Created
February 18, 2025 12:16
-
-
Save InvoxiPlayGames/60f472d5abdbe2a335950017061b65e4 to your computer and use it in GitHub Desktop.
ImHex pattern for the SPPSVC "Physical Store" files used in Windows 7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <std/mem.pat> | |
u8 hmac_key[0x10] @ 0x0; | |
u8 hmac_sha[0x14] @ 0x10; | |
enum blocktype : u32 { | |
None = 0, | |
Named = 1, | |
Attribute = 2, | |
Timer = 3, | |
}; | |
struct ps_w7_block { | |
blocktype type; | |
u32 flags; | |
u32 keyLen; // byte length of key | |
u32 valueLen; // byte length of value | |
u32 dataLen; | |
char16 key[keyLen / 2]; // /2 because utf16 | |
char16 value[valueLen / 2]; // /2 because utf16 | |
u8 data[dataLen]; | |
// padded to 0x4 byte boundaries, this kinda sucks but it works | |
u8 pad[while($ % 4 > 0)]; | |
}; | |
struct physical_store_win7 { | |
u8 unk_pre_header_bytes[0x8]; | |
ps_w7_block blocks[while(!std::mem::eof())]; | |
}; | |
physical_store_win7 store @ 0x28; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment