mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 04:37:38 +02:00
add svcscan and associated types
This commit is contained in:
Analyst
@@ -25,6 +25,7 @@ import volatility.framework.interfaces.plugins as plugins
|
||||
from volatility.framework import renderers, interfaces, layers
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.renderers import format_hints
|
||||
from volatility.framework.objects import utility
|
||||
from volatility.plugins import timeliner
|
||||
|
||||
|
||||
@@ -62,6 +63,16 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
filter_func = lambda x: x.UniqueProcessId not in filter_list
|
||||
return filter_func
|
||||
|
||||
@classmethod
|
||||
def create_name_filter(cls, name_list: List[str] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
|
||||
filter_func = lambda _: False
|
||||
# FIXME: mypy #4973 or #2608
|
||||
name_list = name_list or []
|
||||
filter_list = [x for x in name_list if x is not None]
|
||||
if filter_list:
|
||||
filter_func = lambda x: utility.array_to_string(x.ImageFileName) not in filter_list
|
||||
return filter_func
|
||||
|
||||
@classmethod
|
||||
def list_processes(cls,
|
||||
context: interfaces.context.ContextInterface,
|
||||
|
||||
@@ -0,0 +1,186 @@
|
||||
# This file was contributed to the Volatility Framework Version 3.
|
||||
# Copyright (C) 2018 Volatility Foundation.
|
||||
#
|
||||
# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
|
||||
# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
|
||||
# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
|
||||
# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
|
||||
# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
|
||||
# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
|
||||
# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
|
||||
# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
|
||||
# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
|
||||
# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
|
||||
# https://www.volatilityfoundation.org/license/vcpl_v1.0
|
||||
#
|
||||
# Software distributed under the License is distributed on an "AS IS" basis,
|
||||
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing rights and limitations under the License.
|
||||
#
|
||||
|
||||
import logging
|
||||
from typing import Any, List
|
||||
from volatility.framework import interfaces, renderers, constants, symbols
|
||||
from volatility.framework.layers import scanners
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.renderers import format_hints
|
||||
from volatility.framework.plugins.windows import poolscanner
|
||||
from volatility.framework.plugins.windows import vadyarascan
|
||||
from volatility.plugins.windows import pslist
|
||||
from volatility.framework.symbols.windows.services import ServicesIntermedSymbols
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
class SvcScan(interfaces.plugins.PluginInterface):
|
||||
"""Scans for windows services"""
|
||||
|
||||
is_vista_or_later = poolscanner.os_distinguisher(
|
||||
version_check=lambda x: x >= (6, 0), fallback_checks=[("KdCopyDataBlock", None, True)])
|
||||
|
||||
is_windows_xp = poolscanner.os_distinguisher(
|
||||
version_check=lambda x: (5, 1) <= x < (5, 2), fallback_checks=[("KdCopyDataBlock", None, False),
|
||||
("_HANDLE_TABLE", "HandleCount", True)])
|
||||
|
||||
is_xp_or_2003 = poolscanner.os_distinguisher(
|
||||
version_check=lambda x: (5, 1) <= x < (6, 0), fallback_checks=[("KdCopyDataBlock", None, False),
|
||||
("_HANDLE_TABLE", "HandleCount", True)])
|
||||
|
||||
is_win10_up_to_15063 = poolscanner.os_distinguisher(
|
||||
version_check=lambda x: (10, 0) <= x < (10, 0, 16299), fallback_checks=[("ObHeaderCookie", None, True),
|
||||
("_HANDLE_TABLE", "HandleCount", False),
|
||||
("ObHeaderCookie", None, True)])
|
||||
|
||||
is_win10_16299_or_later = poolscanner.os_distinguisher(
|
||||
version_check=lambda x: x >= (10, 0, 16299), fallback_checks=[("ObHeaderCookie", None, True),
|
||||
("_HANDLE_TABLE", "HandleCount", False),
|
||||
("ObHeaderCookie", None, True)])
|
||||
|
||||
@classmethod
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
] + pslist.PsList.list_processes_filter_requirements
|
||||
|
||||
@staticmethod
|
||||
def get_record_tuple(service_record: Any):
|
||||
return (format_hints.Hex(service_record.vol.offset),
|
||||
service_record.Order,
|
||||
service_record.get_pid(),
|
||||
service_record.Start.description,
|
||||
service_record.State.description,
|
||||
service_record.get_type(),
|
||||
service_record.get_name(),
|
||||
service_record.get_display(),
|
||||
service_record.get_binary())
|
||||
|
||||
@staticmethod
|
||||
def create_service_table(context: interfaces.context.ContextInterface,
|
||||
symbol_table: str,
|
||||
config_path: str) -> str:
|
||||
|
||||
native_types = context.symbol_space[symbol_table].natives
|
||||
is_64bit = symbols.symbol_table_is_64bit(context, symbol_table)
|
||||
|
||||
if SvcScan.is_windows_xp(context = context, symbol_table = symbol_table) and not is_64bit:
|
||||
symbol_filename = "services-xp-x86"
|
||||
elif SvcScan.is_xp_or_2003(context = context, symbol_table = symbol_table) and is_64bit:
|
||||
symbol_filename = "services-xp-2003-x64"
|
||||
elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and is_64bit:
|
||||
symbol_filename = "services-win8-x64"
|
||||
elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and not is_64bit:
|
||||
symbol_filename = "services-win8-x86"
|
||||
elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and is_64bit:
|
||||
symbol_filename = "services-win10-15063-x64"
|
||||
elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and not is_64bit:
|
||||
symbol_filename = "services-win10-15063-x86"
|
||||
elif SvcScan.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and is_64bit:
|
||||
symbol_filename = "services-win10-16299-x64"
|
||||
elif SvcScan.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and not is_64bit:
|
||||
symbol_filename = "services-win10-16299-x86"
|
||||
elif SvcScan.is_vista_or_later(context = context, symbol_table = symbol_table) and is_64bit:
|
||||
symbol_filename = "services-vista-x64"
|
||||
elif SvcScan.is_vista_or_later(context = context, symbol_table = symbol_table) and not is_64bit:
|
||||
symbol_filename = "services-vista-x86"
|
||||
else:
|
||||
raise NotImplementedError("This version of Windows is not supported!")
|
||||
|
||||
print(symbol_filename)
|
||||
return ServicesIntermedSymbols.create(context,
|
||||
config_path,
|
||||
"windows",
|
||||
symbol_filename,
|
||||
native_types = native_types)
|
||||
|
||||
def _generator(self):
|
||||
|
||||
service_table_name = self.create_service_table(self.context,
|
||||
self.config["nt_symbols"],
|
||||
self.config_path)
|
||||
|
||||
relative_tag_offset = self.context.symbol_space.get_type(
|
||||
service_table_name + constants.BANG + "_SERVICE_RECORD").relative_child_offset("Tag")
|
||||
|
||||
filter_func = pslist.PsList.create_name_filter(["services.exe"])
|
||||
|
||||
is_vista_or_later = SvcScan.is_vista_or_later(context = self.context,
|
||||
symbol_table = self.config["nt_symbols"])
|
||||
|
||||
if is_vista_or_later:
|
||||
service_tag = b"serH"
|
||||
else:
|
||||
service_tag = b"sErv"
|
||||
|
||||
seen = []
|
||||
|
||||
for task in pslist.PsList.list_processes(context = self.context,
|
||||
layer_name = self.config['primary'],
|
||||
symbol_table = self.config['nt_symbols'],
|
||||
filter_func = filter_func):
|
||||
|
||||
proc_layer_name = task.add_process_layer()
|
||||
layer = self.context.memory[proc_layer_name]
|
||||
|
||||
for offset in layer.scan(context = self.context,
|
||||
scanner = scanners.BytesScanner(needle = service_tag),
|
||||
sections = vadyarascan.VadYaraScan.get_vad_maps(task)):
|
||||
|
||||
if not is_vista_or_later:
|
||||
service_record = self.context.object(service_table_name + constants.BANG + "_SERVICE_RECORD",
|
||||
offset = offset - relative_tag_offset,
|
||||
layer_name = proc_layer_name)
|
||||
|
||||
if not service_record.is_valid():
|
||||
continue
|
||||
|
||||
yield (0, self.get_record_tuple(service_record))
|
||||
else:
|
||||
service_header = self.context.object(service_table_name + constants.BANG + "_SERVICE_HEADER",
|
||||
offset = offset,
|
||||
layer_name = proc_layer_name)
|
||||
|
||||
if not service_header.is_valid():
|
||||
continue
|
||||
|
||||
# since we walk the s-list backwards, if we've seen
|
||||
# an object, then we've also seen all objects that
|
||||
# exist before it, thus we can break at that time.
|
||||
for service_record in service_header.ServiceRecord.traverse():
|
||||
if service_record in seen:
|
||||
break
|
||||
seen.append(service_record)
|
||||
yield (0, self.get_record_tuple(service_record))
|
||||
|
||||
def run(self):
|
||||
return renderers.TreeGrid([('Offset', format_hints.Hex),
|
||||
('Order', int),
|
||||
('Pid', int),
|
||||
('Start', str),
|
||||
('State', str),
|
||||
('Type', str),
|
||||
('Name', str),
|
||||
('Display', str),
|
||||
('Binary', str),
|
||||
], self._generator())
|
||||
@@ -87,7 +87,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
|
||||
sections = self.get_vad_maps(task)):
|
||||
yield format_hints.Hex(offset), name
|
||||
|
||||
def get_vad_maps(self, task: Any) -> Iterable[Tuple[int, int]]:
|
||||
@staticmethod
|
||||
def get_vad_maps(task: Any) -> Iterable[Tuple[int, int]]:
|
||||
|
||||
vad_root = task.get_vad_root()
|
||||
for vad in vad_root.traverse():
|
||||
|
||||
@@ -0,0 +1,139 @@
|
||||
# This file was contributed to the Volatility Framework Version 3.
|
||||
# Copyright (C) 2018 Volatility Foundation.
|
||||
#
|
||||
# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
|
||||
# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
|
||||
# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
|
||||
# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
|
||||
# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
|
||||
# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
|
||||
# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
|
||||
# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
|
||||
# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
|
||||
# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
|
||||
# https://www.volatilityfoundation.org/license/vcpl_v1.0
|
||||
#
|
||||
# Software distributed under the License is distributed on an "AS IS" basis,
|
||||
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing rights and limitations under the License.
|
||||
#
|
||||
|
||||
from volatility.framework import objects, interfaces
|
||||
from volatility.framework import exceptions
|
||||
from volatility.framework.symbols.wrappers import Flags
|
||||
from volatility.framework import renderers
|
||||
from typing import Union
|
||||
|
||||
class _SERVICE_RECORD(objects.Struct):
|
||||
"""A service record structure"""
|
||||
|
||||
def is_valid(self) -> bool:
|
||||
"""Determine if the structure is valid"""
|
||||
if self.Order < 0 or self.Order > 0xFFFF:
|
||||
return False
|
||||
|
||||
try:
|
||||
_ = self.State.description
|
||||
_ = self.Start.description
|
||||
except ValueError:
|
||||
return False
|
||||
|
||||
return True
|
||||
|
||||
def get_pid(self) -> Union[int, interfaces.renderers.BaseAbsentValue]:
|
||||
"""Return the pid of the process, if any"""
|
||||
if self.State.description != "SERVICE_RUNNING" or "PROCESS" not in self.get_type():
|
||||
return renderers.NotApplicableValue()
|
||||
|
||||
try:
|
||||
return self.ServiceProcess.ProcessId
|
||||
except exceptions.InvalidAddressException:
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
def get_binary(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
|
||||
"""Returns the binary associated with the service"""
|
||||
if self.State.description != "SERVICE_RUNNING":
|
||||
return renderers.NotApplicableValue()
|
||||
|
||||
# depending on whether the service is for a process
|
||||
# or kernel driver, the binary path is stored differently
|
||||
try:
|
||||
if "PROCESS" in self.get_type():
|
||||
return self.ServiceProcess.BinaryPath.dereference().cast("string",
|
||||
encoding = "utf-16",
|
||||
errors = "replace",
|
||||
max_length = 512)
|
||||
else:
|
||||
return self.DriverName.dereference().cast("string",
|
||||
encoding = "utf-16",
|
||||
errors = "replace",
|
||||
max_length = 512)
|
||||
except exceptions.InvalidAddressException:
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
def get_name(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
|
||||
"""Returns the service name"""
|
||||
try:
|
||||
return self.ServiceName.dereference().cast("string",
|
||||
encoding = "utf-16",
|
||||
errors = "replace",
|
||||
max_length = 512)
|
||||
except exceptions.InvalidAddressException:
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
def get_display(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
|
||||
"""Returns the service display"""
|
||||
try:
|
||||
return self.DisplayName.dereference().cast("string",
|
||||
encoding = "utf-16",
|
||||
errors = "replace",
|
||||
max_length = 512)
|
||||
except exceptions.InvalidAddressException:
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
def get_type(self) -> str:
|
||||
"""Returns the binary types"""
|
||||
|
||||
SERVICE_TYPE_FLAGS = {
|
||||
'SERVICE_KERNEL_DRIVER': 1,
|
||||
'SERVICE_FILE_SYSTEM_DRIVER': 2,
|
||||
'SERVICE_ADAPTOR': 4,
|
||||
'SERVICE_RECOGNIZER_DRIVER': 8,
|
||||
'SERVICE_WIN32_OWN_PROCESS': 16,
|
||||
'SERVICE_WIN32_SHARE_PROCESS': 32,
|
||||
'SERVICE_INTERACTIVE_PROCESS': 256
|
||||
}
|
||||
|
||||
type_flags = Flags(choices = SERVICE_TYPE_FLAGS)
|
||||
return "|".join(type_flags(self.Type))
|
||||
|
||||
def traverse(self):
|
||||
"""Generator that enumerates other services"""
|
||||
|
||||
try:
|
||||
if hasattr(self, "PrevEntry"):
|
||||
yield self
|
||||
# make sure we dereference these pointers, or the
|
||||
# is_valid() checks will apply to the pointer and
|
||||
# not the _SERVICE_RECORD object as intended.
|
||||
rec = self.PrevEntry
|
||||
while rec and rec.is_valid():
|
||||
yield rec
|
||||
rec = rec.PrevEntry
|
||||
else:
|
||||
rec = self
|
||||
while rec and rec.is_valid():
|
||||
yield rec
|
||||
rec = rec.ServiceList.Blink.dereference()
|
||||
except exceptions.InvalidAddressException:
|
||||
raise StopIteration
|
||||
|
||||
class _SERVICE_HEADER(objects.Struct):
|
||||
"""A service header structure"""
|
||||
|
||||
def is_valid(self) -> bool:
|
||||
"""Determine if the structure is valid"""
|
||||
try:
|
||||
return self.ServiceRecord.is_valid()
|
||||
except exceptions.InvalidAddressException:
|
||||
return False
|
||||
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 24
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 24
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 120
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 40
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 76
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 52
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 40
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 24
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 120
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,256 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 92
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 28
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 60
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 28
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 92
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 32
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 64
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 232
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 76
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 232
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 72
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 232
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,237 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 156
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 156
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 52
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 156
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 40
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 40
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 64
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 232
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 76
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 232
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 72
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 232
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,237 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 20
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 156
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 156
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 52
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 156
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
+255
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 32
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 92
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 68
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 64
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 92
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
+248
@@ -0,0 +1,248 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 68
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 40
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 68
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,245 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 24
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 24
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 84
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 60
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 24
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 84
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
+245
@@ -0,0 +1,245 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 68
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 8
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 40
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 68
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
# This file was contributed to the Volatility Framework Version 3.
|
||||
# Copyright (C) 2018 Volatility Foundation.
|
||||
#
|
||||
# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
|
||||
# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
|
||||
# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
|
||||
# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
|
||||
# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
|
||||
# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
|
||||
# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
|
||||
# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
|
||||
# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
|
||||
# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
|
||||
# https://www.volatilityfoundation.org/license/vcpl_v1.0
|
||||
#
|
||||
# Software distributed under the License is distributed on an "AS IS" basis,
|
||||
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing rights and limitations under the License.
|
||||
#
|
||||
|
||||
from volatility.framework.symbols import intermed
|
||||
from volatility.framework.symbols.windows.extensions import services
|
||||
|
||||
|
||||
class ServicesIntermedSymbols(intermed.IntermediateSymbolTable):
|
||||
|
||||
def __init__(self, *args, **kwargs):
|
||||
super().__init__(*args, **kwargs)
|
||||
|
||||
self.set_type_class('_SERVICE_RECORD', services._SERVICE_RECORD)
|
||||
self.set_type_class('_SERVICE_HEADER', services._SERVICE_HEADER)
|
||||
Reference in New Issue
Block a user