NTDll's Compression Functions
-
Hello, I'm writing an application that has to have a de/compressing algorithm used to store data. The algorithm I want to use is the LZNT and its functions are exported in NtDll.Dll as far as an unofficial documentation says. I was able to find the 3 functions' syntax, but I can't get them to work. Here they are (DLLImport info stripped): public static extern void RtlCompressBuffer( ulong CompressionFormat, void *SourceBuffer, ulong SourceBufferLength, out IntPtr DestinationBuffer, ulong *DestinationBufferLength, ulong Unknown, out ulong *pDestinationSize, void *WorkspaceBuffer ); public static extern IntPtr RtlDecompressBuffer( out IntPtr DestinationBuffer, ulong DestinationBufferLength, IntPtr SourceBuffer, ulong SourceBufferLength, ulong *pDestinationSize ); public static extern IntPtr RtlGetCompressionWorkSpaceSize( ulong CompressionFormat, out ulong *pNeededBufferSize, out ulong *pUnknown ); Please correct me if I'm wrong with them, and I'd like to see any sample code which I can use for manipulating data. Thank you in advance, and best regards, Stan P.S. here is the code I tried Stream fs = new FileStream("input.exe", FileMode.Open); //input.exe is a test file byte[] DataIn = new byte[fs.Length]; fs.Read(DataIn, 0, (int)fs.Length); fs.Close(); IntPtr p_DataOut; ulong *pDS; byte* bt = stackalloc byte[DataIn.Length]; fixed(byte *p_DataIn = DataIn) { RtlCompressBuffer(0x0002 /*LZNT*/, p_DataIn, (ulong)DataIn.Length, out p_DataOut, (ulong*)DataIn.Length, 0x1000, out pDS, bt); } I get a NullReferenceException when executing RtlCompressBuffer, but as far as I saw, none of the parameters is null, except the ones with 'out' modifiers
-
Hello, I'm writing an application that has to have a de/compressing algorithm used to store data. The algorithm I want to use is the LZNT and its functions are exported in NtDll.Dll as far as an unofficial documentation says. I was able to find the 3 functions' syntax, but I can't get them to work. Here they are (DLLImport info stripped): public static extern void RtlCompressBuffer( ulong CompressionFormat, void *SourceBuffer, ulong SourceBufferLength, out IntPtr DestinationBuffer, ulong *DestinationBufferLength, ulong Unknown, out ulong *pDestinationSize, void *WorkspaceBuffer ); public static extern IntPtr RtlDecompressBuffer( out IntPtr DestinationBuffer, ulong DestinationBufferLength, IntPtr SourceBuffer, ulong SourceBufferLength, ulong *pDestinationSize ); public static extern IntPtr RtlGetCompressionWorkSpaceSize( ulong CompressionFormat, out ulong *pNeededBufferSize, out ulong *pUnknown ); Please correct me if I'm wrong with them, and I'd like to see any sample code which I can use for manipulating data. Thank you in advance, and best regards, Stan P.S. here is the code I tried Stream fs = new FileStream("input.exe", FileMode.Open); //input.exe is a test file byte[] DataIn = new byte[fs.Length]; fs.Read(DataIn, 0, (int)fs.Length); fs.Close(); IntPtr p_DataOut; ulong *pDS; byte* bt = stackalloc byte[DataIn.Length]; fixed(byte *p_DataIn = DataIn) { RtlCompressBuffer(0x0002 /*LZNT*/, p_DataIn, (ulong)DataIn.Length, out p_DataOut, (ulong*)DataIn.Length, 0x1000, out pDS, bt); } I get a NullReferenceException when executing RtlCompressBuffer, but as far as I saw, none of the parameters is null, except the ones with 'out' modifiers
Do NOT use pointers in managed code (unsafe code). There is no reason to use this, though there are acceptable reasons for performance like when manipulating pixels.
out ulongis already serving the role of a pointer, too.out ulong*with an unsafe context would actually be more likeunsigned long**in native code. You should read Marshaling Data with Platform Invoke[^] in the .NET Framework SDK to gain a better understanding of how native types translate to managed types. You can also visit http://pinvoke.net[^] for signatures to many common APIs. You should also refrain from using undocumented APIs because they can be changed without warning, not to mention that they are not officially documented by Microsoft. There are better ways to gain compression in .NET, including class libraries that implement compression without resorting to P/Invoke, which means your applications that use such libraries are more likely to be portable to other platforms. One popular compression library is SharpZipLib[^] but you can search for many more. This posting is provided "AS IS" with no warranties, and confers no rights. Software Design Engineer Developer Division Sustained Engineering Microsoft [My Articles] [My Blog]