From 22ec8ba85c9440614ad69e7e5352d6337d83a49a Mon Sep 17 00:00:00 2001
From: dahall <dahall@byu.net>
Date: Tue, 9 Nov 2021 16:13:04 -0700
Subject: [PATCH] Finished fixing AuthzReportSecurityEventFromParams. BREAKING
 CHANGE: removed SafeAUTHZ_SOURCE_SCHEMA_REGISTRATION as all functionality was
 possible by marshaling AUTHZ_SOURCE_SCHEMA_REGISTRATION correctly.

---
 PInvoke/Security/Authz/AdtGen.cs               | 49 +++++++-------------------
 UnitTests/PInvoke/Security/Authz/AuthzTests.cs |  8 +++--
 2 files changed, 17 insertions(+), 40 deletions(-)

diff --git a/PInvoke/Security/Authz/AdtGen.cs b/PInvoke/Security/Authz/AdtGen.cs
index bdb02f00..0700b806 100644
--- a/PInvoke/Security/Authz/AdtGen.cs
+++ b/PInvoke/Security/Authz/AdtGen.cs
@@ -137,60 +137,35 @@ namespace Vanara.PInvoke
 		/// compatibility with any future changes to this structure.
 		/// </summary>
 		[PInvokeData("adtgen.h")]
-		[StructLayout(LayoutKind.Explicit, Size = 32, CharSet = CharSet.Unicode)]
+		[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
 		public struct AUDIT_PARAM
 		{
 			/// <summary>Type</summary>
-			[FieldOffset(0)]
 			public AUDIT_PARAM_TYPE Type;
 
 			/// <summary>currently unused</summary>
-			[FieldOffset(4)]
 			public uint Length;
 
 			/// <summary>currently unused</summary>
-			[FieldOffset(8)]
 			public uint Flags;
 
 			/// <summary/>
-			[FieldOffset(16)]
 			public IntPtr Data0;
 
 			/// <summary/>
-			[FieldOffset(16)]
-			public StrPtrUni String;
-
-			/// <summary/>
-			[FieldOffset(16)]
-			public IntPtr u;
-
-			/// <summary/>
-			[FieldOffset(16)]
-			public PSID psid;
-
-			/// <summary/>
-			[FieldOffset(16)]
-			public GuidPtr pguid;
-
-			/// <summary/>
-			[FieldOffset(16)]
-			public uint LogonId_LowPart;
-
-			/// <summary/>
-			[FieldOffset(16)]
-			public IntPtr pObjectTypes;
-
-			/// <summary/>
-			[FieldOffset(16)]
-			public IntPtr pIpAddress;
-
-			/// <summary/>
-			[FieldOffset(24)]
 			public IntPtr Data1;
 
-			/// <summary/>
-			[FieldOffset(24)]
-			public int LogonId_HighPart;
+			/// <summary>Initializes a new instance of the <see cref="AUDIT_PARAM"/> struct.</summary>
+			/// <param name="type">The type.</param>
+			/// <param name="data0">The data0.</param>
+			/// <param name="data1">The data1.</param>
+			public AUDIT_PARAM(AUDIT_PARAM_TYPE type, IntPtr data0, IntPtr data1 = default)
+			{
+				Type = type;
+				Length = Flags = 0;
+				Data0 = data0;
+				Data1 = data1;
+			}
 		}
 
 		/// <summary>Audit parameters passed to LsaGenAuditEvent.</summary>
diff --git a/UnitTests/PInvoke/Security/Authz/AuthzTests.cs b/UnitTests/PInvoke/Security/Authz/AuthzTests.cs
index d42abe6c..1caaf124 100644
--- a/UnitTests/PInvoke/Security/Authz/AuthzTests.cs
+++ b/UnitTests/PInvoke/Security/Authz/AuthzTests.cs
@@ -304,9 +304,11 @@ namespace Vanara.PInvoke.Tests
 				try
 				{
 					using SafeCoTaskMemString data = new("Testing");
-					//using SafeCoTaskMemString name = new("MyName");
-					using SafeNativeArray<AUDIT_PARAM> mem = new(new[] { new AUDIT_PARAM { Type = AUDIT_PARAM_TYPE.APT_String, Data0 = data/*, Data1 = name*/ } });
-					AUDIT_PARAMS ap = new() { Count = 1, Parameters = mem };
+					using SafeNativeArray<AUDIT_PARAM> mem = new(new[] {
+						new AUDIT_PARAM(AUDIT_PARAM_TYPE.APT_String, data),
+						new AUDIT_PARAM(AUDIT_PARAM_TYPE.APT_Ulong, new IntPtr(123)),
+					});
+					AUDIT_PARAMS ap = new() { Count = (ushort)mem.Count, Parameters = mem };
 					Assert.That(AuthzReportSecurityEventFromParams(0, hEvtProv, eventId, PSID.NULL, ap), ResultIs.Successful);
 				}
 				finally { Assert.That(() => hEvtProv.Dispose(), Throws.Nothing); }