|
|
|
@ -10,7 +10,10 @@ from .mft import MFTRecord |
|
|
|
|
|
|
|
|
|
class IDPacket(Struct): |
|
|
|
|
magic = Sig(b'\x0E') |
|
|
|
|
unk1 = Sig(bytes([1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])) |
|
|
|
|
type = UInt(16) |
|
|
|
|
unk3 = Data(4) |
|
|
|
|
id = UInt(32) |
|
|
|
|
unk4 = Data(4) |
|
|
|
|
footer = Sig(b'\x0F') |
|
|
|
|
|
|
|
|
|
class BufferPacket(Struct, generics=['D']): |
|
|
|
@ -29,17 +32,9 @@ class BufferChecksumPacket(Struct): |
|
|
|
|
unk5 = Sig(bytes([0, 0, 0, 0])) |
|
|
|
|
footer = Sig(b'\x0B') |
|
|
|
|
|
|
|
|
|
class MFTPacket(Struct): |
|
|
|
|
magic = Sig(b'\x0E') |
|
|
|
|
type = UInt(16) |
|
|
|
|
unk3 = Data(4) |
|
|
|
|
id = UInt(32) |
|
|
|
|
unk4 = Data(4) |
|
|
|
|
footer = Sig(b'\x0F') |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class NTFSIndex(Struct): |
|
|
|
|
header = MFTPacket |
|
|
|
|
header = IDPacket |
|
|
|
|
b = Data(10) |
|
|
|
|
data = MFTRecord # NTFSPropertyTag.SMftRecordSize |
|
|
|
|
|
|
|
|
|