Thomas Bluemel wrote:
ProbeForReadUnicodeString should at least probe the buffers, otherwise the function is pointless. I believe at one point it did, and it was
Well as pointless as ProbeForReadUlong etc. They are all inlined versions of ProbeForRead + returning the probed data. Maybe the names should be changed to ProbeAndReadUlong etc.
Btw, what about inlining the normal ProbeForRead() for internal use?
probably removed for some strange reason. The reason it copies the UNICODE_STRING is so that the pointers can't be modified anymore.
There's ProbeAndCaptureUnicodeString for that. The reason it was not used here is probably that it would be a duplicate copy.