diff --git a/patterns/tokenstore.pat b/patterns/tokenstore.pat new file mode 100644 index 0000000..2d62fc2 --- /dev/null +++ b/patterns/tokenstore.pat @@ -0,0 +1,41 @@ +struct EntryContent { + u8 header[32]; + u32 data_len; + u8 sha256[32]; + u8 data[data_len]; + u8 footer[32]; +}; + +struct Metadata { + u32 entry_off; + u32 populated; + u32 content_off; + u32 content_len; + u32 alloc_len; + char16 name[65]; + char16 ext[4]; + + if (populated == 1) { + EntryContent content @ content_off; + } +}; + +struct Block { + u32 self_off; + u32 next_off; + Metadata metadata[103]; + padding[16384 - sizeof(self_off) - sizeof(next_off) - sizeof(metadata)]; + u8 sha256[32]; + + if (next_off != 0) { + Block next @ next_off; + } +}; + +struct FileHeader { + u32 version; + u8 sha256[32]; + Block block; +}; + +FileHeader fileheader @ 0x00; \ No newline at end of file diff --git a/patterns/variablebag.pat b/patterns/variablebag.pat new file mode 100644 index 0000000..440f8a0 --- /dev/null +++ b/patterns/variablebag.pat @@ -0,0 +1,14 @@ +#include + +struct varbag_entry { + u32 crc32; + u32 unk1; + u32 len_name; + u32 len_val; + char16 name[len_name/2]; + padding[-$&7]; + u8 value[len_val]; + padding[-$&7]; +}; + +varbag_entry entries[while($ < std::mem::size())] @ 0x0; \ No newline at end of file diff --git a/patterns/win7_physstore.pat b/patterns/win7_physstore.pat new file mode 100644 index 0000000..6c816ac --- /dev/null +++ b/patterns/win7_physstore.pat @@ -0,0 +1,15 @@ +#include + +struct tsd_data { + u32 val_type; // 0 None, 1 Named, 2 Attribute, 3 Timer + u32 flags; + u32 len_key; + u32 len_val; + u32 len_data; + char16 key[len_key/2]; + u8 value[len_val]; + u8 data[len_data]; + padding[-$&3]; +}; + +tsd_data store[while($ < std::mem::size())] @ 0x8; \ No newline at end of file diff --git a/patterns/winmodern_physstore.pat b/patterns/winmodern_physstore.pat new file mode 100644 index 0000000..96cb595 --- /dev/null +++ b/patterns/winmodern_physstore.pat @@ -0,0 +1,29 @@ +struct tsd_header { + u32 len_name; + char16 name[len_name/2]; + u32 num_entries; + padding[-$&3]; +}; + +struct tsd_data { + u32 unk1; + u32 unk2; + u32 len_name; + u32 len_val; + u32 unk3; + char16 name[len_name/2]; + u8 value[len_val]; + padding[-$&3]; +}; + +struct tsentry { + tsd_header header; + tsd_data data[header.num_entries]; +}; + +struct data_store { + u32 num_entries; + tsentry entries[num_entries]; +}; + +data_store store @ 0x8; \ No newline at end of file