forked from difcareer/010templates
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathWinhexPosTemplate.bt
executable file
·33 lines (33 loc) · 1.01 KB
/
WinhexPosTemplate.bt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
//--------------------------------------
//--- 010 Editor v3.2.2f Binary Template
//
// File: WinhexPosTemplate
// Author: Artur Babecki
// Revision: 21.02.2012
// Purpose: the WinHex (editor by X-Ways Software Technology AG )
// stores the find results in the winhex.pos file.
// This template parses its structure and allows to
// build the script to convert WinHex results into set
// of bookmarks of 010Editor
//--------------------------------------
string Wh_WinhexID <comment="file signature">;
uint32 Wh_Flags <comment="currently - 0x00, 0X01 - Unicode">;
uint32 Wh_n_ch <comment="number of chunks">;
struct chunk {
uint16 Chsize <comment="chunk size">;
uint16 Chflags ;
uint64 Offset;
uint64 Time;
FILETIME date;
uchar RGB[3];
uchar Padding;
uint16 DescrLen;
string Descr;
if(Chflags&0x100) {
uint64 Relative_Offset;
uint64 FileId;
uint16 PathLen;
string Path;
}
//Printf("%X\n",chflags);
} wh_pos[Wh_n_ch] <optimize=false>;