frnsc-prefetch 0.13.3

Pure rust windows prefetch parser implementation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

use forensic_rs::err::{ForensicError, ForensicResult};

use crate::common::{u32_at_pos, PrefetchFileInformation, Trace};

pub fn traces_for_dependency_v17(
    file_buffer: &[u8],
    info: &PrefetchFileInformation,
    index: usize,
    size: usize,
) -> ForensicResult<Vec<Trace>> {
    let end_pos = (info.trace_chain_offset + info.trace_chain_count * 12) as usize;
    if end_pos > file_buffer.len() {
        return Err(ForensicError::bad_format_str(
            "The trace array position is greater than the file buffer length",
        ));
    }
    let trace_array = &file_buffer[info.trace_chain_offset as usize..end_pos];
    let mut traces = Vec::with_capacity(info.trace_chain_count as usize);
    if (index + size) * 12 > trace_array.len() {
        return Err(ForensicError::bad_format_str(
            "The trace array position is greater than the file buffer length",
        ));
    }
    for i in 0..size {
        let pos = (index + i) * 12;
        let entry = &trace_array[pos..];
        let block_offset = u32_at_pos(entry, 4);
        let flags = entry[8];
        traces.push(Trace {
            flags: flags.into(),
            block_offset,
            used_bitfield: entry[10],
            prefetched_bitfield: entry[11],
        });
    }
    Ok(traces)
}

pub fn process_trace_chain_v17(
    file_buffer: &[u8],
    info: &PrefetchFileInformation,
) -> ForensicResult<Vec<Trace>> {
    let end_pos = (info.trace_chain_offset + info.trace_chain_count * 12) as usize;
    if end_pos > file_buffer.len() {
        return Err(ForensicError::bad_format_str(
            "The trace array position is greater than the file buffer length",
        ));
    }
    let trace_array = &file_buffer[info.trace_chain_offset as usize..end_pos];
    let mut traces = Vec::with_capacity(info.trace_chain_count as usize);
    for i in 0..(info.trace_chain_count as usize) {
        let pos = i * 12;
        let entry = &trace_array[pos..];
        let block_offset = u32_at_pos(entry, 4);
        let flags = entry[8];
        traces.push(Trace {
            flags: flags.into(),
            block_offset,
            used_bitfield: entry[10],
            prefetched_bitfield: entry[11],
        });
    }
    Ok(traces)
}
pub fn process_trace_chain_v30(
    file_buffer: &[u8],
    info: &PrefetchFileInformation,
) -> ForensicResult<Vec<Trace>> {
    let end_pos = (info.trace_chain_offset + info.trace_chain_count * 8) as usize;
    if end_pos > file_buffer.len() {
        return Err(ForensicError::bad_format_str(
            "The trace array position is greater than the file buffer length",
        ));
    }
    let trace_array = &file_buffer[info.trace_chain_offset as usize..end_pos];
    let mut traces = Vec::with_capacity(info.trace_chain_count as usize);
    for i in 0..(info.trace_chain_count as usize) {
        let pos = i * 8;
        let entry = &trace_array[pos..];
        let block_offset = u32_at_pos(entry, 0);
        let flags = entry[4];
        traces.push(Trace {
            flags: flags.into(),
            block_offset,
            used_bitfield: entry[6],
            prefetched_bitfield: entry[7],
        });
    }
    Ok(traces)
}
pub fn traces_for_dependency_v30(
    file_buffer: &[u8],
    info: &PrefetchFileInformation,
    index: usize,
    size: usize,
) -> ForensicResult<Vec<Trace>> {
    let end_pos = (info.trace_chain_offset + info.trace_chain_count * 8) as usize;
    if end_pos > file_buffer.len() {
        return Err(ForensicError::bad_format_str(
            "The trace array position is greater than the file buffer length",
        ));
    }
    let trace_array = &file_buffer[info.trace_chain_offset as usize..end_pos];
    let mut traces = Vec::with_capacity(info.trace_chain_count as usize);
    if (index + size) * 8 > trace_array.len() {
        return Err(ForensicError::bad_format_str(
            "The trace array position is greater than the file buffer length",
        ));
    }
    for i in 0..size {
        let pos = (index + i) * 8;
        let entry = &trace_array[pos..];
        let block_offset = u32_at_pos(entry, 0);
        let flags = entry[4].into();
        traces.push(Trace {
            flags,
            block_offset,
            used_bitfield: entry[6],
            prefetched_bitfield: entry[7],
        });
    }
    Ok(traces)
}