/// <summary> /// Return whether or not the given expression matches the given name. Takes standard /// Windows wildcards (*, ?, <, > "). /// </summary> public unsafe static bool IsNameInExpression(string expression, string name, bool ignoreCase) { if (string.IsNullOrEmpty(expression) || string.IsNullOrEmpty(name)) { return(false); // If ignore case is set, the API will uppercase the name *if* an UpcaseTable // is not provided. It then flips to case-sensitive. In this state the expression // has to be uppercase to match as expected. fixed(char *e = ignoreCase?expression.ToUpperInvariant() : expression) fixed(char *n = name) { UNICODE_STRING *eus = null; UNICODE_STRING *nus = null; if (e != null) { var temp = new UNICODE_STRING(e, expression.Length); eus = &temp; } if (n != null) { var temp = new UNICODE_STRING(n, name.Length); nus = &temp; } return(Imports.RtlIsNameInExpression(eus, nus, ignoreCase, IntPtr.Zero)); } }
public OBJECT_ATTRIBUTES(UNICODE_STRING *name, ObjectAttributesFlags flags, IntPtr hRootDirectory) { Length = sizeof(OBJECT_ATTRIBUTES); Attributes = flags; ObjectName = name; SecurityDescriptor = SecurityQualityOfService = IntPtr.Zero; RootDirectory = hRootDirectory; }
/// <summary> /// Equivalent of InitializeObjectAttributes macro with the exception that you can directly set SQOS. /// </summary> public unsafe OBJECT_ATTRIBUTES(UNICODE_STRING *objectName, ObjectAttributes attributes, IntPtr rootDirectory, SECURITY_QUALITY_OF_SERVICE *securityQualityOfService = null) { Length = (uint)sizeof(OBJECT_ATTRIBUTES); RootDirectory = rootDirectory; ObjectName = objectName; Attributes = attributes; SecurityDescriptor = null; SecurityQualityOfService = securityQualityOfService; }
internal OBJECT_ATTRIBUTES(UNICODE_STRING *name, uint attributes, IntPtr rootDirectory, IntPtr securityDescriptor) { Length = 0; RootDirectory = rootDirectory; Attributes = attributes; ObjectName = name; SecurityDescriptor = securityDescriptor; SecurityQualityOfService = IntPtr.Zero; // Trick to have the compiler happy. Length = (uint)Marshal.SizeOf(this); }
public static unsafe extern int NtQueryDirectoryFile( IntPtr FileHandle, IntPtr Event, IntPtr ApcRoutine, IntPtr ApcContext, IO_STATUS_BLOCK *IoStatusBlock, IntPtr FileInformation, uint Length, FILE_INFORMATION_CLASS FileInformationClass, BOOLEAN ReturnSingleEntry, UNICODE_STRING *FileName, BOOLEAN RestartScan);
public unsafe static extern NTStatus NtQueryDirectoryFile( SafeFileHandle FileHandle, IntPtr Event, AsyncProcedureCall ApcRoutine, IntPtr ApcContext, out IO_STATUS_BLOCK IoStatusBlock, void *FileInformation, uint Length, FileInformationClass FileInformationClass, Boolean8 ReturnSingleEntry, UNICODE_STRING *FileName, Boolean8 RestartScan);
public unsafe static extern Boolean8 RtlIsNameInExpression( UNICODE_STRING *Expression, UNICODE_STRING *Name, Boolean8 IgnoreCase, IntPtr UpcaseTable);
public unsafe static extern NTStatus LsaOpenPolicy( UNICODE_STRING *SystemName, LSA_OBJECT_ATTRIBUTES *ObjectAttributes, PolicyAccessRights DesiredAccess, out LsaHandle PolicyHandle);
public OBJECT_ATTRIBUTES(UNICODE_STRING *name, ObjectAttributesFlags flags = ObjectAttributesFlags.None) : this(name, flags, IntPtr.Zero) { }
internal static extern unsafe ulong NtUnloadDriver( UNICODE_STRING *ServiceName );
public static unsafe extern void RtlFreeUnicodeString( UNICODE_STRING *UnicodeString);
public static unsafe extern NTSTATUS RtlUpcaseUnicodeString( UNICODE_STRING *DestinationString, UNICODE_STRING *SourceString, BOOLEAN AllocateDestinationString);
public static unsafe extern ByteBoolean RtlIsNameInExpression( UNICODE_STRING *Expression, UNICODE_STRING *Name, ByteBoolean IgnoreCase, IntPtr UpcaseTable);
public static extern int NtRenameKey(HANDLE KeyHandle, [NativeTypeName("PUNICODE_STRING")] UNICODE_STRING *NewName);