This repository has been archived by the owner on Apr 7, 2020. It is now read-only.
forked from Velocidex/go-prefetch
-
Notifications
You must be signed in to change notification settings - Fork 0
/
file_metrics.go
64 lines (49 loc) · 1.7 KB
/
file_metrics.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
package prefetch
func (self *FileInformationWin10) Filenames() []string {
result := []string{}
start_of_strings_table := self.FilenameOffset()
file_metrics_offset := int64(self.FileMetricsOffset())
for i := uint32(0); i < self.NumberOfFileMetrics(); i++ {
metric := self.Profile.FileMetricsEntryV30(
self.Reader, file_metrics_offset)
filename := ParseUTF16String(
self.Reader,
int64(start_of_strings_table+metric.FilenameOffset()),
int64(metric.FilenameLength()*2))
result = append(result, filename)
file_metrics_offset += int64(metric.Size())
}
return result
}
func (self *FileInformationVista) Filenames() []string {
result := []string{}
start_of_strings_table := self.FilenameOffset()
file_metrics_offset := int64(self.FileMetricsOffset())
for i := uint32(0); i < self.NumberOfFileMetrics(); i++ {
metric := self.Profile.FileMetricsEntryV30(
self.Reader, file_metrics_offset)
filename := ParseUTF16String(
self.Reader,
int64(start_of_strings_table+metric.FilenameOffset()),
int64(metric.FilenameLength()*2))
result = append(result, filename)
file_metrics_offset += int64(metric.Size())
}
return result
}
func (self *FileInformationXP) Filenames() []string {
result := []string{}
start_of_strings_table := self.FilenameOffset()
file_metrics_offset := int64(self.FileMetricsOffset())
for i := uint32(0); i < self.NumberOfFileMetrics(); i++ {
metric := self.Profile.FileMetricsEntryV17(
self.Reader, file_metrics_offset)
filename := ParseUTF16String(
self.Reader,
int64(start_of_strings_table+metric.FilenameOffset()),
int64(metric.FilenameLength()*2))
result = append(result, filename)
file_metrics_offset += int64(metric.Size())
}
return result
}