#ifndef _NTRTL_H

// ntifs:FsRtlIsNameInExpression
/**
 * The RtlIsNameInExpression routine determines whether a Unicode string matches the specified pattern.
 *
 * \param Expression A pointer to the pattern string. This string can contain wildcard characters. If the IgnoreCase parameter is TRUE, the string must contain only uppercase characters.
 * \param Name Maximum number of bytes to be written to UTF8StringDestination. If this value causes the translated string to be truncated, RtlUnicodeToUTF8N returns an error status.
 * \param IgnoreCase TRUE for case-insensitive matching, or FALSE for case-sensitive matching.
 * \param UpcaseTable An optional pointer to an uppercase character table to use for case-insensitive matching. If this parameter is NULL, the default system uppercase character table is used.
 * \return TRUE if the string matches the pattern. If the string does not match the pattern, this function returns FALSE.
 * \sa https://learn.microsoft.com/en-us/windows/win32/devnotes/rtlisnameinexpression
 */
NTSYSAPI
BOOLEAN
NTAPI
RtlIsNameInExpression(
    _In_ PCUNICODE_STRING Expression,
    _In_ PCUNICODE_STRING Name,
    _In_ BOOLEAN IgnoreCase,
    _In_opt_ PWCH UpcaseTable
    );

#endif
View code on GitHub

BOOLEAN  RtlIsNameInExpression(
  _In_     PUNICODE_STRING Expression,
  _In_     PUNICODE_STRING Name,
  _In_     BOOLEAN         IgnoreCase,
  _In_opt_ PWCH            UpcaseTable
);
View the official Win32 development documentation

NtDoc

This function is documented in Windows SDK.

Edit description on GitHub

Win32 development documentation (rtlisnameinexpression)

RtlIsNameInExpression function

Determines whether a Unicode string matches the specified pattern.

Parameters

Expression [in]

A pointer to the pattern string. This string can contain wildcard characters. If the IgnoreCase parameter is TRUE, the string must contain only uppercase characters.

Name [in]

A pointer to the string to be compared against the pattern. This string cannot contain wildcard characters.

IgnoreCase [in]

TRUE for case-insensitive matching, or FALSE for case-sensitive matching.

UpcaseTable [in, optional]

An optional pointer to an uppercase character table to use for case-insensitive matching. If this parameter is NULL, the default system uppercase character table is used.

Return value

Returns TRUE if the string matches the pattern. If the string does not match the pattern, this function returns FALSE.

Remarks

This function has no associated header file. The associated import library, Ntdll.lib, is available in the Microsoft Windows Driver Kit (WDK). You can also call this function using the LoadLibrary and GetProcAddress functions to dynamically link to Ntdll.dll.

Requirements

Requirement	Value
Minimum supported client	Windows 7 [desktop apps only]
Minimum supported server	Windows Server 2008 R2 [desktop apps only]
DLL	Ntdll.dll

View the official Win32 development documentation

Edit description on GitHub