public static extern NtStatus RtlDecompressBuffer(
RtlCompressionFormat CompressionFormat,
[In] byte[] UncompressedBuffer,
int UncompressedBufferSize,
[Out] byte[] CompressedBuffer,
int CompressedBufferSize,
out int FinalUncompressedSize
);
public static extern NtStatus RtlCompressBuffer(
RtlCompressionFormat CompressionFormatAndEngine,
[In] byte[] UncompressedBuffer,
int UncompressedBufferSize,
[Out] byte[] CompressedBuffer,
int CompressedBufferSize,
int UncompressedChunkSize,
out int FinalCompressedSize,
[Out] byte[] WorkSpace
);
private static NtResult <byte[]> DecompressBuffer(CLAIM_SET_METADATA set)
{
RtlCompressionFormat format = (RtlCompressionFormat)set.usCompressionFormat.Value;
if (format == RtlCompressionFormat.None)
{
return(set.ClaimsSet.GetValue().CreateResult());
}
return(NtCompression.DecompressBuffer(format, set.ClaimsSet, set.ulUncompressedClaimsSetSize, false));
}
/// <summary>
/// Decompress a buffer.
/// </summary>
/// <param name="format">The compression format used.</param>
/// <param name="compressed_buffer">The compressed buffer.</param>
/// <param name="uncompressed_length">The expected uncompressed length.</param>
/// <param name="throw_on_error">True to throw on error.</param>
/// <returns>The uncompressed buffer.</returns>
public static NtResult <byte[]> DecompressBuffer(RtlCompressionFormat format, byte[] compressed_buffer, int uncompressed_length, bool throw_on_error)
{
byte[] uncompressed_buffer = new byte[uncompressed_length];
return(Decompress(format, compressed_buffer, uncompressed_buffer, out int final_size).CreateResult(throw_on_error, () => {
if (uncompressed_buffer.Length != final_size)
{
Array.Resize(ref uncompressed_buffer, final_size);
}
return uncompressed_buffer;
}
));
}
private static NtStatus Decompress(RtlCompressionFormat format, byte[] compressed_buffer, byte[] uncompressed_buffer, out int final_size)
{
if (format == RtlCompressionFormat.XPRESS_HUFF)
{
NtStatus status = NtRtl.RtlGetCompressionWorkSpaceSize(format, out int compress_size, out int fragment_size);
if (!status.IsSuccess())
{
final_size = 0;
return(status);
}
byte[] workspace = new byte[compress_size];
return(NtRtl.RtlDecompressBufferEx(format, uncompressed_buffer, uncompressed_buffer.Length,
compressed_buffer, compressed_buffer.Length, out final_size, workspace));
}
return(NtRtl.RtlDecompressBuffer(format, uncompressed_buffer, uncompressed_buffer.Length,
compressed_buffer, compressed_buffer.Length, out final_size));
}
public static extern NtStatus RtlGetCompressionWorkSpaceSize(
RtlCompressionFormat CompressionFormatAndEngine,
out int CompressBufferWorkSpaceSize,
out int CompressFragmentWorkSpaceSize
);
/// <summary>
/// Decompress a buffer.
/// </summary>
/// <param name="format">The compression format used.</param>
/// <param name="compressed_buffer">The compressed buffer.</param>
/// <param name="uncompressed_length">The expected uncompressed length.</param>
/// <returns>The uncompressed buffer.</returns>
public static byte[] DecompressBuffer(RtlCompressionFormat format, byte[] compressed_buffer, int uncompressed_length)
{
return(DecompressBuffer(format, compressed_buffer, uncompressed_length, true).Result);
}
