that's what i mean. it is a pointer of a pointer. The function alloactes the needed memory itself. here is the prove
sub query_users {
my ( $self, $filename ) = @_;
my $func = import_api( 'advapi32', 'QueryUsersOnEncryptedFile', 'P
+P', 'N' );
die "Could not import API QueryUsersOnEncryptedFile: $!"
unless defined $func;
$filename = make_unicode( File::Spec->canonpath($filename) );
+
my $ptr = " " x 4; # 4 == sizeof(void*)
my $result = $func->Call( "$filename", $ptr );
print "result: $result\n";
return undef if $result;
my $address = unpack( "L*", $ptr );
printf("0x%08x\n", $address);
}
i think i have to switch to XS at this point.