| Author | Message | ||
     James Morris Username: jmorr Registered: N/A |
I have just found out about the template features of X-Ways and require some help in getting a structure for Vista Thumbnails. The following is the structure used for 010 Hex Editor - typedef struct { CHAR magic[4]; DWORD sizeHeaderAndData; UQUAD secret<format=hex>; CHAR ext[8]; DWORD huh1; DWORD type; DWORD size; DWORD unk6; DWORD unk1; DWORD unk2; DWORD unk3; DWORD unk4; CHAR name[32]; if( sizeHeaderAndData - size > 88 ) CHAR padding[ sizeHeaderAndData - size - 88 ]; if( size > 0 ) CHAR data[ size ]; } CMMM; typedef struct { CHAR magic[4]; DWORD unk1; DWORD unk2; DWORD headerSize; DWORD offsetLastEntry; DWORD entryCount; } CMMMH; CMMMH header; local int start; local int x; for( x = 0; x < header.entryCount; x++ ) { start = FTell(); CMMM c; FSeek( start + c.sizeHeaderAndData ); } Can this be translated into the X-Ways Template format? The structure for the thumbcache_(96,32,256,1024).db is - typedef struct { UQUAD secret<format=hex>; FILETIME lastModified; UINT unk2; UINT offset32<format=hex>; UINT offset96<format=hex>; UINT offset256<format=hex>; UINT offset1024<format=hex>; UINT offsetsr<format=hex>; } IMMM; typedef struct { CHAR magic[4]; DWORD unk1; DWORD unk2; DWORD headerSize; DWORD unk3; DWORD unk4; } IMMMH; IMMMH header; //FSeek(184); IMMM b[ header.unk3 ]; Thanks, James | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
Two sample templates for Vista thumbcaches: template "thumbcache_idx" // Template by Alfons Kramer // X-Ways Software Technology AG description "To be applied to records in thumbcache_idx.db" applies_to disk requires 0x0 "49 4D 4D 4D" begin char[4] Magic uint32 unk1 uint32 unk2 uint32 headerSize uint32 entryCount uint32 unk4 { endsection hex 8 secret FileTime lastModified uint32 unk5 hexadecimal uint32 offset32 hexadecimal uint32 offset96 hexadecimal uint32 offset256 hexadecimal uint32 offset1024 hexadecimal uint32 offsetsr }[20] // [entryCount] end template "thumbcache_XXX" // Template by Alfons Kramer // X-Ways Software Technology AG description "To be applied to records in thumbcache_XX.db" applies_to disk multiple requires 0x0 "43 4D 4D 4D" begin char[4] "Magic: CMMM" uint32 sizeHeaderAndData hex 8 secret char16[4] ext // Unicode - sometimes .txt, .jpg, etc uint32 huh1 uint32 type // 0 or 1? uint32 Size uint32 unk1 move 16 char16[16] name IfGreater sizeHeaderAndData 88 move (sizeHeaderAndData-88) EndIf end | ||
| James Morris Username: jmorr Registered: N/A |
Alfons, Thankyou for the templates !! They will make it a breeze to make sense of the thumbnail files in Vista. With the thumbcache_idx template for 010 Hex editor there is a function to read to header and the records of the thumbcache_idx file. Can X-ways have such a script structure to read all the records? I would like to include some of the fields into a report on certain thumbnail files. Especially the timedate field from the record as this is crucial for presenting these files in a report table. Thanks, James Morris | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
You can write a script to read data and output it to a file, yes. |