Searched refs:evtx_event_record_header_t (Results 1 – 3 of 3) sorted by relevance
32 typedef struct evtx_event_record_header evtx_event_record_header_t; typedef
394 sizeof( evtx_event_record_header_t ), in libevtx_record_values_read_header()400 sizeof( evtx_event_record_header_t ), in libevtx_record_values_read_header()419 ( (evtx_event_record_header_t *) event_record_data )->signature, in libevtx_record_values_read_header()435 ( (evtx_event_record_header_t *) event_record_data )->size, in libevtx_record_values_read_header()439 ( (evtx_event_record_header_t *) event_record_data )->identifier, in libevtx_record_values_read_header()443 ( (evtx_event_record_header_t *) event_record_data )->written_time, in libevtx_record_values_read_header()452 ( (evtx_event_record_header_t *) event_record_data )->signature[ 0 ], in libevtx_record_values_read_header()453 ( (evtx_event_record_header_t *) event_record_data )->signature[ 1 ], in libevtx_record_values_read_header()542 if( ( record_values->data_size < sizeof( evtx_event_record_header_t ) ) in libevtx_record_values_read_header()677 + sizeof( evtx_event_record_header_t ); in libevtx_record_values_read_xml_document()[all …]
869 xml_data_offset = chunk_data_offset + sizeof( evtx_event_record_header_t ); in libevtx_chunk_read()872 if( record_values->data_size > ( sizeof( evtx_event_record_header_t ) + 4 ) ) in libevtx_chunk_read()874 xml_data_size = record_values->data_size - ( sizeof( evtx_event_record_header_t ) + 4 ); in libevtx_chunk_read()