/// <summary>
/// Lower case a string according to the internal NTDLL string routines.
/// </summary>
/// <param name="str">The string to lower case.</param>
/// <param name="throw_on_error">True to throw on error.</param>
/// <returns>The lower case string.</returns>
public static NtResult <string> Downcase(string str, bool throw_on_error)
{
UnicodeStringOut out_str = new UnicodeStringOut();
try
{
return(NtRtl.RtlUpcaseUnicodeString(ref out_str, new UnicodeString(str), true).CreateResult(throw_on_error, () => out_str.ToString()));
}
finally
{
NtRtl.RtlFreeUnicodeString(ref out_str);
}
}
static List <string> FindDeviceObjects(IEnumerable <string> names)
{
Queue <string> dumpList = new Queue <string>(names);
HashSet <string> dumpedDirs = new HashSet <string>(StringComparer.OrdinalIgnoreCase);
List <string> totalEntries = new List <string>();
while (dumpList.Count > 0)
{
string name = dumpList.Dequeue();
try
{
ObjectDirectory directory = ObjectNamespace.OpenDirectory(null, name);
if (!dumpedDirs.Contains(directory.FullPath))
{
dumpedDirs.Add(directory.FullPath);
List <ObjectDirectoryEntry> sortedEntries = new List <ObjectDirectoryEntry>(directory.Entries);
sortedEntries.Sort();
string base_name = name.TrimEnd('\\');
IEnumerable <ObjectDirectoryEntry> objs = sortedEntries;
if (_recursive)
{
foreach (ObjectDirectoryEntry entry in sortedEntries.Where(d => d.IsDirectory))
{
dumpList.Enqueue(entry.FullPath);
}
}
totalEntries.AddRange(objs.Where(e => e.TypeName.Equals("device", StringComparison.OrdinalIgnoreCase)).Select(e => e.FullPath));
}
}
catch (NtException ex)
{
int error = NtRtl.RtlNtStatusToDosError(ex.Status);
if (NtRtl.RtlNtStatusToDosError(ex.Status) == 6)
{
// Add name in case it's an absolute name, not in a directory
totalEntries.Add(name);
}
else
{
}
}
}
return(totalEntries);
}
private static NtStatus Decompress(RtlCompressionFormat format, byte[] compressed_buffer, byte[] uncompressed_buffer, out int final_size)
{
if (format == RtlCompressionFormat.XPRESS_HUFF)
{
NtStatus status = NtRtl.RtlGetCompressionWorkSpaceSize(format, out int compress_size, out int fragment_size);
if (!status.IsSuccess())
{
final_size = 0;
return(status);
}
byte[] workspace = new byte[compress_size];
return(NtRtl.RtlDecompressBufferEx(format, uncompressed_buffer, uncompressed_buffer.Length,
compressed_buffer, compressed_buffer.Length, out final_size, workspace));
}
return(NtRtl.RtlDecompressBuffer(format, uncompressed_buffer, uncompressed_buffer.Length,
compressed_buffer, compressed_buffer.Length, out final_size));
}
/// <summary>
/// Lower case a character according to the internal NTDLL string routines.
/// </summary>
/// <param name="c">The character to lower case.</param>
/// <returns>The lower case character.</returns>
public static char Downcase(char c)
{
return(NtRtl.RtlUpcaseUnicodeChar(c));
}
