http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/ (blog 'DidierStevens) Sat, 11 Feb 2012 16:16:49 +0000 hourly 1 http://wordpress.com/ http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/#comment-46435 Fri, 07 Oct 2011 18:14:58 +0000 http://blog.didierstevens.com/?p=1920#comment-46435 Handy resource: Known folder GUIDS: http://msdn.microsoft.com/en-us/library/bb882665.aspx

]]> http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/#comment-45703 Wed, 31 Aug 2011 16:09:29 +0000 http://blog.didierstevens.com/?p=1920#comment-45703 The “Focus time” (bytes 12-15) isn’t milliseconds for shorcuts (.Ink)
It’s counting the number of times the shortcut was executed.

]]> http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/#comment-42383 Wed, 13 Apr 2011 19:45:17 +0000 http://blog.didierstevens.com/?p=1920#comment-42383 @Rich The timestamp is a FILE_TIME datatype.

]]> http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/#comment-42368 Wed, 13 Apr 2011 01:15:42 +0000 http://blog.didierstevens.com/?p=1920#comment-42368 What is the formula for converting the 64-bit timestamps in bytes 60-67? I come up with 12-digit numbers after converting from hex to ascii, I’m trying to create a script to read these values. Great work btw, I love the tool!

]]> http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/#comment-41319 Wed, 29 Dec 2010 17:31:00 +0000 http://blog.didierstevens.com/?p=1920#comment-41319 @Christof What isn’t working? And to what hash values are you referring? If you’re talking about UserAssist for Windows 7, it works on my Windows 7 64 bit machine.

]]> http://blog.didierstevens.com/2010/01/04/new-format-for-userassist-registry-keys/#comment-41311 Wed, 29 Dec 2010 10:50:58 +0000 http://blog.didierstevens.com/?p=1920#comment-41311 It isn’t working under Windows 7 64 bit, because the hash values are longer thanon 32 bit!

]]>