File: msiecf_leak_record.h

package info (click to toggle)
libmsiecf 20181227-1
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, buster, sid
  • size: 11,768 kB
  • sloc: ansic: 166,133; sh: 6,056; makefile: 1,261; python: 325; sed: 16
file content (114 lines) | stat: -rw-r--r-- 2,382 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
/*
 * The LEAK record definition of a MSIE Cache File
 *
 * Copyright (C) 2009-2018, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This software is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this software.  If not, see <http://www.gnu.org/licenses/>.
 */

#if !defined( _MSIECF_LEAK_RECORD_H )
#define _MSIECF_LEAK_RECORD_H

#include <common.h>
#include <types.h>

#if defined( __cplusplus )
extern "C" {
#endif

typedef struct msiecf_leak_record_header msiecf_leak_record_header_t;

struct msiecf_leak_record_header
{
	/* Signature
	 * Consists of 4 bytes
	 * Contains: "LEAK"
	 */
	uint8_t signature[ 4 ];

	/* The number of blocks
	 * Consists of 4 bytes
	 */
	uint8_t number_of_blocks[ 4 ];

	/* Unknown
	 * Consists of 24 bytes
	 * Contains uninitialized values
	 */
	uint8_t unknown1[ 24 ];

	/* Cached file size
	 * Consists of 4 bytes
	 */
	uint8_t cached_file_size[ 4 ];

	/* Unknown
	 * Consists of 8 bytes
	 * Contains uninitialized values
	 */
	uint8_t unknown3[ 8 ];

	/* Unknown
	 * Consists of 4 bytes
	 */
	uint8_t unknown4[ 4 ];

	/* Unknown
	 * Consists of 8 bytes
	 * Contains uninitialized values
	 */
	uint8_t unknown5[ 8 ];

	/* The cache directory index
	 * Consists of 1 byte
	 */
	uint8_t cache_directory_index;

	/* Unknown
	 * Consists of 3 bytes
	 * Contains uninitialized values
	 */
	uint8_t unknown7[ 3 ];

	/* Filename offset
	 * Consists of 4 bytes
	 */
	uint8_t filename_offset[ 4 ];

	/* Unknown
	 * Consists of 24 bytes
	 * Contains uninitialized values
	 */
	uint8_t unknown9[ 24 ];

	/* Unknown
	 * Consists of 4 bytes
	 */
	uint8_t unknown10[ 4 ];

	/* Unknown date and time
	 * Consists of 4 bytes
	 * Contains a FAT date time structure
	 */
	uint8_t unknown_time[ 4 ];
};

#if defined( __cplusplus )
}
#endif

#endif /* !defined( _MSIECF_LEAK_RECORD_H ) */