Struct InType

#[repr(C)]
pub struct InType(/* private fields */);

Advanced: Used to indicate the field’s type for raw metadata operations.

An InType indicates the binary encoding of the field, i.e. how to determine the field’s size. For example, InType::I32 indicates the field is always 4 bytes, while InType::Str8 indicates the field begins with a U16 byte-count to specify the field’s size. The InType also provides a default format to be used if a field’s OutType is OutType::Default, e.g. InType::I32 defaults to OutType::Signed, and InType::Hex32 defaults to OutType::Hex.

Implementations

impl InType

pub const Invalid: InType

TlgInNULL = Invalid type.

pub const CStr16: InType

TlgInUNICODESTRING = NUL-terminated UTF-16LE string.

Default format: OutType::String

Other usable formats: OutType::Xml, OutType::Json.

pub const CStr8: InType

TlgInANSISTRING = NUL-terminated 8-bit string, assumed to be encoded as CP1252.

Default format: OutType::String

Other usable formats: OutType::Xml, OutType::Json, OutType::Utf8.

pub const I8: InType

TlgInINT8 = 8-bit signed integer.

Default format: OutType::Signed

Other usable formats: OutType::String (formats as CP1252 char).

pub const U8: InType

TlgInUINT8 = 8-bit unsigned integer.

Default format: OutType::Unsigned

Other usable formats: OutType::Hex, OutType::String (formats as CP1252 char), OutType::Boolean.

pub const I16: InType

TlgInINT16 = 16-bit signed integer.

Default format: OutType::Signed

pub const U16: InType

TlgInUINT16 = 16-bit unsigned integer.

Default format: OutType::Unsigned

Other usable formats: OutType::Hex, OutType::String (formats as UCS-2 char), OutType::Port (formats as big-endian u16).

pub const I32: InType

TlgInINT32 = 32-bit signed integer.

Default format: OutType::Signed

Other usable formats: OutType::HResult.

pub const U32: InType

TlgInUINT32 = 32-bit unsigned integer.

Default format: OutType::Unsigned

Other usable formats: OutType::Pid, OutType::Tid, OutType::IPv4, OutType::Win32Error, OutType::NtStatus, OutType::CodePointer.

pub const I64: InType

TlgInINT64 = 64-bit signed integer.

Default format: OutType::Signed

pub const U64: InType

TlgInUINT64 = 64-bit signed integer.

Default format: OutType::Unsigned

Other usable formats: OutType::CodePointer.

pub const F32: InType

TlgInFLOAT = 32-bit float.

pub const F64: InType

TlgInDOUBLE = 64-bit float.

pub const Bool32: InType

TlgInBOOL32 = 32-bit Boolean.

Default format: OutType::Boolean

pub const Binary: InType

TlgInBINARY = UINT16 byte-count followed by binary data.

Default format: OutType::Hex

Other usable formats: OutType::IPv6, OutType::SocketAddress, OutType::Pkcs7WithTypeInfo.

Note: Array of Binary is not supported. For arrays, use InType::BinaryC.

pub const Guid: InType

TlgInGUID = 128-bit GUID in Windows (little-endian) byte order.

pub const _HexSize_PlatformSpecific: InType

_TlgInPOINTER_unsupported = Not supported. Use InType::HexSize instead.

pub const FileTime: InType

TlgInFILETIME = 64-bit timestamp in Windows FILETIME format.

Default format: OutType::DateTime

Other usable formats: OutType::DateTimeCultureInsensitive, OutType::DateTimeUtc.

pub const SystemTime: InType

TlgInSYSTEMTIME = 128-bit date/time in Windows SYSTEMTIME format.

Default format: OutType::DateTime

Other usable formats: OutType::DateTimeCultureInsensitive, OutType::DateTimeUtc.

pub const Sid: InType

TlgInSID = Security ID in Windows SID format.

Note: Expected size of value is GetSidLength(sid_bytes) = sid_bytes[1] * 4 + 8.

pub const Hex32: InType

TlgInHEXINT32 = 32-bit integer formatted as hex.

Default format: OutType::Hex

Other usable formats: OutType::Win32Error, OutType::NtStatus, OutType::CodePointer.

pub const Hex64: InType

TlgInHEXINT64 = 64-bit integer formatted as hex.

Default format: OutType::Hex

Other usable formats: OutType::CodePointer.

pub const Str16: InType

TlgInCOUNTEDSTRING = 16-bit byte count followed by UTF-16LE string.

Default format: OutType::String

Other usable formats: OutType::Xml, OutType::Json.

pub const Str8: InType

TlgInCOUNTEDANSISTRING = 16-bit byte count followed by 8-bit string, assumed to be encoded as CP1252.

Default format: OutType::String

Other usable formats: OutType::Xml, OutType::Json, OutType::Utf8.

pub const Struct: InType

_TlgInSTRUCT = The struct field contains no data, but the following N fields will be considered as logically part of the struct field, where N is a value from 1 to 127 encoded into the OutType slot.

pub const BinaryC: InType

TlgInCOUNTEDBINARY = UINT16 byte-count followed by binary data.

Default format: OutType::Hex

Other usable formats: OutType::IPv6, OutType::SocketAddress, OutType::Pkcs7WithTypeInfo.

This is the same as InType::Binary except:

• New type code. Decoders might not support it yet.
• Decodes without the synthesized “FieldName.Length” fields that are common with Binary.
• Arrays are supported.

pub const ISize: InType

TlgInINTPTR = an alias for either InType::I64 or InType::I32, depending on the running process’s pointer size.

Default format: OutType::Signed

pub const USize: InType

TlgInUINTPTR = an alias for either InType::U64 or InType::U32, depending on the running process’s pointer size.

Default format: OutType::Unsigned

Other usable formats: OutType::CodePointer.

pub const HexSize: InType

TlgInPOINTER = an alias for either InType::Hex64 or InType::Hex32, depending on the running process’s pointer size.

Default format: OutType::Hex

Other usable formats: OutType::CodePointer.

pub const ConstantCountFlag: u8 = 32u8

Raw encoding flag: _TlgInCcount indicates that field metadata contains a const-array-count slot.

pub const VariableCountFlag: u8 = 64u8

Raw encoding flag: TlgInVcount indicates that field data contains a variable-array-count slot.

pub const CustomFlag: u8 = 96u8

Raw encoding flag: _TlgInCustom indicates that the field uses a custom serializer.

pub const TypeMask: u8 = 31u8

Raw encoding flag: _TlgInTypeMask is a mask for the intype portion of the encoded byte.

pub const FlagMask: u8 = 96u8

Raw encoding flag: _TlgInFlagMask is a mask for the flags portion of the encoded byte.

pub const fn from_int(value: u8) -> InType

Returns an intype with the specified value. Requires: value <= 127.

pub const fn as_int(self) -> u8

Returns the numeric value corresponding to this intype.

Trait Implementations

impl Clone for InType

fn clone(&self) -> InType

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for InType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for InType

fn default() -> InType

Returns the “default value” for a type.

impl Display for InType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<InType> for u8

fn from(val: InType) -> Self

Converts to this type from the input type.

impl From<u8> for InType

fn from(val: u8) -> Self

Converts to this type from the input type.

impl Hash for InType

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for InType

fn cmp(&self, other: &InType) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for InType

fn eq(&self, other: &InType) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for InType

fn partial_cmp(&self, other: &InType) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Copy for InType

impl Eq for InType

impl StructuralPartialEq for InType