This repository has been archived by the owner on Apr 7, 2020. It is now read-only.
forked from Velocidex/go-prefetch
-
Notifications
You must be signed in to change notification settings - Fork 0
/
profile_vtypes.json
81 lines (73 loc) · 2.62 KB
/
profile_vtypes.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
{
"MAMHeader": [8, {
"Signature": [0, ["String", {"length": 4}]],
"UncompressedSize": [4, ["unsigned long"]]
}],
"SCCAHeader": [84, {
"Version": [0, ["Enumeration", {
"choices": {
"17": "WinXP",
"23": "Vista",
"26": "Win8.1",
"30": "Win10"
},
"target": "unsigned long"
}]],
"Signature": [4,["String", {"length": 4}]],
"FileSize": [12, ["unsigned long"]],
"Executable": [16, ["UnicodeString"]],
"Hash": [76, ["unsigned long"]]
}],
"FileInformationWin10": [224, {
"FileMetricsOffset": [0, ["unsigned long"]],
"NumberOfFileMetrics": [4, ["unsigned long"]],
"TraceChainsArrayOffset": [8, ["unsigned long"]],
"NumberOfTraceChains": [12, ["unsigned long"]],
"FilenameOffset":[16, ["unsigned long"]],
"FilenameSize": [20, ["unsigned long"]],
"VolumesInformationOffset": [24, ["unsigned long"]],
"NumberOfVolumes": [28, ["unsigned long"]],
"VolumesInformationSize": [32, ["unsigned long"]],
"LastRunTimes": [44, ["Array", {
"target": "WinFileTime",
"count": 8
}]],
"RunCount1": [124, ["unsigned long"]],
"RunCount2": [116, ["unsigned long"]]
}],
"FileMetricsEntryV30": [32, {
"FilenameOffset": [12, ["unsigned long"]],
"FilenameLength": [16, ["unsigned long"]],
"MFTFileReference": [24, ["unsigned long long"]]
}],
"FileMetricsEntryV17": [20, {
"FilenameOffset": [8, ["unsigned long"]],
"FilenameLength": [12, ["unsigned long"]]
}],
"FileInformationVista": [156, {
"FileMetricsOffset": [0, ["unsigned long"]],
"NumberOfFileMetrics": [4, ["unsigned long"]],
"TraceChainsArrayOffset": [8, ["unsigned long"]],
"NumberOfTraceChains": [12, ["unsigned long"]],
"FilenameOffset":[16, ["unsigned long"]],
"FilenameSize": [20, ["unsigned long"]],
"VolumesInformationOffset": [24, ["unsigned long"]],
"NumberOfVolumes": [28, ["unsigned long"]],
"VolumesInformationSize": [32, ["unsigned long"]],
"LastRunTime": [44, ["WinFileTime"]],
"RunCount": [68, ["unsigned long"]]
}],
"FileInformationXP": [68, {
"FileMetricsOffset": [0, ["unsigned long"]],
"NumberOfFileMetrics": [4, ["unsigned long"]],
"TraceChainsArrayOffset": [8, ["unsigned long"]],
"NumberOfTraceChains": [12, ["unsigned long"]],
"FilenameOffset":[16, ["unsigned long"]],
"FilenameSize": [20, ["unsigned long"]],
"VolumesInformationOffset": [24, ["unsigned long"]],
"NumberOfVolumes": [28, ["unsigned long"]],
"VolumesInformationSize": [32, ["unsigned long"]],
"LastRunTime": [36, ["WinFileTime"]],
"RunCount": [60, ["unsigned long"]]
}]
}