LDMWinHex模板格式讲解

I write the template set：LDM WinHex 模板

template "LDM Private Header"

description "MyEdit Private Header"

appies_to disk

sector-aligned

big-endian

requires 0x00 "50 52 49 56 48 45 41 44"

begin

{

char[8] "Private Single"

hex 4 "校验和，本扇区所有字节之和"

uint16 "主版本号"

uint16 "次版本号"

hex 4 "未知"

hex 4 "更新时间"

hex 4 "总为零"

uint32 "更新序列号"

int64 "私有头第一备份地址"

int64 "私有头第二备份地址"

char[64] "磁盘IDGUID"

char[64] "主机ID"

char[64] "磁盘组ID"

char[32] "磁盘组名"

hex 2 "未知"

hex 9 "总为0"

int64 "逻辑磁盘起始地址"

int64 "逻辑磁盘大小（扇区数）"

int64 "LDM 数据库的起始地址(扇区)"

int64 "LDM数据库的大小（扇区数）"

int64 "TOC 数量"

int64 "TOC 大小"

uint32 "配置信息数量"

uint32 "日志数量"

int64 "配置信息大小"

int64 "日志大小"

hex 4 "磁盘签名"

hex 16 "磁盘集GUID"

}

end

template "LDM VMDB"

description "MyLDM VMDB 磁盘配置信息"

appies_to disk

big-endian

sector-aligned

requires 0x00 "56 4D 44 42"

begin

{

hex 4 "固定single VMDB"

uint32 "VBLK 的个数"

uint32 "VBLK 的大小"

uint32 "VMDB 头大小"

hex 2 "更新状态"

uint16 "主版本号"

uint16 "次版本号"

char[31] "磁盘组名"

char[64] "磁盘组ID"

int64 "提交序列号"

int64 "未决序列号"

uint32 "卷提交VBLKs数量"

uint32 "组件提交VBLKs数量"

uint32 "分区提交的VBLKs数量"

uint32 "磁盘提交的VBLKs数量"

hex 4 "未使用"

uint32 "卷未决VBLKs数量"

uint32 "组件未决VBLKs数量"

uint32 "分区未决VBLKs 数量"

uint32 "磁盘未决VBLKs 数量"

hex 4 "未使用"

FileTime "最后访问时间"

}

end

template "LDM-TOCblock DirectoryTable"

description "MyEditTOCBLOCK"

appies_to disk

big-endian

multiple

requires 00 "54 4F 43 42 4C 4F 43 4B"

begin

{

section "TOCBLOCK #1"

char[8] "fixe Single"

uint32 "序列号1"

hex 4 "总为零"

uint32 "序列号2"

hex 16 "总为零"

char[8] "位图名1"

hex 2 "位图标识1"

int64 "位图1起始地址"

int64 "位图1大小"

hex 8 "位图标识1"

char[8] "为图名2"

hex 2 "位图标识2"

int64 "位图2起始地址"

int64 "位图2大小"

hex 8 "位图标识2"

endsection

}

end

template "LDM VBLK&Volume"

description "卷的配置记录"

big-endian

appies_to disk

requires 0x00 "56 42 4C 4B"

requires 0x13 "51"

begin

section "VBLK Header"

char[4] "fixe Single VBLK"

uint32 "序列号"

uint32 "参考号"

uint16 "记录号"

uint16 "记录数"

endsection

section "VBLK & Volume(卷)"

uint24 "更新状态" // 这里书本上的结构图错误了

hex 1 "记录类型和状态" // 这里书本上的结构图错误了

uint32 "数据长度"

uint8 "对象ID长度"

IfEqual "对象ID长度" 1

uint8 "对象ID"

Endif

IfEqual "对象ID长度" 2

uint16 "对象ID"

Endif

IfEqual "对象ID长度" 3

uint24 "对象ID"

Endif

IfEqual "对象ID长度" 4

uint32 "对象ID"

Endif

uint8 "名称长度"

char[名称长度] "名称"

uint8 "应用类型长度"

char[应用类型长度] "应用类型"

hex 1 "0值"

char[14] "卷状态(活动)"

uint8 "卷类型(3为普通;4为RAID)"

hex 1 "总是1"

uint8 "卷数量"

hex 3 "0 值"

hex 1 "标志(0x11为普通，0x13为RAID)"

// 子单元数长度的值就是下面字段元数的字节数量

uint8 "子单元数长度"

uint8 "子单元数(分区)"

int64 "日志提交ID"

int64 "ID"

// 大小长度的值就是下面大小的字节数量

uint8 "大小长度"

IfEqual "大小长度" 1

int8 "当前卷扇区数量"

Endif

IfEqual "大小长度" 2

int16 "当前卷扇区数量"

Endif

IfEqual "大小长度" 3

int24 "当前卷扇区数量"

Endif

IfEqual "大小长度" 4

int32 "当前卷扇区数量"

Endif

hex 4 "0值"

hex 1 "分区类型"

hex 16 "卷GUID"

uint8 "ID1长度"

char[ID1长度] "ID1 (驱动器号)"

uint8 "ID2长度"

char[ID2长度] "ID2 (驱动器号)"

endsection

end

template "LDM VBLK&Component(磁盘配置记录)"

description "VBLK 组件配置记录"

big-endian

appies_to disk

requires 0x00 "56 42 4C 4B"

requires 0x13 "32"

begin

section "VBLK Header"

char[4] "fixe Single VBLK"

uint32 "序列号"

uint32 "参考号"

uint16 "记录号"

uint16 "记录数"

endsection

section "VBLK & component(分区)"

uint24 "更新状态"

hex 1 "记录类型和标识"

uint32 "数据长度"

uint8 "组件ID长度(P)"

IfEqual "组件ID长度(P)" 1

int8 "组件ID"

endif

IfEqual "组件ID长度(P)" 2

int16 "组件ID"

endif

IfEqual "组件ID长度(P)" 3

int24 "组件ID"

endif

IfEqual "组件ID长度(P)" 4

int32 "组件ID"

endif

uint8 "组件名称长度"

char[组件名称长度] "组件名称"

uint8 "卷状态(活动)长度(P)"

char[卷状态(活动)长度(P)] "卷状态(活动)"

uint8 "组件类型(1为条带，2为基本或跨区，3为RAID)"

hex 4 "0值"

uint8 "子组件(分区)数量长度(P)"

IfEqual "子组件(分区)数量长度(P)" 1

int8 "子组件(分区)数量"

endif

IfEqual "子组件(分区)数量长度(P)" 2

int16 "子组件(分区)数量"

endif

IfEqual "子组件(分区)数量长度(P)" 3

int24 "子组件(分区)数量"

endif

IfEqual "子组件(分区)数量长度(P)" 4

int32 "子组件(分区)数量"

endif

int64 "日志提交ID"

hex 8 "0值"

uint8 "父ID(卷)长度(P)"

IfEqual "父ID(卷)长度(P)" 1

int8 "父ID(卷)"

endif

IfEqual "父ID(卷)长度(P)" 2

int16 "父ID(卷)"

endif

IfEqual "父ID(卷)长度(P)" 3

int24 "父ID(卷)"

endif

IfEqual "父ID(卷)长度(P)" 4

int32 "父ID(卷)"

endif

hex 1 "0值"

uint8 "条带大小(以扇区为单位)长度"

IfEqual "父ID(卷)长度(P)" 1

int8 "条带大小"

endif

IfEqual "条带大小(以扇区为单位)长度" 2

int16 "条带大小"

endif

IfEqual "条带大小(以扇区为单位)长度" 3

int24 "条带大小"

endif

IfEqual "条带大小(以扇区为单位)长度" 4

int32 "条带大小"

endif

uint8 "条带数量长度"

IfEqual "条带数量长度" 1

int8 "条带数量"

endif

IfEqual "条带数量长度" 2

int16 "条带数量"

endif

IfEqual "条带数量长度" 3

int24 "条带数量"

endif

IfEqual "条带数量长度" 4

int32 "条带数量"

endif

endsection

end

template "LDM VBLK&Partition结构(磁盘配置记录)"

description "VBLK 分区类型配置记录"

big-endian

appies_to disk

requires 0x00 "56 42 4C 4B"

requires 0x13 "33"

begin

section "VBLK Header"

char[4] "fixe Single VBLK"

uint32 "序列号"

uint32 "参考号"

uint16 "记录号"

uint16 "记录数"

endsection

section "VBLK & partition(分区)"

uint24 "更新状态"

hex 1 "记录类型和标识"

uint32 "数据长度"

uint8 "分区ID长度"

IfEqual "分区ID长度" 1

int8 "分区ID"

endif

IfEqual "分区ID长度" 2

int16 "分区ID"

endif

IfEqual "分区ID长度" 3

int24 "分区ID"

endif

IfEqual "分区ID长度" 4

int32 "分区ID"

endif

uint8 "分区名称长度"

char[分区名称长度] "分区名称"

hex 4 "0值"

int64 "日志提交ID"

int64 "在磁盘中起始位置"

int64 "在卷中偏移"

uint8 "分区大小长度"

IfEqual "分区大小长度" 1

int8 "分区大小(扇区数)"

endif

IfEqual "分区大小长度" 2

int16 "分区大小(扇区数)"

endif

IfEqual "分区大小长度" 3

int24 "分区大小(扇区数)"

endif

IfEqual "分区大小长度" 4

int32 "分区大小(扇区数)"

endif

uint8 "父对象ID(组件)长度(P)"

IfEqual "父对象ID(组件)长度(P)" 1

int8 "父对象ID(组件)"

endif

IfEqual "父对象ID(组件)长度(P)" 2

int16 "父对象ID(组件)"

endif

IfEqual "父对象ID(组件)长度(P)" 3

int24 "父对象ID(组件)"

endif

IfEqual "父对象ID(组件)长度(P)" 4

int32 "父对象ID(组件)"

endif

uint8 "磁盘对象ID长度(P)"

IfEqual "磁盘对象ID长度(P)" 1

int8 "磁盘对象ID"

int8 "组件部分的索引"

endif

IfEqual "磁盘对象ID长度(P)" 2

int16 "磁盘对象ID"

int16 "组件部分的索引"

endif

IfEqual "磁盘对象ID长度(P)" 3

int24 "磁盘对象ID"

int24 "组件部分的索引"

endif

IfEqual "磁盘对象ID长度(P)" 4

int32 "磁盘对象ID"

int32 "组件部分的索引"

endif

endsection

end

template "LDM VBLK&Disk(磁盘配置记录)"

description "VBLK 磁盘配置记录"

big-endian

appies_to disk

requires 0x00 "56 42 4C 4B"

requires 0x13 "34"

begin

section "VBLK Header"

char[4] "fixe Single VBLK"

uint32 "序列号"

uint32 "参考号"

uint16 "记录号"

uint16 "记录数"

endsection

section "VBLK & Disk(磁盘)"

uint24 "更新状态"

hex 1 "记录类型和标识"

uint32 "数据长度"

uint8 "磁盘ID长度"

IfEqual "磁盘ID长度" 1

int8 "磁盘ID"

endif

IfEqual "磁盘ID长度" 2

int16 "磁盘ID"

endif

IfEqual "磁盘ID长度" 3

int24 "磁盘ID"

endif

IfEqual "磁盘ID长度" 4

int32 "磁盘ID"

endif

uint8 "磁盘名称长度"

char[磁盘名称长度] "磁盘名称"

uint8 "磁盘GUID长度"

char[磁盘GUID长度] "磁盘GUID"

uint8 "预备名称长度"

char[预备名称长度] "预备名称"

hex 4 "0值"

int64 "日志提交ID"

endsection

end

template "LDM VBLK&DiskGroup(磁盘组配置记录)"

description "VBLK 磁盘组配置记录"

big-endian

appies_to disk

requires 0x00 "56 42 4C 4B"

requires 0x13 "35"

begin

section "VBLK Header"

hex 4 "fixe Single VBLK"

uint32 "序列号"

uint32 "参考号"

uint16 "记录号"

uint16 "记录数"

endsection

section "VBLK & DiskGroup(磁盘组)"

uint24 "更新状态"

hex 1 "记录类型和标志"

int32 "数据长度"

uint8 "磁盘组ID 长度(代号)"

IfEqual "磁盘组ID 长度(代号)" 1

int8 "磁盘组ID"

endif

IfEqual "磁盘组ID 长度(代号)" 2

int16 "磁盘组ID"

endif

IfEqual "磁盘组ID 长度(代号)" 3

int24 "磁盘组ID"

endif

IfEqual "磁盘组ID 长度(代号)" 4

int32 "磁盘组ID"

endif

uint8 "磁盘组名称长度"

char[磁盘组名称长度] "磁盘组名称"

uint8 "磁盘组GUID 长度"

char[磁盘组GUID 长度] "磁盘组GUID"

hex 4 "0值"

int64 "日志提交ID"

uint8 "可选域1长度"

IfEqual "可选域1长度" 1

hex 1 "可选域1"

endif

IfEqual "可选域1长度" 2

hex 2 "可选域1"

endif

IfEqual "可选域1长度" 3

hex 3 "可选域1"

endif

IfEqual "可选域1长度" 4

hex 4 "可选域1"

endif

uint8 "可选域2长度"

IfEqual "可选域2长度" 1

hex 1 "可选域2"

endif

IfEqual "可选域2长度" 2

hex 2 "可选域2"

endif

IfEqual "可选域2长度" 3

hex 3 "可选域2"

endif

IfEqual "可选域2长度" 4

hex 4 "可选域2"

endif

endsection

end

最后编辑于：2018.01.09 11:15:34

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 204,921评论 6赞 478
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 87,635评论 2赞 381
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 151,393评论 0赞 338
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 54,836评论 1赞 277
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 63,833评论 5赞 368
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,685评论 1赞 281
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 38,043评论 3赞 399
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,694评论 0赞 258
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 42,671评论 1赞 300
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,670评论 2赞 321
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,779评论 1赞 332
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 33,424评论 4赞 321
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 39,027评论 3赞 307
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,984评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,214评论 1赞 260
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 45,108评论 2赞 351
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 42,517评论 2赞 343

LDMWinHex模板 格式讲解

推荐阅读更多精彩内容

LDMWinHex模板格式讲解