Versions in this module Expand all Collapse all v0 v0.2.1 Apr 5, 2020 Changes in this version + var Prefetch_debug = false + func LZXpressHuffmanDecompress(input []byte, output_size int) ([]byte, error) + func LZXpressHuffmanDecompressChunk(in_idx int, input []byte, out_idx int, output []byte, chunk_size int) (int, int, error) + func ParseString(reader io.ReaderAt, offset int64, length int64) string + func ParseTerminatedString(reader io.ReaderAt, offset int64) string + func ParseTerminatedUTF16String(reader io.ReaderAt, offset int64) string + func ParseUTF16String(reader io.ReaderAt, offset int64, length int64) string + func ParseUint32(reader io.ReaderAt, offset int64) uint32 + func ParseUint64(reader io.ReaderAt, offset int64) uint64 + func PrefixCodeTreeAddLeaf(treeNodes []PREFIX_CODE_NODE, leafIndex int, mask uint32, bits uint32) int + func PrefixCodeTreeDecodeSymbol(bstr *BitStream, root *PREFIX_CODE_NODE) (uint32, error) + func Printf(fmt_str string, args ...interface{}) + func UTF16BytesToUTF8(b []byte, o binary.ByteOrder) string + type BitStream struct + func NewBitStream(in []byte, in_pos int) *BitStream + func (self *BitStream) Lookup(n uint32) uint32 + func (self *BitStream) Skip(n uint32) error + type Enumeration struct + Name string + Value uint64 + func (self Enumeration) DebugString() string + type FileInformationVista struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewFileInformationVista(reader io.ReaderAt) *FileInformationVista + func (self *FileInformationVista) DebugString() string + func (self *FileInformationVista) FileMetricsOffset() uint32 + func (self *FileInformationVista) FilenameOffset() uint32 + func (self *FileInformationVista) FilenameSize() uint32 + func (self *FileInformationVista) Filenames() []string + func (self *FileInformationVista) LastRunTime() *WinFileTime + func (self *FileInformationVista) NumberOfFileMetrics() uint32 + func (self *FileInformationVista) NumberOfTraceChains() uint32 + func (self *FileInformationVista) NumberOfVolumes() uint32 + func (self *FileInformationVista) RunCount() uint32 + func (self *FileInformationVista) Size() int + func (self *FileInformationVista) TraceChainsArrayOffset() uint32 + func (self *FileInformationVista) VolumesInformationOffset() uint32 + func (self *FileInformationVista) VolumesInformationSize() uint32 + type FileInformationWin10 struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewFileInformationWin10(reader io.ReaderAt) *FileInformationWin10 + func (self *FileInformationWin10) DebugString() string + func (self *FileInformationWin10) FileMetricsOffset() uint32 + func (self *FileInformationWin10) FilenameOffset() uint32 + func (self *FileInformationWin10) FilenameSize() uint32 + func (self *FileInformationWin10) Filenames() []string + func (self *FileInformationWin10) LastRunTimes() []*WinFileTime + func (self *FileInformationWin10) NumberOfFileMetrics() uint32 + func (self *FileInformationWin10) NumberOfTraceChains() uint32 + func (self *FileInformationWin10) NumberOfVolumes() uint32 + func (self *FileInformationWin10) RunCount1() uint32 + func (self *FileInformationWin10) RunCount2() uint32 + func (self *FileInformationWin10) Size() int + func (self *FileInformationWin10) TraceChainsArrayOffset() uint32 + func (self *FileInformationWin10) VolumesInformationOffset() uint32 + func (self *FileInformationWin10) VolumesInformationSize() uint32 + type FileInformationXP struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewFileInformationXP(reader io.ReaderAt) *FileInformationXP + func (self *FileInformationXP) DebugString() string + func (self *FileInformationXP) FileMetricsOffset() uint32 + func (self *FileInformationXP) FilenameOffset() uint32 + func (self *FileInformationXP) FilenameSize() uint32 + func (self *FileInformationXP) Filenames() []string + func (self *FileInformationXP) LastRunTime() *WinFileTime + func (self *FileInformationXP) NumberOfFileMetrics() uint32 + func (self *FileInformationXP) NumberOfTraceChains() uint32 + func (self *FileInformationXP) NumberOfVolumes() uint32 + func (self *FileInformationXP) RunCount() uint32 + func (self *FileInformationXP) Size() int + func (self *FileInformationXP) TraceChainsArrayOffset() uint32 + func (self *FileInformationXP) VolumesInformationOffset() uint32 + func (self *FileInformationXP) VolumesInformationSize() uint32 + type FileMetricsEntryV17 struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewFileMetricsEntryV17(reader io.ReaderAt) *FileMetricsEntryV17 + func (self *FileMetricsEntryV17) DebugString() string + func (self *FileMetricsEntryV17) FilenameLength() uint32 + func (self *FileMetricsEntryV17) FilenameOffset() uint32 + func (self *FileMetricsEntryV17) Size() int + type FileMetricsEntryV30 struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewFileMetricsEntryV30(reader io.ReaderAt) *FileMetricsEntryV30 + func (self *FileMetricsEntryV30) DebugString() string + func (self *FileMetricsEntryV30) FilenameLength() uint32 + func (self *FileMetricsEntryV30) FilenameOffset() uint32 + func (self *FileMetricsEntryV30) MFTFileReference() uint64 + func (self *FileMetricsEntryV30) Size() int + type MAMHeader struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewMAMHeader(reader io.ReaderAt) *MAMHeader + func (self *MAMHeader) DebugString() string + func (self *MAMHeader) Signature() string + func (self *MAMHeader) Size() int + func (self *MAMHeader) UncompressedSize() uint32 + type PREFIX_CODE_NODE struct + func PrefixCodeTreeRebuild(input []byte) *PREFIX_CODE_NODE + func (self PREFIX_CODE_NODE) String() string + type PREFIX_CODE_SYMBOL struct + func (self PREFIX_CODE_SYMBOL) String() string + type PrefetchInfo struct + Executable string + FileSize uint32 + FilesAccessed []string + Hash string + LastRunTimes []time.Time + RunCount uint32 + Version string + func LoadPrefetch(reader io.ReaderAt) (*PrefetchInfo, error) + type PrefetchProfile struct + Off_FileInformationVista_FileMetricsOffset int64 + Off_FileInformationVista_FilenameOffset int64 + Off_FileInformationVista_FilenameSize int64 + Off_FileInformationVista_LastRunTime int64 + Off_FileInformationVista_NumberOfFileMetrics int64 + Off_FileInformationVista_NumberOfTraceChains int64 + Off_FileInformationVista_NumberOfVolumes int64 + Off_FileInformationVista_RunCount int64 + Off_FileInformationVista_TraceChainsArrayOffset int64 + Off_FileInformationVista_VolumesInformationOffset int64 + Off_FileInformationVista_VolumesInformationSize int64 + Off_FileInformationWin10_FileMetricsOffset int64 + Off_FileInformationWin10_FilenameOffset int64 + Off_FileInformationWin10_FilenameSize int64 + Off_FileInformationWin10_LastRunTimes int64 + Off_FileInformationWin10_NumberOfFileMetrics int64 + Off_FileInformationWin10_NumberOfTraceChains int64 + Off_FileInformationWin10_NumberOfVolumes int64 + Off_FileInformationWin10_RunCount1 int64 + Off_FileInformationWin10_RunCount2 int64 + Off_FileInformationWin10_TraceChainsArrayOffset int64 + Off_FileInformationWin10_VolumesInformationOffset int64 + Off_FileInformationWin10_VolumesInformationSize int64 + Off_FileInformationXP_FileMetricsOffset int64 + Off_FileInformationXP_FilenameOffset int64 + Off_FileInformationXP_FilenameSize int64 + Off_FileInformationXP_LastRunTime int64 + Off_FileInformationXP_NumberOfFileMetrics int64 + Off_FileInformationXP_NumberOfTraceChains int64 + Off_FileInformationXP_NumberOfVolumes int64 + Off_FileInformationXP_RunCount int64 + Off_FileInformationXP_TraceChainsArrayOffset int64 + Off_FileInformationXP_VolumesInformationOffset int64 + Off_FileInformationXP_VolumesInformationSize int64 + Off_FileMetricsEntryV17_FilenameLength int64 + Off_FileMetricsEntryV17_FilenameOffset int64 + Off_FileMetricsEntryV30_FilenameLength int64 + Off_FileMetricsEntryV30_FilenameOffset int64 + Off_FileMetricsEntryV30_MFTFileReference int64 + Off_MAMHeader_Signature int64 + Off_MAMHeader_UncompressedSize int64 + Off_SCCAHeader_Executable int64 + Off_SCCAHeader_FileSize int64 + Off_SCCAHeader_Hash int64 + Off_SCCAHeader_Signature int64 + Off_SCCAHeader_Version int64 + func NewPrefetchProfile() *PrefetchProfile + func (self *PrefetchProfile) FileInformationVista(reader io.ReaderAt, offset int64) *FileInformationVista + func (self *PrefetchProfile) FileInformationWin10(reader io.ReaderAt, offset int64) *FileInformationWin10 + func (self *PrefetchProfile) FileInformationXP(reader io.ReaderAt, offset int64) *FileInformationXP + func (self *PrefetchProfile) FileMetricsEntryV17(reader io.ReaderAt, offset int64) *FileMetricsEntryV17 + func (self *PrefetchProfile) FileMetricsEntryV30(reader io.ReaderAt, offset int64) *FileMetricsEntryV30 + func (self *PrefetchProfile) MAMHeader(reader io.ReaderAt, offset int64) *MAMHeader + func (self *PrefetchProfile) SCCAHeader(reader io.ReaderAt, offset int64) *SCCAHeader + func (self *PrefetchProfile) WinFileTime(reader io.ReaderAt, offset int64) *WinFileTime + type SCCAHeader struct + Offset int64 + Profile *PrefetchProfile + Reader io.ReaderAt + func NewSCCAHeader(reader io.ReaderAt) *SCCAHeader + func (self *SCCAHeader) DebugString() string + func (self *SCCAHeader) Executable() string + func (self *SCCAHeader) FileSize() uint32 + func (self *SCCAHeader) Hash() uint32 + func (self *SCCAHeader) Signature() string + func (self *SCCAHeader) Size() int + func (self *SCCAHeader) Version() *Enumeration + type WinFileTime struct + func ParseArray_WinFileTime(profile *PrefetchProfile, reader io.ReaderAt, offset int64, count int) []*WinFileTime + func (self *WinFileTime) DebugString() string + func (self *WinFileTime) GoString() string + func (self *WinFileTime) Size() int