UNICODE_STRING::Buffer
- указатель на массив wchar_t[]
.Вы можете проверить содержимое Buffer
напрямую, например:
enum eAccountType {atUnknown, atUser, atComputer};
eAccountType GetAccountType(const wchar_t *UserName, int Length)
{
return ((UserName) && (Length > 0))
? ((UserName[Length-1] == L'$') ? atComputer : atUser)
: atUnknown;
}
eAccountType GetAccountType(const UNICODE_STRING &UserName)
{
// UNICODE_STRING::Length is expressed in bytes, not in characters...
return GetAccountType(UserName.Buffer, UserName.Length / sizeof(wchar_t));
}
NTSTATUS PsamPasswordNotificationRoutine(
PUNICODE_STRING UserName,
ULONG RelativeId,
PUNICODE_STRING NewPassword
)
{
...
if ((UserName) && (GetAccountType(*UserName) == atUser))
{
...
}
...
}