- .版本 2
- .局部变量 unicode1_STRING, 长整数型
- .局部变量 unicode2_STRING, 长整数型
- .局部变量 unicode3_STRING, 长整数型
- .局部变量 ansi
- .局部变量 ansi_STRING, 长整数型
- .局部变量 ret
- .局部变量 unicode
- .局部变量 a
- .局部变量 b
- .局部变量 c
- ansi = Asm_GetDataH (“Administrator”)
- Asm_writeWord_1 (ansi_STRING, Asm_len (ansi))
- Asm_writeWord__1 (ansi_STRING, 2, Asm_len (ansi) + 1)
- Asm_writeDword__1 (ansi_STRING, 4, ansi)
- ' 调试输出 (到字节集 (“我”))
- ' 调试输出 (到字节集 (Nt_Trans_RtlAnsiCharToUnicodeChar (Asm_GetH (Asm_GetH (取字节集数据 (到字节集 (“我”), #短整数型, )))))) ' ansi双字节转Unicode
- ret = Nt_Trans_RtlAnsiStringToUnicodeSize (Asm_GetH (ansi_STRING)) ' ansi转unicode长度
- ' 调试输出 (ret)
- Nt_Trans_RtlAnsiStringToUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (ansi_STRING), 真) ' 真 由函数在默认堆栈申请内存转换
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING)) ' 释放掉内存 自己也可以释放 Nt_Heap_RtlFreeHeap 默认堆栈传地址就行了
- unicode = Nt_Heap_RtlAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), ret)
- Asm_writeWord_1 (unicode1_STRING, 0)
- Asm_writeWord__1 (unicode1_STRING, 2, ret)
- Asm_writeDword__1 (unicode1_STRING, 4, unicode)
- Nt_Trans_RtlAnsiStringToUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (ansi_STRING), 假) ' 假 自己可控指针位置
- ' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
- ansi = Asm_GetDataH (“|我的Administrator”)
- Asm_writeWord_1 (ansi_STRING, Asm_len (ansi))
- Asm_writeWord__1 (ansi_STRING, 2, Asm_len (ansi) + 1)
- Asm_writeDword__1 (ansi_STRING, 4, ansi)
- unicode = Nt_Heap_RtlReAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), unicode, Asm_add (Nt_Heap_RtlSizeHeap (g_heap, 0, unicode), Nt_Trans_RtlAnsiStringToUnicodeSize (Asm_GetH (ansi_STRING)) - 2))
- Asm_writeWord__1 (unicode1_STRING, 2, Nt_Heap_RtlSizeHeap (g_heap, 0, unicode))
- Asm_writeDword__1 (unicode1_STRING, 4, unicode)
- Nt_Trans_RtlAnsiStringToUnicodeString (Asm_GetH (unicode2_STRING), Asm_GetH (ansi_STRING), 真) ' 真 由函数在默认堆栈申请内存转换
- Nt_Trans_RtlAppendUnicodeToString (Asm_GetH (unicode1_STRING), Asm_readDword__1 (unicode2_STRING, 4))
- ' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
- unicode = Nt_Heap_RtlReAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), unicode, Asm_add (Nt_Heap_RtlSizeHeap (g_heap, 0, unicode), Nt_Trans_RtlAnsiStringToUnicodeSize (Asm_GetH (ansi_STRING)) - 2))
- Asm_writeWord__1 (unicode1_STRING, 2, Nt_Heap_RtlSizeHeap (g_heap, 0, unicode))
- Asm_writeDword__1 (unicode1_STRING, 4, unicode)
- Nt_Trans_RtlAppendUnicodeToString (Asm_GetH (unicode1_STRING), Asm_readDword__1 (unicode2_STRING, 4))
- ' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
- ' 输出调试文本 (Asm_readWord__1 (unicode1_STRING, 0))
- ' 输出调试文本 (Asm_readWord__1 (unicode2_STRING, 0))
- ' 输出调试文本 (Nt_Trans_RtlCompareUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
- ' 输出调试文本 (Nt_Trans_RtlEqualUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
- Nt_Trans_RtlCopyUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING)) ' 复制
- ' 输出调试文本 (Nt_Trans_RtlEqualUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
- ' 输出调试文本 (Nt_Trans_RtlCompareUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING)) ' 释放掉内存
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode2_STRING)) ' 释放掉内存
- ' -------------------------------------------------------------
- Nt_Trans_RtlCreateUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetBinH ({ 97, 0, 98, 0, 99, 0, 0, 0 }))
- ' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING)) ' 释放掉内存
- Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“ABC”))
- ' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING)) ' 释放掉内存
- ' 调试输出 (到字节集 (“A”))
- ' 输出调试文本 (字符 (Nt_Trans_RtlDowncaseUnicodeChar (65))) '单字符转换
- Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“ABC”))
- Nt_Trans_RtlDowncaseUnicodeString (Asm_GetH (unicode2_STRING), Asm_GetH (unicode1_STRING), 真)
- Asm_writeDword__1 (unicode2_STRING, 4, Nt_Heap_RtlReAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), Asm_readDword__1 (unicode2_STRING, 4), Asm_add (Nt_Heap_RtlSizeHeap (g_heap, 0, Asm_readDword__1 (unicode2_STRING, 4)), 2)))
- Asm_writeWord__1 (unicode2_STRING, 2, Nt_Heap_RtlSizeHeap (g_heap, 0, Asm_readDword__1 (unicode2_STRING, 4)))
- ' MessageBoxW (0, Asm_readDword__1 (unicode2_STRING, 4), 0, 0)
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode2_STRING)) ' 释放掉内存
- ' Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“ABC”))
- ' 输出调试文本 (Nt_Trans_RtlEraseUnicodeString (Asm_GetH (unicode1_STRING)))
- ' 调试输出 (到字节集 (unicode1_STRING))
- Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“abcd”))
- Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode2_STRING), Asm_GetDataH (“d”))
- Nt_Trans_RtlFindCharInUnicodeString (0, Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), Asm_GetH (ret))
- ' 输出调试文本 (ret)
- Nt_Trans_RtlFindUnicodeSubstring (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), Asm_GetH (ret))
- ' 输出调试文本 (ret)
- ' 输出调试文本 (Nt_Trans_RtlHashUnicodeString (Asm_GetH (unicode1_STRING), 假, 0, Asm_GetH (ret)))
- ' 调试输出 (到字节集 (ret))
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING)) ' 释放掉内存
- Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode2_STRING)) ' 释放掉内存
- Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“www.我爱你.com”))
- a = Nt_Heap_RtlAllocateHeap (g_heap, 12, 255)
- ret = 255
- Nt_Trans_RtlIdnToAscii (1, Asm_readDword__1 (unicode1_STRING, 4), -1, a, Asm_GetH (ret))
- ' 调试输出 (指针到字节集 (a, ret × 2))
- b = Nt_Heap_RtlAllocateHeap (g_heap, 12, 255)
- c = ret
- ret = 255
- Nt_Trans_RtlIdnToUnicode (1, a, c, b, Asm_GetH (ret))
- ' 调试输出 (指针到字节集 (b, ret × 2))
- Nt_RtlZeroMemory (a, 255)
- ret = 255
- Nt_Trans_RtlIdnToNameprepUnicode (1, b, -1, a, Asm_GetH (ret))
- ' 调试输出 (指针到字节集 (a, ret × 2))
- Nt_Heap_RtlFreeHeap (g_heap, 0, b)
- Nt_Trans_RtlMultiByteToUnicodeSize (Asm_GetH (ret), Asm_GetDataH (“123你好”), Asm_len (Asm_GetDataH (“123你好”)))
- ' 输出调试文本 (ret)
复制代码 .版本 2
' RtlAnsiCharToUnicodeChar
' RtlAnsiStringToUnicodeSize
' RtlAnsiStringToUnicodeString
' RtlAppendAsciizToString
' RtlAppendStringToString
' RtlAppendUnicodeStringToString
' RtlAppendUnicodeToString
' RtlCharToInteger
' RtlCompareString
' RtlCompareUnicodeString
' RtlCompareUnicodeStrings
' RtlConsoleMultiByteToUnicodeN'放弃
' RtlConvertDeviceFamilyInfoToString'放弃
' RtlConvertLCIDToString'放弃
' RtlConvertSidToUnicodeString'放弃
' RtlCopyString
' RtlCopyUnicodeString
' RtlCreateUnicodeString
' RtlCreateUnicodeStringFromAsciiz
' RtlCustomCPToUnicodeN'该RtlCustomCPToUnicodeN程序保留给系统使用。请参见RtlMultiByteToUnicodeN和RtlOemToUnicodeN。
' RtlDowncaseUnicodeChar
' RtlDowncaseUnicodeString
' RtlDuplicateUnicodeString
' RtlEqualString
' RtlEqualUnicodeString
' RtlEraseUnicodeString
' RtlFindCharInUnicodeString
' RtlFindUnicodeSubstring
' RtlFreeAnsiString
' RtlFreeOemString
' RtlFreeUTF8String
' RtlFreeUnicodeString
' RtlGUIDFromString
' RtlStringFromGUIDEx
' RtlHashUnicodeString
' RtlIdnToNameprepUnicode
' RtlIdnToUnicode
' RtlIdnToAscii
' RtlInitAnsiString
' RtlInitAnsiStringEx
' RtlInitString
' RtlInitStringEx
' RtlInitUTF8String
' RtlInitUTF8StringEx
' RtlInitUnicodeString
' RtlInitUnicodeStringEx
' RtlInt64ToUnicodeString
' RtlIntegerToChar
' RtlIntegerToUnicodeString
' RtlIsTextUnicode '放弃
' RtlLargeIntegerToChar '放弃
' RtlLengthSidAsUnicodeString
' RtlMultiAppendUnicodeStringBuffer'放弃
' RtlMultiByteToUnicodeN
' RtlMultiByteToUnicodeSize
' RtlNormalizeString'放弃
' RtlOemStringToUnicodeSize
' RtlOemStringToUnicodeString
' RtlOemToUnicodeN
' RtlPrefixString
' RtlPrefixUnicodeString
' RtlRunDecodeUnicodeString
' RtlRunEncodeUnicodeString
' RtlUTF8StringToUnicodeString
' RtlUTF8ToUnicodeN
' RtlUnicodeStringToAnsiSize
' RtlUnicodeStringToAnsiString
' RtlUnicodeStringToCountedOemString
' RtlUnicodeStringToInteger
' RtlUnicodeStringToOemSize
' RtlUnicodeStringToOemString
' RtlUnicodeStringToUTF8String
' RtlUnicodeToCustomCPN'该RtlUnicodeToCustomCPN程序保留给系统使用。
' RtlUnicodeToMultiByteN
' RtlUnicodeToMultiByteSize
' RtlUnicodeToOemN
' RtlUnicodeToUTF8N
' RtlUpcaseUnicodeChar
' RtlUpcaseUnicodeString
' RtlUpcaseUnicodeStringToAnsiString
' RtlUpcaseUnicodeStringToCountedOemString
' RtlUpcaseUnicodeStringToOemString
' RtlUpcaseUnicodeToCustomCPN'该RtlUpcaseUnicodeToCustomCPN程序保留给系统使用。
' RtlUpcaseUnicodeToMultiByteN
' RtlUpcaseUnicodeToOemN
' RtlUpperChar
' RtlUpperString
' RtlValidateUnicodeString
' RtlxAnsiStringToUnicodeSize
' RtlxOemStringToUnicodeSize
' RtlxUnicodeStringToAnsiSize
' RtlxUnicodeStringToOemSize
|