spp-stuff/patterns/win7_physstore.pat

15 lines
328 B
Plaintext
Raw Normal View History

2025-02-13 18:52:21 -05:00
#include <std/mem.pat>
struct tsd_data {
u32 val_type; // 0 None, 1 Named, 2 Attribute, 3 Timer
u32 flags;
u32 len_key;
u32 len_val;
u32 len_data;
char16 key[len_key/2];
u8 value[len_val];
u8 data[len_data];
padding[-$&3];
};
tsd_data store[while($ < std::mem::size())] @ 0x8;