解读 RtlTrimNtPathSegment
返回字符串前后的 \ 数
typedefHRESULT(__fastcall *PRTL_TRIM_NTPATH_SEGMENT)(
PLUNICODE_STRING,
UINT_PTR *,
UINT_PTR *
);
staticPRTL_TRIM_NTPATH_SEGMENTRtlTrimNtPathSegment;
RtlTrimNtPathSegment = (PRTL_TRIM_NTPATH_SEGMENT)CalcFunctionAddress(phWCP, pfb_RtlTrimNtPathSegment);
LUNICODE_STRINGa1;
UINT_PTRa2, a3;
RtlInitLUnicodeString(&a1, L"c:\\windows\\system32\\abcd\\\\");
RtlTrimNtPathSegment(&a1, &a2, &a3);
结果:
a2 = 0
a3 = 4
//----- (10131387) --------------------------------------------------------
int __fastcall RtlTrimNtPathSegment(inta1, _DWORD *a2, _DWORD *a3)
{
v17 =0xC00000E5;
v3 =a1;
v4 =0;
v12 =a2;
*a2= 0;
*a3= 0;
if (RtlIsLUnicodeStringValid(a1) )
{
v6 =*(__int16**)(v3+ 8);
v7 =v6;
v8 =(__int16 *)((char *)v6 + *(_DWORD *)v3);
v17 =0;
v9 =0;
if (v6 < v8 )
{
do
{
v10 =*v7;
++v7;
if ( v10 != 92 )
break;
v4 +=2;
}
while ( v7 <v8 );
v17 <