-
Notifications
You must be signed in to change notification settings - Fork 20
/
userassist.yaml
79 lines (79 loc) · 1.49 KB
/
userassist.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# dtFabric format specification.
---
name: userassist
type: format
description: UserAssist format
---
name: float32
type: floating-point
attributes:
size: 4
units: bytes
---
name: uint32
type: integer
attributes:
format: unsigned
size: 4
units: bytes
---
name: uint64
type: integer
attributes:
format: unsigned
size: 8
units: bytes
---
name: user_assist_entry_v3
type: structure
description: UserAssist format version used in Windows 2000, XP, 2003, Vista.
attributes:
byte_order: little-endian
members:
- name: unknown1
data_type: uint32
- name: number_of_executions
data_type: uint32
- name: last_execution_time
data_type: uint64
---
name: user_assist_entry_v5
type: structure
description: UserAssist format version used in Windows 2008, 7, 8, 10.
attributes:
byte_order: little-endian
members:
- name: unknown1
data_type: uint32
- name: number_of_executions
data_type: uint32
- name: application_focus_count
data_type: uint32
- name: application_focus_duration
data_type: uint32
- name: unknown2
data_type: float32
- name: unknown3
data_type: float32
- name: unknown4
data_type: float32
- name: unknown5
data_type: float32
- name: unknown6
data_type: float32
- name: unknown7
data_type: float32
- name: unknown8
data_type: float32
- name: unknown9
data_type: float32
- name: unknown10
data_type: float32
- name: unknown11
data_type: float32
- name: unknown12
data_type: uint32
- name: last_execution_time
data_type: uint64
- name: unknown13
data_type: uint32