010editor的com解析脚本tagOBJREF

版权声明：本人的作品仅供研究目的,如果读者利用本人的作品从事其他行为,与本人无关 https://blog.csdn.net/oShuangYue12/article/details/83688313

//------------------------------------------------
//--- 010 Editor v8.0.1 ¶þ½øÖÆÄ£°å
//
//      File: 
//   Authors: 
//   Version: 
//   Purpose: 
//  Category: 
// File Mask: 
//  ID Bytes: 
//   History: 
//------------------------------------------------
local unsigned short sizetp;
local unsigned short sizesec;
typedef struct GUID 
            {
              unsigned int Data1;
              unsigned ushort Data2;
              unsigned ushort Data3;
              byte Data4[8];            
            } IID;
typedef struct tagDUALSTRINGARRAY {
 
  
             unsigned short    wNumEntries;
       
          
             unsigned short    wSecurityOffset;     
             sizetp=wSecurityOffset-2;
             sizesec=(wNumEntries-wSecurityOffset-1)/3;
               Printf("wNumSTRINGBINDING is %d",sizetp);
                Printf("wNumSECURITYBINDING is %d",sizesec);
             struct tagSTRINGBINDING {

                  unsigned short    wTowerId;  

                  unsigned short    aNetworkAddr[sizetp];  

               } STRINGBINDING;
              byte nullterm1[2];
              struct tagSECURITYBINDING {

                unsigned short    wAuthnSvc;     // Must not be zero
            
                unsigned short    wAuthzSvc;     // Must not be zero
            
                unsigned short    aPrincName;    // NULL terminated

               } SECURITYBINDING[sizesec];
               byte nullterm2[2];
 
            } DUALSTRINGARRAY ;
struct tagOBJREF {
	byte  signature[4]; 
	unsigned long  flags; 
	 GUID _iid;
     if(OBJREF.flags==01h)
     {
       struct tagOBJREF_standard {
        unsigned long  flags; 
        unsigned long  cPublicRefs; 
	    struct oxid {
            DWORD LowPart;
            LONG HighPart;
        }  _oxid; 
	     struct oid {
            DWORD LowPart;
            LONG HighPart;
        }  _oid;    
	         struct ipid
         {
          unsigned int Data1;
          unsigned ushort Data2;
          unsigned ushort Data3;
          byte Data4[8];
         } _ipid;  
         DUALSTRINGARRAY dualstringarray;

        } OBJREF_standard;
     }
     if(OBJREF.flags==02h)
     {
         struct tagOBJREF_handler {
         unsigned char std[40]; 
	         struct clsid
            {
              unsigned int Data1;
              unsigned ushort Data2;
              unsigned ushort Data3;
              byte Data4[8];
            } _clsid; 
	    unsigned char saResAddr[8]; 
      } OBJREF_handler;
     }
     if(OBJREF.flags==04h)
     {
        struct tagOBJREF_custom {
	     struct clsid_custom
         {
              unsigned int Data1;
              unsigned ushort Data2;
              unsigned ushort Data3;
              byte Data4[8];
            } _clsid_custom; 
	    unsigned long  cbExtension; 
	    unsigned long  size; 
	    unsigned byte pData; 
      } OBJREF_custom;
    }
     if(OBJREF.flags==08h)
     {
        struct tagOBJREF_EXTENDED{
                 byte std[40]; 
	             byte Signature1[4]; 
	            DUALSTRINGARRAY dualstringarray; 
                unsigned int nElms;
                 byte Signature2[4]; 
                struct tagDATAELEMENT{
                   GUID dataID; 
                    unsigned int cbSize;
                     unsigned int cbRounded;
                     struct  ContextProperties{
                       unsigned ushort  MajorVersion ;
                       unsigned ushort  MinVersion;
                     GUID ContextId ;
                        unsigned int Flags ;
                        unsigned int Reserved ;
                        unsigned int dwNumExtents;
                        unsigned int cbExtents ; 
                        unsigned int MshlFlags ;
                        unsigned int PROPMARSHALHEADERCount ;
                        unsigned int Frozen;
                        struct PROPMARSHALHEADER{
                           GUID clsidHEADER;
                            GUID policyId;             
                          byte  PROPMARSHALHEADEflags[4]; 
                        unsigned int  cbctxProperty ;
                        byte ctxProperty[cbctxProperty];  
                          } _PROPMARSHALHEADER[PROPMARSHALHEADERCount];
                      } _data;
                } _DATAELEMENT;
        }OBJREF_EXTENDED;
     }
} OBJREF;