heres my attempt at a packet debuffer class. my only question is this the most efficient usage?

any suggestions or criticism are graciously accepted.

[code]
From clsPktDebuf
Private Buffer As String

Public Sub InitPacket(Data As String)
    Buffer = Data
End Sub

Public Function GetData(DType As DataType, Optional DataEnd As Integer) As Variant
    Select Case DType
        Case xDword
            GetData = CVL(Mid$(Buffer, 1, 4))
            Call RemBytes(4)
        Case xWord
            GetData = CVI(Mid$(Buffer, 1, 2))
            Call RemBytes(2)
        Case xbyte
            GetData = Chr(CVB(Mid$(Buffer, 1, 1)))
            Call RemBytes(1)
        Case xNonNtstring
            GetData = Mid$(Buffer, 1, DataEnd)
            Call RemBytes(Len(GetData))
        Case xNTString
            GetData = Mid$(Buffer, 1, InStr(1, Buffer, Chr(0)) - 1)
            Call RemBytes(Len(GetData) + 1)
    End Select
End Function

Public Sub RemBytes(remLength As Integer)
    Buffer = Mid(Buffer, remLength + 1)
End Sub

Public Sub ClearBuf()
    Buffer = ""
End Sub
[/code]

the CVI(), CVB(), and CVL() are just RtlMoveMemory functions

I would suggest you rather use a length variable instead of removing the bytes when debuffing, you never know when you have to go back in the buffer for something and your data will be gone.

Okay, at first i didn't really care to do it that way. When i was redoing my 0x3E (SID_LOGONREALMEX) I decided that it was less of a headache if i did use a position instead of just removing the bytes as needed.

Thanks Shadow, heres the new Class, any other suggestions?

[code]
***ClsPktDebuf

Private Buffer As String
Private Position As Integer

Public Sub InitPacket(Data As String)
    Position = 1
    Buffer = Data
End Sub

Public Sub SetPosition(NewPos As Integer)
    Position = NewPos
End Sub

Public Sub SkipBytes(lSkip As Integer)
    Position = Position + lSkip
End Sub

Public Sub ClearBuf()
    Buffer = ""
    Position = 1
End Sub

Public Function GetData(DType As DataType, Optional DataLen As Integer) As Variant
Dim NTPos As Long
On Error Resume Next

    Select Case DType
        Case xDword
            GetData = CVL(Mid$(Buffer, Position, 4))
            Position = Position + 4
        Case xWord
            GetData = CVI(Mid$(Buffer, Position, 2))
            Position = Position + 2
        Case xByte
            GetData = Chr(CVB(Mid$(Buffer, Position, 1)))
            Position = Position + 1
        Case xNonNTString
            GetData = Mid$(Buffer, Position, DataLen)
            Position = Position + Len(GetData)
        Case xNTString
            NTPos = InStr(Position, Buffer, Chr(0))
            GetData = Mid$(Buffer, Position, NTPos - Position)
            Position = NTPos + 1
    End Select
End Function

[/code]

You should make GetDWORD, GetWORD, GetSTRING, GetBYTE, and GetBYTES, instead of clumping everything together.  You should also never use On Error Resume Next.  Either handle your errors or let the program crash.

[quote author=rabbit link=topic=15721.msg158423#msg158423 date=1158627940]
You should make GetDWORD, GetWORD, GetSTRING, GetBYTE, and GetBYTES, instead of clumping everything together.  You should also never use On Error Resume Next.  Either handle your errors or let the program crash.
[/quote]

and try the very hardest to avoid using Variant as a data type, it is slow, and I promise you, it will bite you in the ass.

Also if CVI() is returning an integer, it is incorrect, it should return a long. Remember that Visual Basic data types are signed, so therefore if (assuming you are on a 32-bit system) a WORD is 2 bytes, it's highest value is 0xFFFF, 65535, it is well above the value of a VB Integer, which's maximum value is 0x7FFF, 32767.