Decompiles BPF program into BPF assembler source and saves it in the memory allocated by application.

Syntax:

DWORD __stdcall BpfDecompileBPFAsmToStr(HANDLE hFtr, LPCTSTR Str, DWORD *pSize, BOOL StrLabels);

Parameters:

hFtr

[in] HNUserFilter object handle.

Str

[in] Pointer to a string in which a BPF assembler program will be saved to.

pSize

[in,out] Pointer to a variable containing the size of the memory Str parameter points to. After the function completion, the size of a decompiled program, saved in the user buffer, returns to this variable.

StrLabels

[in] Flag sets that all offsets in JMP commands must be marked as labels (TRUE) or offsets (FALSE).

Return values:

Description:

The function decompiles the current HNUserFilter component BPF program to a program in BPF assembler language and saves it in the predefined memory buffer. This program can be later compiled again and reused for traffic filtering. If the buffer allocated by the user is too small, or the pointer to the buffer is equal to NULL, then the buffer of enough size for the whole decompiled program will be returned in the variable pSize parameter points to.