private byte[] SerializeEntry(EaBufferEntry entry, bool final)
{
int entry_size = (entry.Name.Length + entry.Data.Length + 9 + 3) & ~3;
MemoryStream stm = new MemoryStream();
BinaryWriter writer = new BinaryWriter(stm);
// NextEntryOffset
if (final)
{
writer.Write(0);
}
else
{
writer.Write(entry_size);
}
// Flags
writer.Write((byte)entry.Flags);
// EaNameLength
writer.Write((byte)entry.Name.Length);
// EaValueLength
writer.Write((ushort)entry.Data.Length);
// EaName
writer.Write(Encoding.ASCII.GetBytes(entry.Name));
// NUL terminator (not counted in name length)
writer.Write((byte)0);
// Data
writer.Write(entry.Data);
// Pad to next 4 byte boundary
while (stm.Length < entry_size)
{
writer.Write((byte)0);
}
return(stm.ToArray());
}
/// <summary>
/// Get the cached singing level from the raw EA buffer.
/// </summary>
/// <param name="ea">The EA buffer to read the cached signing level from.</param>
/// <returns>The cached signing level.</returns>
/// <exception cref="NtException">Throw on error.</exception>
public static CachedSigningLevel GetCachedSigningLevelFromEa(EaBuffer ea)
{
EaBufferEntry buffer = ea.GetEntry("$KERNEL.PURGE.ESBCACHE");
if (buffer == null)
{
NtStatus.STATUS_OBJECT_NAME_NOT_FOUND.ToNtException();
}
BinaryReader reader = new BinaryReader(new MemoryStream(buffer.Data));
int total_size = reader.ReadInt32();
int version = reader.ReadInt16();
switch (version)
{
case 1:
return(ReadCachedSigningLevelVersion1(reader));
case 2:
return(ReadCachedSigningLevelVersion2(reader));
case 3:
return(ReadCachedSigningLevelVersion3(reader));
default:
throw new ArgumentException($"Unsupported cached signing level buffer version {version}");
}
}
private bool DeserializeEntry(BinaryReader reader, out EaBufferEntry entry)
{
long start_position = reader.BaseStream.Position;
int next_offset = reader.ReadInt32();
EaBufferEntryFlags flags = (EaBufferEntryFlags)reader.ReadByte();
int ea_name_length = reader.ReadByte();
int data_length = reader.ReadUInt16();
string name = Encoding.ASCII.GetString(reader.ReadAllBytes(ea_name_length));
reader.ReadByte();
byte[] data = reader.ReadAllBytes(data_length);
entry = new EaBufferEntry(name, data, flags);
if (next_offset == 0)
{
return(true);
}
reader.BaseStream.Position = start_position + next_offset;
return(false);
}
/// <summary>
/// Remove an entry from the buffer.
/// </summary>
/// <param name="entry">The entry to remove.</param>
public void RemoveEntry(EaBufferEntry entry)
{
_buffers.Remove(entry);
}
/// <summary>
/// Add a new EA entry from an old entry. The data will be cloned.
/// </summary>
/// <param name="entry">The entry to add.</param>
public void AddEntry(EaBufferEntry entry)
{
AddEntry(entry.Name, entry.Data, entry.Flags);
}
private bool DeserializeEntry(BinaryReader reader, out EaBufferEntry entry)
{
long start_position = reader.BaseStream.Position;
int next_offset = reader.ReadInt32();
// Flags
reader.ReadByte();
int ea_name_length = reader.ReadByte();
int data_length = reader.ReadUInt16();
string name = Encoding.ASCII.GetString(reader.ReadAllBytes(ea_name_length));
reader.ReadByte();
byte[] data = reader.ReadAllBytes(data_length);
entry = new EaBufferEntry(name, data);
if (next_offset == 0)
{
return false;
}
reader.BaseStream.Position = start_position = next_offset;
return true;
}
/// <summary>
/// Remove an entry from the buffer.
/// </summary>
/// <param name="entry">The entry to remove.</param>
public void RemoveEntry(EaBufferEntry entry)
{
_buffers.Remove(entry);
}