptyX())
                                return nullptr;
                        PLIST_ENTRY pTmp = RemoveHeadList(this);
                        return(pTmp);
                }
                void AddHead(PLIST_ENTRY pObj)
                {
                        ASSERT(this != nullptr);
                        ASSERT(pObj != nullptr);
                        ASSERT(Blink != nullptr);       // must be init list
                        InsertHeadList(this, pObj);
                }
                void AddTail(PLIST_ENTRY pObj)
                {
                        ASSERT(this != nullptr);
                        ASSERT(pObj != nullptr);
                        ASSERT(Flink != nullptr);       // must be init list
                        InsertTailList(this, pObj);
                }
                void AddTailLocked(PLIST_ENTRY pObj, PKSPIN_LOCK pSpinLock)
                {
                        ASSERT(pObj != nullptr);
                        ASSERT(Flink != nullptr);       // must be init list
                        ASSERT(pSpinLock != nullptr);
                        ExInterlockedInsertTailList(this, pObj, pSpinLock);
                }
 
                //*****************************************
                // This is a list element.
                bool IsListLinked() const
                {
                        ASSERT(this != nullptr);
                        if (Flink == nullptr)
                                return false;
                        if (Flink == this)
                                return false;
                        return(true);
                }
                PLIST_ENTRY get_Prev() const
                {
                        ASSERT(Blink != nullptr);       // must be init and in a list.
                        return(Blink);
                }
                PLIST_ENTRY get_Next() const
                {
                        ASSERT(Flink != nullptr);       // must be init and in a list.
                        return(Flink);
                }
                void RemoveFromList()
                {
                        ASSERT(IsListLinked()); // was in a list!
                        RemoveEntryList(this);
                        Flink = nullptr;        // not in any list.
                        Blink = nullptr;        // not in any list.
                }
        };
 
        template< class TYPE, int _OFFSET_ENTRY = 0 >
        struct CKeListT : public CKeList
        {
 
                static inline TYPE* GetCast(PLIST_ENTRY pObj)
                {
                        ASSERT(pObj != nullptr);
                        return((TYPE*)(((PUCHAR)pObj) - _OFFSET_ENTRY));
                }
                static inline PLIST_ENTRY GetCast(TYPE* pObj)
                {
                        ASSERT(pObj != nullptr);
                        return((PLIST_ENTRY)(((PUCHAR)pObj) + _OFFSET_ENTRY));
                }
                TYPE* get_Head() const
                {
                        ASSERT(Flink != nullptr);       // must be init and in a list.
                        return(GetCast(Flink));
                }
                TYPE* RemoveHead()
                {
                        if (IsListEmptyX())
                                return nullptr;
                        PLIST_ENTRY pTmp = RemoveHeadList(this);
                        return(GetCast(pTmp));
                }
                bool IsLast(TYPE* pObj) const
                {
                        return(GetCast(pObj) == this); // points back to the list.
                }
                void DestroyList()
                {
                        PLIST_ENTRY pEntry = Flink;
                        ASSERT(pEntry != nullptr);
                        while (!IsListEmptyX())
                        {
                                PLIST_ENTRY pEntryNext = pEntry->Flink;
                                RemoveEntryList(pEntry);
                                GetCast(pEntry)->DestroyThis();
                                pEntry = pEntryNext;    // Move To The Next
                        }
                }
                void AddHead(TYPE* pObj)
                {
                        __super::AddHead(GetCast(pObj));
                }
                void AddTail(TYPE* pObj)
                {
                        __super::AddTail(GetCast(pObj));
                }
                void AddTailLocked(TYPE* pObj, PKSPIN_LOCK pSpinLock)
                {
                        __super::AddTailLocked(GetCast(pObj), pSpinLock);
                }
                TYPE* GetNext(TYPE* pObj) const
                {
                        return GetCast(pObj->m_ListEntry.get_Next());
                }
        };
 
        //*********************************************************
 
        template< ULONG _UTAG >
        struct CKeListObj : public CKeDynamic<_UTAG>
        {
                bool IsListLinked() const
                {
                        return(m_ListEntry.IsListLinked());
                }
                void RemoveFromList()
                {
                        m_ListEntry.RemoveFromList();
                }
        public:
                CKeList m_ListEntry;    // LIST_ENTRY info
        };
 
        //*********************************************************
 
        template< class TYPE, int _OFFSET_ENTRY = offsetof(TYPE, m_ListEntry) >
        struct CKePool
        {
        public:
                static inline TYPE* GetCast(PLIST_ENTRY pObj)
                {
                        ASSERT(pObj != nullptr);
                        return((TYPE*)(((PUCHAR)pObj) - _OFFSET_ENTRY));
                }
                static inline PLIST_ENTRY GetCast(TYPE* pObj)
                {
                        ASSERT(pObj != nullptr);
                        return((PLIST_ENTRY)(((PUCHAR)pObj) + _OFFSET_ENTRY));
                }
                void InitPool()
                {
                        m_FreeList.InitList(); // points to itself.
                        m_UsedList.InitList();
                        m_SpinLock.InitSpinLock();
                }
                bool IsFreeListEmpty() const
                {
                        return m_FreeList.IsListEmptyX();
                }
                bool IsUsedListEmpty() const
                {
                        return m_UsedList.IsListEmptyX();
                }
                int get_FreeCount()
                {
                        CKeSpinLockLock lock(m_SpinLock);       // Locks the list.
                        return m_FreeList.get_Count();
                }
                int get_UsedCount()
                {
                        CKeSpinLockLock lock(m_SpinLock);       // Locks the list.
                        return m_UsedList.get_Count();
                }
                void AddFreeObjZ(TYPE* pObj)
                {
                        ASSERT(pObj != nullptr);
                        ASSERT(!pObj->IsListLinked());
                        AddFreeObj(pObj);
                }
 
                // Destroy
                void DestroyFreeList()
                {
                        CKeSpinLockLock lock(m_SpinLock);
                        return m_FreeList.DestroyList();
                }
                void DestroyUsedList()
                {
                        CKeSpinLockLock lock(m_SpinLock);
                        return m_UsedList.DestroyList();
                }
 
        protected:
                // Add and Remove
                void AddFreeObj(TYPE* pObj)
                {
                        m_FreeList.AddTailLocked(pObj, m_SpinLock);
                }
                void AddUsedObj(TYPE* pObj)
                {
                        m_UsedList.AddTailLocked(pObj, m_SpinLock);
                }
                TYPE* RemoveFreeObj()
                {
                        CKeSpinLockLock lock(m_SpinLock);
                        return m_FreeList.RemoveHead();
                }
                bool IsUsedLast(TYPE* pObj) const
                {
                        return(m_UsedList.IsLast(pObj));
                }
                TYPE* get_UsedFirst() const
                {
                        return(m_UsedList.get_Head());
                }
                TYPE* GetNext(TYPE* pObj) const
                {
                        return GetCast(pObj->m_ListEntry.get_Next());
                }
        protected:
                CKeListT<TYPE, _OFFSET_ENTRY> m_FreeList;
                CKeListT<TYPE, _OFFSET_ENTRY> m_UsedList;
                CKeSpinLock m_SpinLock;
        };
 
        //************************************************************************************
 
        struct CKeIRP : public CKeObject<_IRP>
        {
        public:
                NTSTATUS get_IoStatus() const
                {
                        ASSERT(this != nullptr);
                        return(IoStatus.Status);
                }
                SIZE_T get_IoInformationSize() const
                {
                        return IoStatus.Information;
                }
                PVOID get_AssocSystemBuffer() const
                {
                        ASSERT(this != nullptr);
                        return(AssociatedIrp.SystemBuffer);
                }
 
                void FreeIrp()
                {
                        ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        IoFreeIrp(this);
                }
                void RemoveIrpFromQueue()
                {
                        ASSERT(this != nullptr);
                        RemoveEntryList(&Tail.Overlay.ListEntry);
                }
                PDRIVER_CANCEL SetCancelRoutine(PDRIVER_CANCEL pCancelRoutine = nullptr)
                {
                        ASSERT(this != nullptr);
                        return IoSetCancelRoutine(this, pCancelRoutine);
                }
                BOOLEAN CancelIrp()
                {
                        ASSERT(this != nullptr);
                        return IoCancelIrp(this);
                }
                void MarkIrpPending()
                {
                        ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        ASSERT(this != nullptr);
                        IoMarkIrpPending(this);
                }
                void CompleteRequest(CCHAR cPriorityBoost = IO_NO_INCREMENT)
                {
                        ASSERT(this != nullptr);
                        IoCompleteRequest(this, cPriorityBoost);
                }
                void CompleteRequestStatus(NTSTATUS lStatus = STATUS_SUCCESS, ULONG_PTR uInformation = 0, CCHAR cPriorityBoost = IO_NO_INCREMENT)
                {
                        IoStatus.Status = lStatus;
                        IoStatus.Information = uInformation;
                        CompleteRequest(cPriorityBoost);
                }
                NTSTATUS CallDriver(IN PDEVICE_OBJECT pDeviceObject)
                {
                        // Typically used to pass along to the next device in a chain. pLowerDeviceObject
                        ASSERT(this != nullptr);
                        ASSERT(pDeviceObject != nullptr);
                        ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
                        return IoCallDriver(pDeviceObject, this);
                }
 
                // Stack Location
                PIO_STACK_LOCATION get_StackLocation() const
                {
                        ASSERT(this != nullptr);
                        return ::IoGetCurrentIrpStackLocation(const_cast<_IRP*>(get_CPtr()));
                }
                void SkipStackLocation()
                {
                        ASSERT(this != nullptr);
                        IoSkipCurrentIrpStackLocation(this);
                }
                NTSTATUS SkipStackLocation(PDEVICE_OBJECT pLowerDeviceObject)
                {
                        SkipStackLocation();
                        return CallDriver(pLowerDeviceObject);
                }
                PIO_STACK_LOCATION get_NextStackLocation() const
                {
                        return IoGetNextIrpStackLocation(const_cast<_IRP*>(get_CPtr()));
                }
                void CopyStackLocationToNext()
                {
                        IoCopyCurrentIrpStackLocationToNext(this);
                }
                void SetNextStackLocation()
                {
                        IoSetNextIrpStackLocation(this);
                }
                void SetCompletionRoutine(PIO_COMPLETION_ROUTINE pRoutine, void* pCompletionContext, UCHAR uControlFlags)
                {
                        ASSERT((uControlFlags) ? (pRoutine != nullptr) : true);
                        PIO_STACK_LOCATION pIrpStack = get_NextStackLocation();
                        ASSERT(pIrpStack != nullptr);
                        pIrpStack->CompletionRoutine = pRoutine;
                        pIrpStack->Context = pCompletionContext;
                        pIrpStack->Control = uControlFlags;
                }
                void SetCompletionRoutine(PIO_COMPLETION_ROUTINE pRoutine, void* pCompletionContext, bool bInvokeOnSuccess, bool bInvokeOnError, bool bInvokeOnCancel)
                {
                        IoSetCompletionRoutine(this, // The IRP
                                pRoutine,                               // The completion routine
                                pCompletionContext,     // The completion context
                                bInvokeOnSuccess,       // Invoke On Success
                                bInvokeOnError,         // Invoke On Error
                                bInvokeOnCancel);      // Invoke On Cancel
                }
        };
 
        struct CKeIrpQueue
        {
        public:
                CKeIrpQueue()
                {
                        m_queue.InitList();
                }
                ~CKeIrpQueue()
                {
                        ASSERT(m_queue.IsListEmptyX());
                }
                static inline void RemoveIrpFromQueue(IN PIRP pIrp)
                {
                        ASSERT(pIrp != nullptr);
                        RemoveEntryList(&pIrp->Tail.Overlay.ListEntry);
                }
                void AddIrpToQueue(IN PIRP pIrp)
                {
                        ASSERT(this != nullptr);
                        m_queue.AddTail((CKeIRP*)pIrp);
                }
                void AddIrpToHead(IN PIRP pIrp)
                {
                        ASSERT(this != nullptr);
                        m_queue.AddHead((CKeIRP*)pIrp);
                }
                void CompleteIrpQueue(IN CCHAR cPriorityBoost = IO_SERIAL_INCREMENT)
                {
                        ASSERT(this != nullptr);
                        for (;;)
                        {
                                CKeIRP* pIrp = m_queue.RemoveHead();
                                if (pIrp == nullptr)
                                        return;
                                // TraceIrp("complete", pIrp, &pIrp->get_IoStatus(), TRACE_FLAG_RESULTS);
                                pIrp->CompleteRequest(cPriorityBoost);
                        }
                }
        protected:
                CKeListT< CKeIRP, offsetof(CKeIRP, Tail.Overlay.ListEntry) > m_queue;
        };
 
        //************************************************************************************
 
        struct CKeDeviceObject;
 
        struct CKeFileObject : public CKeObject<_FILE_OBJECT>
        {
                CKeDeviceObject* get_RelatedDeviceObject()
                {
                        ASSERT(this != nullptr);
                        ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
                        return (CKeDeviceObject*)IoGetRelatedDeviceObject(this);
                }
        };
        typedef CKeObjectPtr<_FILE_OBJECT> CKeFileObjectPtr; // CKeFileObject=_FILE_OBJECT
 
        struct CKeFileHandle : public CKeHandle
        {
 
#if 0
                NTSTATUS CreateFile(OBJECT_ATTRIBUTES& objectAttributes, IO_STATUS_BLOCK& ioStatusBlock)
                {
                        // ASSUME InitializeObjectAttributes already called.
                        return ZwCreateFile(
                                get_HandlePtr(),
                                SYNCHRONIZE | FILE_APPEND_DATA,
                                &objectAttributes,
                                &ioStatusBlock,
                                nullptr,
                                FILE_ATTRIBUTE_NORMAL,
                                FILE_SHARE_READ | FILE_SHARE_WRITE,
                                FILE_OPEN_IF,
                                FILE_SYNCHRONOUS_IO_NONALERT,
                                nullptr,
                                0);
                }
#endif
 
                NTSTATUS WriteFile(IO_STATUS_BLOCK* pIoStatusBlock, PVOID pBuffer, ULONG nLength)
                {
                        return ::ZwWriteFile(m_Handle,
                                nullptr,
                                nullptr,
                                nullptr,
                                pIoStatusBlock,
                                pBuffer,
                                nLength,
                                nullptr,
                                nullptr);
                }
        };
 
        //************************************************************************************
 
        struct CKeRegistry
        {
                CKeRegistry(ULONG uRelativeTo, PWSTR pPath)
                        : m_uRelativeTo(uRelativeTo)
                        , m_pPath(pPath)
                {}
 
                NTSTATUS CreateKey()
                {
                        return RtlCreateRegistryKey(m_uRelativeTo, m_pPath);
                }
                NTSTATUS CheckKey()
                {
                        return RtlCheckRegistryKey(m_uRelativeTo, m_pPath);
                }
                NTSTATUS WriteValue(IN PCWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength)
                {
                        return RtlWriteRegistryValue(m_uRelativeTo, m_pPath,
                                ValueName, ValueType, ValueData, ValueLength);
                }
                NTSTATUS DeleteValue(IN PCWSTR ValueName = nullptr)
                {
                        return RtlDeleteRegistryValue(m_uRelativeTo, m_pPath, ValueName);
                }
                NTSTATUS QueryValues(RTL_QUERY_REGISTRY_TABLE* pQueryTable, IN PVOID pContext = nullptr, IN PVOID pEnvironment = nullptr)
                {
                        return RtlQueryRegistryValues(m_uRelativeTo, m_pPath, pQueryTable, pContext, pEnvironment);
                }
 
                NTSTATUS WriteValueStr(IN PCWSTR ValueName, UNICODE_STRING& str)
                {
                        return WriteValue(ValueName, REG_SZ, str.Buffer, str.Length + sizeof(WCHAR));
                }
                NTSTATUS WriteValueStr(IN PCWSTR ValueName, const WCHAR* pStr)
                {
                        CKeStringUS str;
                        str.InitStatic(pStr);
                        return WriteValue(ValueName, REG_SZ, str.Buffer, str.Length + sizeof(WCHAR));
                }
 
        public:
                ULONG m_uRelativeTo;    
                PWSTR m_pPath;          
        };
 
        //************************************************************************************
 
        struct CKeDeviceObject : public CKeObject<_DEVICE_OBJECT>
        {
                void DeleteDevice()
                {
                        ASSERT(this != nullptr);
                        IoDeleteDevice(this);
                }
                void DetachDeviceStack()
                {
                        // Detach if attached. reverse IoAttachDeviceToDeviceStack()
                        ASSERT(this != nullptr);
                        IoDetachDevice(this);
                }
                NTSTATUS GetDeviceProperty(DEVICE_REGISTRY_PROPERTY eDeviceProperty, IN ULONG uBufferLength, OUT PVOID pPropertyBuffer, OUT PULONG puResultLength)
                {
                        // Get some registered property of the device.
                        // eDeviceProperty = DevicePropertyPhysicalDeviceObjectName
                        ASSERT(this != nullptr);
                        return IoGetDeviceProperty(this,
                                eDeviceProperty,
                                uBufferLength,
                                pPropertyBuffer,
                                puResultLength);
                }
        };
        typedef CKeObjectPtr<_DEVICE_OBJECT> CKeDeviceObjectPtr; // CKeDeviceObject = _DEVICE_OBJECT
 
        struct CKeDeviceExt
        {
                static const ULONG CKeDeviceExt_SIGNATURE = 0x1FE04322; // Unlikely id code.
 
                void InitDeviceExt(USHORT uSize, PDEVICE_OBJECT pDeviceObj)
                {
                        ASSERT(this != nullptr);
                        ASSERT(pDeviceObj != nullptr);
                        m_wType = 255;   // NOT the same as IO_TYPE_DEVICE_OBJECT_EXTENSION
                        m_wSize = uSize;        // size of the total structure. Windows seems to think 0 is OK here for _DEVOBJ_EXTENSION?
                        m_pDeviceObject = (CKeDeviceObject*)pDeviceObj;
                        m_uDeviceSignature = CKeDeviceExt_SIGNATURE;
                        ASSERT(IsDeviceValid());
                }
                static inline CKeDeviceExt* GetDeviceExt(PDEVICE_OBJECT pDeviceObj)
                {
                        ASSERT(pDeviceObj != nullptr);
                        ASSERT(pDeviceObj->DeviceExtension != nullptr);
                        return (CKeDeviceExt*)(pDeviceObj->DeviceExtension);
                }
                bool IsDeviceValid() const
                {
                        // ASSERT( g_Driver.IsDriverValid());
                        if (m_uDeviceSignature != CKeDeviceExt_SIGNATURE)
                                return false;
                        ASSERT(((UINT_PTR)this) > sizeof(*this) + 256);
                        ASSERT(m_wSize > sizeof(*this));
                        return(m_pDeviceObject != nullptr);
                }
                bool IsDeviceValid(IN PDEVICE_OBJECT _pDeviceObject) const
                {
                        if (!IsDeviceValid())
                                return false;
                        if (_pDeviceObject != m_pDeviceObject)  // back pointer is correct?
                                return false;
                        return true;
                }
                void DeleteDevice()
                {
                        ASSERT(IsDeviceValid());
                        m_uDeviceSignature = 0;
                        // Note that on 4.0 and later systems, this will result in a recursive fast detach.
                        m_pDeviceObject->DeleteDevice();
                        // NOTE: 'delete *this' has now occurred !!!
                }
                CKeDeviceObject* get_DeviceObject() const
                {
                        return m_pDeviceObject;
                }
 
                CKeDeviceObject* AttachToDeviceStack(PDEVICE_OBJECT pDeviceObjectAttach)
                {
                        ASSERT(m_pDeviceObject != nullptr);
                        ASSERT(pDeviceObjectAttach != nullptr);
                        return (CKeDeviceObject*)IoAttachDeviceToDeviceStack(m_pDeviceObject, pDeviceObjectAttach);
                }
 
                void Flag_Init_Clear()
                {
                        ASSERT(IsDeviceValid());
                        m_pDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
                }
 
        private:
                CSHORT  m_wType;
                USHORT  m_wSize;
                CKeDeviceObject* m_pDeviceObject;               
 
                ULONG m_uDeviceSignature;       
        };
 
        struct CKeDriverObject : public CKeObject<_DRIVER_OBJECT>
        {
        };
 
        struct CKeDriver
        {
 
                void InitDriver(PDRIVER_OBJECT pDriverObject)
                {
                        // called from DriverEntry()
                        ASSERT(pDriverObject != nullptr);
                        m_pDriverObject = (CKeDriverObject*)pDriverObject;
                        RtlInitUnicodeString(&m_ServiceKeyName, nullptr);
                }
                bool IsDriverValid() const
                {
                        return(m_pDriverObject != nullptr);
                }
                CKeDriverObject* get_DriverObject() const
                {
                        return m_pDriverObject;
                }
                CKeDeviceObject* get_DeviceFirst() const
                {
                        ASSERT(m_pDriverObject != nullptr);
                        return (CKeDeviceObject*)(m_pDriverObject->DeviceObject);
                }
                CKeStringU& get_RegistryPath()
                {
                        return (CKeStringU&)m_ServiceKeyName;
                }
 
                NTSTATUS CreateDevice(ULONG uDeviceExtensionSize,
                        IN PUNICODE_STRING puDeviceName OPTIONAL,
                        IN DEVICE_TYPE eDeviceType,
                        IN ULONG uDeviceCharacteristics,
                        IN bool bExclusive,
                        OUT PDEVICE_OBJECT *ppDeviceObject)
                {
                        // see IoCreateDeviceSecure?
                        // eDeviceType = FILE_DEVICE_BEEP
                        ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
                        return IoCreateDevice(
                                m_pDriverObject,
                                uDeviceExtensionSize,
                                puDeviceName,
                                eDeviceType,
                                uDeviceCharacteristics, // No standard device characteristics FILE_READ_ONLY_DEVICE
                                bExclusive,                 // DO_EXCLUSIVE = only one handle to this may be open?
                                ppDeviceObject);
                }
 
        private:
                CKeDriverObject * m_pDriverObject; 
                UNICODE_STRING m_ServiceKeyName; 
        };
        // extern CKeDriver g_Driver;
};
 
#endif // _INC_CKernel_H