data_structures

import "github.com/TheManticoreProject/Manticore/windows/ms_dtyp/common/data_structures"

const UnixTimestampIn100NsIntervals int64 = 116444736000000000

type EVENT_DESCRIPTOR struct {
    Id      data_types.USHORT
    Version data_types.UCHAR
    Channel data_types.UCHAR
    Level   data_types.UCHAR
    Opcode  data_types.UCHAR
    Task    data_types.USHORT
    Keyword data_types.ULONGLONG
}

type EVENT_HEADER struct {
    Size            data_types.USHORT
    HeaderType      data_types.USHORT
    Flags           data_types.USHORT
    EventProperty   data_types.USHORT
    ThreadId        data_types.ULONG
    ProcessId       data_types.ULONG
    TimeStamp       LARGE_INTEGER
    ProviderId      GUID
    EventDescriptor EVENT_DESCRIPTOR
    KernelTime      data_types.ULONG
    UserTime        data_types.ULONG
    ProcessorTime   data_types.ULONG64
    ActivityId      GUID
}

type FILETIME struct {
    // dwLowDateTime: A 32-bit unsigned integer that contains the low-order bits of the file time.
    DwLowDateTime uint32
    // dwHighDateTime: A 32-bit unsigned integer that contains the high-order bits of the file time.
    DwHighDateTime uint32
}

func NewFILETIMEFromTime(t time.Time) *FILETIME

func (ft *FILETIME) GetTime() time.Time

func (ft *FILETIME) GetTimeString() string

func (ft *FILETIME) GetUnixTimestamp() int64

func (ft *FILETIME) Marshal() ([]byte, error)

func (ft *FILETIME) String() string

func (ft *FILETIME) ToInt64() int64

func (ft *FILETIME) Unmarshal(data []byte) (int, error)

type GUID = guid.GUID

type LARGE_INTEGER struct {
    QuadPart data_types.ULONGLONG
}

type LCID = data_types.DWORD

type LPSERVER_INFO_100 *SERVER_INFO_100

type LUID struct {
    // LowPart: The low-order bits of the structure.
    LowPart data_types.DWORD
    // HighPart: The high-order bits of the structure.
    HighPart data_types.LONG
}

type MULTI_SZ struct {
    // Value: A data buffer, which is a string literal containing multiple null-terminated strings serially.
    Value data_types.WCHAR
    // NChar: The length, in characters, including the two terminating nulls.
    NChar data_types.DWORD
}

type OBJECT_TYPE_LIST struct {
    // Level: Specifies the level of the object type in the hierarchy of an object and its sub-objects. Level zero
    // indicates the object itself. Level one indicates a sub-object of the object, such as a property set. Level two
    // indicates a sub-object of the level one sub-object, such as a property. There can be a maximum of five levels
    // numbered zero through four.
    Level data_types.WORD
    // Remaining: Remaining access bits for this element, used by the access check algorithm, as specified in section 2.5.3.2.
    Remaining data_types.UINT32 // data_types.ACCESS_MASK
    // ObjectType: A pointer to the GUID for the object or sub-object.
    ObjectType *GUID
}

type PEVENT_HEADER *EVENT_HEADER

type PLARGE_INTEGER *LARGE_INTEGER

type PLUID *LUID

type PMULTI_SZ *MULTI_SZ

type POBJECT_TYPE_LIST *OBJECT_TYPE_LIST

type PRPC_UNICODE_STRING *RPC_UNICODE_STRING

type PSERVER_INFO_100 *SERVER_INFO_100

type PSYSTEMTIME *SYSTEMTIME

type PUINT128 *UINT128

type PULARGE_INTEGER *ULARGE_INTEGER

type RPC_UNICODE_STRING struct {
    // Length: The length, in bytes, of the string pointed to by the Buffer member.
    // The length MUST be a multiple of 2. The length MUST equal the entire size of the buffer.
    Length data_types.WORD
    // MaximumLength: The maximum size, in bytes, of the string pointed to by Buffer. The size MUST be a multiple of 2.
    // If not, the size MUST be decremented by 1 prior to use. This value MUST not be less than Length.
    MaximumLength data_types.WORD
    // Buffer: A pointer to a string buffer. The string pointed to by the buffer member MUST NOT include a terminating null character.
    Buffer data_types.WCHAR
}

type SERVER_INFO_100 struct {
    // Sv100PlatformId: The platform ID.
    Sv100PlatformId data_types.DWORD
    // Sv100Name: The server name.
    Sv100Name data_types.WCHAR
}

type SERVER_INFO_101 struct {
    // sv101_platform_id: Specifies the information level to use for platform-specific information.
    Sv101PlatformId data_types.DWORD
    // sv101_name: A pointer to a null-terminated Unicode UTF-16 Internet host name or NetBIOS host name of a server.
    Sv101Name data_types.STRING
    // sv101_version_major: Specifies the major release version number of the operating system. The server MUST set this
    // field to an implementation-specific major release version number that corresponds to the host operating system as
    // specified in the following table.
    Sv101VersionMajor data_types.DWORD
    // sv101_version_minor: Specifies the minor release version number of the operating system. The server MUST set this
    // field to an implementation-specific minor release version number that corresponds to the host operating system as
    // specified in the following table.
    Sv101VersionMinor data_types.DWORD
    // sv101_version_type: The sv101_version_type field specifies the SV_TYPE flags, which indicate the software services
    // that are available (but not necessarily running) on the server. This member MUST be a combination of one or more of
    // the following values.
    Sv101VersionType data_types.DWORD
    // sv101_comment: A pointer to a null-terminated Unicode UTF-16 string that specifies a comment that describes the server.
    Sv101Comment data_types.STRING
}

type SYSTEMTIME struct {
    // WYear: The year.
    WYear data_types.WORD
    // WMonth: The month.
    WMonth data_types.WORD
    // WDayOfWeek: The day of the week.
    WDayOfWeek data_types.WORD
    // WDay: The day.
    WDay data_types.WORD
    // WHour: The hour.
    WHour data_types.WORD
    // WMinute: The minute.
    WMinute data_types.WORD
    // WSecond: The second.
    WSecond data_types.WORD
    // WMilliseconds: The milliseconds.
    WMilliseconds data_types.WORD
}

type UINT128 struct {
    // Lower: The lower 64 bits of the 128-bit value.
    Lower data_types.UINT64
    // Upper: The upper 64 bits of the 128-bit value.
    Upper data_types.UINT64
}

type ULARGE_INTEGER struct {
    // QuadPart: The 64-bit value.
    QuadPart data_types.UINT64
}