1HF_FIELD hf_nspi_handle "Handle" "nspi.handle" FT_BYTES BASE_NONE NULL 0 "" "" ""
2
3HF_RENAME hf_nspi_NspiBind_handle hf_nspi_handle
4HF_RENAME hf_nspi_NspiUnbind_handle hf_nspi_handle
5HF_RENAME hf_nspi_NspiQueryRows_handle hf_nspi_handle
6HF_RENAME hf_nspi_NspiGetMatches_handle hf_nspi_handle
7HF_RENAME hf_nspi_NspiDNToEph_handle hf_nspi_handle
8HF_RENAME hf_nspi_NspiGetProps_handle hf_nspi_handle
9HF_RENAME hf_nspi_NspiGetHierarchyInfo_handle hf_nspi_handle
10
11HF_FIELD hf_nspi_property_type "Value" "nspi.SPropValue.value" FT_UINT32 BASE_HEX VALS(nspi_property_types_vals) 0 "" ""
12HF_FIELD hf_nspi_SRestriction_PTTYPE "Restriction Type" "nspi.property_type" FT_UINT32 BASE_HEX VALS(nspi_nspi_RestrictionType_vals) 0 "" ""
13HF_RENAME hf_nspi_SPropValue_value hf_nspi_property_type
14HF_RENAME hf_nspi_SRestriction_res hf_nspi_SRestriction_PTTYPE
15HF_RENAME hf_nspi_SRestriction_rt  hf_nspi_SRestriction_PTTYPE
16
17#
18# policyhandle tracking
19# This block is to specify where a policyhandle is opened and where it is
20# closed so that policyhandles when dissected contain nice info such as
21# [opened in xxx]  [closed in yyy]
22#
23# Policyhandles are opened in these functions (open==0x0001)
24PARAM_VALUE nspi_dissect_element_NspiBind_handle_ 0x0001
25# Policyhandles are closed in these functions (close==0x0002)
26PARAM_VALUE nspi_dissect_element_NspiUnbind_handle_ 0x0002
27