appcompatcache

README

Code was generated using the binparsegen project: https://github.com/Velocidex/binparsergen

References: https://github.com/libyal/winreg-kb/blob/master/documentation/Application%20Compatibility%20Cache%20key.asciidoc

Documentation

Index

• func ParseTerminatedUTF16String(reader io.ReaderAt, offset int64) string
• func ParseUTF16String(reader io.ReaderAt, offset int64, length int64) string
• func ParseUint16(reader io.ReaderAt, offset int64) uint16
• func ParseUint32(reader io.ReaderAt, offset int64) uint32
• func ParseUint64(reader io.ReaderAt, offset int64) uint64
• func UTF16BytesToUTF8(b []byte, o binary.ByteOrder) string
• type AppCompatibilityProfile
  • func NewAppCompatibilityProfile() *AppCompatibilityProfile
  • func (self *AppCompatibilityProfile) Win10CreatorsEntry(reader io.ReaderAt, offset int64) *Win10CreatorsEntry
  • func (self *AppCompatibilityProfile) Win10CreatorsHeader(reader io.ReaderAt, offset int64) *Win10CreatorsHeader
• type CacheEntry
  • func ParseValueData(buffer []byte) []*CacheEntry
• type Win10CreatorsEntry
  • func NewWin10CreatorsEntry(reader io.ReaderAt) *Win10CreatorsEntry
  • func (self *Win10CreatorsEntry) DataSize() uint32
  • func (self *Win10CreatorsEntry) DebugString() string
  • func (self *Win10CreatorsEntry) IsValidSignature() bool
  • func (self *Win10CreatorsEntry) LastMod(header *Win10CreatorsHeader) uint64
  • func (self *Win10CreatorsEntry) Next() *Win10CreatorsEntry
  • func (self *Win10CreatorsEntry) Path() string
  • func (self *Win10CreatorsEntry) PathSize() uint16
  • func (self *Win10CreatorsEntry) Path__() string
  • func (self *Win10CreatorsEntry) Signature() uint32
  • func (self *Win10CreatorsEntry) Size() int
• type Win10CreatorsHeader
  • func NewWin10CreatorsHeader(reader io.ReaderAt) *Win10CreatorsHeader
  • func (self *Win10CreatorsHeader) DebugString() string
  • func (self *Win10CreatorsHeader) HeaderSize() uint32
  • func (self *Win10CreatorsHeader) NumberOfEntries() uint32
  • func (self *Win10CreatorsHeader) Size() int

Functions

func ParseTerminatedUTF16String

func ParseTerminatedUTF16String(reader io.ReaderAt, offset int64) string

func ParseUTF16String

func ParseUTF16String(reader io.ReaderAt, offset int64, length int64) string

func ParseUint16

func ParseUint16(reader io.ReaderAt, offset int64) uint16

func ParseUint32

func ParseUint32(reader io.ReaderAt, offset int64) uint32

func ParseUint64

func ParseUint64(reader io.ReaderAt, offset int64) uint64

func UTF16BytesToUTF8

func UTF16BytesToUTF8(b []byte, o binary.ByteOrder) string

Types

type AppCompatibilityProfile

type AppCompatibilityProfile struct {
	Off_Win10CreatorsEntry_DataSize         int64
	Off_Win10CreatorsEntry_PathSize         int64
	Off_Win10CreatorsEntry_Path__           int64
	Off_Win10CreatorsEntry_Signature        int64
	Off_Win10CreatorsEntry__XXXX            int64
	Off_Win10CreatorsHeader_HeaderSize      int64
	Off_Win10CreatorsHeader_NumberOfEntries int64
}

func NewAppCompatibilityProfile

func NewAppCompatibilityProfile() *AppCompatibilityProfile

func (*AppCompatibilityProfile) Win10CreatorsEntry

func (self *AppCompatibilityProfile) Win10CreatorsEntry(reader io.ReaderAt, offset int64) *Win10CreatorsEntry

func (*AppCompatibilityProfile) Win10CreatorsHeader

func (self *AppCompatibilityProfile) Win10CreatorsHeader(reader io.ReaderAt, offset int64) *Win10CreatorsHeader

type CacheEntry

type CacheEntry struct {
	Name  string    `json:"name"`
	Epoch uint64    `json:"epoch"`
	Time  time.Time `json:"time"`
}

func ParseValueData

func ParseValueData(buffer []byte) []*CacheEntry

type Win10CreatorsEntry

type Win10CreatorsEntry struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *AppCompatibilityProfile
}

func NewWin10CreatorsEntry

func NewWin10CreatorsEntry(reader io.ReaderAt) *Win10CreatorsEntry

func (*Win10CreatorsEntry) DataSize

func (self *Win10CreatorsEntry) DataSize() uint32

func (*Win10CreatorsEntry) DebugString

func (self *Win10CreatorsEntry) DebugString() string

func (*Win10CreatorsEntry) IsValidSignature

func (self *Win10CreatorsEntry) IsValidSignature() bool

func (*Win10CreatorsEntry) LastMod

func (self *Win10CreatorsEntry) LastMod(header *Win10CreatorsHeader) uint64

func (*Win10CreatorsEntry) Next

func (self *Win10CreatorsEntry) Next() *Win10CreatorsEntry

func (*Win10CreatorsEntry) Path

func (self *Win10CreatorsEntry) Path() string

func (*Win10CreatorsEntry) PathSize

func (self *Win10CreatorsEntry) PathSize() uint16

func (*Win10CreatorsEntry) Path__

func (self *Win10CreatorsEntry) Path__() string

func (*Win10CreatorsEntry) Signature

func (self *Win10CreatorsEntry) Signature() uint32

func (*Win10CreatorsEntry) Size

func (self *Win10CreatorsEntry) Size() int

type Win10CreatorsHeader

type Win10CreatorsHeader struct {
	Reader  io.ReaderAt
	Offset  int64
	Profile *AppCompatibilityProfile
}

func NewWin10CreatorsHeader

func NewWin10CreatorsHeader(reader io.ReaderAt) *Win10CreatorsHeader

func (*Win10CreatorsHeader) DebugString

func (self *Win10CreatorsHeader) DebugString() string

func (*Win10CreatorsHeader) HeaderSize

func (self *Win10CreatorsHeader) HeaderSize() uint32

func (*Win10CreatorsHeader) NumberOfEntries

func (self *Win10CreatorsHeader) NumberOfEntries() uint32

func (*Win10CreatorsHeader) Size

func (self *Win10CreatorsHeader) Size() int