| .版本 2复制代码.版本 2
.局部变量 unicode1_STRING, 长整数型
.局部变量 unicode2_STRING, 长整数型
.局部变量 unicode3_STRING, 长整数型
.局部变量 ansi
.局部变量 ansi_STRING, 长整数型
.局部变量 ret
.局部变量 unicode
.局部变量 a
.局部变量 b
.局部变量 c
ansi = Asm_GetDataH (“Administrator”)
Asm_writeWord_1 (ansi_STRING, Asm_len (ansi))
Asm_writeWord__1 (ansi_STRING, 2, Asm_len (ansi) + 1)
Asm_writeDword__1 (ansi_STRING, 4, ansi)
' 调试输出 (到字节集 (“我”))
' 调试输出 (到字节集 (Nt_Trans_RtlAnsiCharToUnicodeChar (Asm_GetH (Asm_GetH (取字节集数据 (到字节集 (“我”), #短整数型, ))))))  ' ansi双字节转Unicode
ret = Nt_Trans_RtlAnsiStringToUnicodeSize (Asm_GetH (ansi_STRING))  ' ansi转unicode长度
' 调试输出 (ret)
Nt_Trans_RtlAnsiStringToUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (ansi_STRING), 真)  ' 真 由函数在默认堆栈申请内存转换
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING))  ' 释放掉内存 自己也可以释放 Nt_Heap_RtlFreeHeap 默认堆栈传地址就行了
unicode = Nt_Heap_RtlAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), ret)
Asm_writeWord_1 (unicode1_STRING, 0)
Asm_writeWord__1 (unicode1_STRING, 2, ret)
Asm_writeDword__1 (unicode1_STRING, 4, unicode)
Nt_Trans_RtlAnsiStringToUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (ansi_STRING), 假)  ' 假 自己可控指针位置
' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
ansi = Asm_GetDataH (“|我的Administrator”)
Asm_writeWord_1 (ansi_STRING, Asm_len (ansi))
Asm_writeWord__1 (ansi_STRING, 2, Asm_len (ansi) + 1)
Asm_writeDword__1 (ansi_STRING, 4, ansi)
unicode = Nt_Heap_RtlReAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), unicode, Asm_add (Nt_Heap_RtlSizeHeap (g_heap, 0, unicode), Nt_Trans_RtlAnsiStringToUnicodeSize (Asm_GetH (ansi_STRING)) - 2))
Asm_writeWord__1 (unicode1_STRING, 2, Nt_Heap_RtlSizeHeap (g_heap, 0, unicode))
Asm_writeDword__1 (unicode1_STRING, 4, unicode)
Nt_Trans_RtlAnsiStringToUnicodeString (Asm_GetH (unicode2_STRING), Asm_GetH (ansi_STRING), 真)  ' 真 由函数在默认堆栈申请内存转换
Nt_Trans_RtlAppendUnicodeToString (Asm_GetH (unicode1_STRING), Asm_readDword__1 (unicode2_STRING, 4))
' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
unicode = Nt_Heap_RtlReAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), unicode, Asm_add (Nt_Heap_RtlSizeHeap (g_heap, 0, unicode), Nt_Trans_RtlAnsiStringToUnicodeSize (Asm_GetH (ansi_STRING)) - 2))
Asm_writeWord__1 (unicode1_STRING, 2, Nt_Heap_RtlSizeHeap (g_heap, 0, unicode))
Asm_writeDword__1 (unicode1_STRING, 4, unicode)
Nt_Trans_RtlAppendUnicodeToString (Asm_GetH (unicode1_STRING), Asm_readDword__1 (unicode2_STRING, 4))
' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
' 输出调试文本 (Asm_readWord__1 (unicode1_STRING, 0))
' 输出调试文本 (Asm_readWord__1 (unicode2_STRING, 0))
' 输出调试文本 (Nt_Trans_RtlCompareUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
' 输出调试文本 (Nt_Trans_RtlEqualUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
Nt_Trans_RtlCopyUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING))  ' 复制
' 输出调试文本 (Nt_Trans_RtlEqualUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
' 输出调试文本 (Nt_Trans_RtlCompareUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), 假))
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING))  ' 释放掉内存
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode2_STRING))  ' 释放掉内存
' -------------------------------------------------------------
Nt_Trans_RtlCreateUnicodeString (Asm_GetH (unicode1_STRING), Asm_GetBinH ({ 97, 0, 98, 0, 99, 0, 0, 0 }))
' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING))  ' 释放掉内存
Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“ABC”))
' MessageBoxW (0, Asm_readDword__1 (unicode1_STRING, 4), 0, 0)
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING))  ' 释放掉内存
' 调试输出 (到字节集 (“A”))
' 输出调试文本 (字符 (Nt_Trans_RtlDowncaseUnicodeChar (65))) '单字符转换
Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“ABC”))
Nt_Trans_RtlDowncaseUnicodeString (Asm_GetH (unicode2_STRING), Asm_GetH (unicode1_STRING), 真)
Asm_writeDword__1 (unicode2_STRING, 4, Nt_Heap_RtlReAllocateHeap (g_heap, 位或 (#HEAP_ZERO_MEMORY, #HEAP_GENERATE_EXCEPTIONS), Asm_readDword__1 (unicode2_STRING, 4), Asm_add (Nt_Heap_RtlSizeHeap (g_heap, 0, Asm_readDword__1 (unicode2_STRING, 4)), 2)))
Asm_writeWord__1 (unicode2_STRING, 2, Nt_Heap_RtlSizeHeap (g_heap, 0, Asm_readDword__1 (unicode2_STRING, 4)))
' MessageBoxW (0, Asm_readDword__1 (unicode2_STRING, 4), 0, 0)
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode2_STRING))  ' 释放掉内存
' Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“ABC”))
' 输出调试文本 (Nt_Trans_RtlEraseUnicodeString (Asm_GetH (unicode1_STRING)))
' 调试输出 (到字节集 (unicode1_STRING))
Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“abcd”))
Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode2_STRING), Asm_GetDataH (“d”))
Nt_Trans_RtlFindCharInUnicodeString (0, Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), Asm_GetH (ret))
' 输出调试文本 (ret)
Nt_Trans_RtlFindUnicodeSubstring (Asm_GetH (unicode1_STRING), Asm_GetH (unicode2_STRING), Asm_GetH (ret))
' 输出调试文本 (ret)
' 输出调试文本 (Nt_Trans_RtlHashUnicodeString (Asm_GetH (unicode1_STRING), 假, 0, Asm_GetH (ret)))
' 调试输出 (到字节集 (ret))
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode1_STRING))  ' 释放掉内存
Nt_Trans_RtlFreeUnicodeString (Asm_GetH (unicode2_STRING))  ' 释放掉内存
Nt_Trans_RtlCreateUnicodeStringFromAsciiz (Asm_GetH (unicode1_STRING), Asm_GetDataH (“www.我爱你.com”))
a = Nt_Heap_RtlAllocateHeap (g_heap, 12, 255)
ret = 255
Nt_Trans_RtlIdnToAscii (1, Asm_readDword__1 (unicode1_STRING, 4), -1, a, Asm_GetH (ret))
' 调试输出 (指针到字节集 (a, ret × 2))
b = Nt_Heap_RtlAllocateHeap (g_heap, 12, 255)
c = ret
ret = 255
Nt_Trans_RtlIdnToUnicode (1, a, c, b, Asm_GetH (ret))
' 调试输出 (指针到字节集 (b, ret × 2))
Nt_RtlZeroMemory (a, 255)
ret = 255
Nt_Trans_RtlIdnToNameprepUnicode (1, b, -1, a, Asm_GetH (ret))
' 调试输出 (指针到字节集 (a, ret × 2))
Nt_Heap_RtlFreeHeap (g_heap, 0, b)
Nt_Trans_RtlMultiByteToUnicodeSize (Asm_GetH (ret), Asm_GetDataH (“123你好”), Asm_len (Asm_GetDataH (“123你好”)))
' 输出调试文本 (ret)
 ' RtlAnsiCharToUnicodeChar
 ' RtlAnsiStringToUnicodeSize
 ' RtlAnsiStringToUnicodeString
 ' RtlAppendAsciizToString
 ' RtlAppendStringToString
 ' RtlAppendUnicodeStringToString
 ' RtlAppendUnicodeToString
 ' RtlCharToInteger
 ' RtlCompareString
 ' RtlCompareUnicodeString
 ' RtlCompareUnicodeStrings
 ' RtlConsoleMultiByteToUnicodeN'放弃
 ' RtlConvertDeviceFamilyInfoToString'放弃
 ' RtlConvertLCIDToString'放弃
 ' RtlConvertSidToUnicodeString'放弃
 ' RtlCopyString
 ' RtlCopyUnicodeString
 ' RtlCreateUnicodeString
 ' RtlCreateUnicodeStringFromAsciiz
 ' RtlCustomCPToUnicodeN'该RtlCustomCPToUnicodeN程序保留给系统使用。请参见RtlMultiByteToUnicodeN和RtlOemToUnicodeN。
 ' RtlDowncaseUnicodeChar
 ' RtlDowncaseUnicodeString
 ' RtlDuplicateUnicodeString
 ' RtlEqualString
 ' RtlEqualUnicodeString
 ' RtlEraseUnicodeString
 ' RtlFindCharInUnicodeString
 ' RtlFindUnicodeSubstring
 ' RtlFreeAnsiString
 ' RtlFreeOemString
 ' RtlFreeUTF8String
 ' RtlFreeUnicodeString
 ' RtlGUIDFromString
 ' RtlStringFromGUIDEx
 ' RtlHashUnicodeString
 ' RtlIdnToNameprepUnicode
 ' RtlIdnToUnicode
 ' RtlIdnToAscii
 ' RtlInitAnsiString
 ' RtlInitAnsiStringEx
 ' RtlInitString
 ' RtlInitStringEx
 ' RtlInitUTF8String
 ' RtlInitUTF8StringEx
 ' RtlInitUnicodeString
 ' RtlInitUnicodeStringEx
 ' RtlInt64ToUnicodeString
 ' RtlIntegerToChar
 ' RtlIntegerToUnicodeString
 ' RtlIsTextUnicode '放弃
 ' RtlLargeIntegerToChar '放弃
 ' RtlLengthSidAsUnicodeString
 ' RtlMultiAppendUnicodeStringBuffer'放弃
 ' RtlMultiByteToUnicodeN
 ' RtlMultiByteToUnicodeSize
 ' RtlNormalizeString'放弃
 ' RtlOemStringToUnicodeSize
 ' RtlOemStringToUnicodeString
 ' RtlOemToUnicodeN
 ' RtlPrefixString
 ' RtlPrefixUnicodeString
 ' RtlRunDecodeUnicodeString
 ' RtlRunEncodeUnicodeString
 ' RtlUTF8StringToUnicodeString
 ' RtlUTF8ToUnicodeN
 ' RtlUnicodeStringToAnsiSize
 ' RtlUnicodeStringToAnsiString
 ' RtlUnicodeStringToCountedOemString
 ' RtlUnicodeStringToInteger
 ' RtlUnicodeStringToOemSize
 ' RtlUnicodeStringToOemString
 ' RtlUnicodeStringToUTF8String
 ' RtlUnicodeToCustomCPN'该RtlUnicodeToCustomCPN程序保留给系统使用。
 ' RtlUnicodeToMultiByteN
 ' RtlUnicodeToMultiByteSize
 ' RtlUnicodeToOemN
 ' RtlUnicodeToUTF8N
 ' RtlUpcaseUnicodeChar
 ' RtlUpcaseUnicodeString
 ' RtlUpcaseUnicodeStringToAnsiString
 ' RtlUpcaseUnicodeStringToCountedOemString
 ' RtlUpcaseUnicodeStringToOemString
 ' RtlUpcaseUnicodeToCustomCPN'该RtlUpcaseUnicodeToCustomCPN程序保留给系统使用。
 ' RtlUpcaseUnicodeToMultiByteN
 ' RtlUpcaseUnicodeToOemN
 ' RtlUpperChar
 ' RtlUpperString
 ' RtlValidateUnicodeString
 ' RtlxAnsiStringToUnicodeSize
 ' RtlxOemStringToUnicodeSize
 ' RtlxUnicodeStringToAnsiSize
 ' RtlxUnicodeStringToOemSize
 
 
 
 |