fields

package

Go to main page

Versions in this module

v1

v1.10.0

Mar 31, 2023

Changes in this version

+ type Deprecation struct

+ Field Field

+ Since string

+ func IsDeprecated(f Field) (bool, *Deprecation)

type Field — windows/amd64

+ const KevtArg

+ const PsChildArgs

+ const PsChildCmdline

+ const PsChildDomain

+ const PsChildExe

+ const PsChildName

+ const PsChildPid

+ const PsChildSID

+ const PsChildSessionID

+ const PsChildUUID

+ const PsChildUsername

+ const PsCmdline

+ const PsParentCmdline

+ const PsParentUUID

+ const PsUUID

+ func (f Field) IsAncestorMap() bool

+ func (f Field) IsEmpty() bool

+ func (f Field) IsEnvsMap() bool

+ func (f Field) IsFileField() bool

+ func (f Field) IsHandleField() bool

+ func (f Field) IsImageField() bool

+ func (f Field) IsKevtArgMap() bool

+ func (f Field) IsModsMap() bool

+ func (f Field) IsNetworkField() bool

+ func (f Field) IsPeField() bool

+ func (f Field) IsPeResourcesMap() bool

+ func (f Field) IsPeSectionsMap() bool

+ func (f Field) IsRegistryField() bool

+ func (f Field) IsThreadField() bool

type FieldInfo

+ Deprecation *Deprecation

+ func (f FieldInfo) IsDeprecated() bool

type Segment — windows/amd64

+ const ProcessCmdline

v1.8.0

Nov 30, 2022

Changes in this version

type Field — windows/amd64

+ const PsSiblingArgs

+ func (f Field) IsKevtField() bool

+ func (f Field) IsPsField() bool

v1.6.0

Aug 31, 2022

Changes in this version

type Field — windows/amd64

+ const FileAttributes

+ const FileStatus

v1.5.0

Apr 29, 2022

Changes in this version

type Field — windows/amd64

+ const PsAccessMask

+ const PsAccessMaskNames

+ const PsAccessStatus

+ const PsDomain

+ const PsParentDomain

+ const PsParentPid

+ const PsParentUsername

+ const PsSiblingComm

+ const PsSiblingDomain

+ const PsSiblingExe

+ const PsSiblingName

+ const PsSiblingPid

+ const PsSiblingSID

+ const PsSiblingSessionID

+ const PsSiblingUsername

+ const PsUsername

+ const ThreadAccessMask

+ const ThreadAccessMaskNames

+ const ThreadAccessStatus

v1.4.2

Dec 25, 2021

v1.4.1

Sep 18, 2021

Changes in this version

type Field — windows/amd64

+ const PeCompany

+ const PeCopyright

+ const PeDescription

+ const PeFileName

+ const PeFileVersion

+ const PeProduct

+ const PeProductVersion

v1.4.0

Aug 24, 2021

Changes in this version

type Field

+ const PsAncestor

+ const PsParentArgs

+ const PsParentComm

+ const PsParentCwd

+ const PsParentDTB

+ const PsParentEnvs

+ const PsParentExe

+ const PsParentHandleTypes

+ const PsParentHandles

+ const PsParentName

+ const PsParentSID

+ const PsParentSessionID

+ const ThreadPID

+ func (f Field) IsAncestorSequence() bool

+ func (f Field) IsEnvsSequence() bool

+ func (f Field) IsModsSequence() bool

+ func (f Field) IsPeResourcesSequence() bool

+ func (f Field) IsPeSectionsSequence() bool

+ type Segment string

+ const ProcessArgs

+ const ProcessComm

+ const ProcessCwd

+ const ProcessExe

+ const ProcessID

+ const ProcessName

+ const ProcessSID

+ const ProcessSessionID

v1.2.0

Apr 27, 2021

Changes in this version

+ const PeResourcesSubfield

+ const PeSectionsSubfield

+ const PsEnvsSubfield

+ const PsModsSubfield

+ type Field string

+ const FileExtension

+ const FileIOSize

+ const FileName

+ const FileObject

+ const FileOffset

+ const FileOperation

+ const FileShareMask

+ const FileType

+ const HandleID

+ const HandleName

+ const HandleObject

+ const HandleType

+ const ImageBase

+ const ImageChecksum

+ const ImageDefaultAddress

+ const ImageName

+ const ImagePID

+ const ImageSize

+ const KevtCPU

+ const KevtCategory

+ const KevtDate

+ const KevtDateDay

+ const KevtDateMonth

+ const KevtDateTz

+ const KevtDateWeek

+ const KevtDateWeekday

+ const KevtDateYear

+ const KevtDesc

+ const KevtHost

+ const KevtMeta

+ const KevtName

+ const KevtNparams

+ const KevtPID

+ const KevtSeq

+ const KevtTID

+ const KevtTime

+ const KevtTimeHour

+ const KevtTimeMin

+ const KevtTimeNs

+ const KevtTimeSec

+ const NetDIP

+ const NetDIPNames

+ const NetDport

+ const NetDportName

+ const NetL4Proto

+ const NetPacketSize

+ const NetSIP

+ const NetSIPNames

+ const NetSport

+ const NetSportName

+ const None

+ const PeBaseAddress

+ const PeEntrypoint

+ const PeImports

+ const PeNumSections

+ const PeNumSymbols

+ const PeResources

+ const PeSections

+ const PeSymbols

+ const PeTimestamp

+ const PsArgs

+ const PsComm

+ const PsCwd

+ const PsDTB

+ const PsEnvs

+ const PsExe

+ const PsHandleTypes

+ const PsHandles

+ const PsModules

+ const PsName

+ const PsPid

+ const PsPpid

+ const PsSID

+ const PsSessionID

+ const RegistryKeyHandle

+ const RegistryKeyName

+ const RegistryStatus

+ const RegistryValue

+ const RegistryValueType

+ const ThreadBasePrio

+ const ThreadEntrypoint

+ const ThreadIOPrio

+ const ThreadKstackBase

+ const ThreadKstackLimit

+ const ThreadPagePrio

+ const ThreadUstackBase

+ const ThreadUstackLimit

+ func Lookup(name string) Field

+ func (f Field) String() string

+ type FieldInfo struct

+ Desc string

+ Examples []string

+ Field Field

+ Type kparams.Type

+ func Get() []FieldInfo

+ type Subfield string

+ const ModuleBaseAddress

+ const ModuleChecksum

+ const ModuleDefaultAddress

+ const ModuleLocation

+ const ModuleSize

+ const SectionEntropy

+ const SectionMD5Hash

+ const SectionSize

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL