Skip to content

Instantly share code, notes, and snippets.

@EricZimmerman
Last active June 14, 2016 11:13
Show Gist options
  • Save EricZimmerman/4696e6d1bf83dbf13c4b to your computer and use it in GitHub Desktop.
Save EricZimmerman/4696e6d1bf83dbf13c4b to your computer and use it in GitHub Desktop.
pinvoke for RtlDecompressBufferEx in c#
using System.Runtime.InteropServices;
namespace Prefetch.XpressStream
{
public class Xpress2
{
// const ushort COMPRESSION_FORMAT_LZNT1 = 2;
// const ushort COMPRESSION_FORMAT_XPRESS = 3;
const ushort CompressionFormatXpressHuff = 4;
[DllImport("ntdll.dll")]
private static extern uint RtlGetCompressionWorkSpaceSize(ushort compressionFormat, ref ulong compressBufferWorkSpaceSize, ref ulong compressFragmentWorkSpaceSize);
[DllImport("ntdll.dll")]
private static extern uint RtlDecompressBufferEx(ushort compressionFormat, byte[] uncompressedBuffer, int uncompressedBufferSize, byte[] compressedBuffer, int compressedBufferSize, ref int finalUncompressedSize, byte[] workSpace);
public static byte[] Decompress(byte[] buffer,ulong decompressedSize)
{
// our uncompressed data will go here
var outBuf = new byte[decompressedSize];
ulong compressBufferWorkSpaceSize = 0;
ulong compressFragmentWorkSpaceSize = 0;
//get the size of what our workspace needs to be
var ret = RtlGetCompressionWorkSpaceSize(CompressionFormatXpressHuff, ref compressBufferWorkSpaceSize, ref compressFragmentWorkSpaceSize);
if (ret != 0)
{
return null;
}
var workSpace = new byte[compressFragmentWorkSpaceSize];
var dstSize = 0;
ret = RtlDecompressBufferEx(CompressionFormatXpressHuff, outBuf, outBuf.Length, buffer, buffer.Length, ref dstSize, workSpace);
if (ret == 0)
{
return outBuf;
}
return null;
}
}
}
@EricZimmerman
Copy link
Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment