var numericPlaceholderRe = regexp.MustCompile(`\$\d+\$`)

func isNumeric(k reflect.Kind) bool {
	switch k {
	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
		return true
	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
		return true
	case reflect.Float32, reflect.Float64:
		return true
	default:
		return false
	}
}

	[op(0x07)]
	int LsarQueryInformationPolicy([in] policy_handle *handle,
			[in] uint16_t level,
			[out,switch_is(level),unique] LsarPolicyInfo *info);

	[op(0x0f)]
	int LsarLookupSids([in] policy_handle *handle,
			[in] LsarSidArray *sids,
			[out,unique] LsarRefDomainList *domains,
			[in,out] LsarTransNameArray *names,
			[in] uint16_t level,
			[in,out] uint32_t *count);

	[op(0x2c)]

	[op(0x07)]
	int LsarQueryInformationPolicy([in] policy_handle *handle,
			[in] uint16_t level,
			[out,switch_is(level),unique] LsarPolicyInfo *info);

	[op(0x0f)]
	int LsarLookupSids([in] policy_handle *handle,
			[in] LsarSidArray *sids,
			[out,unique] LsarRefDomainList *domains,
			[in,out] LsarTransNameArray *names,
			[in] uint16_t level,
			[in,out] uint32_t *count);

	[op(0x2c)]

	rv := reflect.ValueOf(fieldValue)
	switch v := fieldValue.(type) {
	case int64, int, uint, uint64, int32, uint32, int16, uint16:
		result = time.Unix(reflect.Indirect(rv).Int(), 0).UTC()
	case *int64, *int, *uint, *uint64, *int32, *uint32, *int16, *uint16:
		if rv.IsZero() {
			return nil, nil
		}
		result = time.Unix(reflect.Indirect(rv).Int(), 0).UTC()
	default:

// exchange.
func TLSCiphers() []uint16 {
	if Enabled {
		return []uint16{
			tls.TLS_AES_128_GCM_SHA256, // TLS 1.3
			tls.TLS_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, // TLS 1.2
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
		}
	}
	return []uint16{
		tls.TLS_CHACHA20_POLY1305_SHA256, // TLS 1.3

		{"int", math.MaxInt64, "9223372036854775807"},
		{"int8", int8(math.MaxInt8), "127"},
		{"int16", int16(math.MaxInt16), "32767"},
		{"int32", int32(math.MaxInt32), "2147483647"},
		{"int64", int64(math.MaxInt64), "9223372036854775807"},
		{"uint", uint(math.MaxUint64), "18446744073709551615"},
		{"uint8", uint8(math.MaxUint8), "255"},
		{"uint16", uint16(math.MaxUint16), "65535"},
		{"uint32", uint32(math.MaxUint32), "4294967295"},

pkg syscall (windows-386), const SYMBOLIC_LINK_FLAG_DIRECTORY = 1
pkg syscall (windows-386), const SYMBOLIC_LINK_FLAG_DIRECTORY ideal-int
pkg syscall (windows-386), func CreateHardLink(*uint16, *uint16, uintptr) error
pkg syscall (windows-386), func CreateSymbolicLink(*uint16, *uint16, uint32) error
pkg syscall (windows-386), func DeviceIoControl(Handle, uint32, *uint8, uint32, *uint8, uint32, *uint32, *Overlapped) error

pkg crypto/tls, const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 uint16
pkg crypto/tls, const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = 52393
pkg crypto/tls, const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 uint16
pkg crypto/tls, const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 49191
pkg crypto/tls, const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 uint16
pkg crypto/tls, const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = 52392

import (
	"bytes"
	"fmt"
	"syscall"
	"unsafe"
)

func direntNamlen(dirent *syscall.Dirent) (uint64, error) {
	const fixedHdr = uint16(unsafe.Offsetof(syscall.Dirent{}.Name))
	nameBuf := (*[unsafe.Sizeof(dirent.Name)]byte)(unsafe.Pointer(&dirent.Name[0]))
	const nameBufLen = uint16(len(nameBuf))
	limit := dirent.Reclen - fixedHdr
	if limit > nameBufLen {
		limit = nameBufLen
	}
	// Avoid bugs in long file names

	DestinationIps      []string      `json:"destinationIps,omitempty"`
	NotDestinationIps   []string      `json:"notDestinationIps,omitempty"`
	DestinationPorts    []uint16      `json:"destinationPorts,omitempty"`
	NotDestinationPorts []uint16      `json:"notDestinationPorts,omitempty"`
}

type StringMatch struct {
	Exact    string `json:"Exact,omitempty"`
	Suffix   string `json:"Suffix,omitempty"`