From e9994520c9baabe95f04e5b592fa9260b8605f29 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 12 Sep 2013 15:27:22 -0400 Subject: [PATCH 01/13] Windows-definitions-schema.xsd Element "Process_state" Element "priority" - oval-sc:EntityItemStringType + type="oval-sc:EntityItemIntType" + The priority value range is from 0 to 31. Element "process58_state" + type="oval-sc:EntityItemIntType" + The priority value range is from 0 to 31. Windows-system-characteristics-schema.xsd Element "process_item" Element "priority" - oval-sc:EntityItemStringType + type="oval-sc:EntityItemIntType" + The priority value range is from 0 to 31. --- schemas/windows-definitions-schema.xsd | 8 ++++---- schemas/windows-system-characteristics-schema.xsd | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index 43f1431..ef01d73 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -4391,9 +4391,9 @@ The id given to the parent of the process that is created for the specified command line - + - The base priority of the process. + The base priority of the process. The priority value range is from 0 to 31. @@ -4513,9 +4513,9 @@ The id given to the parent of the process that is created for the specified command line - + - The base priority of the process. + The base priority of the process. The priority value range is from 0 to 31 diff --git a/schemas/windows-system-characteristics-schema.xsd b/schemas/windows-system-characteristics-schema.xsd index d8b34b0..7ec4a5f 100644 --- a/schemas/windows-system-characteristics-schema.xsd +++ b/schemas/windows-system-characteristics-schema.xsd @@ -1952,9 +1952,9 @@ The id given to the parent of the process that is created for the specified command line - + - The base priority of the process. + The base priority of the process. The priority value range is from 0 to 31. From 51787e864d75435a68ed90ee3b405dd4154f3f52 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Mon, 23 Sep 2013 15:23:12 -0400 Subject: [PATCH 02/13] issue #59 win-def:peheader_test to include windows_view element. --- schemas/windows-definitions-schema.xsd | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index 12f2dee..a8f09ef 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -3934,6 +3934,11 @@ The real_number_of_directory_entries entity is the real number of data directory entries in the remainder of the optional header calculated by enumerating the directory entries. + + + The windows view value to which this was targeted. This is used to indicate which view (32-bit or 64-bit), the associated State applies to. + + From 57c6cc637d25ab8a4d7d5235dd0ce330fc966e44 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Mon, 23 Sep 2013 17:30:17 -0400 Subject: [PATCH 03/13] added peheader_item and peheader behaviors --- schemas/windows-definitions-schema.xsd | 28 +++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index a8f09ef..3963c18 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -3560,6 +3560,15 @@ The peheader_test is used to check data from a Portable Executable file header. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a peheader_object and the optional state element specifies the metadata to check. + The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. + + + peheader_test + peheader_object + peheader_state + peheader_item + + @@ -3645,7 +3654,6 @@ - The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. @@ -3944,6 +3952,24 @@ + + + The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. + + + + + 64-bit versions of Windows provide an alternate Peheader views to 32-bit applications. This behavior allows the OVAL Object to specify which view should be examined. This behavior only applies to 64-bit Windows, and must not be applied on other platforms. + Note that the values have the following meaning: '64_bit' - Indicates that the 64-bit view on 64-bit Windows operating systems must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. '32_bit' - Indicates that the 32-bit view must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. It is recommended that the corresponding 'windows_view' entity be set on the OVAL Items that are collected when this behavior is used to distinguish between the OVAL Items that are collected in the 32-bit or 64-bit views. + + + + + + + + + From 45872df7f7e5228aa215771a18cacead2c8cb137 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Mon, 23 Sep 2013 17:43:18 -0400 Subject: [PATCH 04/13] documentation edit to registry value. Issues #61 reg_multi_sz with no values. --- schemas/windows-definitions-schema.xsd | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index 3963c18..6f51d99 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -4706,7 +4706,8 @@ - The value entity allows a test to be written against the value held within the specified registry key(s). If the value being tested is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the value being tested is of type REG_DWORD, REG_QWORD, REG_DWORD_LITTLE_ENDIAN, REG_DWORD_BIG_ENDIAN, and REG_QWORD_LITTLE_ENDIAN then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the value being tested is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the value being tested is of type REG_MULTI_SZ, then only a single string (one of the multiple strings) should be tested using the value entity with the datatype attribute set to 'string'. In order to test multiple values, multiple OVAL registry tests should be used. If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string. If the value being tested is of type REG_LINK, then the datatype attribute should be set to 'string' and the null-terminated Unicode string should be represented by the value entity. + The value entity allows a test to be written against the value held within the specified registry key(s). If the value being tested is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the value being tested is of type REG_DWORD, REG_QWORD, REG_DWORD_LITTLE_ENDIAN, REG_DWORD_BIG_ENDIAN, and REG_QWORD_LITTLE_ENDIAN then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the value being tested is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the value being tested is of type REG_MULTI_SZ, then only a single string (one of the multiple strings) should be tested using the value entity with the datatype attribute set to 'string'. In order to test multiple values, multiple OVAL registry tests should be used. If there is no value reg_multi_sz the status of "does not exist" should be given. + If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string. If the value being tested is of type REG_LINK, then the datatype attribute should be set to 'string' and the null-terminated Unicode string should be represented by the value entity. Note that if the intent is to test a version number held in the registry (as a reg_sz) then instead of setting the datatype to 'string', the datatype can be set to 'version'. This allows tools performing the evaluation to know how to perform less than and greater than operations correctly. From 30c36a92ab39d2283bc4fd37388c9cce5cbcc0b1 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Mon, 23 Sep 2013 18:00:28 -0400 Subject: [PATCH 05/13] updated documentation - shadow_test flag entity. --- schemas/unix-definitions-schema.xsd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schemas/unix-definitions-schema.xsd b/schemas/unix-definitions-schema.xsd index aadaade..d4a6156 100644 --- a/schemas/unix-definitions-schema.xsd +++ b/schemas/unix-definitions-schema.xsd @@ -2021,7 +2021,7 @@ - This is a reserved field that the shadow file may use in the future. + Flag is used for failed login count. The low order four bits are used and the remainder is reserved for shadow file future use. From 23c757f7d3e1a9144146c33fe6c0bff8c882a33c Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Tue, 24 Sep 2013 08:43:43 -0400 Subject: [PATCH 06/13] updated peheader_item with windows_view issue #59 --- schemas/windows-system-characteristics-schema.xsd | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/schemas/windows-system-characteristics-schema.xsd b/schemas/windows-system-characteristics-schema.xsd index 7ec4a5f..fb5126c 100644 --- a/schemas/windows-system-characteristics-schema.xsd +++ b/schemas/windows-system-characteristics-schema.xsd @@ -1779,6 +1779,11 @@ The real_number_of_directory_entries entity is the real number of data directory entries in the remainder of the optional header calculated by enumerating the directory entries. + + + The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set. + + From 187ee67903af502fdf619f1bcb0918c0a54c1e20 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Tue, 24 Sep 2013 11:19:20 -0400 Subject: [PATCH 07/13] edits to PeheaderBehaviors doccumentation --- schemas/windows-definitions-schema.xsd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index 6f51d99..e166af6 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -3560,7 +3560,7 @@ The peheader_test is used to check data from a Portable Executable file header. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a peheader_object and the optional state element specifies the metadata to check. - The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. + peheader_test @@ -3654,6 +3654,7 @@ + The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. @@ -3954,12 +3955,11 @@ - The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. + The PeheaderBehaviors complex type defines a number of behaviors that allow a more detailed definition of the peheader_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. - - 64-bit versions of Windows provide an alternate Peheader views to 32-bit applications. This behavior allows the OVAL Object to specify which view should be examined. This behavior only applies to 64-bit Windows, and must not be applied on other platforms. + 64-bit versions of Windows provide an alternate file system and registry views to 32-bit applications. This behavior allows the OVAL Object to state which view should be examined. This behavior only applies to 64-bit Windows, and must not be applied on other platforms. Note that the values have the following meaning: '64_bit' - Indicates that the 64-bit view on 64-bit Windows operating systems must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. '32_bit' - Indicates that the 32-bit view must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. It is recommended that the corresponding 'windows_view' entity be set on the OVAL Items that are collected when this behavior is used to distinguish between the OVAL Items that are collected in the 32-bit or 64-bit views. From 95ce032fccddb2726e3c042cd877e80cd46250ba Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 26 Sep 2013 11:07:35 -0400 Subject: [PATCH 08/13] Revert "edits to PeheaderBehaviors doccumentation" This reverts commit 187ee67903af502fdf619f1bcb0918c0a54c1e20. --- schemas/windows-definitions-schema.xsd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index e166af6..6f51d99 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -3560,7 +3560,7 @@ The peheader_test is used to check data from a Portable Executable file header. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a peheader_object and the optional state element specifies the metadata to check. - + The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. peheader_test @@ -3654,7 +3654,6 @@ - The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. @@ -3955,11 +3954,12 @@ - The PeheaderBehaviors complex type defines a number of behaviors that allow a more detailed definition of the peheader_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. + The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. + - 64-bit versions of Windows provide an alternate file system and registry views to 32-bit applications. This behavior allows the OVAL Object to state which view should be examined. This behavior only applies to 64-bit Windows, and must not be applied on other platforms. + 64-bit versions of Windows provide an alternate Peheader views to 32-bit applications. This behavior allows the OVAL Object to specify which view should be examined. This behavior only applies to 64-bit Windows, and must not be applied on other platforms. Note that the values have the following meaning: '64_bit' - Indicates that the 64-bit view on 64-bit Windows operating systems must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. '32_bit' - Indicates that the 32-bit view must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. It is recommended that the corresponding 'windows_view' entity be set on the OVAL Items that are collected when this behavior is used to distinguish between the OVAL Items that are collected in the 32-bit or 64-bit views. From e91a4db61b5b8930cbab32a15002d1b021f7c179 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 26 Sep 2013 11:10:57 -0400 Subject: [PATCH 09/13] Revert "updated peheader_item with windows_view issue #59" This reverts commit 23c757f7d3e1a9144146c33fe6c0bff8c882a33c. --- schemas/windows-system-characteristics-schema.xsd | 5 ----- 1 file changed, 5 deletions(-) diff --git a/schemas/windows-system-characteristics-schema.xsd b/schemas/windows-system-characteristics-schema.xsd index fb5126c..7ec4a5f 100644 --- a/schemas/windows-system-characteristics-schema.xsd +++ b/schemas/windows-system-characteristics-schema.xsd @@ -1779,11 +1779,6 @@ The real_number_of_directory_entries entity is the real number of data directory entries in the remainder of the optional header calculated by enumerating the directory entries. - - - The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set. - - From 0a67c2254f9e08f678020f69faf811433041dd4c Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 26 Sep 2013 11:12:18 -0400 Subject: [PATCH 10/13] Revert "updated documentation - shadow_test flag entity." This reverts commit 30c36a92ab39d2283bc4fd37388c9cce5cbcc0b1. --- schemas/unix-definitions-schema.xsd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schemas/unix-definitions-schema.xsd b/schemas/unix-definitions-schema.xsd index d4a6156..aadaade 100644 --- a/schemas/unix-definitions-schema.xsd +++ b/schemas/unix-definitions-schema.xsd @@ -2021,7 +2021,7 @@ - Flag is used for failed login count. The low order four bits are used and the remainder is reserved for shadow file future use. + This is a reserved field that the shadow file may use in the future. From de0ea24ac57fb6c8f8cab41153f139ace5d09571 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 26 Sep 2013 11:13:20 -0400 Subject: [PATCH 11/13] Revert "documentation edit to registry value. Issues #61 reg_multi_sz with no values." This reverts commit 45872df7f7e5228aa215771a18cacead2c8cb137. --- schemas/windows-definitions-schema.xsd | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index 6f51d99..3963c18 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -4706,8 +4706,7 @@ - The value entity allows a test to be written against the value held within the specified registry key(s). If the value being tested is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the value being tested is of type REG_DWORD, REG_QWORD, REG_DWORD_LITTLE_ENDIAN, REG_DWORD_BIG_ENDIAN, and REG_QWORD_LITTLE_ENDIAN then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the value being tested is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the value being tested is of type REG_MULTI_SZ, then only a single string (one of the multiple strings) should be tested using the value entity with the datatype attribute set to 'string'. In order to test multiple values, multiple OVAL registry tests should be used. If there is no value reg_multi_sz the status of "does not exist" should be given. - If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string. If the value being tested is of type REG_LINK, then the datatype attribute should be set to 'string' and the null-terminated Unicode string should be represented by the value entity. + The value entity allows a test to be written against the value held within the specified registry key(s). If the value being tested is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the value being tested is of type REG_DWORD, REG_QWORD, REG_DWORD_LITTLE_ENDIAN, REG_DWORD_BIG_ENDIAN, and REG_QWORD_LITTLE_ENDIAN then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the value being tested is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the value being tested is of type REG_MULTI_SZ, then only a single string (one of the multiple strings) should be tested using the value entity with the datatype attribute set to 'string'. In order to test multiple values, multiple OVAL registry tests should be used. If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string. If the value being tested is of type REG_LINK, then the datatype attribute should be set to 'string' and the null-terminated Unicode string should be represented by the value entity. Note that if the intent is to test a version number held in the registry (as a reg_sz) then instead of setting the datatype to 'string', the datatype can be set to 'version'. This allows tools performing the evaluation to know how to perform less than and greater than operations correctly. From fcc1f9071c40bd31e98b320f557e3bacb4ff5c06 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 26 Sep 2013 14:04:17 -0400 Subject: [PATCH 12/13] Revert "added peheader_item and peheader behaviors" This reverts commit 57c6cc637d25ab8a4d7d5235dd0ce330fc966e44. --- schemas/windows-definitions-schema.xsd | 28 +------------------------- 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index 3963c18..a8f09ef 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -3560,15 +3560,6 @@ The peheader_test is used to check data from a Portable Executable file header. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a peheader_object and the optional state element specifies the metadata to check. - The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. - - - peheader_test - peheader_object - peheader_state - peheader_item - - @@ -3654,6 +3645,7 @@ + The peheader_state defines the different metadata associated with the header of a PE file. Please refer to the individual elements in the schema for more details about what each represents. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures. @@ -3952,24 +3944,6 @@ - - - The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. - - - - - 64-bit versions of Windows provide an alternate Peheader views to 32-bit applications. This behavior allows the OVAL Object to specify which view should be examined. This behavior only applies to 64-bit Windows, and must not be applied on other platforms. - Note that the values have the following meaning: '64_bit' - Indicates that the 64-bit view on 64-bit Windows operating systems must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. '32_bit' - Indicates that the 32-bit view must be examined. On a 32-bit system, the Object must be evaluated without applying the behavior. It is recommended that the corresponding 'windows_view' entity be set on the OVAL Items that are collected when this behavior is used to distinguish between the OVAL Items that are collected in the 32-bit or 64-bit views. - - - - - - - - - From 7a496b802789e4fcafa8cf79f34f36e3c5a2c205 Mon Sep 17 00:00:00 2001 From: Luis Nunez Date: Thu, 26 Sep 2013 14:06:24 -0400 Subject: [PATCH 13/13] Revert "issue #59 win-def:peheader_test to include windows_view element." This reverts commit 51787e864d75435a68ed90ee3b405dd4154f3f52. --- schemas/windows-definitions-schema.xsd | 5 ----- 1 file changed, 5 deletions(-) diff --git a/schemas/windows-definitions-schema.xsd b/schemas/windows-definitions-schema.xsd index a8f09ef..12f2dee 100644 --- a/schemas/windows-definitions-schema.xsd +++ b/schemas/windows-definitions-schema.xsd @@ -3934,11 +3934,6 @@ The real_number_of_directory_entries entity is the real number of data directory entries in the remainder of the optional header calculated by enumerating the directory entries. - - - The windows view value to which this was targeted. This is used to indicate which view (32-bit or 64-bit), the associated State applies to. - -