1HF_FIELD hf_nspi_handle "Handle" "nspi.handle" FT_BYTES BASE_NONE NULL 0 "" "" "" 2 3HF_RENAME hf_nspi_NspiBind_handle hf_nspi_handle 4HF_RENAME hf_nspi_NspiUnbind_handle hf_nspi_handle 5HF_RENAME hf_nspi_NspiQueryRows_handle hf_nspi_handle 6HF_RENAME hf_nspi_NspiGetMatches_handle hf_nspi_handle 7HF_RENAME hf_nspi_NspiDNToEph_handle hf_nspi_handle 8HF_RENAME hf_nspi_NspiGetProps_handle hf_nspi_handle 9HF_RENAME hf_nspi_NspiGetHierarchyInfo_handle hf_nspi_handle 10 11HF_FIELD hf_nspi_property_type "Value" "nspi.SPropValue.value" FT_UINT32 BASE_HEX VALS(nspi_property_types_vals) 0 "" "" 12HF_FIELD hf_nspi_SRestriction_PTTYPE "Restriction Type" "nspi.property_type" FT_UINT32 BASE_HEX VALS(nspi_nspi_RestrictionType_vals) 0 "" "" 13HF_RENAME hf_nspi_SPropValue_value hf_nspi_property_type 14HF_RENAME hf_nspi_SRestriction_res hf_nspi_SRestriction_PTTYPE 15HF_RENAME hf_nspi_SRestriction_rt hf_nspi_SRestriction_PTTYPE 16 17# 18# policyhandle tracking 19# This block is to specify where a policyhandle is opened and where it is 20# closed so that policyhandles when dissected contain nice info such as 21# [opened in xxx] [closed in yyy] 22# 23# Policyhandles are opened in these functions (open==0x0001) 24PARAM_VALUE nspi_dissect_element_NspiBind_handle_ 0x0001 25# Policyhandles are closed in these functions (close==0x0002) 26PARAM_VALUE nspi_dissect_element_NspiUnbind_handle_ 0x0002 27