RtlDecompressBufferEx - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSAPI
NTSTATUS
NTAPI
RtlDecompressBufferEx(
_In_ USHORT CompressionFormat,
_Out_writes_bytes_to_(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer,
_In_ ULONG UncompressedBufferSize,
_In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer,
_In_ ULONG CompressedBufferSize,
_Out_ PULONG FinalUncompressedSize,
_In_opt_ PVOID WorkSpace
);
View code on GitHub// ntifs.h
NT_RTL_COMPRESS_API NTSTATUS RtlDecompressBufferEx(
[in] USHORT CompressionFormat,
[out] PUCHAR UncompressedBuffer,
[in] ULONG UncompressedBufferSize,
[in] PUCHAR CompressedBuffer,
[in] ULONG CompressedBufferSize,
[out] PULONG FinalUncompressedSize,
[in] PVOID WorkSpace
);
View the official Windows Driver Kit DDI referenceThis function is documented in Windows Driver Kit.
The RtlDecompressBufferEx function decompresses an entire compressed buffer.
CompressionFormat [in]A bitmask that specifies the compression format of the compressed buffer. This parameter must be set to COMPRESSION_FORMAT_LZNT1. The meaning of this and other related compression format values are as follows.
| Value | Meaning |
|---|---|
| COMPRESSION_FORMAT_NONE | Not supported by this function. |
| COMPRESSION_FORMAT_DEFAULT | Not supported by this function. |
| COMPRESSION_FORMAT_LZNT1 | The function will perform LZ compression. |
| COMPRESSION_FORMAT_XPRESS | The function will perform Xpress compression. |
| COMPRESSION_FORMAT_XPRESS_HUFF | The function will perform Xpress Huffman decompression. |
UncompressedBuffer [out]A pointer to a caller-allocated buffer (allocated from paged or non-paged pool) that receives the decompressed data from CompressedBuffer. This parameter is required and cannot be NULL.
UncompressedBufferSize [in]The size, in bytes, of the UncompressedBuffer buffer.
CompressedBuffer [in]A pointer to the buffer that contains the data to decompress. This parameter is required and cannot be NULL.
CompressedBufferSize [in]The size, in bytes, of the CompressedBuffer buffer.
FinalUncompressedSize [out]A pointer to a caller-allocated variable that receives the size, in bytes, of the decompressed data stored in UncompressedBuffer. This parameter is required and cannot be NULL.
WorkSpace [in]A pointer to a caller-allocated work space buffer used by the RtlDecompressBufferEx function during decompression. Use the RtlGetCompressionWorkSpaceSize function to determine the correct work space buffer size.
RtlDecompressBufferEx returns an appropriate error status value, such as one of the following.
| Return code | Description |
|---|---|
| STATUS_SUCCESS | The CompressedBuffer buffer was successfully decompressed. |
| STATUS_INVALID_PARAMETER | An invalid compression format was specified through the CompressionFormat parameter. If CompressionFormat is either COMPRESSION_FORMAT_NONE or COMPRESSION_FORMAT_DEFAULT (but not both), this value is returned. |
| STATUS_UNSUPPORTED_COMPRESSION | An invalid compression format was specified through the CompressionFormat parameter. If CompressionFormat is not one of the following, STATUS_UNSUPPORTED_COMPRESSION is returned: COMPRESSION_FORMAT_LZNT1, COMPRESSION_FORMAT_XPRESS, COMPRESSION_FORMAT_XPRESS_HUFF |
| STATUS_BAD_COMPRESSION_BUFFER | UncompressedBuffer is not large enough to contain the uncompressed data. |
The RtlDecompressBufferEx function takes as input an entire compressed buffer and produces its decompressed equivalent provided that the uncompressed data fits within the specified destination buffer.
To decompress only a portion of a compressed buffer (that is, a "fragment" of the buffer), use the RtlDecompressFragment function.
To compress an uncompressed buffer, use the RtlCompressBuffer function.