mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-30 19:59:46 +02:00
86 lines
1.7 KiB
JSON
86 lines
1.7 KiB
JSON
{
|
|
"metadata": {
|
|
"producer": {
|
|
"version": "0.1.5",
|
|
"name": "mhl-by-hand",
|
|
"datetime": "2018-10-03T16:53:00.478000"
|
|
},
|
|
"format": "4.0.0"
|
|
},
|
|
"user_types": {
|
|
"_POOL_HEADER": {
|
|
"fields": {
|
|
"BlockSize": {
|
|
"offset": 2,
|
|
"type": {
|
|
"bit_length": 8,
|
|
"bit_position": 0,
|
|
"kind": "bitfield",
|
|
"type": {
|
|
"kind": "base",
|
|
"name": "unsigned short"
|
|
}
|
|
}
|
|
},
|
|
"PoolIndex": {
|
|
"offset": 0,
|
|
"type": {
|
|
"bit_length": 8,
|
|
"bit_position": 8,
|
|
"kind": "bitfield",
|
|
"type": {
|
|
"kind": "base",
|
|
"name": "unsigned short"
|
|
}
|
|
}
|
|
},
|
|
"PoolTag": {
|
|
"offset": 4,
|
|
"type": {
|
|
"kind": "base",
|
|
"name": "unsigned long"
|
|
}
|
|
},
|
|
"PoolType": {
|
|
"offset": 2,
|
|
"type": {
|
|
"bit_length": 8,
|
|
"bit_position": 8,
|
|
"kind": "bitfield",
|
|
"type": {
|
|
"kind": "base",
|
|
"name": "unsigned short"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"kind": "struct",
|
|
"size": 16
|
|
}
|
|
},
|
|
"symbols": {
|
|
},
|
|
"enums": {
|
|
},
|
|
"base_types": {
|
|
"unsigned long": {
|
|
"endian": "little",
|
|
"kind": "int",
|
|
"signed": false,
|
|
"size": 4
|
|
},
|
|
"unsigned short": {
|
|
"endian": "little",
|
|
"kind": "int",
|
|
"signed": false,
|
|
"size": 2
|
|
},
|
|
"int": {
|
|
"endian": "little",
|
|
"kind": "int",
|
|
"signed": true,
|
|
"size": 4
|
|
}
|
|
}
|
|
}
|