[Libguestfs] [PATCH 8/13] hivex: Clarify some more fields.

[Richard W.M. Jones]

On Thu, Jan 28, 2010 at 03:48:44PM +0100, Jim Meyering wrote:
> Richard W.M. Jones wrote:
> 
> > On Thu, Jan 28, 2010 at 03:26:19PM +0100, Jim Meyering wrote:
> >> Richard W.M. Jones wrote:
> >> > Subject: [PATCH 08/13] hivex: Clarify some more fields.
> >> >
> >> > Taken from sentinelchicken.com documentation.
> >> > ---
> >> >  hivex/hivex.c |    5 +++--
> >> >  1 files changed, 3 insertions(+), 2 deletions(-)
> >> >
> >> > diff --git a/hivex/hivex.c b/hivex/hivex.c
> >> > index dfac896..1f5c08b 100644
> >> > --- a/hivex/hivex.c
> >> > +++ b/hivex/hivex.c
> >> > @@ -203,7 +203,8 @@ struct ntreg_nk_record {
> >> >    int32_t seg_len;              /* length (always -ve because used) */
> >> >    char id[2];                   /* "nk" */
> >> >    uint16_t flags;
> >> > -  char timestamp[12];
> >> > +  char timestamp[8];
> >> > +  char unknown0[4];
> >>
> >> I wonder if it's nanoseconds...
> >
> > No it's much stranger than that.  Tenths of microseconds since Jan 1 1601.
> 
> I meant the "unknown0" member.

That particular field is always 0 in the files I have access to.  The
other "unknown" fields seem to be significant and that's what I'm
trying to work out now.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://et.redhat.com/~rjones/virt-top