Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>There is another way to find the end of a row with no additional memory.</p> <ol> <li>All <code>EventID</code> fall into definite range, and could be sequential</li> <li>All <code>Timestamp</code> have a definite range too (say, from 2009/09/09 through 2011/11/11)</li> <li><code>Length</code>, <code>EventID</code>, and <code>Timestamp</code> are adjacent between two rows and have fixed length of 16 bytes in total (4 for length, 4 for eventID, and 8 for timestamp).</li> </ol> <p>Under these considerations you could write a function that searches the end of a row, e.g.</p> <pre><code>byte* FindNextRow(byte* rowStart, byte* memBlockEnd, DWORD minEventID, DWORD maxEventID, QWORD minTimestamp, QWORD maxTimestamp) { long bytesAvail = (long)(memBlockEnd - rowStart) - 4; byte* ptr = rowStart + 12; // move to 'data' for (long i = 0; i &lt; bytesAvail; i++, ptr++) { long length = *(long*)(ptr); // check if this is the last row if (ptr + 4 == memBlockEnd) return memBlockEnd; // try to find candidate for 'length' field first if (rowStart + 12 != ptr - length) continue; // then check 'EventID' and 'Timestamp' for the next row DWORD eventID = *(DWORD*)(ptr + 4); if (eventID &lt; minEventID || eventID &gt; maxEventID) continue; // you might add additional check on a sequence: eventID + 1 == *(DWORD*)(rowStart); QWORD timestamp = *(QWORD*)(ptr + 8); if (timestamp &lt; minTimestamp || timestamp &gt; maxTimestamp) continue; // you might add additional check on a sequence: timestamp &gt; *(QWORD*)(rowStart + 4); // this is the match return ptr + 4; } } </code></pre> <p>WARNING: this will not guarantee the correctness, but you could try to find a workaround this way.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload