Skip to content

Instantly share code, notes, and snippets.

@InvoxiPlayGames
Created February 18, 2025 12:16
Show Gist options
  • Save InvoxiPlayGames/60f472d5abdbe2a335950017061b65e4 to your computer and use it in GitHub Desktop.
Save InvoxiPlayGames/60f472d5abdbe2a335950017061b65e4 to your computer and use it in GitHub Desktop.
ImHex pattern for the SPPSVC "Physical Store" files used in Windows 7
#include <std/mem.pat>
u8 hmac_key[0x10] @ 0x0;
u8 hmac_sha[0x14] @ 0x10;
enum blocktype : u32 {
None = 0,
Named = 1,
Attribute = 2,
Timer = 3,
};
struct ps_w7_block {
blocktype type;
u32 flags;
u32 keyLen; // byte length of key
u32 valueLen; // byte length of value
u32 dataLen;
char16 key[keyLen / 2]; // /2 because utf16
char16 value[valueLen / 2]; // /2 because utf16
u8 data[dataLen];
// padded to 0x4 byte boundaries, this kinda sucks but it works
u8 pad[while($ % 4 > 0)];
};
struct physical_store_win7 {
u8 unk_pre_header_bytes[0x8];
ps_w7_block blocks[while(!std::mem::eof())];
};
physical_store_win7 store @ 0x28;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment