private byte[] SerializeEntry(EaBufferEntry entry, bool final)
        {
            int entry_size = (entry.Name.Length + entry.Data.Length + 9 + 3) & ~3;

            MemoryStream stm    = new MemoryStream();
            BinaryWriter writer = new BinaryWriter(stm);

            // NextEntryOffset
            if (final)
            {
                writer.Write(0);
            }
            else
            {
                writer.Write(entry_size);
            }
            // Flags
            writer.Write((byte)entry.Flags);
            // EaNameLength
            writer.Write((byte)entry.Name.Length);
            // EaValueLength
            writer.Write((ushort)entry.Data.Length);
            // EaName
            writer.Write(Encoding.ASCII.GetBytes(entry.Name));
            // NUL terminator (not counted in name length)
            writer.Write((byte)0);
            // Data
            writer.Write(entry.Data);
            // Pad to next 4 byte boundary
            while (stm.Length < entry_size)
            {
                writer.Write((byte)0);
            }
            return(stm.ToArray());
        }
Exemplo n.º 2
0
        /// <summary>
        /// Get the cached singing level from the raw EA buffer.
        /// </summary>
        /// <param name="ea">The EA buffer to read the cached signing level from.</param>
        /// <returns>The cached signing level.</returns>
        /// <exception cref="NtException">Throw on error.</exception>
        public static CachedSigningLevel GetCachedSigningLevelFromEa(EaBuffer ea)
        {
            EaBufferEntry buffer = ea.GetEntry("$KERNEL.PURGE.ESBCACHE");

            if (buffer == null)
            {
                NtStatus.STATUS_OBJECT_NAME_NOT_FOUND.ToNtException();
            }

            BinaryReader reader     = new BinaryReader(new MemoryStream(buffer.Data));
            int          total_size = reader.ReadInt32();
            int          version    = reader.ReadInt16();

            switch (version)
            {
            case 1:
                return(ReadCachedSigningLevelVersion1(reader));

            case 2:
                return(ReadCachedSigningLevelVersion2(reader));

            case 3:
                return(ReadCachedSigningLevelVersion3(reader));

            default:
                throw new ArgumentException($"Unsupported cached signing level buffer version {version}");
            }
        }
        private bool DeserializeEntry(BinaryReader reader, out EaBufferEntry entry)
        {
            long start_position      = reader.BaseStream.Position;
            int  next_offset         = reader.ReadInt32();
            EaBufferEntryFlags flags = (EaBufferEntryFlags)reader.ReadByte();
            int    ea_name_length    = reader.ReadByte();
            int    data_length       = reader.ReadUInt16();
            string name = Encoding.ASCII.GetString(reader.ReadAllBytes(ea_name_length));

            reader.ReadByte();
            byte[] data = reader.ReadAllBytes(data_length);
            entry = new EaBufferEntry(name, data, flags);
            if (next_offset == 0)
            {
                return(true);
            }
            reader.BaseStream.Position = start_position + next_offset;
            return(false);
        }
 /// <summary>
 /// Remove an entry from the buffer.
 /// </summary>
 /// <param name="entry">The entry to remove.</param>
 public void RemoveEntry(EaBufferEntry entry)
 {
     _buffers.Remove(entry);
 }
 /// <summary>
 /// Add a new EA entry from an old entry. The data will be cloned.
 /// </summary>
 /// <param name="entry">The entry to add.</param>
 public void AddEntry(EaBufferEntry entry)
 {
     AddEntry(entry.Name, entry.Data, entry.Flags);
 }
 private bool DeserializeEntry(BinaryReader reader, out EaBufferEntry entry)
 {
     long start_position = reader.BaseStream.Position;
     int next_offset = reader.ReadInt32();
     // Flags
     reader.ReadByte();
     int ea_name_length = reader.ReadByte();
     int data_length = reader.ReadUInt16();
     string name = Encoding.ASCII.GetString(reader.ReadAllBytes(ea_name_length));
     reader.ReadByte();
     byte[] data = reader.ReadAllBytes(data_length);
     entry = new EaBufferEntry(name, data);
     if (next_offset == 0)
     {
         return false;
     }
     reader.BaseStream.Position = start_position = next_offset;
     return true;
 }
 /// <summary>
 /// Remove an entry from the buffer.
 /// </summary>
 /// <param name="entry">The entry to remove.</param>
 public void RemoveEntry(EaBufferEntry entry)
 {
     _buffers.Remove(entry);
 }