├── AVITemplate.bt ├── AXMLTemplate.bt ├── AndroidBackUpTemplate.bt ├── AndroidManifestTemplate.bt ├── AndroidzImageTemplate.bt ├── BMPTemplate.bt ├── Bt2NvidiaWrapper.bt ├── CABTemplate.bt ├── CAPTemplate.bt ├── CDATemplate.bt ├── CLASSTemplate.bt ├── CLASSTemplate2.bt ├── CLASSTemplate3.bt ├── CRXTemplate.bt ├── DBFTemplate.bt ├── DEXTemplate.bt ├── DEXTemplate.new.bt ├── DMPTemplate.bt ├── EDIDTemplate.bt ├── ELF.bt ├── ELFTemplate.bt ├── ELFTemplate.new.bt ├── EMFTemplate.bt ├── EOTTemplate.bt ├── EVSBTemplate.bt ├── EVTTemplate.zip ├── EXETemplate.bt ├── EXETemplate2.bt ├── FAT16Template.bt ├── FLVTemplate.bt ├── GIFTemplate.bt ├── GPTTemplate.bt ├── GZipTemplate.bt ├── GeoTIFTemplate.bt ├── GocleverTemplate.bt ├── ICOTemplate.bt ├── IDBTemplate.bt ├── ISOBMFTemplate.bt ├── InspectorDates.bt ├── InspectorWithMP4DateTime.bt ├── JPGTemplate.bt ├── LGDrmDexTemplate.bt ├── LNKTemplate.bt ├── LUKSTemplate.bt ├── MBRTemplate.bt ├── MBRTemplateFAT.bt ├── MIDITemplate.bt ├── MOBITemplate.bt ├── MP3Template.bt ├── MP4Template.bt ├── MPQTemplate.bt ├── MachOTemplate.bt ├── MachOTemplate_1.bt ├── Mifare1kTemplate.bt ├── Mifare4kTemplate.bt ├── MiniDumpTemplate.bt ├── NetflowVersion5.bt ├── OGGTemplate.bt ├── OrCAD3.20a_LIB.bt ├── OrCad3.20a_SCH.bt ├── OscarItemTemplate.bt ├── PALTemplate.bt ├── PCAPTemplate.bt ├── PCXTemplate.bt ├── PDFTemplate.bt ├── PETemplate.bt ├── PNG12Template.bt ├── PNGTemplate.bt ├── PSFTemplate.bt ├── PYCTemplate.bt ├── QihooPackerTemplate.bt ├── RARTemplate.bt ├── RDBTemplate.bt ├── README.md ├── RESTemplate.bt ├── ROMFS.bt ├── RegistryHive.bt ├── RegistryPolicyFileTemplate.bt ├── SHPTemplate.bt ├── SHXTemplate.bt ├── SKB_SecureDataHeader.bt ├── SONYCamFirmwareTemplate.bt ├── SRecTemplate.bt ├── SSPTemplate.bt ├── STLTemplate.bt ├── SWFTemplate.bt ├── SinclairMicrodriveImage.bt ├── TGATemplate.bt ├── TIFTemplate.bt ├── TOCTemplate.bt ├── TTFTemplate.bt ├── TacxTemplate.bt ├── UTMPTemplate.bt ├── VHDTemplate.bt ├── VirtualBoxKeystore.bt ├── WAVTemplate.bt ├── WAVTemplateAdv.bt ├── WMFTemplate.bt ├── WinhexPosTemplate.bt ├── ZIPTemplate.bt ├── ZIPTemplateAdv.bt └── exFATTemplate.bt /AVITemplate.bt: -------------------------------------------------------------------------------- 1 | //------------------------------------ 2 | //--- 010 Editor v1.2 Binary Template 3 | // 4 | // Name: AVITemplate.bt 5 | // Original Author: Blaine Lefebvre [bl] 6 | // Contributor: Elias Bachaalany [eb] 7 | // Purpose: Parse an AVI file 8 | // 9 | // Last Updated: 10/02/2006, 04:40 PM 10 | // 11 | // History 12 | // ----------- 13 | // [bl] original version: Blaine Lefevre 14 | // 10/02/2006: 15 | // - [eb] Added BITMAPINFO and WAVEFORMATEX proper strfHEADER recognition 16 | // - [eb] Fixed 'idx1' parsing 17 | //------------------------------------ 18 | 19 | 20 | typedef struct 21 | { 22 | WORD wFormatTag; 23 | WORD nChannels; 24 | DWORD nSamplesPerSec; 25 | DWORD nAvgBytesPerSec; 26 | WORD nBlockAlign; 27 | WORD wBitsPerSample; 28 | WORD cbSize; 29 | } WAVEFORMATEX; 30 | 31 | // head structure info 32 | typedef struct 33 | { 34 | DWORD dwMicroSecPerFrame; 35 | DWORD dwMaxBytesPerSec; 36 | DWORD dwReserved1; 37 | DWORD dwFlags; 38 | DWORD dwTotalFrames; 39 | DWORD dwInitialFrames; 40 | DWORD dwStreams; 41 | DWORD dwSuggestedBufferSize; 42 | DWORD dwWidth; 43 | DWORD dwHeight; 44 | DWORD dwScale; 45 | DWORD dwRate; 46 | DWORD dwStart; 47 | DWORD dwLength; 48 | } MainAVIHeader; 49 | 50 | typedef struct 51 | { 52 | uint32 biSize; 53 | uint32 biWidth; 54 | uint32 biHeight; 55 | uint16 biPlanes; 56 | uint16 biBitCount; 57 | uint32 biCompression; 58 | uint32 biSizeImage; 59 | uint32 biXPelsPerMeter; 60 | uint32 biYPelsPerMeter; 61 | uint32 biClrUsed; 62 | uint32 biClrImportant; 63 | } BITMAPINFOHEADER; 64 | 65 | typedef struct 66 | { 67 | unsigned char rgbBlue; 68 | unsigned char rgbGreen; 69 | unsigned char rgbRed; 70 | unsigned char rgbReserved; 71 | } RGBQUAD; 72 | 73 | typedef struct 74 | { 75 | BITMAPINFOHEADER bmiHeader; 76 | RGBQUAD bmiColors; 77 | } BITMAPINFO; 78 | 79 | typedef struct 80 | { 81 | char id[4]; 82 | uint32 datalen; 83 | MainAVIHeader data; 84 | } avihHEADER; 85 | 86 | 87 | // header stream structure info 88 | typedef struct 89 | { 90 | char fccType[4]; 91 | char fccHandler[4]; 92 | DWORD dwFlags; 93 | DWORD dwReserved1; 94 | DWORD dwInitialFrames; 95 | DWORD dwScale; 96 | DWORD dwRate; 97 | DWORD dwStart; 98 | DWORD dwLength; 99 | DWORD dwSuggestedBufferSize; 100 | DWORD dwQuality; 101 | DWORD dwSampleSize; 102 | DWORD xdwQuality; 103 | DWORD xdwSampleSize; 104 | } AVIStreamHeader; 105 | 106 | typedef struct 107 | { 108 | char id[4]; 109 | uint32 datalen; 110 | AVIStreamHeader data; 111 | }strhHEADER; 112 | 113 | 114 | // Generic strfHEADER 115 | typedef struct 116 | { 117 | char id[4]; 118 | uint32 datalen; 119 | if (datalen % 2) 120 | char data[datalen+1]; 121 | else 122 | char data[datalen]; 123 | } strfHEADER; 124 | 125 | // strfHEADER with BITMAPINFOHEADER 126 | typedef struct 127 | { 128 | char id[4]; 129 | uint32 datalen; 130 | BITMAPINFOHEADER bmiHeader; 131 | local int sz = sizeof(bmiHeader); 132 | if (datalen == (sizeof(BITMAPINFOHEADER) + sizeof(RGBQUAD))) 133 | { 134 | RGBQUAD bmiColors; 135 | sz += sizeof(RGBQUAD); 136 | } 137 | Printf("left: %d\n", sz); 138 | char exData[datalen - sz]; 139 | } strfHEADER_BIH; 140 | 141 | 142 | // strfHEADER with WAVEFORMAT 143 | typedef struct 144 | { 145 | char id[4]; 146 | uint32 datalen; 147 | WAVEFORMATEX wave; 148 | char exData[datalen - sizeof(WAVEFORMATEX)]; 149 | } strfHEADER_WAVE; 150 | 151 | // 152 | typedef struct 153 | { 154 | char id[4]; 155 | uint32 datalen; 156 | if ( datalen % 2 ) 157 | char data[datalen+1]; 158 | else 159 | char data[datalen]; 160 | } strnHEADER; 161 | 162 | // 163 | typedef struct 164 | { 165 | char id[4]; 166 | uint32 datalen; 167 | if ( datalen % 2 ) 168 | char data[datalen+1]; 169 | else 170 | char data[datalen]; 171 | } genericblock; 172 | 173 | 174 | 175 | typedef struct 176 | { 177 | char id[4]; 178 | uint32 datalen; 179 | char type[4]; 180 | 181 | if (!Memcmp(type,"hdrl",4)) 182 | { 183 | avihHEADER avhi; 184 | } 185 | else if (!Memcmp(type,"strl",4)) 186 | { 187 | strhHEADER strh; 188 | 189 | // Printf("->%c%c%c%c\n", strh.data.fccHandler[0], strh.data.fccHandler[1],strh.data.fccHandler[2],strh.data.fccHandler[3]); 190 | if (Memcmp(strh.data.fccType, "vids", 4) == 0) 191 | { 192 | strfHEADER_BIH strf; 193 | } 194 | else if (Memcmp(strh.data.fccType, "auds", 4) == 0) 195 | { 196 | strfHEADER_WAVE strf; 197 | } 198 | else 199 | { 200 | strfHEADER strf; 201 | } 202 | strnHEADER strn; 203 | } 204 | else if (Memcmp(type,"movi",4) == 0) 205 | { 206 | local int32 pointer = 0; 207 | local int32 stop = datalen - 4; 208 | 209 | //Printf("stop=%d\n", stop); 210 | 211 | do 212 | { 213 | genericblock gb; 214 | pointer += sizeof(gb); 215 | //Printf("+%x = %d\n", gb.datalen, pointer); 216 | } while (pointer != stop); 217 | } 218 | else 219 | { 220 | char data[datalen-4]; 221 | } 222 | } LISTHEADER; 223 | 224 | 225 | // junk structure info 226 | typedef struct 227 | { 228 | char id[4]; 229 | uint32 datalen; 230 | if ( datalen % 2 ) 231 | char data[datalen+1]; 232 | else 233 | char data[datalen]; 234 | } JUNKHEADER; 235 | 236 | 237 | // aviindex structure info 238 | typedef struct 239 | { 240 | DWORD ckid; 241 | DWORD dwFlags; 242 | DWORD dwChunkOffset; 243 | DWORD dwChunkLength; 244 | } AVIINDEXENTRY; 245 | 246 | const DWORD AVIINDEXENTRYLEN = 16; 247 | 248 | typedef struct 249 | { 250 | char id[4]; 251 | uint32 datalen; 252 | AVIINDEXENTRY data[datalen/AVIINDEXENTRYLEN]; 253 | } idx1HEADER; 254 | 255 | // root structure info 256 | typedef struct xroot 257 | { 258 | char id[4]; // RIFF 259 | if (root.id[3] == 'X') 260 | { 261 | Printf("Motorola format\n"); 262 | BigEndian(); 263 | } 264 | else 265 | { 266 | Printf("Intel format\n"); 267 | LittleEndian(); 268 | } 269 | 270 | uint32 datalen; 271 | char form[4]; 272 | 273 | if (Strcmp(form, "AVI ")) 274 | { 275 | Warning("Not a valid AVI file"); 276 | return -1; 277 | } 278 | } ROOT; 279 | 280 | local char nheader[4]; 281 | 282 | ROOT root; 283 | 284 | while (!FEof()) 285 | { 286 | ReadBytes(nheader,FTell(), 4); 287 | 288 | if (Memcmp(nheader,"LIST",4) == 0) 289 | { 290 | LISTHEADER list; 291 | } 292 | else if (Memcmp(nheader, "JUNK",4) == 0) 293 | { 294 | JUNKHEADER junk; 295 | } 296 | else if (Memcmp(nheader, "idx1",4) == 0) 297 | { 298 | idx1HEADER idx1; 299 | } 300 | else 301 | { 302 | if (!FEof()) 303 | Printf("unknown chunk: %c%c%c%c", nheader[0],nheader[1],nheader[2],nheader[3]); 304 | return -1; 305 | } 306 | } 307 | -------------------------------------------------------------------------------- /AndroidBackUpTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0beta2 Binary Template 3 | // 4 | // File: AndroidBackUpTemplate.bt 5 | // Author: Tim "diff" Strazzere 6 | // Revision: 1.0 7 | // Purpose: Quick template for parsing Android Back Ups 8 | // 9 | //-------------------------------------- 10 | 11 | // utility type to show the SHA1 hash in the value column 12 | typedef ubyte SHA1[20] ; 13 | 14 | string SHA1Read(SHA1 sig) { 15 | string ret; 16 | string tmp; 17 | int i; 18 | 19 | for(i = 0; i<20; i++) { 20 | SPrintf(tmp, "%.2X", sig[i]); 21 | ret += tmp; 22 | } 23 | 24 | return ret; 25 | } 26 | 27 | typedef struct { 28 | string magic ; 29 | if(Strcmp(magic, "ANDROID BACKUP\n") != 0) { 30 | return("Doesn't appear to be an Android Back Up file - bailing!\n"); 31 | } 32 | 33 | string backup_file_format ; 34 | 35 | string compressed_flag ; 36 | 37 | string encryption_algorithm ; 38 | if(Strcmp(encryption_algorithm, "none") != 0) { 39 | string user_password_salt; 40 | string master_key_checksum_salt; 41 | 42 | } 43 | } Android_Global_File_header; 44 | 45 | Android_Global_File_header globalFileHeader; -------------------------------------------------------------------------------- /AndroidManifestTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0.2 Binary Template 3 | // 4 | // File: AndroidManifestTemplate.bt 5 | // Author: dongmu 6 | // Revision: 1.0 7 | // Purpose: Define a template for parsing 8 | // AndroidManifest.xml binary files. 9 | //-------------------------------------- 10 | 11 | // Define the structures used in a 12 | // AndroidManifest.xml binary file 13 | 14 | // Define Header 15 | typedef struct { 16 | uint magicnumber; 17 | uint filesize; 18 | } HEADER; 19 | 20 | // Define the string format 21 | typedef struct { 22 | ushort sfSize; 23 | if (sfSize > 0) 24 | { 25 | struct { 26 | char c1; 27 | char c2; 28 | } ONECHAR[ sfSize ]; 29 | } 30 | ushort sfEnd; 31 | } STRING_ITEM; 32 | 33 | 34 | // Define the string chunk 35 | typedef struct { 36 | uint scSignature; 37 | uint scSize; 38 | uint scStringCount; 39 | uint scStyleCount; 40 | uint scUNKNOWN; 41 | uint scStringPoolOffset; 42 | uint scStylePoolOffset; 43 | uint scStringOffsets[ scStringCount ] ; 44 | 45 | if (scStyleCount > 0) 46 | uint scStyleOffset[ scStylePoolOffset ]; 47 | 48 | // The Strings 49 | local int i; 50 | for (i = 0; i < scStringCount; i++) 51 | { 52 | if ((0x8+scStringPoolOffset + scStringOffsets[ i ]) < (0x8+scSize)) 53 | { 54 | FSeek(0x8+scStringPoolOffset + scStringOffsets[ i ]); 55 | STRING_ITEM strItem; 56 | } 57 | } 58 | 59 | } STRINGCHUNK; 60 | 61 | // Define the Resource chunk 62 | typedef struct { 63 | 64 | local int pos = FTell(); 65 | 66 | uint rcSignature; 67 | uint rcSize; 68 | uint rcItem[ rcSize/4 - 2 ]; 69 | 70 | } RESOURCEIDCHUNK; 71 | 72 | // Define the Start Namespace Chunk 73 | typedef struct { 74 | uint sncSignature; 75 | uint sncSize; 76 | uint sncLineNumber; 77 | uint sncUNKNOWN; 78 | uint sncPrefix; 79 | uint sncUri; 80 | } SNCHUNK; 81 | 82 | // Define the End Namespace Chunk 83 | typedef struct { 84 | uint encSignature; 85 | uint encSize; 86 | uint encLineNumber; 87 | uint encUNKNOWN; 88 | uint encPrefix; 89 | uint encUri; 90 | } ENCHUNK; 91 | 92 | // Define the Attribute Chunk 93 | typedef struct { 94 | uint acNamespaceUri; 95 | uint acName; 96 | uint acValueStr; 97 | uint acType ; 98 | uint acData; 99 | } ATTRIBUTECHUNK; 100 | 101 | 102 | // Define the Start Tag Chunk 103 | typedef struct { 104 | local int pos = FTell(); 105 | uint stcSignature; 106 | uint stcSize; 107 | uint stcLineNumber; 108 | uint stcUNKNOWN; 109 | uint stcNamespaceUri; 110 | uint stcName; 111 | uint stcFlags; 112 | uint stcAttributeCount; 113 | uint stcClassAttribute; 114 | 115 | while (FTell() != pos + stcSize) 116 | ATTRIBUTECHUNK attributeChunk; 117 | } STCHUNK; 118 | 119 | // Define the End Tag Chunk 120 | typedef struct { 121 | uint etcSignature; 122 | uint etcSize; 123 | uint etcLineNumber; 124 | uint etcUNKNOWN; 125 | uint etcNamespaceUri; 126 | uint etcName; 127 | } ETCHUNK; 128 | 129 | // Define the Text Chunk 130 | typedef struct { 131 | uint tcSignature; 132 | uint tcSize; 133 | uint tcLineNumber; 134 | uint tcUNKNOWN; 135 | uint tcName; 136 | uint tcUNKNOWN; 137 | uint tcUNNNOWN; 138 | } TEXTCHUNK; 139 | 140 | //-------------------------------------- 141 | // Define the file 142 | 143 | local uint tag; 144 | 145 | LittleEndian(); 146 | HEADER header; 147 | 148 | SetBackColor( cLtGreen ); 149 | STRINGCHUNK stringChunk; 150 | // Sometimes there are some zeros padding after the string chunk 151 | FSeek(0x8+stringChunk.scSize); 152 | 153 | SetBackColor( cLtBlue ); 154 | RESOURCEIDCHUNK resourceChunk; 155 | FSeek(resourceChunk.pos+resourceChunk.rcSize); 156 | 157 | while( !FEof() ) 158 | { 159 | // Read a tag 160 | tag = ReadUInt( FTell() ); 161 | 162 | // Read data depending upon tag 163 | if (tag == 0x00100100) 164 | { 165 | SetBackColor( cLtPurple ); 166 | SNCHUNK startNamespaceChunk; 167 | } 168 | else if (tag == 0x00100101) 169 | { 170 | SetBackColor( cLtPurple ); 171 | ENCHUNK endNamespaceChunk; 172 | } 173 | else if (tag == 0x00100102) 174 | { 175 | SetBackColor( cLtGreen ); 176 | STCHUNK startTagChunk; 177 | } 178 | else if (tag == 0x00100103) 179 | { 180 | SetBackColor( cLtGreen ); 181 | ETCHUNK endTagChunk; 182 | } 183 | else if (tag == 0x00100104) 184 | { 185 | SetBackColor( cLtBlue ); 186 | TEXTCHUNK TextChunk; 187 | } 188 | } 189 | -------------------------------------------------------------------------------- /AndroidzImageTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0beta2 Binary Template 3 | // 4 | // File: AndroidzImageTemplate.bt 5 | // Author: Tim "diff" Strazzere 6 | // Revision: 1.1 7 | // Purpose: Quick template for parsing Android boot/recovery (zImage) images, just wip 8 | // 9 | // Most (if not all) research stolen from; 10 | // - https://github.com/we3des/psychic-octo-robot/wiki/Android-boot.img-zImage-format 11 | // Which is pulled mostly from; 12 | // - https://github.com/android/platform_system_core/blob/master/mkbootimg/bootimg.h 13 | // 14 | // CertISW structure (added in 1.1) was taken from; 15 | // - http://www.droid-developers.org/wiki/Cryptography 16 | //-------------------------------------- 17 | 18 | #define PAGE_SIZE (0x800) 19 | 20 | // utility type to show the SHA1 hash in the value column 21 | typedef ubyte SHA1[20] ; 22 | 23 | string SHA1Read(SHA1 sig) { 24 | string ret; 25 | string tmp; 26 | int i; 27 | 28 | for(i = 0; i<20; i++) { 29 | SPrintf(tmp, "%.2X", sig[i]); 30 | ret += tmp; 31 | } 32 | 33 | return ret; 34 | } 35 | 36 | typedef struct { 37 | int image_offset; 38 | int image_size; 39 | int data_byte[5]; 40 | } Images; 41 | 42 | typedef struct { 43 | char signer_info[16]; 44 | long signature_info; 45 | long key_id; 46 | char digest[256]; 47 | } Digest; 48 | 49 | typedef struct { 50 | int reg_address; 51 | int reg_value; 52 | } Reg_table; 53 | 54 | typedef struct { 55 | char cert_mark[8] ; 56 | if(Strcmp(cert_mark, "CertISW\00") != 0) { 57 | return("Doesn't appear to be a correct CerISW struct - bailing!\n"); 58 | } 59 | 60 | int cert_version; 61 | int cert_type; 62 | 63 | int minimum_version_src; 64 | int minimum_version_pk; 65 | int minimum_version_ppa; 66 | int minimum_version_rd1; 67 | int minimum_version_rd2; 68 | int minimum_version_isw; 69 | 70 | int watchdog_param; 71 | int use_DMA; 72 | int active_images; 73 | Images images[4]; 74 | 75 | int magic[1]; 76 | int reg_bitfield; 77 | Reg_table reg_table[32]; 78 | int reg_type_01; 79 | int reg_type_02; 80 | 81 | int enter_point_offset; 82 | int zero_hole[32]; 83 | Digest digest; 84 | 85 | } CertISW; 86 | 87 | typedef struct { 88 | char magic[8] ; 89 | if(Strcmp(magic, "ANDROID!") != 0) { 90 | return("Doesn't appear to be a zImage file - bailing!\n"); 91 | } 92 | 93 | uint kernel_size; 94 | uint kernel_address ; 95 | 96 | uint ramdisk_size; 97 | uint ramdisk_address ; 98 | 99 | uint second_size; 100 | uint second_address ; 101 | 102 | uint tag_address ; 103 | 104 | uint page_size ; 105 | 106 | ubyte unused[8] ; 107 | 108 | char name[16] ; 109 | char cmd_line[512] ; 110 | 111 | // Comments from bootimg.h claim this field is; "timestamp / checksum / sha1 / etc" 112 | // However the actual usage in mkbootimg.c only appears to be the sha1 of 113 | // the kernel data, ramdisk data and second data section 114 | // - https://github.com/android/platform_system_core/blob/master/mkbootimg/mkbootimg.c#L237 115 | SHA1 id ; 116 | } Android_zImage_header; 117 | 118 | // Does it look like it has a CertISW? 119 | if(ReadByte(0) == 0x43) { 120 | CertISW Cert_ISW; 121 | } 122 | 123 | local int start = FTell(); 124 | 125 | // This should always be one page 126 | Android_zImage_header bootImage; 127 | // Skip to the end of the page 128 | FSkip(PAGE_SIZE - FTell() + start); 129 | 130 | // Ensure we get the padded page at the end 131 | local int pages = pages = bootImage.kernel_size / PAGE_SIZE; 132 | if(bootImage.kernel_size % PAGE_SIZE) { 133 | pages = pages + 1; 134 | } 135 | if(pages != 0) { 136 | ubyte kernel[pages * PAGE_SIZE]; 137 | } 138 | 139 | // Ensure we get the padded page at the end 140 | pages = bootImage.ramdisk_size / PAGE_SIZE; 141 | if(bootImage.ramdisk_size % PAGE_SIZE) { 142 | pages = pages + 1; 143 | } 144 | if(pages != 0) { 145 | ubyte ramdisk[pages * PAGE_SIZE]; 146 | } 147 | 148 | // Ensure we get the padded page at the end 149 | pages = bootImage.second_size / PAGE_SIZE; 150 | if(bootImage.second_size % PAGE_SIZE) { 151 | pages = pages + 1; 152 | } 153 | if(pages != 0) { 154 | ubyte second[pages * PAGE_SIZE]; 155 | } -------------------------------------------------------------------------------- /BMPTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: BMPTemplate.bt 5 | // Author: SweetScape Software 6 | // Revision: 2.2 7 | // Purpose: Defines a template for 8 | // parsing BMP image files. 9 | //----------------------------------- 10 | 11 | // Define structures used in BMP files 12 | 13 | typedef struct { // bmfh 14 | CHAR bfType[2]; 15 | DWORD bfSize; 16 | WORD bfReserved1; 17 | WORD bfReserved2; 18 | DWORD bfOffBits; 19 | } BITMAPFILEHEADER; 20 | 21 | typedef struct { // bmih 22 | DWORD biSize; 23 | LONG biWidth; 24 | LONG biHeight; 25 | WORD biPlanes; 26 | WORD biBitCount; 27 | DWORD biCompression; 28 | DWORD biSizeImage; 29 | LONG biXPelsPerMeter; 30 | LONG biYPelsPerMeter; 31 | DWORD biClrUsed; 32 | DWORD biClrImportant; 33 | } BITMAPINFOHEADER; 34 | 35 | typedef struct { // rgbq 36 | UBYTE rgbBlue; 37 | UBYTE rgbGreen; 38 | UBYTE rgbRed; 39 | UBYTE rgbReserved; 40 | } RGBQUAD ; 41 | 42 | typedef struct { // rgbt 43 | UBYTE rgbBlue; 44 | UBYTE rgbGreen; 45 | UBYTE rgbRed; 46 | } RGBTRIPLE ; 47 | 48 | //--------------------------------------------- 49 | // Custom read functions for color types - this allows the 50 | // color to be displayed without having to open up the structure. 51 | 52 | string ReadRGBQUAD( RGBQUAD &a ) 53 | { 54 | string s; 55 | SPrintf( s, "#%02X%02X%02X%02X", (int)a.rgbReserved, (int)a.rgbRed, (int)a.rgbGreen, (int)a.rgbBlue ); 56 | return s; 57 | } 58 | 59 | string ReadRGBTRIPLE( RGBTRIPLE &a ) 60 | { 61 | string s; 62 | SPrintf( s, "#%02X%02X%02X", (int)a.rgbRed, (int)a.rgbGreen, (int)a.rgbBlue ); 63 | return s; 64 | } 65 | 66 | //--------------------------------------------- 67 | 68 | // Define the headers 69 | LittleEndian(); 70 | SetBackColor( cLtGray ); 71 | BITMAPFILEHEADER bmfh; 72 | BITMAPINFOHEADER bmih; 73 | 74 | // Check for header 75 | if( bmfh.bfType != "BM" ) 76 | { 77 | Warning( "File is not a bitmap. Template stopped." ); 78 | return -1; 79 | } 80 | 81 | // Define the color table 82 | if( (bmih.biBitCount != 24) && (bmih.biBitCount != 32) ) 83 | { 84 | SetBackColor( cLtAqua ); 85 | if( bmih.biClrUsed > 0 ) 86 | RGBQUAD aColors[ bmih.biClrUsed ]; 87 | else 88 | RGBQUAD aColors[ 1 << bmih.biBitCount ]; 89 | } 90 | 91 | // Define the bytes of the data 92 | SetBackColor( cNone ); 93 | if( bmih.biCompression > 0 ) 94 | { 95 | // Bytes are compressed 96 | if( bmih.biSizeImage > 0 ) 97 | UBYTE rleData[ bmih.biSizeImage ]; 98 | else 99 | UBYTE rleData[ bmfh.bfSize - FTell() ]; 100 | } 101 | else 102 | { 103 | // Calculate bytes per line and padding required 104 | local int bytesPerLine = (int)Ceil( bmih.biWidth * bmih.biBitCount / 8.0 ); 105 | local int padding = 4 - (bytesPerLine % 4); 106 | if( padding == 4 ) 107 | padding = 0; 108 | 109 | // Define each line of the image 110 | struct BITMAPLINE { 111 | 112 | // Define color data 113 | if( bmih.biBitCount < 8 ) 114 | UBYTE imageData[ bytesPerLine ]; 115 | else if( bmih.biBitCount == 8 ) 116 | UBYTE colorIndex[ bmih.biWidth ]; 117 | else if( bmih.biBitCount == 24 ) 118 | RGBTRIPLE colors[ bmih.biWidth ]; 119 | else if( bmih.biBitCount == 32 ) 120 | RGBQUAD colors[ bmih.biWidth ]; 121 | 122 | // Pad if necessary 123 | if( padding != 0 ) 124 | UBYTE padBytes[ padding ]; 125 | 126 | } lines[ bmih.biHeight ] ; 127 | } -------------------------------------------------------------------------------- /Bt2NvidiaWrapper.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0beta1 Binary Template 3 | // 4 | // File: Bt2NvidiaWrapper.bt 5 | // Author: Tim "diff" Strazzere 6 | // 7 | // 8 | // Revision: 0.5 9 | // Purpose: Quick template for "Bt2" files, which seems to be an Nvidia specific 10 | // format for "wrapped" things; 11 | // - modem.wrapped 12 | // - secondary_boot.wrapped 13 | // 14 | // Not done - more to reverse 15 | //-------------------------------------- 16 | 17 | typedef enum { 18 | UNKNOWN = 0x0A14E91C, 19 | // Head of both modem and secondary 20 | NORMAL = 0x1CE9140A, 21 | BT2_BOOTMAGIC = 0x1CE8060A, 22 | // Found right before xml in seconardy_boot.wrapped 23 | BT2_TRAILER_MAGIC = 0x1CEB72AB, 24 | MODEM = 0x1CE70100 25 | } magic ; 26 | 27 | // 0x20 bytes large according to reversing 28 | typedef struct { 29 | // Likely magic bytes appears normally as; 30 | // 0x0A14E91C 31 | // Seems to be code to check for; 32 | // 0x1CE9140A 33 | // 0x1CEB72AB "trailer magic" 34 | magic tag ; 35 | uint length ; 36 | uint file_size ; 37 | uint file_id; 38 | 39 | if(length - 0x10 > 0) { 40 | byte data[length - 0x10]; 41 | } 42 | } header; 43 | 44 | typedef struct { 45 | magic tag ; 46 | uint length ; 47 | if(length > 0) { 48 | byte xml_data[length]; 49 | } 50 | } BT2Trailer; 51 | 52 | typedef struct { 53 | header head; 54 | if(head.length + head.file_size != FileSize()) { 55 | Warning("File size does not seem correct according to header, expected %d but have %d", head.file_size, FileSize()); 56 | } 57 | //byte data[head.file_size - head.length]; 58 | } archive; 59 | 60 | 61 | archive archive_struct; -------------------------------------------------------------------------------- /CABTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.2.2 Binary Template 3 | // 4 | // File: cabtemplate.bt 5 | // Author: Alex McDonnell 6 | // Revision: 0.1 7 | // Purpose: Parse Microsoft CAB files 8 | // Changes: 9 | // 0.2 (SweetScape): 10 | // - Allow for multiple flags to be set at the same time 11 | //-------------------------------------- 12 | 13 | // Define structures used in CAB files 14 | 15 | typedef struct { 16 | //header 17 | char signature[4]; /* 'MSCF' */ 18 | uint reserved1; /* 0x00000000 */ 19 | uint cbCabinet; /* size of this cabinet file in bytes */ 20 | uint reserved2; /* 0x00000000 */ 21 | uint coffFiles; /* offset of the first CFFILE entry */ 22 | uint reserved3; /* 0x00000000 */ 23 | ubyte versionMinor; /* cabinet file format version, minor 0x03 */ 24 | ubyte versionMajor; /* cabinet file format version, major 0x01 */ 25 | ushort cFolders; /* number of CFFOLDER entries in this cabinet */ 26 | ushort cFiles; /* number of CFFILE entries in this cabinet */ 27 | ushort flags; /* cabinet file option indicators 0x0001 0x0002 0x0004 only*/ 28 | ushort setID; /* must be the same for all cabinets in a set */ 29 | ushort iCabinet; /* number of this cabinet file in a set */ 30 | 31 | if(flags & 4){ 32 | 33 | ushort cbCFHeader; /* (optional) size of per-cabinet reserved area */ 34 | ubyte cbCFFolder; /* (optional) size of per-folder reserved area */ 35 | ubyte cbCFData; /* (optional) size of per-datablock reserved area */ 36 | 37 | if(cbCFHeader > 0) 38 | char abReserve[cbCFHeader]; /* (optional) per-cabinet reserved area */ 39 | 40 | } 41 | if(flags & 1){ 42 | 43 | char szCabinetPrev[];/* (optional) name of previous cabinet file */ 44 | char szDiskPrev[]; /* (optional) name of previous disk */ 45 | 46 | } 47 | if(flags & 2){ 48 | 49 | char szCabinetNext[]; /* (optional) name of next cabinet file */ 50 | char szDiskNext[]; /* (optional) name of next disk */ 51 | 52 | } 53 | 54 | } CFHEADER; 55 | 56 | LittleEndian(); 57 | CFHEADER header; 58 | local uint counter = 0; 59 | 60 | typedef struct { 61 | //folder 62 | uint coffCabStart; /* offset of the first CFDATA block in this folder */ 63 | ushort cCFData; /* number of CFDATA blocks in this folder */ 64 | ushort typeCompress; /* compression type indicator */ 65 | 66 | if( exists(header.cbCFFolder)) 67 | char abReserve[header.cbCFFolder]; /* (optional) per-folder reserved area */ 68 | 69 | } CFFOLDER; 70 | 71 | typedef struct { 72 | //file 73 | uint cbFile; /* uncompressed size of this file in bytes */ 74 | uint uoffFolderStart; /* uncompressed offset of this file in the folder */ 75 | ushort iFolder; /* index into the CFFOLDER area */ 76 | DOSDATE date; /* date stamp for this file */ 77 | DOSTIME time; /* time stamp for this file */ 78 | ushort attribs; /* attribute flags for this file */ 79 | char szName[]; /* name of this file */ 80 | } CFFILE; 81 | 82 | typedef struct { 83 | //data 84 | uint csum; /* checksum of this CFDATA entry */ 85 | ushort cbData; /* number of compressed bytes in this block */ 86 | ushort cbUncomp; /* number of uncompressed bytes in this block */ 87 | 88 | if( exists(header.cbCFData)) 89 | char abReserve[header.cbCFData]; /* (optional) per-datablock reserved area */ 90 | 91 | char ab[cbData]; /* compressed data bytes */ 92 | } CFDATA; 93 | 94 | while(header.cFolders > counter){ 95 | 96 | counter++; 97 | CFFOLDER folder; 98 | 99 | } 100 | 101 | counter = 0; 102 | 103 | while(header.cFiles > counter){ 104 | 105 | counter++; 106 | CFFILE file; 107 | 108 | } 109 | 110 | counter = 0; 111 | 112 | while(folder.cCFData > counter){ 113 | 114 | counter++; 115 | CFDATA data; 116 | 117 | } -------------------------------------------------------------------------------- /CDATemplate.bt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/difcareer/010templates/431f32bbb0fb721e29c84605f7ecd6f1dc66454d/CDATemplate.bt -------------------------------------------------------------------------------- /CLASSTemplate2.bt: -------------------------------------------------------------------------------- 1 | BigEndian(); 2 | 3 | typedef struct { 4 | enum { 5 | CONSTANT_Class = 7, 6 | CONSTANT_Fieldref = 9, 7 | CONSTANT_Methodref = 10, 8 | CONSTANT_InterfaceMethodref = 11, 9 | CONSTANT_String = 8, 10 | CONSTANT_Integer = 3, 11 | CONSTANT_Float = 4, 12 | CONSTANT_Long = 5, 13 | CONSTANT_Double = 6, 14 | CONSTANT_NameAndType = 12, 15 | CONSTANT_Utf8 = 1 16 | } tag; 17 | switch (tag) { 18 | case 7: 19 | uint16 name_index; 20 | break; 21 | case 9: 22 | uint16 class_index; 23 | uint16 name_and_type_index; 24 | break; 25 | case 10: 26 | uint16 class_index; 27 | uint16 name_and_type_index; 28 | break; 29 | case 11: 30 | uint16 class_index; 31 | uint16 name_and_type_index; 32 | break; 33 | case 8: 34 | uint16 string_index; 35 | break; 36 | case 3: 37 | int32 int_value; 38 | break; 39 | case 4: 40 | float float_value; 41 | break; 42 | case 5: 43 | int64 long_value; 44 | break; 45 | case 6: 46 | double double_value; 47 | break; 48 | case 12: 49 | uint16 name_index; 50 | uint16 descriptor_index; 51 | break; 52 | case 1: 53 | uint16 length; 54 | char utf8_value[length]; 55 | break; 56 | } 57 | } cp_info; 58 | 59 | typedef struct { 60 | uint16 attribute_name_index; 61 | uint32 attribute_length; 62 | char info[attribute_length]; 63 | } attribute_info; 64 | 65 | typedef struct { 66 | uint16 access_flags ; 67 | uint16 name_index; 68 | uint16 descriptor_index; 69 | uint16 attributes_count; 70 | local int i_att2 = 0; 71 | for ( i_att2 = 0; i_att2 < attributes_count; i_att2++) { 72 | attribute_info attributes; 73 | }; 74 | } field_info, method_info; 75 | 76 | typedef struct { 77 | uint32 magic ; 78 | if (magic != 0xCAFEBABE) { 79 | Warning ("Invalid Class File."); 80 | return -1; 81 | } 82 | uint16 minor_version; 83 | uint16 major_version; 84 | uint16 constant_pool_count; 85 | local int i_cp = 0; 86 | for ( i_cp = 1; i_cp < constant_pool_count; i_cp++) { 87 | cp_info constant_pool; 88 | if ( constant_pool.tag == 5 || constant_pool.tag == 6 ){ 89 | i_cp++; 90 | } 91 | }; 92 | uint16 access_flags ; 93 | uint16 this_class; 94 | uint16 super_class; 95 | uint16 interfaces_count; 96 | local int i_if = 0; 97 | for ( i_if = 0; i_if < interfaces_count; i_if++) { 98 | uint16 interfaces; 99 | }; 100 | uint16 fields_count; 101 | local int i_fld = 0; 102 | for ( i_fld = 0; i_fld < fields_count; i_fld++) { 103 | field_info fields; 104 | }; 105 | uint16 methods_count; 106 | local int i_m = 0; 107 | for ( i_m = 0; i_m < methods_count; i_m++) { 108 | method_info methods; 109 | }; 110 | uint16 attributes_count; 111 | local int i_att = 0; 112 | for ( i_att = 0; i_att < attributes_count; i_att++) { 113 | attribute_info attributes; 114 | }; 115 | } class_file; 116 | 117 | class_file file; 118 | 119 | if (!FEof()) { 120 | Warning("File is not properly ended."); 121 | }; 122 | -------------------------------------------------------------------------------- /CRXTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: CRXTemplate.bt 5 | // Author: SweetScape Software 6 | // Revision: 1.0 7 | // Purpose: Copy of ZIPTemplate.bt 8 | // with extra bits for Google Chrome 9 | // extensions. 10 | //----------------------------------- 11 | 12 | // Define structures used in ZIP files 13 | 14 | //enum used for compression format 15 | typedef enum { 16 | COMP_STORED = 0, 17 | COMP_SHRUNK = 1, 18 | COMP_REDUCED1 = 2, 19 | COMP_REDUCED2 = 3, 20 | COMP_REDUCED3 = 4, 21 | COMP_REDUCED4 = 5, 22 | COMP_IMPLODED = 6, 23 | COMP_TOKEN = 7, 24 | COMP_DEFLATE = 8, 25 | COMP_DEFLATE64 = 9 26 | } COMPTYPE; 27 | 28 | // Defines a file record 29 | typedef struct { 30 | // Header for the file 31 | char frSignature[4]; //0x04034b50 32 | ushort frVersion; 33 | ushort frFlags; 34 | COMPTYPE frCompression; 35 | DOSTIME frFileTime; 36 | DOSDATE frFileDate; 37 | uint frCrc ; 38 | uint frCompressedSize; 39 | uint frUncompressedSize; 40 | ushort frFileNameLength; 41 | ushort frExtraFieldLength; 42 | if( frFileNameLength > 0 ) 43 | char frFileName[ frFileNameLength ]; 44 | if( frExtraFieldLength > 0 ) 45 | uchar frExtraField[ frExtraFieldLength ]; 46 | 47 | // Compressed data 48 | SetBackColor( cNone ); 49 | if( frCompressedSize > 0 ) 50 | uchar frData[ frCompressedSize ]; 51 | 52 | } ZIPFILERECORD ; 53 | 54 | // Defines an entry in the directory table 55 | typedef struct { 56 | char deSignature[4]; //0x02014b50 57 | ushort deVersionMadeBy; 58 | ushort deVersionToExtract; 59 | ushort deFlags; 60 | COMPTYPE deCompression; 61 | DOSTIME deFileTime; 62 | DOSDATE deFileDate; 63 | uint deCrc ; 64 | uint deCompressedSize; 65 | uint deUncompressedSize; 66 | ushort deFileNameLength; 67 | ushort deExtraFieldLength; 68 | ushort deFileCommentLength; 69 | ushort deDiskNumberStart; 70 | ushort deInternalAttributes; 71 | uint deExternalAttributes; 72 | uint deHeaderOffset; 73 | if( deFileNameLength > 0 ) 74 | char deFileName[ deFileNameLength ]; 75 | if( deExtraFieldLength > 0 ) 76 | uchar deExtraField[ deExtraFieldLength ]; 77 | if( deFileCommentLength > 0 ) 78 | uchar deFileComment[ deFileCommentLength ]; 79 | } ZIPDIRENTRY ; 80 | 81 | // Defines the digital signature 82 | typedef struct { 83 | char dsSignature[4]; //0x05054b50 84 | ushort dsDataLength; 85 | if( dsDataLength > 0 ) 86 | uchar dsData[ dsDataLength ]; 87 | } ZIPDIGITALSIG; 88 | 89 | // Defintes the Data descriptor 90 | typedef struct { 91 | char ddSignature[4]; //0x08074b50 92 | uint ddCRC ; 93 | uint ddCompressedSize; 94 | uint ddUncompressedSize; 95 | } ZIPDATADESCR; 96 | 97 | // Defines the end of central directory locator 98 | typedef struct { 99 | char elSignature[4]; //0x06054b50 100 | ushort elDiskNumber; 101 | ushort elStartDiskNumber; 102 | ushort elEntriesOnDisk; 103 | ushort elEntriesInDirectory; 104 | uint elDirectorySize; 105 | uint elDirectoryOffset; 106 | ushort elCommentLength; 107 | if( elCommentLength > 0 ) 108 | char elComment[ elCommentLength ]; 109 | } ZIPENDLOCATOR; 110 | 111 | //-------------------------------------------- 112 | 113 | // Custom read functions that allows the name of the 114 | // of the file to appear in the Template Results. 115 | 116 | string ReadZIPFILERECORD( ZIPFILERECORD &file ) 117 | { 118 | if( exists( file.frFileName ) ) 119 | return file.frFileName; 120 | else 121 | return ""; 122 | } 123 | 124 | string ReadZIPDIRENTRY( ZIPDIRENTRY &entry ) 125 | { 126 | if( exists( entry.deFileName ) ) 127 | return entry.deFileName; 128 | else 129 | return ""; 130 | } 131 | 132 | // Custom write function that allows changing 133 | // the name of the file - note that the file 134 | // name size cannot be increased 135 | 136 | void WriteZIPFILERECORD( ZIPFILERECORD &file, string s ) 137 | { 138 | local int len = Strlen( s ); 139 | if( exists( file.frFileName ) ) 140 | { 141 | Strncpy( file.frFileName, s, file.frFileNameLength ); 142 | if( len < file.frFileNameLength ) 143 | file.frFileName[len] = 0; //null terminate 144 | } 145 | } 146 | 147 | typedef struct { 148 | SetBackColor(0xd8e5ed); 149 | char magicNumber[4]; 150 | SetBackColor(0xd8edd8); 151 | uint32 version; 152 | SetBackColor(0xd8e5ed); 153 | uint32 pkLength; 154 | SetBackColor(0xd8edd8); 155 | uint32 sigLength; 156 | SetBackColor(0xf7d6c3); 157 | byte pubKey[pkLength]; 158 | SetBackColor(0xd8edd8); 159 | byte sig[sigLength]; 160 | } CRXHEADER; 161 | 162 | //-------------------------------------------- 163 | 164 | // Define the file 165 | SetBackColor(0xe8e8e8); 166 | CRXHEADER crxHeader; 167 | SetBackColor(cNone); 168 | local uint tag; 169 | LittleEndian(); 170 | while( !FEof() ) 171 | { 172 | // Read a tag 173 | tag = ReadUInt( FTell() ); 174 | 175 | // Read data depending upon tag - should start with 'PK'. 176 | // Note that when duplicate variables are defined, they 177 | // are made into an array (see 'Using Templates and Structs' 178 | // in the help file). 179 | if( tag == 0x04034b50 ) 180 | { 181 | SetBackColor( cLtGray ); 182 | ZIPFILERECORD record; 183 | } 184 | else if( tag == 0x08074b50 ) 185 | { 186 | SetBackColor( cLtGreen ); 187 | ZIPDATADESCR dataDescr; 188 | } 189 | else if( tag == 0x02014b50 ) 190 | { 191 | SetBackColor( cLtPurple ); 192 | ZIPDIRENTRY dirEntry; 193 | } 194 | else if( tag == 0x05054b50 ) 195 | { 196 | SetBackColor( cLtBlue ); 197 | ZIPDIGITALSIG digitalSig; 198 | } 199 | else if( tag == 0x06054b50 ) 200 | { 201 | SetBackColor( cLtYellow ); 202 | ZIPENDLOCATOR endLocator; 203 | } 204 | else 205 | { 206 | Warning( "Unknown ZIP tag encountered. Template stopped." ); 207 | return -1; 208 | } 209 | } -------------------------------------------------------------------------------- /DBFTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.1.3 Binary Template 3 | // 4 | // File: 5 | // Author: 6 | // Revision: 7 | // Purpose: 8 | //-------------------------------------- 9 | 10 | string yearFrom1900 (char yy) 11 | { 12 | string s; 13 | SPrintf(s, "%d", 1900 + yy); 14 | return s; 15 | } 16 | 17 | struct DBF { 18 | struct HEADER { 19 | char version; 20 | struct DATE_OF_LAST_UPDATE { 21 | char yy ; 22 | char mm ; 23 | char dd ; 24 | } DateOfLastUpdate; 25 | int numberOfRecords; 26 | short lengthOfHeaderStructure; 27 | short lengthOfEachRecord; 28 | char reserved[2]; 29 | char incompleteTrasaction ; 30 | char encryptionFlag ; 31 | int freeRecordThread; 32 | int reserved1[2]; 33 | char mdxFlag ; 34 | char languageDriver ; 35 | short reserved2; 36 | } header; 37 | struct FIELD { 38 | char fieldName[11]; 39 | char fieldType; 40 | int fieldDataAddress; 41 | char fieldLength ; 42 | char decimalCount ; 43 | short reserved; 44 | char workAreaId ; 45 | short reserved1; 46 | char flags ; 47 | char reserved2[7]; 48 | char indexFieldFlag ; 49 | } field[(header.lengthOfHeaderStructure-33)/sizeof(struct FIELD)]; 50 | char Terminator ; 51 | struct RECORD { 52 | char deletedFlag; 53 | char fields[header.lengthOfEachRecord-1]; 54 | } record [ header.numberOfRecords ] ; 55 | } dbf ; 56 | 57 | 58 | 59 | -------------------------------------------------------------------------------- /DMPTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.0.2 Binary Template 3 | // 4 | // File: DMPTemplate.bt 5 | // Author: 6 | // Revision: 1.0 - 20060320 7 | // Purpose: This template merely serves as documentation of the 8 | // memory dump format used by Microsoft's debuggers and 9 | // the NT kernel crashdump facility. Detailed and 10 | // authorative information about a DMP file can be 11 | // obtained by processing the file with the "dumpchk" 12 | // utility which ships whith Microsoft's free debugging 13 | // tools package. 14 | //-------------------------------------- 15 | 16 | 17 | typedef enum { 18 | FULL = 1, 19 | KERNEL, 20 | SMALL 21 | } e_DumpType; 22 | 23 | 24 | typedef struct { 25 | uint32 BasePage ; 26 | uint32 PageCount ; 27 | } _PHYSICAL_MEMORY_RUN32; 28 | 29 | 30 | typedef struct { 31 | uint32 NumberOfRuns; 32 | uint32 NumberOfPages ; 33 | _PHYSICAL_MEMORY_RUN32 Run[NumberOfRuns]; 34 | } _PHYSICAL_MEMORY_DESCRIPTOR32; 35 | 36 | 37 | typedef struct { 38 | int32 ExceptionCode ; 39 | uint32 ExceptionFlags; 40 | uint32 ExceptionRecord; 41 | uint32 ExceptionAddress ; 42 | uint32 NumberParameters; 43 | uint32 ExceptionInformation[15] ; 44 | } _EXCEPTION_RECORD32; 45 | 46 | 47 | FSeek(0); 48 | 49 | char Signature[4]; 50 | char ValidDump[4]; 51 | uint32 MajorVersion; 52 | uint32 MinorVersion; 53 | uint32 DirectoryTableBase ; 54 | uint32 PfnDataBase ; 55 | uint32 PsLoadedModuleList ; 56 | uint32 PsActiveProcessHead ; 57 | uint32 MachineImageType ; 58 | uint32 NumberProcessors; 59 | uint32 BugCheckCode ; 60 | uint32 BugCheckParameter[4] ; 61 | char VersionUser[32]; 62 | uchar PaeEnabled; 63 | uchar KdSecondaryVersion; 64 | uchar Spare3[2]; 65 | uint32 KdDebuggerDataBlock ; 66 | _PHYSICAL_MEMORY_DESCRIPTOR32 PhysicalMemoryBlock; 67 | FSeek(800); 68 | uchar ContextRecord[1200]; 69 | _EXCEPTION_RECORD32 Exception; 70 | char Comment[128]; 71 | uchar _reserved0[1768]; 72 | e_DumpType DumpType; 73 | uint32 MiniDumpFields; 74 | uint32 SecondaryDataState; 75 | uint32 ProductType; 76 | uint32 SuiteMask; 77 | uint32 WriterStatus; 78 | int64 RequiredDumpSpace; 79 | uchar _reserved2[16]; 80 | FILETIME SystemUpTime; 81 | FILETIME SystemTime; 82 | uchar _reserved3[56]; 83 | -------------------------------------------------------------------------------- /EMFTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.1.3 Binary Template 3 | // 4 | // File: EMFTemplate.bt 5 | // Author: Dustin D. Trammell 6 | // Revision: 0.1 7 | // Date: 2008/04/08 - 2008/04/08 8 | // Purpose: Parsing EMF files. 9 | // References: 10 | // MS-EMF: Enhanced Metafile Format Specification 2.1, Microsoft 11 | //-------------------------------------- 12 | 13 | typedef enum { 14 | EMR_HEADER = 0x00000001, 15 | EMR_POLYBEZIER = 0x00000002, 16 | EMR_POLYGON = 0x00000003, 17 | EMR_POLYLINE = 0x00000004, 18 | EMR_POLYBEZIERTO = 0x00000005, 19 | EMR_POLYLINETO = 0x00000006, 20 | EMR_POLYPOLYLINE = 0x00000007, 21 | EMR_POLYPOLYGON = 0x00000008, 22 | EMR_SETWINDOWEXTEX = 0x00000009, 23 | EMR_SETWINDOWORGEX = 0x0000000A, 24 | EMR_SETVIEWPORTEXTEX = 0x0000000B, 25 | EMR_SETVIEWPORTORGEX = 0x0000000C, 26 | EMR_SETBRUSHORGEX = 0x0000000D, 27 | EMR_EOF = 0x0000000E, 28 | EMR_SETPIXELV = 0x0000000F, 29 | EMR_SETMAPPERFLAGS = 0x00000010, 30 | EMR_SETMAPMODE = 0x00000011, 31 | EMR_SETBKMODE = 0x00000012, 32 | EMR_SETPOLYFILLMODE = 0x00000013, 33 | EMR_SETROP2 = 0x00000014, 34 | EMR_SETSTRETCHBLTMODE = 0x00000015, 35 | EMR_SETTEXTALIGN = 0x00000016, 36 | EMR_SETCOLORADJUSTMENT = 0x00000017, 37 | EMR_SETTEXTCOLOR = 0x00000018, 38 | EMR_SETBKCOLOR = 0x00000019, 39 | EMR_OFFSETCLIPRGN = 0x0000001A, 40 | EMR_MOVETOEX = 0x0000001B, 41 | EMR_SETMETARGN = 0x0000001C, 42 | EMR_EXCLUDECLIPRECT = 0x0000001D, 43 | EMR_INTERSECTCLIPRECT = 0x0000001E, 44 | EMR_SCALEVIEWPORTEXTEX = 0x0000001F, 45 | EMR_SCALEWINDOWEXTEX = 0x00000020, 46 | EMR_SAVEDC = 0x00000021, 47 | EMR_RESTOREDC = 0x00000022, 48 | EMR_SETWORLDTRANSFORM = 0x00000023, 49 | EMR_MODIFYWORLDTRANSFORM = 0x00000024, 50 | EMR_SELECTOBJECT = 0x00000025, 51 | EMR_CREATEPEN = 0x00000026, 52 | EMR_CREATEBRUSHINDIRECT = 0x00000027, 53 | EMR_DELETEOBJECT = 0x00000028, 54 | EMR_ANGLEARC = 0x00000029, 55 | EMR_ELLIPSE = 0x0000002A, 56 | EMR_RECTANGLE = 0x0000002B, 57 | EMR_ROUNDRECT = 0x0000002C, 58 | EMR_ARC = 0x0000002D, 59 | EMR_CHORD = 0x0000002E, 60 | EMR_PIE = 0x0000002F, 61 | EMR_SELECTPALETTE = 0x00000030, 62 | EMR_CREATEPALETTE = 0x00000031, 63 | EMR_SETPALETTEENTRIES = 0x00000032, 64 | EMR_RESIZEPALETTE = 0x00000033, 65 | EMR_REALIZEPALETTE = 0x00000034, 66 | EMR_EXTFLOODFILL = 0x00000035, 67 | EMR_LINETO = 0x00000036, 68 | EMR_ARCTO = 0x00000037, 69 | EMR_POLYDRAW = 0x00000038, 70 | EMR_SETARCDIRECTION = 0x00000039, 71 | EMR_SETMITERLIMIT = 0x0000003A, 72 | EMR_BEGINPATH = 0x0000003B, 73 | EMR_ENDPATH = 0x0000003C, 74 | EMR_CLOSEFIGURE = 0x0000003D, 75 | EMR_FILLPATH = 0x0000003E, 76 | EMR_STROKEANDFILLPATH = 0x0000003F, 77 | EMR_STROKEPATH = 0x00000040, 78 | EMR_FLATTENPATH = 0x00000041, 79 | EMR_WIDENPATH = 0x00000042, 80 | EMR_SELECTCLIPPATH = 0x00000043, 81 | EMR_ABORTPATH = 0x00000044, 82 | EMR_RESERVED_69 = 0x00000045, 83 | EMR_COMMENT = 0x00000046, 84 | EMR_FILLRGN = 0x00000047, 85 | EMR_FRAMERGN = 0x00000048, 86 | EMR_INVERTRGN = 0x00000049, 87 | EMR_PAINTRGN = 0x0000004A, 88 | EMR_EXTSELECTCLIPRGN = 0x0000004B, 89 | EMR_BITBLT = 0x0000004C, 90 | EMR_STRETCHBLT = 0x0000004D, 91 | EMR_MASKBLT = 0x0000004E, 92 | EMR_PLGBLT = 0x0000004F, 93 | EMR_SETDIBITSTODEVICE = 0x00000050, 94 | EMR_STRETCHDIBITS = 0x00000051, 95 | EMR_EXTCREATEFONTINDIRECTW = 0x00000052, 96 | EMR_EXTTEXTOUTA = 0x00000053, 97 | EMR_EXTTEXTOUTW = 0x00000054, 98 | EMR_POLYBEZIER16 = 0x00000055, 99 | EMR_POLYGON16 = 0x00000056, 100 | EMR_POLYLINE16 = 0x00000057, 101 | EMR_POLYBEZIERTO16 = 0x00000058, 102 | EMR_POLYLINETO16 = 0x00000059, 103 | EMR_POLYPOLYLINE16 = 0x0000005A, 104 | EMR_POLYPOLYGON16 = 0x0000005B, 105 | EMR_POLYDRAW16 = 0x0000005C, 106 | EMR_CREATEMONOBRUSH = 0x0000005D, 107 | EMR_CREATEDIBPATTERNBRUSHPT = 0x0000005E, 108 | EMR_EXTCREATEPEN = 0x0000005F, 109 | EMR_POLYTEXTOUTA = 0x00000060, 110 | EMR_POLYTEXTOUTW = 0x00000061, 111 | EMR_SETICMMODE = 0x00000062, 112 | EMR_CREATECOLORSPACE = 0x00000063, 113 | EMR_SETCOLORSPACE = 0x00000064, 114 | EMR_DELETECOLORSPACE = 0x00000065, 115 | EMR_GLSRECORD = 0x00000066, 116 | EMR_GLSBOUNDEDRECORD = 0x00000067, 117 | EMR_PIXELFORMAT = 0x00000068, 118 | EMR_DRAWESCAPE = 0x00000069, 119 | EMR_EXTESCAPE = 0x0000006A, 120 | EMR_RESERVED_107 = 0x0000006B, 121 | EMR_SMALLTEXTOUT = 0x0000006C, 122 | EMR_FORCEUFIMAPPING = 0x0000006D, 123 | EMR_NAMEDESCAPE = 0x0000006E, 124 | EMR_COLORCORRECTPALETTE = 0x0000006F, 125 | EMR_SETICMPROFILEA = 0x00000070, 126 | EMR_SETICMPROFILEW = 0x00000071, 127 | EMR_ALPHABLEND = 0x00000072, 128 | EMR_SETLAYOUT = 0x00000073, 129 | EMR_TRANSPARENTBLT = 0x00000074, 130 | EMR_RESERVED_117 = 0x00000075, 131 | EMR_GRADIENTFILL = 0x00000076, 132 | EMR_SETLINKEDUFIS = 0x00000077, 133 | EMR_SETTEXTJUSTIFICATION = 0x00000078, 134 | EMR_COLORMATCHTOTARGETW = 0x00000079, 135 | EMR_CREATECOLORSPACEW = 0x0000007A 136 | } RecordType; 137 | 138 | typedef struct { 139 | LONG cx; 140 | LONG cy; 141 | } SIZEL; 142 | 143 | typedef struct _RECTL { 144 | LONG left; 145 | LONG top; 146 | LONG right; 147 | LONG bottom; 148 | } RECTL; 149 | 150 | typedef struct { 151 | RecordType iType; // Record type EMR_HEADER. 152 | DWORD nSize; // Record size in bytes. This may be greater 153 | // than the sizeof(ENHMETAHEADER). 154 | RECTL rclBounds; // Inclusive-inclusive bounds in device units. 155 | RECTL rclFrame; // Inclusive-inclusive Picture Frame of 156 | // metafile in .01 mm units. 157 | DWORD dSignature; // Signature. Must be ENHMETA_SIGNATURE. 158 | DWORD nVersion; // Version number. 159 | DWORD nBytes; // Size of the metafile in bytes. 160 | DWORD nRecords; // Number of records in the metafile. 161 | WORD nHandles; // Number of handles in the handle table. 162 | // Handle index zero is reserved. 163 | WORD sReserved; // Reserved. Must be zero. 164 | DWORD nDescription; // Number of chars in the unicode description string. 165 | // This is 0 if there is no description string. 166 | DWORD offDescription; // Offset to the metafile description record. 167 | // This is 0 if there is no description string. 168 | DWORD nPalEntries; // Number of entries in the metafile palette. 169 | SIZEL szlDevice; // Size of the reference device in pixels. 170 | SIZEL szlMillimeters; // Size of the reference device in millimeters. 171 | } Header; 172 | 173 | typedef struct { 174 | WORD desc[header.nDescription]; 175 | } Description; 176 | 177 | typedef struct { 178 | RecordType iType; // Record type EMR_XXX 179 | DWORD nSize; // Record size in bytes 180 | DWORD dParm[((nSize-8)/4)]; // DWORD Array of parameters 181 | } Record; 182 | 183 | typedef struct { 184 | uchar Reserved; 185 | uchar Blue; 186 | uchar Green; 187 | uchar Red; 188 | } PaletteEntry; 189 | 190 | // START 191 | 192 | LittleEndian(); 193 | 194 | // Header 195 | Header header; 196 | 197 | // Optional Description 198 | FSeek(header.offDescription); 199 | Description description; 200 | 201 | // Start of Records (after header) 202 | FSeek(header.nSize); 203 | 204 | // Parse the number of records indicated in the header 205 | local int recCnt = 0; 206 | for( recCnt = 0; recCnt < header.nRecords - 1; recCnt++ ) { 207 | Record record; 208 | } 209 | // If the last record wasn't EMR_EOF, there should be more records 210 | // even though they exceed the count in the header 211 | do { 212 | Record extrarecord; 213 | recCnt++; 214 | } while( record[recCnt-1].iType != EMR_EOF); 215 | 216 | // Check last record or header for presence of Palette 217 | local int palCnt = 0; 218 | for( palCnt = 0; palCnt < header.nPalEntries; palCnt++ ) { 219 | PaletteEntry paletteentry; 220 | } 221 | 222 | -------------------------------------------------------------------------------- /EOTTemplate.bt: -------------------------------------------------------------------------------- 1 | //------------------------------------ 2 | //--- 010 Editor v2.01 Binary Template 3 | // 4 | // Name: EOTTemplate.bt 5 | // Author: Neo (Jiepeng) Tan 6 | // Revision: 1.0 7 | // Purpose: Parse an Embedded OpenType (EOT) File Format for Version: 0x00020002 8 | // Reference: http://www.w3.org/Submission/EOT/ 9 | //------------------------------------ 10 | 11 | LittleEndian(); 12 | 13 | 14 | typedef enum {TTEMBED_SUBSET = 0x1, 15 | TTEMBED_TTCOMPRESSED = 0x4, 16 | TTEMBED_FAILIFVARIATIONSIMULATED = 0x10, 17 | TTMBED_EMBEDEUDC = 0x00000020, 18 | TTEMBED_VALIDATIONTESTS = 0x00000040, 19 | TTEMBED_WEBOBJECT = 0x00000080, 20 | TTEMBED_XORENCRYPTDATA = 0x10000000 21 | } TTEMBED; 22 | 23 | typedef struct embedded_opentype_file { 24 | unsigned long EOTSize; 25 | unsigned long FontDataSize; 26 | unsigned long Version; 27 | TTEMBED Flags;//processing flags #define TTEMBED_TTCOMPRESSED 0x00000004 28 | byte FontPANOSE[10]; 29 | byte Charset; 30 | byte Italic; 31 | unsigned long Weight; 32 | unsigned short fsType; 33 | unsigned short MagicNumber;//Magic number for EOT file - 0x504C 34 | unsigned long UnicodeRange1; 35 | unsigned long UnicodeRange2; 36 | unsigned long UnicodeRange3; 37 | unsigned long UnicodeRange4; 38 | unsigned long CodePageRange1; 39 | unsigned long CodePageRange2; 40 | unsigned long CheckSumAdjustment; 41 | unsigned long Reserved1;//must be 0 42 | unsigned long Reserved2;//must be 0 43 | unsigned long Reserved3;//must be 0 44 | unsigned long Reserved4;//must be 0 45 | unsigned short Padding1;//always 0x0000 46 | unsigned short FamilyNameSize; 47 | byte FamilyName[FamilyNameSize]; 48 | 49 | unsigned short Padding2;//always 0x0000 50 | unsigned short StyleNameSize; 51 | byte StyleName[StyleNameSize]; 52 | 53 | unsigned short Padding3;//always 0x0000 54 | unsigned short VersionNameSize; 55 | byte VersionName[VersionNameSize]; 56 | 57 | unsigned short Padding4;//always 0x0000 58 | unsigned short FullNameSize; 59 | byte FullName[FullNameSize]; 60 | 61 | unsigned short Padding5;//always 0x0000 62 | unsigned short RootStringSize; 63 | byte RootString[RootStringSize]; 64 | unsigned long RootStringCheckSum; 65 | unsigned long EUDCCodePage; 66 | unsigned short Padding6; 67 | unsigned short SignatureSize; 68 | byte Signature[SignatureSize]; 69 | unsigned long EUDCFlags; 70 | unsigned long EUDCFontSize; 71 | byte EUDCFontData[EUDCFontSize]; 72 | byte FontData[FontDataSize]; 73 | }; 74 | 75 | LittleEndian(); 76 | 77 | FSeek(0); 78 | embedded_opentype_file EOT; -------------------------------------------------------------------------------- /EVSBTemplate.bt: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | //--- 010 Editor v2.0.2 Binary Template 3 | // 4 | // File: EVSB_Symbol_Display 5 | // Author: Kip Leitner, Panasonic, PSDC NJ, USA, kleitner@pavcal.com 6 | // Revision: 1.0 21 January, 2006 7 | // 8 | // Purpose: Decompose EVSB Over-the-Air (OTA) symbols for DTV Transmission 9 | // 10 | // Ref: ATSC Digital Television standard (A/53), Revision D 11 | // Including Ammendment 1 12 | // 19 July 2005 13 | // Data Organization (Sect 5.3) 14 | //---------------------------------------------------------------------------- 15 | // Setups for 010 View --> Width --> custom (832) to see segment synks 16 | // View --> Width --> custom (64) to Field sync details 17 | // 18 | // modify template for your own frame length 19 | const int Frame_Count = 951; 20 | 21 | 22 | //---------------------------------------------------------------------------- 23 | typedef struct SYNC_SEGMENT_EVEN 24 | { 25 | SetBackColor(cRed); 26 | char Sync[4]; 27 | SetBackColor(cPurple); 28 | char PN511[511]; 29 | SetBackColor(cLtBlue); 30 | char PN63_a[63]; 31 | SetBackColor(cBlue); 32 | char PN63_b[63]; 33 | SetBackColor(cLtBlue); 34 | char PN63_c[63]; 35 | SetBackColor(cLtGreen); 36 | char VSB_Mode[24]; 37 | SetBackColor(cAqua); 38 | char Kerdock[64]; 39 | SetBackColor(cNone); 40 | char Reserved_a[28]; 41 | SetBackColor(cSilver); 42 | char Reserved_b[12]; 43 | } Sync_Segment_Even; 44 | 45 | typedef struct SYNC_SEGMENT_ODD 46 | { 47 | SetBackColor(cLtRed); 48 | char Sync[4]; 49 | SetBackColor(cPurple); 50 | char PN511[511]; 51 | SetBackColor(cLtBlue); 52 | char PN63_a[63]; 53 | SetBackColor(cBlue); 54 | char PN63_b[63]; 55 | SetBackColor(cLtBlue); 56 | char PN63_c[63]; 57 | SetBackColor(cLtGreen); 58 | char VSB_Mode[24]; 59 | SetBackColor(cAqua); 60 | char Kerdock[64]; 61 | SetBackColor(cNone); 62 | char Reserved_a[28]; 63 | SetBackColor(cSilver); 64 | char Reserved_b[12]; 65 | } Sync_Segment_Odd; 66 | 67 | typedef struct DATA_SEGMENT_EVEN 68 | { 69 | SetBackColor(cRed); 70 | char Data_Segment_Sync[4]; 71 | SetBackColor(cNone); 72 | char Payload_Even[828]; 73 | } Data_Segment_Even; 74 | 75 | typedef struct DATA_SEGMENT_ODD 76 | { 77 | SetBackColor(cLtRed); 78 | char Data_Segment_Sync[4]; 79 | SetBackColor(cNone); 80 | char Payload_Odd[828]; 81 | } Data_Segment_Odd; 82 | 83 | typedef struct FIELD_EVEN 84 | { 85 | Sync_Segment_Even Sync_Seg_Even[1]; 86 | Data_Segment_Even Data_Seg_Even[312]; 87 | } Field_Even; 88 | 89 | typedef struct FIELD_ODD 90 | { 91 | Sync_Segment_Odd Sync_Seg_Odd[1]; 92 | Data_Segment_Odd Data_Seg_Odd[312]; 93 | } Field_Odd; 94 | 95 | typedef struct FRAME 96 | { 97 | Field_Even F_Even; 98 | Field_Odd F_Odd; 99 | } Frame; 100 | 101 | struct FILE 102 | { 103 | Frame Frames[Frame_Count]; 104 | } File; -------------------------------------------------------------------------------- /EVTTemplate.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/difcareer/010templates/431f32bbb0fb721e29c84605f7ecd6f1dc66454d/EVTTemplate.zip -------------------------------------------------------------------------------- /FAT16Template.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.1.2 Binary Template 3 | // 4 | // File: FAT16Template.bt 5 | // Author: 6 | // Revision: 7 | // Purpose: This template can find the 8 | // partitions and display the FAT16 9 | // partitions on the disk. 10 | //-------------------------------------- 11 | 12 | //-------------------------------------- 13 | //Master Boot record 14 | //-------------------------------------- 15 | typedef struct _CHS 16 | { 17 | BYTE Head; 18 | BYTE Sector; 19 | BYTE Cylinder; 20 | }CHS; 21 | //-------------------------------------- 22 | typedef union _CHSAddr 23 | { 24 | CHS chs; 25 | BYTE Address[3]; 26 | }CHSAddr; 27 | //-------------------------------------- 28 | typedef struct _Partion_Table_Entry{ 29 | BYTE Status; 30 | CHSAddr StartCHSAddress; 31 | BYTE PartitionType; 32 | CHSAddr EndCHSAddress; 33 | DWORD FirstLBA; 34 | DWORD TotalSectors; 35 | }Partion_Table_Entry; 36 | //-------------------------------------- 37 | typedef struct { 38 | BYTE Code[446]; 39 | Partion_Table_Entry ptable[4]; 40 | WORD Signature55AA ; 41 | if ( Signature55AA != 0xAA55 ) 42 | { 43 | Warning("Invalid MBR"); 44 | return 1; 45 | } 46 | }MBR; 47 | //-------------------------------------- 48 | //FAT Boot sector FAT12,FAT16 49 | //-------------------------------------- 50 | typedef struct _FAT16BootSector 51 | { 52 | BYTE JumpCode[3]; 53 | BYTE OEM_Name[8]; 54 | WORD BytesPerSector; 55 | BYTE SectorsPerCluster; 56 | WORD ReservedSectorCount; //Number of sectors before the first FAT, including the boot sector 57 | BYTE NumberOfFAT; 58 | WORD MAX_RootDirEntry; 59 | WORD TotalSectors; //If Less than 65535 else see offset 0x20 60 | BYTE MediaDescriptor; 61 | WORD SectorsPerFAT; //For FAT12/16 62 | WORD SectorsPerTrack; 63 | WORD NumberOfHeads; 64 | DWORD HiddenSectorsBeforePartition; 65 | DWORD TotalSectors; 66 | BYTE PhysicalDriveNumber; 67 | BYTE Reserved; //Current Head 68 | BYTE ExtendedBootSignature; 69 | BYTE SerialNumber[4]; 70 | BYTE VolumeLable[11]; 71 | BYTE FAT_Type[8]; 72 | BYTE BootCode[448]; 73 | WORD BootSectorSignature; //0x55 0xAA 74 | }FAT16BootSector; 75 | //-------------------------------------- 76 | //FAT16 77 | //-------------------------------------- 78 | local unsigned int FATEntryCount=0; 79 | typedef struct _FAT16 80 | { 81 | WORD Table[FATEntryCount]; 82 | }FAT16; 83 | //-------------------------------------- 84 | //FAT root dir entry FAT12,FAT16 85 | //-------------------------------------- 86 | typedef struct _RootDirEntry 87 | { 88 | BYTE name[8]; 89 | BYTE extn[3]; 90 | BYTE attributes; 91 | BYTE reserved[10]; 92 | WORD time; 93 | WORD date; 94 | WORD firstDataBlock; 95 | DWORD size; 96 | }RootDirEntry; 97 | //-------------------------------------- 98 | LittleEndian(); 99 | FSeek(0); 100 | //-------------------------------------- 101 | //MBR Object 102 | MBR MasterBootRecord; 103 | //-------------------------------------- 104 | //Partition Info 105 | //-------------------------------------- 106 | local unsigned int partition_index=0; 107 | typedef struct _Fat16Partition 108 | { 109 | 110 | local unsigned int startBYTE = (MasterBootRecord.ptable[partition_index].FirstLBA*512); 111 | FSeek( startBYTE); 112 | FAT16BootSector BtSector; 113 | 114 | //-------------------------------------- 115 | //Find the FATs 116 | //-------------------------------------- 117 | //Skip the reserved sectors (-1 for accounting the bootrecord) 118 | FSkip((BtSector.ReservedSectorCount-1)*512); 119 | 120 | local unsigned int FATsize = (BtSector.SectorsPerFAT * 512)/2; 121 | local unsigned int FATcnt = 0; 122 | for(FATcnt = 0;FATcnt < BtSector.NumberOfFAT;++FATcnt) 123 | { 124 | FATEntryCount=FATsize; 125 | FAT16 FAT; 126 | } 127 | 128 | //-------------------------------------- 129 | //Find the Root Dir Entries 130 | //-------------------------------------- 131 | RootDirEntry rootDir[BtSector.MAX_RootDirEntry]; 132 | //-------------------------------------- 133 | 134 | }Fat16Partition; 135 | //-------------------------------------- 136 | //disk Info 137 | //-------------------------------------- 138 | typedef struct _Disk 139 | { 140 | //find all the partitions 141 | local int part; 142 | for(part=0;part<4;++part) 143 | { 144 | if(MasterBootRecord.ptable[part].FirstLBA) 145 | { 146 | partition_index=part; 147 | Fat16Partition FAT16partition; 148 | } 149 | } 150 | }Disk; 151 | //-------------------------------------- 152 | Disk dsk; 153 | //-------------------------------------- 154 | 155 | -------------------------------------------------------------------------------- /FLVTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v3.0 Binary Template 3 | // 4 | // File: FLVTemplate.bt 5 | // Author: lafei(indep@263.net) 6 | // Revision: 2.1 7 | // Purpose: Defines a template for 8 | // parsing FLV files. 9 | //----------------------------------- 10 | 11 | // Define structures used in FLV files 12 | 13 | typedef struct { 14 | CHAR signature[3]; //"FLV" 15 | UBYTE version; 16 | UBYTE dummy : 5; 17 | UBYTE audio : 1; //1 if audio present 18 | UBYTE dummy2 : 1; 19 | UBYTE video : 1; //1 if video present 20 | DWORD dataoffset; //in abs. file offset 21 | DWORD zero; //previous tag size 22 | } HEADER; 23 | 24 | local UINT taglen; 25 | 26 | typedef struct { 27 | UINT type : 8; 28 | UINT datasize : 24; 29 | UINT timestamp : 24; 30 | UINT timestamphi : 8; 31 | UINT streamid : 24; 32 | taglen = datasize - 1; 33 | Printf("tag length: %x\n",taglen); 34 | if(type==8) //audio 35 | { 36 | UINT fmt : 4; 37 | UINT sr : 2; 38 | UINT bits : 1; 39 | UINT channels : 1; 40 | if(fmt==10) 41 | { 42 | --taglen; 43 | UBYTE frmtype; 44 | } 45 | } 46 | else if(type==9)//video 47 | { 48 | UINT frmtype : 4; 49 | UINT codecid : 4; 50 | if(codecid==7) 51 | { 52 | taglen -= 4; 53 | UINT pkttype : 8; 54 | UINT compotime : 24; 55 | } 56 | } 57 | else if(type==18)//script 58 | { 59 | UINT fristbyte : 8; 60 | } 61 | UBYTE data[taglen]; 62 | UINT lastsize; //last tag size 63 | 64 | //for debugging 65 | //Printf("lastsize: %x\n",lastsize); 66 | //Printf("Pos: %x\n",FTell()); 67 | } Tag; 68 | 69 | BigEndian(); 70 | SetBackColor( cLtGray ); 71 | HEADER hdr; 72 | 73 | // Check for header 74 | if( hdr.signature != "FLV" ) 75 | { 76 | Warning( "File is not a FLV. Template stopped." ); 77 | return -1; 78 | } 79 | 80 | if( hdr.version != 1 ) 81 | { 82 | Warning( "Unsupported FLV version. Template stopped." ); 83 | return -1; 84 | } 85 | 86 | // Define the bytes of the data 87 | SetBackColor( cNone ); 88 | 89 | while( !FEof() ) 90 | { 91 | Tag tag; 92 | } 93 | -------------------------------------------------------------------------------- /GIFTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: BMGIFTemplate.bt 5 | // Author: Berend-Jan "SkyLined" Wever 6 | // Revision: 1.1 7 | // Purpose: Defines a template for 8 | // parsing GIF image files. 9 | // SweetScape: Added bug fixes for 10 | // reading global color table (May 2nd, 2007) 11 | // SweetScape: Added bug fixes for 12 | // reading local color table and 13 | // changed ReadShort to ReadUShort (Sept 25, 2007) 14 | //----------------------------------- 15 | 16 | // From GIF89a Specification: 17 | 18 | // ::= Header * Trailer 19 | // ::= Logical Screen Descriptor [Global Color Table] 20 | // ::= | 21 | // ::= [Graphic Control Extension] 22 | // ::= | Plain Text Extension 23 | // ::= Image Descriptor [Local Color Table] Image Data 24 | // ::= Application Extension | Comment Extension 25 | 26 | LittleEndian(); 27 | 28 | typedef struct { 29 | UBYTE R; 30 | UBYTE G; 31 | UBYTE B; 32 | } RGB ; 33 | string ReadRGB( RGB &color ) 34 | { 35 | string s; 36 | SPrintf( s, "#%02X%02X%02X", color.R, color.G, color.B ); 37 | return s; 38 | } 39 | typedef struct { 40 | local UBYTE size = ReadUByte(FTell()); 41 | while (size != 0) { 42 | struct DATASUBBLOCK { 43 | UBYTE Size; 44 | char Data[size]; 45 | } DataSubBlock; 46 | size = ReadUByte(FTell()); 47 | } 48 | UBYTE BlockTerminator; 49 | } DATASUBBLOCKS; 50 | 51 | typedef struct { 52 | char Signature[3]; 53 | char Version[3]; 54 | } GIFHEADER; 55 | 56 | typedef struct { 57 | ushort Width; 58 | ushort Height; 59 | BitfieldLeftToRight(); 60 | struct LOGICALSCREENDESCRIPTOR_PACKEDFIELDS { 61 | UBYTE GlobalColorTableFlag : 1; 62 | UBYTE ColorResolution : 3; 63 | UBYTE SortFlag : 1; 64 | UBYTE SizeOfGlobalColorTable : 3; 65 | } PackedFields; 66 | UBYTE BackgroundColorIndex; 67 | UBYTE PixelAspectRatio; 68 | } LOGICALSCREENDESCRIPTOR; 69 | 70 | // ::= Header * Trailer 71 | // Header 72 | SetBackColor( 0xFFFFFF ); 73 | GIFHEADER GifHeader; 74 | if( GifHeader.Signature != "GIF" ) 75 | { 76 | Warning( "File is not a valid GIF. Template stopped." ); 77 | return -1; 78 | } 79 | // ::= Logical Screen Descriptor [Global Color Table] 80 | // Logical Screen Descriptor 81 | SetBackColor( 0xE0E0E0 ); 82 | LOGICALSCREENDESCRIPTOR LogicalScreenDescriptor; 83 | // [Global Color Table] 84 | if (LogicalScreenDescriptor.PackedFields.GlobalColorTableFlag == 1) { 85 | SetBackColor( 0xC0C0C0 ); 86 | struct GLOBALCOLORTABLE { 87 | local int i; 88 | local int size = 1; 89 | for (i = 0; i <= LogicalScreenDescriptor.PackedFields.SizeOfGlobalColorTable; i++) { 90 | size *= 2; 91 | } 92 | RGB rgb[size]; 93 | } GlobalColorTable ;; 94 | } 95 | // ::= | 96 | SetBackColor( 0xFFFFFF ); 97 | struct DATA { 98 | while (ReadUByte(FTell()) != 0x3B) { 99 | // ::= [Graphic Control Extension] 100 | if (ReadUByte(FTell()) == 0x2C) { 101 | SetBackColor( 0xE0FFE0 ); 102 | struct IMAGEDESCRIPTOR { 103 | UBYTE ImageSeperator; 104 | ushort ImageLeftPosition; 105 | ushort ImageTopPosition; 106 | ushort ImageWidth; 107 | ushort ImageHeight; 108 | struct IMAGEDESCRIPTOR_PACKEDFIELDS { 109 | UBYTE LocalColorTableFlag : 1; 110 | UBYTE InterlaceFlag : 1; 111 | UBYTE SortFlag : 1; 112 | UBYTE Reserved : 2; 113 | UBYTE SizeOfLocalColorTable : 3; 114 | } PackedFields; 115 | } ImageDescriptor; 116 | if (ImageDescriptor.PackedFields.LocalColorTableFlag == 1) { 117 | SetBackColor( 0xC0FFC0 ); 118 | struct LOCALCOLORTABLE { 119 | local int i; 120 | local int size = 1; 121 | for (i = 0; i <= ImageDescriptor.PackedFields.SizeOfLocalColorTable; i++) { 122 | size *= 2; 123 | } 124 | RGB rgb[size]; 125 | } LocalColorTable ;; 126 | } 127 | SetBackColor( 0xA0FFA0 ); 128 | struct IMAGEDATA { 129 | UBYTE LZWMinimumCodeSize; 130 | DATASUBBLOCKS DataSubBlocks; 131 | } ImageData; 132 | } else if (ReadUShort(FTell()) == 0xF921) { 133 | SetBackColor( 0xC0FFFF ); 134 | struct GRAPHICCONTROLEXTENSION { 135 | UBYTE ExtensionIntroducer; // 0x21 136 | UBYTE GraphicControlLabel; // 0xF9 137 | struct GRAPHICCONTROLSUBBLOCK { 138 | UBYTE BlockSize; 139 | struct GRAPHICCONTROLEXTENSION_DATASUBBLOCK_PACKEDFIELDS { 140 | UBYTE Reserved : 3; 141 | UBYTE DisposalMethod : 3; 142 | UBYTE UserInputFlag : 1; 143 | UBYTE TransparentColorFlag : 1; 144 | } PackedFields; 145 | ushort DelayTime; 146 | UBYTE TransparentColorIndex; 147 | } GraphicControlSubBlock; 148 | UBYTE BlockTerminator; 149 | } GraphicControlExtension; 150 | } else if (ReadUShort(FTell()) == 0xFE21) { 151 | SetBackColor( 0xFFFFC0 ); 152 | struct COMMENTEXTENSION { 153 | UBYTE ExtensionIntroducer; // 0x21 154 | UBYTE CommentLabel; // 0xFE 155 | DATASUBBLOCKS CommentData; 156 | } CommentExtension; 157 | } else if (ReadUShort(FTell()) == 0x0121) { 158 | SetBackColor( 0xC0C0C0 ); 159 | struct PLAINTEXTEXTENTION { 160 | UBYTE ExtensionIntroducer; // 0x21 161 | UBYTE PlainTextLabel; // 0x01 162 | struct PLAINTEXTSUBBLOCK { 163 | UBYTE BlockSize; 164 | ushort TextGridLeftPosition; 165 | ushort TextGridTopPosition; 166 | ushort TextGridWidth; 167 | ushort TextGridHeight; 168 | UBYTE CharacterCellWidth; 169 | UBYTE CharacterCellHeight; 170 | UBYTE TextForegroundColorIndex; 171 | UBYTE TextBackgroundColorIndex; 172 | } PlainTextSubBlock; 173 | DATASUBBLOCKS PlainTextData; 174 | } PlainTextExtension; 175 | } else if (ReadUShort(FTell()) == 0xFF21) { 176 | SetBackColor( 0xC0C0FF ); 177 | struct APPLICATIONEXTENTION { 178 | UBYTE ExtensionIntroducer; // 0x21 179 | UBYTE ApplicationLabel; // 0xFF 180 | struct APPLICATIONSUBBLOCK { 181 | UBYTE BlockSize; 182 | char ApplicationIdentifier[8]; 183 | char ApplicationAuthenticationCode[3]; 184 | } ApplicationSubBlock; 185 | DATASUBBLOCKS ApplicationData; 186 | } ApplicationExtension; 187 | } else { 188 | SetBackColor( 0xFF8080 ); 189 | struct UNDEFINEDDATA { 190 | UBYTE ExtensionIntroducer; // 21 191 | UBYTE Label; // F9 192 | DATASUBBLOCKS DataSubBlocks; 193 | } UndefinedData; 194 | } 195 | } 196 | } Data; 197 | SetBackColor( 0xFFFFFF ); 198 | struct TRAILER { 199 | UBYTE GIFTrailer; 200 | } Trailer; -------------------------------------------------------------------------------- /GPTTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0 Binary Template 3 | // 4 | // File: GPTTemplate 5 | // Author: lurker0ster@gmail.com 6 | // Revision: V1.0 7 | // Purpose: Guid Partition Table 8 | //-------------------------------------- 9 | typedef struct { 10 | BYTE BootIndicator; 11 | BYTE StartHead; 12 | WORD StartSector:6; 13 | WORD StartCylinder:10; 14 | BYTE PartitionType; 15 | BYTE EndHead; 16 | WORD EndSector:6; 17 | WORD EndCylider:10; 18 | DWORD SectorsPrecedingPartion; 19 | DWORD SectorsInPartition; 20 | }MBRPARTITIONTABLE; 21 | 22 | 23 | typedef struct{ 24 | char SIGNATURE[8]; 25 | DWORD Revision; 26 | DWORD Headersize; 27 | DWORD CRC32OfHeader; 28 | DWORD Reserved; 29 | uint64 CurrentLBA; 30 | uint64 BackupLBA; //location of the other head copy 31 | uint64 FirstUsableLBA; //primary partition table last LBA+1 32 | uint64 LastUsableLBA; //secondary parition table first LBA-1 33 | BYTE DiskGUID[16]; 34 | uint64 PartitionEntries; 35 | DWORD NumOfPartitions; 36 | DWORD SizeOfPartitionEntry; 37 | DWORD CRC32ofPartitionArray; 38 | BYTE reserved[420]; 39 | }GPT; 40 | 41 | typedef struct { 42 | BYTE PartitionTypeGUID[16]; 43 | BYTE PartitionGUID[16]; 44 | uint64 PartitionStartLBA; 45 | uint64 PartitionEndLBA; 46 | uint64 PartitionProperty; 47 | wchar_t PartitionName[36]; //Unicode 48 | }GPTPAPTITIONTABLE ; 49 | 50 | LittleEndian(); 51 | struct { 52 | BYTE bootcode[446]; 53 | MBRPARTITIONTABLE partitionTable[4]; 54 | WORD signature; 55 | }MBR ; 56 | 57 | 58 | 59 | 60 | if ((MBR.partitionTable[0].PartitionType & 0xFF) == 0xEE) { 61 | Printf("Protected MBR. GPT reserved"); 62 | GPT gptheader; 63 | GPTPAPTITIONTABLE table[128]; 64 | FSeek(FileSize()-sizeof(GPT)-sizeof(GPTPAPTITIONTABLE)*128); 65 | GPTPAPTITIONTABLE BackupTable[128]; 66 | FSeek(FileSize()-sizeof(GPT)); 67 | GPT Backupgptheader; 68 | } -------------------------------------------------------------------------------- /GZipTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v4.0.3 Binary Template 3 | // 4 | // File: GZipTemplate.bt 5 | // Author: Tim "diff" Strazzere 6 | // Revision: 1.2 7 | // Purpose: Quick template for parsing GZip data/files 8 | //-------------------------------------- 9 | // 10 | // Version 1.2 11 | // - Fix processing of part numbers for continuation based gzips 12 | // - Added some notes on the encrypted header information 13 | // 14 | // Version 1.1 15 | // - Fix small typos 16 | // - Added comments to fields 17 | // - Fix compression/flag names according to gzip 1.2.4 source 18 | // - Added uncompressed length and CRC32 19 | // - Check for different common magic bytes, and display properly 20 | // - Minor code clean up 21 | // 22 | // Version 1.0 23 | // - First implementation of the template 24 | // 25 | // TODO: 26 | // - Parse encrypted header information 27 | 28 | // GZip's should be Little Endian only 29 | LittleEndian(); 30 | 31 | // utility type to show the magic bytes in the value column 32 | typedef ubyte MAGIC[2] ; 33 | 34 | string MAGICRead(MAGIC magic) { 35 | string ret; 36 | string tmp; 37 | int i; 38 | 39 | for(i = 0; i<2; i++) { 40 | SPrintf(tmp, "%.2X", magic[i]); 41 | ret += tmp; 42 | } 43 | 44 | return ret; 45 | } 46 | 47 | typedef enum { 48 | // All below, except DEFLATE are reserved 49 | STORED = 0, 50 | COMPRESSED = 1, 51 | PACKED = 2, 52 | LZHED = 3, 53 | RESERVED_4 = 4, 54 | RESERVED_5 = 5, 55 | RESERVED_6 = 6, 56 | RESERVED_7 = 7, 57 | // Default (and most common) 58 | DEFLATE = 8 59 | } COMPRESSION; 60 | 61 | 62 | // TODO : Probably some better way to do this 63 | typedef struct { 64 | // File is probably ascii text (determined by compressor) 65 | byte FLAG_ASCII_TEXT : 1; 66 | 67 | // Continuation of multi-part gzip file 68 | byte FLAG_CONTINUATION : 1; 69 | 70 | // Generic extra field present 71 | byte FLAG_EXTRA : 1; 72 | 73 | // Original filename present 74 | byte FLAG_NAME : 1; 75 | 76 | // File comment present 77 | byte FLAG_COMMENT : 1; 78 | 79 | // Is file encrypted? 80 | byte FLAG_ENCRYPTED : 1; 81 | 82 | // Reserved for future use (nothing as of gzip 1.2.4 83 | byte FLAG_RESERVED : 1; 84 | byte FLAG_RESERVED : 1; 85 | } FLAGS; 86 | 87 | typedef enum { 88 | FAT_FILESYSTEM = 0, 89 | AMIGA = 1, 90 | VMS = 2, 91 | UNIX = 3, 92 | VM_CMS = 4, 93 | ATARI_TOS = 5, 94 | HPFS_FILESYSTEM = 6, 95 | MACINTOSH = 7, 96 | Z_SYSTEM = 8, 97 | CPM = 9, 98 | TOPS_20 = 10, 99 | NTFS_FILESYSTEM = 11, 100 | QDOS = 12, 101 | ACORN_RISCOS = 13, 102 | UNKNOWN = 255 103 | } OS; 104 | 105 | typedef struct { 106 | MAGIC magic_bytes ; 107 | 108 | // Should be a better way to parse the magic bytes and complain to user... 109 | if(magic_bytes[0] == 0x1F) { 110 | if(magic_bytes[1] == 0x8B) { 111 | // GZIP_MAGIC 112 | Printf("Appears to be a valid GZIP compressed file, attempting to parse.\n"); 113 | } else if(magic_bytes[1] == 0x1E) { 114 | // PACK_MAGIC 115 | Printf("Appears to be a generic compressed file, attempting to parse - don't expect much though.\n"); 116 | } else if(magic_bytes[1] == 0x9E) { 117 | // OLD_GZIP_MAGIC 118 | Printf("Appears to be an old GZip compressed file, attempting to parse - don't expect much though.\n"); 119 | } else if(magic_bytes[1] == 0xA0) { 120 | // LZH_MAGIC 121 | Printf("Appears to be a LZH compressed file, attempting to parse - don't expect much though.\n"); 122 | } 123 | } else if(magic_bytes[0] == 0x50 && magic_bytes[1] == 0x4B) { 124 | Warning("Appears to be a possible ZIP file - unable to parse with this template!"); 125 | Exit(-1); 126 | } else { 127 | Warning("Does not appear to be a GZip file!"); 128 | Exit(-1); 129 | } 130 | 131 | COMPRESSION compression_method ; 132 | FLAGS flags ; 133 | 134 | // Convert to proper timestamp 135 | uint modification_time ; 136 | 137 | // Extra flags 138 | ubyte extra_flags ; 139 | 140 | // OS where compression took place 141 | OS operating_system ; 142 | 143 | // The file is marked as a continuation, so it should have a part number 144 | if(flags.FLAG_CONTINUATION == 1) { 145 | ushort part ; 146 | } 147 | 148 | // Read in extras from flags 149 | if(flags.FLAG_EXTRA == 1) { 150 | ushort extra_length ; 151 | byte extra_bytes[extra_length] ; 152 | } 153 | 154 | if(flags.FLAG_NAME == 1) { 155 | string original_file_name ; 156 | } 157 | 158 | if(flags.FLAG_COMMENT == 1) { 159 | string file_comment ; 160 | } 161 | 162 | // TODO: Parse encrypted header info 163 | // -- according to the docs this is grabbed from the zip lib (crypt.h/crypt.c) 164 | // which according to their docs is hardly used or fully supported. 165 | // It would appear you would need to compile this directly into your gzip 166 | // sources for it to properly work, even though it's considered "valid". 167 | if(flags.FLAG_ENCRYPTED == 1) { 168 | // 12 bytes of encryption header data 169 | } 170 | } gzip_header; 171 | 172 | // Structure of gzip file 173 | struct { 174 | // Header information 175 | gzip_header header ; 176 | 177 | // Everything else should just be compress bytes, less the last 8 bytes 178 | // which contain the CRC32 and uncompressed size 179 | byte compressed[FileSize() - FTell() - 8] ; 180 | 181 | uint CRC32 ; 182 | 183 | // 4 bytes uncompressed input size modulo 2^32 184 | uint uncompressed_sized ; 185 | } gzip_file; -------------------------------------------------------------------------------- /GocleverTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.2.1 Binary Template 3 | // 4 | // File:GocleverTemplate.bt 5 | // Author:Artur Babecki 6 | // Revision: 21.02.2012 7 | // Purpose: template for GOCLEVER Navigation log format 8 | // GPSLogYYYY-MM-DD_xx-xx-xx.bin 9 | // (Model GC-4335 and others) 10 | // Generates raport in the human readable form: 11 | // Date, Longitude, Latitude, Geoid, Altitude, Direction. 12 | // 13 | //-------------------------------------- 14 | 15 | 16 | local uint number_of_records; 17 | local int i; 18 | local string s; 19 | 20 | number_of_records=FileSize()/48; 21 | struct gps 22 | { 23 | double longitude ; 24 | double latitude ; 25 | time_t date; 26 | int direction; 27 | int speed; 28 | uchar unknown_data [12]; 29 | int geoid; 30 | int altitude ; 31 | } goclever[number_of_records]; 32 | OutputPaneClear(); 33 | 34 | Printf("GOCLEVER Navigation log: %s \n\n",GetFileName()); 35 | Printf(" Date\t\tLongitude Latitude Geoid Altitude Direction Speed\n"); 36 | Printf("mm/dd/yyyy hh:mm:ss\n"); 37 | for (i=0;i=8bpp) 19 | BYTE bReserved; // Reserved ( must be 0) 20 | WORD wPlanes; // Color Planes 21 | WORD wBitCount; // Bits per pixel 22 | DWORD dwBytesInRes; // How many bytes in this resource? 23 | DWORD dwImageOffset; // Where in the file is this image? 24 | } ICONDIRENTRY ; 25 | 26 | typedef struct 27 | { 28 | WORD idReserved; // Reserved (must be 0) 29 | WORD idType; // Resource Type (1 for icons) 30 | WORD idCount; // How many images? 31 | ICONDIRENTRY idEntries[idCount]; // An entry for each image (idCount of 'em) 32 | } ICONDIR; 33 | 34 | typedef struct { // rgbq 35 | UBYTE rgbBlue; 36 | UBYTE rgbGreen; 37 | UBYTE rgbRed; 38 | UBYTE rgbReserved; 39 | } RGBQUAD ; 40 | 41 | typedef struct { // rgbt 42 | UBYTE rgbBlue; 43 | UBYTE rgbGreen; 44 | UBYTE rgbRed; 45 | } RGBTRIPLE ; 46 | 47 | typedef struct { // bmih 48 | DWORD biSize; 49 | LONG biWidth; 50 | LONG biHeight; 51 | WORD biPlanes; 52 | WORD biBitCount; 53 | DWORD biCompression; 54 | DWORD biSizeImage; 55 | LONG biXPelsPerMeter; 56 | LONG biYPelsPerMeter; 57 | DWORD biClrUsed; 58 | DWORD biClrImportant; 59 | } BITMAPINFOHEADER; 60 | 61 | typedef struct { 62 | // Define the color table 63 | if( (bmiHeader.biBitCount != 24) && (bmiHeader.biBitCount != 32) ) 64 | { 65 | if( bmiHeader.biClrUsed > 0 ) 66 | RGBQUAD aColors[ bmiHeader.biClrUsed ]; 67 | else 68 | RGBQUAD aColors[ 1 << bmiHeader.biBitCount ]; 69 | } 70 | 71 | // Calculate bytes per line and padding required 72 | local int bytesPerLine = (int)Ceil( bmiHeader.biWidth * bmiHeader.biBitCount / 8.0 ); 73 | local int padding = 4 - (bytesPerLine % 4); 74 | if( padding == 4 ) 75 | padding = 0; 76 | 77 | // Define each line of the image 78 | struct BITMAPLINE { 79 | 80 | // Define color data 81 | if( bmiHeader.biBitCount < 8 ) 82 | UBYTE imageData[ bytesPerLine ]; 83 | else if( bmiHeader.biBitCount == 8 ) 84 | UBYTE colorIndex[ bmiHeader.biWidth ]; 85 | else if( bmiHeader.biBitCount == 24 ) 86 | RGBTRIPLE colors[ bmiHeader.biWidth ]; 87 | else if( bmiHeader.biBitCount == 32 ) 88 | RGBQUAD colors[ bmiHeader.biWidth ]; 89 | 90 | // Pad if necessary 91 | if( padding != 0 ) 92 | UBYTE padBytes[ padding ]; 93 | 94 | } lines[ bmiHeader.biHeight/2 ]; 95 | 96 | // Define each line of the mask 97 | struct MASKLINE { 98 | UBYTE line[((bmiHeader.biWidth + 31)/32)*4]; 99 | }mask[bmiHeader.biHeight/2]; 100 | 101 | }IMAGEDATA; 102 | 103 | typedef struct { 104 | SetBackColor( cLtAqua ); 105 | BITMAPINFOHEADER bmiHeader; 106 | SetBackColor( cLtGray ); 107 | IMAGEDATA data; 108 | }ICONIMAGE ; 109 | 110 | //--------------------------------------------- 111 | // Custom read functions - this allows the data to be displayed without having to open up the structure. 112 | 113 | 114 | string ReadIconDirEntry( ICONDIRENTRY &dirEntry ) 115 | { 116 | string s; 117 | SPrintf( s, "%dx%d %dbit %d colors", dirEntry.bWidth, dirEntry.bHeight, dirEntry.wBitCount, dirEntry.bColorCount ); 118 | return s; 119 | } 120 | 121 | string ReadDIBHeader( ICONIMAGE &image ) 122 | { 123 | string s; 124 | SPrintf( s, "%dx%d %dbit", image.bmiHeader.biWidth, image.bmiHeader.biHeight, image.bmiHeader.biBitCount ); 125 | return s; 126 | } 127 | 128 | string ReadRGBQUAD( RGBQUAD &a ) 129 | { 130 | string s; 131 | SPrintf( s, "#%02X%02X%02X%02X", a.rgbReserved, a.rgbRed, a.rgbGreen, a.rgbBlue ); 132 | return s; 133 | } 134 | 135 | string ReadRGBTRIPLE( RGBTRIPLE &a ) 136 | { 137 | string s; 138 | SPrintf( s, "#%02X%02X%02X", a.rgbRed, a.rgbGreen, a.rgbBlue ); 139 | return s; 140 | } 141 | 142 | //--------------------------------------------- 143 | 144 | // Define the headers 145 | LittleEndian(); 146 | 147 | local short res = ReadShort( FTell() ); 148 | local short type = ReadShort(FTell() +2 ); 149 | 150 | //Check icon dir 151 | if( res != 0 || type != 1) 152 | { 153 | Warning( "File is not an Icon. Template stopped." ); 154 | return -1; 155 | } 156 | 157 | SetBackColor( cNone ); 158 | ICONDIR icondir; 159 | ICONIMAGE images[icondir.idCount] ; -------------------------------------------------------------------------------- /IDBTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.2.2 Binary Template 3 | // 4 | // File: IDBTemplate.bt 5 | // Author: Tim "diff" Strazzere 6 | // Revision: 0.1 7 | // Purpose: Quick template for parsing Macho-o binaries, probably doesn't fully work, just wip 8 | //-------------------------------------- 9 | 10 | // TODO: Pretty printer for this 11 | typedef enum { 12 | IDA0 = 0x49444130, 13 | IDA1 = 0x49444131, 14 | IDA2 = 0x49444132, 15 | } Magic; 16 | 17 | typedef enum { 18 | NORMAL = 0xAABBCCDD, 19 | LAMRON = 0xDDCCBBAA 20 | } Foothold ; 21 | 22 | typedef struct { 23 | uint32 data_size; 24 | byte padding[5]; 25 | } SubFile; 26 | 27 | typedef struct { 28 | Magic magic ; 29 | byte padding[2]; 30 | ubyte id0_offset ; 31 | byte padding_2[7]; 32 | uint32 id1_offset ; 33 | byte padding_3[8]; 34 | Foothold foothold; 35 | byte unknown[2]; 36 | uint32 nam_offset ; 37 | byte padding_4[12]; 38 | uint32 til_offset ; 39 | byte padding_5[4]; 40 | uint32 other_offset ; 41 | } Header; 42 | 43 | Header header; 44 | FSeek(header.id0_offset); 45 | SubFile id0; 46 | FSeek(header.id1_offset); 47 | SubFile id1; 48 | FSeek(header.nam_offset); 49 | SubFile nam; 50 | FSeek(header.til_offset); 51 | SubFile til; -------------------------------------------------------------------------------- /ISOBMFTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v4.0.3 Binary Template 3 | // 4 | // File: ISOBMFTemplate.bt 5 | // Author: @RReverser 6 | // Revision: 201302261710 7 | // Purpose: Parse ISO Base Media File Format files (QuickTime, JPEG2000, MPEG-4, etc.) 8 | //-------------------------------------- 9 | 10 | BigEndian(); 11 | 12 | typedef struct 13 | { 14 | uint32 size ; 15 | char type[4] ; 16 | switch (type) 17 | { 18 | case "ftyp": 19 | char fileType[4] ; 20 | break; 21 | 22 | case "co64": 23 | ubyte version ; 24 | ubyte flags[3] ; 25 | uint32 n ; 26 | uint64 entries[n] ; 27 | break; 28 | 29 | case "ctts": 30 | ubyte version ; 31 | ubyte flags[3] ; 32 | uint32 n ; 33 | struct { 34 | uint32 sampleCount ; 35 | uint32 offset ; 36 | } entries[n] ; 37 | break; 38 | 39 | case "elst": 40 | ubyte version ; 41 | ubyte flags[3] ; 42 | uint32 n ; 43 | struct { 44 | uint32 duration ; 45 | uint32 mediaTime ; 46 | uint32 playbackSpeed ; 47 | } entries[n] ; 48 | break; 49 | 50 | case "fiel": 51 | ubyte fields ; 52 | ubyte detail ; 53 | break; 54 | 55 | case "hdlr": 56 | ubyte version ; 57 | ubyte flags[3] ; 58 | char component_type[4] ; 59 | char subtype[4] ; 60 | uint32 manufacturer ; 61 | uint32 flags ; 62 | uint32 flags_mask ; 63 | string name ; 64 | break; 65 | 66 | case "mdhd": 67 | ubyte version ; 68 | ubyte flags[3] ; 69 | if (version < 1) 70 | { 71 | uint32 creation_time ; 72 | uint32 modification_time ; 73 | } 74 | else 75 | { 76 | uint64 creation_time ; 77 | uint64 modification_time ; 78 | } 79 | uint32 time_scale ; 80 | if (version < 1) 81 | { 82 | uint32 duration ; 83 | } 84 | else 85 | { 86 | uint64 duration ; 87 | } 88 | uint16 lang ; 89 | uint16 quality ; 90 | break; 91 | 92 | case "stco": 93 | ubyte version ; 94 | ubyte flags[3] ; 95 | uint32 n ; 96 | uint32 entries[n] ; 97 | break; 98 | 99 | case "stss": 100 | ubyte version ; 101 | ubyte flags[3] ; 102 | uint32 n ; 103 | uint32 entries[n] ; 104 | break; 105 | 106 | case "stsz": 107 | ubyte version ; 108 | ubyte flags[3] ; 109 | uint32 uniform_size ; 110 | uint32 n ; 111 | uint32 entries[n] ; 112 | break; 113 | 114 | case "cmov": 115 | case "edts": 116 | case "mdia": 117 | case "minf": 118 | case "moov": 119 | case "rmda": 120 | case "rmra": 121 | case "stbl": 122 | case "trak": 123 | while (FTell() - startof(this) < size) 124 | { 125 | struct Atom child; 126 | } 127 | break; 128 | 129 | default: 130 | FSeek(FTell() - 8); 131 | break; 132 | } 133 | 134 | local int left = size - (FTell() - startof(this)); 135 | if (left > 0) 136 | { 137 | ubyte data[left] ; 138 | } 139 | } 140 | Atom ; 141 | 142 | int GetAtomSize(Atom &atom) 143 | { 144 | return ReadUInt(startof(atom)); 145 | } 146 | 147 | string GetAtomName(Atom &atom) 148 | { 149 | char type[4]; 150 | ReadBytes(type, startof(atom) + 4, 4); 151 | return type; 152 | } 153 | 154 | while (!FEof()) 155 | { 156 | Atom atom; 157 | } -------------------------------------------------------------------------------- /InspectorDates.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v4.0 Binary Template 3 | // 4 | // File: InspectorDates.bt 5 | // Author: SweetScape Software 6 | // Revision: 1.0 7 | // Purpose: Demonstrates how to add 8 | // a series of date types to the 9 | // Inspector.bt file. Includes 10 | // WebkitTime, HFSTime, AppleTime, PRTime 11 | // JavaTime, GPSTime, and BlackberryDate. 12 | //----------------------------------- 13 | RequiresVersion( 4.0 ); 14 | 15 | // Calculate the position for each variable, 16 | // either at the beginning of the selection 17 | // or at the current cursor position. 18 | local int64 pos; 19 | if( GetSelSize() > 0 ) 20 | pos = GetSelStart(); 21 | else 22 | pos = GetCursorPos(); 23 | 24 | // Define variables for the inspector 25 | FSeek( pos ); byte _si8 ; 26 | FSeek( pos ); ubyte _ui8 ; 27 | FSeek( pos ); short _si16 ; 28 | FSeek( pos ); ushort _ui16 ; 29 | FSeek( pos ); int _si32 ; 30 | FSeek( pos ); uint _ui32 ; 31 | FSeek( pos ); int64 _si64 ; 32 | FSeek( pos ); uint64 _ui64 ; 33 | FSeek( pos ); float _f ; 34 | FSeek( pos ); double _d ; 35 | FSeek( pos ); char _s [ReadStringLength(pos,256)] ; // limit to 256 characters 36 | FSeek( pos ); wchar_t _ws[ReadWStringLength(pos,256)] ; // limit to 256 characters 37 | FSeek( pos ); DOSDATE _dd ; 38 | FSeek( pos ); DOSTIME _dt ; 39 | FSeek( pos ); time_t _tt ; 40 | FSeek( pos ); FILETIME _ft ; 41 | FSeek( pos ); OLETIME _ot ; 42 | 43 | //---------------------------------------------------------------- 44 | // WebkitTime 45 | // 64-bit integer, number of microseconds since 01/01/1601 00:00:00 46 | typedef uint64 WebkitTime ; 47 | FSeek( pos ); WebkitTime _wkt ; 48 | string WebkitTimeRead( WebkitTime t ) 49 | { 50 | // Convert to FILETIME 51 | return FileTimeToString( t*10 ); 52 | } 53 | int WebkitTimeWrite( WebkitTime &t, string value ) 54 | { 55 | // Convert from FILETIME 56 | FILETIME ft; 57 | int result = StringToFileTime( value, ft ); 58 | t = (int64)ft/10; 59 | return result; 60 | } 61 | 62 | //---------------------------------------------------------------- 63 | // HFSTime 64 | // 32-bit integer, number of seconds since 01/01/1904 00:00:00 65 | typedef uint HFSTime ; 66 | FSeek( pos ); HFSTime _hft ; 67 | string HFSTimeRead( HFSTime t ) 68 | { 69 | // Convert to FILETIME 70 | return FileTimeToString( t*10000000L + 95616288000000000L ); 71 | } 72 | int HFSTimeWrite( HFSTime &t, string value ) 73 | { 74 | // Convert from FILETIME 75 | FILETIME ft; 76 | int result = StringToFileTime( value, ft ); 77 | t = (int)(((uint64)ft - 95616288000000000L)/10000000L); 78 | return result; 79 | } 80 | 81 | //---------------------------------------------------------------- 82 | // AppleTime 83 | // 32-bit integer, number of seconds since 01/01/2001 00:00:00 84 | typedef uint AppleTime ; 85 | FSeek( pos ); AppleTime _at ; 86 | string AppleTimeRead( AppleTime t ) 87 | { 88 | // Convert to FILETIME 89 | return FileTimeToString( t*10000000L + 126227808000000000L ); 90 | } 91 | int AppleTimeWrite( AppleTime &t, string value ) 92 | { 93 | // Convert from FILETIME 94 | FILETIME ft; 95 | int result = StringToFileTime( value, ft ); 96 | t = (int)(((uint64)ft - 126227808000000000L)/10000000L); 97 | return result; 98 | } 99 | 100 | //---------------------------------------------------------------- 101 | // PRTime 102 | // 64-bit integer, number of microseconds since 01/01/1970 00:00:00 103 | typedef uint64 PRTime ; 104 | FSeek( pos ); PRTime _prt ; 105 | string PRTimeRead( PRTime t ) 106 | { 107 | // Convert to FILETIME 108 | return FileTimeToString( t*10L + 116444736000000000L ); 109 | } 110 | int PRTimeWrite( PRTime &t, string value ) 111 | { 112 | // Convert from FILETIME 113 | FILETIME ft; 114 | int result = StringToFileTime( value, ft ); 115 | t = (((uint64)ft - 116444736000000000L)/10L); 116 | return result; 117 | } 118 | 119 | //---------------------------------------------------------------- 120 | // JavaTime 121 | // 64-bit integer, number of microseconds since 01/01/1970 00:00:00 122 | typedef uint64 JavaTime ; 123 | FSeek( pos ); JavaTime _jt ; 124 | string JavaTimeRead( JavaTime t ) 125 | { 126 | // Convert to FILETIME 127 | return FileTimeToString( t*10000L + 116444736000000000L ); 128 | } 129 | int JavaTimeWrite( JavaTime &t, string value ) 130 | { 131 | // Convert from FILETIME 132 | FILETIME ft; 133 | int result = StringToFileTime( value, ft ); 134 | t = (((uint64)ft - 116444736000000000L)/10000L); 135 | return result; 136 | } 137 | 138 | //---------------------------------------------------------------- 139 | // GPSTime 140 | // 32-bit integer, number of seconds since 01/06/1980 00:00:00 141 | typedef uint GPSTime ; 142 | FSeek( pos ); GPSTime _gpst ; 143 | string GPSTimeRead( GPSTime t ) 144 | { 145 | // Convert to FILETIME 146 | return FileTimeToString( t*10000000L + 119604384000000000 ); 147 | } 148 | int GPSTimeWrite( GPSTime &t, string value ) 149 | { 150 | // Convert from FILETIME 151 | FILETIME ft; 152 | int result = StringToFileTime( value, ft ); 153 | t = (int)(((uint64)ft - 119604384000000000)/10000000L); 154 | return result; 155 | } 156 | 157 | //---------------------------------------------------------------- 158 | // BlackberryDate 159 | // 32-bit integer, number of minutes since 01/01/1900 00:00:00 160 | typedef uint BlackberryDate ; 161 | FSeek( pos ); BlackberryDate _gt ; 162 | string BlackberryDateRead( BlackberryDate t ) 163 | { 164 | // Convert to FILETIME 165 | return FileTimeToString( t*600000000L + 94354848000000000L ); 166 | } 167 | int BlackberryDateWrite( BlackberryDate &t, string value ) 168 | { 169 | // Convert from FILETIME 170 | FILETIME ft; 171 | int result = StringToFileTime( value, ft ); 172 | t = (int)(((uint64)ft - 94354848000000000L)/600000000L); 173 | return result; 174 | } 175 | -------------------------------------------------------------------------------- /InspectorWithMP4DateTime.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v4.0 Binary Template 3 | // 4 | // File: InspectorMoje.bt 5 | // Author: SweetScape Software 6 | // Revision: 1.1 7 | // Purpose: This template may be used 8 | // to customize the auto tab of the 9 | // Inspector with your own variables. 10 | // See the Inspector section of the 11 | // Options dialog for more information. 12 | // Changes: 13 | // 1.1 (SweetScape): 14 | // - Added hfloat data type. 15 | // 1.2 (Marian Denes): 16 | // - Added MP4_Time data type 17 | //----------------------------------- 18 | RequiresVersion( 4.0 ); 19 | 20 | // Calculate the position for each variable, 21 | // either at the beginning of the selection 22 | // or at the current cursor position. 23 | local int64 position; 24 | if( GetSelSize() > 0 ) 25 | position = GetSelStart(); 26 | else 27 | position = GetCursorPos(); 28 | 29 | 30 | int leap(int year) 31 | { 32 | return year % 4 == 0 && ( year % 100 != 0 || year % 400 == 0 ); 33 | } 34 | 35 | int daysInYear(int year) {return 365 + leap(year);} 36 | 37 | 38 | typedef uint MP4_Time ; 39 | 40 | string MP4_TimeRead( MP4_Time secs ) 41 | { 42 | // secs - seconds since midnight, January 1, 1904 43 | 44 | int days = secs / 86400; 45 | secs = secs % 86400; 46 | 47 | int year = 1904; 48 | int month = 1; 49 | 50 | int daysInMonth[13] = {-1, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}; 51 | int extraDay [13] = {-1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; 52 | 53 | while (days > daysInYear(year)) 54 | { 55 | days -= daysInYear(year); 56 | year++; 57 | } 58 | 59 | while (days > daysInMonth[month] + leap(year) * extraDay[month]) 60 | { 61 | days -= daysInMonth[month] + leap(year) * extraDay[month]; 62 | month++; 63 | } 64 | 65 | int day = ++days; // 0 (full) days remaining means the 1st day of the monht, and so on 66 | 67 | int hours = secs / 3600; 68 | secs = secs % 3600; 69 | int mins = secs / 60; 70 | secs = secs % 60; 71 | 72 | string s; 73 | SPrintf( s, "%02d.%02d.%4d %02d:%02d:%02d", day, month, year, hours, mins, secs ); 74 | return s; 75 | } 76 | 77 | void MP4_TimeWrite( MP4_Time &secs, string dateTime ) 78 | { 79 | int daysInMonth[13] = {-1, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}; 80 | int extraDay [13] = {-1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; 81 | 82 | int day, month, year, hour, min, sec; //secs = 0x1122; 83 | SScanf(dateTime, "%d.%d.%d %d:%d:%d", day, month, year, hour, min, sec); 84 | 85 | int days = day - 1; // January 1, 1994 is 0 days after this date, and so on 86 | int months, hours, mins, y, m; 87 | 88 | for (y = 1904; y < year; ++y) 89 | days += daysInYear(y); 90 | 91 | for (m = 1; m < month; ++m) 92 | days += daysInMonth[m] + leap(year) * extraDay[m]; 93 | 94 | secs = days * 86400 + hour * 3600 + min * 60 + sec; 95 | } 96 | 97 | // Define variables for the inspector 98 | FSeek( position ); MP4_Time _mp4t ; 99 | FSeek( position ); byte _si8 ; 100 | FSeek( position ); ubyte _ui8 ; 101 | FSeek( position ); short _si16 ; 102 | FSeek( position ); ushort _ui16 ; 103 | FSeek( position ); int _si32 ; 104 | FSeek( position ); uint _ui32 ; 105 | FSeek( position ); int64 _si64 ; 106 | FSeek( position ); uint64 _ui64 ; 107 | FSeek( position ); float _f ; 108 | FSeek( position ); double _d ; 109 | FSeek( position ); hfloat _hf ; 110 | FSeek( position ); char _s [ReadStringLength(position,256)] ; // limit to 256 characters 111 | FSeek( position ); wchar_t _ws[ReadWStringLength(position,256)] ; // limit to 256 characters 112 | FSeek( position ); DOSDATE _dd ; 113 | FSeek( position ); DOSTIME _dt ; 114 | FSeek( position ); FILETIME _ft ; 115 | FSeek( position ); OLETIME _ot ; 116 | FSeek( position ); time_t _tt ; 117 | -------------------------------------------------------------------------------- /LGDrmDexTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0beta1 Binary Template 3 | // 4 | // File: LGDermDexTemplate.pt 5 | // Author: Tim Strazzere 6 | // Revision: 0.1 7 | // Purpose: Just parsing out some information while doing research 8 | // into LG's "almond" crypto drm. 9 | //-------------------------------------- 10 | 11 | 12 | // TODO : Redo all this to just parse it out as a string and 13 | // seperate it all using skip chars and \r\n seperators 14 | typedef struct { 15 | ubyte encryption_method_key[Strlen("Encryption-Method")]; 16 | if(Strcmp("Encryption-Method", encryption_method_key) != 0) { 17 | Printf("Unexpected encryption method key!\n"); 18 | } 19 | FSkip(2); // Skip ": " 20 | 21 | ubyte encryption_method_value[Strlen("AES128CBC")]; 22 | if(Strcmp("AES128CBC", encryption_method_value) != 0) { 23 | Printf("Unexpected encryption method value!\n"); 24 | } 25 | FSkip(1); // Skip ";" 26 | 27 | ubyte padding_key[Strlen("padding=")]; 28 | if(Strcmp("padding=", padding_key) != 0) { 29 | Printf("Unexpected padding key!\n"); 30 | } 31 | 32 | ubyte padding_value[Strlen("RFC2630")]; 33 | if(Strcmp("RFC2630", padding_value) != 0) { 34 | Printf("Unexpected padding value!\n"); 35 | } 36 | FSkip(1); // Skip ";" 37 | 38 | ubyte plain_text_length_key[Strlen("plaintextlen=")]; 39 | if(Strcmp("plaintextlen=", plain_text_length_key) != 0) { 40 | Printf("Unexpected plain text length key!\n"); 41 | } 42 | 43 | ubyte plain_text_length_value[Strlen("0000378580")]; 44 | FSkip(2); // Skip "; " 45 | 46 | ubyte preload_id_key[Strlen("LGEID")]; 47 | if(Strcmp("LGEID", preload_id_key) != 0) { 48 | Printf("Unexpected preload id!\n"); 49 | } 50 | FSkip(2); // Skip ": " 51 | 52 | ubyte preload_id_value[Strlen("VcYhp0fRX7OSDIKlV2z2u521UTM=")]; 53 | FSkip(2); // Skip "; " 54 | } encryption_block; 55 | 56 | typedef struct { 57 | ubyte version ; 58 | ubyte mime_type_length ; 59 | ubyte CID_length ; 60 | ubyte mime_type[mime_type_length] ; 61 | if(Strcmp("application/octet-stream", mime_type) != 0) { 62 | Printf("Unexpected mime-type found!\n"); 63 | } 64 | ubyte CID[CID_length] ; 65 | ubyte encryption_header_size; // length of encryption header block 66 | ubyte content_length; 67 | ubyte one2; 68 | ubyte one3; 69 | encryption_block encryption_data; 70 | // ubyte encryption_header[header_size]; 71 | } Header; 72 | 73 | Header header; -------------------------------------------------------------------------------- /LUKSTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v4.0.1 Binary Template 3 | // 4 | // File: LUKS.bt 5 | // Author: Daniel Correa 6 | // URL: http://www.sinfocol.org/ 7 | // Revision: 1.0 8 | // Purpose: Template for LUKS 9 | //-------------------------------------- 10 | 11 | #define LUKS_CIPHERNAME_L 32 12 | #define LUKS_CIPHERMODE_L 32 13 | #define LUKS_HASHSPEC_L 32 14 | #define LUKS_DIGESTSIZE 20 15 | #define LUKS_HMACSIZE 32 16 | #define LUKS_SALTSIZE 32 17 | #define LUKS_NUMKEYS 8 18 | 19 | #define LUKS_MKD_ITERATIONS_MIN 1000 20 | #define LUKS_SLOT_ITERATIONS_MIN 1000 21 | 22 | #define LUKS_KEY_DISABLED_OLD 0 23 | #define LUKS_KEY_ENABLED_OLD 0xCAFE 24 | 25 | #define LUKS_KEY_DISABLED 0x0000DEAD 26 | #define LUKS_KEY_ENABLED 0x00AC71F3 27 | 28 | #define LUKS_STRIPES 4000 29 | 30 | #define LUKS_MAGIC "LUKS\xBA\xBE" 31 | #define LUKS_MAGIC_L 6 32 | 33 | #define LUKS_PHDR_SIZE (sizeof(struct luks_phdr)/SECTOR_SIZE+1) 34 | 35 | #define UUID_STRING_L 40 36 | 37 | #define LUKS_ALIGN_KEYSLOTS 4096 38 | 39 | 40 | typedef struct luks_phdr { 41 | char magic[LUKS_MAGIC_L] ; 42 | 43 | if (magic != LUKS_MAGIC) { 44 | SetBackColor(0x0000ff); 45 | Warning("File is not a LUKS disk. Bad signature."); 46 | return -1; 47 | } 48 | 49 | uint16 version ; 50 | char cipherName[LUKS_CIPHERNAME_L] ; 51 | char cipherMode[LUKS_CIPHERMODE_L] ; 52 | char hashSpec[LUKS_HASHSPEC_L] ; 53 | uint32 payloadOffset ; 54 | uint32 keyBytes ; 55 | char mkDigest[LUKS_DIGESTSIZE] ; 56 | char mkDigestSalt[LUKS_SALTSIZE] ; 57 | uint32 mkDigestIterations ; 58 | char uuid[UUID_STRING_L] ; 59 | 60 | struct { 61 | uint32 active ; 62 | 63 | uint32 passwordIterations ; 64 | char passwordSalt[LUKS_SALTSIZE] ; 65 | 66 | uint32 keyMaterialOffset ; 67 | uint32 stripes ; 68 | } keyblock[LUKS_NUMKEYS]; 69 | 70 | char _padding[432]; 71 | }; 72 | 73 | FSeek(0); 74 | BigEndian(); 75 | luks_phdr LUKS; -------------------------------------------------------------------------------- /MBRTemplate.bt: -------------------------------------------------------------------------------- 1 | //------------------------------------ 2 | //--- 010 Editor v2.01 Binary Template 3 | // 4 | // Name: MBRTemplate.bt 5 | // Author: Christian Schaffalitzky 6 | // Revision: 1.2 7 | // Purpose: Parse a Master Boot Record on a Harddisk 8 | // Changes: 9 | // 1.2 (A.Babecki): 10 | // - Added BitfieldDisablePadding 11 | // - Added unsigned for relsect/numsect 12 | // 13 | //------------------------------------ 14 | 15 | BitfieldRightToLeft(); 16 | BitfieldDisablePadding(); 17 | 18 | typedef struct fdisk_partition { 19 | unsigned char bootid; /* bootable? 0=no, 128=yes */ 20 | unsigned short beghead : 8; /* beginning head number */ 21 | unsigned short begsect : 6; /* beginning sector number */ 22 | unsigned short begcyl : 10; /* 10 bit nmbr */ 23 | unsigned char systid; /* Operating System type indicator code */ 24 | unsigned short endhead : 8; /* ending head number */ 25 | unsigned short endsect : 6; /* ending sector number */ 26 | unsigned short endcyl : 10; /* also a 10 bit nmbr */ 27 | unsigned int relsect; /* first sector relative to start of disk */ 28 | unsigned int numsect; /* number of sectors in partition */ 29 | }; 30 | 31 | 32 | typedef struct master_boot_record { 33 | char bootinst[446]; /* space to hold actual boot code */ 34 | fdisk_partition partitions[4]; 35 | ushort signature; /* set to 0xAA55 to indicate PC MBR format */ 36 | }; 37 | 38 | LittleEndian(); 39 | 40 | FSeek(0); 41 | master_boot_record MBR; -------------------------------------------------------------------------------- /MBRTemplateFAT.bt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/difcareer/010templates/431f32bbb0fb721e29c84605f7ecd6f1dc66454d/MBRTemplateFAT.bt -------------------------------------------------------------------------------- /MIDITemplate.bt: -------------------------------------------------------------------------------- 1 | /* General-MIDI Parser 2 | * By Jack Andersen 3 | */ 4 | 5 | BigEndian(); 6 | 7 | struct MidiHeader 8 | { 9 | char m_magic[4] ; 10 | uint m_seclen; 11 | enum 12 | { 13 | MIDI_SINGLE = 0, 14 | MIDI_MULTIPLE = 1, 15 | MIDI_PATTERN = 2 16 | } m_format; 17 | short m_ntracks; 18 | short m_tickdiv; 19 | }; 20 | 21 | struct DeltaTime 22 | { 23 | local uint total = 0; 24 | char t0; 25 | total += t0 & 0x7f; 26 | if (!(t0 & 0x80)) 27 | break; 28 | 29 | total <<= 7; 30 | char t1; 31 | total += t1 & 0x7f; 32 | if (!(t1 & 0x80)) 33 | break; 34 | 35 | total <<= 7; 36 | char t2; 37 | total += t2 & 0x7f; 38 | if (!(t2 & 0x80)) 39 | break; 40 | 41 | total <<= 7; 42 | char t3; 43 | total += t3 & 0x7f; 44 | if (!(t3 & 0x80)) 45 | break; 46 | }; 47 | 48 | struct MidiMessage 49 | { 50 | DeltaTime m_dtime; 51 | char m_status; 52 | local char m_channel = m_status & 0xf; 53 | if ((m_status & 0xf0) == 0x80) 54 | { 55 | struct 56 | { 57 | char m_note; 58 | char m_velocity; 59 | } note_off_event; 60 | } 61 | else if ((m_status & 0xf0) == 0x90) 62 | { 63 | struct 64 | { 65 | char m_note; 66 | char m_velocity; 67 | } note_on_event; 68 | } 69 | else if ((m_status & 0xf0) == 0xA0) 70 | { 71 | struct 72 | { 73 | char m_note; 74 | char m_pressure; 75 | } note_pressure_event; 76 | } 77 | else if ((m_status & 0xf0) == 0xB0) 78 | { 79 | struct 80 | { 81 | char m_controller; 82 | char m_value; 83 | } controller_event; 84 | } 85 | else if ((m_status & 0xf0) == 0xC0) 86 | { 87 | struct 88 | { 89 | char m_program; 90 | } program_event; 91 | } 92 | else if ((m_status & 0xf0) == 0xD0) 93 | { 94 | struct 95 | { 96 | char m_pressure; 97 | } channel_pressure_event; 98 | } 99 | else if ((m_status & 0xf0) == 0xE0) 100 | { 101 | struct 102 | { 103 | char m_lsb; 104 | char m_msb; 105 | } pitch_bend_event; 106 | } 107 | else if (m_status == -1) 108 | { 109 | struct 110 | { 111 | enum 112 | { 113 | META_SEQUENCE_NUM = 0, 114 | META_TEXT = 1, 115 | META_COPYRIGHT = 2, 116 | META_SEQUENCE_NAME = 3, 117 | META_INSTRUMENT_NAME = 4, 118 | META_LYRIC = 5, 119 | META_MARKER = 6, 120 | META_CUE_POINT = 7, 121 | META_PROGRAM_NAME = 8, 122 | META_DEVICE_NAME = 9, 123 | META_MIDI_CHANNEL_PREFIX = 0x20, 124 | META_MIDI_PORT = 0x21, 125 | META_END_OF_TRACK = 0x2f, 126 | META_TEMPO = 0x51, 127 | META_SMPTE_OFFSET = 0x54, 128 | META_TIME_SIGNATURE = 0x58, 129 | META_KEY_SIGNATURE = 0x59, 130 | META_SEQUENCER_EVENT = 0x7f 131 | } m_type; 132 | DeltaTime m_length; 133 | if (m_type == META_SEQUENCE_NUM) 134 | { 135 | short m_seqNum; 136 | } 137 | else if (m_type == META_TEXT) 138 | { 139 | char m_text[m_length.total]; 140 | } 141 | else if (m_type == META_COPYRIGHT) 142 | { 143 | char m_copyright[m_length.total]; 144 | } 145 | else if (m_type == META_SEQUENCE_NAME) 146 | { 147 | char m_name[m_length.total]; 148 | } 149 | else if (m_type == META_INSTRUMENT_NAME) 150 | { 151 | char m_name[m_length.total]; 152 | } 153 | else if (m_type == META_LYRIC) 154 | { 155 | char m_lyric[m_length.total]; 156 | } 157 | else if (m_type == META_MARKER) 158 | { 159 | char m_marker[m_length.total]; 160 | } 161 | else if (m_type == META_CUE_POINT) 162 | { 163 | char m_cuePoint[m_length.total]; 164 | } 165 | else if (m_type == META_PROGRAM_NAME) 166 | { 167 | char m_programName[m_length.total]; 168 | } 169 | else if (m_type == META_DEVICE_NAME) 170 | { 171 | char m_deviceName[m_length.total]; 172 | } 173 | else if (m_type == META_MIDI_CHANNEL_PREFIX) 174 | { 175 | char m_channelPrefix; 176 | } 177 | else if (m_type == META_MIDI_PORT) 178 | { 179 | char m_port; 180 | } 181 | else if (m_type == META_END_OF_TRACK) 182 | { 183 | } 184 | else if (m_type == META_TEMPO) 185 | { 186 | uint m_usecPerQuarterNote : 24; 187 | local uint m_bpm = 60000000 / m_usecPerQuarterNote; 188 | FSeek(FTell() - 1); 189 | } 190 | else if (m_type == META_SMPTE_OFFSET) 191 | { 192 | char m_hours; 193 | char m_mins; 194 | char m_secs; 195 | char m_fps; 196 | char m_fracFrames; 197 | } 198 | else if (m_type == META_TIME_SIGNATURE) 199 | { 200 | char m_numerator; 201 | char m_denominator; 202 | char m_clocksPerClick; 203 | char m_32ndPer4th; 204 | } 205 | else if (m_type == META_KEY_SIGNATURE) 206 | { 207 | char m_flatsSharps; 208 | char m_majorMinor; 209 | } 210 | else 211 | { 212 | char m_data[m_length.total]; 213 | } 214 | } meta_event; 215 | } 216 | else if ((m_status & 0xf0) == 0xF0) 217 | { 218 | struct 219 | { 220 | DeltaTime m_length; 221 | char m_message[m_length.total]; 222 | } sysex_event; 223 | } 224 | }; 225 | 226 | struct MidiTrack 227 | { 228 | char m_magic[4] ; 229 | uint m_seclen; 230 | local uint remaining = m_seclen; 231 | while (remaining) { 232 | MidiMessage message; 233 | remaining -= sizeof(message); 234 | } 235 | }; 236 | 237 | struct 238 | { 239 | MidiHeader header; 240 | MidiTrack tracks[header.m_ntracks] ; 241 | } file; 242 | -------------------------------------------------------------------------------- /MP4Template.bt: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------- 2 | //--- 010 Editor v6.0.2 Binary Template 3 | // 4 | // File: MP4.bt 5 | // Author: Marian Denes 6 | // Revision: 2.1 7 | // Date: 2015.06.04 8 | // Purpose: Defines a template for parsing MP4 and MOV files. 9 | //------------------------------------------------------------- 10 | 11 | BigEndian(); 12 | 13 | local int64 pos; 14 | local int64 pos2; 15 | 16 | typedef union { 17 | /*uint number;*/ 18 | char text[4]; 19 | } _typ; 20 | 21 | string typeFullName(_typ& type) { 22 | if (Memcmp(type.text, "ftyp", 4) == 0) return "File type compatibility box"; 23 | if (Memcmp(type.text, "mvhd", 4) == 0) return "Movie header box"; 24 | if (Memcmp(type.text, "iods", 4) == 0) return "Initial object descriptor box"; 25 | if (Memcmp(type.text, "trak", 4) == 0) return "Track box"; 26 | if (Memcmp(type.text, "udta", 4) == 0) return "Uset data box"; 27 | if (Memcmp(type.text, "mdat", 4) == 0) return "Movie (sample) data box"; 28 | if (Memcmp(type.text, "moov", 4) == 0) return "Moovie box"; 29 | if (Memcmp(type.text, "tkhd", 4) == 0) return "Track header box"; 30 | if (Memcmp(type.text, "mdia", 4) == 0) return "Media box"; 31 | if (Memcmp(type.text, "edts", 4) == 0) return "Edit box"; 32 | if (Memcmp(type.text, "elst", 4) == 0) return "Edit list"; 33 | return "I don't know the full name"; 34 | } 35 | 36 | string typeString(_typ& type) { 37 | return "Type of the box: \"" + type.text + "\""; 38 | } 39 | 40 | // MessageBox(idOk, "", "GetCursorPos == %d", GetCursorPos()); 41 | 42 | while(FTell() < FileSize() - 1) { 43 | struct _box { 44 | uint size ; 45 | _typ type ; 47 | if (Memcmp(type.text, "ftyp", 4) == 0) { 48 | char major_brand[4] ; 49 | char minor_ver [4] ; 50 | uint comp_brands[(size - sizeof(size) - sizeof(type) - sizeof(major_brand) - 51 | sizeof(minor_ver)) / 4] ; 53 | } else if (Memcmp(type.text, "moov", 4) == 0) { 54 | pos = FTell(); 55 | while(FTell() < pos + size - sizeof(size) - sizeof(type)) 56 | struct _box2 { 57 | uint size ; 58 | _typ type ; 60 | if (Memcmp(type.text, "mvhd", 4) == 0) { 61 | char version ; 62 | char flags[3] ; 63 | uint crTime ; 64 | uint mdTime ; 65 | uint tmScale ; 66 | uint duration ; 67 | char rest[size - sizeof(size) - sizeof(type) - sizeof(version) - 68 | sizeof(flags) - sizeof(crTime) - sizeof(mdTime) - 69 | sizeof(tmScale) - sizeof(duration)]; 70 | } else if (Memcmp(type.text, "trak", 4) == 0) { 71 | pos2 = FTell(); 72 | while(FTell() < pos2 + size - sizeof(size) - sizeof(type)) 73 | struct _box3 { 74 | uint size ; 75 | _typ type ; 77 | if (Memcmp(type.text, "tkhd", 4) == 0) { 78 | char version ; 79 | char flags[3] ; 80 | uint crTime ; 81 | uint mdTime ; 82 | uint trkID < name="Track ID", open=false>; 83 | uint reserv ; 84 | uint duration < name="Duration", open=false>; 85 | char rest[size - sizeof(size) - sizeof(type) - sizeof(version) - 86 | sizeof(flags) - sizeof(crTime) - sizeof(mdTime) - 87 | sizeof(trkID) - sizeof(reserv) - sizeof(duration)]; 88 | } else if (Memcmp(type.text, "edts", 4) == 0) { 89 | struct _box4 { 90 | uint size ; 91 | _typ type ; 93 | char version ; 94 | char flags[3] ; 95 | uint entrs; 96 | struct { 97 | uint trDuration ; 98 | uint mediaTime ; 99 | uint mediaRate ; 100 | } entry[entrs] ; 101 | } box ; 102 | } else 103 | char rest[size - sizeof(size) - sizeof(type)]; 104 | } box ; 105 | } else 106 | char rest[size - sizeof(size) - sizeof(type)]; 107 | } box ; 108 | } else 109 | char rest[size - sizeof(size) - sizeof(type)]; 110 | } box ; 111 | } 112 | 113 | string boxName(_box& box) { 114 | return box.type.text + " (" + typeFullName(box.type) + ")";; 115 | } 116 | 117 | string boxName2(_box2& box) { 118 | return box.type.text + " (" + typeFullName(box.type) + ")"; 119 | } 120 | 121 | string boxName3(_box3& box) { 122 | return box.type.text + " (" + typeFullName(box.type) + ")"; 123 | } 124 | 125 | string boxName4(_box4& box) { 126 | return box.type.text + " (" + typeFullName(box.type) + ")"; 127 | } 128 | 129 | string brandName(uint brand) { 130 | local char text[4]; 131 | local int i; 132 | 133 | for (i = 0; i < 4; ++i) 134 | text[i] = brand >> 8 * (3 - i) & 0xFF; 135 | return text; 136 | } 137 | 138 | // string boxName5(_box5& box) { 139 | // return box.type.text + " (" + typeFullName(box.type) + ")"; 140 | // } 141 | 142 | // local int i; 143 | 144 | // struct DATABLOCK { 145 | // int dataID; 146 | // uchar dataArray[16]; 147 | // }; 148 | 149 | 150 | // pos = FTell(); // save read position 151 | // for( i = 0; i < 4; i++ ) { 152 | // DATABLOCK data ; 153 | // } 154 | // FSeek( pos ); // restore read position 155 | // 156 | // // Custom read function 157 | // string ReadDataBlock( DATABLOCK &d ) 158 | // { 159 | // // string str; 160 | // // SPrintf( str, "ID = '%d'", d.dataID ); 161 | // FTell( box[i].type] ); 162 | // return str; 163 | // } 164 | -------------------------------------------------------------------------------- /MPQTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.2.2 Binary Template 3 | // 4 | // File: MPQTemplate.bt 5 | // Author: Tim "diff" Strazzere 6 | // Revision: 0.1 7 | // Purpose: Parse the MPQ (Mo'PaQ, short for Mike O'Brien Pack) file format, 8 | // using in Blizzard games. Purely a POC/WIP - doesn't fully work yet. 9 | //-------------------------------------- 10 | 11 | #define MD5_DIGEST_SIZE (16) 12 | 13 | LittleEndian(); 14 | 15 | typedef struct { 16 | int64 extended_offset; 17 | int16 hash_table_offset_high; 18 | int16 block_table_offset_high; 19 | } mpq_header_v2_extension; 20 | 21 | typedef struct { 22 | int64 archive_size; 23 | int64 bet_table_offset; 24 | int64 het_table_offset; 25 | } mpq_header_v3_extension; 26 | 27 | typedef struct { 28 | int64 hash_table_size; 29 | int64 block_table_size; 30 | int64 hiblock_table_size; 31 | int64 het_table_size; 32 | int64 bet_table_size; 33 | int32 raw_chunk_size; 34 | 35 | char md5_block_table[MD5_DIGEST_SIZE]; 36 | char md5_hash_table[MD5_DIGEST_SIZE]; 37 | char md5_hiblock_table[MD5_DIGEST_SIZE]; 38 | char md5_bet_table[MD5_DIGEST_SIZE]; 39 | char md5_het_table[MD5_DIGEST_SIZE]; 40 | char md5_mpq_table[MD5_DIGEST_SIZE]; 41 | } mpq_header_v4_extension; 42 | 43 | typedef struct { 44 | char mpq_magic[4] ; 45 | int32 header_size ; 46 | int32 archive_size ; 47 | int16 format_version ; 48 | 49 | if(format_version == 1 && header_size != 0x20) { 50 | Warning("A version 1 MPQ must have a header size of exactly 0x20!"); 51 | Exit(-1); 52 | } else if(format_version == 2 && header_size != 0x2C) { 53 | Warning("A version 2 MPQ must have a header size of exactly 0x2C!"); 54 | Exit(-1); 55 | } else if(format_version == 3 && header_size < 0x2C) { 56 | Warning("A version 3 MPQ must have a header size greater than 0x2C!"); 57 | Exit(-1); 58 | } else if(format_version == 4 && header_size != 0xD0) { 59 | Warning("A version 4 MPQ must have a header size of exactly 0xD0!"); 60 | Exit(-1); 61 | } 62 | 63 | int16 sector_size ; 64 | int32 hash_table_offset ; 65 | int32 block_tablet_offset ; 66 | int32 hash_table_count ; 67 | int32 block_table_count ; 68 | 69 | if(format_version >= 2) { 70 | mpq_header_v2_extension v2_header_extension; 71 | if(format_version >= 3) { 72 | mpq_header_v3_extension v3_header_extension; 73 | if(format_version >= 4) { 74 | mpq_header_v4_extension v4_header_extension; 75 | } 76 | } 77 | } 78 | } mpq_header; 79 | 80 | typedef struct { 81 | char signature[4]; 82 | int32 version; 83 | int32 data_size; 84 | int32 table_size; 85 | int32 max_file_count; 86 | int32 hash_table_size; 87 | int32 hash_entry_size; 88 | int32 total_index_size; 89 | int32 index_size_extra; 90 | int32 index_size; 91 | int32 block_table_size; 92 | 93 | // byte het_hash_table[hash_table_size]; 94 | } het_table; 95 | 96 | typedef struct { 97 | int32 hash_a ; 98 | int32 hash_b ; 99 | int16 locale ; 100 | int16 platform ; 101 | int32 block_table_index ; 102 | } mpq_hash; 103 | 104 | typedef struct { 105 | int32 offset ; 106 | int32 packed_size ; 107 | int32 unpacked_size ; 108 | int32 flags; 109 | } mpq_block; 110 | 111 | typedef struct { 112 | int16 offset; 113 | } mpq_block_extension; 114 | 115 | typedef struct { 116 | int32 block_table_indices ; 117 | int32 block_table_diff ; 118 | } mpq_map; 119 | 120 | mpq_header header ; 121 | if(header.mpq_magic != "MPQ\x1A") { 122 | Warning("Magic does not appear to match! Parsing will fail!"); 123 | } 124 | 125 | if(header.format_version >= 3) { 126 | FSeek(header.v3_header_extension.het_table_offset); 127 | het_table hettable; 128 | } 129 | 130 | FSeek(header.hash_table_offset); 131 | mpq_hash hash[header.hash_table_count]; 132 | 133 | FSeek(header.block_tablet_offset); 134 | mpq_block block[header.block_table_count]; -------------------------------------------------------------------------------- /Mifare1kTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | // File: Mifare Classic 1k 3 | // Author: Ruben Boonen (b33f) 4 | // http://www.fuzzysecurity.com/ 5 | // Purpose: Basic Structure 6 | //----------------------------------- 7 | 8 | struct FILE { 9 | struct Manufacturer_block { 10 | char Card_UID[4] ; 11 | char LRC[1] ; 12 | char Internal[11] ; 13 | char Data[32]; 14 | char Key_A[6] ; 15 | char Access_Bits[3] ; 16 | char GPB[1] ; 17 | char Key_B[6] ; 18 | } manufacturer_block; 19 | 20 | struct Sec_4blk { 21 | char Data[48]; 22 | char Key_A[6] ; 23 | char Access_Bits[3] ; 24 | char GPB[1] ; 25 | char Key_B[6] ; 26 | } sec_4blk[ 15 ]; 27 | 28 | } file ; -------------------------------------------------------------------------------- /Mifare4kTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | // File: Mifare Classic 4k 3 | // Author: Ruben Boonen (b33f) 4 | // http://www.fuzzysecurity.com/ 5 | // Purpose: Basic Structure 6 | //----------------------------------- 7 | 8 | struct FILE { 9 | struct Manufacturer_block { 10 | char Card_UID[4] ; 11 | char LRC[1] ; 12 | char Internal[11] ; 13 | char Data[32]; 14 | char Key_A[6] ; 15 | char Access_Bits[3] ; 16 | char GPB[1] ; 17 | char Key_B[6] ; 18 | } manufacturer_block; 19 | 20 | struct Sec_4blk { 21 | char Data[48]; 22 | char Key_A[6] ; 23 | char Access_Bits[3] ; 24 | char GPB[1] ; 25 | char Key_B[6] ; 26 | } sec_4blk[ 31 ]; 27 | 28 | struct Sec_16blk { 29 | char Data[240]; 30 | char Key_A[6] ; 31 | char Access_Bits[3] ; 32 | char GPB[1] ; 33 | char Key_B[6] ; 34 | } sec_16blk[ 8 ]; 35 | 36 | } file ; -------------------------------------------------------------------------------- /NetflowVersion5.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.1.3 Binary Template 3 | // 4 | // File: Netflow Version 5 5 | // 6 | // Author: Andrew Faust 7 | // Revision: 8 | // Purpose: Parses a Netflow Version 5 record 9 | //-------------------------------------- 10 | 11 | BigEndian(); 12 | 13 | struct FLOW { 14 | struct HEADER { 15 | ushort Version; 16 | ushort Count; 17 | uint SysUptime; 18 | uint EopochSeconds; 19 | uint NanoSeconds; 20 | uint FlowsSeen; 21 | byte EngineType; 22 | byte EngineID; 23 | char filler[2]; 24 | } header; 25 | 26 | struct DATA { 27 | char SourceIP[4]; 28 | char DestIP[4]; 29 | char NextHopIP[4]; 30 | ushort InSNMP; 31 | ushort OutSNMP; 32 | uint PacketCount; 33 | uint ByteCount; 34 | uint StartFlowTime; 35 | uint EndFlowTime; 36 | ushort SourcePort; 37 | ushort DestPort; 38 | char filler[1]; 39 | byte TCPFlags; 40 | byte Protocol; 41 | byte TypeOfService; 42 | ushort SourceSysID; 43 | ushort DestSysID; 44 | byte SourceMaskBitsCount; 45 | byte DestMaskBitsCount; 46 | char filler2[2]; 47 | } data [ flow.header.Count ]; 48 | } flow; -------------------------------------------------------------------------------- /OGGTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v4.0.4 Binary Template 3 | // 4 | // File: OGGTemplate.bt 5 | // Author: George Woods 6 | // Revision: 7 | // Purpose: Parses the ogg container format. 8 | //-------------------------------------- 9 | 10 | // ogg files can be quite large. Don't read more the 1000 pages. 11 | local uint MAXPAGES = 1000; 12 | 13 | typedef struct { // bmfh 14 | CHAR CapturePattern[4]; 15 | BYTE Version; 16 | BYTE HeaderType; 17 | QUAD GranulePosition; 18 | DWORD BitstreamSerial; 19 | DWORD PageSequenceNumber; 20 | DWORD Checksum; 21 | UBYTE PageSegments; 22 | 23 | // the lengths of the segments that follow 24 | UBYTE SegmentLen[PageSegments]; 25 | 26 | // the segments themselves 27 | local uint i; 28 | for (i = 0; i < PageSegments; i++) { 29 | struct { 30 | BYTE Data[SegmentLen[i]] ; 31 | } Segment; 32 | } 33 | } PAGE; 34 | 35 | 36 | LittleEndian(); 37 | 38 | local uint currpage = 0; 39 | while( !FEof() ) 40 | { 41 | currpage++; 42 | if (MAXPAGES < currpage) 43 | { 44 | Printf("Max Pages of %d reached!\n", maxpages); 45 | return 0; 46 | } 47 | 48 | PAGE page ; 49 | 50 | // Check for valid header 51 | if( page.CapturePattern != "OggS" ) 52 | { 53 | Warning( "File is not a valid ogg file. Template stopped." ); 54 | return -1; 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /OrCad3.20a_SCH.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v6.0 Binary Template 3 | // 4 | // File: OrCad3.20a_SCH.bt 5 | // Author: L. Potjewijd 6 | // Revision: 1.20 7 | // Date: 20150531 8 | // Purpose: Parsing OrCad 3.20a schematic files 9 | //----------------------------------- 10 | 11 | enum fType {BLOCK,WORKSHEET}; 12 | enum YesNo {no,yes}; 13 | enum paper {OrcadA,OrcadB,OrcadC,OrcadD,OrcadE}; 14 | enum rotate {none,CCW_90,CCW_180,CCW_270}; 15 | enum primT {dwgDetails,sheet,part,line,bus,junction,modulePort,label,busEntry,dashedLine,powerSymbol,text,EndOfList=0x0f}; 16 | enum IOtype {UNSPEC,OUTPUT,INPUT,BIDIR}; 17 | enum Pstyle {block,pointL,pointR,pointLR}; 18 | enum side {left,right,top,bottom}; 19 | enum PStype {circle,arrow,bar,wave}; 20 | enum align {centered,just_left,just_right}; 21 | enum Btype {downleft,upleft}; 22 | 23 | typedef byte bit; // just for readability 24 | 25 | typedef struct sText 26 | { byte Length ; 27 | if (Length > 0) char String[Length]; 28 | }; 29 | 30 | typedef struct fTxt (byte fixLen) 31 | { byte Length ; 32 | if (Length > 0) char String[Length]; 33 | if ((fixLen > 0) && (fixLen > Length)) char filler[fixLen-Length]; 34 | }; 35 | 36 | typedef struct Coord 37 | { short X; 38 | short Y; 39 | }; 40 | 41 | typedef struct PartField 42 | { Coord Location; 43 | sText Value; 44 | }; 45 | 46 | typedef struct IDstring 47 | { char text[14]; // "Schematic FILE" 48 | char terminator[3]; // #13, #10, #26 49 | }; 50 | 51 | typedef struct hdrDet 52 | { IDstring head; 53 | if (head.text != "Schematic FILE") 54 | { Warning("File is not recognized as an OrCAD schematic file."); 55 | return -1; 56 | } 57 | ubyte tail[5]; 58 | int primitiveSectionLength ; 59 | Coord cursor; 60 | ushort zoom; 61 | }; 62 | 63 | typedef struct pP00 // TITLEBLOCK 64 | { ushort sheetNumber; 65 | ushort ofSheets; 66 | paper PaperSize; 67 | fTxt DocDate(12); 68 | fTxt DocNumber(36); 69 | fTxt RevNumber(3); 70 | fTxt Title(44); 71 | fTxt Organisation(44); 72 | fTxt AddressLine(44)[4] ; // for readability 73 | }; 74 | 75 | typedef struct pP01 // SHEET 76 | { local int i ; 77 | Coord Location; 78 | Coord Size; 79 | ubyte unknown[4]; 80 | ubyte Ports; 81 | sText FileName; 82 | sText SheetName; 83 | for ( i=0 ; i < Ports ; i++ ) 84 | struct PortDef 85 | { short NameXoffset; 86 | short PortYoffset; 87 | IOtype Type; 88 | sText Name; 89 | } Port; 90 | }; 91 | 92 | typedef struct pP02 // PART 93 | { Coord Location; 94 | Coord RefDesLocation; 95 | Coord ValueLocation; 96 | struct PartDet1 97 | { ubyte raw ;/* this is to display */ 98 | FSkip (-1); /* the 'raw' bits, too */ 99 | BitfieldLeftToRight(); 100 | YesNo mirror : 1; 101 | rotate rotation : 2; 102 | byte subpackage : 5; 103 | } Details; 104 | struct PartDet2 105 | { BigEndian(); /*************************/ 106 | ushort raw ;/* this is to display */ 107 | LittleEndian(); /* the 'raw' bits, too */ 108 | FSkip (-2); /*************************/ 109 | BitfieldLeftToRight(); 110 | bit bitF : 1 ; 111 | YesNo XtraFields : 1; 112 | bit bitD : 1 ; 113 | bit bitC : 1 ; 114 | bit bitB : 1 ; 115 | YesNo HideValue : 1; 116 | YesNo HideRefDes : 1; 117 | bit bit8 : 1 ; 118 | YesNo HideField8 : 1; 119 | YesNo HideField7 : 1; 120 | YesNo HideField6 : 1; 121 | YesNo HideField5 : 1; 122 | YesNo HideField4 : 1; 123 | YesNo HideField3 : 1; 124 | YesNo HideField2 : 1; 125 | YesNo HideField1 : 1; 126 | } Visibility; 127 | ubyte unknown[13] ; 128 | sText RefDes; 129 | sText PartValue; 130 | if (Visibility.XtraFields == yes) 131 | PartField Xfield[8] ; 132 | }; 133 | 134 | typedef struct pP03 // LINE, BUS or DASHED LINE 135 | { Coord Start; 136 | Coord End; 137 | }; 138 | 139 | typedef struct pP05 // JUNCTION 140 | { Coord Location; 141 | }; 142 | 143 | typedef struct pP06 // MOD_PORT 144 | { Coord Location; 145 | struct PortDet 146 | { ubyte MinLength; 147 | ubyte raw ;// this is to display // 148 | FSkip (-1); // the 'raw' bits, too // 149 | BitfieldLeftToRight(); 150 | IOtype PortType : 2; 151 | Pstyle PortStyle : 2; 152 | bit bit3 : 1 ; 153 | bit bit2 : 1 ; 154 | bit bit1 : 1 ; 155 | bit bit0 : 1 ; 156 | } Details; 157 | sText PortName ; 158 | }; 159 | 160 | typedef struct pP07 // LABEL or TEXT 161 | { Coord Location; 162 | short rawSize ; 163 | local ushort Size = Abs(rawSize); 164 | local YesNo Vertical = (rawSize < 0); 165 | sText Name; 166 | }; 167 | 168 | typedef struct pP08 // BUS_ENTRY 169 | { Coord Location; 170 | struct BusDet 171 | { ubyte raw ;// this is to display // 172 | FSkip (-1); // the 'raw' bits, too // 173 | BitfieldLeftToRight(); 174 | bit bit7 : 1 ; 175 | bit bit6 : 1 ; 176 | bit bit5 : 1 ; 177 | bit bit4 : 1 ; 178 | bit bit3 : 1 ; 179 | bit bit2 : 1 ; 180 | YesNo isBusType : 1; 181 | Btype direction : 1; 182 | } Details; 183 | }; 184 | 185 | typedef struct pP0A // PWR_SYM 186 | { Coord Location; 187 | struct PSDet 188 | { ubyte raw ;// this is to display // 189 | FSkip (-1); // the 'raw' bits, too // 190 | BitfieldLeftToRight(); 191 | bit bit7 : 1 ; 192 | bit bit6 : 1 ; 193 | bit bit5 : 1 ; 194 | bit bit4 : 1 ; 195 | side Orientation : 2; 196 | PStype Shape : 2; 197 | } Details; 198 | sText Name; 199 | }; 200 | 201 | typedef struct Element // the actual displayable items 202 | { primT Type ; 203 | ushort DataLength ; 204 | switch ( Type ) 205 | { case 0x00 : {pP00 TITLE_BLOCK;break;} 206 | case 0x01 : {pP01 SHEET; break;} 207 | case 0x02 : {pP02 PART; break;} 208 | case 0x03 : {pP03 LINE; break;} 209 | case 0x04 : {pP03 BUS; break;} 210 | case 0x05 : {pP05 JUNCTION; break;} 211 | case 0x06 : {pP06 MOD_PORT; break;} 212 | case 0x07 : {pP07 LABEL; break;} 213 | case 0x08 : {pP08 BUS_ENTRY; break;} 214 | case 0x09 : {pP03 DASH_LINE; break;} 215 | case 0x0a : {pP0A PWR_SYM; break;} 216 | case 0x0b : {pP07 TEXT; break;} 217 | case 0x0f : {/* End Of List */ break;} 218 | case 0x11 : {pP01 bSHEET; break;} 219 | case 0x12 : {pP02 bPART; break;} 220 | case 0x13 : {pP03 bLINE; break;} 221 | case 0x14 : {pP03 bBUS; break;} 222 | case 0x15 : {pP05 bJUNCTION; break;} 223 | case 0x16 : {pP06 bMOD_PORT; break;} 224 | case 0x17 : {pP07 bLABEL; break;} 225 | case 0x18 : {pP08 bBUS_ENTRY; break;} 226 | case 0x19 : {pP03 bDASH_LINE; break;} 227 | case 0x1a : {pP0A bPWR_SYM; break;} 228 | case 0x1b : {pP07 bTEXT; break;} 229 | default : { Printf ("Unknown primitive: %x, ",Type); 230 | return (-1); 231 | } 232 | } 233 | }; 234 | 235 | // *************************************************************************** 236 | 237 | hdrDet HEADER; 238 | do 239 | { Element primitive; 240 | } 241 | while ( primitive.Type != EndOfList ); 242 | 243 | while ( !FEof() ) 244 | { sText part; 245 | } 246 | -------------------------------------------------------------------------------- /OscarItemTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0.2 Binary Template 3 | // 4 | // File: OscarItemTemplate.bt 5 | // Author: 6 | // Revision:1.0 7 | // Purpose: Template for binary journal 8 | // file used in AppleOne POS. 9 | //-------------------------------------- 10 | while( !FEof() ){ 11 | struct RECORD { 12 | char type; 13 | if (r.type == 'A'){ 14 | char unused ; 15 | short empNum; 16 | int ssn; 17 | short checkNum; 18 | short tableNum; 19 | short calcGuestCt; 20 | short openTime; 21 | short flagDeleted; 22 | short unused2; 23 | short pullBack; 24 | short itemCt; 25 | short guestCt; 26 | short takeoutTicket; 27 | int csiNumber; 28 | char junk[22]; 29 | } else { if (r.type == 'B'){ 30 | char unused ; 31 | short empNum; 32 | int ssn; 33 | short itemNum; 34 | short deptCat; 35 | short priceGrp; 36 | int price; 37 | int tax1Amt; 38 | int tax2Amt; 39 | short quantity; 40 | short taxStatusAcct; 41 | short specUserId; 42 | int plu; 43 | int managerSsn; 44 | short orderTime; 45 | byte seatNum; 46 | byte priceCode; 47 | byte xxExpansion; 48 | byte itemType; 49 | int reductionCode; 50 | int postPrice; 51 | } else { if (r.type == 'C' || r.type == 'D'){ 52 | char unused ; 53 | short empNum; 54 | int ssn; 55 | short itemNum; 56 | short deptCat; 57 | short priceGrp; 58 | int price; 59 | int tax1Amt; 60 | int tax2Amt; 61 | short quantity; 62 | short dupVoidCat; 63 | short managerNum; 64 | int plu; 65 | int managerSsn; 66 | short tranTime; 67 | byte seatNum; 68 | char unused2[3]; 69 | short voidCatId; 70 | char junk[6]; 71 | } else { if (r.type == 'E'){ 72 | char unused ; 73 | short empNum; 74 | int ssn; 75 | char unused2[6]; 76 | int discAmt; 77 | int tax1Amt; 78 | int tax2Amt; 79 | short quantity; 80 | short altDiscCat; 81 | short managerNum; 82 | char unused3[4]; 83 | int managerSsn; 84 | short discTime; 85 | byte seatNum; 86 | char unused4[3]; 87 | short discCatId; 88 | char junk[6]; 89 | } else { if (r.type == 'F'){ 90 | char unused ; 91 | short empNum; 92 | int ssn; 93 | short payCatId; 94 | int payAmt; 95 | int gratuity; 96 | int externalId; 97 | short status; 98 | int acctNum; 99 | int acctExHigh; 100 | int cashBack; 101 | char junk[18]; 102 | } else { if (r.type == 'K'){ 103 | char unused ; 104 | short empNum; 105 | int ssn; 106 | int amount; 107 | short closedTime; 108 | short origClsTime; 109 | int unused2; 110 | short dupEmpNum; 111 | int unused3; 112 | short origCheckNum; 113 | char junk[26]; 114 | } else { 115 | char junk[53] ; 116 | }}}}}} 117 | } r; 118 | } 119 | -------------------------------------------------------------------------------- /PALTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.0.2 Template File 3 | // 4 | // File: PALTemplate.bt 5 | // Author: SweetScape Software 6 | // Revision: 1.1 7 | // Purpose: Parses a Microsoft PAL 8 | // palette file. 9 | // SweetScape: Changed display order 10 | // in ReadRGBQUAD to match the BMP 11 | // template (Oct 24th, 2007). 12 | //-------------------------------------- 13 | 14 | // Declare a structure for holding a color 15 | typedef struct 16 | { 17 | uchar red; 18 | uchar green; 19 | uchar blue; 20 | uchar alpha; 21 | } RGBQUAD ; 22 | 23 | // Custom read functions for color types - this allows the 24 | // color to be displayed without having to open up the structure. 25 | string ReadRGBQUAD( RGBQUAD &a ) 26 | { 27 | string s; 28 | SPrintf( s, "#%02X%02X%02X%02X", a.alpha, a.red, a.green, a.blue ); 29 | return s; 30 | } 31 | 32 | //--------------------------------------------- 33 | 34 | // Declare the file header 35 | char file_signature[4]; 36 | int file_length; 37 | char tag_type[4]; 38 | 39 | // Declare the RIFF chunk with color data 40 | char chunk_signature[4]; 41 | int chunk_size; 42 | ushort version ; //should be 300h 43 | ushort num_colors; 44 | RGBQUAD colors[ num_colors ]; 45 | -------------------------------------------------------------------------------- /PCAPTemplate.bt: -------------------------------------------------------------------------------- 1 | //--------------------- 2 | //--- 010 Editor v3.0.3 Binary Template 3 | // 4 | // File: PCAPTemplate.bt 5 | // Author: Didier Stevens (https://DidierStevens.com) 6 | // Revision: 0.1, prototype, only tested on 1 PCAP file 7 | // Date: 2009/05/24 8 | // Purpose: Defines a template for parsing PCAP files. 9 | // References: 10 | // http://wiki.wireshark.org/Development/LibpcapFileFormat 11 | //-------------------------------------- 12 | 13 | 14 | typedef struct { 15 | uint32 magic_number ; /* magic number */ 16 | if(magic_number != 0xA1B2C3D4) { 17 | Warning("Not a valid PCAP file"); 18 | return 1; 19 | } 20 | uint16 version_major; /* major version number */ 21 | uint16 version_minor; /* minor version number */ 22 | int32 thiszone; /* GMT to local correction */ 23 | uint32 sigfigs; /* accuracy of timestamps */ 24 | uint32 snaplen; /* max length of captured packets, in octets */ 25 | uint32 network; /* data link type */ 26 | } PCAPHEADER; 27 | 28 | typedef struct 29 | { 30 | uchar Byte[6]; 31 | } MACaddr; 32 | 33 | typedef struct 34 | { 35 | MACaddr DstMac; 36 | MACaddr SrcMac; 37 | uint16 L3type; 38 | } Layer_2 ; 39 | 40 | typedef struct 41 | { 42 | uchar Byte[4]; 43 | } IPv4addr; 44 | 45 | string IPv4addrName(IPv4addr &IP) 46 | { 47 | string strReturn; 48 | SPrintf(strReturn,"%d.%d.%d.%d",IP.Byte[0],IP.Byte[1],IP.Byte[2],IP.Byte[3]); 49 | return strReturn; 50 | } 51 | typedef struct (uint16 proto_type) 52 | { 53 | uchar version:4; 54 | uchar ip_hdr_len:4; 55 | local int hdr_length = ip_hdr_len*4; 56 | BYTE DiffServField; 57 | uint16 total_length; 58 | if (proto_type == 0x0800) // IP 59 | { 60 | uint16 Identification; 61 | uint16 Flags; 62 | BYTE TTL; 63 | BYTE L4proto; 64 | uint16 HdrChecksum; 65 | IPv4addr SRC_IP; 66 | IPv4addr DST_IP; 67 | } 68 | else 69 | { 70 | BYTE Unknown[hdr_length-4]; 71 | } 72 | } Layer_3; 73 | 74 | typedef struct (ushort VER_HDR,uint16 total_length,uint L4proto) 75 | { 76 | local uint16 ip_hdr_length = VER_HDR*4; 77 | 78 | if (L4proto == 0x11) // UDP 79 | { 80 | uint16 SrcPort; 81 | uint16 DstPort; 82 | uint16 udp_hdr_len; 83 | uint16 ChkSum; 84 | } 85 | else if (L4proto == 0x6) // TCP 86 | { 87 | uint16 SrcPort; 88 | uint16 DstPort; 89 | uint32 SEQ; 90 | uint32 ACK; 91 | uchar tcp_hdr_len:4; 92 | uchar Reserved:4; 93 | BYTE Crap[tcp_hdr_len*4-13]; 94 | } 95 | else 96 | { 97 | BYTE packet[total_length-ip_hdr_length]; 98 | } 99 | 100 | } Layer_4; 101 | 102 | string L4protoName(BYTE val) 103 | { 104 | if (val == 0x06) 105 | { 106 | return "TCP"; 107 | } 108 | else if (val == 0x11) 109 | { 110 | return "UDP"; 111 | } 112 | else 113 | { 114 | return "Unknown"; 115 | } 116 | } 117 | 118 | typedef struct { 119 | time_t ts_sec; /* timestamp seconds */ 120 | uint32 ts_usec; /* timestamp microseconds */ 121 | uint32 incl_len; /* number of octets of packet saved in file */ 122 | uint32 orig_len; /* actual length of packet */ 123 | BigEndian(); 124 | Layer_2 L2 ; 125 | Layer_3 L3(L2.L3type) ; 126 | Layer_4 L4(L3.ip_hdr_len,L3.total_length,L3.L4proto); 127 | 128 | if (L3.L4proto == 0x6) 129 | { 130 | local uint16 AppDataLen = L3.total_length - L3.ip_hdr_len*4 - L4.tcp_hdr_len*4; 131 | if (AppDataLen > 0) 132 | { 133 | BYTE AppData[AppDataLen]; 134 | } 135 | } 136 | else if (L3.L4proto == 0x11) 137 | { 138 | local uint AppDataLen = L4.udp_hdr_len-8; 139 | if (AppDataLen > 0) 140 | { 141 | BYTE AppData[AppDataLen]; 142 | } 143 | } 144 | LittleEndian(); 145 | } PCAPRECORD ; 146 | 147 | string PCAPcomments(PCAPRECORD &P) 148 | { 149 | local uint16 L4_proto = P.L3.L4proto; 150 | string strReturn; 151 | local uint16 AppDataLen = 0; 152 | if (L4_proto == 0x6) 153 | { 154 | AppDataLen = P.L3.total_length - P.L3.ip_hdr_len*4 - P.L4.tcp_hdr_len*4; 155 | } 156 | else if (L4_proto == 0x11) 157 | { 158 | AppDataLen = P.L4.udp_hdr_len - 8; 159 | } 160 | SPrintf(strReturn,"%s:%d -> %s:%d %s %s",IPv4addrName(P.L3.SRC_IP),P.L4.SrcPort,IPv4addrName(P.L3.DST_IP),P.L4.DstPort,L4protoName(L4_proto), AppDataLen > 0 ? "***" : ""); 161 | return strReturn; 162 | } 163 | string ReadPCAPRECORD(PCAPRECORD &record) 164 | { 165 | string strReturn; 166 | 167 | SPrintf(strReturn, "%s.%06u", TimeTToString(record.ts_sec), record.ts_usec); 168 | return strReturn; 169 | } 170 | 171 | string MACname(MACaddr &addr) 172 | { 173 | string strReturn; 174 | SPrintf(strReturn,"%.02x:%.02x:%.02x:%.02x:%.02x:%.02x",addr.Byte[0],addr.Byte[1],addr.Byte[2],addr.Byte[3],addr.Byte[4],addr.Byte[5]); 175 | return strReturn; 176 | } 177 | 178 | // Define the headers 179 | LittleEndian(); 180 | PCAPHEADER header; 181 | 182 | while( !FEof() ) 183 | { 184 | PCAPRECORD record; 185 | 186 | } 187 | -------------------------------------------------------------------------------- /PCXTemplate.bt: -------------------------------------------------------------------------------- 1 | //------------------------------------ 2 | //--- 010 Editor v1.2 Binary Template 3 | // 4 | // Name: PCXTemplate.bt 5 | // Author: James Newton 6 | // Purpose: Sample template for PCX 7 | // header information. 8 | //------------------------------------ 9 | 10 | enum PCX_TYPE { 11 | v25 =0, //Version 2.5 of PC Paintbrush 12 | v28Pal =2, //Version 2.8 w/palette information 13 | v28 =3, //Version 2.8 w/o palette information 14 | v5Win =4, //PC Paintbrush for Windows(Plus for Windows uses Ver 5) 15 | v3up =5 //Version 3.0 and > of PC Paintbrush and PC Paintbrush +, includes Publisher's Paintbrush. Includes 24-bit .PCX files. 16 | } ; 17 | 18 | struct PCX { 19 | ubyte Manufacturer; //Constant Flag, 10 = ZSoft .pcx 20 | PCX_TYPE version; //Version information 21 | ubyte encoding; //1 = .PCX run length encoding 22 | ubyte BitsPerPixel; //Number of bits to represent a pixel (per Plane) - 1, 2, 4, or 8 23 | ushort Xmin; //Window. Image Dimensions: Xmin,Ymin,Xmax,Ymax 24 | ushort Ymin; // 25 | ushort Xmax; // 26 | ushort Ymax; // 27 | ushort HDpi; //Horizontal Resolution of image in DPI* 28 | ushort VDpi; //Vertical Resolution of image in DPI* 29 | ubyte Colormap[48]; //Color palette setting, see text 30 | ubyte Reserved; //Should be set to 0. 31 | ubyte NPlanes; //Number of color planes 32 | ushort BytesPerLine; //Number of bytes to allocate for a scanline plane. MUST be an EVEN number. Do NOT calculate from Xmax-Xmin. 33 | ushort PaletteInfo; //How to interpret palette- 1 = Color/BW, 2 = Grayscale (ignored in PB IV/ IV +) 34 | ushort HscreenSize; //Horizontal screen size in pixels. New field found only in PB IV/IV Plus 35 | ushort VscreenSize; //Vertical screen size in pixels. New field found only in PB IV/IV Plus 36 | ubyte Filler[54]; //Blank to fill out 128 byte header. Set all bytes to 0 37 | }; 38 | 39 | PCX file; 40 | -------------------------------------------------------------------------------- /PNGTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.0.1 Binary Template 3 | // 4 | // File: PNGTemplate.bt 5 | // Author: Kevin O. Grover 6 | // Purpose: A template for parsing PNG (Portable Network Graphics) files. 7 | // Version: 1.1 2009-02-25 8 | // History: 9 | // 2005-05-11 KOG Initial version 10 | // 2005-06-29 KOG Fixed typos in comments 11 | // 2009-02-23 KOG Decode IHDR and tEXt chunks 12 | // 13 | // This template was written to the PNG 1.2 Specification. 14 | // Note however, that it does not check nor parse chunk subdata, so it 15 | // should work with all future PNG specifications. 16 | // 17 | // Also, a possible caveat: PNG encourages the type of chunks to be 18 | // mapped to strings of the form "[a-zA-Z]{4}". However, it's not a requirement. 19 | // 20 | // Summary of PNG Format: 21 | // A PNG file consists of an 8 byte ID followed by a series of chunks. 22 | // Each Chunk is 23 | // length (4 bytes), chunk_type (4 bytes), data (length bytes), crc (4 bytes) 24 | // CRC Does NOT include the length bytes. 25 | //-------------------------------------- 26 | 27 | BigEndian(); // PNG files are in Network Byte order 28 | 29 | const uint64 PNGMAGIC = 0x89504E470D0A1A0AL; 30 | 31 | // Chunk Type 32 | typedef union { 33 | uint32 ctype ; // Chunk Type 34 | char cname[4]; // character representation 35 | } CTYPE ; 36 | 37 | string readCTYPE(local CTYPE &t) { 38 | return t.cname; 39 | } 40 | 41 | // -- Specific Chunks 42 | 43 | // IHDR - Image Header 44 | 45 | typedef struct { 46 | uint32 width; 47 | uint32 height; 48 | ubyte bits; 49 | ubyte color_type; 50 | ubyte compression; 51 | ubyte filter; 52 | ubyte interlace; 53 | } IHDR ; 54 | 55 | string readIHDR(local IHDR &ihdr) { 56 | local string s; 57 | SPrintf(s, "%i x %i (x%i)", ihdr.width, ihdr.height, ihdr.bits); 58 | return s; 59 | } 60 | 61 | // tEXt - Text Data 62 | 63 | typedef struct { 64 | string label; // to the first NULL (including) 65 | char data[length - Strlen(label) - 1]; // rest of the data 66 | } tEXt ; 67 | 68 | string readtEXt(local tEXt &text) { 69 | local string s; 70 | SPrintf(s, "%s = %s", text.label, text.data); 71 | return s; 72 | } 73 | 74 | // -- End: Specific Chunks 75 | 76 | local uint32 CHUNK_CNT = 0; 77 | 78 | // Generic Chunks 79 | typedef struct { 80 | uint32 length; // Number of data bytes (not including length,type, or crc) 81 | local quad pos_start = FTell(); 82 | CTYPE type; // Type of chunk 83 | if (type.cname == "IHDR") { 84 | IHDR ihdr; 85 | } else if (type.cname == "tEXt") { 86 | tEXt text; 87 | } else { 88 | ubyte data[length]; // Data (or not present) 89 | } 90 | local quad data_size = FTell() - pos_start; 91 | uint32 crc ; // CRC type and data (not including length or crc) 92 | local uint32 crc_calc = Checksum(CHECKSUM_CRC32, pos_start, data_size); 93 | if (crc != crc_calc) { 94 | local string msg; 95 | SPrintf(msg, "*WARNING CRC Mismatch @ chunk[%d] (%08x != %08x)\n", CHUNK_CNT, crc, crc_calc); 96 | Warning(msg); 97 | Printf(msg); 98 | } 99 | CHUNK_CNT++; 100 | } CHUNK ; 101 | 102 | 103 | // Chunks can be in any order: HOWEVER, IHDR must be first, IEND must be last 104 | // Bit 5s in chunk type bytes are used to flag some things: 105 | // Ancillary bit: bit 5 of 1st byte: 0=Critical, 1=Ancillary 106 | // Private bit: bit 5 of 2nd byte: 0=Public, 1=Private 107 | // Reserved bit: bit 5 of 3rd byte: MUST be 0 108 | // Safe to Copy bit: bit 5 of 4th byte: 0=Unsafe to Copy, 1=Safe to Copy 109 | string readCHUNK(local CHUNK &c) { 110 | local string s; 111 | s=readCTYPE(c.type)+" ("; 112 | s += (c.type.cname[0] & 0x20) ? "Ancillary, " : "Critical, "; 113 | s += (c.type.cname[1] & 0x20) ? "Private, " : "Public, "; 114 | s += (c.type.cname[2] & 0x20) ? "ERROR_RESERVED, " : ""; 115 | s += (c.type.cname[3] & 0x20) ? "Safe to Copy)" : "Unsafe to Copy)"; 116 | return s; 117 | } 118 | 119 | // --------------------------------------------------------------------------- 120 | // MAIN -- Here's where we really allocate the data 121 | // --------------------------------------------------------------------------- 122 | 123 | uint64 pngid ; 124 | if (pngid != PNGMAGIC) { 125 | Warning("Invalid PNG File: Bad Magic Number"); 126 | return -1; 127 | } 128 | while(!FEof()) { 129 | CHUNK chunk; 130 | } 131 | if (CHUNK_CNT > 1) { 132 | if ((chunk[0].type.cname != "IHDR") || (chunk[CHUNK_CNT-1].type.cname != "IEND")) { 133 | local string msg; 134 | SPrintf(msg, "*WARNING: Chunk IHDR must be first and chunk IEND must be last!\n"); 135 | Warning(msg); 136 | Printf(msg); 137 | } 138 | } 139 | -------------------------------------------------------------------------------- /QihooPackerTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0beta1 Binary Template 3 | // 4 | // File: QihooPackerTemplate.pt 5 | // Author: Tim Strazzere 6 | // Revision: 0.1 7 | // Purpose: Parse the header added at the end of the dex file on 8 | // Qihoo360 packed files. Just a WPI while I was doing some 9 | // research... 10 | 11 | typedef struct { 12 | byte qihoo_magic[8]; 13 | byte junk[0x104]; 14 | byte key[0x8]; 15 | byte compression[0x4]; 16 | byte encryption[0x4]; 17 | } Header; 18 | 19 | Header header; -------------------------------------------------------------------------------- /RDBTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: RDBTemplate.bt 5 | // Author: AnTler 6 | // Revision: 1.0 7 | // Purpose: Defines a template for parsing RDB files. 8 | // Changes: 9 | 10 | //----------------------------------- 11 | 12 | // Define structures used in RDB files 13 | 14 | // Defines a file header 15 | typedef struct { 16 | CHAR reserved[16]; 17 | DWORD fhFileTotalCount; 18 | INT64 fhFileNameOffBits ; 19 | INT64 fhFileDataOffBits ; 20 | } RDBFILEHEADER ; 21 | 22 | // Defines a file record 23 | typedef struct { 24 | local INT fileNameLength = 0; 25 | local USHORT value = 0; 26 | do 27 | { 28 | value = ReadUShort( FTell() + fileNameLength) ; 29 | fileNameLength += sizeof(value); 30 | } while(value != 0x0000); 31 | 32 | CHAR frCurFileName[fileNameLength]; 33 | INT64 frCurFileDataOffBits ; 34 | INT64 frCurFileDataSize; 35 | } RDBFILERECORD ; 36 | 37 | string ReadRDBFILERECORD( RDBFILERECORD &r ) 38 | { 39 | string s; 40 | SPrintf( s, "%s", r.frCurFileName); 41 | return s; 42 | } 43 | 44 | //-------------------------------------------- 45 | 46 | // Define the file 47 | LittleEndian(); 48 | 49 | RDBFILEHEADER rdbFileHeader; 50 | 51 | FSeek(rdbFileHeader.fhFileNameOffBits); 52 | 53 | local int i; 54 | for( i = 0; i < rdbFileHeader.fhFileTotalCount; i++ ) 55 | RDBFILERECORD rdbFileRecord; 56 | 57 | 58 | 59 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 010templates 2 | 3 | a collections of 010 templates 4 | 5 | you are welcome to commit your templates 6 | 7 | -------------------------------------------------------------------------------- /RegistryHive.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0.1 Binary Template 3 | // 4 | // File: RegistryHive.bt 5 | // Author: Eric R. Zimmerman saericzimmerman@gmail.com 6 | // Revision: 1.2 7 | // Purpose: Parses Registry structures including Header, nk, vk, sk, and list records. Data node records are skipped 8 | //-------------------------------------- 9 | 10 | LittleEndian(); 11 | 12 | // Defines a header record 13 | typedef struct { 14 | // Header for the file 15 | char HeaderSignature[4] ; 16 | int PrimarySequenceNumber; 17 | int SecondarySequenceNumber; 18 | FILETIME LastWriteTime ; 19 | int MajorVersion ; 20 | int MinorVersion ; 21 | int FileType; 22 | int Unknown; 23 | int RootKeyOffset ; 24 | int HbinTotalSize ; 25 | int Unknown2; 26 | wchar_t EmbeddedFilename[32] ; 27 | char Unknown3[396]; 28 | int Checksum; 29 | 30 | } REGISTRYHEADER ; 31 | 32 | typedef struct (int recordSize) { 33 | int Size; 34 | char Signature[2] ; 35 | short Flags ; 36 | FILETIME LastWriteTime ; 37 | int Spare; 38 | int ParentCellOffset; 39 | int SubkeyCountStable ; 40 | int SubkeyCountVolatile; 41 | int SubkeyListOffsetStable ; 42 | int SubkeyListOffsetVolatile; 43 | int ValueCount ; 44 | int ValuelistOffset ; 45 | int SecurityKeyOffset; 46 | int ClassOffset; 47 | short MaxNameLength; 48 | byte UserVirtFlags; 49 | byte Debug; 50 | int MaxClassLength; 51 | int MaxValueNameLength; 52 | int MaxValueDataLength; 53 | int WorkVar; 54 | short NameLength ; 55 | short ClassLength; 56 | char Name[NameLength] ; 57 | local int PaddingSize = recordSize - 0x50 - NameLength; 58 | if (PaddingSize > 0) 59 | { 60 | char Padding[recordSize - 0x50 - NameLength]; 61 | } 62 | 63 | 64 | } NKCELL ; 65 | 66 | string ReadNKCell( NKCELL &nk ) 67 | { 68 | return nk.Name; 69 | } 70 | 71 | typedef struct (int recordSize) { 72 | int Size; 73 | char Signature[2] ; 74 | short NameLength ; 75 | int DataLength; 76 | int DataOffset; 77 | int Type; 78 | short Flags ; 79 | short Spare; 80 | if (NameLength>0) 81 | { 82 | char Name[NameLength] ; 83 | } 84 | local int PaddingSize = recordSize - 0x18 - NameLength; 85 | if (PaddingSize > 0) 86 | { 87 | char Padding [recordSize - 0x18 - NameLength]; 88 | } 89 | 90 | } VKCELL ; 91 | 92 | string ReadVKCell( VKCELL &vk ) 93 | { 94 | if (vk.NameLength > 0) 95 | { 96 | return vk.Name; 97 | } 98 | else 99 | { 100 | return "(Default)"; 101 | } 102 | } 103 | 104 | 105 | typedef struct (int recordSize) { 106 | byte AceType; 107 | byte AceFlags; 108 | short AceSize; 109 | int Mask ; 110 | char SID[AceSize - 8]; //account for 2 bytes, short, and int 111 | 112 | } ACE ; 113 | 114 | typedef struct (int recordSize) { 115 | byte AclRevision; 116 | byte Sbz1; 117 | short AclSize; 118 | short AceCount; 119 | short Sbz2; 120 | if (AclSize > 0) 121 | { 122 | local int aceSize = 0; 123 | local int i; 124 | for (i = 0; i < AceCount; i++) 125 | { 126 | aceSize=ReadInt(FTell()+2); 127 | ACE Ace(aceSize); 128 | } 129 | } 130 | 131 | } ACL ; 132 | 133 | typedef struct (int recordSize) { 134 | byte Revision; 135 | byte Spare; 136 | short ControlFlag ; 137 | int OffsetToOwner; 138 | int OffsetToGroup; 139 | int OffsetToSACL; 140 | int OffsetToDACL; 141 | 142 | local int sizeSACL = OffsetToDACL - OffsetToSACL; 143 | local int sizeDACL = OffsetToOwner - OffsetToDACL; 144 | local int sizeOwnerSid = OffsetToGroup - OffsetToOwner; 145 | local int sizeGroupSid = recordSize - OffsetToGroup; 146 | 147 | if ((ControlFlag & 0x010) == 0x010) //0x010 == SeSaclPresent 148 | { 149 | ACL SACL(sizeSACL); 150 | } 151 | if ((ControlFlag & 0x004) == 0x004) //0x004 == SeDaclPresent 152 | { 153 | ACL DACL(sizeDACL); 154 | } 155 | char OwnerSID[sizeOwnerSid]; 156 | char GroupSID[sizeGroupSid]; 157 | } DESCRIPTOR ; 158 | 159 | typedef struct (int recordSize) { 160 | int Size; 161 | char Signature[2] ; 162 | short Reserved; 163 | int Flink; 164 | int Blink; 165 | int ReferenceCount; 166 | int DescriptorLength; 167 | if (DescriptorLength) 168 | { 169 | DESCRIPTOR Descriptor(DescriptorLength); 170 | } 171 | 172 | local int PaddingSize = recordSize - 0x18 - DescriptorLength; 173 | if (PaddingSize > 0) 174 | { 175 | char Padding[recordSize - 0x18 - DescriptorLength]; 176 | } 177 | 178 | } SKCELL ; 179 | 180 | typedef struct { 181 | int Offset; 182 | char Hash[4]; 183 | 184 | } LXOFFSET ; 185 | 186 | typedef struct (int recordSize) { 187 | int Size; 188 | char Signature[2] ; 189 | short NumberOfOffsets; 190 | if (NumberOfOffsets > 0) 191 | { 192 | LXOFFSET offsets[NumberOfOffsets]; 193 | } 194 | 195 | local int PaddingSize = recordSize-8-(8*NumberOfOffsets); 196 | if (PaddingSize > 0) 197 | { 198 | char Padding[recordSize-8-(8*NumberOfOffsets)]; 199 | } 200 | 201 | } LXLIST ; 202 | 203 | typedef struct (int recordSize) { 204 | int Size; 205 | char Signature[2] ; 206 | short NumberOfOffsets; 207 | LXOFFSET offsets[NumberOfOffsets]; 208 | 209 | } LILIST ; 210 | 211 | typedef struct { 212 | char HbinSignature[4] ; 213 | int RelativeOffset; 214 | int SizeOfHbin; 215 | int Unknown1; 216 | int Unknown2; 217 | FILETIME Timestamp ; 218 | int unknown3; 219 | 220 | local string sig; 221 | 222 | local int index = 0; 223 | 224 | local int cellSize = ReadInt(FTell()); 225 | 226 | while (index < SizeOfHbin) 227 | { 228 | sig = GetCellSignature(); 229 | 230 | cellSize = ReadInt(FTell()); 231 | 232 | if (cellSize == 0) 233 | { 234 | break; //safety net 235 | } 236 | 237 | switch( sig ) 238 | { 239 | case "nk" : NKCELL nk(Abs(cellSize)); break; 240 | case "sk" : SKCELL sk(Abs(cellSize)); break; 241 | case "vk" : VKCELL vk(Abs(cellSize)); break; 242 | case "li" : LILIST li(Abs(cellSize)); break; 243 | case "lf" : LXLIST lf(Abs(cellSize)); break; 244 | case "lh" : LXLIST lh(Abs(cellSize)); break; 245 | default : 246 | //Printf("Sig = %s \n",sig); //print out signatures of unknowns 247 | FSkip(Abs(cellSize)); //skip data cells 248 | } 249 | 250 | index+=Abs(cellSize); 251 | } 252 | 253 | } HBINRECORD ; 254 | 255 | int SizeHbinRecord( HBINRECORD &r) 256 | { 257 | return ReadInt(startof(r)+8); 258 | } 259 | 260 | char[] GetCellSignature() 261 | { 262 | //Read 4 bytes away from current to get the signature string 263 | return ReadString(FTell() + 4, 2); 264 | } 265 | 266 | REGISTRYHEADER Header ; 267 | 268 | local int indexPosition = FTell(); 269 | 270 | local int indexPosStart = indexPosition; 271 | 272 | local int absoluteEndPosition = Header.HbinTotalSize + 0x1000; 273 | 274 | while (indexPosition < absoluteEndPosition) 275 | { 276 | HBINRECORD Hbin ; 277 | 278 | indexPosition+= Hbin.SizeOfHbin; 279 | } 280 | 281 | 282 | -------------------------------------------------------------------------------- /RegistryPolicyFileTemplate.bt: -------------------------------------------------------------------------------- 1 | 2 | // 3 | // 010 Editor v4.0.3d Binary Template 4 | // 5 | // File: RegistryPolicyFileTemplate.bt 6 | // Author: Blake Frantz (blakefrantz at gmail dot com) 7 | // Revision: 1.0, Last Updated on 6 Mar 2013. 8 | // Purpose: Parse registry.pol files. 9 | // See http://msdn.microsoft.com/en-us/library/windows/desktop/aa374407(v=vs.85).aspx 10 | // 11 | 12 | const DWORD REG_SZ = 1; 13 | const DWORD REG_EXPAND_SZ = 2; 14 | const DWORD REG_BINARY = 3; 15 | const DWORD REG_DWORD = 4; 16 | const DWORD REG_MULTI_SZ = 7; 17 | 18 | typedef struct 19 | { 20 | CHAR LBRACKET[2] ; 21 | wstring Key; 22 | SHORT seperator0 ; 23 | wstring ValueName; 24 | SHORT seperator1 ; 25 | DWORD Type ; 26 | SHORT seperator2 ; 27 | DWORD DataSize; 28 | SHORT seperator3 ; 29 | union { 30 | UBYTE Raw[DataSize]; 31 | DWORD Int; 32 | wstring String; 33 | } Data; 34 | 35 | CHAR RBRACKET[2] ; 36 | 37 | } REGISTRY_RECORD ; 38 | 39 | string DataValueTypeComment( DWORD type ) 40 | { 41 | string comment = ""; 42 | 43 | switch ( type ) 44 | { 45 | case REG_SZ : comment = "REG_SZ"; break; 46 | case REG_EXPAND_SZ: comment = "REG_EXPAND_SZ"; break; 47 | case REG_BINARY : comment = "REG_BINARY"; break; 48 | case REG_DWORD : comment = "REG_DWORD"; break; 49 | case REG_MULTI_SZ : comment = "REG_MULTI_SZ"; break; 50 | default : comment = "UNKNOWN_TYPE"; break; 51 | } 52 | 53 | return comment; 54 | } 55 | 56 | string RegistryRecordComment( REGISTRY_RECORD &record ) 57 | { 58 | string comment; 59 | 60 | uchar tempBuffer[ sizeof(record) ]; 61 | ReadBytes( tempBuffer, startof(record), sizeof(record) ); 62 | 63 | string result; 64 | ChecksumAlgArrayStr( CHECKSUM_CRC32, result, tempBuffer, sizeof(record)); 65 | 66 | if(WStrnicmp(record.ValueName, "**Del.", 6) == 0 ) 67 | { 68 | SPrintf(comment, "ValueName '%s' will be deleted from '%s'. CRC=%s", SubStr(record.ValueName, 6), record.Key, result); 69 | } 70 | else if(WStrnicmp(record.ValueName, "**DeleteValues", 14) == 0 ) 71 | { 72 | SPrintf(comment, "ValueNames '%s' will be deleted from '%s'. CRC=%s", SubStr(record.ValueName, 14), record.Key, result); 73 | } 74 | else if(WStrnicmp(record.ValueName, "**DelVals", 9) == 0 ) 75 | { 76 | SPrintf(comment, "All ValueNames under '%s' will be deleted. CRC=%s", record.Key, result); 77 | } 78 | else if(WStrnicmp(record.ValueName, "**DeleteKeys", 12) == 0 ) 79 | { 80 | SPrintf(comment, "Keys '%s' under '%s' will be deleted. CRC=%s", SubStr(record.ValueName, 12), record.Key, result); 81 | } 82 | else if(WStrnicmp(record.ValueName, "**SecureKey=0", 13) == 0 ) 83 | { 84 | SPrintf(comment, "The DACL on '%s' will be reset to align with the root's DACL. CRC=%s", record.Key, result); 85 | } 86 | else if(WStrnicmp(record.ValueName, "**SecureKey=1", 13) == 0 ) 87 | { 88 | SPrintf(comment, "The DACL on '%s' will be set as follows: Administrators, SYSTEM = Full; Users = Read Only. CRC=%s", record.Key, result); 89 | } 90 | else if(record.Type == REG_DWORD) 91 | { 92 | SPrintf(comment, "%s:%s = (REG_DWORD) %d. CRC=%s", record.Key, record.ValueName, record.Data.Int, result); 93 | } 94 | else if(record.Type == REG_SZ) 95 | { 96 | SPrintf(comment, "%s:%s = (REG_SZ) '%s'. CRC=%s", record.Key, record.ValueName, record.Data.String, result); 97 | } 98 | else if(record.Type == REG_EXPAND_SZ) 99 | { 100 | SPrintf(comment, "%s:%s = (REG_EXPAND_SZ) ... CRC=%s", record.Key, record.ValueName, result); 101 | } 102 | else if(record.Type == REG_BINARY) 103 | { 104 | SPrintf(comment, "%s:%s = (REG_BINARY) ... CRC=%s", record.Key, record.ValueName, result); 105 | } 106 | else if(record.Type == REG_MULTI_SZ) 107 | { 108 | SPrintf(comment, "%s:%s = (REG_MULTI_SZ) ... CRC=%s", record.Key, record.ValueName, result); 109 | } 110 | else 111 | { 112 | SPrintf(comment, "%s:%s (%s)", record.Key, record.ValueName, result); 113 | } 114 | 115 | return comment; 116 | } 117 | 118 | BigEndian(); 119 | 120 | DWORD REGFILE_SIGNATURE; 121 | 122 | LittleEndian(); 123 | 124 | DWORD REGISTRY_FILE_VERSION; 125 | 126 | if (REGFILE_SIGNATURE !=0x50526567 || REGISTRY_FILE_VERSION != 0x01 ) 127 | { 128 | Warning( "File is not Registry Policy File Format Version 1. Template stopped." ); 129 | return -1; 130 | } 131 | 132 | local int records = 0; 133 | 134 | while( !FEof() ) 135 | { 136 | REGISTRY_RECORD record; 137 | records++; 138 | } 139 | 140 | local int i; 141 | 142 | for (i=0; i < records; i++) 143 | { 144 | Printf("%s\\%s\n", record[i].Key, record[i].ValueName); 145 | } -------------------------------------------------------------------------------- /SHPTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.1.3 Binary Template 3 | // 4 | // File: 5 | // Author: 6 | // Revision: 7 | // Purpose: 8 | //-------------------------------------- 9 | typedef struct point_s {double X; double Y;} POINT; 10 | 11 | string GetByteSize(int wordSize) 12 | { 13 | string s; 14 | SPrintf(s, "%d", 2*wordSize); 15 | return s; 16 | } 17 | 18 | struct ESRI_SHAPE { 19 | SetBackColor(cLtGreen); 20 | struct HEADER { 21 | BigEndian(); 22 | int fileCode; 23 | int unused[5]; 24 | int fileLength ; 25 | LittleEndian(); 26 | int version; 27 | enum ShapeEnum { 28 | NullShape, 29 | Point, 30 | PolyLine=3, 31 | Polygon=5, 32 | MultiPoint=5, 33 | PointZ=11, 34 | PolyLineZ=13, 35 | PolygonZ=15} shapeType; 36 | double Xmin; 37 | double Ymin; 38 | double Xmax; 39 | double Ymax; 40 | double Zmin; 41 | double Zmax; 42 | double Mmin; 43 | double Mmax; 44 | } header; 45 | SetBackColor(cLtGray); 46 | struct RECORD { 47 | BigEndian(); 48 | int recordNumber; 49 | int contentLength ; 50 | LittleEndian(); 51 | enum ShapeTypeEnum { 52 | NullShapeType, 53 | PointType, 54 | PolyLineType=3, 55 | PolygonType=5, 56 | MultiPointType=8, 57 | PointZType=11, 58 | PolyLineZType=13, 59 | PolygonZType=15, 60 | MultiPointZType=18, 61 | PointMType=21, 62 | PolyLineMType=23, 63 | PolygonMType=25, 64 | MultiPointMType=28, 65 | MultiPatchType=31} shapeType; 66 | if (shapeType == 1) 67 | { 68 | POINT location; 69 | } 70 | else if (shapeType == 3) 71 | { 72 | double box[4]; 73 | int numParts; 74 | int numPoints; 75 | int parts[numParts]; 76 | POINT points[numPoints]; 77 | } 78 | else if (shapeType == 5) 79 | { 80 | double box[4]; 81 | int numParts; 82 | int numPoints; 83 | int parts[numParts]; 84 | POINT points[numPoints]; 85 | } 86 | } record [10000] ; 87 | } esri_shape; -------------------------------------------------------------------------------- /SHXTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.1.3 Binary Template 3 | // 4 | // File: 5 | // Author: 6 | // Revision: 7 | // Purpose: 8 | //-------------------------------------- 9 | typedef struct point_s {double X; double Y;} POINT; 10 | 11 | string GetByteSize(int wordSize) 12 | { 13 | string s; 14 | SPrintf(s, "%d", 2*wordSize); 15 | return s; 16 | } 17 | 18 | struct ESRI_INDEX { 19 | SetBackColor(cLtGreen); 20 | struct HEADER { 21 | BigEndian(); 22 | int fileCode; 23 | int unused[5]; 24 | int fileLength ; 25 | LittleEndian(); 26 | int version; 27 | enum ShapeEnum { 28 | NullShape, 29 | Point, 30 | PolyLine=3, 31 | Polygon=5, 32 | MultiPoint=5, 33 | PointZ=11, 34 | PolyLineZ=13, 35 | PolygonZ=15} shapeType; 36 | double Xmin; 37 | double Ymin; 38 | double Xmax; 39 | double Ymax; 40 | double Zmin; 41 | double Zmax; 42 | double Mmin; 43 | double Mmax; 44 | } header; 45 | SetBackColor(cLtGray); 46 | struct INDEX_RECORD { 47 | BigEndian(); 48 | int offset ; 49 | int contentLength ; 50 | } record [(FileSize() - 100)/8]; 51 | 52 | } esri_index; -------------------------------------------------------------------------------- /SKB_SecureDataHeader.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0beta1 Binary Template 3 | // 4 | // File: SKB_SecureDataHeader.bt 5 | // Author: Tim Strazzere 6 | // Revision: 0.1 7 | // Purpose: Parse an extracted data structure from an SDK I'm evaluating. 8 | // If you found this, then you are potentially interested in the 9 | // structure and already know what it might be/is for. :) 10 | //-------------------------------------- 11 | 12 | BigEndian(); 13 | 14 | typedef struct { 15 | ubyte control_bytes[4] ; 16 | // Should be an enum 17 | ubyte format_version; 18 | ubyte key_type[4]; 19 | uint key_size; 20 | ubyte key_version[4]; 21 | ubyte export_key_id[16]; 22 | } Header; 23 | 24 | Header header; 25 | ubyte exported_content[FileSize() - sizeof(header)]; -------------------------------------------------------------------------------- /SONYCamFirmwareTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0beta1 Binary Template 3 | // 4 | // File: SONYCamFirmwareTemplate.bt 5 | // Author: Tim Strazzere 6 | // Revision: 0.2 7 | // Purpose: A template for Sony Camera Firmware files. 8 | // 9 | // License: This file is released into the public domain. People may 10 | // use it for any purpose, commercial or otherwise. 11 | //-------------------------------------- 12 | 13 | LittleEndian(); 14 | 15 | // From FirmwareArchive::GetChunkType(uchar *) 16 | typedef enum { 17 | DATV = 0x44415456, // Unknown as of right now 18 | PROV = 0x50524F56, 19 | UDID = 0x55444944, 20 | FDAT = 0x46444154, 21 | DEND = 0x44454E44, // End will follow with CRC 22 | UDIC = 0x55444943 // Unknown what this should even be? 23 | } chunk_type ; 24 | 25 | typedef struct { 26 | // Chunk header 27 | BigEndian(); 28 | uint32 chunk_length; 29 | chunk_type type; 30 | 31 | switch(type) { 32 | case DATV: 33 | char data[4]; 34 | break; 35 | case PROV: 36 | char data[4]; 37 | break; 38 | case UDID: 39 | // This properly gets all the data 40 | // though no idea what it is 41 | uint32 count; 42 | uint64 data[count]; 43 | break; 44 | case FDAT: 45 | // Firmware DATa - encrypted 46 | char data[chunk_length]; 47 | break; 48 | case DEND: 49 | // Data END - CRC32 of everything above this chunk 50 | char crc[4]; 51 | break; 52 | default: 53 | return("Hit unknown chunk type!\n"); 54 | } 55 | } chunk ; 56 | 57 | string ChunkRead(chunk &data) { 58 | switch(data.type) { 59 | case DATV: 60 | return "DATV"; 61 | case PROV: 62 | return "PROV"; 63 | case UDID: 64 | return "UDID"; 65 | case FDAT: 66 | return "FDAT"; 67 | case DEND: 68 | return "DEND"; 69 | case UDIC: 70 | return "UDIC"; 71 | default: 72 | return("UNKNOWN"); 73 | } 74 | } 75 | 76 | struct { 77 | char magic[8] ; 78 | 79 | while(FTell() != FileSize()) { 80 | chunk chunk_data; 81 | } 82 | } firmware_data; -------------------------------------------------------------------------------- /SRecTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0 Binary Template 3 | // 4 | // File: SRecTemplate.bt 5 | // Author: Mario Ghecea 6 | // Revision: 1A 7 | // Purpose: Parses Motorola S-REC 8 | //-------------------------------------- 9 | typedef char RECORDTYPE [2]; 10 | typedef char COUNT [2]; 11 | typedef char ADDRESS16 [4]; 12 | typedef char ADDRESS24 [6]; 13 | typedef char ADDRESS32 [8]; 14 | typedef char CHECKSUM [2]; 15 | 16 | local char hexval [10]; 17 | local uint addrwidth; 18 | local uint rec = 1; 19 | 20 | typedef struct 21 | { 22 | RECORDTYPE recordType; 23 | COUNT count; 24 | switch(recordType) 25 | { 26 | case "S0": // header 27 | case "S1": // 16-bit address record 28 | case "S5": // total record count 29 | case "S9": // termination 16-bit 30 | ADDRESS16 address16; 31 | addrwidth = 4; 32 | break; 33 | case "S2": // 24-bit address record 34 | case "S8": // termination 24-bit 35 | ADDRESS24 address24; 36 | addrwidth = 6; 37 | break; 38 | case "S3": // 32-bit address record 39 | case "S7": // termination 32-bit 40 | ADDRESS32 adress32; 41 | addrwidth = 8; 42 | break; 43 | //case "S4": 44 | //case "S6": 45 | default: 46 | break; 47 | } 48 | 49 | local int i; 50 | local int intval = 0; 51 | local uint pow = 0; 52 | local uint hexlen = 2; 53 | local uint digit = 0; 54 | for (i = 0; i < hexlen; i ++) 55 | { 56 | digit = (count[i] - '0' > 9) ? count[i] - '7' : count[i] - '0'; 57 | intval += ((uint32) digit * (1 << 4 * ((hexlen - 1) - i))); 58 | } 59 | local uint bytesPerLine = (uint32) ((intval - 1) * 2) - addrwidth; 60 | if (bytesPerLine != 0) 61 | char data [(bytesPerLine)]; 62 | //Printf("rec# %d bpl: %d %X count : %s\n\r", rec++, bytesPerLine, intval, count); 63 | char checksum [2]; 64 | char crlf[2]; 65 | }SREC; 66 | 67 | while( !FEof() ) 68 | { 69 | SREC srec; 70 | } -------------------------------------------------------------------------------- /SSPTemplate.bt: -------------------------------------------------------------------------------- 1 | //--------------------------------------------------------------- 2 | //--- 010 Editor v3.2 Binary Template 3 | // 4 | // File: SSPTemplate.bt 5 | // Author: ThangCuAnh (TQN) - HVA 6 | // Revision: 0.1, prototypes 7 | // Date: 2010/10/09 8 | // Purpose: Define a template for parsing SmartSniff Packet file 9 | // References: http://www.nirsoft.net/utils/smsniff.html 10 | //--------------------------------------------------------------- 11 | 12 | typedef BYTE IP_ADDRESS[4] ; 13 | typedef BYTE MAC_ADDRESS[6] ; 14 | 15 | string IP2Str(IP_ADDRESS ip) 16 | { 17 | string strReturn; 18 | 19 | SPrintf(strReturn, "IP: %02d.%02d.%02d.%02d", ip[0], ip[1], ip[2], ip[3]); 20 | return strReturn; 21 | } 22 | 23 | typedef struct { 24 | char signature[8]; // SMSNF200 25 | WORD numberOfBytesInHeader; 26 | IP_ADDRESS IP; 27 | 28 | if ((Strcmp(signature, "SMSNF200") != 0) || (numberOfBytesInHeader != 4)) 29 | { 30 | Warning("Not a valid SmartSniff Packet file"); 31 | return -1; 32 | } 33 | } SSP_HEADER; 34 | 35 | typedef struct { 36 | WORD packetHeaderSize; 37 | if (packetHeaderSize != 0x18) 38 | { 39 | Waring("Invalid packetHeaderSize"); 40 | return -1; 41 | } 42 | DWORD numberOfReceivedBytes; 43 | FILETIME fileTime; 44 | MAC_ADDRESS sourceMAC; 45 | MAC_ADDRESS destMAC; 46 | BYTE packet[numberOfReceivedBytes] ; 47 | } SSP_PACKET; 48 | 49 | string MAC2Str(MAC_ADDRESS mac) 50 | { 51 | string strReturn; 52 | SPrintf(strReturn, "%02X-%02X-%02X-%02X-%02X-%02X", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); 53 | 54 | return strReturn; 55 | } 56 | 57 | // Define the headers 58 | LittleEndian(); 59 | SSP_HEADER header; 60 | 61 | while (!FEof()) 62 | { 63 | SSP_PACKET record; 64 | } 65 | 66 | return 1; 67 | -------------------------------------------------------------------------------- /STLTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.0.5 Binary Template 3 | // 4 | // File: STLTemplate.bt 5 | // Author: ZiZi 6 | // E-mail: zefars@rambler.ru 7 | // Revision: 1.2 8 | // Purpose: Defines a template for 9 | // parsing STL 3D-data files. 10 | //----------------------------------- 11 | 12 | typedef struct { 13 | CHAR Caption[80]; 14 | DWORD trCount; 15 | } STLFILEHEADER ; 16 | 17 | string STLFILEHEADERRead(STLFILEHEADER &x) 18 | { 19 | return x.Caption; 20 | }; 21 | 22 | typedef struct { 23 | FLOAT x; 24 | FLOAT y; 25 | FLOAT z; 26 | } tVector3f ; 27 | string tVector3fRead( tVector3f &v ) { 28 | string s; 29 | SPrintf( s, "(%6.2f %6.2f %6.2f)", v.x, v.y, v.z ); 30 | return s; 31 | }; 32 | 33 | typedef struct { 34 | tVector3f Normal; 35 | tVector3f Point0; 36 | tVector3f Point1; 37 | tVector3f Point2; 38 | WORD Flags ; 39 | } STLTRIANGLE; 40 | 41 | //--------------------------------------------- 42 | 43 | LittleEndian(); 44 | SetBackColor( cLtAqua ); 45 | 46 | local CHAR text_sign[5]; 47 | ReadBytes( text_sign, FTell(), 5); 48 | if (text_sign=="solid") 49 | { 50 | Warning("Is ASCII STL"); 51 | return; 52 | } 53 | STLFILEHEADER stlh; 54 | SetBackColor( cNone ); 55 | local int64 n=(FileSize()-84)/50; 56 | if (stlh.trCount!=n) Warning("File corrupted: stlh.trCount must be equal %Ld", n); 57 | STLTRIANGLE Data[n]; 58 | -------------------------------------------------------------------------------- /SinclairMicrodriveImage.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: SinclairMicrodriveImage.bt 5 | // Author: 6 | // Revision: 1.0 7 | // Purpose: Defines a template for parsing 8 | // images of emulated Sinclair Microdrive 9 | // cartridges. 10 | //----------------------------------- 11 | 12 | struct { 13 | ubyte HDFLAG[1]; // Value 1, to indicate header block *See note. 14 | // char HDNUMB[1]; // sector number (values 254 down to 1) 15 | ubyte HDNUMB[1]; 16 | ubyte UNUSED[2]; // not used (and of undetermined value) 17 | ubyte HDNAME[10]; // microdrive cartridge name (blank padded) 18 | ubyte HDCHK[1]; //header checksum (of first 14 bytes) 19 | 20 | ubyte RECFLG[1]; // - bit 0: always 0 to indicate record block 21 | // - bit 1: set for the EOF block 22 | // - bit 2: reset for a PRINT file 23 | // - bits 3-7: not used (value 0) 24 | 25 | ubyte RECNUM[1]; // data block sequence number (value starts at 0) 26 | ubyte RECLEN[2]; // data block length (<=512, LSB first) 27 | ubyte RECNAM[10]; // filename (blank padded) 28 | ubyte DESCHK[1]; // record descriptor checksum (of previous 14 bytes) 29 | ubyte CHDATA[512]; // data block 30 | ubyte DCHK[1]; // data block checksum (of all 512 bytes of data 31 | // block, even when not all bytes are used) 32 | } MicrodriveSector[254] ; 33 | ubyte WriteProtectionFlag[1]; 34 | -------------------------------------------------------------------------------- /TGATemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.0.2 Binary Template 3 | // 4 | // File: TGATemplate.bt 5 | // Author: Chiuta Adrian Marius 6 | // E-mail: camsoftwarero@yahoo.com 7 | // Revision: 1.0 8 | // Purpose: Shows the fields of a TGA image. 9 | //-------------------------------------- 10 | 11 | //Definim structurile folosite de TGA 12 | typedef struct{ 13 | WORD FirstIndexEntry; 14 | WORD ColorMapLength; 15 | UBYTE ColorMapEntrySize; 16 | }COLORMAPSPECIFICATION; 17 | 18 | typedef struct{ 19 | WORD XOrigin; 20 | WORD YOrigin; 21 | WORD Width; 22 | WORD Height; 23 | UBYTE PixelDepth; 24 | UBYTE ImageDescriptor; 25 | }IMAGESPECIFICATION ; 26 | 27 | typedef struct{ 28 | UBYTE IDLength; 29 | UBYTE ColorMapType; 30 | UBYTE ImageType; 31 | COLORMAPSPECIFICATION CMSpecification; 32 | IMAGESPECIFICATION ISpecification; 33 | }TGAFILEHEADER ; 34 | 35 | typedef struct{ 36 | DWORD B:5; 37 | DWORD G:5; 38 | DWORD R:5; 39 | }RGB555 ; 40 | 41 | typedef struct{ 42 | DWORD B:5; 43 | DWORD G:5; 44 | DWORD R:5; 45 | DWORD X:1; 46 | }XRGB1555 ; 47 | 48 | typedef struct{ 49 | UBYTE B; 50 | UBYTE G; 51 | UBYTE R; 52 | }RGB888 ; 53 | 54 | typedef struct{ 55 | UBYTE B; 56 | UBYTE G; 57 | UBYTE R; 58 | UBYTE A; 59 | }ARGB8888 ; 60 | 61 | string ReadTGAHeader(TGAFILEHEADER &a) 62 | { 63 | switch( a.ImageType ) 64 | { 65 | case 0: 66 | return "No Image Data Included"; 67 | case 1: 68 | return "Uncompressed, Color-mapped Image"; 69 | case 2: 70 | return "Uncompressed, True-color Image"; 71 | case 3: 72 | return "Uncompressed, Black-and-white Image"; 73 | case 9: 74 | return "Run-length encoded, Color-mapped Image"; 75 | case 10: 76 | return "Run-length encoded, True-color Image"; 77 | case 11: 78 | return "Run-length encoded, Black-and-white Image"; 79 | } 80 | } 81 | string ReadImageSpecification(IMAGESPECIFICATION &a) 82 | { 83 | string s; 84 | SPrintf( s, "Res: %dx%d^%d", a.Width, a.Height, a.PixelDepth ); 85 | return s; 86 | } 87 | string ReadRGB555( RGB555 &a ) 88 | { 89 | string s; 90 | SPrintf( s, "B=%03d G=%03d R=%03d", a.B, a.G, a.R ); 91 | return s; 92 | } 93 | string ReadXRGB1555( XRGB1555 &a ) 94 | { 95 | string s; 96 | SPrintf( s, "X=%1d B=%03d G=%03d R=%03d",a.X, a.B, a.G, a.R ); 97 | return s; 98 | } 99 | 100 | string ReadRGB888( RGB888 &a ) 101 | { 102 | string s; 103 | SPrintf( s, "B=%03d G=%03d R=%03d", a.B, a.G, a.R ); 104 | return s; 105 | } 106 | 107 | string ReadARGB8888( ARGB8888 &a ) 108 | { 109 | string s; 110 | SPrintf( s, "A=%03d B=%03d G=%03d R=%03d",a.A, a.B, a.G, a.R ); 111 | return s; 112 | } 113 | 114 | LittleEndian(); 115 | SetBackColor( cLtGray ); 116 | //Definim headerului fisierului TGA 117 | TGAFILEHEADER TGAfh; 118 | 119 | 120 | if( TGAfh.IDLength!=0 )//Definim ID-ul imaginii TGA 121 | UBYTE ImageID[ TGAfh.IDLength ]; 122 | 123 | SetBackColor( cSilver ); 124 | //Definim culorile indexate asociate TGA-ului 125 | if( TGAfh.ColorMapType!=0 ) 126 | switch( TGAfh.CMSpecification.ColorMapEntrySize) 127 | { 128 | case 15: 129 | RGB555 ColorMap[ TGAfh.CMSpecification.ColorMapLength ]; 130 | break; 131 | case 16: 132 | XRGB1555 ColorMap[ TGAfh.CMSpecification.ColorMapLength ]; 133 | break; 134 | case 24: 135 | RGB888 ColorMap[ TGAfh.CMSpecification.ColorMapLength ]; 136 | break; 137 | case 32: 138 | ARGB8888 ColorMap[ TGAfh.CMSpecification.ColorMapLength ]; 139 | break; 140 | } 141 | SetBackColor( cLtAqua ); 142 | struct TGALine { 143 | switch( TGAfh.ISpecification.PixelDepth ) 144 | { 145 | case 8: 146 | UBYTE ColorIndex[TGAfh.ISpecification.Height]; 147 | break; 148 | case 16: 149 | XRGB1555 Pixel[TGAfh.ISpecification.Height]; 150 | break; 151 | case 24: 152 | RGB888 Pixel[TGAfh.ISpecification.Height]; 153 | break; 154 | case 32: 155 | ARGB8888 Pixel[TGAfh.ISpecification.Height]; 156 | break; 157 | } 158 | }TGALines [ TGAfh.ISpecification.Width ] ; 159 | -------------------------------------------------------------------------------- /TOCTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v2.1.4 Binary Template 3 | // 4 | // File: TOCTemplate.bt 5 | // Author: L. Potjewijd 6 | // Revision: 1.22 7 | // Purpose: Eudora 7.1.0.9 mailbox .TOC files 8 | //-------------------------------------- 9 | enum type {In,Out,Junk,Trash,User,IMAP=8}; 10 | enum class {user,system}; 11 | enum stat {unread,read,replied,forwarded,redirected,rebuilt,sendable,queued,sent,unsent,timed,sending,recovered}; 12 | 13 | typedef struct 14 | { char EudoraVersion[8]; // might contain something else, too 15 | char MailboxName[32]; // this name is used in the window title 16 | type MailboxType; 17 | short Unknown0; 18 | class MailboxClass; 19 | struct 20 | { short TopLeftX; // default = 80 21 | short TopLeftY; // default = 80 22 | short BottomRightX; // default = 565 23 | short BottomRightY; // default = 415 24 | } WindowPosition; 25 | // -1 = default size and location. 26 | // For non-maximized and non-minimized windows only, 27 | // relative to the main window upper left corner. 28 | // All values are clipped to main window boundaries 29 | // on next opening, minimum window size is 112*27 (X*Y) 30 | // and takes precedence over clipping. 31 | 32 | struct 33 | { short StatusColumnWidth; // default = 2 34 | short JunkScoreColumnWidth; // default = 4 35 | short PriorityColumnWidth; // default = 2 36 | short AttachmentColumnWidth; // default = 2 37 | short LabelColumnWidth; // default = 8 38 | short WhoColumnWidth; // default = 16 39 | short DateColumnWidth; // default = 16 40 | short SizeColumnWidth; // default = 2 41 | } ColumnWidths; 42 | // Measurement unit is unknown (not pixels); pica's? 43 | // Window size takes precedence over column width. 44 | // The server and mood status columns are always 45 | // displayed with a width of 2 when the window is 46 | // opened, the subject column gets whatever is left. 47 | // -1 means default width. 48 | short Unknown1; 49 | long HighestMsgSeqNumber; 50 | short Unknown2[4]; 51 | short PreviewPaneDivider; 52 | short Unknown3[5]; 53 | long NewMessageOffsetMBXfile; // = FileSize ( .mbx file ) + 1 54 | short Unknown4; 55 | short MessagesInMailbox; // number of active messages in mailbox 56 | } TOChdr; // 104 bytes in total 57 | 58 | typedef struct 59 | { long OffsetMBXfile ; 60 | long Length; 61 | time_t GMTtimestamp; 62 | stat Status; 63 | SetForeColor(cGreen); 64 | ubyte Flags1 :8 ; 65 | // LSB SignatureUsed was: alternate signature 66 | // . obsolete was: signature used 67 | // . WordwrapON 68 | // . TabsInBody 69 | // . KeepCopyOfSentMessage 70 | // . InlineTextAttachment 71 | // . ReturnReceiptTo 72 | // MSB QuotedPrintable 73 | ubyte Flags2 :8 ; 74 | // LSB MIMEencoded 75 | // . UUencoded neither means BINHEX encoded 76 | // . obsolete was: ShowAllHeaders 77 | // . 78 | // . 79 | // . Text/HTML/Enriched 80 | // . ReceiptRequestPending 81 | // MSB Attachments 82 | SetForeColor(cNone); 83 | short Priority; 84 | char LocalDateTime[32]; 85 | char Who[64]; 86 | char Subject[64]; 87 | struct 88 | { short TopLeftX; 89 | short TopLeftY; 90 | short BottomRightX; 91 | short BottomRightY; 92 | } WindowPosition; 93 | 94 | short Label; 95 | long OffsetLMOSfile ; 96 | long MsgSeqNumber; 97 | SetForeColor(cPurple); 98 | ubyte Flags3 :8 ; 99 | // LSB 100 | // . 101 | // . 102 | // . 103 | // . 104 | // . 105 | // . 106 | // MSB looks like 'Return Receipt To:' header flag 107 | ubyte Flags4 :8 ; 108 | // LSB 109 | // . 110 | // . 111 | // . 112 | // . 113 | // . 114 | // . 115 | // MSB 116 | SetForeColor(cNone); 117 | short Unknown[10]; 118 | } TOCmsg; // 218 bytes in total 119 | 120 | //==================================================================== 121 | 122 | LittleEndian(); 123 | TOChdr hdr; 124 | while( !FEof() ) 125 | { TOCmsg msg; 126 | } 127 | -------------------------------------------------------------------------------- /UTMPTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0beta1 Binary Template 3 | // 4 | // File: UTMPTemplate.bt 5 | // Author: Matthew Geiger 6 | // Revision: 0.1 7 | // Purpose: Parsing entries in wtmp and utmp files on *nix hosts 8 | //-------------------------------------- 9 | 10 | #define UT_LINESIZE 32 11 | #define UT_NAMESIZE 32 12 | #define UT_HOSTSIZE 256 13 | 14 | LittleEndian(); 15 | 16 | typedef enum { /* Should be a short(?), but not on Linux systems I have seen */ 17 | EMPTY = 0, /* Record does not contain valid info 18 | (formerly known as UT_UNKNOWN on Linux) */ 19 | RUN_LVL = 1, /* Change in system run-level (see 20 | init(8)) */ 21 | BOOT_TIME = 2, /* Time of system boot (in ut_tv) */ 22 | NEW_TIME = 3, /* Time after system clock change 23 | (in ut_tv) */ 24 | OLD_TIME = 4, /* Time before system clock change 25 | (in ut_tv) */ 26 | INIT_PROCESS = 5, /* Process spawned by init(8) */ 27 | LOGIN_PROCESS = 6, /* Session leader process for user login */ 28 | USER_PROCESS = 7, /* Normal process */ 29 | DEAD_PROCESS = 8, /* Terminated process */ 30 | ACCOUNTING = 9 /* Not implemented */ 31 | } LOGIN_TYPE; 32 | 33 | 34 | struct exit_status 35 | { 36 | short e_termination; /* Process termination status. */ 37 | short e_exit; /* Process exit status. */ 38 | }; 39 | 40 | 41 | struct utmp 42 | { 43 | LOGIN_TYPE ut_type; /* Type of login. */ 44 | int ut_pid; /* Process ID of login process. */ 45 | char ut_line[UT_LINESIZE]; /* Devicename. */ 46 | char ut_id[4]; /* Inittab ID. */ 47 | char ut_user[UT_NAMESIZE]; /* Username. */ 48 | char ut_host[UT_HOSTSIZE]; /* Hostname for remote login. */ 49 | struct exit_status ut_exit; /* Exit status of a process marked 50 | as DEAD_PROCESS. */ 51 | long ut_session; /* Session ID, used for windowing. */ 52 | time_t high_timeval; /* Time entry was made. */ 53 | int low_timeval; 54 | int ut_addr_v6[4]; /* Internet address of remote host. */ 55 | char __unused[20]; /* Reserved for future use. */ 56 | }; 57 | 58 | 59 | FSeek(0); 60 | while( !FEof() ) 61 | { 62 | utmp UTMP_entry; 63 | } -------------------------------------------------------------------------------- /VHDTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v5.0 Binary Template 3 | // 4 | // File: VHD interpretation 5 | // Author: lurker0ster@gmail.com 6 | // Revision: V1.0 7 | // Purpose: Verify what I learn from Microsoft VHD specification. 8 | //-------------------------------------- 9 | 10 | 11 | BigEndian(); 12 | typedef uint64 ULONGLONG; 13 | 14 | enum OS { 15 | OS_WI2R = 0x57693272, 16 | OS_WINDOWS = 0x5769326B, 17 | OS_W2RU = 0x57327275, 18 | OS_W2KU = 0x57326B75, 19 | OS_MACINTOSH = 0x4D616320, 20 | OS_MACX = 0x4D163258, 21 | }; 22 | 23 | enum DISK { 24 | NONE = 0x0, 25 | DEPRECATE = 0x1, 26 | FIXED = 0x2, 27 | DYNAMIC = 0x3, 28 | DIFFERENCING = 0x4, 29 | DEPRECATE1= 0x5, 30 | DEPRECATE2 = 0x6, 31 | }; 32 | 33 | typedef struct{ 34 | char cookie[8]; /* Identifies original creator of the disk */ 35 | DWORD Features ; 36 | DWORD FileformatVersion; 37 | ULONGLONG DataOffset ; 38 | time_t TimeStamp ; //This is the number of seconds since January 1, 2000 12:00:00 AM in UTC/GMT 39 | char CreaterApplication[4]; 40 | DWORD CreaterVersion; 41 | OS CreaterHostOS; 42 | ULONGLONG OrginalSize; 43 | ULONGLONG CurrentSize; 44 | struct { 45 | WORD Cylinder; 46 | BYTE Heads; 47 | BYTE SectorsPerCylinder; 48 | }DiskGeometry; 49 | DISK DiskType; 50 | DWORD CheckSum ; 51 | BYTE UUID[16] ; 52 | BYTE SavedState ; 53 | BYTE hidden; //tapdisk-specific field 54 | BYTE Reserved[426]; 55 | }FOOTER ; 56 | 57 | string statecheck(BYTE SavedState ) 58 | { 59 | if (0x1 == SavedState) return "In saved state"; 60 | return "not saved"; 61 | } 62 | 63 | string feaRead(WORD Features) 64 | { 65 | string s; 66 | if (Features & 0x0001) { s=s+"Temporary, " ;} 67 | if (Features & 0x0002) { s=s+"Reserved, " ;} 68 | return s; 69 | } 70 | 71 | string CorrectTime(time_t TimeStamp) 72 | { 73 | /* VHD uses an epoch of 12:00AM, Jan 1, 2000. */ 74 | /* Need to adjust this to the expected epoch of 1970. */ 75 | return TimeTToString((DWORD)TimeStamp + 946684800); 76 | } 77 | 78 | string OffsetCheck(ULONGLONG DataOffset) 79 | { 80 | if((DataOffset & 0xFFFFFFFF) == 0xFFFFFFFF) 81 | { 82 | return "Fixed disks"; 83 | } 84 | return ""; 85 | } 86 | 87 | typedef struct { 88 | char Cookie[8]; 89 | ULONGLONG DataOffset; //unused 90 | ULONGLONG TableOffset; //pointer to BAT 91 | DWORD HeaderVersion; 92 | DWORD MaxTableEntries; //number of blocks in the disk 93 | DWORD BlockSize ; //does not include the size of block bitmap 94 | DWORD Checksum; 95 | BYTE ParentUUID[16]; //for differencing HD 96 | time_t ParentTimeStamp; 97 | DWORD reserved; 98 | BYTE parentUnicodeName[512]; 99 | typedef struct { 100 | DWORD PlatformCode; 101 | DWORD PlatformDataSpace; 102 | DWORD PlatformDataLength; 103 | DWORD reserved; 104 | ULONGLONG PlatformDataOffset; 105 | }ENTRY; 106 | 107 | ENTRY ParentLocatorEntry[8]; 108 | BYTE reserved1[256]; 109 | }DYNAMICDISKHDEAR ; 110 | 111 | string sizecmt(DWORD blocksize) 112 | { 113 | string s; 114 | SPrintf(s, "block siez:%dMB", blocksize/1024/1024); 115 | return s; 116 | } 117 | 118 | 119 | FOOTER copyOfFooter; 120 | DYNAMICDISKHDEAR DynamicDiskHeader; 121 | FSeek(DynamicDiskHeader.TableOffset); 122 | struct { 123 | DWORD entry[DynamicDiskHeader.MaxTableEntries] ; //1 entry for 4096 sectors (2MB) 124 | }bat ; //Block Allocation table 125 | 126 | string entryCmt(DWORD entry) 127 | { 128 | if (0xFFFFFFFF == entry) return "Unused"; 129 | return ""; 130 | } 131 | 132 | 133 | typedef struct { 134 | char magic[8]; //"tdbatmap" 135 | ULONGLONG batmap_offset; 136 | DWORD batmap_size; 137 | DWORD batmap_version; 138 | DWORD Checksum; 139 | }TDBATMAP; 140 | 141 | char magic[8]; 142 | 143 | if (Memcmp(magic, "tdbatmap", 8) == 0) 144 | { 145 | TDBATMAP batmap; 146 | }else{ 147 | FSkip(-8); 148 | } 149 | 150 | 151 | local int index = 0; 152 | local int BytesInSector = 512; 153 | 154 | local int SectorsPerBlock = DynamicDiskHeader.BlockSize / BytesInSector; 155 | local int BitmapBytes = SectorsPerBlock / 8; 156 | //local int ResetBytes = DynamicDiskHeader.BlockSize - BitmapBytes; 157 | 158 | //local int numsOfBlockAllocated = (FileSize()-512 - FTell() ) / (DynamicDiskHeader.BlockSize+BitmapBytes); 159 | typedef struct { 160 | BYTE bitmap[BitmapBytes]; //each bit represent a sector. 1: used, 0: full0s. 161 | BYTE data[DynamicDiskHeader.BlockSize]; 162 | }DATABLOCK; 163 | 164 | //DATABLOCK block[numsOfBlockAllocated]; 165 | 166 | do{ 167 | 168 | if (bat.entry[index] != 0xFFFFFFFF) { 169 | Printf("Block[%d] -> VHD sector:0x%x", index, bat.entry[index]); 170 | Printf(" VHD offset:0x%x\n", bat.entry[index]*512); 171 | FSeek(bat.entry[index]*512); 172 | DATABLOCK data; 173 | }else{ 174 | //Printf("Block[%d] sparse\n", index); 175 | } 176 | index ++; 177 | }while(index < DynamicDiskHeader.MaxTableEntries); 178 | 179 | 180 | FSeek(FileSize()-512); 181 | FOOTER Footer; 182 | 183 | //for demo only 184 | //offset is sector offset 185 | string readData( uint64 offset) 186 | { 187 | local uint64 BlockIndex = offset/SectorsPerBlock; 188 | local uint64 sectorIndex = offset%SectorsPerBlock; 189 | 190 | local uint64 byteoffset = offset/8; 191 | local uint64 bitfield = offset%8; 192 | if(bitfield & data[BlockIndex].bitmap[byteoffset]) { 193 | //spare 194 | Printf("Zeros sector"); 195 | } 196 | 197 | } -------------------------------------------------------------------------------- /VirtualBoxKeystore.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v6.0.2 Binary Template 3 | // 4 | // File: VBOXDIEKeyStore.bt 5 | // Author: Daniel Correa 6 | // URL: http://www.sinfocol.org/ 7 | // Revision: 1.0 8 | // Purpose: Template for VirtualBox Disk Image Encryption KeyStore 9 | //-------------------------------------- 10 | typedef struct vbox_die_keystore { 11 | int header ; 12 | if (header != 0x454E4353) { 13 | SetBackColor(0x0000ff); 14 | Warning("File is not a valid VBOX DIE KeyStore. Bad signature."); 15 | return -1; 16 | } 17 | uint16 version ; 18 | char algorithm[32] ; 19 | char kdf[32] ; 20 | int generic_key_length ; 21 | char final_hash[32] ; 22 | int pbkdf2_2_key_length ; 23 | char pbkdf2_2_salt[32] ; 24 | int pbkdf2_2_iterations ; 25 | char pbkdf2_1_salt[32] ; 26 | int pbkdf2_1_iterations ; 27 | int evp_decrypt_input_length ; 28 | char pbkdf2_2_encrypted_password[64] ; 29 | }; 30 | FSeek(0); 31 | LittleEndian(); 32 | vbox_die_keystore VBOXDIE; -------------------------------------------------------------------------------- /WAVTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: WAVTemplate.bt 5 | // Author: SweetScape Software 6 | // Revision: 1.0 7 | // Purpose: Defines a template for 8 | // parsing WAV audio files. 9 | //----------------------------------- 10 | 11 | // Typedefs for the wave file 12 | typedef char ID[4]; 13 | 14 | // Record whether we have found a format chunk yet 15 | local int haveValidFormat = false; 16 | 17 | //----------------------------------- 18 | // Define structures used in WAV files 19 | 20 | // Stores the file header information 21 | typedef struct 22 | { 23 | ID groupID; 24 | long size; 25 | ID riffType; 26 | } WAVRIFFHEADER; 27 | 28 | // Stores the format information for the file 29 | typedef struct { 30 | ID chunkID; 31 | long chunkSize; 32 | local int pos = FTell(); 33 | short wFormatTag; 34 | unsigned short wChannels; 35 | unsigned long dwSamplesPerSec; 36 | unsigned long dwAvgBytesPerSec; 37 | unsigned short wBlockAlign; 38 | unsigned short wBitsPerSample; 39 | 40 | // Mark that we have found a valid format chunk 41 | haveValidFormat = true; 42 | 43 | // Unknown data at the end of the chunk 44 | if( chunkSize > (FTell() - pos) ) 45 | uchar unknown[ chunkSize - (FTell() - pos) ]; 46 | 47 | // Padding so the next chunk starts on an even byte 48 | if( chunkSize & 1 ) 49 | uchar padding; 50 | } FORMATCHUNK; 51 | 52 | // Stores the actual wave data 53 | typedef struct 54 | { 55 | ID chunkID; 56 | long chunkSize; 57 | 58 | // Test if we have a valid format 59 | if( !haveValidFormat ) 60 | { 61 | Warning( "File contains no valid WAVE format chunk." ); 62 | return -1; 63 | } 64 | 65 | // Parse the samples of the data 66 | if( ((format.wBitsPerSample != 8) && (format.wBitsPerSample != 16) && (format.wBitsPerSample != 32)) 67 | || (chunkSize % (int)format.wBlockAlign != 0) ) 68 | { 69 | // Unsupported storage method used 70 | unsigned char waveformData[chunkSize]; 71 | } 72 | else if( (format.wChannels == 1) && (format.wBitsPerSample == 8) ) 73 | { 74 | // Define an array of 8-bit samples - common case 75 | uchar samples[ chunkSize ]; 76 | } 77 | else if( (format.wChannels == 1) && (format.wBitsPerSample == 16) ) 78 | { 79 | // Define an array of 16-bit samples - common case 80 | short samples[ chunkSize/2 ]; 81 | } 82 | else if( (format.wChannels == 1) && (format.wBitsPerSample == 32) ) 83 | { 84 | // Define an array of 32-bit samples - common case 85 | int samples[ chunkSize/4 ]; 86 | } 87 | else 88 | { 89 | // Define general case sample 90 | struct SAMPLES { 91 | if( format.wBitsPerSample == 8 ) 92 | uchar channels[ format.wChannels ]; 93 | else if( format.wBitsPerSample == 16 ) 94 | short channels[ format.wChannels ]; 95 | else if( format.wBitsPerSample == 32 ) 96 | int channels[ format.wChannels ]; 97 | } samples[ chunkSize / (int)format.wBlockAlign ]; 98 | } 99 | 100 | // Padding so the next chunk starts on an even byte 101 | if( (chunkSize & 1) && (FTell() < FileSize()) ) 102 | uchar padding; 103 | } DATACHUNK; 104 | 105 | // Stores the size of the wave after decompression 106 | typedef struct 107 | { 108 | ID chunkID; 109 | long chunkSize; 110 | unsigned long uncompressedSize; 111 | } FACTCHUNK; 112 | 113 | // Stores a list of cue points or markers to points in the data 114 | typedef struct { 115 | long dwIdentifier; 116 | long dwPosition; 117 | ID fccChunk; 118 | long dwChunkStart; 119 | long dwBlockStart; 120 | long dwSampleOffset; 121 | } CUEPOINT; 122 | 123 | typedef struct { 124 | ID chunkID; 125 | long chunkSize; 126 | local int pos = FTell(); 127 | long dwCuePoints; 128 | CUEPOINT points[dwCuePoints]; 129 | 130 | // Unknown data at the end of the chunk 131 | if( chunkSize > (FTell() - pos) ) 132 | uchar unknown[ chunkSize - (FTell() - pos) ]; 133 | } CUECHUNK; 134 | 135 | // Define a list chunk with a set of subchunks 136 | typedef struct { 137 | ID chunkID; 138 | long chunkSize; 139 | char listData[chunkSize]; 140 | 141 | // Padding so the next chunk starts on an even byte 142 | if( (chunkSize & 1) && (FTell() < FileSize()) ) 143 | uchar padding; 144 | } LISTSUBCHUNK; 145 | 146 | typedef struct { 147 | ID chunkID; 148 | long chunkSize; 149 | local quad pos = FTell(); 150 | ID chunkType; 151 | 152 | // Read the subchunks 153 | while( FTell() - pos < chunkSize ) 154 | LISTSUBCHUNK subchunk; 155 | 156 | // Padding so the next chunk starts on an even byte 157 | if( (chunkSize & 1) && (FTell() < FileSize()) ) 158 | uchar padding; 159 | } LISTCHUNK; 160 | 161 | // A chunk which could not be identified 162 | typedef struct { 163 | ID chunkID; 164 | long chunkSize; 165 | uchar unknownData[chunkSize]; 166 | 167 | // Padding so the next chunk starts on an even byte 168 | if( (chunkSize & 1) && (FTell() < FileSize()) ) 169 | uchar padding; 170 | } UNKNOWNCHUNK; 171 | 172 | //--------------------------------------------- 173 | 174 | // Define the headers 175 | LittleEndian(); 176 | SetBackColor( cLtPurple ); 177 | WAVRIFFHEADER header; 178 | 179 | // Check for valid header 180 | if( header.groupID != "RIFF" || header.riffType != "WAVE" ) 181 | { 182 | Warning( "File is not a valid wave file. Template stopped." ); 183 | return -1; 184 | } 185 | 186 | // Read the file as a set of chunks 187 | local char tag[5]; 188 | local uint size; 189 | while( !FEof() ) 190 | { 191 | // Read the chunk tag 192 | ReadBytes( tag, FTell(), 4 ); 193 | tag[4] = 0; 194 | 195 | // See which chunk this is 196 | switch( tag ) 197 | { 198 | case "fmt ": 199 | SetBackColor( cLtGray ); 200 | FORMATCHUNK format; 201 | break; 202 | case "data": 203 | SetBackColor( cNone ); 204 | DATACHUNK data; 205 | break; 206 | case "fact": 207 | SetBackColor( cLtBlue ); 208 | FACTCHUNK fact; 209 | break; 210 | case "cue ": 211 | SetBackColor( cLtGray ); 212 | CUECHUNK cue; 213 | break; 214 | case "LIST": 215 | SetBackColor( cLtYellow ); 216 | LISTCHUNK list; 217 | break; 218 | default: 219 | // Unknown chunk 220 | size = ReadUInt( FTell()+4 ); 221 | Printf( "Encountered unknown chunk '%s' of size %d at position %Ld.\n", 222 | tag, size, FTell() ); 223 | SetBackColor( cNone ); 224 | UNKNOWNCHUNK unknown; 225 | break; 226 | } 227 | } 228 | 229 | 230 | 231 | 232 | -------------------------------------------------------------------------------- /WinhexPosTemplate.bt: -------------------------------------------------------------------------------- 1 | //-------------------------------------- 2 | //--- 010 Editor v3.2.2f Binary Template 3 | // 4 | // File: WinhexPosTemplate 5 | // Author: Artur Babecki 6 | // Revision: 21.02.2012 7 | // Purpose: the WinHex (editor by X-Ways Software Technology AG ) 8 | // stores the find results in the winhex.pos file. 9 | // This template parses its structure and allows to 10 | // build the script to convert WinHex results into set 11 | // of bookmarks of 010Editor 12 | //-------------------------------------- 13 | string Wh_WinhexID ; 14 | uint32 Wh_Flags ; 15 | uint32 Wh_n_ch ; 16 | struct chunk { 17 | uint16 Chsize ; 18 | uint16 Chflags ; 19 | uint64 Offset; 20 | uint64 Time; 21 | FILETIME date; 22 | uchar RGB[3]; 23 | uchar Padding; 24 | uint16 DescrLen; 25 | string Descr; 26 | if(Chflags&0x100) { 27 | uint64 Relative_Offset; 28 | uint64 FileId; 29 | uint16 PathLen; 30 | string Path; 31 | } 32 | //Printf("%X\n",chflags); 33 | } wh_pos[Wh_n_ch] ; 34 | -------------------------------------------------------------------------------- /ZIPTemplate.bt: -------------------------------------------------------------------------------- 1 | //----------------------------------- 2 | //--- 010 Editor v2.0 Binary Template 3 | // 4 | // File: ZIPTemplate.bt 5 | // Author: SweetScape Software 6 | // Revision: 2.2 7 | // Purpose: Defines a template for 8 | // parsing ZIP files. 9 | // Changes: 10 | // 2.1 (SweetScape): 11 | // - Added write function for ZIPFILERECORD structure. 12 | // 2.2 (S.Gibson, KPMG LLP): 13 | // - Fix for entry comment field 14 | // - Fix for parsing data descriptors 15 | //----------------------------------- 16 | 17 | // Define structures used in ZIP files 18 | 19 | //enum used for compression format 20 | typedef enum { 21 | COMP_STORED = 0, 22 | COMP_SHRUNK = 1, 23 | COMP_REDUCED1 = 2, 24 | COMP_REDUCED2 = 3, 25 | COMP_REDUCED3 = 4, 26 | COMP_REDUCED4 = 5, 27 | COMP_IMPLODED = 6, 28 | COMP_TOKEN = 7, 29 | COMP_DEFLATE = 8, 30 | COMP_DEFLATE64 = 9 31 | } COMPTYPE; 32 | 33 | // Defines a file record 34 | typedef struct { 35 | // Header for the file 36 | char frSignature[4]; //0x04034b50 37 | ushort frVersion; 38 | ushort frFlags; 39 | COMPTYPE frCompression; 40 | DOSTIME frFileTime; 41 | DOSDATE frFileDate; 42 | uint frCrc ; 43 | uint frCompressedSize; 44 | uint frUncompressedSize; 45 | ushort frFileNameLength; 46 | ushort frExtraFieldLength; 47 | if( frFileNameLength > 0 ) 48 | char frFileName[ frFileNameLength ]; 49 | if( frExtraFieldLength > 0 ) 50 | uchar frExtraField[ frExtraFieldLength ]; 51 | 52 | // Compressed data 53 | SetBackColor( cNone ); 54 | if( frCompressedSize > 0 ) 55 | uchar frData[ frCompressedSize ]; 56 | 57 | } ZIPFILERECORD ; 58 | 59 | // Defines an entry in the directory table 60 | typedef struct { 61 | char deSignature[4]; //0x02014b50 62 | ushort deVersionMadeBy; 63 | ushort deVersionToExtract; 64 | ushort deFlags; 65 | COMPTYPE deCompression; 66 | DOSTIME deFileTime; 67 | DOSDATE deFileDate; 68 | uint deCrc ; 69 | uint deCompressedSize; 70 | uint deUncompressedSize; 71 | ushort deFileNameLength; 72 | ushort deExtraFieldLength; 73 | ushort deFileCommentLength; 74 | ushort deDiskNumberStart; 75 | ushort deInternalAttributes; 76 | uint deExternalAttributes; 77 | uint deHeaderOffset; 78 | if( deFileNameLength > 0 ) 79 | char deFileName[ deFileNameLength ]; 80 | if( deExtraFieldLength > 0 ) 81 | uchar deExtraField[ deExtraFieldLength ]; 82 | if( deFileCommentLength > 0 ) 83 | uchar deFileComment[ deFileCommentLength ]; 84 | } ZIPDIRENTRY ; 85 | 86 | // Defines the digital signature 87 | typedef struct { 88 | char dsSignature[4]; //0x05054b50 89 | ushort dsDataLength; 90 | if( dsDataLength > 0 ) 91 | uchar dsData[ dsDataLength ]; 92 | } ZIPDIGITALSIG; 93 | 94 | // Defintes the Data descriptor 95 | typedef struct { 96 | char ddSignature[4]; //0x08074b50 97 | uint ddCRC ; 98 | uint ddCompressedSize; 99 | uint ddUncompressedSize; 100 | } ZIPDATADESCR; 101 | 102 | // Defines the end of central directory locator 103 | typedef struct { 104 | char elSignature[4]; //0x06054b50 105 | ushort elDiskNumber; 106 | ushort elStartDiskNumber; 107 | ushort elEntriesOnDisk; 108 | ushort elEntriesInDirectory; 109 | uint elDirectorySize; 110 | uint elDirectoryOffset; 111 | ushort elCommentLength; 112 | if( elCommentLength > 0 ) 113 | char elComment[ elCommentLength ]; 114 | } ZIPENDLOCATOR; 115 | 116 | //-------------------------------------------- 117 | 118 | // Custom read functions that allows the name of the 119 | // of the file to appear in the Template Results. 120 | 121 | string ReadZIPFILERECORD( ZIPFILERECORD &file ) 122 | { 123 | if( exists( file.frFileName ) ) 124 | return file.frFileName; 125 | else 126 | return ""; 127 | } 128 | 129 | string ReadZIPDIRENTRY( ZIPDIRENTRY &entry ) 130 | { 131 | if( exists( entry.deFileName ) ) 132 | return entry.deFileName; 133 | else 134 | return ""; 135 | } 136 | 137 | // Custom write function that allows changing 138 | // the name of the file - note that the file 139 | // name size cannot be increased 140 | 141 | void WriteZIPFILERECORD( ZIPFILERECORD &file, string s ) 142 | { 143 | local int len = Strlen( s ); 144 | if( exists( file.frFileName ) ) 145 | { 146 | Strncpy( file.frFileName, s, file.frFileNameLength ); 147 | if( len < file.frFileNameLength ) 148 | file.frFileName[len] = 0; //null terminate 149 | } 150 | } 151 | 152 | //-------------------------------------------- 153 | 154 | // Define the file 155 | local uint tag; 156 | LittleEndian(); 157 | while( !FEof() ) 158 | { 159 | // Read a tag 160 | tag = ReadUInt( FTell() ); 161 | 162 | // Read data depending upon tag - should start with 'PK'. 163 | // Note that when duplicate variables are defined, they 164 | // are made into an array (see 'Using Templates and Structs' 165 | // in the help file). 166 | if( tag == 0x04034b50 ) 167 | { 168 | SetBackColor( cLtGray ); 169 | ZIPFILERECORD record; 170 | } 171 | else if( tag == 0x08074b50 ) 172 | { 173 | SetBackColor( cLtGreen ); 174 | ZIPDATADESCR dataDescr; 175 | } 176 | else if( tag == 0x02014b50 ) 177 | { 178 | SetBackColor( cLtPurple ); 179 | ZIPDIRENTRY dirEntry; 180 | } 181 | else if( tag == 0x05054b50 ) 182 | { 183 | SetBackColor( cLtBlue ); 184 | ZIPDIGITALSIG digitalSig; 185 | } 186 | else if( tag == 0x06054b50 ) 187 | { 188 | SetBackColor( cLtYellow ); 189 | ZIPENDLOCATOR endLocator; 190 | } 191 | else 192 | { 193 | Warning( "Unknown ZIP tag encountered. Template stopped." ); 194 | return -1; 195 | } 196 | } --------------------------------------------------------------------------------