Last active
June 14, 2016 11:13
-
-
Save EricZimmerman/4696e6d1bf83dbf13c4b to your computer and use it in GitHub Desktop.
pinvoke for RtlDecompressBufferEx in c#
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System.Runtime.InteropServices; | |
namespace Prefetch.XpressStream | |
{ | |
public class Xpress2 | |
{ | |
// const ushort COMPRESSION_FORMAT_LZNT1 = 2; | |
// const ushort COMPRESSION_FORMAT_XPRESS = 3; | |
const ushort CompressionFormatXpressHuff = 4; | |
[DllImport("ntdll.dll")] | |
private static extern uint RtlGetCompressionWorkSpaceSize(ushort compressionFormat, ref ulong compressBufferWorkSpaceSize, ref ulong compressFragmentWorkSpaceSize); | |
[DllImport("ntdll.dll")] | |
private static extern uint RtlDecompressBufferEx(ushort compressionFormat, byte[] uncompressedBuffer, int uncompressedBufferSize, byte[] compressedBuffer, int compressedBufferSize, ref int finalUncompressedSize, byte[] workSpace); | |
public static byte[] Decompress(byte[] buffer,ulong decompressedSize) | |
{ | |
// our uncompressed data will go here | |
var outBuf = new byte[decompressedSize]; | |
ulong compressBufferWorkSpaceSize = 0; | |
ulong compressFragmentWorkSpaceSize = 0; | |
//get the size of what our workspace needs to be | |
var ret = RtlGetCompressionWorkSpaceSize(CompressionFormatXpressHuff, ref compressBufferWorkSpaceSize, ref compressFragmentWorkSpaceSize); | |
if (ret != 0) | |
{ | |
return null; | |
} | |
var workSpace = new byte[compressFragmentWorkSpaceSize]; | |
var dstSize = 0; | |
ret = RtlDecompressBufferEx(CompressionFormatXpressHuff, outBuf, outBuf.Length, buffer, buffer.Length, ref dstSize, workSpace); | |
if (ret == 0) | |
{ | |
return outBuf; | |
} | |
return null; | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Also available here
https://github.com/EricZimmerman/Prefetch/blob/master/Prefetch/XpressStream/Xpress2.cs