Ejemplo n.º 1
0
		/// <summary>
		/// Reads a UNICODE_STRING from a structure
		/// NOTE: This function assumes that the structure contains a pointer to the UNICODE_STRING, NOT that the UNICODE_STRING is embedded!
		/// </summary>
		/// <param name="moduleName">Name of the module that contains the type</param>
		/// <param name="typeName">Name of the type that contains the field</param>
		/// <param name="fieldName">Name of the field</param>
		/// <param name="structureAddress">Address of the structure</param>
		/// <param name="output">The data that was retrieved</param>
		/// <returns>HRESULT</returns>
        public int ReadUNICODE_STRINGFromStructure_Pointer(string moduleName, string typeName, string fieldName, UInt64 structureAddress, out string output, ReadUNICODE_STRINGOptions options = ReadUNICODE_STRINGOptions.Escaped)
		{
			int hr;
			UInt64 stringPointer;
			if (FAILED(hr = ReadPointerFromStructure(moduleName, typeName, fieldName, structureAddress, out stringPointer)))
			{
				output = null;
				return hr;
			}
			return ReadUNICODE_STRING(stringPointer, out output, options);
		}
Ejemplo n.º 2
0
		/// <summary>
		/// Reads a UNICODE_STRING from a structure
		/// NOTE: This function assumes that the UNICODE_STRING structure is embedded in the parent struction, NOT that the parent has a pointer to a UNICODE_STRING!
		/// </summary>
		/// <param name="moduleName">Name of the module that contains the type</param>
		/// <param name="typeName">Name of the type that contains the field</param>
		/// <param name="fieldName">Name of the field</param>
		/// <param name="structureAddress">Address of the structure</param>
		/// <param name="output">The data that was retrieved</param>
		/// <returns>HRESULT</returns>
		public int ReadUNICODE_STRINGFromStructure_Embedded(string moduleName, string typeName, string fieldName, UInt64 structureAddress, out string output, ReadUNICODE_STRINGOptions options = ReadUNICODE_STRINGOptions.Escaped)
		{
			int hr;
            ulong fieldAddress;
            if (FAILED(hr = GetFieldVirtualAddress(moduleName, typeName, fieldName, structureAddress, out fieldAddress)))
            {
                output = string.Empty;
                return hr;
            }
            return ReadUNICODE_STRING(fieldAddress, out output, options);
		}