xeno_rat_client.Compression Class Reference

Collaboration diagram for xeno_rat_client.Compression:

Static Public Member Functions
static byte[]	Compress (byte[] buffer)
	Compresses the input buffer using the LZNT1 compression format and returns the compressed data.
static byte[]	Decompress (byte[] buffer, int original_size)
	Decompresses the input buffer using the LZNT1 compression format and returns the decompressed data.

Private Member Functions
static uint	RtlGetCompressionWorkSpaceSize (ushort CompressionFormat, out uint pNeededBufferSize, out uint Unknown)
	Retrieves the size of the workspace required for compression.
static uint	RtlDecompressBuffer (ushort CompressionFormat, byte[] UncompressedBuffer, int UncompressedBufferSize, byte[] CompressedBuffer, int CompressedBufferSize, out int FinalUncompressedSize)
	Decompresses a buffer using the specified compression format and returns the decompressed data.
static uint	RtlCompressBuffer (ushort CompressionFormat, byte[] SourceBuffer, int SourceBufferLength, byte[] DestinationBuffer, int DestinationBufferLength, uint Unknown, out int pDestinationSize, IntPtr WorkspaceBuffer)
	Compresses the input buffer using the specified compression format and returns the compressed data in the destination buffer.
static IntPtr	LocalAlloc (int uFlags, IntPtr sizetdwBytes)
	Allocates memory in the local heap.
static IntPtr	LocalFree (IntPtr hMem)
	Frees the memory block allocated by the LocalAlloc or LocalReAlloc function.

Static Private Attributes
const ushort	COMPRESSION_FORMAT_LZNT1 = 2
const ushort	COMPRESSION_ENGINE_MAXIMUM = 0x100

Member Function Documentation

Compress()

static byte[] xeno_rat_client.Compression.Compress ( byte[] buffer )

inlinestatic

Compresses the input buffer using the LZNT1 compression format and returns the compressed data.

Parameters

buffer

The input buffer to be compressed.

Returns

The compressed data in the LZNT1 format.

This method compresses the input buffer using the LZNT1 compression format and returns the compressed data. It first calculates the required workspace size for compression using the RtlGetCompressionWorkSpaceSize function. If the compression operation is successful, it returns the compressed data; otherwise, it returns null.

Here is the call graph for this function:

Here is the caller graph for this function:

Decompress()

static byte[] xeno_rat_client.Compression.Decompress ( byte[] buffer, int original_size )

inlinestatic

Decompresses the input buffer using the LZNT1 compression format and returns the decompressed data.

Parameters

buffer	The compressed data to be decompressed.
original_size	The size of the original data before compression.

Returns

The decompressed data as a byte array.

This method decompresses the input buffer using the LZNT1 compression format and returns the decompressed data as a new byte array. The size of the original data before compression is required to properly decompress the input buffer.

Here is the call graph for this function:

Here is the caller graph for this function:

LocalAlloc()

static IntPtr xeno_rat_client.Compression.LocalAlloc ( int uFlags, IntPtr sizetdwBytes )

private

Allocates memory in the local heap.

Parameters

uFlags	The memory allocation attributes. This parameter specifies the allocation attributes. This parameter can be zero or any combination of the following values: LMEM_FIXED, LMEM_MOVEABLE, LMEM_ZEROINIT, and LMEM_NOCOMPACT.
sizetdwBytes	The size of the memory block, in bytes. If this parameter is zero, the LocalAlloc function allocates a zero-length item and returns a valid pointer to that item.

Returns

A pointer to the allocated memory block if the function succeeds; otherwise, it returns NULL.

This method allocates memory in the local heap of the calling process. The allocated memory is automatically initialized to zero. If the LocalAlloc function succeeds, the return value is a handle to the newly allocated memory object. If the LocalAlloc function fails, the return value is NULL.

Here is the caller graph for this function:

LocalFree()

static IntPtr xeno_rat_client.Compression.LocalFree ( IntPtr hMem )

private

Frees the memory block allocated by the LocalAlloc or LocalReAlloc function.

Parameters

hMem	A handle to the local memory object. This handle is returned by either the LocalAlloc or LocalReAlloc function.

Returns

If the function succeeds, the return value is NULL. If the function fails, the return value is equal to a handle to the local memory object. To get extended error information, call GetLastError.

This method frees the memory block allocated by the LocalAlloc or LocalReAlloc function. It is important to note that this method is used for freeing memory allocated in unmanaged code, and it should be used with caution to avoid memory leaks and access violations.

Here is the caller graph for this function:

RtlCompressBuffer()

static uint xeno_rat_client.Compression.RtlCompressBuffer ( ushort CompressionFormat, byte[] SourceBuffer, int SourceBufferLength, byte[] DestinationBuffer, int DestinationBufferLength, uint Unknown, out int pDestinationSize, IntPtr WorkspaceBuffer )

private

Compresses the input buffer using the specified compression format and returns the compressed data in the destination buffer.

Parameters

CompressionFormat	The compression format to be used.
SourceBuffer	The input buffer to be compressed.
SourceBufferLength	The length of the input buffer.
DestinationBuffer	The buffer to store the compressed data.
DestinationBufferLength	The length of the destination buffer.
Unknown	Unknown parameter.
pDestinationSize	The size of the compressed data in the destination buffer.
WorkspaceBuffer	The workspace buffer used for compression.

Returns

The status of the compression operation.

Here is the caller graph for this function:

RtlDecompressBuffer()

static uint xeno_rat_client.Compression.RtlDecompressBuffer ( ushort CompressionFormat, byte[] UncompressedBuffer, int UncompressedBufferSize, byte[] CompressedBuffer, int CompressedBufferSize, out int FinalUncompressedSize )

private

Decompresses a buffer using the specified compression format and returns the decompressed data.

Parameters

CompressionFormat	The compression format used for the input buffer.
UncompressedBuffer	The buffer containing the uncompressed data.
UncompressedBufferSize	The size of the uncompressed data buffer.
CompressedBuffer	The buffer containing the compressed data to be decompressed.
CompressedBufferSize	The size of the compressed data buffer.
FinalUncompressedSize	When this method returns, contains the size of the decompressed data.

Returns

The status of the decompression operation. Zero indicates success; otherwise, an error occurred.

This method decompresses the data in the input buffer using the specified compression format. The decompressed data is stored in the output buffer, and the size of the decompressed data is returned in the FinalUncompressedSize parameter.

Here is the caller graph for this function:

RtlGetCompressionWorkSpaceSize()

static uint xeno_rat_client.Compression.RtlGetCompressionWorkSpaceSize ( ushort CompressionFormat, out uint pNeededBufferSize, out uint Unknown )

private

Retrieves the size of the workspace required for compression.

Parameters

CompressionFormat	The compression format.
pNeededBufferSize	Receives the size of the workspace required for compression.
Unknown	Receives an unknown value.

Returns

The status of the operation.

Here is the caller graph for this function:

Member Data Documentation

COMPRESSION_ENGINE_MAXIMUM

const ushort xeno_rat_client.Compression.COMPRESSION_ENGINE_MAXIMUM = 0x100

staticprivate

COMPRESSION_FORMAT_LZNT1

const ushort xeno_rat_client.Compression.COMPRESSION_FORMAT_LZNT1 = 2

staticprivate

---

The documentation for this class was generated from the following file:

• /Users/sumansaurabh/Documents/my-startup/xeno-rat/xeno rat client/Compression.cs