Geoff Chappell, Software Analyst
The CsrAllocateCaptureBuffer function obtains a capture buffer such as can be sent as extra data with a message to the CSRSS server.
PVOID CsrAllocateCaptureBuffer ( ULONG MaxMessagePointers, ULONG Size);
in version 5.0 and higher, but
PVOID CsrAllocateCaptureBuffer ( ULONG MaxMessagePointers, ULONG MaxCapturePointers, ULONG Size);
in versions 3.10 to 4.0.
The MaxMessagePointers and MaxCapturePointers arguments tell respectively how many message and capture pointers to allow for. Both types of pointers point into the capture buffer. Message pointers are in the message. Capture pointers are in the capture buffer.
The Size argument tells how many bytes to allow for allocations from within the capture buffer.
The function returns the address of the allocated capture buffer, else it returns NULL for failure.
The capture buffer begins with a CSR_CAPTURE_HEADER structure, but it is here thought that the function hides this as an implementation detail. The caller does not manipulate the structure but passes the returned address to other functions, e.g., CsrAllocateCapturePointer, CsrAllocateMessagePointer and CsrCaptureMessageBuffer for further work on the capture buffer, and eventually to CsrClientCallServer to include the capture buffer when sending a message to the server.
The CsrAllocateCaptureBuffer function is exported by name from NTDLL.DLL in all known Windows versions, i.e., starting from version 3.10.
The CsrAllocateCaptureBuffer function is not documented. Neither is Microsoft known to have disclosed a C-language declaration in any header from any publicly released kit for software development.
IN PROGRESS