/// <summary>
/// Return whether or not the given expression matches the given name. Takes standard
/// Windows wildcards (*, ?, <, > ").
/// </summary>
public unsafe static bool IsNameInExpression(string expression, string name, bool ignoreCase)
{
if (string.IsNullOrEmpty(expression) || string.IsNullOrEmpty(name))
{
return(false);
// If ignore case is set, the API will uppercase the name *if* an UpcaseTable
// is not provided. It then flips to case-sensitive. In this state the expression
// has to be uppercase to match as expected.
fixed(char *e = ignoreCase?expression.ToUpperInvariant() : expression)
fixed(char *n = name)
{
UNICODE_STRING *eus = null;
UNICODE_STRING *nus = null;
if (e != null)
{
var temp = new UNICODE_STRING(e, expression.Length);
eus = &temp;
}
if (n != null)
{
var temp = new UNICODE_STRING(n, name.Length);
nus = &temp;
}
return(Imports.RtlIsNameInExpression(eus, nus, ignoreCase, IntPtr.Zero));
}
}
public OBJECT_ATTRIBUTES(UNICODE_STRING *name, ObjectAttributesFlags flags, IntPtr hRootDirectory)
{
Length = sizeof(OBJECT_ATTRIBUTES);
Attributes = flags;
ObjectName = name;
SecurityDescriptor = SecurityQualityOfService = IntPtr.Zero;
RootDirectory = hRootDirectory;
}
/// <summary>
/// Equivalent of InitializeObjectAttributes macro with the exception that you can directly set SQOS.
/// </summary>
public unsafe OBJECT_ATTRIBUTES(UNICODE_STRING *objectName, ObjectAttributes attributes, IntPtr rootDirectory, SECURITY_QUALITY_OF_SERVICE *securityQualityOfService = null)
{
Length = (uint)sizeof(OBJECT_ATTRIBUTES);
RootDirectory = rootDirectory;
ObjectName = objectName;
Attributes = attributes;
SecurityDescriptor = null;
SecurityQualityOfService = securityQualityOfService;
}
internal OBJECT_ATTRIBUTES(UNICODE_STRING *name, uint attributes, IntPtr rootDirectory, IntPtr securityDescriptor)
{
Length = 0;
RootDirectory = rootDirectory;
Attributes = attributes;
ObjectName = name;
SecurityDescriptor = securityDescriptor;
SecurityQualityOfService = IntPtr.Zero;
// Trick to have the compiler happy.
Length = (uint)Marshal.SizeOf(this);
}
public static unsafe extern int NtQueryDirectoryFile(
IntPtr FileHandle,
IntPtr Event,
IntPtr ApcRoutine,
IntPtr ApcContext,
IO_STATUS_BLOCK *IoStatusBlock,
IntPtr FileInformation,
uint Length,
FILE_INFORMATION_CLASS FileInformationClass,
BOOLEAN ReturnSingleEntry,
UNICODE_STRING *FileName,
BOOLEAN RestartScan);
public unsafe static extern NTStatus NtQueryDirectoryFile(
SafeFileHandle FileHandle,
IntPtr Event,
AsyncProcedureCall ApcRoutine,
IntPtr ApcContext,
out IO_STATUS_BLOCK IoStatusBlock,
void *FileInformation,
uint Length,
FileInformationClass FileInformationClass,
Boolean8 ReturnSingleEntry,
UNICODE_STRING *FileName,
Boolean8 RestartScan);
public unsafe static extern Boolean8 RtlIsNameInExpression(
UNICODE_STRING *Expression,
UNICODE_STRING *Name,
Boolean8 IgnoreCase,
IntPtr UpcaseTable);
public unsafe static extern NTStatus LsaOpenPolicy(
UNICODE_STRING *SystemName,
LSA_OBJECT_ATTRIBUTES *ObjectAttributes,
PolicyAccessRights DesiredAccess,
out LsaHandle PolicyHandle);
public OBJECT_ATTRIBUTES(UNICODE_STRING *name, ObjectAttributesFlags flags = ObjectAttributesFlags.None) : this(name, flags, IntPtr.Zero)
{
}
internal static extern unsafe ulong NtUnloadDriver(
UNICODE_STRING *ServiceName
);
public static unsafe extern void RtlFreeUnicodeString(
UNICODE_STRING *UnicodeString);
public static unsafe extern NTSTATUS RtlUpcaseUnicodeString(
UNICODE_STRING *DestinationString,
UNICODE_STRING *SourceString,
BOOLEAN AllocateDestinationString);
public static unsafe extern ByteBoolean RtlIsNameInExpression(
UNICODE_STRING *Expression,
UNICODE_STRING *Name,
ByteBoolean IgnoreCase,
IntPtr UpcaseTable);
public static extern int NtRenameKey(HANDLE KeyHandle, [NativeTypeName("PUNICODE_STRING")] UNICODE_STRING *NewName);
