解读 RtlTrimNtPathSegment

解读 RtlTrimNtPathSegment

 

 

返回字符串前后的 \ 数

 

typedefHRESULT(__fastcall *PRTL_TRIM_NTPATH_SEGMENT)(

    PLUNICODE_STRING,

    UINT_PTR *,

    UINT_PTR *

    );

staticPRTL_TRIM_NTPATH_SEGMENTRtlTrimNtPathSegment;

RtlTrimNtPathSegment = (PRTL_TRIM_NTPATH_SEGMENT)CalcFunctionAddress(phWCP, pfb_RtlTrimNtPathSegment);

 

LUNICODE_STRINGa1;

UINT_PTRa2, a3;

RtlInitLUnicodeString(&a1, L"c:\\windows\\system32\\abcd\\\\");

RtlTrimNtPathSegment(&a1, &a2, &a3);

结果：

a2 = 0

a3 = 4

 

 

//----- (10131387) --------------------------------------------------------
int __fastcall RtlTrimNtPathSegment(inta1, _DWORD *a2, _DWORD *a3)
{

  v17 =0xC00000E5;
  v3 =a1;
  v4 =0;
  v12 =a2;
  *a2= 0;
  *a3= 0;
  if (RtlIsLUnicodeStringValid(a1) )
  {
    v6 =*(__int16**)(v3+ 8);
    v7 =v6;
    v8 =(__int16 *)((char *)v6 + *(_DWORD *)v3);
    v17 =0;
    v9 =0;
    if (v6 < v8 )
    {
      do
      {
        v10 =*v7;
        ++v7;
        if ( v10 != 92 )
          break;
        v4 +=2;
      }
      while ( v7 <v8 );
      v17 <