mirror of
https://github.com/WerWolv/ImHex-Patterns.git
synced 2026-03-28 07:47:02 -05:00
c533017d0b
* repo-wide: trim trailing spaces Note: This doesn't touch the .tbl files in encodings/ since they include meaningful trailing spaces (`20= `) * patterns: clean up duplicate semicolons * ELF: add header magic check * glTF: use type::Magic for magic value * glTF: check that the file size in the header matches * xgstexture: fix generics syntax for magic value * JPEG: define hex enum with 0x00 instead of 0X00 * CI: update deprecated actions --------- Co-authored-by: Nik <werwolv98@gmail.com>
82 lines
2.0 KiB
Rust
82 lines
2.0 KiB
Rust
#pragma author sethhall
|
|
#pragma description Windows Notepad Cache Files
|
|
|
|
// This was written based on the following blog post:
|
|
// https://u0041.co/posts/articals/exploring-windows-artifacts-notepad-files/
|
|
|
|
import type.leb128;
|
|
import type.time;
|
|
import type.magic;
|
|
import std.time;
|
|
|
|
using uLEB128 = type::uLEB128;
|
|
|
|
enum Encodings: u8 {
|
|
ANSI = 0x01,
|
|
UTF_16LE = 0x02,
|
|
UTF_16BE = 0x03,
|
|
UTF_8BOM = 0x04,
|
|
UTF_8 = 0x05,
|
|
};
|
|
|
|
enum LineEndings: u8 {
|
|
CRLF = 0x01,
|
|
CR = 0x02,
|
|
LF = 0x03,
|
|
};
|
|
|
|
struct ConfigBlock {
|
|
bool word_wrap;
|
|
bool rtl;
|
|
bool show_unicode;
|
|
uLEB128 version;
|
|
u16 unknown;
|
|
};
|
|
|
|
struct UnsavedChunk {
|
|
uLEB128 cursor_position;
|
|
uLEB128 deletion_number;
|
|
uLEB128 addition_number;
|
|
char16 chars[addition_number];
|
|
char crc32[4] [[format("hash_format"), comment("CRC32 hash of the entire unsaved chunk structure")]];
|
|
};
|
|
|
|
struct Notepad_File {
|
|
type::Magic<"NP\0"> signature [[comment("File signature")]];
|
|
bool is_saved;
|
|
if ( is_saved ) {
|
|
uLEB128 path_length;
|
|
char16 path[path_length] [[comment("Path of saved file on disk")]];
|
|
uLEB128 file_size;
|
|
Encodings encoding;
|
|
LineEndings line_endings;
|
|
uLEB128 last_write [[format("format_filetime")]];
|
|
char sha256[32] [[format("hash_format")]];
|
|
u8 unknown1;
|
|
}
|
|
u8 unknown2;
|
|
uLEB128 selection_start;
|
|
uLEB128 selection_end;
|
|
ConfigBlock config_block;
|
|
type::uLEB128 content_length;
|
|
char16 content[content_length];
|
|
bool contain_unsaved_data;
|
|
char crc32[4] [[format("hash_format")]];
|
|
UnsavedChunk unsaved_chunks[while(!std::mem::eof())];
|
|
};
|
|
|
|
fn hash_format(auto bytes) {
|
|
str hash_hex;
|
|
for(u8 i=0, i < sizeof(bytes), i+=1) {
|
|
hash_hex = hash_hex + std::format("{:02X}",bytes[i]);
|
|
}
|
|
return hash_hex;
|
|
};
|
|
|
|
fn format_filetime(uLEB128 data) {
|
|
// We will only support dates back to the epoch
|
|
std::time::Time time64 = std::time::to_utc((data / 10000000.0) - 11644473600.0);
|
|
return std::time::format(time64, "%c");
|
|
};
|
|
|
|
Notepad_File file @ $; |