自学教程：C++ FIELD_OFFSET函数代码示例

NTSTATUSEx2ProcessUserPerfStat(    IN PEXT2_IRP_CONTEXT    IrpContext,    IN PEXT2_QUERY_PERFSTAT QueryPerf,    IN ULONG                Length){    PEXT2_VCB   Vcb = NULL;    PDEVICE_OBJECT  DeviceObject = NULL;    BOOLEAN     GlobalDataResourceAcquired = FALSE;    NTSTATUS    Status = STATUS_SUCCESS;    __try {        ASSERT(IrpContext != NULL);        ASSERT((IrpContext->Identifier.Type == EXT2ICX) &&               (IrpContext->Identifier.Size == sizeof(EXT2_IRP_CONTEXT)));        DeviceObject = IrpContext->DeviceObject;        if (IsExt2FsDevice(DeviceObject)) {            if (QueryPerf->Magic != EXT2_QUERY_PERFSTAT_MAGIC) {                Status = STATUS_INVALID_PARAMETER;                __leave;            }            if (QueryPerf->Command != IOCTL_APP_QUERY_PERFSTAT) {                Status = STATUS_INVALID_PARAMETER;                __leave;            }            if (Length != EXT2_QUERY_PERFSTAT_SZV1 &&                Length != EXT2_QUERY_PERFSTAT_SZV2) {                Status = STATUS_INVALID_PARAMETER;                __leave;            }            ExAcquireResourceSharedLite(&Ext2Global->Resource, TRUE);            GlobalDataResourceAcquired = TRUE;            if (Length == EXT2_QUERY_PERFSTAT_SZV2) {                QueryPerf->Flags = EXT2_QUERY_PERFSTAT_VER2;                QueryPerf->PerfStatV2 = Ext2Global->PerfStat;            } else {                memcpy(&QueryPerf->PerfStatV1.Irps[0], &Ext2Global->PerfStat.Irps[0],                       FIELD_OFFSET(EXT2_PERF_STATISTICS_V1, Unit));                memcpy(&QueryPerf->PerfStatV1.Unit, &Ext2Global->PerfStat.Unit,                       sizeof(EXT2_STAT_ARRAY_V1));                memcpy(&QueryPerf->PerfStatV1.Current, &Ext2Global->PerfStat.Current,                       sizeof(EXT2_STAT_ARRAY_V1));                memcpy(&QueryPerf->PerfStatV1.Size, &Ext2Global->PerfStat.Size,                       sizeof(EXT2_STAT_ARRAY_V1));                memcpy(&QueryPerf->PerfStatV1.Total, &Ext2Global->PerfStat.Total,                       sizeof(EXT2_STAT_ARRAY_V1));            }        } else {            Status = STATUS_INVALID_PARAMETER;            __leave;        }        if (NT_SUCCESS(Status)) {            IrpContext->Irp->IoStatus.Information = Length;        }    } __finally {        if (GlobalDataResourceAcquired) {            ExReleaseResourceLite(&Ext2Global->Resource);        }        if (!IrpContext->ExceptionInProgress) {            Ext2CompleteIrpContext(IrpContext, Status);        }    }    return Status;}

//.........这里部分代码省略.........		}		// Change the key length for EAPPkt9x.vxd. Added by Annie, 2005-11-03.		if((encryptionalgo==  _AES_) && (key->KeyLength == 32) ) {			key->KeyLength = 16;			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("AES key length changed: %u/n", key->KeyLength) );		}		if(key->KeyIndex & 0x8000000) {//error ??? 0x8000_0000			bgrouptkey = _TRUE;		}		if((check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE)==_TRUE)&&(check_fwstate(&padapter->mlmepriv, _FW_LINKED)==_TRUE))		{			bgrouptkey = _TRUE;		}		bgroup = _TRUE;		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------/n") );		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("[Group Key set]/n") );		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------/n")) ;		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key index: 0x%8x(0x%8x)/n", key->KeyIndex,(key->KeyIndex&0x3)));		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key Length: %d/n", key->KeyLength)) ;		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------/n"));	}	// If WEP encryption algorithm, just call set_802_11_add_wep().	if((padapter->securitypriv.dot11AuthAlgrthm !=2)&&(encryptionalgo== _WEP40_  || encryptionalgo== _WEP104_))	{		u8 ret;		u32 keyindex;		u32 len = FIELD_OFFSET(NDIS_802_11_KEY, KeyMaterial) + key->KeyLength;		NDIS_802_11_WEP *wep = &padapter->securitypriv.ndiswep;		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ WEP key +++++/n"));		wep->Length = len;		keyindex = key->KeyIndex&0x7fffffff;		wep->KeyIndex = keyindex ;		wep->KeyLength = key->KeyLength;		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY:Before memcpy /n"));		_memcpy(wep->KeyMaterial, key->KeyMaterial, key->KeyLength);		_memcpy(&(padapter->securitypriv.dot11DefKey[keyindex].skey[0]), key->KeyMaterial, key->KeyLength);		padapter->securitypriv.dot11DefKeylen[keyindex]=key->KeyLength;		padapter->securitypriv.dot11PrivacyKeyIndex=keyindex;		ret = set_802_11_add_wep(padapter, wep);		goto exit;	}	if (key->KeyIndex & 0x20000000) {		// SetRSC		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ SetRSC+++++/n"));		if(bgroup == _TRUE)		{			NDIS_802_11_KEY_RSC keysrc=key->KeyRSC & 0x00FFFFFFFFFFFFULL;			_memcpy(&padapter->securitypriv.dot11Grprxpn, &keysrc, 8);		}		else

NTSTATUSNTAPIIntVideoPortPnPStartDevice(    IN PDEVICE_OBJECT DeviceObject,    IN PIRP Irp){    PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);    PDRIVER_OBJECT DriverObject;    PVIDEO_PORT_DRIVER_EXTENSION DriverExtension;    PVIDEO_PORT_DEVICE_EXTENSION DeviceExtension;    PCM_RESOURCE_LIST AllocatedResources;    /* Get the initialization data we saved in VideoPortInitialize.*/    DriverObject = DeviceObject->DriverObject;    DriverExtension = IoGetDriverObjectExtension(DriverObject, DriverObject);    DeviceExtension = (PVIDEO_PORT_DEVICE_EXTENSION)DeviceObject->DeviceExtension;    /* Store some resources in the DeviceExtension. */    AllocatedResources = Stack->Parameters.StartDevice.AllocatedResources;    if (AllocatedResources != NULL)    {        CM_FULL_RESOURCE_DESCRIPTOR *FullList;        CM_PARTIAL_RESOURCE_DESCRIPTOR *Descriptor;        ULONG ResourceCount;        ULONG ResourceListSize;        /* Save the resource list */        ResourceCount = AllocatedResources->List[0].PartialResourceList.Count;        ResourceListSize =            FIELD_OFFSET(CM_RESOURCE_LIST, List[0].PartialResourceList.                         PartialDescriptors[ResourceCount]);        DeviceExtension->AllocatedResources = ExAllocatePool(PagedPool, ResourceListSize);        if (DeviceExtension->AllocatedResources == NULL)        {            return STATUS_INSUFFICIENT_RESOURCES;        }        RtlCopyMemory(DeviceExtension->AllocatedResources,                      AllocatedResources,                      ResourceListSize);        /* Get the interrupt level/vector - needed by HwFindAdapter sometimes */        for (FullList = AllocatedResources->List;             FullList < AllocatedResources->List + AllocatedResources->Count;             FullList++)        {            INFO_(VIDEOPRT, "InterfaceType %u BusNumber List %u Device BusNumber %u Version %u Revision %u/n",                  FullList->InterfaceType, FullList->BusNumber, DeviceExtension->SystemIoBusNumber, FullList->PartialResourceList.Version, FullList->PartialResourceList.Revision);            /* FIXME: Is this ASSERT ok for resources from the PNP manager? */            ASSERT(FullList->InterfaceType == PCIBus);            ASSERT(FullList->BusNumber == DeviceExtension->SystemIoBusNumber);            ASSERT(1 == FullList->PartialResourceList.Version);            ASSERT(1 == FullList->PartialResourceList.Revision);            for (Descriptor = FullList->PartialResourceList.PartialDescriptors;                 Descriptor < FullList->PartialResourceList.PartialDescriptors + FullList->PartialResourceList.Count;                 Descriptor++)            {                if (Descriptor->Type == CmResourceTypeInterrupt)                {                    DeviceExtension->InterruptLevel = Descriptor->u.Interrupt.Level;                    DeviceExtension->InterruptVector = Descriptor->u.Interrupt.Vector;                    if (Descriptor->ShareDisposition == CmResourceShareShared)                        DeviceExtension->InterruptShared = TRUE;                    else                        DeviceExtension->InterruptShared = FALSE;                }            }        }    }    INFO_(VIDEOPRT, "Interrupt level: 0x%x Interrupt Vector: 0x%x/n",          DeviceExtension->InterruptLevel,          DeviceExtension->InterruptVector);    /* Create adapter device object. */    return IntVideoPortFindAdapter(DriverObject,                                   DriverExtension,                                   DeviceObject);}

//.........这里部分代码省略.........            IO_COUNTERS pii;            if (ProcessInformationLength >= sizeof(IO_COUNTERS))            {                if (!ProcessInformation)                    ret = STATUS_ACCESS_VIOLATION;                else if (!ProcessHandle)                    ret = STATUS_INVALID_HANDLE;                else                {                    /* FIXME : real data */                    memset(&pii, 0 , sizeof(IO_COUNTERS));                    memcpy(ProcessInformation, &pii, sizeof(IO_COUNTERS));                    len = sizeof(IO_COUNTERS);                }                if (ProcessInformationLength > sizeof(IO_COUNTERS))                    ret = STATUS_INFO_LENGTH_MISMATCH;            }            else            {                len = sizeof(IO_COUNTERS);                ret = STATUS_INFO_LENGTH_MISMATCH;            }        }        break;    case ProcessVmCounters:        {            VM_COUNTERS pvmi;            /* older Windows versions don't have the PrivatePageCount field */            if (ProcessInformationLength >= FIELD_OFFSET(VM_COUNTERS,PrivatePageCount))            {                if (!ProcessInformation)                    ret = STATUS_ACCESS_VIOLATION;                else if (!ProcessHandle)                    ret = STATUS_INVALID_HANDLE;                else                {                    /* FIXME : real data */                    memset(&pvmi, 0 , sizeof(VM_COUNTERS));                    len = ProcessInformationLength;                    if (len != FIELD_OFFSET(VM_COUNTERS,PrivatePageCount)) len = sizeof(VM_COUNTERS);                    memcpy(ProcessInformation, &pvmi, min(ProcessInformationLength,sizeof(VM_COUNTERS)));                }                if (ProcessInformationLength != FIELD_OFFSET(VM_COUNTERS,PrivatePageCount) &&                    ProcessInformationLength != sizeof(VM_COUNTERS))                    ret = STATUS_INFO_LENGTH_MISMATCH;            }            else            {                len = sizeof(pvmi);                ret = STATUS_INFO_LENGTH_MISMATCH;            }        }        break;    case ProcessTimes:        {            KERNEL_USER_TIMES pti;            if (ProcessInformationLength >= sizeof(KERNEL_USER_TIMES))

NTSTATUSFatQueryFsAttributeInfo (    IN PIRP_CONTEXT IrpContext,    IN PVCB Vcb,    IN PFILE_FS_ATTRIBUTE_INFORMATION Buffer,    IN OUT PULONG Length    )/*++Routine Description:    This routine implements the query volume attribute callArguments:    Vcb - Supplies the Vcb being queried    Buffer - Supplies a pointer to the output buffer where the information        is to be returned    Length - Supplies the length of the buffer in byte.  This variable        upon return recieves the remaining bytes free in the bufferReturn Value:    Status - Returns the status for the query--*/{    ULONG BytesToCopy;    NTSTATUS Status;    DebugTrace(0, Dbg, "FatQueryFsAttributeInfo.../n", 0);    //    //  Determine how much of the file system name will fit.    //    if ( (*Length - FIELD_OFFSET( FILE_FS_ATTRIBUTE_INFORMATION,                                  FileSystemName[0] )) >= 6 ) {        BytesToCopy = 6;        *Length -= FIELD_OFFSET( FILE_FS_ATTRIBUTE_INFORMATION,                                 FileSystemName[0] ) + 6;        Status = STATUS_SUCCESS;    } else {        BytesToCopy = *Length - FIELD_OFFSET( FILE_FS_ATTRIBUTE_INFORMATION,                                              FileSystemName[0]);        *Length = 0;        Status = STATUS_BUFFER_OVERFLOW;    }    //    //  Set the output buffer    //    Buffer->FileSystemAttributes = FILE_CASE_PRESERVED_NAMES |                                   FILE_UNICODE_ON_DISK;#ifdef WE_WON_ON_APPEAL    if (FlagOn(Vcb->VcbState, VCB_STATE_FLAG_COMPRESSED_VOLUME)) {        SetFlag( Buffer->FileSystemAttributes, FILE_VOLUME_IS_COMPRESSED );    }#endif // WE_WON_ON_APPEAL    Buffer->MaximumComponentNameLength = FatData.ChicagoMode ? 255 : 12;    Buffer->FileSystemNameLength       = BytesToCopy;    RtlCopyMemory( &Buffer->FileSystemName[0], L"FAT", BytesToCopy );    //    //  And return success to our caller    //    UNREFERENCED_PARAMETER( IrpContext );    UNREFERENCED_PARAMETER( Vcb );    return Status;}

VALUE_SEARCH_RETURN_TYPECmpQueryKeyValueData(    PCM_KEY_CONTROL_BLOCK KeyControlBlock,    PPCM_CACHED_VALUE   ContainingList,    PCM_KEY_VALUE       ValueKey,    BOOLEAN             ValueCached,    KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,    PVOID               KeyValueInformation,    ULONG               Length,    PULONG              ResultLength,    NTSTATUS            *status    )/*++Routine Description:    Do the actual copy of data for a key value into caller's buffer.    If KeyValueInformation is not long enough to hold all requested data,    STATUS_BUFFER_OVERFLOW will be returned, and ResultLength will be    set to the number of bytes actually required.Arguments:    Hive - supplies a pointer to the hive control structure for the hive    Cell - supplies index of node to whose sub keys are to be found    KeyValueInformationClass - Specifies the type of information returned in        KeyValueInformation.  One of the following types:    KeyValueInformation -Supplies pointer to buffer to receive the data.    Length - Length of KeyInformation in bytes.    ResultLength - Number of bytes actually written into KeyInformation.Return Value:    NTSTATUS--*/{    PKEY_VALUE_INFORMATION pbuffer;    PCELL_DATA  pcell;    LONG        leftlength;    ULONG       requiredlength;    ULONG       minimumlength;    ULONG       offset;    ULONG       base;    ULONG       realsize;    PUCHAR      datapointer;    BOOLEAN     small;    USHORT      NameLength;    BOOLEAN     BufferAllocated = FALSE;    HCELL_INDEX CellToRelease = HCELL_NIL;    PHHIVE      Hive;    VALUE_SEARCH_RETURN_TYPE SearchValue = SearchSuccess;    Hive = KeyControlBlock->KeyHive;    pbuffer = (PKEY_VALUE_INFORMATION)KeyValueInformation;    pcell = (PCELL_DATA) ValueKey;    NameLength = CmpValueNameLen(&pcell->u.KeyValue);    switch (KeyValueInformationClass) {    case KeyValueBasicInformation:        //        // TitleIndex, Type, NameLength, Name        //        requiredlength = FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name) +                         NameLength;        minimumlength = FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name);        *ResultLength = requiredlength;        *status = STATUS_SUCCESS;        if (Length < minimumlength) {            *status = STATUS_BUFFER_TOO_SMALL;        } else {            pbuffer->KeyValueBasicInformation.TitleIndex = 0;            pbuffer->KeyValueBasicInformation.Type =                pcell->u.KeyValue.Type;            pbuffer->KeyValueBasicInformation.NameLength =                NameLength;            leftlength = Length - minimumlength;            requiredlength = NameLength;            if (leftlength < (LONG)requiredlength) {                requiredlength = leftlength;//.........这里部分代码省略.........

 static int seq_num_offset() {   return FIELD_OFFSET(RefNodeDesc, _seq_num); }

 static int ref_obj_offset() {   return FIELD_OFFSET(RefNodeDesc, _ref_obj); }

void CALLBACK kuhl_m_sekurlsa_enum_logon_callback_wdigest(IN PKIWI_BASIC_SECURITY_LOGON_SESSION_DATA pData){    KULL_M_MEMORY_HANDLE hLocalMemory = {KULL_M_MEMORY_TYPE_OWN, NULL};    KULL_M_MEMORY_ADDRESS aLocalMemory = {NULL, &hLocalMemory}, aLsassMemory = {NULL, pData->cLsass->hLsassMem};    SIZE_T taille;    if(kuhl_m_sekurlsa_wdigest_package.Module.isInit || kuhl_m_sekurlsa_utils_search_generic(pData->cLsass, &kuhl_m_sekurlsa_wdigest_package.Module, WDigestReferences, sizeof(WDigestReferences) / sizeof(KULL_M_PATCH_GENERIC), (PVOID *) &l_LogSessList, NULL, &offsetWDigestPrimary))    {        aLsassMemory.address = l_LogSessList;        taille = offsetWDigestPrimary + sizeof(KIWI_GENERIC_PRIMARY_CREDENTIAL);        if(aLsassMemory.address = kuhl_m_sekurlsa_utils_pFromLinkedListByLuid(&aLsassMemory, FIELD_OFFSET(KIWI_WDIGEST_LIST_ENTRY, LocallyUniqueIdentifier), pData->LogonId))        {            if(aLocalMemory.address = LocalAlloc(LPTR, taille))            {                if(kull_m_memory_copy(&aLocalMemory, &aLsassMemory, taille))                    kuhl_m_sekurlsa_genericCredsOutput((PKIWI_GENERIC_PRIMARY_CREDENTIAL) ((PBYTE) aLocalMemory.address + offsetWDigestPrimary), pData->LogonId, 0);                LocalFree(aLocalMemory.address);            }        }    } else kprintf(L"KO");}

NTSTATUSDiskDeviceControl(__in PDEVICE_OBJECT DeviceObject, __in PIRP Irp) {  PIO_STACK_LOCATION irpSp;  PDokanDCB dcb;  PDokanVCB vcb;  NTSTATUS status = STATUS_NOT_IMPLEMENTED;  ULONG outputLength = 0;  ULONG inputLength = 0;  DDbgPrint("   => DokanDiskDeviceControl/n");  irpSp = IoGetCurrentIrpStackLocation(Irp);  dcb = DeviceObject->DeviceExtension;  outputLength = irpSp->Parameters.DeviceIoControl.OutputBufferLength;  inputLength = irpSp->Parameters.DeviceIoControl.InputBufferLength;  if (GetIdentifierType(dcb) != DCB) {    PrintIdType(dcb);    DDbgPrint("   Device is not dcb so go out here/n");    return STATUS_INVALID_PARAMETER;  }  if (IsDeletePending(DeviceObject)) {    DDbgPrint("   Device object is pending for delete valid anymore/n");    return STATUS_DEVICE_REMOVED;  }  vcb = dcb->Vcb;  if (IsUnmountPendingVcb(vcb)) {    DDbgPrint("   Volume is unmounted so ignore dcb requests/n");    return STATUS_NO_SUCH_DEVICE;  }  DDbgPrint("   DiskDeviceControl Device name %wZ /n", dcb->DiskDeviceName);  switch (irpSp->Parameters.DeviceIoControl.IoControlCode) {  case IOCTL_DISK_GET_DRIVE_GEOMETRY: {    PDISK_GEOMETRY diskGeometry;    DDbgPrint("  IOCTL_DISK_GET_DRIVE_GEOMETRY/n");    if (outputLength < sizeof(DISK_GEOMETRY)) {      Irp->IoStatus.Information = 0;      status = STATUS_BUFFER_TOO_SMALL;      break;    }    diskGeometry = (PDISK_GEOMETRY)Irp->AssociatedIrp.SystemBuffer;    ASSERT(diskGeometry != NULL);    DokanPopulateDiskGeometry(diskGeometry);    Irp->IoStatus.Information = sizeof(DISK_GEOMETRY);    status = STATUS_SUCCESS;  } break;  case IOCTL_DISK_GET_LENGTH_INFO: {    PGET_LENGTH_INFORMATION getLengthInfo;    DDbgPrint("  IOCTL_DISK_GET_LENGTH_INFO/n");    if (outputLength < sizeof(GET_LENGTH_INFORMATION)) {      status = STATUS_BUFFER_TOO_SMALL;      Irp->IoStatus.Information = 0;      break;    }    getLengthInfo = (PGET_LENGTH_INFORMATION)Irp->AssociatedIrp.SystemBuffer;    ASSERT(getLengthInfo != NULL);    getLengthInfo->Length.QuadPart = 1024 * 1024 * 500;    status = STATUS_SUCCESS;    Irp->IoStatus.Information = sizeof(GET_LENGTH_INFORMATION);  } break;  case IOCTL_DISK_GET_DRIVE_LAYOUT:  case IOCTL_DISK_GET_DRIVE_LAYOUT_EX:  case IOCTL_DISK_GET_PARTITION_INFO:  case IOCTL_DISK_GET_PARTITION_INFO_EX: {    // Fake drive layout/partition information    VOID *outputBuffer = Irp->AssociatedIrp.SystemBuffer;    ULONG ioctl = irpSp->Parameters.DeviceIoControl.IoControlCode;    switch (ioctl) {    case IOCTL_DISK_GET_DRIVE_LAYOUT:      DDbgPrint("  IOCTL_DISK_GET_DRIVE_LAYOUT/n");      Irp->IoStatus.Information =          FIELD_OFFSET(DRIVE_LAYOUT_INFORMATION, PartitionEntry[1]);      break;    case IOCTL_DISK_GET_DRIVE_LAYOUT_EX:      DDbgPrint("  IOCTL_DISK_GET_DRIVE_LAYOUT_EX/n");      Irp->IoStatus.Information =          FIELD_OFFSET(DRIVE_LAYOUT_INFORMATION_EX, PartitionEntry[1]);      break;    case IOCTL_DISK_GET_PARTITION_INFO:      DDbgPrint("  IOCTL_DISK_GET_PARTITION_INFO/n");      Irp->IoStatus.Information = sizeof(PARTITION_INFORMATION);      break;    case IOCTL_DISK_GET_PARTITION_INFO_EX:      DDbgPrint("  IOCTL_DISK_GET_PARTITION_INFO_EX/n");      Irp->IoStatus.Information = sizeof(PARTITION_INFORMATION_EX);//.........这里部分代码省略.........

static_assert(sizeof(MW_CRITICAL_SECTION) == sizeof(CRITICAL_SECTION), "MW_CRITICAL_SECTION != CRITICAL_SECTION");static_assert(sizeof(MW_CONTEXT) == sizeof(CONTEXT), "MW_CONTEXT != CONTEXT");// Check defines and flagsstatic_assert(MW_INFINITE == INFINITE, "MW_INFINITE != INFINITE");static_assert(MW_WAIT_OBJECT_0 == WAIT_OBJECT_0, "MW_WAIT_OBJECT_0 != WAIT_OBJECT_0");static_assert(MW_CONTEXT_FULL == CONTEXT_FULL, "MW_CONTEXT_FULL != CONTEXT_FULL");static_assert(MW_MEM_COMMIT == MEM_COMMIT, "MW_MEM_COMMIT != MEM_COMMIT");static_assert(MW_PAGE_READWRITE == PAGE_READWRITE, "MW_PAGE_READWRITE != PAGE_READWRITE");static_assert(MW_PAGE_NOACCESS == PAGE_NOACCESS, "MW_PAGE_NOACCESS != PAGE_NOACCESS");static_assert(MW_MEM_RELEASE == MEM_RELEASE, "MW_MEM_RELEASE != MEM_RELEASE");static_assert(MW_FIBER_FLAG_FLOAT_SWITCH == FIBER_FLAG_FLOAT_SWITCH, "MW_FIBER_FLAG_FLOAT_SWITCH != FIBER_FLAG_FLOAT_SWITCH");// Check offsetsstatic_assert(MW_STACK_BASE_OFFSET == FIELD_OFFSET(NT_TIB, StackBase), "MW_STACK_BASE_OFFSET != FIELD_OFFSET(NT_TIB, StackBase)");static_assert(MW_STACK_STACK_LIMIT_OFFSET == FIELD_OFFSET(NT_TIB, StackLimit), "MW_STACK_STACK_LIMIT_OFFSET != FIELD_OFFSET(NT_TIB, StackLimit)");static_assert(FIELD_OFFSET(MW_SYSTEM_INFO, dwPageSize) == FIELD_OFFSET(SYSTEM_INFO, dwPageSize), "FIELD_OFFSET(MW_SYSTEM_INFO, dwPageSize) != FIELD_OFFSET(SYSTEM_INFO, dwPageSize)");static_assert(FIELD_OFFSET(MW_SYSTEM_INFO, dwNumberOfProcessors) == FIELD_OFFSET(SYSTEM_INFO, dwNumberOfProcessors), "FIELD_OFFSET(MW_SYSTEM_INFO, dwNumberOfProcessors) != FIELD_OFFSET(SYSTEM_INFO, dwNumberOfProcessors)");static_assert(FIELD_OFFSET(MW_CONTEXT, ContextFlags) == FIELD_OFFSET(CONTEXT, ContextFlags), "FIELD_OFFSET(MW_CONTEXT, ContextFlags) != FIELD_OFFSET(CONTEXT, ContextFlags)");#if MT_PTR64static_assert(FIELD_OFFSET(MW_CONTEXT, Rsp) == FIELD_OFFSET(CONTEXT, Rsp), "FIELD_OFFSET(MW_CONTEXT, Rsp) != FIELD_OFFSET(CONTEXT, Rsp)");static_assert(FIELD_OFFSET(MW_CONTEXT, Rip) == FIELD_OFFSET(CONTEXT, Rip), "FIELD_OFFSET(MW_CONTEXT, Rip) != FIELD_OFFSET(CONTEXT, Rip)");#elsestatic_assert(FIELD_OFFSET(MW_CONTEXT, Esp) == FIELD_OFFSET(CONTEXT, Esp), "FIELD_OFFSET(MW_CONTEXT, Esp) != FIELD_OFFSET(CONTEXT, Esp)");static_assert(FIELD_OFFSET(MW_CONTEXT, Eip) == FIELD_OFFSET(CONTEXT, Eip), "FIELD_OFFSET(MW_CONTEXT, Eip) != FIELD_OFFSET(CONTEXT, Eip)");

DWORDWINAPIDECLSPEC_HOTPATCHGetAdaptersAddresses(    _In_ ULONG Family,    _In_ ULONG Flags,    _In_ PVOID Reserved,    _Inout_ PIP_ADAPTER_ADDRESSES pAdapterAddresses,    _Inout_ PULONG pOutBufLen){    NTSTATUS Status;    HANDLE TcpFile;    TDIEntityID* InterfacesList;    ULONG InterfacesCount;    ULONG AdaptersCount = 0;    ULONG i;    ULONG TotalSize = 0, RemainingSize;    BYTE* Ptr = (BYTE*)pAdapterAddresses;    DWORD MIN_SIZE = 15 * 1024;    PIP_ADAPTER_ADDRESSES PreviousAA = NULL;    FIXME("GetAdaptersAddresses - Semi Stub: Family %u, Flags 0x%08x, Reserved %p, pAdapterAddress %p, pOutBufLen %p./n",        Family, Flags, Reserved, pAdapterAddresses, pOutBufLen);    if (!pOutBufLen)        return ERROR_INVALID_PARAMETER;    // FIXME: the exact needed size should be computed first, BEFORE doing any write to the output buffer.    // As suggested by MSDN, require a 15 KB buffer, which allows to React properly to length checks.    if(!Ptr || *pOutBufLen < MIN_SIZE)    {        *pOutBufLen = MIN_SIZE;        return ERROR_BUFFER_OVERFLOW;    }    switch(Family)    {        case AF_INET:            break;        case AF_INET6:            /* One day maybe... */            FIXME("IPv6 is not supported in ReactOS!/n");            /* We got nothing to say in this case */            return ERROR_NO_DATA;            break;        case AF_UNSPEC:            WARN("IPv6 addresses ignored, IPv4 only/n");            Family = AF_INET;            break;        default:            ERR("Invalid family 0x%x/n", Family);            return ERROR_INVALID_PARAMETER;            break;    }    RemainingSize = *pOutBufLen;    if (Ptr)        ZeroMemory(Ptr, RemainingSize);    /* open the tcpip driver */    Status = openTcpFile(&TcpFile, FILE_READ_DATA);    if (!NT_SUCCESS(Status))    {        ERR("Could not open handle to tcpip.sys. Status %08x/n", Status);        return RtlNtStatusToDosError(Status);    }    /* Get the interfaces list */    Status = GetInterfacesList(TcpFile, &InterfacesList, &InterfacesCount);    if (!NT_SUCCESS(Status))    {        ERR("Could not get adapters list. Status %08x/n", Status);        NtClose(TcpFile);        return RtlNtStatusToDosError(Status);    }    /* Let's see if we got any adapter. */    for (i = 0; i < InterfacesCount; i++)    {        PIP_ADAPTER_ADDRESSES CurrentAA = (PIP_ADAPTER_ADDRESSES)Ptr;        ULONG CurrentAASize = 0;        if (InterfacesList[i].tei_entity == IF_ENTITY)        {            BYTE EntryBuffer[FIELD_OFFSET(IFEntry, if_descr) +                             RTL_FIELD_SIZE(IFEntry, if_descr[0]) * (MAX_ADAPTER_DESCRIPTION_LENGTH + 1)];            IFEntry* Entry = (IFEntry*)EntryBuffer;            /* Remember we got one */            AdaptersCount++;            /* Set the pointer to this instance in the previous one*/            if(PreviousAA)                PreviousAA->Next = CurrentAA;            /* Of course we need some space for the base structure. */            CurrentAASize = sizeof(IP_ADAPTER_ADDRESSES);            /* Get the entry */            Status = GetInterfaceEntry(TcpFile, InterfacesList[i], Entry);//.........这里部分代码省略.........

/*********************************************************************** *           TASK_Create * * NOTE: This routine might be called by a Win32 thread. Thus, we need *       to be careful to protect global data structures. We do this *       by entering the Win16Lock while linking the task into the *       global task list. */static TDB *TASK_Create( NE_MODULE *pModule, UINT16 cmdShow, LPCSTR cmdline, BYTE len ){    HTASK16 hTask;    TDB *pTask;    FARPROC16 proc;    char curdir[MAX_PATH];    HMODULE16 hModule = pModule ? pModule->self : 0;      /* Allocate the task structure */    hTask = GlobalAlloc16( GMEM_FIXED | GMEM_ZEROINIT, sizeof(TDB) );    if (!hTask) return NULL;    pTask = TASK_GetPtr( hTask );    FarSetOwner16( hTask, hModule );    /* Fill the task structure */    pTask->hSelf = hTask;    pTask->version       = pModule ? pModule->ne_expver : 0x0400;    pTask->hModule       = hModule;    pTask->hParent       = GetCurrentTask();    pTask->magic         = TDB_MAGIC;    pTask->nCmdShow      = cmdShow;    GetCurrentDirectoryA( sizeof(curdir), curdir );    GetShortPathNameA( curdir, curdir, sizeof(curdir) );    pTask->curdrive = (curdir[0] - 'A') | 0x80;    lstrcpynA( pTask->curdir, curdir + 2, sizeof(pTask->curdir) );      /* Create the thunks block */    TASK_CreateThunks( hTask, (char *)pTask->thunks - (char *)pTask, 7 );      /* Copy the module name */    if (hModule)    {        char name[sizeof(pTask->module_name)+1];        size_t len;        GetModuleName16( hModule, name, sizeof(name) );        len = strlen(name) + 1;        memcpy(pTask->module_name, name, min(len,sizeof(pTask->module_name)));        pTask->compat_flags = GetProfileIntA( "Compatibility", name, 0 );    }      /* Allocate a selector for the PDB */    pTask->hPDB = GLOBAL_CreateBlock( GMEM_FIXED, &pTask->pdb, sizeof(PDB16),                                      hModule, WINE_LDT_FLAGS_DATA );      /* Fill the PDB */    pTask->pdb.int20 = 0x20cd;    pTask->pdb.dispatcher[0] = 0x9a;  /* ljmp */    proc = GetProcAddress16( GetModuleHandle16("KERNEL"), "DOS3Call" );    memcpy( &pTask->pdb.dispatcher[1], &proc, sizeof(proc) );    pTask->pdb.savedint22 = 0;    pTask->pdb.savedint23 = 0;    pTask->pdb.savedint24 = 0;    pTask->pdb.fileHandlesPtr =        MAKESEGPTR( GlobalHandleToSel16(pTask->hPDB), FIELD_OFFSET( PDB16, fileHandles ));    pTask->pdb.hFileHandles = 0;    memset( pTask->pdb.fileHandles, 0xff, sizeof(pTask->pdb.fileHandles) );    /* FIXME: should we make a copy of the environment? */    pTask->pdb.environment    = SELECTOROF(GetDOSEnvironment16());    pTask->pdb.nbFiles        = 20;    /* Fill the command line */    if (!cmdline)    {        cmdline = GetCommandLineA();        /* remove the first word (program name) */        if (*cmdline == '"')            if (!(cmdline = strchr( cmdline+1, '"' ))) cmdline = GetCommandLineA();        while (*cmdline && (*cmdline != ' ') && (*cmdline != '/t')) cmdline++;        while ((*cmdline == ' ') || (*cmdline == '/t')) cmdline++;        len = strlen(cmdline);    }    if (len >= sizeof(pTask->pdb.cmdLine)) len = sizeof(pTask->pdb.cmdLine)-1;    pTask->pdb.cmdLine[0] = len;    memcpy( pTask->pdb.cmdLine + 1, cmdline, len );    /* pTask->pdb.cmdLine[len+1] = 0; */    TRACE("cmdline='%.*s' task=%04x/n", len, cmdline, hTask );      /* Allocate a code segment alias for the TDB */    pTask->hCSAlias = GLOBAL_CreateBlock( GMEM_FIXED, pTask, sizeof(TDB),                                          pTask->hPDB, WINE_LDT_FLAGS_CODE );//.........这里部分代码省略.........

static inline xmlcf *impl_from_IClassFactory( IClassFactory *iface ){    return (xmlcf *)((char*)iface - FIELD_OFFSET(xmlcf, lpVtbl));}

 static int next_by_id_offset() {   return FIELD_OFFSET(RefNodeDesc, _next_by_id); }

NTSTATUSFatQueryFsVolumeInfo (    IN PIRP_CONTEXT IrpContext,    IN PVCB Vcb,    IN PFILE_FS_VOLUME_INFORMATION Buffer,    IN OUT PULONG Length    )/*++Routine Description:    This routine implements the query volume info callArguments:    Vcb - Supplies the Vcb being queried    Buffer - Supplies a pointer to the output buffer where the information        is to be returned    Length - Supplies the length of the buffer in byte.  This variable        upon return recieves the remaining bytes free in the bufferReturn Value:    NTSTATUS - Returns the status for the query--*/{    ULONG BytesToCopy;    NTSTATUS Status;    DebugTrace(0, Dbg, "FatQueryFsVolumeInfo.../n", 0);    //    //  Zero out the buffer, then extract and fill up the non zero fields.    //    RtlZeroMemory( Buffer, sizeof(FILE_FS_VOLUME_INFORMATION) );    Buffer->VolumeSerialNumber = Vcb->Vpb->SerialNumber;    Buffer->SupportsObjects = FALSE;    *Length -= FIELD_OFFSET(FILE_FS_VOLUME_INFORMATION, VolumeLabel[0]);    //    //  Check if the buffer we're given is long enough    //    if ( *Length >= (ULONG)Vcb->Vpb->VolumeLabelLength ) {        BytesToCopy = Vcb->Vpb->VolumeLabelLength;        Status = STATUS_SUCCESS;    } else {        BytesToCopy = *Length;        Status = STATUS_BUFFER_OVERFLOW;    }    //    //  Copy over what we can of the volume label, and adjust *Length    //    Buffer->VolumeLabelLength = Vcb->Vpb->VolumeLabelLength;    RtlCopyMemory( &Buffer->VolumeLabel[0],                   &Vcb->Vpb->VolumeLabel[0],                   BytesToCopy );    *Length -= BytesToCopy;    //    //  Set our status and return to our caller    //    UNREFERENCED_PARAMETER( IrpContext );    return Status;}

 { NULL,DIJOFS_BUTTON(113),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(114),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(115),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(116),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(117),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(118),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(119),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(120),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(121),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(122),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(123),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(124),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(125),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(126),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { NULL,DIJOFS_BUTTON(127),DIDFT_OPTIONAL|DIDFT_BUTTON|DIDFT_ANYINSTANCE,0}, { &GUID_XAxis,FIELD_OFFSET(DIJOYSTATE2,lVX),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_YAxis,FIELD_OFFSET(DIJOYSTATE2,lVY),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_ZAxis,FIELD_OFFSET(DIJOYSTATE2,lVZ),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_RxAxis,FIELD_OFFSET(DIJOYSTATE2,lVRx),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_RyAxis,FIELD_OFFSET(DIJOYSTATE2,lVRy),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_RzAxis,FIELD_OFFSET(DIJOYSTATE2,lVRz),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_Slider,FIELD_OFFSET(DIJOYSTATE2,rglVSlider[0]),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_Slider,FIELD_OFFSET(DIJOYSTATE2,rglVSlider[1]),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_XAxis,FIELD_OFFSET(DIJOYSTATE2,lAX),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_YAxis,FIELD_OFFSET(DIJOYSTATE2,lAY),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_ZAxis,FIELD_OFFSET(DIJOYSTATE2,lAZ),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_RxAxis,FIELD_OFFSET(DIJOYSTATE2,lARx),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_RyAxis,FIELD_OFFSET(DIJOYSTATE2,lARy),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_RzAxis,FIELD_OFFSET(DIJOYSTATE2,lARz),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_Slider,FIELD_OFFSET(DIJOYSTATE2,rglASlider[0]),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0}, { &GUID_Slider,FIELD_OFFSET(DIJOYSTATE2,rglASlider[1]),DIDFT_OPTIONAL|DIDFT_AXIS|DIDFT_ANYINSTANCE,0},

NTSTATUSCmpQueryKeyData(    PHHIVE                  Hive,    PCM_KEY_NODE            Node,    KEY_INFORMATION_CLASS   KeyInformationClass,    PVOID                   KeyInformation,    ULONG                   Length,    PULONG                  ResultLength    )/*++Routine Description:    Do the actual copy of data for a key into caller's buffer.    If KeyInformation is not long enough to hold all requested data,    STATUS_BUFFER_OVERFLOW will be returned, and ResultLength will be    set to the number of bytes actually required.Arguments:    Hive - supplies a pointer to the hive control structure for the hive    Node - Supplies pointer to node whose subkeys are to be found    KeyInformationClass - Specifies the type of information returned in        Buffer.  One of the following types:        KeyBasicInformation - return last write time, title index, and name.            (see KEY_BASIC_INFORMATION structure)        KeyNodeInformation - return last write time, title index, name, class.            (see KEY_NODE_INFORMATION structure)    KeyInformation -Supplies pointer to buffer to receive the data.    Length - Length of KeyInformation in bytes.    ResultLength - Number of bytes actually written into KeyInformation.Return Value:    NTSTATUS--*/{    NTSTATUS            status;    PCELL_DATA          pclass;    ULONG               requiredlength;    LONG                leftlength;    ULONG               offset;    ULONG               minimumlength;    PKEY_INFORMATION    pbuffer;    USHORT              NameLength;    pbuffer = (PKEY_INFORMATION)KeyInformation;    NameLength = CmpHKeyNameLen(Node);    switch (KeyInformationClass) {    case KeyBasicInformation:        //        // LastWriteTime, TitleIndex, NameLength, Name        //        requiredlength = FIELD_OFFSET(KEY_BASIC_INFORMATION, Name) +                         NameLength;        minimumlength = FIELD_OFFSET(KEY_BASIC_INFORMATION, Name);        *ResultLength = requiredlength;        status = STATUS_SUCCESS;        if (Length < minimumlength) {            status = STATUS_BUFFER_TOO_SMALL;        } else {            pbuffer->KeyBasicInformation.LastWriteTime =                Node->LastWriteTime;            pbuffer->KeyBasicInformation.TitleIndex = 0;            pbuffer->KeyBasicInformation.NameLength =                NameLength;            leftlength = Length - minimumlength;            requiredlength = NameLength;            if (leftlength < (LONG)requiredlength) {                requiredlength = leftlength;                status = STATUS_BUFFER_OVERFLOW;            }            if (Node->Flags & KEY_COMP_NAME) {                CmpCopyCompressedName(pbuffer->KeyBasicInformation.Name,//.........这里部分代码省略.........

//.........这里部分代码省略.........            {                REPARSE_GUID_DATA_BUFFER *pReparseBuffer = (REPARSE_GUID_DATA_BUFFER *)Irp->AssociatedIrp.SystemBuffer;                REPARSE_DATA_BUFFER *pMSFTReparseBuffer = (REPARSE_DATA_BUFFER *)Irp->AssociatedIrp.SystemBuffer;                ULONG ulRemainingLen = ulOutputBufferLen;                AFSReparseTagInfo *pReparseInfo = NULL;                BOOLEAN bRelative = FALSE;                BOOLEAN bDriveLetter = FALSE;                WCHAR * PathBuffer = NULL;                AFSDbgTrace(( AFS_SUBSYSTEM_FILE_PROCESSING,                              AFS_TRACE_LEVEL_VERBOSE_2,                              "AFSProcessUserFsRequest Processing FSCTL_GET_REPARSE_POINT request %wZ Type 0x%x Attrib 0x%x/n",                              &pCcb->DirectoryCB->NameInformation.FileName,                              pFcb->ObjectInformation->FileType,                              pFcb->ObjectInformation->FileAttributes));                //                // Check if we have the reparse entry set on the entry                //                if( !BooleanFlagOn( pFcb->ObjectInformation->FileAttributes, FILE_ATTRIBUTE_REPARSE_POINT))                {                    ntStatus = STATUS_NOT_A_REPARSE_POINT;                    break;                }                switch ( pFcb->ObjectInformation->FileType) {                case AFS_FILE_TYPE_MOUNTPOINT:                    if( ulOutputBufferLen < FIELD_OFFSET( REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer.DataBuffer))                    {                        ntStatus = STATUS_BUFFER_TOO_SMALL;                        Irp->IoStatus.Information = FIELD_OFFSET( REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer.DataBuffer);                        break;                    }                    ulRemainingLen -= FIELD_OFFSET( REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer.DataBuffer);                    break;                default:                    if( ulOutputBufferLen < FIELD_OFFSET( REPARSE_DATA_BUFFER, GenericReparseBuffer.DataBuffer))                    {                        ntStatus = STATUS_BUFFER_TOO_SMALL;                        Irp->IoStatus.Information = FIELD_OFFSET( REPARSE_DATA_BUFFER, GenericReparseBuffer.DataBuffer);                        break;                    }                    ulRemainingLen -= FIELD_OFFSET( REPARSE_DATA_BUFFER, GenericReparseBuffer.DataBuffer);                    break;                }                //                // Populate the data in the reparse buffer

//// Copy//// return a pointer to an identical copy of pSampleIMediaSample * CTransInPlaceFilter::Copy(IMediaSample *pSource){    IMediaSample * pDest;    HRESULT hr;    REFERENCE_TIME tStart, tStop;    const BOOL bTime = S_OK == pSource->GetTime( &tStart, &tStop);    // this may block for an indeterminate amount of time    hr = OutputPin()->PeekAllocator()->GetBuffer(              &pDest              , bTime ? &tStart : NULL              , bTime ? &tStop : NULL              , m_bSampleSkipped ? AM_GBF_PREVFRAMESKIPPED : 0              );    if (FAILED(hr)) {        return NULL;    }    ASSERT(pDest);    IMediaSample2 *pSample2;    if (SUCCEEDED(pDest->QueryInterface(IID_IMediaSample2, (void **)&pSample2))) {        HRESULT hr = pSample2->SetProperties(            FIELD_OFFSET(AM_SAMPLE2_PROPERTIES, pbBuffer),            (PBYTE)m_pInput->SampleProps());        pSample2->Release();        if (FAILED(hr)) {            pDest->Release();            return NULL;        }    } else {        if (bTime) {            pDest->SetTime(&tStart, &tStop);        }        if (S_OK == pSource->IsSyncPoint()) {            pDest->SetSyncPoint(TRUE);        }        if (S_OK == pSource->IsDiscontinuity() || m_bSampleSkipped) {            pDest->SetDiscontinuity(TRUE);        }        if (S_OK == pSource->IsPreroll()) {            pDest->SetPreroll(TRUE);        }        // Copy the media type        AM_MEDIA_TYPE *pMediaType;        if (S_OK == pSource->GetMediaType(&pMediaType)) {            pDest->SetMediaType(pMediaType);            DeleteMediaType( pMediaType );        }    }    m_bSampleSkipped = FALSE;    // Copy the sample media times    REFERENCE_TIME TimeStart, TimeEnd;    if (pSource->GetMediaTime(&TimeStart,&TimeEnd) == NOERROR) {        pDest->SetMediaTime(&TimeStart,&TimeEnd);    }    // Copy the actual data length and the actual data.    {        const long lDataLength = pSource->GetActualDataLength();        pDest->SetActualDataLength(lDataLength);        // Copy the sample data        {            BYTE *pSourceBuffer, *pDestBuffer;            long lSourceSize  = pSource->GetSize();            long lDestSize = pDest->GetSize();            ASSERT(lDestSize >= lSourceSize && lDestSize >= lDataLength);            pSource->GetPointer(&pSourceBuffer);            pDest->GetPointer(&pDestBuffer);            ASSERT(lDestSize == 0 || pSourceBuffer != NULL && pDestBuffer != NULL);            CopyMemory( (PVOID) pDestBuffer, (PVOID) pSourceBuffer, lDataLength );        }    }    return pDest;} // Copy

VOID StaReceiveBeacon(    _In_  PMP_EXTSTA_PORT                        pStation,    _In_  PMP_RX_MPDU                    pFragment,    _In_  ULONG                           TotalLength    ){    NDIS_STATUS         ndisStatus = NDIS_STATUS_SUCCESS;    PUCHAR              pPacketBuffer;    PDOT11_BEACON_FRAME pDot11BeaconFrame;    ULONG               uOffsetOfInfoElemBlob =                            FIELD_OFFSET(DOT11_BEACON_FRAME, InfoElements) + sizeof(DOT11_MGMT_HEADER);    ULONG               uInfoElemBlobSize = 0;    pPacketBuffer = MP_RX_MPDU_DATA(pFragment);    do    {        //         // Drop if its doesnt contain atleast the        // fixed size portion (DOT11_BEACON_FRAME)        //        if (uOffsetOfInfoElemBlob > TotalLength)        {            break;        }        pDot11BeaconFrame = (PDOT11_BEACON_FRAME)(pPacketBuffer + sizeof(DOT11_MGMT_HEADER));                // Validate information elements blob        ndisStatus = Dot11GetInfoBlobSize(            pPacketBuffer,            TotalLength,            uOffsetOfInfoElemBlob,            &uInfoElemBlobSize            );        if (ndisStatus != NDIS_STATUS_SUCCESS)        {            break;        }        if (pDot11BeaconFrame->Capability.IBSS) {            ndisStatus = StaSaveAdHocStaInfo(                pStation,                pFragment,                pDot11BeaconFrame,                uInfoElemBlobSize                );        }                    ndisStatus = StaProcessBeaconForConfigInfo(            pStation,            pFragment,            (PUCHAR)&pDot11BeaconFrame->InfoElements,            TotalLength            );        if (ndisStatus != NDIS_STATUS_SUCCESS)        {            break;        }    } while (FALSE);}

/********************************************************************** *          EMFDRV_PolyPolylinegon * * Helper for EMFDRV_PolyPoly{line|gon} */static BOOLEMFDRV_PolyPolylinegon( PHYSDEV dev, const POINT* pt, const INT* counts, UINT polys,			DWORD iType){    EMRPOLYPOLYLINE *emr;    DWORD cptl = 0, poly, size, i;    INT point;    const RECTL empty = {0, 0, -1, -1};    RECTL bounds = empty;    const POINT *pts;    BOOL ret, use_small_emr = TRUE, bounds_valid = TRUE;    pts = pt;    for(poly = 0; poly < polys; poly++) {        cptl += counts[poly];        if(counts[poly] < 2) bounds_valid = FALSE;	for(point = 0; point < counts[poly]; point++) {            /* check whether all points fit in the SHORT int POINT structure */            if( ((pts->x+0x8000) & ~0xffff ) ||                ((pts->y+0x8000) & ~0xffff ) )                use_small_emr = FALSE;            if(pts == pt) {                bounds.left = bounds.right = pts->x;                bounds.top = bounds.bottom = pts->y;            } else {                if(bounds.left > pts->x) bounds.left = pts->x;                else if(bounds.right < pts->x) bounds.right = pts->x;                if(bounds.top > pts->y) bounds.top = pts->y;                else if(bounds.bottom < pts->y) bounds.bottom = pts->y;            }	    pts++;	}    }    if(!cptl) bounds_valid = FALSE;    size = FIELD_OFFSET(EMRPOLYPOLYLINE, aPolyCounts[polys]);    if(use_small_emr)        size += cptl * sizeof(POINTS);    else        size += cptl * sizeof(POINTL);    emr = HeapAlloc( GetProcessHeap(), 0, size );    emr->emr.iType = iType;    if(use_small_emr) emr->emr.iType += EMR_POLYPOLYLINE16 - EMR_POLYPOLYLINE;    emr->emr.nSize = size;    if(bounds_valid)        emr->rclBounds = bounds;    else        emr->rclBounds = empty;    emr->nPolys = polys;    emr->cptl = cptl;    if(polys)    {        memcpy( emr->aPolyCounts, counts, polys * sizeof(DWORD) );        if(cptl)        {            if(use_small_emr)            {                POINTS *out_pts = (POINTS *)(emr->aPolyCounts + polys);                for(i = 0; i < cptl; i++ )                {                    out_pts[i].x = pt[i].x;                    out_pts[i].y = pt[i].y;                }            }            else                memcpy( emr->aPolyCounts + polys, pt, cptl * sizeof(POINTL) );        }    }    ret = EMFDRV_WriteRecord( dev, &emr->emr );    if(ret && !bounds_valid)    {        ret = FALSE;        SetLastError( ERROR_INVALID_PARAMETER );    }    if(ret)        EMFDRV_UpdateBBox( dev, &emr->rclBounds );    HeapFree( GetProcessHeap(), 0, emr );    return ret;}

VOID NTAPI DotNetEventCallback(    _In_ PEVENT_RECORD EventRecord    ){    PASMPAGE_CONTEXT context = EventRecord->UserContext;    PEVENT_HEADER eventHeader = &EventRecord->EventHeader;    PEVENT_DESCRIPTOR eventDescriptor = &eventHeader->EventDescriptor;    if (UlongToHandle(eventHeader->ProcessId) == context->ProcessItem->ProcessId)    {        // .NET 4.0+        switch (eventDescriptor->Id)        {        case RuntimeInformationDCStart:            {                PRuntimeInformationRundown data = EventRecord->UserData;                PDNA_NODE node;                PPH_STRING startupFlagsString;                PPH_STRING startupModeString;                // Check for duplicates.                if (FindClrNode(context, data->ClrInstanceID))                    break;                node = AddNode(context);                node->Type = DNA_TYPE_CLR;                node->u.Clr.ClrInstanceID = data->ClrInstanceID;                node->u.Clr.DisplayName = PhFormatString(L"CLR v%u.%u.%u.%u", data->VMMajorVersion, data->VMMinorVersion, data->VMBuildNumber, data->VMQfeNumber);                node->StructureText = node->u.Clr.DisplayName->sr;                node->IdText = PhFormatString(L"%u", data->ClrInstanceID);                startupFlagsString = FlagsToString(data->StartupFlags, StartupFlagsMap, sizeof(StartupFlagsMap));                startupModeString = FlagsToString(data->StartupMode, StartupModeMap, sizeof(StartupModeMap));                if (startupFlagsString->Length != 0 && startupModeString->Length != 0)                {                    node->FlagsText = PhConcatStrings(3, startupFlagsString->Buffer, L", ", startupModeString->Buffer);                    PhDereferenceObject(startupFlagsString);                    PhDereferenceObject(startupModeString);                }                else if (startupFlagsString->Length != 0)                {                    node->FlagsText = startupFlagsString;                    PhDereferenceObject(startupModeString);                }                else if (startupModeString->Length != 0)                {                    node->FlagsText = startupModeString;                    PhDereferenceObject(startupFlagsString);                }                if (data->CommandLine[0])                    node->PathText = PhCreateString(data->CommandLine);                PhAddItemList(context->NodeRootList, node);            }            break;        case AppDomainDCStart_V1:            {                PAppDomainLoadUnloadRundown_V1 data = EventRecord->UserData;                SIZE_T appDomainNameLength;                USHORT clrInstanceID;                PDNA_NODE parentNode;                PDNA_NODE node;                appDomainNameLength = PhCountStringZ(data->AppDomainName) * sizeof(WCHAR);                clrInstanceID = *(PUSHORT)((PCHAR)data + FIELD_OFFSET(AppDomainLoadUnloadRundown_V1, AppDomainName) + appDomainNameLength + sizeof(WCHAR) + sizeof(ULONG));                // Find the CLR node to add the AppDomain node to.                parentNode = FindClrNode(context, clrInstanceID);                if (parentNode)                {                    // Check for duplicates.                    if (FindAppDomainNode(parentNode, data->AppDomainID))                        break;                    node = AddNode(context);                    node->Type = DNA_TYPE_APPDOMAIN;                    node->u.AppDomain.AppDomainID = data->AppDomainID;                    node->u.AppDomain.DisplayName = PhConcatStrings2(L"AppDomain: ", data->AppDomainName);                    node->StructureText = node->u.AppDomain.DisplayName->sr;                    node->IdText = PhFormatString(L"%I64u", data->AppDomainID);                    node->FlagsText = FlagsToString(data->AppDomainFlags, AppDomainFlagsMap, sizeof(AppDomainFlagsMap));                    PhAddItemList(parentNode->Children, node);                }            }            break;        case AssemblyDCStart_V1:            {                PAssemblyLoadUnloadRundown_V1 data = EventRecord->UserData;                SIZE_T fullyQualifiedAssemblyNameLength;                USHORT clrInstanceID;                PDNA_NODE parentNode;                PDNA_NODE node;                PH_STRINGREF remainingPart;                fullyQualifiedAssemblyNameLength = PhCountStringZ(data->FullyQualifiedAssemblyName) * sizeof(WCHAR);//.........这里部分代码省略.........

//.........这里部分代码省略.........    ZwSetValueKey (handle,                   &unicodeString,                   0L,                   REG_SZ,                   L"PCI",                   sizeof (L"PCI")                   );    RtlInitUnicodeString (&unicodeString, rgzConfigurationData);    Descriptor = (PCM_FULL_RESOURCE_DESCRIPTOR) buffer;    Descriptor->InterfaceType = PCIBus;    Descriptor->BusNumber = CB.BusNo;    Descriptor->PartialResourceList.Version = 0;    Descriptor->PartialResourceList.Revision = 0;    Descriptor->PartialResourceList.Count = 0;    ZwSetValueKey (handle,                   &unicodeString,                   0L,                   REG_FULL_RESOURCE_DESCRIPTOR,                   Descriptor,                   sizeof (*Descriptor)                   );    RtlInitUnicodeString (&unicodeString, L"Component Information");    Component = (PCONFIGURATION_COMPONENT) buffer;    RtlZeroMemory (Component, sizeof (*Component));    Component->AffinityMask = 0xffffffff;    ZwSetValueKey (handle,                   &unicodeString,                   0L,                   REG_BINARY,                   Component,                   FIELD_OFFSET (CONFIGURATION_COMPONENT, ConfigurationDataLength)                   );    ZwClose (handle);    //    // Since the BIOS didn't configure this bridge we'll assume that    // the PCI interrupts are bridged.  (for BIOS configured buses we    // assume that the BIOS put the ISA bus IRQ in the InterruptLine value)    //    CB.BusData->Pin2Line = (PciPin2Line) HalpPCIBridgedPin2Line;    CB.BusData->Line2Pin = (PciLine2Pin) HalpPCIBridgedLine2Pin;    //CB.BusData->GetIrqTable = (PciIrqTable) HalpGetBridgedPCIIrqTable;    if (Current->BusHandler->GetInterruptVector == HalpGetPCIIntOnISABus) {        //        // The parent bus'es interrupt pin to vector mappings is not        // a static function, and is determined by the boot firmware.        //        //CB.BusHandler->GetInterruptVector = (PGETINTERRUPTVECTOR) HalpGetBridgedPCIISAInt;        // read each device on parent bus        for (d = 0; d < PCI_MAX_DEVICES; d++) {            CB.SlotNumber.u.bits.DeviceNumber = d;            for (f = 0; f < PCI_MAX_FUNCTION; f++) {                CB.SlotNumber.u.bits.FunctionNumber = f;                HalpReadPCIConfig (

static inline IAutoCompleteImpl *impl_from_IAutoComplete2( IAutoComplete2 *iface ){    return (IAutoCompleteImpl *)((char*)iface - FIELD_OFFSET(IAutoCompleteImpl, lpvtblAutoComplete2));}

void CALLBACK kuhl_m_sekurlsa_enum_logon_callback_livessp(IN PKUHL_M_SEKURLSA_CONTEXT cLsass, IN PLUID logId, IN PVOID pCredentials, IN OPTIONAL PKUHL_M_SEKURLSA_EXTERNAL externalCallback, IN OPTIONAL LPVOID externalCallbackData){	KIWI_LIVESSP_LIST_ENTRY credentials;	KIWI_LIVESSP_PRIMARY_CREDENTIAL primaryCredential;	KULL_M_MEMORY_HANDLE hLocalMemory = {KULL_M_MEMORY_TYPE_OWN, NULL};	KULL_M_MEMORY_ADDRESS aLocalMemory = {&credentials, &hLocalMemory}, aLsassMemory = {NULL, cLsass->hLsassMem};		if(kuhl_m_sekurlsa_livessp_package.Module.isInit || kuhl_m_sekurlsa_utils_search_generic(cLsass, &kuhl_m_sekurlsa_livessp_package.Module, LiveReferences, sizeof(LiveReferences) / sizeof(KULL_M_PATCH_GENERIC), (PVOID *) &LiveGlobalLogonSessionList, NULL, NULL))	{		aLsassMemory.address = LiveGlobalLogonSessionList;		if(aLsassMemory.address = kuhl_m_sekurlsa_utils_pFromLinkedListByLuid(&aLsassMemory, FIELD_OFFSET(KIWI_LIVESSP_LIST_ENTRY, LocallyUniqueIdentifier), logId))		{			if(kull_m_memory_copy(&aLocalMemory, &aLsassMemory, sizeof(KIWI_LIVESSP_LIST_ENTRY)))			{				if(aLsassMemory.address = credentials.suppCreds)				{					aLocalMemory.address = &primaryCredential;					if(kull_m_memory_copy(&aLocalMemory, &aLsassMemory, sizeof(KIWI_LIVESSP_PRIMARY_CREDENTIAL)))						kuhl_m_sekurlsa_genericCredsOutput(&primaryCredential.credentials, logId, (cLsass->osContext.BuildNumber != 9431) ? 0 : KUHL_SEKURLSA_CREDS_DISPLAY_NODECRYPT, externalCallback, externalCallbackData);				}			}		}	} else kprintf(L"KO");}

static inline FTMarshalImpl *impl_from_IMarshal( IMarshal *iface ){    return (FTMarshalImpl *)((char*)iface - FIELD_OFFSET(FTMarshalImpl, lpvtblFTM));}