;DMDE Disk Editor Templates

[Test]
fuse:0
$i:=0
WHILE $i<5
$i:=$i+1
$j:=0
$x:=10
WHILE $j<5
$j:=$j+1
{4},x:$x,f:%u
$x:=$x+11
ENDWHILE
=
ENDWHILE

[MFT Record]
;remove guid not to use by default:
guid:{1df5ef71-7ae4-b176-c967-f94c63c5fb7a}
flow:1

CALCSIZESTART
$1:={0x1C,2}
IF $1<1024
$1:=1024
ENDIF
$RECSIZE:=$1
CALCSIZEEND

LOADSTART
$fx_srcofs:={0x04,2}
$fx_count:={0x06,2}
IF ($fx_srcofs >= 0x2A) AND ($fx_srcofs < 0x1FE) AND ($fx_count > 1)
$fx_dstofs:=0x1FE
IF {$fx_dstofs,2} = {$fx_srcofs,2}
WHILE ($fx_count > 1) AND ($fx_dstofs + 2 <= $RECSIZE)
$fx_srcofs:=$fx_srcofs+2
$fx_count:=$fx_count-1
{$fx_dstofs,2}:={$fx_srcofs,2}
$fx_dstofs:=$fx_dstofs+0x200
ENDWHILE
ENDIF
ENDIF
LOADEND

FLUSHSTART
$fx_srcofs:={0x04,2}
$fx_count:={0x06,2}
IF ($fx_srcofs >= 0x2A) AND ($fx_srcofs < 0x1FE) AND ($fx_count > 1)
$fx_value:={$fx_srcofs,2}
$fx_dstofs:=0x1FE
WHILE ($fx_count > 1) AND ($fx_dstofs + 2 <= $RECSIZE)
$fx_srcofs:=$fx_srcofs+2
$fx_count:=$fx_count-1
{$fx_srcofs,2}:={$fx_dstofs,2}
{$fx_dstofs,2}:=$fx_value
$fx_dstofs:=$fx_dstofs+0x200
ENDWHILE
 ENDIF
FLUSHEND

$OPENFILERECOFS:=0x00
$63:=TOGGLE:0,x:1

$10:=0 ;default color

IF {0x00,4}!=0x454c4946
$10:=8 ;error color
ENDIF

IF {0x16,2}&1
$13:=0 ;default color
ELSE
$13:=10 ;grayed (removed)
ENDIF

x:5,c:$10,f:File
IF {0x04,2}>=0x30
({0x2C,4}),x:10,f:#%u ========
ENDIF
({0x10,2}),x:22,f:(%u) ============

x:38,f:==================

IF $63
=
x:5,f:magic ("FILE"):
{0x00,4},x:32,c:$10,f:%4c
=
$10:=0
IF {0x04,2}<0x2A OR {0x04,2}>=$RECSIZE
$10:=8
ENDIF
x:5,f:fixups offset:
{0x04,2},x:32,c:$10,f:%4X
x:36,f:h
=
$10:=$13
IF {0x06,2}<2
$10:=8
ENDIF
x:5,f:fixups count:
{0x06,2},x:32,f:%4u
=
x:5,f:LSNlo:
{0x08,4},x:28,f:%08X
x:36,f:h
=
x:5,f:LSNHi:
{0x0C,4},x:28,f:%08X
x:36,f:h
=
x:5,f:seq. number:
{0x10,2},x:32,f:%4u
=
x:5,f:hlink number:
{0x12,2},x:32,f:%4u
=
 x:5,f:attrs offset:
{0x14,2},x:32,f:%4X
x:36,f:h
=
x:5,f:flags:
{0x16,2},x:32,f:%4X
x:36,f:h
=
x:5,f:used size:
{0x18,4},x:28,f:%8X
x:36,f:h

{0x18,4},x:38,f:%8u
=
x:5,f:record size:
{0x1C,4},x:28,f:%8X
x:36,f:h

{0x1C,4},x:38,f:%8u
=
x:5,f:basefileref:
{0x20,4},x:28,f:%8u
=
x:5,f:0x24:
{0x24,2},x:32,f:%4X
x:36,f:h
=
x:5,f:basefileref seq.:
{0x26,2},x:32,f:%4u
=
x:5,f:next attribute #:
{0x28,2},x:32,f:%4u

IF {0x04,2}>=0x30
=
x:5,f:0x2A:
{0x2A,2},x:32,f:%4X
x:36,f:h
=
x:5,f:file #:
{0x2C,4},x:28,f:%8u
ENDIF
$3:={0x04,2} ;fixup offset
IF $3>=0x2A AND $3<0x1FE
=
x:5,f:fixup:
{$3,2},x:32,f:%04X
x:36,f:h
ENDIF
ELSE
;if grayed
IF NOT $10 AND $13
$10:=$13
ENDIF
x:30,f: "
{0x00,4},x:32,c:$10,f:%4c
x:36,f:" =
ENDIF
;Attributes
$2:={0x14,2}
WHILE 1
=
$1:=$2
IF $1<0x2A OR $1>=$RECSIZE
x:5,c:8,f:ERROR Attribute Offset
=
BREAK
ENDIF
$OFFSET:=$1
$9:={0x00,4}
IF $9!=0xFFFFFFFF
$63:=TOGGLE:$1,x:1
ELSE
{0x00,4},x:11,c:10,f:%8X
x:19,f:h
x:21,f:End Mark
BREAK
ENDIF

$OPENATTROFS:=$1

x:5,f:#
$3:={0x0E,2}
$3,x:6,f:%u

IF NOT $63
{0x00,4},x:11,c:$13,f:%8X
x:19,f:h
ENDIF
IF NOT $63 AND {0x09,1}
;Attr name
$3:={0x0A,2}
$4:={0x09,1}<<1
x:21,f::
IF ($3<=0) OR ($3>={0x04,4}) OR ($3>=$RECSIZE-$OFFSET)
x:22,c:8,f:ERROR Attrname Offset
ELSEIF ($4>0)
{$3,$4},x:22,c:$13,f:U
ENDIF
=
ENDIF
IF $9=0x10
x:21,f:$STANDARD_INFORMATION
ELSEIF $9=0x20
x:21,f:$ATTRIBUTE_LIST
ELSEIF $9=0x30
x:21,f:$FILE_NAME
ELSEIF $9=0x50
x:21,f:$SECURITY_DESCRIPTOR
ELSEIF $9=0x60
x:21,f:$VOLUME_NAME
ELSEIF $9=0x70
x:21,f:$VOLUME_INFORMATION
ELSEIF $9=0x80
x:21,f:$DATA
ELSEIF $9=0x90
x:21,f:$INDEX_ROOT
ELSEIF $9=0xA0
x:21,f:$INDEX_ALLOCATION
ELSEIF $9=0xB0
x:21,f:$BITMAP
ELSEIF $9=0x100
x:21,f:$LOGGED_UTILITY_STREAM
ELSE
;$9,x:11,f:Attribute (%Xh)
x:21,f:Other Attribute
ENDIF

$10:=0 ;color
$2:={0x04,4}
$5:=$2 ;full attr length
IF $2<=0
$10:=8 ;error color
ELSE
$2:=$1+$2 ;next attribute offset
IF $2>$RECSIZE
$2:=$RECSIZE
$5:=$2-$1
$10:=8
ENDIF
ENDIF

IF $63
=
x:7,f:Attr. type:
{0x00,4},x:34,f:%8X
x:42,f:h
=
x:7,c:$10,f:Attr. length:
{0x04,4},x:34,c:$10,f:%8X
x:42,f:h
{0x04,4},x:44,c:$10,f:%10u
=
ELSEIF $10
=
x:7,c:$10,f:Attr. length:
{0x04,4},x:34,c:$10,f:%8X
x:42,f:h
=
ENDIF
IF $2<=0
=
BREAK
ENDIF

IF $63
x:7,f:Non-resident:
{0x08,1},x:39,f:%3u
=
x:7,f:Attrname len:
{0x09,1},x:39,f:%3u
=
x:7,f:Attrname ofs:
{0x0A,2},x:38,f:%4X
x:42,f:h
=
 x:7,f:Flags:
{0x0C,2},x:38,f:%4X
x:42,f:h
{0x0C:0,2},x:45,f:F:C-+-
{0x0C:14,2},x:48,f:F:E-S-
=
x:7,f:Attr. number:
{0x0E,2},x:37,f:%5u
=
ENDIF

IF NOT {0x08,1}
;resident attribute
$10:=0 ;color for offset
$11:=0 ;color for size

$3:={0x14,2} ;data offset

$4:={0x10,4} ;data size

IF $3>$5
;$3>full attr length
$3:=$5
$4:=0
$10:=8
ENDIF
IF $3+$4>$5
$4:=$5-$3
$11:=8
ENDIF

IF NOT $63
IF {0x00,4}=0x80
;$DATA:
;if grayed
IF NOT $11 AND $13
$11:=$13
ENDIF
{0x10,4},x:32,c:$11,f:%u
=
ELSEIF $11
=
x:7,c:$11,f:Data Size:
{0x10,4},x:34,c:$11,f:%8X
x:42,f:h
=
ENDIF
IF $10
=
x:7,c:$10,f:Data Offset:
{0x14,2},x:38,c:$10,f:%4X
x:42,f:h
=
ENDIF
ELSE
x:7,c:$11,f:Data Size:
{0x10,4},x:34,c:$11,f:%8X
x:42,f:h
{0x10,4},x:44,c:$11,f:%10u
=
 x:7,c:$10,f:Data Offset:
{0x14,2},x:38,c:$10,f:%4X
x:42,f:h
=
$9:={0x09,1}<<1
IF $9
x:7,f:Attr. name:
$8:={0x0A,2}
IF ($8<=0) OR ($8>={0x04,4}) OR ($8>=$RECSIZE-$OFFSET)
x:32,c:8,f:ERROR Attrname Offset
ELSE
{$8,$9},x:32,f:U
ENDIF
=
ENDIF
ENDIF

$NEXTOFS:=$3
IF {0x00,4}=0x10
;standard information
IF NOT $63
$NEXTOFS:=$NEXTOFS+8
$4:=$4-8
{8},x:43,c:$13,f:FILETIME
=
ELSE
x:14,f:created:
{8},x:32,f:FILETIME
=
x:14,f:modified:
{8},x:32,f:FILETIME
=
x:14,f:changed:
{8},x:32,f:FILETIME
=
x:14,f:accessed:
{8},x:32,f:FILETIME
=
x:14,f:attrs:
{2},x:32,f:F:R-H-S-V-D-A-d-n-t-s-r-c-o-i-e-+-
{2},x:49,f:F:+-+-+-+-+-+-+-+-+-+-+-+-D-I-+-+-
=
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
IF $4>=12
x:14,f:Max versions:
{4},x:32,f:%u
=
x:14,f:Version:
{4},x:32,f:%u
=
x:14,f:Class Id:
{4},x:32,f:%u
=
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
IF $4>=24
x:14,f:Owner Id:
{4},x:32,f:%u
 =
x:14,f:Security Id:
{4},x:32,f:%u
=
x:14,f:Quota Charged:
{8},x:32,f:%u
=
x:14,f:USN:
{8},x:32,f:%u
=
ENDIF
ENDIF
ENDIF
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
ELSEIF {0x00,4}=0x20
;attribute list
IF $63
x:1,f:attr.type len n.len n.ofs vcn MFT (#) attr# name
=
$8:=$OFFSET
$OFFSET:=$OFFSET+$3

WHILE $4>0
IF {0x04,2}
$OPENFILENUM:={0x10,4}
{0x00,4},x:1,f:%8X
x:9,f:h
ENDIF
$9:={0x04,2},x:11,f:%u
IF NOT $9
BREAK
ENDIF
{0x06,1},x:16,f:%u
$7:={0x07,1},x:21,f:%3X
x:24,f:h
{0x08,8},x:27,f:%d
{0x10,6},x:45,f:%u
{0x16,2},x:55,f:%u
{0x18,2},x:60,f:%u
$6:={0x06,1}<<1
IF $6
{$7,$6},x:66,f:U
ENDIF
=
IF $9>$4
$9:=$4
ENDIF
IF NOT $9
BREAK
ENDIF
$OFFSET:=$OFFSET+$9
$3:=$3+$9
$4:=$4-$9
ENDWHILE

$OFFSET:=$8
ENDIF
ELSEIF {0x00,4}=0x30
 ;file name
$OPENFILENUM:={$3,4}
IF $63
x:14,f:directory:
{6},x:32,f:%u
x:44,f:(
{2},x:45,f:%u
x:50,f:)
=
x:14,f:created:
{8},x:32,f:FILETIME
=
x:14,f:modified:
{8},x:32,f:FILETIME
=
x:14,f:changed:
{8},x:32,f:FILETIME
=
x:14,f:accessed:
{8},x:32,f:FILETIME
=
x:14,f:allocated:
{8},x:32,f:%u
=
x:14,f:size:
{8},x:32,f:%u
=
x:14,f:attrs:
{2},x:32,f:F:R-H-S-V-D-A-d-n-t-s-r-c-o-i-e-+-
{2},x:49,f:F:+-+-+-+-+-+-+-+-+-+-+-+-D-I-+-+-
=
x:14,f:reparse:
{4},x:32,f:%u
=
x:14,f:name len:
{1},x:32,f:%u
=
x:14,f:posix:
{1},x:32,f:%u
=
x:14,f:name:
ELSE
$NEXTOFS:=$NEXTOFS+0x42
ENDIF
$9:={$3+0x40,1}<<1
IF $9
{$9},x:32,c:$13,f:U
ENDIF
=
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
ELSEIF {0x00,4}=0x60
=
x:14,f:Volume Name:
{$3,$4},x:32,c:$13,f:U
=
$3:=$3+$4
$4:=0
ELSEIF $63 AND {0x00,4}=0x90 AND {$3,4}=0x30 AND $4>0x20
;INDX ROOT
;IF {0x10,2}=0x10
$8:=$OFFSET ;store
$OFFSET:=$OFFSET+$3+0x20
$3:=$3+0x20
$4:=$4-0x20

$10:=0 ;color
$12:=0 ;END MARK
$9:=0 ;entry size
WHILE $4>=0x10
IF $9
IF $9>=$4
$9:=$4
$3:=$3+$9
$4:=0
BREAK
ENDIF
$3:=$3+$9
$4:=$4-$9
$OFFSET:=$OFFSET+$9
ENDIF

$9:={0x08,2} ;entry size

IF $9&7 OR $9<0x10
$9:=8
CONTINUE
ENDIF
IF $9>$4
$9:=$4
ENDIF

IF NOT {0x0C:1,1} AND $9<0x54

$9:=8
CONTINUE
ENDIF

IF NOT {0x0C:1,1} OR NOT $12

IF {0x00,4}
;MFT num:
$OPENFILENUM:={0x00,4}
ENDIF
{0x00,6},x:1,c:$10,f:%u
;MFT seq num
x:11,f:(
{0x06,2},x:12,c:$10,f:%u
x:17,f:)
ENDIF

IF {0x0C:1,1}
;last entry
IF NOT $12
$12:=1
x:19,f:END MARK
=
ENDIF
BREAK
$10:=10 ;grayed
$7:=8
 IF {0x0C:0,1}
$7:=$7+8
ENDIF
IF $9!=$7
$9:=8
ENDIF
CONTINUE
ENDIF
;{0x0A,2} orig nameattr size
;{0x0C,1} UINT8 flags:
;&0x02 last entry
;&0x01: {entry_size-8,8} -> next sort vcn
;{0x0D,1} !=0 - D
;{0x0E,2} !=0 - U
;{0x10,original nameattr size} = name.data

;dir MFT num:

{0x10,6},x:19,c:10,f:%u
;dir MFT seq num
x:29,f:(
{0x16,2},x:30,c:10,f:%u
x:35,f:)

;creation time:
{0x18,8},x:37,w:10,c:10,f:FILETIME
;last modification time:
{0x20,8},x:48,w:10,c:10,f:FILETIME
;last change time:
{0x28,8},x:59,w:10,c:10,f:FILETIME
;access time:
{0x30,8},x:70,w:10,c:10,f:FILETIME
=
$OPENFILENUM:={0x00,4}
;allocated size:
{0x38,8},x:3,c:10,f:%u
;size:
{0x40,8},x:23,c:$10,f:%u
;{0x48,4}: file attributes
;namelen in bytes:
$7:={0x50,1}<<1
;{0x51,1}: ngt
;name:
{0x52,$7},x:42,c:$10,f:U
=
$7:=(0x59+$7)&0xFFFFFFF8
$11:=$7+8
IF {0x0C:0,1}
;sub nodes
$7:=$11
ENDIF
IF $7!=$9 AND $11!=$9
$9:=8
ENDIF
ENDWHILE
$OFFSET:=$8 ;restore
ENDIF

;$OFFSET = attr offset

;$3 = offset (relative to $OFFSET)
;$4 = rest data size
;$5 = full attr length

IF $3<$5
;hex output
IF $63
x:7,f:Hex:
=

$6:=$3
$7:=0
$9:=$3-{0x14,2}

$12:=12
$14:=61

;$6 = line start offset

;$7 = count of bytes per line for text
;$9 = offset relative to data start
;$10 = color
;$12 = screen position for hex output
;$14 = screen position for text output

$9,x:7,f:%03x:

WHILE 1
$10:=0
IF $4<=0
$10:=10 ;grayed
ENDIF
{$3,1},x:$12,c:$10,f:%cX

$3:=$3+1
IF $4
$4:=$4-1
$7:=$7+1
ENDIF
$12:=$12+3
$9:=$9+1

IF $12>57 OR $3>=$5
{$6,$7},x:$14,f:T
$6:=$3
$7:=0
ENDIF

IF $3>=$5
BREAK
ENDIF
IF $12>57
=
$12:=12
$7:=0
$14:=61
$9,x:7,f:%03x:
ENDIF
ENDWHILE
=
ENDIF
 =
ENDIF
ELSE
;non-resident attribute
IF NOT $63
IF {0x00,4}=0x80
;$DATA
{0x30,8},x:32,c:$13,f:%u
=
ENDIF
ELSE
$NEXTOFS:=0x10
x:12,f:start vcn:
{8},x:22,f:%20d
=
x:12,f:end vcn:
{8},x:22,f:%20d
=
x:12,f:runs offset:
{2},x:38,f:%4X
x:42,f:h
=
x:12,f:clogblk:
{2},x:37,f:%5u
=
x:12,f:0x24:
{4},x:34,f:%08X
x:42,f:h
=
x:12,f:allocated:
{8},x:22,f:%20u
=
x:12,f:size:
{8},x:22,f:%20u
=
x:12,f:initializ:
{8},x:22,f:%20u
=
IF {0x20,2}>=0x48 AND (NOT {0x09,1} OR {0x0A,2}>=0x48)
x:12,f:compress:
{8},x:22,f:%20u
=
ENDIF

$3:={0x0A,2}
$4:={0x09,1}<<1
IF $4
x:7,f:Attrname:
{$3,$4},x:32,f:U
=
ENDIF

;runlist:
$3:=$1+{0x20,2}
$cluster:=0
$vcn:=0
WHILE $3<$2
$OFFSET:=$3
$vcn,x:1,f:%10d
 x:12,f:run:
{0x00,1},x:17,f:%02X
x:19,f:h
IF NOT {0x00,1}
BREAK
ENDIF
$4:={0:0,4}
x:21,f:len:
{1,$4},x:26,f:%16d
$vcn:=$vcn+{1,$4}
$4:=$4+1
$9:={0:4,4}
x:43,f:relc:
IF NOT $9
x:49,f:-
ELSE
;relative cluster value:
$7:={$4,$9},x:49,f:%13X
x:62,f:h
;convert to signed value:
IF {$4+$9-1,1}&0x80
$7:=$7-(1<<($9*8))
ENDIF
$cluster:=$cluster+$7
$cluster,x:64,f::%d
ENDIF
=
$3:=$3+$4+$9
ENDWHILE
ENDIF
ENDIF
ENDWHILE

[NTFS Attribute List]

;uncomment guid to use by default:
guid:{27731dac-f9ab-8526-2ea2-55622acbbe12}
h: attr.type len n.len n.ofs vcn MFT (#) attr# name

WHILE $OFFSET<$RECSIZE
$NEXTOFS:=0
{4},x:1,f:%8X
x:9,f:h
$2:={2},x:11,f:%u
IF NOT $2
BREAK
ENDIF
$3:={$NEXTOFS,1}<<1
{1},x:16,f:%u
$4:={1},x:21,f:%3X
x:24,f:h
{8},x:27,f:%d
$OPENFILENUM:={0x10,4}
{6},x:45,f:%u
{2},x:55,f:%u
{2},x:60,f:%u
IF $3
{$4,$3},x:66,f:U
ENDIF
=
 IF $2<=0
BREAK
ENDIF
$OFFSET:=$OFFSET+$2
ENDWHILE

[NTFS Dir Entries]

;uncomment guid to use by default:
guid:{451037af-3415-2b8f-a8e9-b3b9d72cd284}
flow:1
h: MFT No Size Name

CALCSIZESTART
$1:=$RECSIZE
;"INDX" header:
IF {0x00,4}=0x58444E49
$1:=0x18+{0x20,2}
IF $1<512
$1:=512
ENDIF
ENDIF
$RECSIZE:=$1
CALCSIZEEND

LOADSTART
IF {0x00,4}=0x58444E49
$1:={0x04,2} ;fixups offset
IF $1<0x28 OR $1>=$RECSIZE
GOTO:1
ENDIF
$2:={0x06,2} ;fixups count
IF $2<=1
GOTO:1
ENDIF
$3:=0x1FE ;seq. offset
IF {$3,2}={$1,2} ;insert fixups
$1:=$1+2
WHILE 1
$2:=$2-1
{$3,2}:={$1,2}
$1:=$1+2
$3:=$3+0x200
IF NOT $2 OR $3>=$RECSIZE
BREAK
ENDIF
ENDWHILE
ENDIF
LABEL:1
ENDIF
LOADEND

FLUSHSTART
IF {0x00,4}=0x58444E49
$1:={0x04,2}
IF $1<0x28 OR $1>=$RECSIZE
GOTO:1
ENDIF
$2:={0x06,2}
IF $2<=1
 GOTO:1
ENDIF
$3:=0x1FE
$4:={$1,2}

$1:=$1+2
$2:=$2-1
WHILE 1
{$1,2}:={$3,2}
{$3,2}:=$4
$1:=$1+2
$2:=$2-1
$3:=$3+0x200
IF NOT $2 OR $3>=$RECSIZE
BREAK
ENDIF
ENDWHILE
LABEL:1
ENDIF
FLUSHEND

$10:=0 ;color
IF {0x00,4}=0x58444E49
$63:=TOGGLE:$OFFSET,x:1
x:5,c:$10,f:magic ("INDX"):
{0x00,4},x:22,f:%4c
IF NOT $63
x:30,c:$10,f:vcn:
{0x10,8},x:35,f:%d
ELSE
=
x:5,f:fixups offset:
{0x04,2},x:32,c:$10,f:%4X
x:36,f:h
=
x:5,f:fixups count:
{0x06,2},x:32,f:%4u
=
x:5,f:LSNlo:
{0x08,4},x:28,f:%08X
x:36,f:h
=
x:5,f:LSNHi:
{0x0C,4},x:28,f:%08X
x:36,f:h
=
x:5,c:$10,f:vcn:
{0x10,8},x:22,f:%d
=
x:5,c:$10,f:items offset:
{0x18,2},x:22,f:%u
=
x:5,c:$10,f:usedsize:
{0x1C,4},x:22,f:%u
=
x:5,c:$10,f:recordsize:
{0x20,4},x:22,f:%u
ENDIF
=
 $OFFSET:=0x18+{0x18,2}
ELSEIF {0x00,4}=0x30 AND {0x10,2}=0x10
$OFFSET:=0x20
ENDIF

$4:=$RECSIZE - $OFFSET
$12:=0
$9:=0 ;entry size
WHILE 1
IF $9
IF $9>=$4
$9:=$4
$3:=$3+$9
$4:=0
BREAK
ENDIF
$3:=$3+$9
$4:=$4-$9
$OFFSET:=$OFFSET+$9
ENDIF

IF $4<0x10
BREAK
ENDIF

$9:={0x08,2} ;entry size

IF $9&7 OR $9<0x10
$9:=8
CONTINUE
ENDIF
IF $9>$4
IF $12
$9:=8
CONTINUE
ENDIF
$9:=$4
ENDIF

IF $12 AND ({0x0C:1,1} OR $9<0x54 OR {0x0A,2}<0x42 OR {0x0A,2}>$9)

$9:=8
CONTINUE
ENDIF

$63:=TOGGLE:$OFFSET,x:1

IF NOT {0x0C:1,1} OR NOT $12

IF {0x00,8}
;MFT num:
$OPENFILENUM:={0x00,4}
x:4,f:>
ENDIF
IF {0x04,2}
x:4,f:x
{0x00,6},x:5,c:$10,f:%X
ELSE
{0x00,4},x:5,c:$10,f:%u
ENDIF
;MFT seq num
x:15,f:(
 {0x06,2},x:16,c:$10,f:%u
x:21,f:)
ENDIF

IF $63
=
x:5,f:Entry Size:
{0x08,2},x:24,c:$10,f:%u
=
x:5,f:Attr. Size:
{0x0A,2},x:24,c:$10,f:%u
=
x:5,f:Flags:
{0x0C,4},x:24,c:$10,f:%X
;{0x0C,1} flags:
;&0x02 last entry
;&0x01: {entry_size-8,8} -> next sort vcn
;{0x0D,1} !=0 - D
;{0x0E,2} !=0 - U
=
ENDIF

IF {0x0C:1,1}
$12:=1
x:24,f:END MARK
=
;BREAK
$7:=0x10
IF {0x0C:0,1}
IF $63
;sub nodes
x:5,f:Subnode VCN:
{$7,8},x:24,c:$10,f:%d
=
ENDIF
$7:=$7+8
ENDIF
IF $9!=$7
$9:=8
ENDIF
$10:=10 ;grayed
CONTINUE
ENDIF

;IF ($9<0x54 OR {0x0A,2}<0x42 OR {0x0A,2}>$9)

; $9:=8
; =
; CONTINUE
;ENDIF

IF $63
$OPENFILENUM:={0x10,4}
x:5,f:Dir MFT Num: >
IF {0x14,2}
x:23,f:x
{0x10,6},x:24,c:$10,f:%X
ELSE
{0x10,4},x:24,c:$10,f:%u
ENDIF
 x:35,f:(
{0x16,2},x:36,c:$10,f:%u
x:41,f:)
=
x:5,f:Creation Time:
{0x18,8},x:24,c:$10,f:FILETIME
=
x:5,f:Modification Time:
{0x20,8},x:24,c:$10,f:FILETIME
=
x:5,f:Change Time:
{0x28,8},x:24,c:$10,f:FILETIME
=
x:5,f:Access Time:
{0x30,8},x:24,c:$10,f:FILETIME
=
x:5,f:Allocated Size:
{0x38,8},x:24,c:$10,f:%u
=
x:5,f:Size:
{0x40,8},x:24,c:$10,f:%u
=
x:5,f:Attributes:
{0x48,4},x:24,c:$10,f:%X
=
x:5,f:Name Length:
{0x50,1},x:24,c:$10,f:%u
=
x:5,f:Name POSIX:
{0x51,1},x:24,c:$10,f:%u
=
$7:={0x50,1}<<1
x:5,f:Name:
{0x52,$7},x:24,c:$10,f:U
ELSE
IF {0x48,4} & 0x10000000
x:24,f:[dir]
ELSE
;size:
{0x40,8},x:24,c:$10,f:%u
ENDIF
;namelen in bytes:
$7:={0x50,1}<<1
;{0x51,1}: ngt
;name:
{0x52,$7},x:42,c:$10,f:U
ENDIF
=
$7:=(0x59+$7)&0xFFFFFFF8
$11:=$7+8
IF {0x0C:0,1}
IF $63
;sub nodes
x:5,f:Subnode VCN:
{$7,8},x:24,c:$10,f:%d
=
ENDIF
$7:=$11
ENDIF
 IF $7!=$9 AND $11!=$9
$9:=8
ENDIF
ENDWHILE

[extFS Superblock]
guid:{e753e591-7808-eb38-a7d0-42cace180382}
o:1
$RECSIZE:=1024

x:1,f:s_inodes_count
{4},x:25,f:%u
=
x:1,f:s_blocks_count_lo
{4},x:25,f:%u
=
x:1,f:s_r_blocks_count_lo
{4},x:25,f:%u
=
x:1,f:s_free_blocks_count_lo
{4},x:25,f:%u
=
x:1,f:s_free_inodes_count
{4},x:25,f:%u
=
x:1,f:s_first_data_block
{4},x:25,f:%u
=
x:1,f:s_log_block_size
{4},x:25,f:%u
=
x:1,f:s_log_cluster_size
{4},x:25,f:%u
=
x:1,f:s_blocks_per_group
{4},x:25,f:%u
;=
;x:1,f:s_obso_frags_per_group
;{0x24,4},x:25,f:%u
$NEXTOFS:=$NEXTOFS+4
=
x:1,f:s_inodes_per_group
{4},x:25,f:%u
=
x:1,f:s_mtime
{4},x:25,f:UNIXDATE
=
x:1,f:s_wtime
{4},x:25,f:UNIXDATE
=
x:1,f:s_mnt_count
{2},x:25,f:%u
=
x:1,f:s_max_mnt_count
{2},x:25,f:%u
=
x:1,f:s_magic (53EF)
{2},x:25,f:%2cX
=
x:1,f:s_state
{2},x:25,f:%u
=
x:1,f:s_errors
{2},x:25,f:%u
=
x:1,f:s_minor_rev_level
{2},x:25,f:%u
=
x:1,f:s_lastcheck
{4},x:25,f:UNIXDATE
=
x:1,f:s_checkinterval
{4},x:25,f:%u
=
x:1,f:s_creator_os
{4},x:25,f:%u
=
$revision:={$NEXTOFS,4}
x:1,f:s_rev_level
{4},x:25,f:%u
=
;{0x50,2}s_def_resuid
;{0x52,2}s_def_resgid
$NEXTOFS:=$NEXTOFS+4

IF $revision
;revision>0
x:1,f:s_first_ino
{4},x:25,f:%u
=
x:1,f:s_inode_size
{2},x:25,f:%u
=
x:1,f:s_block_group_nr#
{2},x:25,f:%u
=
x:1,f:s_feature_compat
{4},x:25,f:%X
x:33,f:h
;0x1 Directory prealloc
;0x2 "imagic inodes"
;0x4 journal
;0x8 extended attributes
;0x10 reserved GDT blocks for filesystem expansion
;0x20 directory indices
;0x40 "Lazy BG"
;0x80 "Exclude inode"
=
x:1,f:s_feature_incompat
{4},x:25,f:%X
x:33,f:h
;0x1 Compression.
;0x2 Directory entries record the file type
;0x4 FS needs recovery
;0x8 FS has a separate journal device
;0x10 Meta block groups
;0x40 file extents
;0x80 2^64 blocks
;0x200 Flexible block groups
;0x400 Inodes for large extended attributes
;0x1000 Data in directory entry
=
x:1,f:s_feature_ro_compat
{4},x:25,f:%X
x:33,f:h
;0x1 Sparse superblocks.
;0x2 files greater than 2GiB.
;0x8 file sizes are in blocks, not 512-byte sectors
;0x10 Group descriptor checksums
;0x20 no 32,000 subdirectory limit
;0x40 large inodes
;0x80 FS has a snapshot.
=
x:1,f:s_uuid
{4},x:25,f:%08X
x:33,f:-
{2},x:34,f:%04X
x:38,f:-
{2},x:39,f:%04X
x:43,f:-
{2},x:44,f:%.2cX
x:48,f:-
{6},x:49,f:%.6cX
;UUID of the volume
=
x:1,f:s_volume_name "
{16},x:25,f:u
x:41,f:"
=
;{0x88,64}s_last_mounted:%64c
$NEXTOFS:=$NEXTOFS+64
=
x:1,f:s_algorithm_usage_bitmap
{4},x:25,f:%u
;compression
=
; {0xCC,1}s_prealloc_blocks
; {0xCD,1}s_prealloc_dir_blocks
; {0xCE,2}s_reserved_gdt_blocks

$NEXTOFS:=$NEXTOFS+4

IF {0x5C:2,1}
;has journal
x:1,f:s_journal_uuid
{4},x:25,f:%08X
x:33,f:-
{2},x:34,f:%04X
x:38,f:-
{2},x:39,f:%04X
x:43,f:-
{2},x:44,f:%.2cX
x:48,f:-
{6},x:49,f:%.6cX
=
x:1,f:s_journal_inum
{4},x:25,f:%u
 =
x:1,f:s_journal_dev
{4},x:25,f:%u
=
ENDIF
;x:1,f:s_last_orphan
;{4},x:25,f:%u
; =
; {0xEC,16}s_hash_seed
; {0xFC,1}s_def_hash_version
; {0xFD,1}s_jnl_backup_type {?}
;=
$NEXTOFS:=$NEXTOFS+22
x:1,f:s_desc_size
{2},x:25,f:%u
=
; {0x100,4}s_default_mount_opts
;=
$NEXTOFS:=$NEXTOFS+4
x:1,f:s_first_meta_bg
{4},x:25,f:%u
=
x:1,f:s_mkfs_time
{4},x:25,f:UNIXDATE
; {0x10C,68}s_jnl_blocks 4x17
;=
$NEXTOFS:=$NEXTOFS+68
;64bit support valid if EXT4_FEATURE_COMPAT_64BIT
x:1,f:s_blocks_count_hi
{4},x:25,f:%X
x:33,f:h
=
x:1,f:s_r_blocks_count_hi
{4},x:25,f:%X
x:33,f:h
=
x:1,f:s_free_blocks_count_hi
{4},x:25,f:%X
x:33,f:h
=
x:1,f:s_min_extra_isize
{2},x:25,f:%u
=
x:1,f:s_want_extra_isize
{2},x:25,f:%u
=
x:1,f:s_flags
{4},x:25,f:%X
x:33,f:h
;0x0001 Signed directory hash in use.
;0x0002 Unsigned directory hash in use.
;0x0004 To test development code.
=
x:1,f:s_raid_stride
{2},x:25,f:%u
=
x:1,f:s_mmp_interval
{2},x:25,f:%u
=
 x:1,f:s_mmp_block
{2},x:25,f:%u
=
x:1,f:s_raid_stripe_width
{4},x:25,f:%u
=
x:1,f:s_log_groups_per_flex
{1},x:25,f:%u
=
;0x175 __u8 s_reserved_char_pad
;0x176 __le16 s_reserved_pad
;=
$NEXTOFS:=$NEXTOFS+3
x:1,f:s_kbytes_written
{8},x:25,f:%u
=
;0x180 __le32 s_snapshot_inum
;0x184 __le32 s_snapshot_id
;0x188 __le64 s_snapshot_r_blocks_count
;0x190 __le32 s_snapshot_list
;0x194 __le32 s_error_count
;0x198 __le32 s_first_error_time
;0x19C __le32 s_first_error_ino
;0x1A0 __le64 s_first_error_block
;0x1A8 __u8 s_first_error_func[32]
;0x1C8 __le32 s_first_error_line
;0x1CC __le32 s_last_error_time
;0x1D0 __le32 s_last_error_ino
;0x1D4 __le32 s_last_error_line
;0x1D8 __le64 s_last_error_block
;0x1E0 __u8 s_last_error_func[32]
;0x200 __u8 s_mount_opts[64]
;0x240 __le32 s_reserved[108]
=
x:1,f:s_checksum
{0x3FC,4},x:25,f:%08X
x:33,f:h
ENDIF

[extFS Group Descriptors x32]

guid:{f377e6df-e06c-7909-922e-90d58c09259d}
flow:1
h: blk_bitmap ino_bitmap ino_table freblk frino usedir flag nusei csum

WHILE $OFFSET+32<=$RECSIZE
{0x0,4},x:1,f:%10u
{0x4,4},x:12,f:%10u
{0x8,4},x:23,f:%10u
{0xC,2},x:34,f:%5u
{0xE,2},x:40,f:%5u
{0x10,2},x:46,f:%5u
{0x12,2},x:52,f:%4X
x:56,f:h
;{0x14,4},x:58,f:%10u
;{0x18,2},x:58,f:%4X
;x:62,f:h
;{0x1A,2},x:64,f:%4X
;x:68,f:h
{0x1C,2},x:58,f:%5u
 {0x1E,2},x:64,f:%4X
x:68,f:h
=
$OFFSET:=$OFFSET+32
ENDWHILE

[extFS Group Descriptors x64]

guid:{d3f3136d-fe00-3ffd-5cfb-eef922c334a3}
flow:1
h: blk_bitmap ino_bitmap ino_table freeblk freeino usedir
unuse flags chksum
IF $1<=0
;desriptor size not given
$1:=64
ENDIF

WHILE $OFFSET+$1<=$RECSIZE
{0x0,4;0x20,4},x:0,f:%18u
{0x4,4;0x24,4},x:18,f:%18u
{0x8,4;0x28,4},x:36,f:%18u
{0xC,2;0x2C,2},x:54,f:%9u
{0xE,2;0x2E,2},x:63,f:%9u
{0x10,2;0x30,2},x:72,f:%9u
{0x1C,2;0x32,2},x:81,f:%9u
{0x12,2},x:91,f:%4X
x:95,f:h
{0x1E,2},x:97,f:%4X
=
$OFFSET:=$OFFSET+$1
ENDWHILE

[extFS Inodes Entries]

guid:{e39b26a7-c80d-8db3-adac-4251831fd053}
flow:1

IF $1<=0
;inode size not given
$1:=128
ENDIF
;$64=inode number (if given)

WHILE $OFFSET+$1<=$RECSIZE
$OPENFILERECOFS:=$OFFSET
$63:=TOGGLE:$OFFSET,x:1
x:5,f:Inode ====== #
$64,x:19,f:%u =======
$OFFSET,x:29,f:(+%u) =====
x:39,f:====================
IF $64>0
$64:=$64+1
ENDIF
=
$OPENFILERECOFS:=$OFFSET
x:5,f:i_mode:
{0x0,2},x:19,f:%X
x:23,f:h:
$mode:={0x0:12,4}
IF $mode=0x1
x:25,f:FIFO
ELSEIF $mode=0x2
x:25,f:CHR
ELSEIF $mode=0x4
x:25,f:DIR
ELSEIF $mode=0x6
x:25,f:BLK
ELSEIF $mode=0x8
x:25,f:FILE
ELSEIF $mode=0xA
x:25,f:LINK
ELSEIF $mode=0xC
x:25,f:SOCK
ENDIF
x:30,f:Oth:
{0x0:0,3},x:34,f:F:X-W-R-
x:38,f:Grp:
{0x0:3,3},x:42,f:F:X-W-R-
x:46,f:Own:
{0x0:6,3},x:50,f:F:X-W-R-
x:54,f:StB:
{0x0:9,1},x:58,f:F:+-
x:60,f:Gid:
{0x0:10,1},x:64,f:F:+-
x:66,f:Uid:
{0x0:11,1},x:70,f:F:+-
=
IF $63
x:5,f:i_uid:
{0x2,2},x:19,f:%u
=
ENDIF
x:5,f:i_size_lo:
{0x4,4},x:19,f:%u
=
IF $63
x:5,f:i_atime:
{0x8,4},x:19,f:UNIXDATE
=
x:5,f:i_ctime:
{0xC,4},x:19,f:UNIXDATE
=
ENDIF
x:5,f:i_mtime:
{0x10,4},x:19,f:UNIXDATE
=
IF $63
x:5,f:i_dtime:
{0x14,4},x:19,f:UNIXDATE
=
x:5,f:i_gid:
{0x18,2},x:19,f:%u
=
x:5,f:i_links_count:
{0x1A,2},x:19,f:%u
=
x:5,f:i_blocks_lo:
{0x1C,4},x:19,f:%u
=
x:5,f:i_flags:
{0x20,4},x:19,f:%08X
x:27,f:h

IF {0x21:4,1}
x:30,f:INDEX
ENDIF
IF {0x21:5,1}
x:36,f:IMAGIC
ENDIF
IF {0x22:1,1}
x:43,f:TOPDIR
ENDIF
IF {0x22:2,1}
x:50,f:HUGE
ENDIF
IF {0x22:3,1}
x:55,f:EXTENT
ENDIF
IF {0x22:5,1}
x:62,f:EA
ENDIF
IF {0x23:4,1}
x:63,f:INLINE
ENDIF

;0x20 EXT4_APPEND_FL
;0x1000 EXT4_INDEX_FL
;0x2000 EXT4_IMAGIC_FL
;0x4000 EXT4_JOURNAL_DATA_F
;0x20000 EXT4_TOPDIR_FL
;0x40000 EXT4_HUGE_FILE_FL
;0x80000 EXT4_EXTENTS_FL
;0x200000 EXT4_EA_INODE_FL
;0x10000000 EXT4_INLINE_DATA_FL
=

x:5,f:l_i_version:
{0x24,4},x:19,f:%u
=

$3:=1
;extents
IF {0x22:3,1}
;extents header
$4:=$OFFSET+0x28
;save offset:
$2:=$OFFSET
$OFFSET:=$4

x:2,f:eh_magic (F30A):
{0x00,2},x:19,f:%04X
x:23,f:h
=
x:2,f:eh_entries:
{0x02,2},x:19,f:%u
=
x:2,f:eh_max:
{0x04,2},x:19,f:%u
=
 x:2,f:eh_depth:
{0x06,2},x:19,f:%u
=
x:2,f:eh_generation:
{0x08,4},x:19,f:%X
x:27,f:h
=

;extents:
$3:={0x06,2}
$4:=$4+0x0C
$5:={0x02,2}
IF $5>4
$5:=4
ENDIF

WHILE $5>0
$OFFSET:=$4
IF NOT $3
;extent
x:3,f:ee_block:
{0x00,4},x:19,f:%u

x:30,f:ee_len:
{0x04,2},x:41,f:%u

$OPENCLUSTER:={0x08,4;0x06,2}
x:49,f:ee_start:
{0x08,4;0x06,2},x:60,f:%u
=
ELSE
;inode
x:3,f:ei_block:
{0x00,4},x:19,f:%u

$OPENTEMPLATE:='{30747da5-cdcb-b665-e094-12c9cdf32a26}'
$OPENCLUSTER:={0x04,4;0x08,2}
x:30,f:ei_leaf:
{0x04,4;0x08,2},x:41,f:%u
=
ENDIF

$4:=$4+12
$5:=$5-1
ENDWHILE

$OFFSET:=$2 ;restore offset

$3:=0 ;no blocks
ENDIF
IF $3
IF {0x0:12,4}=0xA
;link
IF {0x4,4}<=60
;no blocks
$3:=0
ENDIF
ENDIF
IF {0x23:4,1}
;inline data
 $3:=0
ENDIF
IF NOT $3
;inline data
$4:={0x4,4}
IF $4>60
$4:=60
ENDIF
IF $4>0
x:5,f:i_block:
IF {0x0:12,4}=0xA
;link
{0x28,$4},x:19,f:C
ELSE
;data
{0x28,$4},x:19,f:T
ENDIF
=
ENDIF
ENDIF
ENDIF
IF $3
;blocks:
$NEXTOFS:=0x28
$OPENCLUSTER:={0x28,4}
x:5,f:i_block:
$i:=0
WHILE $i<3
$i:=$i+1
$j:=0
$x:=19
WHILE $j<5
$j:=$j+1
{4},x:$x,f:%u
$x:=$x+11
ENDWHILE
=
ENDWHILE
ENDIF
=
x:5,f:i_generation:
{0x64,4},x:19,f:%u
=
x:5,f:i_file_acl_lo:
{0x68,4},x:19,f:%u
=
ENDIF
x:5,f:i_size_high:
{0x6C,4},x:19,f:%X
x:27,f:h
=
IF $63
;0x70 __le32 i_obso_faddr
;=
;0x0 __le16 l_i_blocks_high
x:5,f:l_i_blocks_hi:
{0x74,2},x:19,f:%X
x:23,f:h
=
 ;0x2 __le16 l_i_file_acl_high
x:5,f:l_i_file_aclh:
{0x76,2},x:19,f:%X
x:23,f:h
=
;0x4 __le16 l_i_uid_high
x:5,f:l_i_uid_high:
{0x78,2},x:19,f:%X
x:23,f:h
=
;0x6 __le16 l_i_gid_high
x:5,f:l_i_gid_high:
{0x7A,2},x:19,f:%X
x:23,f:h
=
;0x8 __le16 l_i_checksum_lo
x:5,f:l_i_checksuml:
{0x7C,2},x:19,f:%X
x:23,f:h
=
;0xA __le16 l_i_reserved
x:5,f:l_i_reserved:
{0x7E,2},x:19,f:%X
x:23,f:h
=
IF $1>128
x:5,f:i_extra_isize:
{0x80,2},x:19,f:%u
=
x:5,f:i_pad1:
{0x82,2},x:19,f:%u
=
x:5,f:i_ctime_extra:
{0x84,4},x:19,f:%u
=
x:5,f:i_mtime_extra:
{0x88,4},x:19,f:%u
=
x:5,f:i_atime_extra:
{0x8C,4},x:19,f:%u
=
x:5,f:i_crtime:
{0x90,4},x:19,f:UNIXDATE
=
x:5,f:i_crtime_extra:
{0x94,4},x:19,f:%u
=
x:5,f:i_version_hi:
{0x98,4},x:19,f:%X
x:27,f:h
=
ENDIF
ENDIF
IF $OFFSET+$1>=$RECSIZE
BREAK
ENDIF
$OFFSET:=$OFFSET+$1
ENDWHILE
[extFS Extent List]
guid:{30747da5-cdcb-b665-e094-12c9cdf32a26}

CALCSIZESTART
IF {0x00,2}=0xF30A
$1:= (0x0C + {0x02,2}*12 + 511) & ~511
IF $1>0x10000
$1:=0x10000
ENDIF
IF $RECSIZE<$1
$RECSIZE:=$1
ENDIF
ENDIF
CALCSIZEEND

;extents header
$4:=0x00
$OFFSET:=$4

x:2,f:eh_magic (F30A):
{0x00,2},x:19,f:%04X
x:23,f:h
=
x:2,f:eh_entries:
{0x02,2},x:19,f:%u
=
x:2,f:eh_max:
{0x04,2},x:19,f:%u
=
x:2,f:eh_depth:
{0x06,2},x:19,f:%u
=
x:2,f:eh_generation:
{0x08,4},x:19,f:%X
x:27,f:h

;extents:
$3:={0x06,2}
$4:=$4+0x0C
$5:={0x02,2}
; IF $5>4
; $5:=4
; ENDIF
WHILE ($5>0) AND ($4+12<=$RECSIZE)
$OFFSET:=$4
IF NOT $3
;extent
=
x:3,f:ee_block:
{0x00,4},x:19,f:%u

x:30,f:ee_len:
{0x04,2},x:41,f:%u

$OPENCLUSTER:={0x08,4;0x06,2}
x:49,f:ee_start:
{0x08,4;0x06,2},x:60,f:%u
ELSE
;inode
 =
x:3,f:ei_block:
{0x00,4},x:19,f:%u

$OPENTEMPLATE:='{30747da5-cdcb-b665-e094-12c9cdf32a26}'
$OPENCLUSTER:={0x04,4;0x08,2}
x:30,f:ei_leaf:
{0x04,4;0x08,2},x:41,f:%u
ENDIF

$4:=$4+12
$5:=$5-1
ENDWHILE

[extFS Directory Entries]

guid:{8a4dbd31-8a3a-0aa6-b095-58c6f3416fed}
flow:1
h: Inode ESize NmLen Type Name

CALCSIZESTART
IF $1<=0
;recsize is not given
IF $RECSIZE<4096
$RECSIZE:=4096
ENDIF
ENDIF
CALCSIZEEND

;removed:
$4:=0
;index hashes:
$5:=0
$6:=0

WHILE $OFFSET+0x08<=$RECSIZE
$10:=0
$2:={0x06,1}
$3:=($2+11)&0xFC

IF $OFFSET=0 AND {0x04,5}=\x0C\x00\x01\x02\x2E

$5:=1
ENDIF
IF $OFFSET=0x0C AND {0x06,4}!=\x02\x02\x2E\x2E
$5:=0
ENDIF
IF $5 AND $OFFSET=0x18 AND {0x0,4}=0 AND {0x07,1}=0 AND $4>=0x28 AND {0xA,2}>0
;dx_root
$63:=TOGGLE:0,x:1
x:5,f:dx_root (index hashes)
=
IF $63
x:9,f:reserved_zero
{0x00,4},x:28,f:%u
=
x:9,f:hash_version
{0x04,1},x:28,f:%u
=
x:9,f:info_length (8)
{0x05,1},x:28,f:%u
 =
x:9,f:indirect_levels
{0x06,1},x:28,f:%u
=
x:9,f:unused_flags
{0x07,1},x:28,f:%u
=
x:9,f:limit
{0x08,2},x:28,f:%u
=
x:9,f:count
{0x0A,2},x:28,f:%u
=
x:38,f:block:
{0x0C,4},x:58,f:%u
=
ENDIF

$6:={0x0A,2}-1
$OFFSET:=0x28
ENDIF

IF $OFFSET=0 AND {0x0,4}=0 AND {0x6,2}=0 AND {0xA,2}>0

;dx_node
$5:=1

x:1,f:dx_node fake.inode (0)

{0x0,4},x:28,f:%u
=
x:9,f:fake.rec_len
{0x4,2},x:28,f:%u
=
x:9,f:name_len (0)
{0x6,1},x:28,f:%u
=
x:9,f:file_type (0)
{0x7,1},x:28,f:%u
=
x:9,f:limit
{0x8,2},x:28,f:%u
=
x:9,f:count
{0xA,2},x:28,f:%u
=
IF {0xA,2}>1
$63:=TOGGLE:0,x:5
x:9,f:hashes
ENDIF

x:38,f:block:
{0xC,4},x:58,f:%u
=

$4:={0x4,2}
$6:={0xA,2}-1
$OFFSET:=0x10
ENDIF

IF $6
 WHILE 1
IF $63
x:9,f:hash:
{0x00,4},x:28,c:$10,f:%08X
x:38,f:block:
{0x04,4},x:58,c:$10,f:%u
=
ENDIF
$6:=$6-1
IF NOT $6
BREAK
ENDIF
$OFFSET:=$OFFSET+8
IF $OFFSET>=$4
$OFFSET:=$4
$4:=0
BREAK
ENDIF
ENDWHILE
$6:=0
ENDIF

IF $4
IF NOT {0x07,1} OR {0x07,1}>7 OR {0x04:0,2}>0 OR {0x04,2}<8
$2:=0
ENDIF
$5:=$2+8
IF $5>{0x04,2}
$2:=0
ENDIF
IF $RECSIZE>0
$5:=$OFFSET+{0x04,2}
IF $5>$RECSIZE
$2:=0
ENDIF
ENDIF
IF NOT $2
$3:=$OFFSET+4
IF $3>=$4
$4:=0
ENDIF
IF $3>=$RECSIZE
BREAK
ENDIF
$OFFSET:=$3
CONTINUE
ENDIF
ENDIF

IF NOT $4 AND {0x00,6}=0

BREAK
ENDIF

$OPENFILENUM:={0x00,4}
$10:=0
IF $4
$10:=10 ;grayed
ENDIF
{0x00,4},x:1,c:$10,f:%u
 $1:={0x04,2},x:12,c:$10,f:%u
$2:={0x06,1},x:19,c:$10,f:%u
{0x07,1},x:25,c:$10,f:%X
;0x0 Unknown.
;0x1 Regular file.
;0x2 Directory.
;0x3 Character device file.
;0x4 Block device file.
;0x5 FIFO.
;0x6 Socket.
;0x7 Symbolic link.
IF {0x07,1}=2
x:30,f:>
ENDIF
IF $4
x:29,f:x
ENDIF

{0x08,$2},x:31,c:$10,f:u
$3,x:81,c:$10,f:%u
=
IF $3<$1
IF NOT $4
$4:=$OFFSET+$1
ENDIF
ELSE
$3:=$1
ENDIF
IF $3<4
$3:=4
ENDIF
$3:=$OFFSET+$3
IF $4 AND $3>=$4
$3:=$4
$4:=0
ENDIF
IF $3>=$RECSIZE
BREAK
ENDIF
$OFFSET:=$3
ENDWHILE

[exFAT Boot Sector]

guid:{69aff35a-367b-8d25-22d2-2dfb6664ad4f}

;{0x00,3}BS_jmpBoot {0xEB7690}
x:1,f:OEMName (EXFAT)
x:24,f:"
{0x03,8},x:25,f:%-8c
x:33,f:"
=
;{0x0b,43}Zeroed
;=
x:1,f:PartitionOffset
{0x40,8},x:25,f:%u
=
x:1,f:VolumeLength
{0x48,8},x:25,f:%u
=
x:1,f:FATOffset
{0x50,4},x:25,f:%u
=
x:1,f:FATLength
{0x54,4},x:25,f:%u
=
x:1,f:ClusterHeapOffset
{0x58,4},x:25,f:%u
=
x:1,f:ClusterCount
{0x5C,4},x:25,f:%u
=
x:1,f:RootDirectoryFirstCluster
{0x60,4},x:25,f:%u
=
x:1,f:VolumeSerialNumber
{0x64,4},x:25,f:%08X
x:33,f:h
=
x:1,f:FileSystemRevision
{0x69,1},x:25,f:%02X
x:27,f:.
{0x68,1},x:28,f:%02X
=
x:1,f:VolumeFlags
{0x6A,2},x:25,f:%04X
x:29,f:h:
{0x6A:0,3},x:32,f:F:21DCFN
;Active FAT 0 1 0 � 1st, 1 � 2nd
;Volume Dirty 1 1 0 � Clean, 1 - Dirty
;Media Failure 2 1 0 � No Failures, 1 � Failures Reported
;Clear to Zero 3 1 No Meaning
;Reserved 4 12
=
x:1,f:BytesPerSectorPow
{0x6C,1},x:25,f:%u
=
x:1,f:SectorsPerClusterPow
{0x6D,1},x:25,f:%u
=
x:1,f:NumberOfFATS
{0x6E,1},x:25,f:%u
=
x:1,f:DriveSelect
{0x6F,1},x:25,f:%02X
x:27,f:h
=
x:1,f:PercentInUse
{0x6F,1},x:25,f:%u
;=
;{0x71,7}Reserved
;{0x78,390}BS_Code
=
x:1,f:BS_ExtSign (0xAA55)
{0x1FE,2},x:25,f:%04X
x:29,f:h

[exFAT Dir Entries]

guid:{4496390b-27f1-a0f9-35bd-e144918e7ed0}
flow:1
WHILE $OFFSET+32<=$RECSIZE
$10:=0
IF NOT {0x00:7,1}
$10:=10 ;grayed
ENDIF
{0x00,1},x:1,c:$10,f:%02X
x:3,f:h
IF NOT {0x00:7,1}
x:4,c:$10,f:x
ENDIF
IF {0x00:0,7}=1
;BITMAP
$OPENFILERECOFS:=$OFFSET
x:5,f:BITMAP #:
{0x01,1},x:15,c:$10,f:F:21
x:47,f:cl:
{0x14,4},x:50,c:$10,f:%u
x:61,f:size:
{0x18,8},x:67,c:$10,f:%u
ELSEIF {0x00:0,7}=2
;UPCASE
$OPENFILERECOFS:=$OFFSET
x:5,c:$10,f:UPCASE:
x:12,f:CS:
{0x04,4},x:15,c:$10,f:%08X
x:23,c:$10,f:h
x:47,f:cl:
{0x14,4},x:50,c:$10,f:%u
x:61,f:size:
{0x18,8},x:67,c:$10,f:%u
ELSEIF {0x00:0,7}=3
;VOLLABEL
x:5,f:LABEL len:
{0x01,1},x:15,c:$10,f:%u
x:20,f:name:
$1:={0x01,1}<<1
IF $1>30
$1:=30
ENDIF
{0x02,$1},x:25,c:$10,f:U
ENDIF
IF {0x00:0,7}=5
$OPENFILERECOFS:=$OFFSET
x:5,f:#
{0x01,1},x:6,c:$10,f:%u
x:10,f:csum:
{0x02,2},x:15,c:$10,f:%04X
x:19,c:$10,f:h
x:29,f:attrs:
{0x04,1},x:35,c:$10,f:F:R-H-S-V-D-A-+-+-

;Creation Time:
;{0x0A:9,7},x:64,f:-%03u
;x:67,f:-
;{0x0A:5,4},x:68,f:-%02u
;x:70,f:-
;{0x0A:0,5},x:71,f:-%02u
;{0x08:11+5},x:74,f:-%02u
 ;x:76,f::
;{0x08:5,6},x:77,f:-%02u
;x:79,f::
;{0x08:0,5}<<1,x:80,f:-%02u
;x:82,f:.
;{0x0D,1},x:83,f:%02u
ENDIF
IF {0x00:0,7}=0x40
IF $OFFSET>=32
$OPENFILERECOFS:=$OFFSET-32
ELSE
$OPENFILERECOFS:=$OFFSET
ENDIF
x:5,f:F
{0x01,1},x:6,c:$10,f:F:+-+-
x:10,f:nlen:
{0x03,1},x:15,c:$10,f:%u
x:18,f:hash:
{0x04,2},x:23,c:$10,f:%04X
x:27,f:h
x:29,f:size:
{0x08,8},x:34,c:$10,f:%u
x:47,f:cl:
{0x14,4},x:50,c:$10,f:%u
x:61,f:alloc:
{0x18,8},x:67,c:$10,f:%u
ENDIF
IF {0x00:0,7}=0x41
x:5,f:F
{0x01,1},x:6,c:$10,f:F:+-+-
x:10,f:name:
{0x02,30},x:15,c:$10,f:U
ENDIF
=
$OFFSET:=$OFFSET+32
ENDWHILE

[HFS Volume Header]

guid:{f40f1a35-fe5d-19c5-3e94-a10992273292}
big-endian:1
o:1

x:1,f:signature
{0x00,2},x:25,f:C
=
x:1,f:version
{0x02,2},x:25,f:%u
=
x:1,f:attributes
{0x04,4},x:25,f:%08X
x:33,f:h
=
x:1,f:lastMountedVersion
{0x08,4},x:25,f:C
=
x:1,f:journalInfoBlock
{0x0C,4},x:25,f:%u
; UInt32 createDate;
; UInt32 modifyDate;
; UInt32 backupDate;
; UInt32 checkedDate;

=
x:1,f:fileCount
{0x20,4},x:25,f:%u
=
x:1,f:folderCount
{0x24,4},x:25,f:%u
=
x:1,f:blockSize
{0x28,4},x:25,f:%u
=
x:1,f:totalBlocks
{0x2C,4},x:25,f:%u
=
x:1,f:freeBlocks
{0x30,4},x:25,f:%u
=

x:1,f:nextAllocation
{0x34,4},x:25,f:%u
=
x:1,f:rsrcClumpSize
{0x38,4},x:25,f:%u
=
x:1,f:dataClumpSize
{0x3C,4},x:25,f:%u
=
x:1,f:nextCatalogID
{0x40,4},x:25,f:%u

=
x:1,f:writeCount
{0x44,4},x:25,f:%u
=
x:1,f:encodingsBitmap
{0x48,8},x:25,f:%u
=
$OFFSET:=0x50
$63:=TOGGLE:$OFFSET,x:1
x:5,f:finderInfo
IF $63
$1:=0;
WHILE $OFFSET<0x68
=
x:5,f:finderInfo[
$1,x:16,f:%u]
{0x00,4},x:25,f:%u
$OFFSET:=$OFFSET+4
$1:=$1+1
ENDWHILE
ENDIF
=
$OFFSET:=0
x:1,f:volume identifier
{0x68,4},x:25,f:%08X
x:33,f:-
{0x6C,4},x:34,f:%08X
$1:=0x70
WHILE $1<0x200
=
$OFFSET:=$1
$63:=TOGGLE:$OFFSET,x:1
IF $1==0x70
x:5,f:allocationFile
ELSEIF $1==0xC0
x:5,f:extentsFile
ELSEIF $1==0x110
x:5,f:catalogFile
ELSEIF $1==0x160
x:5,f:attributesFile
ELSEIF $1==0x1B0
x:5,f:startupFile
ENDIF

IF NOT $63
{0x00,8},x:25,f:%u
ELSE
=
x:5,f:logicalSize
{0x00,8},x:25,f:%u
=
x:5,f:clumpSize
{0x08,4},x:25,f:%u
=
x:5,f:totalBlocks
{0x0c,4},x:25,f:%u
=
$OFFSET:=$OFFSET+0x10
$63:=TOGGLE:$OFFSET,x:5
x:9,f:extents
IF NOT $63
$OPENCLUSTER:={0x00,4},x:25,f:%u
ELSE
$2:=0
WHILE $2<8
=
x:9,f:startBlock:
$OPENCLUSTER:={0x00,4},x:25,f:%u
x:35,f:blockCount:
{0x04,4},x:51,f:%u
$OFFSET:=$OFFSET+8
$2:=$2+1
ENDWHILE
ENDIF
ENDIF
$1:=$1+0x50
ENDWHILE

[HFS Catalog Nodes]

guid:{8c5be8bc-d060-0d6d-d76f-fc081e1d9187}
big-endian:1
flow:1

CALCSIZESTART
IF $1<=0
 ;recsize is not given
IF $RECSIZE<4096
$RECSIZE:=4096
ENDIF
ENDIF
CALCSIZEEND

;BTNodeDescriptor
x:1,f:fLink >
$GOTOREC:={0x00,4},x:25,f:%u
=
x:1,f:bLink >
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:kind
$9:={0x08,1},x:25,f:%u
IF $9==0xff
x:32,f:kBTLeafNode
ELSEIF $9==0
x:32,f:kBTIndexNode
ELSEIF $9==1
x:32,f:kBTHeaderNode
ELSEIF $9==2
x:32,f:kBTMapNode
ELSE
x:32,c:8,f:Unknown
ENDIF
=
x:1,f:height
{0x09,1},x:25,f:%u
=
x:1,f:numRecords
{0x0A,2},x:25,f:%u
=
x:1,f:reserved
{0x0C,2},x:25,f:%u
=
$2:=0x0E
$12:=$RECSIZE-2
;num records:
$13:={0x0A,2}

WHILE $2<$RECSIZE AND $13>0

$13:=$13-1
x:1,f:==========
=
$OFFSET:=$2-2
IF $9==0
x:1,f:keyLength
$1:={0x02,2},x:25,f:%u
IF $1==0
BREAK
ENDIF
=
x:1,f:parentID >
$OPENFILENUM:={0x04,4},x:25,f:%u
=
x:1,f:nodeName
$8:={0x08,2},x:25,f:%u
 $8:=$8*2
IF $8>510
$8:=510
ENDIF
{0x0A,$8},x:32,f:U
=
$OFFSET:=$OFFSET+$1+4
x:1,f:Node Number >
$GOTOREC:={0x00,4},x:25,f:%u
=
ELSEIF $9==1
;BTHeaderRec
x:1,f:treeDepth
{0x02,2},x:25,f:%u
=
x:1,f:rootNode >
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:leafRecords
{0x08,4},x:25,f:%u
=
x:1,f:firstLeafNode >
$GOTOREC:={0x0C,4},x:25,f:%u
=
x:1,f:LastLeafNode >
$GOTOREC:={0x10,4},x:25,f:%u
=
x:1,f:nodeSize
{0x14,2},x:25,f:%u
=
x:1,f:maxKeyLength
{0x16,2},x:25,f:%u
=
x:1,f:totalNodes
{0x18,4},x:25,f:%u
=
x:1,f:freeNodes
{0x1C,4},x:25,f:%u
=
x:1,f:reserved1
{0x20,2},x:25,f:%u
=
x:1,f:clumpSize
{0x22,4},x:25,f:%u
=
x:1,f:btreeType
{0x26,1},x:25,f:%u
=
x:1,f:keyCompareType
{0x27,1},x:25,f:%X
x:27,f:h
=
x:1,f:attributes
{0x28,4},x:25,f:%08X
x:33,f:h
;UInt32 reserved3[16]
BREAK
ELSE
x:1,f:keyLength
 $1:={0x02,2},x:25,f:%u
IF $1==0
BREAK
ENDIF
=
x:1,f:parentID >
$OPENFILENUM:={0x4,4},x:25,f:%u
=
x:1,f:nodeName
$8:={0x8,2},x:25,f:%u
$8:=$8*2
IF $8>510
$8:=510
ENDIF
{0x0A,$8},x:32,f:U
IF $OFFSET+$1+4>=$RECSIZE
BREAK
ENDIF
=
$OFFSET:=$OFFSET+$1+4
$63:=TOGGLE:$OFFSET,x:1
x:5,f:recordType
$7:={0x00,2},x:25,f:%u
IF $7==1
;HFSPlusCatalogFolder
x:32,f:HFSPlusCatalogFolder
=
IF $63
x:5,f:flags
{0x02,2},x:25,f:%X
x:34,f:h
=
x:5,f:valence
{0x04,4},x:25,f:%X
x:38,f:h
=
x:5,f:folderID >
$OPENFILENUM:={0x08,4},x:25,f:%u
=
x:5,f:createDate
{0x0C,4},x:25,f:%u
=
x:5,f:contentModDate
{0x10,4},x:25,f:%u
=
x:5,f:attributeModDate
{0x14,4},x:25,f:%u
=
x:5,f:accessDate
{0x18,4},x:25,f:%u
=
x:5,f:backupDate
{0x1C,4},x:25,f:%u
=
; {0x20,0x10}
; HFSPlusBSDInfo permissions;
; HFSPlusBSDInfo {
; UInt32 ownerID;
; UInt32 groupID;
; UInt8 adminFlags;
; UInt8 ownerFlags;
; UInt16 fileMode;
; union {
; UInt32 iNodeNum;
; UInt32 linkCount;
; UInt32 rawDevice;
; } special;

; {0x30,0x10}
; FolderInfo userInfo;
;struct FolderInfo {
; Rect windowBounds; /* The position and dimension of the folder's
window */
; UInt16 finderFlags;
; Point location; /* Folder's location in the parent */
; /* folder. If set to {0, 0}, the Finder */
; /* will place the item automatically */
; UInt16 reservedField;
;};

; {0x40,0x10}
; ExtendedFolderInfo finderInfo;
;struct ExtendedFolderInfo {
; Point scrollPosition; /* Scroll position (for icon views) */
; SInt32 reserved1;
; UInt16 extendedFinderFlags;
; SInt16 reserved2;
; SInt32 putAwayFolderID;
;};
x:5,f:textEncoding
{0x50,4},x:25,f:%u
=
; UInt32 reserved;
ENDIF
ELSEIF $7==2
;HFSPlusCatalogFile
x:32,f:HFSPlusCatalogFile >
$OPENFILERECOFS:=$2
=
IF $63
x:5,f:flags
{0x02,2},x:25,f:%X
x:34,f:h
=
x:5,f:reserved1
{0x04,4},x:25,f:%X
x:33,f:h
=
x:5,f:fileID >
$OPENFILENUM:={0x08,4},x:25,f:%u
=
x:5,f:createDate
{0x0C,4},x:25,f:%u
=
x:5,f:contentModDate
{0x10,4},x:25,f:%u
=
x:5,f:attributeModDate
 {0x14,4},x:25,f:%u
=
x:5,f:accessDate
{0x18,4},x:25,f:%u
=
x:5,f:backupDate
{0x1C,4},x:25,f:%u
=
; {0x20,0x10}
; HFSPlusBSDInfo permissions;
; HFSPlusBSDInfo {
; UInt32 ownerID;
; UInt32 groupID;
; UInt8 adminFlags;
; UInt8 ownerFlags;
; UInt16 fileMode;
; union {
; UInt32 iNodeNum;
; UInt32 linkCount;
; UInt32 rawDevice;
; } special;

; {0x30,0x10}
; FileInfo userInfo;
;struct FileInfo {
; OSType fileType; /* The type of the file */
; OSType fileCreator; /* The file's creator */
; UInt16 finderFlags;
; Point location; /* File's location in the folder. */
; UInt16 reservedField;
;};

; {0x40,0x10}
; ExtendedFileInfo finderInfo;
;struct ExtendedFileInfo {
; SInt16 reserved1[4];
; UInt16 extendedFinderFlags;
; SInt16 reserved2;
; SInt32 putAwayFolderID;
;};

x:5,f:textEncoding
{0x50,4},x:25,f:%u
=
; {0x54}
; UInt32 reserved2;

; {0x58}
; HFSPlusForkData dataFork;
; HFSPlusForkData resourceFork;
$4:=$OFFSET+0x58
$3:=0
WHILE $3<2
$OFFSET:=$4
$63:=TOGGLE:$OFFSET,x:1
IF $3==0
x:5,f:dataFork
ELSE
x:5,f:resourceFork
 ENDIF

IF NOT $63
{0x00,8},x:25,f:%u
$OPENCLUSTER:={0x10,4}
ELSE
=
x:5,f:logicalSize
{0x00,8},x:25,f:%u
=
x:5,f:clumpSize
{0x08,4},x:25,f:%u
=
x:5,f:totalBlocks
{0x0c,4},x:25,f:%u
=
$OFFSET:=$OFFSET+0x10
$63:=TOGGLE:$OFFSET,x:5
x:9,f:extents
IF NOT $63
$OPENCLUSTER:={0x00,4},x:25,f:%u
ELSE
$5:=0
WHILE $5<8
=
x:9,f:startBlock:
$OPENCLUSTER:={0x00,4},x:25,f:%u
x:35,f:blockCount:
{0x04,4},x:51,f:%u
$OFFSET:=$OFFSET+8
$5:=$5+1
ENDWHILE
ENDIF
ENDIF
=
$4:=$4+0x50
$3:=$3+1
ENDWHILE
ENDIF
ELSEIF ($7==3) OR ($7==4)
;HFSPlusCatalogThread
IF ($7==3)
x:32,f:HFSPlusFolderThreadRec
ELSE
x:32,f:HFSPlusFileThreadRec
ENDIF
=
x:5,f:reserved
{0x02,2},x:25,f:%X
x:29,f:h
=
x:5,f:parentID >
$OPENFILENUM:={0x04,4},x:25,f:%u
=
x:5,f:nodeName
$8:={0x8,2},x:25,f:%u
$8:=$8*2
IF $8>510
$8:=510
 ENDIF
{0x0A,$8},x:32,f:U
=
ELSE
x:32,f:Unknown Record Type
=
ENDIF
ENDIF
$2:=$2+$1
$12:=$12-2
$OFFSET:=0
IF {$12,2}<=$2
BREAK
ENDIF
$2:={$12,2}
ENDWHILE

[HFS Extents Nodes]

guid:{95b010bd-e409-fd86-764a-ea95e78bf763}
big-endian:1
flow:1

;BTNodeDescriptor
x:1,f:fLink >
$GOTOREC:={0x00,4},x:25,f:%u
=
x:1,f:bLink >
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:kind
$9:={0x08,1},x:25,f:%u
IF $9==0xff
x:32,f:kBTLeafNode
ELSEIF $9==0
x:32,f:kBTIndexNode
ELSEIF $9==1
x:32,f:kBTHeaderNode
ELSEIF $9==2
x:32,f:kBTMapNode
ELSE
x:32,c:8,f:Unknown
ENDIF
=
x:1,f:height
{0x09,1},x:25,f:%u
=
x:1,f:numRecords
{0x0A,2},x:25,f:%u
=
x:1,f:reserved
{0x0C,2},x:25,f:%u
=
$2:=0x0E
$12:=$RECSIZE-2
;records num:
$13:={0x0A,2}

WHILE $2<$RECSIZE AND $13>0

$13:=$13-1
x:1,f:==========
=
$OFFSET:=$2-2
IF $9==1
;BTHeaderRec
x:1,f:treeDepth
{0x02,2},x:25,f:%u
=
x:1,f:rootNode >
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:leafRecords
{0x08,4},x:25,f:%u
=
x:1,f:firstLeafNode >
$GOTOREC:={0x0C,4},x:25,f:%u
=
x:1,f:LastLeafNode >
$GOTOREC:={0x10,4},x:25,f:%u
=
x:1,f:nodeSize
{0x14,2},x:25,f:%u
=
x:1,f:maxKeyLength
{0x16,2},x:25,f:%u
=
x:1,f:totalNodes
{0x18,4},x:25,f:%u
=
x:1,f:freeNodes
{0x1C,4},x:25,f:%u
=
x:1,f:reserved1
{0x20,2},x:25,f:%u
=
x:1,f:clumpSize
{0x22,4},x:25,f:%u
=
x:1,f:btreeType
{0x26,1},x:25,f:%u
=
x:1,f:keyCompareType
{0x27,1},x:25,f:%X
x:27,f:h
=
x:1,f:attributes
{0x28,4},x:25,f:%08X
x:33,f:h
;UInt32 reserved3[16]
BREAK
ELSE
x:1,f:keyLength
$1:={0x02,2},x:25,f:%u
IF $1==0
BREAK
ENDIF
=
x:1,f:forkType
{0x04,1},x:25,f:%u
 =
x:1,f:pad
{0x05,1},x:25,f:%u
=
x:1,f:fileID >
$OPENFILENUM:={0x06,4},x:25,f:%u
=
x:1,f:startBlock
{0x0A,4},x:25,f:%u
=
$OFFSET:=$OFFSET+$1+4
IF $9==1
x:1,f:Node Number >
$GOTOREC:={0x00,4},x:25,f:%u
=
ELSE

$63:=TOGGLE:$OFFSET,x:5
x:9,f:extents
IF NOT $63
$OPENCLUSTER:={0x00,4},x:25,f:%u
ELSE
$5:=0
WHILE $5<8
=
x:9,f:startBlock:
$OPENCLUSTER:={0x00,4},x:25,f:%u
x:35,f:blockCount:
{0x04,4},x:51,f:%u
$OFFSET:=$OFFSET+8
$5:=$5+1
ENDWHILE
ENDIF
=
ENDIF
ENDIF
$2:=$2+1
$12:=$12-2
$OFFSET:=0
IF {$12,2}<=$2
BREAK
ENDIF
$2:={$12,2}
ENDWHILE

[Apple Partition Map]

guid:{8d3ad335-7279-d9c2-7c82-1d013c3da08e}
big-endian:1
flow:1

IF {0x00,2} = 0x4552

;Apple Partition Scheme

x:1,f:signature ("ER")
{0x00,2},x:25,f:C
=
x:1,f:block size
{0x02,2},x:25,f:%u
=
 x:1,f:blocks number
{0x04,4},x:25,f:%u

ELSE

x:1,f:signature ("PM")
{0x00,2},x:25,f:C
=
x:1,f:reserved
{0x02,2},x:25,f:%u
=
x:1,f:partitions number
{0x04,4},x:25,f:%u
=
x:1,f:partition start
{0x08,4},x:25,f:%u
=
x:1,f:partition size
{0x0C,4},x:25,f:%u
=
x:1,f:partition name
{0x10,32},x:25,f:C
=
x:1,f:partition type
{0x30,32},x:25,f:C
=
x:1,f:data start
{0x50,4},x:25,f:%u
=
x:1,f:data size
{0x54,4},x:25,f:%u
=
x:1,f:partition status
{0x58,4},x:25,f:%08X
x:33,f:h
=
x:1,f:boot code start
{0x5C,4},x:25,f:%u
=
x:1,f:boot code size
{0x60,4},x:25,f:%u
=
x:1,f:bootloader code address
{0x64,4},x:25,f:%u
=
x:1,f:reserved
{0x68,4},x:25,f:%u
=
x:1,f:boot code entry point
{0x6C,4},x:25,f:%u
=
x:1,f:reserved
{0x70,4},x:25,f:%u
=
x:1,f:boot code checksum
{0x74,4},x:25,f:%08X
x:33,f:h
=
x:1,f:processor type
 {0x78,16},x:25,f:C

ENDIF

[MBR Partition Table]

fuse:0
x:1,f:Disk identifier (Windows):
=
{0x1B8,4},x:1,f:%08X
x:9,f:h
=
x:1,f:Boot System ID : First : Last : Relative : Number of
=
x:1,f:Flag :Cyl Head Sec:Cyl Head Sec: Sector : Sectors
=
$OFFSET:=0x1BE
LABEL:0
$OPENLBA:={0x08,4}
{0x00,1},x:1,f:%02X
x:3,f:h
{0x04,1},x:7,f:%02X
x:9,f:h
x:19,f::
{0x03,1;0x02:6,2},x:20,f:%4u
{0x01,1},x:25,f:%3u
{0x02:0,6},x:29,f:%2u
x:32,f::
{0x07,1;0x06:6,2},x:33,f:%4u
{0x05,1},x:38,f:%3u
{0x06:0,6},x:42,f:%2u
x:45,f::
{0x08,4},x:46,f:%10u
x:56,f::
{0x0C,4},x:57,f:%10u
=
$OFFSET:=$OFFSET+16
IF $OFFSET<0x1FE
GOTO:0
ENDIF
x:1,f:MBR signature (0xAA55):
=
{0x00,2},x:1,f:%04X
x:5,f:h

[FAT Entries]
fuse:0
flow:1
h: Name Ext Size Cluster Attrs Modified Created
Accessed

LABEL:0
$OPENFILERECOFS:=$OFFSET
IF {00,1}=0xE5
x:0,f:x
$10:=10
ELSE
$10:=0
ENDIF
IF {0x0B:0,4}!=0xF ;Short Name Entry
 {0x00,8},x:01,c:$10,f:C
{0x08,3},x:10,c:$10,f:C
IF {0x0B:4,1}
x:13,f:>
ENDIF
{0x1C,4},x:14,c:$10,f:-%u
{0x1A,2;0x14,2},x:24,c:$10,f:-%u
{0x0B,1},x:35,c:$10,f:F:R-H-S-V-D-A-+-+-
;Modification Time:
{0x16,4},x:44,c:$10,f:DOSDATE
;Creation Time:
{0x0E,4},x:64,c:$10,f:DOSDATE
x:83,f:.
{0x0D,1},x:84,c:$10,f:%02u
;Access Date:
{0x12,2},x:88,c:$10,f:DOSDATE
ELSE
;LFN Entry:
IF {0:7,1}
x:3,f:x
ELSE
{0:0,5},x:2,c:$10,f:-%u
ENDIF
{0:5,3},x:5,c:$10,f:F:+-L-R-
{1,10},x:10,c:$10,f:U
{0x0E,12},x:15,c:$10,f:U
{0x1C,4},x:21,c:$10,f:U
{0x1A,2},x:25,c:$10,f:-%u
{0x0B,1},x:35,c:$10,f:F:R-H-S-V-D-A-+-+-
{0x0D,1},x:45,c:$10,f:%02X
x:47,f:h
ENDIF
=
$OFFSET:=$OFFSET+32
GOTO:0

[extFS HTree Root (dx_root)]

fuse:0
h: Inode ESize NmLen Type Name

$OPENFILENUM:={0x00,4}
{0x00,4},x:1,f:%u
$1:={0x04,2},x:12,f:%u
$2:={0x06,1},x:19,f:%u
{0x07,1},x:25,f:%X
{0x08,$2},x:30,f:C
=
$OFFSET:=$1
$OPENFILENUM:={0x00,4}
{0x00,4},x:1,f:%u
$2:={0x04,2},x:12,f:%u
$3:={0x06,1},x:19,f:%u
{0x07,1},x:25,f:%X
{0x08,$3},x:30,f:C
=
$OFFSET:=0
x:1,f:reserved_zero
{0x18,4},x:20,f:%u
=
x:1,f:hash_version
{0x1C,1},x:20,f:%u
=
x:1,f:info_length (8)
{0x1D,1},x:20,f:%u
=
x:1,f:indirect_levels
{0x1E,1},x:20,f:%u
=
x:1,f:unused_flags
{0x1F,1},x:20,f:%u
=
x:1,f:limit
{0x20,2},x:20,f:%u
=
x:1,f:count
{0x22,2},x:20,f:%u
=
x:30,f:block:
{0x24,4},x:50,f:%u
=

$2:={0x22,2}
$OFFSET:=0x28
WHILE $OFFSET+8<=$RECSIZE
x:1,f:hash:
{0x00,4},x:20,f:%08X
x:30,f:block:
{0x04,4},x:50,f:%u
=
$2:=$2-1
IF $2<=1
BREAK
ENDIF
$OFFSET:=$OFFSET+8
ENDWHILE

[extFS HTree Node (dx_node)]

fuse:0

x:1,f:fake.inode (0)
{0x0,4},x:20,f:%u
=
x:1,f:fake.rec_len
{0x4,2},x:20,f:%u
=
x:1,f:name_len (0)
{0x6,1},x:20,f:%u
=
x:1,f:file_type (0)
{0x7,1},x:20,f:%u
=
x:1,f:limit
{0x8,2},x:20,f:%u
=
x:1,f:count
{0xA,2},x:20,f:%u
=
x:1,f:block
{0xC,4},x:20,f:%u
=
$2:={0xA,2}
$OFFSET:=0x10
WHILE $OFFSET+8<=$RECSIZE
x:1,f:hash:
{0x00,4},x:20,f:%08X
x:30,f:block:
{0x04,4},x:50,f:%u
=
$2:=$2-1
IF $2<=0
BREAK
ENDIF
$OFFSET:=$OFFSET+8
ENDWHILE

[ReFS Volume Header]

guid:{b0e7a24d-7796-1e8f-c782-fb752e970447}

x:1,f:FSName
{0x03,8},x:25,f:C
=
x:1,f:Identifier
{0x10,4},x:25,f:%08X
=
x:1,f:LBASize
{0x18,8},x:25,f:%u
=
x:1,f:BytesPerSec
{0x20,4},x:25,f:%u
=
x:1,f:SecPerClus
{0x24,4},x:25,f:%u
=

[ReFS Superblock]
guid:{9b4d6f1e-5d3d-924d-c220-2cce1c7f9173}

$XOFS:=1
IF {0x00,4}=0x42505553
x:0,f:Node Signature
{0x00,0x0c},x:18,f:CXm
=
x:0,f:Volume Signature 0x
{0x0c,4},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x10,8},x:24,f:%X
=
x:0,f: 0x
{0x18,8},x:24,f:%X
=
x:0,f:Cluster Number [0..3] 0x
{0x20,8},x:24,f:%X
{0x28,8},x:42,f:%X
{0x30,8},x:60,f:%X
{0x38,8},x:78,f:%X
=
 x:0,f:Object Id 0x
{0x40,8},x:24,f:%X
x:40,f:-
{0x48,8},x:42,f:%X
=
$3:=0xC0
$4:=1
ELSE
x:0,f:Page Number (Cluster) 0x
{0x00,8},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x08,8},x:24,f:%X
=
x:0,f:Object Id 0x
{0x10,8},x:24,f:%X
x:40,f:-
{0x18,8},x:42,f:%X
=
$3:=0xA0
$4:=0
ENDIF

x:0,f:FS Descr. Page 1 > 0x

$OPENTEMPLATE:='{cdb0fa46-17bb-d839-15c5-8b7d9f75e0e2}'
$OPENCLUSTER:={$3,8},x:24,f:%X
=
x:0,f:FS Descr. Page 2 > 0x
$OPENTEMPLATE:='{cdb0fa46-17bb-d839-15c5-8b7d9f75e0e2}'
$3:=$3+8
$OPENCLUSTER:={$3,8},x:24,f:%X

[ReFS Descriptors]
guid:{cdb0fa46-17bb-d839-15c5-8b7d9f75e0e2}

$RECSIZE:=16384
$XOFS:=1
IF {0x00,4}=0x504b4843
x:0,f:Node Signature
{0x00,0x0c},x:18,f:CXm
=
x:0,f:Volume Signature 0x
{0x0c,4},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x10,8},x:24,f:%X
=
x:0,f: 0x
{0x18,8},x:24,f:%X
=
x:0,f:Cluster Number [0..3] 0x
{0x20,8},x:24,f:%X
{0x28,8},x:42,f:%X
{0x30,8},x:60,f:%X
{0x38,8},x:78,f:%X
=
x:0,f:Object Id 0x
{0x40,8},x:24,f:%X
x:40,f:-
 {0x48,8},x:42,f:%X
=
$3:=0x90
$4:=1
ELSE
x:0,f:Page Number (Cluster) 0x
{0x00,8},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x08,8},x:24,f:%X
=
x:0,f:Object Id 0x
{0x10,8},x:24,f:%X
x:40,f:-
{0x18,8},x:42,f:%X
;=
;x:0,f:Descr Offset 0x
;$1:={0x38,4},x:24,f:%X
=
$3:=0x58
$4:=0
ENDIF
x:0,f:Descriptors Number
$1:={$3,4},x:24,f:%u
=
$2:=$3+4
$11:=$1
$12:=$2
$63:=TOGGLE:$OFFSET,x:0,f:Offsets
=
IF $63
WHILE $1>0
$11-$1,x:2,f:%2u:
$3:={$2,4},x:6,f:%X
$2:=$2+4
$1:=$1-1
IF $2+4>$RECSIZE
BREAK
ENDIF
=
ENDWHILE
ENDIF
$1:=$11
$2:=$12
WHILE $1>0
$11-$1,x:2,f:%2u:
$3:={$2,4}
IF $3+8>$RECSIZE OR $3<0x5C
x:6,c:8,f:Wrong Offs.
ELSE
x:6,f:>
IF $4
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
ELSE
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
ENDIF
$OPENCLUSTER:={$3,8},x:8,f:%X
IF $4
$5:=$3+8
 {$5,8},x:24,f:%X
$5:=$5+8
{$5,8},x:40,f:%X
$5:=$5+8
{$5,8},x:56,f:%X
ENDIF
ENDIF
$2:=$2+4
$1:=$1-1
IF $2+4>$RECSIZE
BREAK
ENDIF
=
ENDWHILE

[ReFSv1 Node]
guid:{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}

$RECSIZE:=0x4000
$XOFS:=1
x:0,f:Page Number (Cluster) 0x
{0x00,8},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x08,8},x:24,f:%X
=
x:0,f:Object Id > 0x
{0x10,8},x:24,f:%X
x:40,f:-
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={0x18,8},x:42,f:%X
$60:={0x18,8}
=
x:0,f:[0x20]: 0x
{0x20,8},x:24,f:CX
=
x:0,f:[0x28]: 0x
{0x28,8},x:24,f:CX
=
$OFFSET:=0x30
$63:=TOGGLE:$OFFSET,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2>$RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF

$10:=$OFFSET+$2
IF $2>=4 AND $10+4<=$RECSIZE
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
 IF $OFFSET+$2>$RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSEIF $2<28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2>=28 AND $OFFSET+28<=$RECSIZE
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets > 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:End Offset 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF

$1:={0x10,4}
$3:={0x14,4}
$4:=$OFFSET
WHILE $3>0 AND $4+$1+4<=$RECSIZE
$XOFS:=1
$OFFSET:=$4

x:0,f:[0x
$OFFSET+$1,x:3,f:%X]

$2:={$1,4}
$1:=$1+4

x:9,f:0x
$2,x:11,f:%X:

$2:=$OFFSET+$2
IF $2+24>$RECSIZE
x:18,c:8,f:Error Offset
=
 $3:=$3-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$9:={0,4}
IF $OFFSET+$9>$RECSIZE
$9:=$RECSIZE-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X

;Key Offs
$7:={4,2}
;Key Size
$8:={6,2}

IF $8 AND $7>=$9
$8:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $8 AND $7+$8>$9
$8:=$9-$7
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X

;Flags
{8,2},x:44,f:%X

;Value Offs
$5:={0x0A,2}
;Value Size
$6:={0x0C,4}

IF $6 AND $5>=$9
$10:=8
$6:=0
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $6 AND $5+$6>$9
$6:=$9-$5
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
IF $8>=4 AND {$7,4}=0x010030
$OPENFILERECOFS:=$OFFSET
x:6,f:>
ENDIF
=
IF $8
$10:=$7+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$7,$8},x:12,f:CXm
ELSEIF {$7,2}=0x0030
$2:=$7+4;
$10:=$8-4;
{$2,$10},x:18,f:U
ELSEIF $8=16 AND NOT {$7,8}
x:12,f:Obj. Id > 0x
{$7,8},x:24,f:%X
x:40,f:-
$10:=$7+8
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$10,8},x:42,f:%X
ELSE
$10:=$8
IF $10>16
$10:=16
ENDIF
{$7,$10},x:12,f:CXm
ENDIF
=
ENDIF

IF NOT $6
$3:=$3-1
CONTINUE
ENDIF
$10:=$5+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $8>=4 AND ({$7,4}=0x010030 OR {$7,4}=0x0160) OR $8=4 AND {$7,4}=0x10
$59:=1
ELSEIF $8=4 AND {$7,4}=0x10000000
$59:=2
ELSE
$59:=0
ENDIF
IF $63 AND $59=1 AND $6>=0x20 AND {$5,4}>0 AND {$5,4}<=$6
=
$XOFS:=7
$OFFSET:=$OFFSET+$5
$12:=$OFFSET+$6

$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2>$12
$2:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2>=4 AND $10+4<=$12
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2>$12
$2:=$12-$OFFSET
$10:=8
ELSEIF $2<28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2>=28 AND $OFFSET+28<=$12
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets > 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:End Offset 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF

$21:={0x10,4}
$23:={0x14,4}
$24:=$OFFSET

WHILE $23>0 AND $24+$21+4<=$12

$XOFS:=7
$OFFSET:=$24

x:0,f:[0x
$OFFSET+$21,x:3,f:%X]

$2:={$21,4}
$21:=$21+4
x:9,f:0x
$2,x:11,f:%X:

$2:=$OFFSET+$2
IF $2+24>$12
x:18,c:8,f:Error Offset
=
$23:=$23-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$29:={0,4}
IF $OFFSET+$29>$12
$29:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X

;Key Offs
$27:={4,2}
;Key Size
$28:={6,2}

IF $28 AND $27>=$29

$28:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $28 AND $27+$28>$29
$28:=$29-$27
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X

;Flags
{8,2},x:44,f:%X

;Value Offs
$25:={0x0A,2}
;Value Size
$26:={0x0C,4}

IF $26 AND $25>=$29

$26:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $26 AND $25+$26>$29
$26:=$29-$25
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $28
$10:=$27+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$27,$28},x:12,f:CXm
ELSE
$10:=$28
IF $10>16
$10:=16
ENDIF
{$27,$10},x:12,f:CXm
ENDIF
=
ENDIF

IF NOT $26
$23:=$23-1
CONTINUE
ENDIF
$10:=$25+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $63 AND $59=1 AND $26>=0x20 AND {$25,4}>0 AND {$25,4}<=$26
=
$XOFS:=13
$OFFSET:=$OFFSET+$25
$32:=$OFFSET+$26

$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2>$32
$10:=8
$2:=$32-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF

$10:=$OFFSET+$2
IF $2>=4 AND $10+4<=$32
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2>$32
$10:=8
$2:=$32-$OFFSET
ELSEIF $2<28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
 =
ELSE
$2:=0
ENDIF
IF $2>28 AND $OFFSET+28<=$32
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets > 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:End Offset 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF

$41:={0x10,4}
$43:={0x14,4}
$44:=$OFFSET

WHILE $43>0 AND $44+$41+4<=$32

$OFFSET:=$44

x:0,f:[0x
$OFFSET+$41,x:3,f:%X]

$2:={$41,4}
$41:=$41+4

x:9,f:0x
$2,x:11,f:%X:

$2:=$OFFSET+$2
IF $2+44>$32
x:18,c:8,f:Error Offset
=
$43:=$43-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$49:={0,4}
IF $OFFSET+$49>$32
 $49:=$32-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X

;Key Offs
$47:={4,2}
;Key Size
$48:={6,2}

IF $48 AND $47>=$49

$48:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $48 AND $47+$48>$49
$48:=$49-$47
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X

;Flags
{8,2},x:44,f:%X

;Value Offs
$45:={0x0A,2}
;Value Size
$46:={0x0C,4}

IF $46 AND $45>=$49

$46:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $46 AND $45+$46>$49
$46:=$49-$45
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $48
$10:=$47+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$47,$48},x:12,f:CXm
ELSE
$10:=$48
IF $10>16
$10:=16
ENDIF
{$47,$10},x:12,f:CXm
ENDIF
=
 ENDIF

IF NOT $46
$43:=$43-1
CONTINUE
ENDIF
$10:=$OFFSET+$45
$63:=TOGGLE:$10,x:2,f:Value
$10:=$45+8
IF $63
{$45,$46},x:12,f:CXm
ELSEIF NOT $48 OR ($46=0x18) AND {$45,8} AND {$10,8}=0x0808020000
IF $46>=0x8
x:12,f:Page > 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENCLUSTER:={$45,8},x:24,f:%X
ENDIF
ELSE
IF $46>=0x18
$10:=$45+0x10
x:12,f:Cluster > 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
=
$43:=$43-1
ENDWHILE

$XOFS:=13
$OFFSET:=$44
$41:={0x10,4}
$43:={0x14,4}
IF $43>0 AND $41+4<=$32
$10:=$OFFSET+$41
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $43>0 AND $41+4<=$32
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f:> 0x
$GOTORECOFS:=$OFFSET+{$41,4}
{$41,4},x:16,f:%X
$41:=$41+4
$43:=$43-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$25,$26},x:12,f:CXm
ELSE
$10:=$25+8
$11:=$27+8
IF NOT $28 AND $26>=0x8 OR $26=0x18 AND {$25,8} AND
{$10,8}=0x0808020000
x:12,f:Page > 0x
 $OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENCLUSTER:={$25,8},x:24,f:%X
ELSEIF $28=0x0E AND {$11,6}=0x38 AND $26>=0x60 AND {$25,4}=0
$10:=$25+0x0C
x:12,f:Obj. Id > 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$25+0x5E
$11:=$25+0x54
$11:={$11,1}*2
IF 0x5E+$11>$26
$11:=$26-0x5E
ENDIF
{$10,$11},x:18,f:U
ELSEIF $28=0x10
IF $26>=0x18
$10:=$25+0x10
x:12,f:Cluster > 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
ENDIF
=
$23:=$23-1
ENDWHILE

$XOFS:=7
$OFFSET:=$24
$21:={0x10,4}
$23:={0x14,4}
IF $23>0 AND $21+4<=$12
$10:=$OFFSET+$21
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $23>0 AND $21+4<=$12
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f:> 0x
$GOTORECOFS:=$OFFSET+{$21,4}
{$21,4},x:16,f:%X
$21:=$21+4
$23:=$23-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$5,$6},x:12,f:CXm
ELSE
$10:=$5+8
$11:=$7+8
IF $8>=2 AND {$7,2}=0x0510
x:12,f:Label:
{$5,$6},x:18,f:U
ELSEIF $8>=4 AND {$7,4}=0x020030 AND $6>=0x20
 x:12,f:Obj. Id > 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$5,8},x:24,f:%X
ELSEIF $60=2 OR $60=0x0C OR (NOT $59 OR $6=0x18) AND {$5,8} AND $6>=0x10 AND
{$10,8}=0x0808020000
x:12,f:Page > 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENCLUSTER:={$5,8},x:24,f:%X
ELSEIF $60>=0x500 AND $8=0x0E AND {$11,6}=0x38 AND $6>=0x60 AND {$5,4}=0
$10:=$5+0x0C
x:12,f:Obj. Id > 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$5+0x5E
$11:=$5+0x54
$11:={$11,1}*2
IF 0x5E+$11>$6
$11:=$6-0x5E
ENDIF
{$10,$11},x:18,f:U
ENDIF
=
ENDIF
$3:=$3-1
ENDWHILE

$XOFS:=1
$OFFSET:=$4
$1:={0x10,4}
$3:={0x14,4}
IF $3>0 AND $1+4<=$RECSIZE
$10:=$OFFSET+$1
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $3>0 AND $1+4<=$RECSIZE
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f:> 0x
$GOTORECOFS:=$OFFSET+{$1,4}
{$1,4},x:16,f:%X
$1:=$1+4
$3:=$3-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF

[ReFSv3 Node]
guid:{2bf504cd-5185-ff23-a9bc-929a1abdcf79}

$RECSIZE:=0x4000

CALCSIZESTART
IF $1>=0x4000
$RECSIZE:=$1
 ELSE
;recsize is not given
$10:=0x50+{0x50,4}+0x10
IF {$10,4}>=0x4000
$RECSIZE:=0x10000
ENDIF
ENDIF
CALCSIZEEND

$XOFS:=1
x:0,f:Node Signature
{0x00,0x0c},x:18,f:CXm
=
x:0,f:Volume Signature 0x
{0x0c,4},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x10,8},x:24,f:%X
=
x:0,f: 0x
{0x18,8},x:24,f:%X
=
x:0,f:Cluster Number [0..3] 0x
{0x20,8},x:24,f:%X
{0x28,8},x:42,f:%X
{0x30,8},x:60,f:%X
{0x38,8},x:78,f:%X
=
x:0,f:Object Id > 0x
{0x40,8},x:24,f:%X
x:40,f:-
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={0x48,8},x:42,f:%X
$60:={0x48,8}
=
$OFFSET:=0x50
$63:=TOGGLE:$OFFSET,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2>$RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF

$10:=$OFFSET+$2
IF $2>=4 AND $10+4<=$RECSIZE
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2>$RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSEIF $2<28
 $10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2>=28 AND $OFFSET+28<=$RECSIZE
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets > 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:[0x18] 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF

$1:={0x10,4}
$3:={0x14,4}
$4:=$OFFSET
WHILE $3>0 AND $4+$1+4<=$RECSIZE
$XOFS:=1
$OFFSET:=$4

x:0,f:[0x
$OFFSET+$1,x:3,f:%X]

$2:={$1,2}
$1:=$1+4

x:9,f:0x
$2,x:11,f:%X:

$2:=$OFFSET+$2
IF $2+24>$RECSIZE
x:18,c:8,f:Error Offset
=
$3:=$3-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$9:={0,4}
IF $OFFSET+$9>$RECSIZE
$9:=$RECSIZE-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X

;Key Offs
$7:={4,2}
;Key Size
$8:={6,2}

IF $8 AND $7>=$9
$8:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $8 AND $7+$8>$9
$8:=$9-$7
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X

;Flags
{8,2},x:44,f:%X

;Value Offs
$5:={0x0A,2}
;Value Size
$6:={0x0C,4}

IF $6 AND $5>=$9
$10:=8
$6:=0
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $6 AND $5+$6>$9
$6:=$9-$5
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
IF $8>=4 AND {$7,4}=0x010030
$OPENFILERECOFS:=$OFFSET
x:6,f:>
ENDIF
=
IF $8
$10:=$7+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
 {$7,$8},x:12,f:CXm
ELSEIF {$7,2}=0x0030
$2:=$7+4;
$10:=$8-4;
{$2,$10},x:18,f:U
ELSEIF $8=16 AND NOT {$7,8}
x:12,f:Obj. Id > 0x
{$7,8},x:24,f:%X
x:40,f:-
$10:=$7+8
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={$10,8},x:42,f:%X
ELSE
$10:=$8
IF $10>16
$10:=16
ENDIF
{$7,$10},x:12,f:CXm
ENDIF
=
ENDIF

IF NOT $6
$3:=$3-1
CONTINUE
ENDIF
$10:=$5+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $8>=4 AND ({$7,4}=0x010030 OR {$7,4}=0x0160) OR $8=4 AND {$7,4}=0x10
$59:=1
ELSEIF $8=4 AND {$7,4}=0x10000000
$59:=2
ELSE
$59:=0
ENDIF
IF $63 AND $59=1 AND $6>=0x20 AND {$5,4}>0 AND {$5,4}<=$6
=
$XOFS:=7
$OFFSET:=$OFFSET+$5
$12:=$OFFSET+$6

$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2>$12
$2:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF

$10:=$OFFSET+$2
IF $2>=4 AND $10+4<=$12
$OFFSET:=$10
 $63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2>$12
$2:=$12-$OFFSET
$10:=8
ELSEIF $2<28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2>=28 AND $OFFSET+28<=$12
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets > 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:[0x18] 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF

$21:={0x10,4}
$23:={0x14,4}
$24:=$OFFSET

WHILE $23>0 AND $24+$21+4<=$12

$XOFS:=7
$OFFSET:=$24

x:0,f:[0x
$OFFSET+$21,x:3,f:%X]

$2:={$21,2}
$21:=$21+4

x:9,f:0x
$2,x:11,f:%X:

$2:=$OFFSET+$2
IF $2+24>$12
x:18,c:8,f:Error Offset
=
$23:=$23-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$29:={0,4}
IF $OFFSET+$29>$12
$29:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X

;Key Offs
$27:={4,2}
;Key Size
$28:={6,2}

IF $28 AND $27>=$29

$28:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $28 AND $27+$28>$29
$28:=$29-$27
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X

;Flags
{8,2},x:44,f:%X

;Value Offs
$25:={0x0A,2}
;Value Size
$26:={0x0C,4}

IF $26 AND $25>=$29

$26:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $26 AND $25+$26>$29
$26:=$29-$25
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $28
 $10:=$27+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$27,$28},x:12,f:CXm
ELSE
$10:=$28
IF $10>16
$10:=16
ENDIF
{$27,$10},x:12,f:CXm
ENDIF
=
ENDIF

IF NOT $26
$23:=$23-1
CONTINUE
ENDIF
$10:=$25+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $63 AND $59=1 AND $26>=0x20 AND {$25,4}>0 AND {$25,4}<=$26
=
$XOFS:=13
$OFFSET:=$OFFSET+$25
$32:=$OFFSET+$26

$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2>$32
$10:=8
$2:=$32-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF

$10:=$OFFSET+$2
IF $2>=4 AND $10+4<=$32
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2>$32
$10:=8
$2:=$32-$OFFSET
ELSEIF $2<28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2>28 AND $OFFSET+28<=$32
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets > 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:[0x18] 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF

$41:={0x10,4}
$43:={0x14,4}
$44:=$OFFSET

WHILE $43>0 AND $44+$41+4<=$32

$OFFSET:=$44

x:0,f:[0x
$OFFSET+$41,x:3,f:%X]

$2:={$41,2}
$41:=$41+4

x:9,f:0x
$2,x:11,f:%X:

$2:=$OFFSET+$2
IF $2+44>$32
x:18,c:8,f:Error Offset
=
$43:=$43-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$49:={0,4}
IF $OFFSET+$49>$32
$49:=$32-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X

;Key Offs
$47:={4,2}
;Key Size
$48:={6,2}

IF $48 AND $47>=$49

$48:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $48 AND $47+$48>$49
$48:=$49-$47
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X

;Flags
{8,2},x:44,f:%X

;Value Offs
$45:={0x0A,2}
;Value Size
$46:={0x0C,4}

IF $46 AND $45>=$49

$46:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $46 AND $45+$46>$49
$46:=$49-$45
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $48
$10:=$47+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$47,$48},x:12,f:CXm
ELSE
$10:=$48
IF $10>16
$10:=16
ENDIF
{$47,$10},x:12,f:CXm
ENDIF
=
ENDIF

IF NOT $46
$43:=$43-1
 CONTINUE
ENDIF
$10:=$OFFSET+$45
$63:=TOGGLE:$10,x:2,f:Value
$10:=$45+0x20
IF $63
{$45,$46},x:12,f:CXm
ELSEIF NOT $48 OR ($46=0x30) AND {$45,8} AND {$10,8}=0x0808020000
IF $46>=0x8
x:12,f:Page > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENCLUSTER:={$45,8},x:24,f:%X
ENDIF
ELSE
IF $46>=0x18
$10:=$45+0x10
x:12,f:Cluster > 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
=
$43:=$43-1
ENDWHILE

$XOFS:=13
$OFFSET:=$44
$41:={0x10,4}
$43:={0x14,4}
IF $43>0 AND $41+4<=$32
$10:=$OFFSET+$41
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $43>0 AND $41+4<=$32
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f:> 0x
$GOTORECOFS:=$OFFSET+{$41,4}
{$41,4},x:16,f:%X
$41:=$41+4
$43:=$43-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$25,$26},x:12,f:CXm
ELSE
$10:=$25+0x20
$11:=$27+8
IF NOT $28 AND $26>=0x8 OR $26=0x30 AND {$25,8} AND
{$10,8}=0x0808020000
x:12,f:Page > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENCLUSTER:={$25,8},x:24,f:%X
ELSEIF $28=0x0E AND {$11,6}=0x38 AND $26>=0x60 AND {$25,4}=0
$10:=$25+0x0C+0x08
 x:12,f:Obj. Id > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$25+0x5E
$11:=$25+0x54
$11:={$11,1}*2
IF 0x5E+$11>$26
$11:=$26-0x5E
ENDIF
{$10,$11},x:18,f:U
ELSEIF $28=0x10
IF $26>=0x18
$10:=$25+0x10
x:12,f:Cluster > 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
ENDIF
=
$23:=$23-1
ENDWHILE

$XOFS:=7
$OFFSET:=$24
$21:={0x10,4}
$23:={0x14,4}
IF $23>0 AND $21+4<=$12
$10:=$OFFSET+$21
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $23>0 AND $21+4<=$12
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f:> 0x
$GOTORECOFS:=$OFFSET+{$21,4}
{$21,4},x:16,f:%X
$21:=$21+4
$23:=$23-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$5,$6},x:12,f:CXm
ELSE
$10:=$5+0x20
$11:=$7+8
IF $8>=2 AND {$7,2}=0x0510
x:12,f:Label:
{$5,$6},x:18,f:U
ELSEIF $8>=4 AND {$7,4}=0x020030 AND $6>=0x20
x:12,f:Obj. Id > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$5:=$5+0x08
$OPENFILENUM:={$5,8},x:24,f:%X
 ELSEIF (NOT $59 OR $6=0x30) AND {$5,8} AND $6>=0x28 AND {$10,8}=0x0808020000
x:12,f:Page > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENCLUSTER:={$5,8},x:24,f:%X
ELSEIF ($60=2) OR ($60=4)
x:12,f:Page > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$5:=$5+0x20
$OPENCLUSTER:={$5,8},x:24,f:%X
ELSEIF $60>=0x500 AND $8=0x0E AND {$11,6}=0x38 AND $6>=0x60 AND {$5,4}=0
$10:=$5+0x0C+0x08
x:12,f:Obj. Id > 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$5+0x5E
$11:=$5+0x54
$11:={$11,1}*2
IF 0x5E+$11>$6
$11:=$6-0x5E
ENDIF
{$10,$11},x:18,f:U
ENDIF
=
ENDIF
$3:=$3-1
ENDWHILE

$XOFS:=1
$OFFSET:=$4
$1:={0x10,4}
$3:={0x14,4}
IF $3>0 AND $1+4<=$RECSIZE
$10:=$OFFSET+$1
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $3>0 AND $1+4<=$RECSIZE
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f:> 0x
$GOTORECOFS:=$OFFSET+{$1,4}
{$1,4},x:16,f:%X
$1:=$1+4
$3:=$3-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF

[APFS Node]
guid:{d9e4fb83-4991-9aa6-7d0e-929edde456ed}

CALCSIZESTART
IF $1<=0
;recsize is not given
IF (({0x18,4} & 0xffff) = 1) AND ({0x20,4}=0x4253584E)
 $1:= {0x24,4}
ENDIF
ENDIF
IF ({0x24,4}>=512) AND ({0x24,4}<=0x100000)
$RECSIZE:= $1
ELSE
$RECSIZE:= 4096
ENDIF
CALCSIZEEND

$1:= $RECSIZE
IF $2<=0
;partition offset is not given
IF (({0x18,4} & 0xffff) = 1) AND ({0x20,4}=0x4253584E)
$2:= $RECDEVOFS
ENDIF
ENDIF
$partofs:= $2

$XOFS:= 1

$expanded:= TOGGLE:0,x:0
x:4,f:obj_phys

$XOFS:= 5
$objtype:= {0x18,4} & 0xffff
$storagetype:= {0x18,4} & 0xc0000000

IF $expanded
=
x:0,f:o_cksum
{8},x:10,f:%X
=
x:0,f:o_oid
{8},x:10,f:%X
=
ELSE
$NEXTOFS:=0x08
{8},x:10,f:%X
=
ENDIF

x:0,f:o_xid
{8},x:10,f:%X
=
x:0,f:o_type
{4},x:10,f:%X

IF $objtype=1
x:26,f:NX_SUPERBLOCK
ELSEIF $objtype=2
x:26,f:BTREE
ELSEIF $objtype=3
x:26,f:BTREE_NODE
ELSEIF $objtype=5
x:26,f:SPACEMAN
ELSEIF $objtype=0xB
x:26,f:OMAP
ELSEIF $objtype=0xC
 x:26,f:CHECKPOINT_MAP
ELSEIF $objtype=0xD
x:26,f:FS
ELSEIF $objtype=0x11
x:26,f:NX_REAPER
ENDIF

IF $storagetype=0
x:42,f:OBJ_VIRTUAL
ELSEIF $storagetype=0x80000000
x:42,f:OBJ_EPHEMERAL
ELSEIF $storagetype=0x40000000
x:42,f:OBJ_PHYSICAL
ELSE
x:42,c:8,f:OBJ_ERRTYPE
ENDIF
=

;#define OBJ_VIRTUAL 0x00000000

;#define OBJ_EPHEMERAL 0x80000000
;#define OBJ_PHYSICAL 0x40000000
;#define OBJ_NOHEADER 0x20000000
;#define OBJ_ENCRYPTED 0x10000000
;#define OBJ_NONPERSISTENT 0x08000000

$subtype:={$NEXTOFS,4}
IF $expanded
x:0,f:o_subtype
{4},x:10,f:%X
=
ENDIF

$XOFS:=1
$NEXTOFS:=0x20

IF $objtype=1
;NX_SUPERBLOCK
$xt:=24
x:0,f:nx_magic ("NXSB")
{4},x:$xt,f:%4c
=
x:0,f:nx_block_size
{4},x:$xt,f:%u
=
x:0,f:nx_block_count
{8},x:$xt,f:%u
=
x:0,f:nx_features 0x
{8},x:$xt,f:%X
=
x:0,f:nx_ro_compat_features 0x
{8},x:$xt,f:%X
=
x:0,f:nx_incompat_features 0x
{8},x:$xt,f:%X
=
x:0,f:nx_uuid
{16},x:$xt-6,f:CXm
=
x:0,f:nx_next_oid 0x
{8},x:$xt,f:%X
=
x:0,f:nx_next_xid 0x
{8},x:$xt,f:%X
=
x:0,f:nx_xp_desc_blocks 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_blocks 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_desc_base 0x
{8},x:$xt,f:%X
=
x:0,f:nx_xp_data_base 0x
{8},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+(2+{$NEXTOFS,4})*$RECSIZE
x:0,f:nx_xp_desc_next >0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_next 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_desc_index 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_desc_len 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_index 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_len 0x
{4},x:$xt,f:%X
=
x:0,f:nx_spaceman_oid 0x
{8},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:nx_omap_oid >0x
{8},x:$xt,f:%X
=
x:0,f:nx_reaper_oid 0x
{8},x:$xt,f:%X
=
x:0,f:nx_test_type 0x
{4},x:$xt,f:%X
=
$count:={$NEXTOFS,4}
x:0,f:nx_max_file_systems 0x
{4},x:$xt,f:%X
=
$i:=0
WHILE ($i<$count) AND ($NEXTOFS+0x08<=$RECSIZE)
$i,x:0,f:nx_fs_oid[%u]
 $i:=$i+1
x:$xt-2,f:0x
{8},x:$xt,f:%X
=
ENDWHILE
x:0,f:...
ELSEIF $objtype=0xC
;CHECKPOINT_MAP
x:0,f:cpm_flags 0x
{4},x:14,f:%X
=
x:0,f:cpm_count
$count:={$NEXTOFS,4}
{4},x:14,f:%u
=
$i:=0
WHILE $i<$count AND $NEXTOFS+0x28<=$RECSIZE
$i,x:4,f:cpm_map[%u]
$i:=$i+1
$expanded:=TOGGLE:$NEXTOFS,x:0
$entryofs:=$NEXTOFS
=
IF $expanded
$XOFS:=$XOFS+4
$objtype:={$NEXTOFS,4}&0xffff
$storagetype:={$NEXTOFS,4}&0xc0000000
x:0,f:cpm_type 0x
{4},x:14,f:%X

IF $objtype=1
x:26,f:NX_SUPERBLOCK
ELSEIF $objtype=2
x:26,f:BTREE
ELSEIF $objtype=5
x:26,f:SPACEMAN
ELSEIF $objtype=0xC
x:26,f:CHECKPOINT_MAP
ELSEIF $objtype=0x11
x:26,f:NX_REAPER
ENDIF
IF $storagetype=0
x:42,f:OBJ_VIRTUAL
ELSEIF $storagetype=0x80000000
x:42,f:OBJ_EPHEMERAL
ELSEIF $storagetype=0x40000000
x:42,f:OBJ_PHYSICAL
ELSE
x:42,c:8,f:OBJ_ERRTYPE
ENDIF

=
x:0,f:cpm_subtype 0x
{4},x:14,f:%X
=
x:0,f:cpm_size 0x
{4},x:14,f:%X
=
x:0,f:cpm_pad 0x
{4},x:14,f:%X
 =
x:0,f:cpm_fs_oid 0x
{8},x:14,f:%X
=
x:0,f:cpm_oid 0x
{8},x:14,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:cpm_paddr >0x
{8},x:14,f:%X
=
$XOFS:=$XOFS-4
ENDIF
$NEXTOFS:=$entryofs+0x28
ENDWHILE
ELSEIF $objtype=0x2 OR $objtype=0x3
;B-tree node
$xt:=24
x:0,f:btn_flags 0x
$flags:={$NEXTOFS,2}
$valsofs:=$RECSIZE
{2},x:$xt,f:%X
IF $flags&0x1
x:$xt+6,f:ROOT
$valsofs:=$valsofs-0x28
ENDIF
IF $flags&0x2
x:$xt+11,f:LEAF
ENDIF
IF $flags&0x4
x:$xt+16,f:FIX_KVS
ENDIF
IF $flags&0x8000
x:$xt+24,c:8,f:CHK_INVAL
ENDIF
=
x:0,f:btn_level 0x
{2},x:$xt,f:%X
=
$nkeys:={$NEXTOFS,4}
x:0,f:btn_nkeys
{4},x:$xt,f:%u
=
$tocofs:={$NEXTOFS,2}
x:0,f:btn_table_space.off 0x
{2},x:$xt,f:%X
=
$keysofs:=$tocofs+{$NEXTOFS,2}
x:0,f:btn_table_space.len 0x
{2},x:$xt,f:%X
=
x:0,f:btn_free_space.off 0x
{2},x:$xt,f:%X
=
x:0,f:btn_free_space.len 0x
{2},x:$xt,f:%X
=
x:0,f:btn_key_free_list.off 0x
{2},x:$xt,f:%X
=
x:0,f:btn_key_free_list.len 0x
{2},x:$xt,f:%X
=
x:0,f:btn_val_free_list.off 0x
{2},x:$xt,f:%X
=
x:0,f:btn_val_free_list.len 0x
{2},x:$xt,f:%X
=

$dataofs:=$NEXTOFS
$keysofs:=$dataofs+$keysofs

$NEXTOFS:=$dataofs+$tocofs
$expanded:=TOGGLE:$NEXTOFS,x:0
x:4,f:TOC
=
IF $expanded
$i:=0
$XOFS:=$XOFS+4
WHILE $i<$nkeys
$i:=$i+1
IF $flags&0x4
IF $NEXTOFS+4>$RECSIZE
BREAK
ENDIF
x:0,f:k:
{2},x:2,f:%X
x:8,f:v:
{2},x:10,f:%X
ELSE
IF $NEXTOFS+8>$RECSIZE
BREAK
ENDIF
x:0,f:k.off:
{2},x:6,f:%X
x:12,f:k.len:
{2},x:18,f:%X
x:24,f:v.off:
{2},x:30,f:%X
x:36,f:v.len:
{2},x:42,f:%X
ENDIF
=
ENDWHILE
$XOFS:=$XOFS-4
ENDIF

$NEXTOFS:=$dataofs+$tocofs
;$expanded:=TOGGLE:$NEXTOFS,x:0
;IF $expanded
$i:=0
$xk:=0
IF $flags&0x4
x:0,f:kofs vofs
$xk:=10
ELSE
 x:0,f:kofs/l vofs/l
$xk:=16
ENDIF
IF $subtype=0xB AND $flags&0x2
x:$xk,f:ok_oid ok_xid ov_flags ov_size ov_paddr
ELSEIF $subtype=0xB
x:$xk,f:ok_oid ok_xid obj_id
ELSEIF $subtype=0xE
x:$xk,f:obj_id type
ENDIF
=
WHILE $i<$nkeys
;$i,x:0,f:key[%d]
$i:=$i+1
$keyofs:=0
$valofs:=0
$valsz:=0
IF $flags&0x4
IF $NEXTOFS+4>$RECSIZE
=
BREAK
ENDIF
$keyofs:=$keysofs+{2}
$keyofs,x:0,f:%X
$valofs:={2}
IF ($valofs=0xffff)
$valofs:=-1
x:5,f:-
ELSE
$valofs:=$valsofs-$valofs
$valofs,x:5,f:%X
ENDIF
ELSE
IF $NEXTOFS+8>$RECSIZE
=
BREAK
ENDIF
$keyofs:=$keysofs+{2}
$keysz:={2}
$valofs:=$valsofs-{2}
$valsz:={2}
$keyofs|$keysz<<32,x:0,f:%X/%X
$valofs|$valsz<<32,x:8,f:%X/%X
ENDIF
IF $subtype=0xB
{$keyofs,8},x:10,f:%X
{$keyofs+8,8},x:26,f:%X
IF $flags&0x2
{$valofs,4},x:42,f:%X
{$valofs+4,4},x:51,f:%X
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$valofs+8,8}*$RECSIZE
x:59,f:>
{$valofs+8,8},x:60,f:%X
ELSE
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$valofs,8}*$RECSIZE
x:43,f:>
{$valofs,8},x:44,f:%X
 ENDIF
ELSEIF $subtype=0xE
{$keyofs:0,60},x:$xk,f:%X
{$keyofs:60,4},x:$xk+16,f:%X
$etype:={$keyofs:60,4}
$nlen:=0
IF $etype=5
x:$xk+18,f:>
$OPENFILENUM:={$keyofs+8,8},x:$xk+19,f:%X
ELSEIF $etype=8
{$keyofs+8,8},x:$xk+22,f:%X
ENDIF
IF ($flags&0x2)=0
x:59,f:>
$OPENVOLPAGE:={$valofs,8},x:60,f:%X
ELSEIF $etype=5
{$valofs,8},x:$xk+30,f:%X
$l:={$valofs+8,2}
IF $l>0
{$valofs+10,$l},x:$xk+39,f:u
ENDIF
ELSEIF $etype=6
{$valofs,4},x:$xk+22,f:%X
ELSEIF $etype=8
{$valofs,8},x:$xk+36,f:%X
$OPENDEVOFS:=$partofs+{$valofs+8,8}*$RECSIZE
x:$xk+51,f:>
{$valofs+8,8},x:$xk+52,f:%X
ELSEIF $etype=9
x:$xk+18,f:>
$OPENFILENUM:={$valofs,8},x:$xk+19,f:%X
{$keyofs+8,4},x:$xk+35,f:%08X
$l:={$keyofs+8,2}&0x3ff
IF $l>0
{$keyofs+12,$l},x:$xk+44,f:u
ENDIF
ELSEIF $etype=3
x:$xk+18,f:>
$OPENFILENUM:={$valofs,8},x:$xk+19,f:%X
$exp:=TOGGLE:$valofs,x:$xk+35
$xv:=$xk+35
IF $exp
=
x:$xv-14,f:private_id:
{$valofs+8,8},x:$xv,f:%X
=
x:$xv-14,f:create_time:
{$valofs+0x10,8},x:$xv,f:%X
=
x:$xv-14,f:mod_time:
{$valofs+0x18,8},x:$xv,f:%X
=
x:$xv-14,f:change_time:
{$valofs+0x20,8},x:$xv,f:%X
=
x:$xv-14,f:access_time:
{$valofs+0x28,8},x:$xv,f:%X
=
x:$xv-14,f:intern_flags:
 {$valofs+0x30,8},x:$xv,f:%X
=
x:$xv-14,f:n_child/link:
{$valofs+0x38,4},x:$xv,f:%X
=
x:$xv-14,f:def_prot_cls:
{$valofs+0x3C,4},x:$xv,f:%X
=
x:$xv-14,f:wr_gen_count:
{$valofs+0x40,4},x:$xv,f:%X
=
x:$xv-14,f:bsd_flags:
{$valofs+0x44,4},x:$xv,f:%X
=
x:$xv-14,f:owner:
{$valofs+0x48,4},x:$xv,f:%X
=
x:$xv-14,f:group:
{$valofs+0x4C,4},x:$xv,f:%X
=
x:$xv-14,f:mode:
{$valofs+0x50,2},x:$xv,f:%X
=
x:$xv-14,f:pad1:
{$valofs+0x52,2},x:$xv,f:%X
=
x:$xv-14,f:pad2:
{$valofs+0x54,8},x:$xv,f:%X
ENDIF
IF ($valsz>0x60)
$v:=$valofs+0x5C
IF $exp
=
x:$xv-14,f:xf_num_exts:
{$v,2},x:$xv,f:%X
=
x:$xv-14,f:xf_used_data:
{$v+2,2},x:$xv,f:%X
ENDIF
$_vnum:={$v,2}
$_vsz:=$valsz-0x60
$v:=$v+4
$_dofs:=$v
$_dxofs:=$_vnum*4
WHILE ($_vsz>=4) AND ($_vnum>0)
IF $exp
=
x:$xv-12,f:x_type:
{$v,1},x:$xv+2,f:%X
=
x:$xv-12,f:x_flags:
{$v+1,1},x:$xv+2,f:%X
=
x:$xv-12,f:x_size:
{$v+2,2},x:$xv+2,f:%X
ENDIF
IF {$v,1} = 4
$_x:=$xv+9
IF $exp
 =
x:$xv-10,f:name:
$_x:=$xv+2
ENDIF
{$_dofs+$_dxofs,{$v+2,2}},x:$_x,f:u
ENDIF
$_dxofs:=($_dxofs+{$v+2,2}+7) & ~7
$_vsz:=$_vsz-4
$_vnum:=$_vnum-1
$v:=$v+4
ENDWHILE
ENDIF
ELSE
x:$xk+18,f:>
$OPENFILENUM:={$valofs,8},x:$xk+19,f:%X
ENDIF
ENDIF
=
ENDWHILE
;ENDIF

ELSEIF $objtype=0xB
;OMAP
$xt:=24
x:0,f:om_flags 0x
{4},x:$xt,f:%X
=
x:0,f:om_snapshot 0x
{4},x:$xt,f:%X
=
x:0,f:om_treetype 0x
{4},x:$xt,f:%X
=
x:0,f:om_snapshot_treetype 0x
{4},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:om_tree_oid >0x
{8},x:$xt,f:%X
=
x:0,f:om_scanpshot_tree_oid 0x
{8},x:$xt,f:%X
=
x:0,f:om_most_recent_snap 0x
{8},x:$xt,f:%X
=
x:0,f:om_pending_revert_min 0x
{8},x:$xt,f:%X
=
x:0,f:om_pending_revert_max 0x
{8},x:$xt,f:%X
ELSEIF $objtype=0xD
;FS
$xt:= 32
x:0,f:apfs_magic ("APSB")
{4},x:$xt,f:%4c
=
x:0,f:apfs_fs_index
{4},x:$xt,f:%u
=
x:0,f:apfs_features 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_ro_compat_features 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_incompat_features 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_unmount_time 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_reserve_block_count 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_quota_block_count 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_alloc_count 0x
{8},x:$xt,f:%X
=
;x:0,f:apfs_meta_crypto
;{0x14}
$NEXTOFS:=$NEXTOFS+0x14
;=
x:0,f:apfs_root_tree_type 0x
{4},x:$xt,f:%X
=
x:0,f:apfs_extentref_tree_type 0x
{4},x:$xt,f:%X
=
x:0,f:apfs_snap_meta_tree_type 0x
{4},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:apfs_omap_oid >0x
{8},x:$xt,f:%X
=
x:0,f:apfs_root_tree_oid 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_extentref_tree_oid 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_snap_meta_tree_oid 0x
{8},x:$xt,f:%X
=
;apfs_revert_to_xid: QWORD;
;apfs_revert_to_sblock_oid: QWORD;
$NEXTOFS:= $NEXTOFS + 16

x:0,f:apfs_next_obj_oid 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_files 0x
{8},x:$xt,f:%X
 =
x:0,f:apfs_num_directories 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_symlinks 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_other_fsobjects 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_snapshots 0x
{8},x:$xt,f:%X
=

x:0,f:apfs_total_blocks_alloced 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_total_blocks_freed 0x
{8},x:$xt,f:%X
=

x:0,f:apfs_vol_uuid
{16},x:$xt-6,f:CXm
=

x:0,f:apfs_last_mod_time 0x
{8},x:$xt,f:%X
=

x:0,f:apfs_fs_flags 0x
{8},x:$xt,f:%X
=

;apfs_formatted_by: apfs_modified_by_t;
;apfs_modified_by: [APFS_MAX_HIST] of apfs_modified_by_t;

$NEXTOFS:=$NEXTOFS + 9 * (32+16)

x:0,f:apfs_volname
{256},x:$xt,f:u
=

;apfs_next_doc_id {4}

;apfs_role {2}
;reserved {2}

;apfs_root_to_xid {8}
;apfs_er_state_oid {8}
ENDIF