const ForeignString = extern struct length: u16maximum_length: u16buffer_address: u64Address in the CSRSS address space. To convert this to a valid pointer in our address space, see relocateCsrssAddress (or the ForeignString.relocate wrapper function).
fn relocate(str: ForeignString) UNICODE_STRING5991
5992
5993
5994
5995
5996
5997
5998
5999
6000
6001
6002
6003
6004 const ForeignString = extern struct {
length: u16,
maximum_length: u16,
/// Address in the CSRSS address space. To convert this to a valid pointer in *our* address
/// space, see `relocateCsrssAddress` (or the `ForeignString.relocate` wrapper function).
buffer_address: u64,
fn relocate(str: ForeignString) UNICODE_STRING {
return .{
.Length = str.length,
.MaximumLength = str.maximum_length,
.Buffer = @ptrCast(@alignCast(@constCast(relocateCsrssAddress(str.buffer_address)))),
};
}
}
This matches the 64-bit version of
UNICODE_STRING---even on 32-bit targets, this string is from 64-bit code (since it comes from CSRSS which is running outside of WOW64).