/// <summary> /// Reads a unicode string from a structure /// NOTE: This function assumes the structure has an pointer to the unicode string, NOT a string embedded within the structure itself! /// </summary> /// <param name="moduleName">Name of the module that contains the type</param> /// <param name="typeName">Name of the type that contains the field</param> /// <param name="fieldName">Name of the field</param> /// <param name="structureAddress">Address of the structure</param> /// <param name="maxSize">Maximum number of characters to read</param> /// <param name="output">The data that was retrieved</param> /// <returns>HRESULT</returns> public int ReadUnicodeStringFromStructure_WOW(string moduleName, string typeName, string fieldName, UInt64 structureAddress, uint maxSize, out string output) { int hr; UInt64 stringPointer; if (FAILED(hr = ReadPointerFromStructure(moduleName, typeName, fieldName, structureAddress, out stringPointer))) { output = null; return hr; } PEFile PEFile = new PEFile(this, moduleName); if (PEFile.GetMachineType() == IMAGE_FILE_MACHINE.I386) stringPointer &= 0xFFFFFFFF; return ReadUnicodeString(stringPointer, maxSize, out output); }