Skip to content

Commit 9cbb10e

Browse files
scudettescudette
committed
Initial commit for prefetch parser.
0 parents  commit 9cbb10e

20 files changed

+1527
-0
lines changed

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*~
2+
prefetch
3+
prefetch.exe

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "test_data/Prefetch"]
2+
path = test_data/Prefetch
3+
url = https://github.com/EricZimmerman/Prefetch.git

‎Makefile

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
all:
2+
go build -o prefetch cmd/*.go
3+
4+
gen:
5+
binparsegen conversion.spec.yaml > prefetch_gen.go
6+
7+
test:
8+
go test ./...
9+
10+
windows:
11+
GOOS=windows GOARCH=amd64 go build -o prefetch.exe cmd/*.go

‎cmd/prefetch.go

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package main
2+
3+
import (
4+
"encoding/json"
5+
"flag"
6+
"fmt"
7+
"os"
8+
9+
"www.velocidex.com/golang/binparsergen"
10+
prefetch "www.velocidex.com/golang/go-prefetch"
11+
)
12+
13+
func main() {
14+
flag.Parse()
15+
16+
args := flag.Args()
17+
if len(args) == 0 {
18+
flag.Usage()
19+
os.Exit(1)
20+
}
21+
22+
for _, arg := range args {
23+
fd, err := os.Open(arg)
24+
binparsergen.FatalIfError(err, fmt.Sprintf("Open file: %v", err))
25+
26+
prefetch_obj, err := prefetch.LoadPrefetch(fd)
27+
binparsergen.FatalIfError(err, fmt.Sprintf("Parsing Error: %v", err))
28+
29+
serialized_content, _ := json.MarshalIndent(prefetch_obj, " ", " ")
30+
fmt.Println(string(serialized_content))
31+
}
32+
}

‎conversion.spec.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Module: prefetch
2+
Profile: PrefetchProfile
3+
Filename: profile_vtypes.json
4+
GenerateDebugString: true
5+
Structs:
6+
- MAMHeader
7+
- SCCAHeader
8+
- FileInformationWin10
9+
- FileMetricsEntryV30
10+
- FileInformationVista
11+
- FileInformationXP
12+
- FileMetricsEntryV17

‎debug.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package prefetch
2+
3+
import "fmt"
4+
5+
var (
6+
Prefetch_debug = true
7+
)
8+
9+
func Printf(fmt_str string, args ...interface{}) {
10+
if Prefetch_debug {
11+
fmt.Printf(fmt_str, args...)
12+
}
13+
}

‎file_metrics.go

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
package prefetch
2+
3+
func (self *FileInformationWin10) Filenames() []string {
4+
result := []string{}
5+
6+
start_of_strings_table := self.FilenameOffset()
7+
8+
file_metrics_offset := int64(self.FileMetricsOffset())
9+
for i := uint32(0); i < self.NumberOfFileMetrics(); i++ {
10+
metric := self.Profile.FileMetricsEntryV30(
11+
self.Reader, file_metrics_offset)
12+
13+
filename := ParseUTF16String(
14+
self.Reader,
15+
int64(start_of_strings_table+metric.FilenameOffset()),
16+
int64(metric.FilenameLength()*2))
17+
result = append(result, filename)
18+
file_metrics_offset += int64(metric.Size())
19+
}
20+
21+
return result
22+
}
23+
24+
func (self *FileInformationVista) Filenames() []string {
25+
result := []string{}
26+
27+
start_of_strings_table := self.FilenameOffset()
28+
29+
file_metrics_offset := int64(self.FileMetricsOffset())
30+
for i := uint32(0); i < self.NumberOfFileMetrics(); i++ {
31+
metric := self.Profile.FileMetricsEntryV30(
32+
self.Reader, file_metrics_offset)
33+
34+
filename := ParseUTF16String(
35+
self.Reader,
36+
int64(start_of_strings_table+metric.FilenameOffset()),
37+
int64(metric.FilenameLength()*2))
38+
result = append(result, filename)
39+
file_metrics_offset += int64(metric.Size())
40+
}
41+
42+
return result
43+
}
44+
45+
func (self *FileInformationXP) Filenames() []string {
46+
result := []string{}
47+
48+
start_of_strings_table := self.FilenameOffset()
49+
50+
file_metrics_offset := int64(self.FileMetricsOffset())
51+
for i := uint32(0); i < self.NumberOfFileMetrics(); i++ {
52+
metric := self.Profile.FileMetricsEntryV17(
53+
self.Reader, file_metrics_offset)
54+
55+
filename := ParseUTF16String(
56+
self.Reader,
57+
int64(start_of_strings_table+metric.FilenameOffset()),
58+
int64(metric.FilenameLength()*2))
59+
result = append(result, filename)
60+
file_metrics_offset += int64(metric.Size())
61+
}
62+
63+
return result
64+
}

‎fixtures/CALC.EXE-3FBEF7FD.pf.golden

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"Executable": "CALC.EXE",
3+
"FileSize": 47848,
4+
"Hash": "0x3FBEF7FD",
5+
"Version": "Win10",
6+
"LastRunTimes": [
7+
"2016-01-11T22:08:20Z",
8+
"2016-01-10T02:12:33Z"
9+
],
10+
"FilesAccessed": [
11+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
12+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\CALC.EXE",
13+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\KERNEL32.DLL",
14+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\KERNELBASE.DLL",
15+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\LOCALE.NLS",
16+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SHELL32.DLL",
17+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\MSVCRT.DLL",
18+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\CFGMGR32.DLL",
19+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\WINDOWS.STORAGE.DLL",
20+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\COMBASE.DLL",
21+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\RPCRT4.DLL",
22+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\BCRYPTPRIMITIVES.DLL",
23+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\ADVAPI32.DLL",
24+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SECHOST.DLL",
25+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SHLWAPI.DLL",
26+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\GDI32.DLL",
27+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\USER32.DLL",
28+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\KERNEL.APPCORE.DLL",
29+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SHCORE.DLL",
30+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\POWRPROF.DLL",
31+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\PROFAPI.DLL",
32+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\IMM32.DLL",
33+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\RPCSS.DLL",
34+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\GLOBALIZATION\\SORTING\\SORTDEFAULT.NLS",
35+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\APPHELP.DLL",
36+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\CLBCATQ.DLL",
37+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\UXTHEME.DLL",
38+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\PROGRAM FILES (X86)\\STARDOCK\\START10\\START10_64.DLL",
39+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\PROGRAM FILES\\GPSOFTWARE\\DIRECTORY OPUS\\DOPUSLIB.DLL",
40+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\OLE32.DLL",
41+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\OLEAUT32.DLL",
42+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SHFOLDER.DLL",
43+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\CRYPT32.DLL",
44+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\MSASN1.DLL",
45+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\VERSION.DLL",
46+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\WTSAPI32.DLL",
47+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\PROPSYS.DLL",
48+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\ACTXPRXY.DLL",
49+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\URLMON.DLL",
50+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\IERTUTIL.DLL",
51+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\IEFRAME.DLL",
52+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\WINSXS\\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.10586.0_NONE_8C15AE12515E1C22\\COMCTL32.DLL",
53+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\WINDOWSSHELL.MANIFEST",
54+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\EN-US\\WINDOWS.STORAGE.DLL.MUI",
55+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SECUR32.DLL",
56+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\SSPICLI.DLL",
57+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\MLANG.DLL",
58+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\WININET.DLL",
59+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\USERS\\E\\APPDATA\\LOCAL\\MICROSOFT\\WINDOWS\\INETCACHE\\COUNTERS.DAT",
60+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\TWINUI.DLL",
61+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\TWINAPI.APPCORE.DLL",
62+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\DWMAPI.DLL",
63+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\WINDOWS.UI.IMMERSIVE.DLL",
64+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\WINTYPES.DLL",
65+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\BCRYPT.DLL",
66+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\TWINUI.APPCORE.DLL",
67+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\COREMESSAGING.DLL",
68+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\COREUICOMPONENTS.DLL",
69+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\EXECMODELPROXY.DLL",
70+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\MRMCORER.DLL",
71+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\BCP47LANGS.DLL",
72+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\WINDOWS\\SYSTEM32\\WINDOWS.UI.DLL",
73+
"\\VOLUME{01d1217a9c4c6779-8c9f49ec}\\$MFT"
74+
]
75+
}

‎fixtures/LIVECOMM.EXE-D546E475.pf.golden

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"Executable": "LIVECOMM.EXE",
3+
"FileSize": 36456,
4+
"Hash": "0xD546E475",
5+
"Version": "Win8.1",
6+
"LastRunTimes": [
7+
"2016-01-16T21:08:46Z"
8+
],
9+
"FilesAccessed": [
10+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
11+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\LIVECOMM.EXE",
12+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\KERNEL32.DLL",
13+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\KERNELBASE.DLL",
14+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\LOCALE.NLS",
15+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\MICROSOFT.SYSTEM.PACKAGE.METADATA\\S-1-5-21-588873271-1728575951-1297560112-1001.PCKGDEP",
16+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\ADVAPI32.DLL",
17+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.VCLIBS.110.00_11.0.50712.1_X64__8WEKYB3D8BBWE\\MSVCR110.DLL",
18+
"\\DEVICE\\HARDDISKVOLUME2\\$MFT",
19+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\COMBASE.DLL",
20+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\WLLOG.DLL",
21+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\MICROSOFT.WINDOWSLIVE.PLATFORM.SERVICE.DLL",
22+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\OLEAUT32.DLL",
23+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\MSVCRT.DLL",
24+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\SECHOST.DLL",
25+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\RPCRT4.DLL",
26+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\OLE32.DLL",
27+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\GDI32.DLL",
28+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\USER32.DLL",
29+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\IMM32.DLL",
30+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\MSCTF.DLL",
31+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\RPCSS.DLL",
32+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CRYPTBASE.DLL",
33+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\BCRYPTPRIMITIVES.DLL",
34+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWS.STORAGE.APPLICATIONDATA.DLL",
35+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\TWINAPI.DLL",
36+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\SHELL32.DLL",
37+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\SHLWAPI.DLL",
38+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINTYPES.DLL",
39+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\GLOBALIZATION\\SORTING\\SORTDEFAULT.NLS",
40+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\PROPSYS.DLL",
41+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\SHCORE.DLL",
42+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\EN-US\\SHELL32.DLL.MUI",
43+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\SHARED\\BICI.DLL",
44+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CRYPTSP.DLL",
45+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\RSAENH.DLL",
46+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\EN-US\\KERNELBASE.DLL.MUI",
47+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\THREADPOOLWINRT.DLL",
48+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\ACTXPRXY.DLL",
49+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\BIWINRT.DLL",
50+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\MICROSOFT.WINDOWSLIVE.PLATFORM.DLL",
51+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWS.APPLICATIONMODEL.DLL",
52+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWS.APPLICATIONMODEL.BACKGROUND.SYSTEMEVENTSBROKER.DLL",
53+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\SYSTEMEVENTSBROKERCLIENT.DLL",
54+
"\\DEVICE\\HARDDISKVOLUME2\\USERS\\E\\APPDATA\\LOCAL\\PACKAGES\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_8WEKYB3D8BBWE\\SETTINGS\\SETTINGS.DAT",
55+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWS.SECURITY.AUTHENTICATION.ONLINEID.DLL",
56+
"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES\\WINDOWSAPPS\\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16.4.4206.722_X64__8WEKYB3D8BBWE\\MODERNSHARED\\ERRORREPORTING\\ERRORREPORTING.DLL",
57+
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWS.NETWORKING.CONNECTIVITY.DLL"
58+
]
59+
}

‎fixtures/MSMSGS.EXE-2B6052DE.pf.golden

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"Executable": "MSMSGS.EXE",
3+
"FileSize": 21366,
4+
"Hash": "0x2B6052DE",
5+
"Version": "WinXP",
6+
"LastRunTimes": [
7+
"2016-01-13T22:05:11Z"
8+
],
9+
"FilesAccessed": [
10+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
11+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\KERNEL32.DLL",
12+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\UNICODE.NLS",
13+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\LOCALE.NLS",
14+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SORTTBLS.NLS",
15+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSVCRT.DLL",
16+
"\\DEVICE\\HARDDISKVOLUME1\\PROGRAM FILES\\MESSENGER\\MSMSGS.EXE",
17+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\ADVAPI32.DLL",
18+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\RPCRT4.DLL",
19+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SECUR32.DLL",
20+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\GDI32.DLL",
21+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\USER32.DLL",
22+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSOCK32.DLL",
23+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WS2_32.DLL",
24+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WS2HELP.DLL",
25+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\OLE32.DLL",
26+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\OLEAUT32.DLL",
27+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\WINSXS\\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\\COMCTL32.DLL",
28+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SHLWAPI.DLL",
29+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\COMDLG32.DLL",
30+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SHELL32.DLL",
31+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\VERSION.DLL",
32+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WINMM.DLL",
33+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\WINSXS\\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.0.2600.5512_X-WW_DFB54E0C\\GDIPLUS.DLL",
34+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSIMG32.DLL",
35+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\NETAPI32.DLL",
36+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WININET.DLL",
37+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\CRYPT32.DLL",
38+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSASN1.DLL",
39+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\CRYPTDLL.DLL",
40+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\IPHLPAPI.DLL",
41+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\CTYPE.NLS",
42+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SORTKEY.NLS",
43+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\WINDOWSSHELL.MANIFEST",
44+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\RPCSS.DLL",
45+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\UXTHEME.DLL",
46+
"\\DEVICE\\HARDDISKVOLUME1\\DOCUMENTS AND SETTINGS\\E\\NTUSER.DAT",
47+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\XPOB2RES.DLL",
48+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\CLBCATQ.DLL",
49+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\COMRES.DLL",
50+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WINLOGON.EXE",
51+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\XPSP2RES.DLL",
52+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SXS.DLL",
53+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\ES.DLL",
54+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WTSAPI32.DLL",
55+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WINSTA.DLL",
56+
"\\DEVICE\\HARDDISKVOLUME1\\PROGRAM FILES\\MESSENGER\\MSGSC.DLL",
57+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\CREDUI.DLL",
58+
"\\DEVICE\\HARDDISKVOLUME1\\DOCUMENTS AND SETTINGS\\E\\LOCAL SETTINGS\\TEMPORARY INTERNET FILES\\CONTENT.IE5\\INDEX.DAT",
59+
"\\DEVICE\\HARDDISKVOLUME1\\DOCUMENTS AND SETTINGS\\E\\COOKIES\\INDEX.DAT",
60+
"\\DEVICE\\HARDDISKVOLUME1\\DOCUMENTS AND SETTINGS\\E\\LOCAL SETTINGS\\HISTORY\\HISTORY.IE5\\INDEX.DAT"
61+
]
62+
}

‎fixtures/PING.EXE-B29F6629.pf.golden

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"Executable": "PING.EXE",
3+
"FileSize": 11216,
4+
"Hash": "0xB29F6629",
5+
"Version": "Vista",
6+
"LastRunTimes": [
7+
"2012-04-06T19:00:55Z"
8+
],
9+
"FilesAccessed": [
10+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
11+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\KERNEL32.DLL",
12+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\APISETSCHEMA.DLL",
13+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\KERNELBASE.DLL",
14+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\LOCALE.NLS",
15+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\PING.EXE",
16+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\ADVAPI32.DLL",
17+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSVCRT.DLL",
18+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SECHOST.DLL",
19+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\RPCRT4.DLL",
20+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\IPHLPAPI.DLL",
21+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\NSI.DLL",
22+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WINNSI.DLL",
23+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\USER32.DLL",
24+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\GDI32.DLL",
25+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\LPK.DLL",
26+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\USP10.DLL",
27+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WS2_32.DLL",
28+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\IMM32.DLL",
29+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSCTF.DLL",
30+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\EN-US\\PING.EXE.MUI",
31+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\GLOBALIZATION\\SORTING\\SORTDEFAULT.NLS",
32+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSWSOCK.DLL",
33+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSHQOS.DLL",
34+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSHTCPIP.DLL",
35+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSHIP6.DLL",
36+
"\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\RESCACHE\\RC0007\\RESCACHE.HIT"
37+
]
38+
}

‎headers.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
package prefetch

0 commit comments

Comments
 (0)