diff --git a/NtApiDotNet/Ndr/Marshal/NdrUnmarshalBuffer.cs b/NtApiDotNet/Ndr/Marshal/NdrUnmarshalBuffer.cs index 5db81dc4..ff293ff7 100644 --- a/NtApiDotNet/Ndr/Marshal/NdrUnmarshalBuffer.cs +++ b/NtApiDotNet/Ndr/Marshal/NdrUnmarshalBuffer.cs @@ -162,6 +162,51 @@ public NdrUnmarshalBuffer(NdrPickledType pickled_type) #endregion #region Misc Methods + + /// + /// When manually decoding 64bit NDR data, there are situations that + /// result in a single item getting stuck on the stack. This completely depends on what + /// is being decoded, so this function returns the _conformance_values array + /// to be evaluated. Depending on the evaluation, the _conformance_values array will be cleared. + /// + /// + public int[] GetConformanceValuesArray() + { + return _conformance_values; + } + + /// + /// When decoding 64bit NDR data, conformant arrays will leave data on the stack if pre alignment + /// is not possible. This results in other structs not being decoded correctly. + /// This method clears the stack manually. + /// + public void ClearConformanceValues() + { + _conformance_values = null; + } + + /// + /// Reads given number of positions from the buffer and moves the position back to where it was. + /// This allows for reading data from the stream without consuming it + /// + /// Number of bytes to peek + /// bytearray from the stream + public byte[] PeekBuffer(int length) + { + + if ((long)length > _stm.RemainingLength()) + throw new IndexOutOfRangeException("Given length bigger than remaining length"); + + long currentPosition = _stm.Position; + + byte[] res = new byte[length]; + res = ReadFixedByteArray(length); + + _stm.Position = currentPosition; + + return res; + } + public T ReadSystemHandle() where T : NtObject { int index = ReadInt32();