Undocumented functions of NTDLL


RtlCompressBuffer
RtlCompressBuffer

NTSYSAPI 
NTSTATUS
NTAPI

RtlCompressBuffer(
IN ULONG CompressionFormat, IN PVOID SourceBuffer, IN ULONG SourceBufferLength, OUT PVOID DestinationBuffer, IN ULONG DestinationBufferLength, IN ULONG Unknown, OUT PULONG pDestinationSize, IN PVOID WorkspaceBuffer );


CompressionFormat


Only lower 2 bytes are supported. Higher byte means Compression Engine. Lower byte means Compressing Format.


Unknown


Put 0x1000 here. Propably means page size.

pDestinationSize


Size of data after compression.

WorkspaceBuffer


See RtlGetCompressionWorkSpaceSize for more information.



Requirements:
Library: ntdll.lib




See also:
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize