/// <summary>
/// Reads a UNICODE_STRING from a structure
/// NOTE: This function assumes that the structure contains a pointer to the UNICODE_STRING, NOT that the UNICODE_STRING is embedded!
/// </summary>
/// <param name="moduleName">Name of the module that contains the type</param>
/// <param name="typeName">Name of the type that contains the field</param>
/// <param name="fieldName">Name of the field</param>
/// <param name="structureAddress">Address of the structure</param>
/// <param name="output">The data that was retrieved</param>
/// <returns>HRESULT</returns>
public int ReadUNICODE_STRINGFromStructure_Pointer(string moduleName, string typeName, string fieldName, UInt64 structureAddress, out string output, ReadUNICODE_STRINGOptions options = ReadUNICODE_STRINGOptions.Escaped)
{
int hr;
UInt64 stringPointer;
if (FAILED(hr = ReadPointerFromStructure(moduleName, typeName, fieldName, structureAddress, out stringPointer)))
{
output = null;
return hr;
}
return ReadUNICODE_STRING(stringPointer, out output, options);
}
/// <summary>
/// Reads a UNICODE_STRING from a structure
/// NOTE: This function assumes that the UNICODE_STRING structure is embedded in the parent struction, NOT that the parent has a pointer to a UNICODE_STRING!
/// </summary>
/// <param name="moduleName">Name of the module that contains the type</param>
/// <param name="typeName">Name of the type that contains the field</param>
/// <param name="fieldName">Name of the field</param>
/// <param name="structureAddress">Address of the structure</param>
/// <param name="output">The data that was retrieved</param>
/// <returns>HRESULT</returns>
public int ReadUNICODE_STRINGFromStructure_Embedded(string moduleName, string typeName, string fieldName, UInt64 structureAddress, out string output, ReadUNICODE_STRINGOptions options = ReadUNICODE_STRINGOptions.Escaped)
{
int hr;
ulong fieldAddress;
if (FAILED(hr = GetFieldVirtualAddress(moduleName, typeName, fieldName, structureAddress, out fieldAddress)))
{
output = string.Empty;
return hr;
}
return ReadUNICODE_STRING(fieldAddress, out output, options);
}