prefetch

package module
v0.0.0-...-338dbe6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 1, 2022 License: Apache-2.0 Imports: 10 Imported by: 4

README

Go prefetch parser.

This project is a parser for Microsoft prefetch files.

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	Prefetch_debug = false
)

Functions

func LZXpressHuffmanDecompress 

func LZXpressHuffmanDecompress(input []byte, output_size int) ([]byte, error)

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-frs2/8cb5bae9-edf3-4833-9f0a-9d7e24218d3d

func LZXpressHuffmanDecompressChunk 

func LZXpressHuffmanDecompressChunk(
	in_idx int,
	input []byte,
	out_idx int,
	output []byte,
	chunk_size int,
) (int, int, error)

func LZXpressHuffmanDecompressWithFallback 

func LZXpressHuffmanDecompressWithFallback(input []byte, output_size int) ([]byte, error)

Non windows systems fall back to build in decompression.

func ParseString 

func ParseString(reader io.ReaderAt, offset int64, length int64) string

func ParseTerminatedString 

func ParseTerminatedString(reader io.ReaderAt, offset int64) string

func ParseTerminatedUTF16String 

func ParseTerminatedUTF16String(reader io.ReaderAt, offset int64) string

func ParseUTF16String 

func ParseUTF16String(reader io.ReaderAt, offset int64, length int64) string

func ParseUint32 

func ParseUint32(reader io.ReaderAt, offset int64) uint32

func ParseUint64 

func ParseUint64(reader io.ReaderAt, offset int64) uint64

func PrefixCodeTreeAddLeaf 

func PrefixCodeTreeAddLeaf(
	treeNodes []PREFIX_CODE_NODE,
	leafIndex uint32,
	mask uint32,
	bits uint32) uint32

inout PREFIX_CODE_NODE treeNodes[1024]: A 1024 element 

PREFIX_CODE_NODE array that contains the Huffman prefix code
tree's nodes.

in ULONG leafIndex: The index in treeNodes of the node to link into the tree.

in ULONG mask: The symbol's prefix code.

in ULONG bits: The number of bits in the symbol's prefix code.

Return Value

Returns the index in treeNodes of the next node to be processed.

func PrefixCodeTreeDecodeSymbol 

func PrefixCodeTreeDecodeSymbol(bstr *BitStream, root *PREFIX_CODE_NODE) (
	uint32, error)

func Printf 

func Printf(fmt_str string, args ...interface{})

func UTF16BytesToUTF8 

func UTF16BytesToUTF8(b []byte, o binary.ByteOrder) string

Types

type BitStream 

type BitStream struct {
	// contains filtered or unexported fields
}

func NewBitStream 

func NewBitStream(in []byte, in_pos int) *BitStream

func (*BitStream) Lookup 

func (self *BitStream) Lookup(n uint32) uint32

func (*BitStream) Skip 

func (self *BitStream) Skip(n uint32) error

type Enumeration 

type Enumeration struct {
	Value uint64
	Name  string
}

func (Enumeration) DebugString 

func (self Enumeration) DebugString() string

type FileInformationVista 

type FileInformationVista struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewFileInformationVista 

func NewFileInformationVista(reader io.ReaderAt) *FileInformationVista

func (*FileInformationVista) DebugString 

func (self *FileInformationVista) DebugString() string

func (*FileInformationVista) FileMetricsOffset 

func (self *FileInformationVista) FileMetricsOffset() uint32

func (*FileInformationVista) FilenameOffset 

func (self *FileInformationVista) FilenameOffset() uint32

func (*FileInformationVista) FilenameSize 

func (self *FileInformationVista) FilenameSize() uint32

func (*FileInformationVista) Filenames 

func (self *FileInformationVista) Filenames() []string

func (*FileInformationVista) LastRunTime 

func (self *FileInformationVista) LastRunTime() *WinFileTime

func (*FileInformationVista) NumberOfFileMetrics 

func (self *FileInformationVista) NumberOfFileMetrics() uint32

func (*FileInformationVista) NumberOfTraceChains 

func (self *FileInformationVista) NumberOfTraceChains() uint32

func (*FileInformationVista) NumberOfVolumes 

func (self *FileInformationVista) NumberOfVolumes() uint32

func (*FileInformationVista) RunCount 

func (self *FileInformationVista) RunCount() uint32

func (*FileInformationVista) Size 

func (self *FileInformationVista) Size() int

func (*FileInformationVista) TraceChainsArrayOffset 

func (self *FileInformationVista) TraceChainsArrayOffset() uint32

func (*FileInformationVista) VolumesInformationOffset 

func (self *FileInformationVista) VolumesInformationOffset() uint32

func (*FileInformationVista) VolumesInformationSize 

func (self *FileInformationVista) VolumesInformationSize() uint32

type FileInformationWin10 

type FileInformationWin10 struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewFileInformationWin10 

func NewFileInformationWin10(reader io.ReaderAt) *FileInformationWin10

func (*FileInformationWin10) DebugString 

func (self *FileInformationWin10) DebugString() string

func (*FileInformationWin10) FileMetricsOffset 

func (self *FileInformationWin10) FileMetricsOffset() uint32

func (*FileInformationWin10) FilenameOffset 

func (self *FileInformationWin10) FilenameOffset() uint32

func (*FileInformationWin10) FilenameSize 

func (self *FileInformationWin10) FilenameSize() uint32

func (*FileInformationWin10) Filenames 

func (self *FileInformationWin10) Filenames() []string

func (*FileInformationWin10) LastRunTimes 

func (self *FileInformationWin10) LastRunTimes() []*WinFileTime

func (*FileInformationWin10) NumberOfFileMetrics 

func (self *FileInformationWin10) NumberOfFileMetrics() uint32

func (*FileInformationWin10) NumberOfTraceChains 

func (self *FileInformationWin10) NumberOfTraceChains() uint32

func (*FileInformationWin10) NumberOfVolumes 

func (self *FileInformationWin10) NumberOfVolumes() uint32

func (*FileInformationWin10) RunCount1 

func (self *FileInformationWin10) RunCount1() uint32

func (*FileInformationWin10) RunCount2 

func (self *FileInformationWin10) RunCount2() uint32

func (*FileInformationWin10) Size 

func (self *FileInformationWin10) Size() int

func (*FileInformationWin10) TraceChainsArrayOffset 

func (self *FileInformationWin10) TraceChainsArrayOffset() uint32

func (*FileInformationWin10) VolumesInformationOffset 

func (self *FileInformationWin10) VolumesInformationOffset() uint32

func (*FileInformationWin10) VolumesInformationSize 

func (self *FileInformationWin10) VolumesInformationSize() uint32

type FileInformationXP 

type FileInformationXP struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewFileInformationXP 

func NewFileInformationXP(reader io.ReaderAt) *FileInformationXP

func (*FileInformationXP) DebugString 

func (self *FileInformationXP) DebugString() string

func (*FileInformationXP) FileMetricsOffset 

func (self *FileInformationXP) FileMetricsOffset() uint32

func (*FileInformationXP) FilenameOffset 

func (self *FileInformationXP) FilenameOffset() uint32

func (*FileInformationXP) FilenameSize 

func (self *FileInformationXP) FilenameSize() uint32

func (*FileInformationXP) Filenames 

func (self *FileInformationXP) Filenames() []string

func (*FileInformationXP) LastRunTime 

func (self *FileInformationXP) LastRunTime() *WinFileTime

func (*FileInformationXP) NumberOfFileMetrics 

func (self *FileInformationXP) NumberOfFileMetrics() uint32

func (*FileInformationXP) NumberOfTraceChains 

func (self *FileInformationXP) NumberOfTraceChains() uint32

func (*FileInformationXP) NumberOfVolumes 

func (self *FileInformationXP) NumberOfVolumes() uint32

func (*FileInformationXP) RunCount 

func (self *FileInformationXP) RunCount() uint32

func (*FileInformationXP) Size 

func (self *FileInformationXP) Size() int

func (*FileInformationXP) TraceChainsArrayOffset 

func (self *FileInformationXP) TraceChainsArrayOffset() uint32

func (*FileInformationXP) VolumesInformationOffset 

func (self *FileInformationXP) VolumesInformationOffset() uint32

func (*FileInformationXP) VolumesInformationSize 

func (self *FileInformationXP) VolumesInformationSize() uint32

type FileMetricsEntryV17 

type FileMetricsEntryV17 struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewFileMetricsEntryV17 

func NewFileMetricsEntryV17(reader io.ReaderAt) *FileMetricsEntryV17

func (*FileMetricsEntryV17) DebugString 

func (self *FileMetricsEntryV17) DebugString() string

func (*FileMetricsEntryV17) FilenameLength 

func (self *FileMetricsEntryV17) FilenameLength() uint32

func (*FileMetricsEntryV17) FilenameOffset 

func (self *FileMetricsEntryV17) FilenameOffset() uint32

func (*FileMetricsEntryV17) Size 

func (self *FileMetricsEntryV17) Size() int

type FileMetricsEntryV30 

type FileMetricsEntryV30 struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewFileMetricsEntryV30 

func NewFileMetricsEntryV30(reader io.ReaderAt) *FileMetricsEntryV30

func (*FileMetricsEntryV30) DebugString 

func (self *FileMetricsEntryV30) DebugString() string

func (*FileMetricsEntryV30) FilenameLength 

func (self *FileMetricsEntryV30) FilenameLength() uint32

func (*FileMetricsEntryV30) FilenameOffset 

func (self *FileMetricsEntryV30) FilenameOffset() uint32

func (*FileMetricsEntryV30) MFTFileReference 

func (self *FileMetricsEntryV30) MFTFileReference() uint64

func (*FileMetricsEntryV30) Size 

func (self *FileMetricsEntryV30) Size() int

type MAMHeader 

type MAMHeader struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewMAMHeader 

func NewMAMHeader(reader io.ReaderAt) *MAMHeader

func (*MAMHeader) DebugString 

func (self *MAMHeader) DebugString() string

func (*MAMHeader) Signature 

func (self *MAMHeader) Signature() string

func (*MAMHeader) Size 

func (self *MAMHeader) Size() int

func (*MAMHeader) UncompressedSize 

func (self *MAMHeader) UncompressedSize() uint32

type PREFIX_CODE_NODE 

type PREFIX_CODE_NODE struct {
	// contains filtered or unexported fields
}

func PrefixCodeTreeRebuild 

func PrefixCodeTreeRebuild(input []byte) *PREFIX_CODE_NODE

func (PREFIX_CODE_NODE) String 

func (self PREFIX_CODE_NODE) String() string

type PREFIX_CODE_SYMBOL 

type PREFIX_CODE_SYMBOL struct {
	// contains filtered or unexported fields
}

func (PREFIX_CODE_SYMBOL) String 

func (self PREFIX_CODE_SYMBOL) String() string

type PrefetchInfo 

type PrefetchInfo struct {
	Executable    string      `json:"Executable"`
	FileSize      uint32      `json:"FileSize"`
	Hash          string      `json:"Hash"`
	Version       string      `json:"Version"`
	LastRunTimes  []time.Time `json:"LastRunTimes"`
	FilesAccessed []string    `json:"FilesAccessed"`
	RunCount      uint32      `json:"RunCount"`
}

func LoadPrefetch 

func LoadPrefetch(reader io.ReaderAt) (*PrefetchInfo, error)

type PrefetchProfile 

type PrefetchProfile struct {
	Off_FileInformationVista_FileMetricsOffset        int64
	Off_FileInformationVista_FilenameOffset           int64
	Off_FileInformationVista_FilenameSize             int64
	Off_FileInformationVista_LastRunTime              int64
	Off_FileInformationVista_NumberOfFileMetrics      int64
	Off_FileInformationVista_NumberOfTraceChains      int64
	Off_FileInformationVista_NumberOfVolumes          int64
	Off_FileInformationVista_RunCount                 int64
	Off_FileInformationVista_TraceChainsArrayOffset   int64
	Off_FileInformationVista_VolumesInformationOffset int64
	Off_FileInformationVista_VolumesInformationSize   int64
	Off_FileInformationWin10_FileMetricsOffset        int64
	Off_FileInformationWin10_FilenameOffset           int64
	Off_FileInformationWin10_FilenameSize             int64
	Off_FileInformationWin10_LastRunTimes             int64
	Off_FileInformationWin10_NumberOfFileMetrics      int64
	Off_FileInformationWin10_NumberOfTraceChains      int64
	Off_FileInformationWin10_NumberOfVolumes          int64
	Off_FileInformationWin10_RunCount1                int64
	Off_FileInformationWin10_RunCount2                int64
	Off_FileInformationWin10_TraceChainsArrayOffset   int64
	Off_FileInformationWin10_VolumesInformationOffset int64
	Off_FileInformationWin10_VolumesInformationSize   int64
	Off_FileInformationXP_FileMetricsOffset           int64
	Off_FileInformationXP_FilenameOffset              int64
	Off_FileInformationXP_FilenameSize                int64
	Off_FileInformationXP_LastRunTime                 int64
	Off_FileInformationXP_NumberOfFileMetrics         int64
	Off_FileInformationXP_NumberOfTraceChains         int64
	Off_FileInformationXP_NumberOfVolumes             int64
	Off_FileInformationXP_RunCount                    int64
	Off_FileInformationXP_TraceChainsArrayOffset      int64
	Off_FileInformationXP_VolumesInformationOffset    int64
	Off_FileInformationXP_VolumesInformationSize      int64
	Off_FileMetricsEntryV17_FilenameLength            int64
	Off_FileMetricsEntryV17_FilenameOffset            int64
	Off_FileMetricsEntryV30_FilenameLength            int64
	Off_FileMetricsEntryV30_FilenameOffset            int64
	Off_FileMetricsEntryV30_MFTFileReference          int64
	Off_MAMHeader_Signature                           int64
	Off_MAMHeader_UncompressedSize                    int64
	Off_SCCAHeader_Executable                         int64
	Off_SCCAHeader_FileSize                           int64
	Off_SCCAHeader_Hash                               int64
	Off_SCCAHeader_Signature                          int64
	Off_SCCAHeader_Version                            int64
}

func NewPrefetchProfile 

func NewPrefetchProfile() *PrefetchProfile

func (*PrefetchProfile) FileInformationVista 

func (self *PrefetchProfile) FileInformationVista(reader io.ReaderAt, offset int64) *FileInformationVista

func (*PrefetchProfile) FileInformationWin10 

func (self *PrefetchProfile) FileInformationWin10(reader io.ReaderAt, offset int64) *FileInformationWin10

func (*PrefetchProfile) FileInformationXP 

func (self *PrefetchProfile) FileInformationXP(reader io.ReaderAt, offset int64) *FileInformationXP

func (*PrefetchProfile) FileMetricsEntryV17 

func (self *PrefetchProfile) FileMetricsEntryV17(reader io.ReaderAt, offset int64) *FileMetricsEntryV17

func (*PrefetchProfile) FileMetricsEntryV30 

func (self *PrefetchProfile) FileMetricsEntryV30(reader io.ReaderAt, offset int64) *FileMetricsEntryV30

func (*PrefetchProfile) MAMHeader 

func (self *PrefetchProfile) MAMHeader(reader io.ReaderAt, offset int64) *MAMHeader

func (*PrefetchProfile) SCCAHeader 

func (self *PrefetchProfile) SCCAHeader(reader io.ReaderAt, offset int64) *SCCAHeader

func (*PrefetchProfile) WinFileTime 

func (self *PrefetchProfile) WinFileTime(reader io.ReaderAt, offset int64) *WinFileTime

type SCCAHeader 

type SCCAHeader struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *PrefetchProfile
}

func NewSCCAHeader 

func NewSCCAHeader(reader io.ReaderAt) *SCCAHeader

func (*SCCAHeader) DebugString 

func (self *SCCAHeader) DebugString() string

func (*SCCAHeader) Executable 

func (self *SCCAHeader) Executable() string

func (*SCCAHeader) FileSize 

func (self *SCCAHeader) FileSize() uint32

func (*SCCAHeader) Hash 

func (self *SCCAHeader) Hash() uint32

func (*SCCAHeader) Signature 

func (self *SCCAHeader) Signature() string

func (*SCCAHeader) Size 

func (self *SCCAHeader) Size() int

func (*SCCAHeader) Version 

func (self *SCCAHeader) Version() *Enumeration

type WinFileTime 

type WinFileTime struct {
	time.Time
}

A WinFileTime object is a timestamp in windows filetime format.

func ParseArray_WinFileTime 

func ParseArray_WinFileTime(profile *PrefetchProfile, reader io.ReaderAt, offset int64, count int) []*WinFileTime

func (*WinFileTime) DebugString 

func (self *WinFileTime) DebugString() string

func (*WinFileTime) GoString 

func (self *WinFileTime) GoString() string

func (*WinFileTime) Size 

func (self *WinFileTime) Size() int

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.