/// <summary> /// Reads a UNICODE_STRING from a structure /// NOTE: This function assumes that the structure contains a pointer to the UNICODE_STRING, NOT that the UNICODE_STRING is embedded! /// </summary> /// <param name="moduleName">Name of the module that contains the type</param> /// <param name="typeName">Name of the type that contains the field</param> /// <param name="fieldName">Name of the field</param> /// <param name="structureAddress">Address of the structure</param> /// <param name="output">The data that was retrieved</param> /// <returns>HRESULT</returns> public int ReadUNICODE_STRINGFromStructure_Pointer(string moduleName, string typeName, string fieldName, UInt64 structureAddress, out string output, ReadUNICODE_STRINGOptions options = ReadUNICODE_STRINGOptions.Escaped) { int hr; UInt64 stringPointer; if (FAILED(hr = ReadPointerFromStructure(moduleName, typeName, fieldName, structureAddress, out stringPointer))) { output = null; return hr; } return ReadUNICODE_STRING(stringPointer, out output, options); }
/// <summary> /// Reads a UNICODE_STRING from a structure /// NOTE: This function assumes that the UNICODE_STRING structure is embedded in the parent struction, NOT that the parent has a pointer to a UNICODE_STRING! /// </summary> /// <param name="moduleName">Name of the module that contains the type</param> /// <param name="typeName">Name of the type that contains the field</param> /// <param name="fieldName">Name of the field</param> /// <param name="structureAddress">Address of the structure</param> /// <param name="output">The data that was retrieved</param> /// <returns>HRESULT</returns> public int ReadUNICODE_STRINGFromStructure_Embedded(string moduleName, string typeName, string fieldName, UInt64 structureAddress, out string output, ReadUNICODE_STRINGOptions options = ReadUNICODE_STRINGOptions.Escaped) { int hr; ulong fieldAddress; if (FAILED(hr = GetFieldVirtualAddress(moduleName, typeName, fieldName, structureAddress, out fieldAddress))) { output = string.Empty; return hr; } return ReadUNICODE_STRING(fieldAddress, out output, options); }