Reference

SystemFunction041(3w)

NAME

SystemFunction041 (ADVAPI32.@)

SYNOPSIS

NTSTATUS SystemFunction041
(
PVOID memory,
ULONG length,
ULONG flags
)

DESCRIPTION

MSDN documents this function as RtlDecryptMemory and declares it in ntsecapi.h.

PARAMS

memory [In/Out] Pointer to memory to decrypt.

length [In] Length of region to decrypt in bytes.

flags [In] Control whether other processes are able to decrypt the memory. RTL_ENCRYPT_OPTION_SAME_PROCESS RTL_ENCRYPT_OPTION_CROSS_PROCESS RTL_ENCRYPT_OPTION_SAME_LOGON.

RETURNS

Success: STATUS_SUCCESS

Failure: NTSTATUS error code.

NOTES

length must be a multiple of RTL_ENCRYPT_MEMORY_SIZE. If flags are specified when encrypting, the same flag value must be given when decrypting the memory.

IMPLEMENTATION

Declared in "ntsecapi.h".

Implemented in "dlls/advapi32/crypt.c".

Debug channel "crypt".

History