public RawSecurityDescriptor (byte[] binaryForm, int offset)
		{
			if (binaryForm == null)
				throw new ArgumentNullException("binaryForm");
			
			if (offset < 0 || offset > binaryForm.Length - 0x14)
				throw new ArgumentOutOfRangeException("offset", offset, "Offset out of range");
			
			if (binaryForm[offset] != 1)
				throw new ArgumentException("Unrecognized Security Descriptor revision.", "binaryForm");
			
			resourcemgr_control = binaryForm[offset + 0x01];
			control_flags = (ControlFlags)ReadUShort(binaryForm, offset + 0x02);
			
			int ownerPos = ReadInt(binaryForm, offset + 0x04);
			int groupPos = ReadInt(binaryForm, offset + 0x08);
			int saclPos = ReadInt(binaryForm, offset + 0x0C);
			int daclPos = ReadInt(binaryForm, offset + 0x10);
			
			if (ownerPos != 0)
				owner_sid = new SecurityIdentifier(binaryForm, ownerPos);
			
			if (groupPos != 0)
				group_sid = new SecurityIdentifier(binaryForm, groupPos);
			
			if (saclPos != 0)
				system_acl = new RawAcl(binaryForm, saclPos);
			
			if (daclPos != 0)
				discretionary_acl = new RawAcl(binaryForm, daclPos);
		}

		public RawSecurityDescriptor (ControlFlags flags,
					      SecurityIdentifier owner,
					      SecurityIdentifier group,
					      RawAcl systemAcl,
					      RawAcl discretionaryAcl)
		{
		}

		public CommonSecurityDescriptor (bool isContainer, bool isDS,
						 ControlFlags flags,
						 SecurityIdentifier owner,
						 SecurityIdentifier group,
						 SystemAcl systemAcl,
						 DiscretionaryAcl discretionaryAcl)
		{
			Init (isContainer, isDS, flags, owner, group, systemAcl, discretionaryAcl);
		}

		public CommonSecurityDescriptor (bool isContainer, bool isDS,
						 ControlFlags flags,
						 SecurityIdentifier owner,
						 SecurityIdentifier group,
						 SystemAcl systemAcl,
						 DiscretionaryAcl discretionaryAcl)
		{
			this.isContainer = isContainer;
			this.isDS = isDS;
			this.flags = flags;
			this.owner = owner;
			this.group = group;
			this.systemAcl = systemAcl;
			this.discretionaryAcl = discretionaryAcl;
			
			throw new NotImplementedException ();
		}

        //
        // These two add/remove method must be called with great care (and thus it is internal)
        // The caller is responsible for keeping the SaclPresent and DaclPresent bits in sync
        // with the actual SACL and DACL.
        //

        internal void AddControlFlags(ControlFlags flags)
        {
            _rawSd.SetFlags(_rawSd.ControlFlags | flags);
        }

 internal void UpdateControlFlags(ControlFlags flagsToUpdate, ControlFlags newFlags)
 {
     ControlFlags finalFlags = newFlags | (_rawSd.ControlFlags & (~flagsToUpdate));
     _rawSd.SetFlags(finalFlags);
 }

 public UserHintJumpBlock(BinaryReader binaryReader)
 {
     this.flags = (Flags)binaryReader.ReadInt16();
     this.geometryIndex = binaryReader.ReadShortBlockIndex1();
     this.forceJumpHeight = (ForceJumpHeight)binaryReader.ReadInt16();
     this.controlFlags = (ControlFlags)binaryReader.ReadInt16();
 }

		internal override string GetSddlForm(ControlFlags sdFlags,
		                                     bool isDacl)
		{
			StringBuilder result = new StringBuilder();
			
			if(isDacl) {
				if((sdFlags & ControlFlags.DiscretionaryAclProtected) != 0)
					result.Append("P");
				if((sdFlags & ControlFlags.DiscretionaryAclAutoInheritRequired) != 0)
					result.Append("AR");
				if((sdFlags & ControlFlags.DiscretionaryAclAutoInherited) != 0)
					result.Append("AI");
			} else {
				if((sdFlags & ControlFlags.SystemAclProtected) != 0)
					result.Append("P");
				if((sdFlags & ControlFlags.SystemAclAutoInheritRequired) != 0)
					result.Append("AR");
				if((sdFlags & ControlFlags.SystemAclAutoInherited) != 0)
					result.Append("AI");
			}
			
			foreach(var ace in list)
			{
				result.Append(ace.GetSddlForm());
			}
			
			return result.ToString();
		}

 private bool GetControlFlag(ControlFlags flag)
 {
     return (agentControls & (uint)flag) != 0;
 }

        private void CreateFromParts(bool isContainer, bool isDS, ControlFlags flags, SecurityIdentifier owner, SecurityIdentifier group, SystemAcl systemAcl, DiscretionaryAcl discretionaryAcl)
        {
            if (systemAcl != null &&
                systemAcl.IsContainer != isContainer)
            {
                throw new ArgumentException(
                     isContainer ?
                        SR.AccessControl_MustSpecifyContainerAcl :
                        SR.AccessControl_MustSpecifyLeafObjectAcl,
nameof(systemAcl));
            }

            if (discretionaryAcl != null &&
                discretionaryAcl.IsContainer != isContainer)
            {
                throw new ArgumentException(
                     isContainer ?
                        SR.AccessControl_MustSpecifyContainerAcl :
                        SR.AccessControl_MustSpecifyLeafObjectAcl,
nameof(discretionaryAcl));
            }

            _isContainer = isContainer;

            if (systemAcl != null &&
                systemAcl.IsDS != isDS)
            {
                throw new ArgumentException(
                     isDS ?
                        SR.AccessControl_MustSpecifyDirectoryObjectAcl :
                        SR.AccessControl_MustSpecifyNonDirectoryObjectAcl,
nameof(systemAcl));
            }

            if (discretionaryAcl != null &&
                discretionaryAcl.IsDS != isDS)
            {
                throw new ArgumentException(
                    isDS ?
                        SR.AccessControl_MustSpecifyDirectoryObjectAcl :
                        SR.AccessControl_MustSpecifyNonDirectoryObjectAcl,
nameof(discretionaryAcl));
            }

            _isDS = isDS;

            _sacl = systemAcl;

            //
            // Replace null DACL with an allow-all for everyone DACL
            //

            if (discretionaryAcl == null)
            {
                //
                // to conform to native behavior, we will add allow everyone ace for DACL
                //

                discretionaryAcl = DiscretionaryAcl.CreateAllowEveryoneFullAccess(_isDS, _isContainer);
            }

            _dacl = discretionaryAcl;

            //
            // DACL is never null. So always set the flag bit on
            //

            ControlFlags actualFlags = flags | ControlFlags.DiscretionaryAclPresent;

            //
            // Keep SACL and the flag bit in sync.
            //

            if (systemAcl == null)
            {
                unchecked { actualFlags &= ~(ControlFlags.SystemAclPresent); }
            }
            else
            {
                actualFlags |= (ControlFlags.SystemAclPresent);
            }

            _rawSd = new RawSecurityDescriptor(actualFlags, owner, group, systemAcl == null ? null : systemAcl.RawAcl, discretionaryAcl.RawAcl);
        }

        //
        // Creates a security descriptor explicitly
        //

        public RawSecurityDescriptor(ControlFlags flags, SecurityIdentifier owner, SecurityIdentifier group, RawAcl systemAcl, RawAcl discretionaryAcl)
            : base()
        {
            CreateFromParts(flags, owner, group, systemAcl, discretionaryAcl);
        }

		public void SetDiscretionaryAclProtection (bool isProtected,
							   bool preserveInheritance)
		{
			DiscretionaryAcl.IsAefa = false;
			
			if (!isProtected) {
				flags &= ~ControlFlags.DiscretionaryAclProtected;
				return;
			}
			
			flags |= ControlFlags.DiscretionaryAclProtected;
			if (!preserveInheritance)
				DiscretionaryAcl.RemoveInheritedAces ();
		}

	// Set a control flag.
	private void SetControlFlag(ControlFlags mask, bool value)
			{
				if(value)
				{
					flags |= mask;
				}
				else
				{
					flags &= ~mask;
				}
			}

		public void SetFlags (ControlFlags flags)
		{
			control_flags = flags | ControlFlags.SelfRelative;
		}

 internal void RemoveControlFlags(ControlFlags flags)
 {
     unchecked
     {
         _rawSd.SetFlags(_rawSd.ControlFlags & ~flags);
     }
 }

		public void SetSystemAclProtection (bool isProtected,
						    bool preserveInheritance)
		{
			if (!isProtected) {
				flags &= ~ControlFlags.SystemAclProtected;
				return;
			}
			
			flags |= ControlFlags.SystemAclProtected;
			if (!preserveInheritance && SystemAcl != null)
				SystemAcl.RemoveInheritedAces ();
		}

		public void AddDiscretionaryAcl (byte revision, int trusted)
		{
			DiscretionaryAcl = new DiscretionaryAcl (IsContainer, IsDS, revision, trusted);
			flags |= ControlFlags.DiscretionaryAclPresent;
		}

        public void SetFlags(ControlFlags flags)
        {
            //
            // We can not deal with non-self-relative descriptors
            // so just forget about it
            //

            _flags = (flags | ControlFlags.SelfRelative);
        }

		public void AddSystemAcl(byte revision, int trusted)
		{
			SystemAcl = new SystemAcl (IsContainer, IsDS, revision, trusted);
			flags |= ControlFlags.SystemAclPresent;
		}

 private CommonSecurityDescriptor(bool isContainer, bool isDS, ControlFlags flags, SecurityIdentifier owner, SecurityIdentifier group, RawAcl systemAcl, RawAcl discretionaryAcl)
     : this(isContainer, isDS, flags, owner, group, systemAcl == null ? null : new SystemAcl(isContainer, isDS, systemAcl), discretionaryAcl == null ? null : new DiscretionaryAcl(isContainer, isDS, discretionaryAcl))
 {
 }