From c7d00b87b60f6f90407a101f20ec28f76e3bd57f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 1 Dec 2022 00:56:48 -0600 Subject: [PATCH] fixes unknown bit ranges --- format/applebookmark/apple_bookmark.go | 231 +++++++------------ format/applebookmark/testdata/sample1.fqtest | 81 +++---- format/applebookmark/testdata/sample2.fqtest | 110 ++++----- format/applebookmark/testdata/sample3.fqtest | 122 +++++----- format/applebookmark/testdata/sample4.fqtest | 118 +++++----- 5 files changed, 309 insertions(+), 353 deletions(-) diff --git a/format/applebookmark/apple_bookmark.go b/format/applebookmark/apple_bookmark.go index ca959fe2..95d8dc9e 100644 --- a/format/applebookmark/apple_bookmark.go +++ b/format/applebookmark/apple_bookmark.go @@ -166,154 +166,94 @@ func (dod *dataObjectDecoder) decode(d *decode.D) { var resourcePropDecoder = &dataObjectDecoder{decodeResourcePropertyFlags} var volumePropDecoder = &dataObjectDecoder{decodeVolumePropertyFlags} +func decodeTgtPropertyFlagBits(d *decode.D) { + d.FieldBool("is_regular_file") + d.FieldBool("is_directory") + d.FieldBool("is_symbolic_link") + d.FieldBool("is_volume") + d.FieldBool("is_package") + d.FieldBool("is_system_immutable") + d.FieldBool("is_user_immutable") + d.FieldBool("is_hidden") + d.FieldBool("has_hidden_extension") + d.FieldBool("is_application") + d.FieldBool("is_compressed") + d.FieldBool("can_set_hidden_extension") + d.FieldBool("is_readable") + d.FieldBool("is_writeable") + d.FieldBool("is_executable") + d.FieldBool("is_alias_file") + d.FieldBool("is_mount_trigger") +} + func decodeResourcePropertyFlags(d *decode.D) { - d.FieldStruct("property_flags", func(d *decode.D) { - start := d.Pos() - d.FieldBool("is_regular_file") - d.FieldBool("is_directory") - d.FieldBool("is_symbolic_link") - d.FieldBool("is_volume") - d.FieldBool("is_package") - d.FieldBool("is_system_immutable") - d.FieldBool("is_user_immutable") - d.FieldBool("is_hidden") - d.FieldBool("has_hidden_extension") - d.FieldBool("is_application") - d.FieldBool("is_compressed") - d.FieldBool("can_set_hidden_extension") - d.FieldBool("is_readable") - d.FieldBool("is_writeable") - d.FieldBool("is_executable") - d.FieldBool("is_alias_file") - d.FieldBool("is_mount_trigger") - d.RawLen(64 - (d.Pos() - start)) - }) - d.FieldStruct("enabled_property_flags", func(d *decode.D) { - start := d.Pos() - d.FieldBool("is_regular_file") - d.FieldBool("is_directory") - d.FieldBool("is_symbolic_link") - d.FieldBool("is_volume") - d.FieldBool("is_package") - d.FieldBool("is_system_immutable") - d.FieldBool("is_user_immutable") - d.FieldBool("is_hidden") - d.FieldBool("has_hidden_extension") - d.FieldBool("is_application") - d.FieldBool("is_compressed") - d.FieldBool("can_set_hidden_extension") - d.FieldBool("is_readable") - d.FieldBool("is_writeable") - d.FieldBool("is_executable") - d.FieldBool("is_alias_file") - d.FieldBool("is_mount_trigger") - d.RawLen(64 - (d.Pos() - start)) - }) + start := d.Pos() + d.FieldStruct("property_flags", decodeTgtPropertyFlagBits) + d.FieldRawLen("unused_property_bits", 64-(d.Pos()-start)) + + start = d.Pos() + d.FieldStruct("enabled_property_flags", decodeTgtPropertyFlagBits) + d.FieldRawLen("unused_indicator_bits", 64-(d.Pos()-start)) +} + +func decodeVolPropertyFlagBits(d *decode.D) { + d.FieldBool("is_local") + d.FieldBool("is_automount") + d.FieldBool("dont_browse") + d.FieldBool("is_read_only") + d.FieldBool("is_quarantined") + d.FieldBool("is_ejectable") + d.FieldBool("is_removable") + d.FieldBool("is_internal") + d.FieldBool("is_external") + d.FieldBool("is_disk_image") + d.FieldBool("is_file_vault") + d.FieldBool("is_local_idisk_mirror") + d.FieldBool("is_ipod") + d.FieldBool("is_idisk") + d.FieldBool("is_cd") + d.FieldBool("is_dvd") + d.FieldBool("is_device_file_system") + d.FieldBool("supports_persistent_ids") + d.FieldBool("supports_search_fs") + d.FieldBool("supports_exchange") + d.FieldBool("reserved_0") + d.FieldBool("supports_symbolic_links") + d.FieldBool("supports_deny_modes") + d.FieldBool("supports_copy_file") + d.FieldBool("supports_read_dir_attr") + d.FieldBool("supports_journaling") + d.FieldBool("supports_rename") + d.FieldBool("supports_fast_stat_fs") + d.FieldBool("supports_case_sensitive_names") + d.FieldBool("supports_case_preserved_names") + d.FieldBool("supports_flock") + d.FieldBool("has_no_root_directory_times") + d.FieldBool("supports_extended_security") + d.FieldBool("supports_2_tb_file_size") + d.FieldBool("supports_hard_links") + d.FieldBool("supports_mandatory_byte_range_locks") + d.FieldBool("supports_path_from_id") + d.FieldBool("reserved_1") + d.FieldBool("is_journaling") + d.FieldBool("supports_sparse_files") + d.FieldBool("supports_zero_runs") + d.FieldBool("supports_volume_sizes") + d.FieldBool("supports_remote_events") + d.FieldBool("supports_hidden_files") + d.FieldBool("supports_decmp_fs_compression") + d.FieldBool("has64_bit_object_ids") + d.FieldBool("property_flags_all") } func decodeVolumePropertyFlags(d *decode.D) { - d.FieldStruct("property_flags", func(d *decode.D) { - start := d.Pos() - d.FieldBool("is_local") - d.FieldBool("is_automount") - d.FieldBool("dont_browse") - d.FieldBool("is_read_only") - d.FieldBool("is_quarantined") - d.FieldBool("is_ejectable") - d.FieldBool("is_removable") - d.FieldBool("is_internal") - d.FieldBool("is_external") - d.FieldBool("is_disk_image") - d.FieldBool("is_file_vault") - d.FieldBool("is_local_idisk_mirror") - d.FieldBool("is_ipod") - d.FieldBool("is_idisk") - d.FieldBool("is_cd") - d.FieldBool("is_dvd") - d.FieldBool("is_device_file_system") - d.FieldBool("supports_persistent_ids") - d.FieldBool("supports_search_fs") - d.FieldBool("supports_exchange") - d.FieldBool("reserved_0") - d.FieldBool("supports_symbolic_links") - d.FieldBool("supports_deny_modes") - d.FieldBool("supports_copy_file") - d.FieldBool("supports_read_dir_attr") - d.FieldBool("supports_journaling") - d.FieldBool("supports_rename") - d.FieldBool("supports_fast_stat_fs") - d.FieldBool("supports_case_sensitive_names") - d.FieldBool("supports_case_preserved_names") - d.FieldBool("supports_flock") - d.FieldBool("has_no_root_directory_times") - d.FieldBool("supports_extended_security") - d.FieldBool("supports_2_tb_file_size") - d.FieldBool("supports_hard_links") - d.FieldBool("supports_mandatory_byte_range_locks") - d.FieldBool("supports_path_from_id") - d.FieldBool("reserved_1") - d.FieldBool("is_journaling") - d.FieldBool("supports_sparse_files") - d.FieldBool("supports_zero_runs") - d.FieldBool("supports_volume_sizes") - d.FieldBool("supports_remote_events") - d.FieldBool("supports_hidden_files") - d.FieldBool("supports_decmp_fs_compression") - d.FieldBool("has64_bit_object_ids") - d.FieldBool("property_flags_all") - d.RawLen(64 - (d.Pos() - start)) - }) - d.FieldStruct("enabled_property_flags", func(d *decode.D) { - start := d.Pos() - d.FieldBool("is_local") - d.FieldBool("is_automount") - d.FieldBool("dont_browse") - d.FieldBool("is_read_only") - d.FieldBool("is_quarantined") - d.FieldBool("is_ejectable") - d.FieldBool("is_removable") - d.FieldBool("is_internal") - d.FieldBool("is_external") - d.FieldBool("is_disk_image") - d.FieldBool("is_file_vault") - d.FieldBool("is_local_idisk_mirror") - d.FieldBool("is_ipod") - d.FieldBool("is_idisk") - d.FieldBool("is_cd") - d.FieldBool("is_dvd") - d.FieldBool("is_device_file_system") - d.FieldBool("supports_persistent_ids") - d.FieldBool("supports_search_fs") - d.FieldBool("supports_exchange") - d.FieldBool("reserved_0") - d.FieldBool("supports_symbolic_links") - d.FieldBool("supports_deny_modes") - d.FieldBool("supports_copy_file") - d.FieldBool("supports_read_dir_attr") - d.FieldBool("supports_journaling") - d.FieldBool("supports_rename") - d.FieldBool("supports_fast_stat_fs") - d.FieldBool("supports_case_sensitive_names") - d.FieldBool("supports_case_preserved_names") - d.FieldBool("supports_flock") - d.FieldBool("has_no_root_directory_times") - d.FieldBool("supports_extended_security") - d.FieldBool("supports_2_tb_file_size") - d.FieldBool("supports_hard_links") - d.FieldBool("supports_mandatory_byte_range_locks") - d.FieldBool("supports_path_from_id") - d.FieldBool("reserved_1") - d.FieldBool("is_journaling") - d.FieldBool("supports_sparse_files") - d.FieldBool("supports_zero_runs") - d.FieldBool("supports_volume_sizes") - d.FieldBool("supports_remote_events") - d.FieldBool("supports_hidden_files") - d.FieldBool("supports_decmp_fs_compression") - d.FieldBool("has64_bit_object_ids") - d.FieldBool("property_flags_all") - d.RawLen(64 - (d.Pos() - start)) - }) + start := d.Pos() + d.FieldStruct("property_flags", decodeVolPropertyFlagBits) + d.FieldRawLen("unused_property_bits", 64-(d.Pos()-start)) + + start = d.Pos() + d.FieldStruct("enabled_property_flags", decodeVolPropertyFlagBits) + d.FieldRawLen("unused_indicator_bits", 64-(d.Pos()-start)) } var cocoaTimeEpochDate = time.Date(2001, time.January, 1, 0, 0, 0, 0, time.UTC) @@ -342,7 +282,7 @@ func (hdr *tocHeader) decodeEntries(d *decode.D) { entry.recordOffset = calcOffset(d.FieldU32("offset_to_record")) - d.U32() + d.FieldU32("unused") switch entry.key { case elementTypeTargetFlags: @@ -403,6 +343,7 @@ func decodeRecord(d *decode.D) { switch typ { case dataTypeString: d.FieldUTF8("data", n) + d.FieldRawLen("alignment_bytes", 32-((d.Pos()+32)%32)) case dataTypeData: d.FieldRawLen("data", int64(n*8)) case dataTypeNumber8: diff --git a/format/applebookmark/testdata/sample1.fqtest b/format/applebookmark/testdata/sample1.fqtest index 262d38f0..02949810 100644 --- a/format/applebookmark/testdata/sample1.fqtest +++ b/format/applebookmark/testdata/sample1.fqtest @@ -8,29 +8,32 @@ $ fq dv sample1.book 0x010|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| reserved: raw bits 0x10-0x2f.7 (32) 0x020|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| 0x030|50 01 00 00 |P... | first_toc_offset: 336 0x30-0x33.7 (4) - | | | bookmark_entries[0:13]: 0x34-0x22b.7 (504) - | | | [0]{}: entry 0x40-0x19b.7 (348) + | | | bookmark_entries[0:13]: 0x34-0x22f.7 (508) + | | | [0]{}: entry 0x40-0x19f.7 (352) | | | record{}: 0x40-0x7b.7 (60) | | | data[0:2]: 0x40-0x7b.7 (60) | | | [0]{}: element 0x40-0x77.7 (56) - | | | record{}: 0x40-0x53.7 (20) + | | | record{}: 0x40-0x57.7 (24) 0x040|0c 00 00 00 |.... | length: 12 0x40-0x43.7 (4) 0x040| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x44-0x47.7 (4) 0x040| 41 70 70 6c 69 63 61 74| Applicat| data: "Applications" 0x48-0x53.7 (12) 0x050|69 6f 6e 73 |ions | +0x050| 0d 00 00 00 | .... | alignment_bytes: raw bits 0x54-0x57.7 (4) 0x070| 10 00 00 00 | .... | offset: 16 0x74-0x77.7 (4) | | | [1]{}: element 0x54-0x7b.7 (40) - | | | record{}: 0x54-0x68.7 (21) + | | | record{}: 0x54-0x6b.7 (24) 0x050| 0d 00 00 00 | .... | length: 13 0x54-0x57.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x58-0x5b.7 (4) 0x050| 42 69 74 77| Bitw| data: "Bitwarden.app" 0x5c-0x68.7 (13) 0x060|61 72 64 65 6e 2e 61 70 70 |arden.app | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x69-0x6b.7 (3) 0x070| 24 00 00 00 | $... | offset: 36 0x78-0x7b.7 (4) 0x060| 08 00 00 00| ....| length: 8 0x6c-0x6f.7 (4) 0x070|01 06 00 00 |.... | type: "array" (1537) (Array of 4-byte offsets to data items) 0x70-0x73.7 (4) 0x190| 04 10 00 00 | .... | key: "target_path" (4100) (Array of individual path components) 0x194-0x197.7 (4) 0x190| 3c 00 00 00 | <... | offset_to_record: 60 0x198-0x19b.7 (4) - | | | [1]{}: entry 0x7c-0x1a7.7 (300) +0x190| 00 00 00 00| ....| unused: 0 0x19c-0x19f.7 (4) + | | | [1]{}: entry 0x7c-0x1ab.7 (304) | | | record{}: 0x7c-0xab.7 (48) | | | data[0:2]: 0x7c-0xab.7 (48) | | | [0]{}: element 0x7c-0xa7.7 (44) @@ -49,7 +52,8 @@ $ fq dv sample1.book 0x0a0|01 06 00 00 |.... | type: "array" (1537) (Array of 4-byte offsets to data items) 0xa0-0xa3.7 (4) 0x1a0|05 10 00 00 |.... | key: "target_cnid_path" (4101) (Array of CNIDs) 0x1a0-0x1a3.7 (4) 0x1a0| 6c 00 00 00 | l... | offset_to_record: 108 0x1a4-0x1a7.7 (4) - | | | [2]{}: entry 0xbc-0x1b3.7 (248) +0x1a0| 00 00 00 00 | .... | unused: 0 0x1a8-0x1ab.7 (4) + | | | [2]{}: entry 0xbc-0x1b7.7 (252) | | | record{}: 0xbc-0xdb.7 (32) 0x0b0| 18 00 00 00| ....| length: 24 (valid) 0xbc-0xbf.7 (4) 0x0c0|01 02 00 00 |.... | raw_type: "data" (513) (valid) 0xc0-0xc3.7 (4) @@ -72,6 +76,7 @@ $ fq dv sample1.book 0x0c0| 00 | . | is_executable: false 0xc5.6-0xc5.6 (0.1) 0x0c0| 00 | . | is_alias_file: false 0xc5.7-0xc5.7 (0.1) 0x0c0| 00 | . | is_mount_trigger: false 0xc6-0xc6 (0.1) +0x0c0| 00 00 00 00 00 00 | ...... | unused_property_bits: raw bits 0xc6.1-0xcb.7 (5.7) | | | enabled_property_flags{}: 0xcc-0xce (2.1) 0x0c0| 0f | . | is_regular_file: false 0xcc-0xcc (0.1) 0x0c0| 0f | . | is_directory: false 0xcc.1-0xcc.1 (0.1) @@ -90,61 +95,74 @@ $ fq dv sample1.book 0x0c0| 00 | . | is_executable: false 0xcd.6-0xcd.6 (0.1) 0x0c0| 00 | . | is_alias_file: false 0xcd.7-0xcd.7 (0.1) 0x0c0| 00 | . | is_mount_trigger: false 0xce-0xce (0.1) +0x0c0| 00 00| ..| unused_indicator_bits: raw bits 0xce.1-0xd3.7 (5.7) +0x0d0|00 00 00 00 |.... | 0x0d0| 00 00 00 00 00 00 00 00 | ........ | reserved: raw bits 0xd4-0xdb.7 (8) 0x1a0| 10 10 00 00| ....| key: "target_flags" (4112) (flag bitfield) 0x1ac-0x1af.7 (4) 0x1b0|8c 00 00 00 |.... | offset_to_record: 140 0x1b0-0x1b3.7 (4) - | | | [3]{}: entry 0xac-0x1bf.7 (276) +0x1b0| 00 00 00 00 | .... | unused: 0 0x1b4-0x1b7.7 (4) + | | | [3]{}: entry 0xac-0x1c3.7 (280) | | | record{}: 0xac-0xbb.7 (16) 0x0a0| 08 00 00 00| ....| length: 8 0xac-0xaf.7 (4) 0x0b0|00 04 00 00 |.... | type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0xb0-0xb3.7 (4) 0x0b0| 41 c4 81 02 d0 00 00 00 | A....... | data: 6.87998368e+08 (2022-10-20T22:39:28Z) 0xb4-0xbb.7 (8) 0x1b0| 40 10 00 00 | @... | key: "target_creation_date" (4160) (Date) 0x1b8-0x1bb.7 (4) 0x1b0| 7c 00 00 00| |...| offset_to_record: 124 0x1bc-0x1bf.7 (4) - | | | [4]{}: entry 0x16c-0x1cb.7 (96) - | | | record{}: 0x16c-0x174.7 (9) +0x1c0|00 00 00 00 |.... | unused: 0 0x1c0-0x1c3.7 (4) + | | | [4]{}: entry 0x16c-0x1cf.7 (100) + | | | record{}: 0x16c-0x177.7 (12) 0x160| 01 00 00 00| ....| length: 1 0x16c-0x16f.7 (4) 0x170|01 01 00 00 |.... | type: "string" (257) (UTF-8 String) 0x170-0x173.7 (4) 0x170| 2f | / | data: "/" 0x174-0x174.7 (1) +0x170| 00 00 00 | ... | alignment_bytes: raw bits 0x175-0x177.7 (3) 0x1c0| 02 20 00 00 | . .. | key: "volume_path" (8194) (Array of individual path components) 0x1c4-0x1c7.7 (4) 0x1c0| 3c 01 00 00 | <... | offset_to_record: 316 0x1c8-0x1cb.7 (4) - | | | [5]{}: entry 0xdc-0x1d7.7 (252) +0x1c0| 00 00 00 00| ....| unused: 0 0x1cc-0x1cf.7 (4) + | | | [5]{}: entry 0xdc-0x1db.7 (256) | | | record{}: 0xdc-0xeb.7 (16) 0x0d0| 08 00 00 00| ....| length: 8 0xdc-0xdf.7 (4) 0x0e0|01 09 00 00 |.... | type: "url" (2305) (UTF-8 string) 0xe0-0xe3.7 (4) 0x0e0| 66 69 6c 65 3a 2f 2f 2f | file:/// | data: "file:///" 0xe4-0xeb.7 (8) 0x1d0|05 20 00 00 |. .. | key: "volume_url" (8197) (URL of volume root) 0x1d0-0x1d3.7 (4) 0x1d0| ac 00 00 00 | .... | offset_to_record: 172 0x1d4-0x1d7.7 (4) - | | | [6]{}: entry 0xec-0x1e3.7 (248) - | | | record{}: 0xec-0xff.7 (20) +0x1d0| 00 00 00 00 | .... | unused: 0 0x1d8-0x1db.7 (4) + | | | [6]{}: entry 0xec-0x1e7.7 (252) + | | | record{}: 0xec-0x103.7 (24) 0x0e0| 0c 00 00 00| ....| length: 12 0xec-0xef.7 (4) 0x0f0|01 01 00 00 |.... | type: "string" (257) (UTF-8 String) 0xf0-0xf3.7 (4) 0x0f0| 4d 61 63 69 6e 74 6f 73 68 20 48 44| Macintosh HD| data: "Macintosh HD" 0xf4-0xff.7 (12) +0x100|08 00 00 00 |.... | alignment_bytes: raw bits 0x100-0x103.7 (4) 0x1d0| 10 20 00 00| . ..| key: "volume_name" (8208) (String) 0x1dc-0x1df.7 (4) 0x1e0|bc 00 00 00 |.... | offset_to_record: 188 0x1e0-0x1e3.7 (4) - | | | [7]{}: entry 0x120-0x1ef.7 (208) - | | | record{}: 0x120-0x14b.7 (44) +0x1e0| 00 00 00 00 | .... | unused: 0 0x1e4-0x1e7.7 (4) + | | | [7]{}: entry 0x120-0x1f3.7 (212) + | | | record{}: 0x120-0x14f.7 (48) 0x120|24 00 00 00 |$... | length: 36 0x120-0x123.7 (4) 0x120| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x124-0x127.7 (4) 0x120| 41 41 41 41 41 41 41 41| AAAAAAAA| data: "AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA" 0x128-0x14b.7 (36) 0x130|2d 41 41 41 41 2d 41 41 41 41 2d 41 41 41 41 2d|-AAAA-AAAA-AAAA-| 0x140|41 41 41 41 41 41 41 41 41 41 41 41 |AAAAAAAAAAAA | +0x140| 18 00 00 00| ....| alignment_bytes: raw bits 0x14c-0x14f.7 (4) 0x1e0| 11 20 00 00 | . .. | key: "volume_uuid" (8209) (String UUID) 0x1e8-0x1eb.7 (4) 0x1e0| f0 00 00 00| ....| offset_to_record: 240 0x1ec-0x1ef.7 (4) - | | | [8]{}: entry 0x100-0x1fb.7 (252) +0x1f0|00 00 00 00 |.... | unused: 0 0x1f0-0x1f3.7 (4) + | | | [8]{}: entry 0x100-0x1ff.7 (256) | | | record{}: 0x100-0x10f.7 (16) 0x100|08 00 00 00 |.... | length: 8 0x100-0x103.7 (4) 0x100| 04 03 00 00 | .... | type: "long" (772) ((signed 64-bit) 8-byte number) 0x104-0x107.7 (4) 0x100| 00 a0 20 68 74 00 00 00| .. ht...| data: 499963174912 0x108-0x10f.7 (8) 0x1f0| 12 20 00 00 | . .. | key: "volume_size" (8210) (8-byte integer) 0x1f4-0x1f7.7 (4) 0x1f0| d0 00 00 00 | .... | offset_to_record: 208 0x1f8-0x1fb.7 (4) - | | | [9]{}: entry 0x110-0x207.7 (248) +0x1f0| 00 00 00 00| ....| unused: 0 0x1fc-0x1ff.7 (4) + | | | [9]{}: entry 0x110-0x20b.7 (252) | | | record{}: 0x110-0x11f.7 (16) 0x110|08 00 00 00 |.... | length: 8 0x110-0x113.7 (4) 0x110| 00 04 00 00 | .... | type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0x114-0x117.7 (4) 0x110| 41 c1 de 44 80 00 00 00| A..D....| data: 5.995584e+08 (2020-01-01T08:00:00Z) 0x118-0x11f.7 (8) 0x200|13 20 00 00 |. .. | key: "volume_creation_date" (8211) (Date) 0x200-0x203.7 (4) 0x200| e0 00 00 00 | .... | offset_to_record: 224 0x204-0x207.7 (4) - | | | [10]{}: entry 0x14c-0x213.7 (200) +0x200| 00 00 00 00 | .... | unused: 0 0x208-0x20b.7 (4) + | | | [10]{}: entry 0x14c-0x217.7 (204) | | | record{}: 0x14c-0x16b.7 (32) 0x140| 18 00 00 00| ....| length: 24 (valid) 0x14c-0x14f.7 (4) 0x150|01 02 00 00 |.... | raw_type: "data" (513) (valid) 0x150-0x153.7 (4) @@ -197,6 +215,7 @@ $ fq dv sample1.book 0x150| 00 | . | supports_decmp_fs_compression: false 0x159.4-0x159.4 (0.1) 0x150| 00 | . | has64_bit_object_ids: false 0x159.5-0x159.5 (0.1) 0x150| 00 | . | property_flags_all: false 0x159.6-0x159.6 (0.1) +0x150| 00 00 00 | ... | unused_property_bits: raw bits 0x159.7-0x15b.7 (2.1) | | | enabled_property_flags{}: 0x15c-0x161.6 (5.7) 0x150| ef | . | is_local: true 0x15c-0x15c (0.1) 0x150| ef | . | is_automount: true 0x15c.1-0x15c.1 (0.1) @@ -245,29 +264,26 @@ $ fq dv sample1.book 0x160| 00 | . | supports_decmp_fs_compression: false 0x161.4-0x161.4 (0.1) 0x160| 00 | . | has64_bit_object_ids: false 0x161.5-0x161.5 (0.1) 0x160| 00 | . | property_flags_all: false 0x161.6-0x161.6 (0.1) +0x160| 00 00 00 | ... | unused_indicator_bits: raw bits 0x161.7-0x163.7 (2.1) 0x160| 00 00 00 00 00 00 00 00 | ........ | reserved: raw bits 0x164-0x16b.7 (8) 0x200| 20 20 00 00| ..| key: "volume_flags" (8224) (flag bitfield) 0x20c-0x20f.7 (4) 0x210|1c 01 00 00 |.... | offset_to_record: 284 0x210-0x213.7 (4) - | | | [11]{}: entry 0x178-0x21f.7 (168) +0x210| 00 00 00 00 | .... | unused: 0 0x214-0x217.7 (4) + | | | [11]{}: entry 0x178-0x223.7 (172) | | | record{}: 0x178-0x17f.7 (8) 0x170| 00 00 00 00 | .... | length: 0 0x178-0x17b.7 (4) 0x170| 01 05 00 00| ....| type: "boolean_true" (1281) (True) 0x17c-0x17f.7 (4) 0x210| 30 20 00 00 | 0 .. | key: "volume_is_root" (8240) (True if the volume was the filesystem root) 0x218-0x21b.7 (4) 0x210| 48 01 00 00| H...| offset_to_record: 328 0x21c-0x21f.7 (4) - | | | [12]{}: entry 0x34-0x22b.7 (504) +0x220|00 00 00 00 |.... | unused: 0 0x220-0x223.7 (4) + | | | [12]{}: entry 0x34-0x22f.7 (508) | | | record{}: 0x34-0x3f.7 (12) 0x030| 04 00 00 00 | .... | length: 4 0x34-0x37.7 (4) 0x030| 03 03 00 00 | .... | type: "int" (771) ((signed 32-bit) 4-byte number) 0x38-0x3b.7 (4) 0x030| 00 00 00 20| ... | data: 536870912 0x3c-0x3f.7 (4) 0x220| 10 d0 00 00 | .... | key: "creation_options" (53264) (Integer containing flags passed to CFURLCreateBookmarkData) 0x224-0x227.7 (4) 0x220| 04 00 00 00 | .... | offset_to_record: 4 0x228-0x22b.7 (4) -0x060| 00 00 00 | ... | unknown0: raw bits 0x69-0x6b.7 (3) -0x0c0| 00 00 00 00 00 00 | ...... | unknown1: raw bits 0xc6.1-0xcb.7 (5.7) -0x0c0| 00 00| ..| unknown2: raw bits 0xce.1-0xd3.7 (5.7) -0x0d0|00 00 00 00 |.... | -0x150| 00 00 00 | ... | unknown3: raw bits 0x159.7-0x15b.7 (2.1) -0x160| 00 00 00 | ... | unknown4: raw bits 0x161.7-0x163.7 (2.1) -0x170| 00 00 00 | ... | unknown5: raw bits 0x175-0x177.7 (3) +0x220| 00 00 00 00| ....| unused: 0 0x22c-0x22f.7 (4) | | | toc_headers[0:1]: 0x180-0x193.7 (20) | | | [0]{}: toc_header 0x180-0x193.7 (20) 0x180|a8 00 00 00 |.... | toc_size: 168 0x180-0x183.7 (4) @@ -275,19 +291,6 @@ $ fq dv sample1.book 0x180| 01 00 00 00 | .... | identifier: 1 0x188-0x18b.7 (4) 0x180| 00 00 00 00| ....| next_toc_offset: 0 0x18c-0x18f.7 (4) 0x190|0d 00 00 00 |.... | num_entries_in_toc: 13 0x190-0x193.7 (4) -0x190| 00 00 00 00| ....| unknown6: raw bits 0x19c-0x19f.7 (4) -0x1a0| 00 00 00 00 | .... | unknown7: raw bits 0x1a8-0x1ab.7 (4) -0x1b0| 00 00 00 00 | .... | unknown8: raw bits 0x1b4-0x1b7.7 (4) -0x1c0|00 00 00 00 |.... | unknown9: raw bits 0x1c0-0x1c3.7 (4) -0x1c0| 00 00 00 00| ....| unknown10: raw bits 0x1cc-0x1cf.7 (4) -0x1d0| 00 00 00 00 | .... | unknown11: raw bits 0x1d8-0x1db.7 (4) -0x1e0| 00 00 00 00 | .... | unknown12: raw bits 0x1e4-0x1e7.7 (4) -0x1f0|00 00 00 00 |.... | unknown13: raw bits 0x1f0-0x1f3.7 (4) -0x1f0| 00 00 00 00| ....| unknown14: raw bits 0x1fc-0x1ff.7 (4) -0x200| 00 00 00 00 | .... | unknown15: raw bits 0x208-0x20b.7 (4) -0x210| 00 00 00 00 | .... | unknown16: raw bits 0x214-0x217.7 (4) -0x220|00 00 00 00 |.... | unknown17: raw bits 0x220-0x223.7 (4) -0x220| 00 00 00 00| ....| unknown18: raw bits 0x22c-0x22f.7 (4) $ fq torepr sample1.book { "creation_options": 536870912, diff --git a/format/applebookmark/testdata/sample2.fqtest b/format/applebookmark/testdata/sample2.fqtest index 91dda4bb..1f1f6bfc 100644 --- a/format/applebookmark/testdata/sample2.fqtest +++ b/format/applebookmark/testdata/sample2.fqtest @@ -8,34 +8,38 @@ $ fq dv sample2.book 0x010|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| reserved: raw bits 0x10-0x2f.7 (32) 0x020|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| 0x030|90 01 00 00 |.... | first_toc_offset: 400 0x30-0x33.7 (4) - | | | bookmark_entries[0:18]: 0x34-0x2a7.7 (628) - | | | [0]{}: entry 0x40-0x1db.7 (412) + | | | bookmark_entries[0:18]: 0x34-0x2ab.7 (632) + | | | [0]{}: entry 0x40-0x1df.7 (416) | | | record{}: 0x40-0x8b.7 (76) | | | data[0:3]: 0x40-0x8b.7 (76) | | | [0]{}: element 0x40-0x83.7 (68) - | | | record{}: 0x40-0x4c.7 (13) + | | | record{}: 0x40-0x4f.7 (16) 0x040|05 00 00 00 |.... | length: 5 0x40-0x43.7 (4) 0x040| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x44-0x47.7 (4) 0x040| 55 73 65 72 73 | Users | data: "Users" 0x48-0x4c.7 (5) +0x040| 00 00 00| ...| alignment_bytes: raw bits 0x4d-0x4f.7 (3) 0x080|10 00 00 00 |.... | offset: 16 0x80-0x83.7 (4) | | | [1]{}: element 0x50-0x87.7 (56) - | | | record{}: 0x50-0x64.7 (21) + | | | record{}: 0x50-0x67.7 (24) 0x050|0d 00 00 00 |.... | length: 13 0x50-0x53.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x54-0x57.7 (4) 0x050| 64 61 76 69 64 6d 63 64| davidmcd| data: "davidmcdonald" 0x58-0x64.7 (13) 0x060|6f 6e 61 6c 64 |onald | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x65-0x67.7 (3) 0x080| 20 00 00 00 | ... | offset: 32 0x84-0x87.7 (4) | | | [2]{}: element 0x68-0x8b.7 (36) - | | | record{}: 0x68-0x76.7 (15) + | | | record{}: 0x68-0x77.7 (16) 0x060| 07 00 00 00 | .... | length: 7 0x68-0x6b.7 (4) 0x060| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0x6c-0x6f.7 (4) 0x070|68 78 73 74 6f 72 65 |hxstore | data: "hxstore" 0x70-0x76.7 (7) +0x070| 00 | . | alignment_bytes: raw bits 0x77-0x77.7 (1) 0x080| 38 00 00 00 | 8... | offset: 56 0x88-0x8b.7 (4) 0x070| 0c 00 00 00 | .... | length: 12 0x78-0x7b.7 (4) 0x070| 01 06 00 00| ....| type: "array" (1537) (Array of 4-byte offsets to data items) 0x7c-0x7f.7 (4) 0x1d0| 04 10 00 00 | .... | key: "target_path" (4100) (Array of individual path components) 0x1d4-0x1d7.7 (4) 0x1d0| 48 00 00 00 | H... | offset_to_record: 72 0x1d8-0x1db.7 (4) - | | | [1]{}: entry 0x8c-0x1e7.7 (348) +0x1d0| 00 00 00 00| ....| unused: 0 0x1dc-0x1df.7 (4) + | | | [1]{}: entry 0x8c-0x1eb.7 (352) | | | record{}: 0x8c-0xcf.7 (68) | | | data[0:3]: 0x8c-0xcf.7 (68) | | | [0]{}: element 0x8c-0xc7.7 (60) @@ -60,7 +64,8 @@ $ fq dv sample2.book 0x0c0|01 06 00 00 |.... | type: "array" (1537) (Array of 4-byte offsets to data items) 0xc0-0xc3.7 (4) 0x1e0|05 10 00 00 |.... | key: "target_cnid_path" (4101) (Array of CNIDs) 0x1e0-0x1e3.7 (4) 0x1e0| 8c 00 00 00 | .... | offset_to_record: 140 0x1e4-0x1e7.7 (4) - | | | [2]{}: entry 0xe0-0x1f3.7 (276) +0x1e0| 00 00 00 00 | .... | unused: 0 0x1e8-0x1eb.7 (4) + | | | [2]{}: entry 0xe0-0x1f7.7 (280) | | | record{}: 0xe0-0xff.7 (32) 0x0e0|18 00 00 00 |.... | length: 24 (valid) 0xe0-0xe3.7 (4) 0x0e0| 01 02 00 00 | .... | raw_type: "data" (513) (valid) 0xe4-0xe7.7 (4) @@ -83,6 +88,7 @@ $ fq dv sample2.book 0x0e0| 00 | . | is_executable: false 0xe9.6-0xe9.6 (0.1) 0x0e0| 00 | . | is_alias_file: false 0xe9.7-0xe9.7 (0.1) 0x0e0| 00 | . | is_mount_trigger: false 0xea-0xea (0.1) +0x0e0| 00 00 00 00 00 00| ......| unused_property_bits: raw bits 0xea.1-0xef.7 (5.7) | | | enabled_property_flags{}: 0xf0-0xf2 (2.1) 0x0f0|1f |. | is_regular_file: false 0xf0-0xf0 (0.1) 0x0f0|1f |. | is_directory: false 0xf0.1-0xf0.1 (0.1) @@ -101,61 +107,73 @@ $ fq dv sample2.book 0x0f0| 02 | . | is_executable: true 0xf1.6-0xf1.6 (0.1) 0x0f0| 02 | . | is_alias_file: false 0xf1.7-0xf1.7 (0.1) 0x0f0| 00 | . | is_mount_trigger: false 0xf2-0xf2 (0.1) +0x0f0| 00 00 00 00 00 00 | ...... | unused_indicator_bits: raw bits 0xf2.1-0xf7.7 (5.7) 0x0f0| 1a 02 00 00 00 00 00 00| ........| reserved: raw bits 0xf8-0xff.7 (8) 0x1e0| 10 10 00 00| ....| key: "target_flags" (4112) (flag bitfield) 0x1ec-0x1ef.7 (4) 0x1f0|b0 00 00 00 |.... | offset_to_record: 176 0x1f0-0x1f3.7 (4) - | | | [3]{}: entry 0xd0-0x1ff.7 (304) +0x1f0| 00 00 00 00 | .... | unused: 0 0x1f4-0x1f7.7 (4) + | | | [3]{}: entry 0xd0-0x203.7 (308) | | | record{}: 0xd0-0xdf.7 (16) 0x0d0|08 00 00 00 |.... | length: 8 0xd0-0xd3.7 (4) 0x0d0| 00 04 00 00 | .... | type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0xd4-0xd7.7 (4) 0x0d0| 41 c4 8a 17 83 4d f0 44| A....M.D| data: 6.891886146088948e+08 (2022-11-03T17:16:54Z) 0xd8-0xdf.7 (8) 0x1f0| 40 10 00 00 | @... | key: "target_creation_date" (4160) (Date) 0x1f8-0x1fb.7 (4) 0x1f0| a0 00 00 00| ....| offset_to_record: 160 0x1fc-0x1ff.7 (4) - | | | [4]{}: entry 0x1ac-0x20b.7 (96) - | | | record{}: 0x1ac-0x1b4.7 (9) +0x200|00 00 00 00 |.... | unused: 0 0x200-0x203.7 (4) + | | | [4]{}: entry 0x1ac-0x20f.7 (100) + | | | record{}: 0x1ac-0x1b7.7 (12) 0x1a0| 01 00 00 00| ....| length: 1 0x1ac-0x1af.7 (4) 0x1b0|01 01 00 00 |.... | type: "string" (257) (UTF-8 String) 0x1b0-0x1b3.7 (4) 0x1b0| 2f | / | data: "/" 0x1b4-0x1b4.7 (1) +0x1b0| 00 00 00 | ... | alignment_bytes: raw bits 0x1b5-0x1b7.7 (3) 0x200| 02 20 00 00 | . .. | key: "volume_path" (8194) (Array of individual path components) 0x204-0x207.7 (4) 0x200| 7c 01 00 00 | |... | offset_to_record: 380 0x208-0x20b.7 (4) - | | | [5]{}: entry 0x11c-0x217.7 (252) +0x200| 00 00 00 00| ....| unused: 0 0x20c-0x20f.7 (4) + | | | [5]{}: entry 0x11c-0x21b.7 (256) | | | record{}: 0x11c-0x12b.7 (16) 0x110| 08 00 00 00| ....| length: 8 0x11c-0x11f.7 (4) 0x120|01 09 00 00 |.... | type: "url" (2305) (UTF-8 string) 0x120-0x123.7 (4) 0x120| 66 69 6c 65 3a 2f 2f 2f | file:/// | data: "file:///" 0x124-0x12b.7 (8) 0x210|05 20 00 00 |. .. | key: "volume_url" (8197) (URL of volume root) 0x210-0x213.7 (4) 0x210| ec 00 00 00 | .... | offset_to_record: 236 0x214-0x217.7 (4) - | | | [6]{}: entry 0x12c-0x223.7 (248) - | | | record{}: 0x12c-0x13f.7 (20) +0x210| 00 00 00 00 | .... | unused: 0 0x218-0x21b.7 (4) + | | | [6]{}: entry 0x12c-0x227.7 (252) + | | | record{}: 0x12c-0x143.7 (24) 0x120| 0c 00 00 00| ....| length: 12 0x12c-0x12f.7 (4) 0x130|01 01 00 00 |.... | type: "string" (257) (UTF-8 String) 0x130-0x133.7 (4) 0x130| 4d 61 63 69 6e 74 6f 73 68 20 48 44| Macintosh HD| data: "Macintosh HD" 0x134-0x13f.7 (12) +0x140|08 00 00 00 |.... | alignment_bytes: raw bits 0x140-0x143.7 (4) 0x210| 10 20 00 00| . ..| key: "volume_name" (8208) (String) 0x21c-0x21f.7 (4) 0x220|fc 00 00 00 |.... | offset_to_record: 252 0x220-0x223.7 (4) - | | | [7]{}: entry 0x160-0x22f.7 (208) - | | | record{}: 0x160-0x18b.7 (44) +0x220| 00 00 00 00 | .... | unused: 0 0x224-0x227.7 (4) + | | | [7]{}: entry 0x160-0x233.7 (212) + | | | record{}: 0x160-0x18f.7 (48) 0x160|24 00 00 00 |$... | length: 36 0x160-0x163.7 (4) 0x160| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x164-0x167.7 (4) 0x160| 38 41 38 32 39 41 30 33| 8A829A03| data: "8A829A03-9B24-4085-8051-18978712E4BE" 0x168-0x18b.7 (36) 0x170|2d 39 42 32 34 2d 34 30 38 35 2d 38 30 35 31 2d|-9B24-4085-8051-| 0x180|31 38 39 37 38 37 31 32 45 34 42 45 |18978712E4BE | +0x180| 18 00 00 00| ....| alignment_bytes: raw bits 0x18c-0x18f.7 (4) 0x220| 11 20 00 00 | . .. | key: "volume_uuid" (8209) (String UUID) 0x228-0x22b.7 (4) 0x220| 30 01 00 00| 0...| offset_to_record: 304 0x22c-0x22f.7 (4) - | | | [8]{}: entry 0x140-0x23b.7 (252) +0x230|00 00 00 00 |.... | unused: 0 0x230-0x233.7 (4) + | | | [8]{}: entry 0x140-0x23f.7 (256) | | | record{}: 0x140-0x14f.7 (16) 0x140|08 00 00 00 |.... | length: 8 0x140-0x143.7 (4) 0x140| 04 03 00 00 | .... | type: "long" (772) ((signed 64-bit) 8-byte number) 0x144-0x147.7 (4) 0x140| 00 a0 20 68 74 00 00 00| .. ht...| data: 499963174912 0x148-0x14f.7 (8) 0x230| 12 20 00 00 | . .. | key: "volume_size" (8210) (8-byte integer) 0x234-0x237.7 (4) 0x230| 10 01 00 00 | .... | offset_to_record: 272 0x238-0x23b.7 (4) - | | | [9]{}: entry 0x150-0x247.7 (248) +0x230| 00 00 00 00| ....| unused: 0 0x23c-0x23f.7 (4) + | | | [9]{}: entry 0x150-0x24b.7 (252) | | | record{}: 0x150-0x15f.7 (16) 0x150|08 00 00 00 |.... | length: 8 0x150-0x153.7 (4) 0x150| 00 04 00 00 | .... | type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0x154-0x157.7 (4) 0x150| 41 c1 de 44 80 00 00 00| A..D....| data: 5.995584e+08 (2020-01-01T08:00:00Z) 0x158-0x15f.7 (8) 0x240|13 20 00 00 |. .. | key: "volume_creation_date" (8211) (Date) 0x240-0x243.7 (4) 0x240| 20 01 00 00 | ... | offset_to_record: 288 0x244-0x247.7 (4) - | | | [10]{}: entry 0x18c-0x253.7 (200) +0x240| 00 00 00 00 | .... | unused: 0 0x248-0x24b.7 (4) + | | | [10]{}: entry 0x18c-0x257.7 (204) | | | record{}: 0x18c-0x1ab.7 (32) 0x180| 18 00 00 00| ....| length: 24 (valid) 0x18c-0x18f.7 (4) 0x190|01 02 00 00 |.... | raw_type: "data" (513) (valid) 0x190-0x193.7 (4) @@ -208,6 +226,7 @@ $ fq dv sample2.book 0x190| 00 | . | supports_decmp_fs_compression: false 0x199.4-0x199.4 (0.1) 0x190| 00 | . | has64_bit_object_ids: false 0x199.5-0x199.5 (0.1) 0x190| 00 | . | property_flags_all: false 0x199.6-0x199.6 (0.1) +0x190| 00 00 00 | ... | unused_property_bits: raw bits 0x199.7-0x19b.7 (2.1) | | | enabled_property_flags{}: 0x19c-0x1a1.6 (5.7) 0x190| ef | . | is_local: true 0x19c-0x19c (0.1) 0x190| ef | . | is_automount: true 0x19c.1-0x19c.1 (0.1) @@ -256,65 +275,68 @@ $ fq dv sample2.book 0x1a0| 00 | . | supports_decmp_fs_compression: false 0x1a1.4-0x1a1.4 (0.1) 0x1a0| 00 | . | has64_bit_object_ids: false 0x1a1.5-0x1a1.5 (0.1) 0x1a0| 00 | . | property_flags_all: false 0x1a1.6-0x1a1.6 (0.1) +0x1a0| 00 00 00 | ... | unused_indicator_bits: raw bits 0x1a1.7-0x1a3.7 (2.1) 0x1a0| 00 00 00 00 00 00 00 00 | ........ | reserved: raw bits 0x1a4-0x1ab.7 (8) 0x240| 20 20 00 00| ..| key: "volume_flags" (8224) (flag bitfield) 0x24c-0x24f.7 (4) 0x250|5c 01 00 00 |\... | offset_to_record: 348 0x250-0x253.7 (4) - | | | [11]{}: entry 0x1b8-0x25f.7 (168) +0x250| 00 00 00 00 | .... | unused: 0 0x254-0x257.7 (4) + | | | [11]{}: entry 0x1b8-0x263.7 (172) | | | record{}: 0x1b8-0x1bf.7 (8) 0x1b0| 00 00 00 00 | .... | length: 0 0x1b8-0x1bb.7 (4) 0x1b0| 01 05 00 00| ....| type: "boolean_true" (1281) (True) 0x1bc-0x1bf.7 (4) 0x250| 30 20 00 00 | 0 .. | key: "volume_is_root" (8240) (True if the volume was the filesystem root) 0x258-0x25b.7 (4) 0x250| 88 01 00 00| ....| offset_to_record: 392 0x25c-0x25f.7 (4) - | | | [12]{}: entry 0x100-0x26b.7 (364) +0x260|00 00 00 00 |.... | unused: 0 0x260-0x263.7 (4) + | | | [12]{}: entry 0x100-0x26f.7 (368) | | | record{}: 0x100-0x10f.7 (16) 0x100|08 00 00 00 |.... | length: 8 0x100-0x103.7 (4) 0x100| 04 03 00 00 | .... | type: "long" (772) ((signed 64-bit) 8-byte number) 0x104-0x107.7 (4) 0x100| 01 00 00 00 00 00 00 00| ........| data: 1 0x108-0x10f.7 (8) 0x260| 01 c0 00 00 | .... | key: "containing_folder_index" (49153) (Integer index of containing folder in target path array) 0x264-0x267.7 (4) 0x260| d0 00 00 00 | .... | offset_to_record: 208 0x268-0x26b.7 (4) - | | | [13]{}: entry 0x50-0x277.7 (552) - | | | record{}: 0x50-0x64.7 (21) +0x260| 00 00 00 00| ....| unused: 0 0x26c-0x26f.7 (4) + | | | [13]{}: entry 0x50-0x27b.7 (556) + | | | record{}: 0x50-0x67.7 (24) 0x050|0d 00 00 00 |.... | length: 13 0x50-0x53.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x54-0x57.7 (4) 0x050| 64 61 76 69 64 6d 63 64| davidmcd| data: "davidmcdonald" 0x58-0x64.7 (13) 0x060|6f 6e 61 6c 64 |onald | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x65-0x67.7 (3) 0x270|11 c0 00 00 |.... | key: "creator_username" (49169) (Name of user that created bookmark) 0x270-0x273.7 (4) 0x270| 20 00 00 00 | ... | offset_to_record: 32 0x274-0x277.7 (4) - | | | [14]{}: entry 0x110-0x283.7 (372) +0x270| 00 00 00 00 | .... | unused: 0 0x278-0x27b.7 (4) + | | | [14]{}: entry 0x110-0x287.7 (376) | | | record{}: 0x110-0x11b.7 (12) 0x110|04 00 00 00 |.... | length: 4 0x110-0x113.7 (4) 0x110| 03 03 00 00 | .... | type: "int" (771) ((signed 32-bit) 4-byte number) 0x114-0x117.7 (4) 0x110| f5 01 00 00 | .... | data: 501 0x118-0x11b.7 (4) 0x270| 12 c0 00 00| ....| key: "creator_uid" (49170) (UID of user that created bookmark) 0x27c-0x27f.7 (4) 0x280|e0 00 00 00 |.... | offset_to_record: 224 0x280-0x283.7 (4) - | | | [15]{}: entry 0x34-0x28f.7 (604) +0x280| 00 00 00 00 | .... | unused: 0 0x284-0x287.7 (4) + | | | [15]{}: entry 0x34-0x293.7 (608) | | | record{}: 0x34-0x3f.7 (12) 0x030| 04 00 00 00 | .... | length: 4 0x34-0x37.7 (4) 0x030| 03 03 00 00 | .... | type: "int" (771) ((signed 32-bit) 4-byte number) 0x38-0x3b.7 (4) 0x030| 00 00 00 20| ... | data: 536870912 0x3c-0x3f.7 (4) 0x280| 10 d0 00 00 | .... | key: "creation_options" (53264) (Integer containing flags passed to CFURLCreateBookmarkData) 0x288-0x28b.7 (4) 0x280| 04 00 00 00| ....| offset_to_record: 4 0x28c-0x28f.7 (4) - | | | [16]{}: entry 0x68-0x29b.7 (564) - | | | record{}: 0x68-0x76.7 (15) +0x290|00 00 00 00 |.... | unused: 0 0x290-0x293.7 (4) + | | | [16]{}: entry 0x68-0x29f.7 (568) + | | | record{}: 0x68-0x77.7 (16) 0x060| 07 00 00 00 | .... | length: 7 0x68-0x6b.7 (4) 0x060| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0x6c-0x6f.7 (4) 0x070|68 78 73 74 6f 72 65 |hxstore | data: "hxstore" 0x70-0x76.7 (7) +0x070| 00 | . | alignment_bytes: raw bits 0x77-0x77.7 (1) 0x290| 17 f0 00 00 | .... | key: "display_name" (61463) (String) 0x294-0x297.7 (4) 0x290| 38 00 00 00 | 8... | offset_to_record: 56 0x298-0x29b.7 (4) - | | | [17]{}: entry 0x1b8-0x2a7.7 (240) +0x290| 00 00 00 00| ....| unused: 0 0x29c-0x29f.7 (4) + | | | [17]{}: entry 0x1b8-0x2ab.7 (244) | | | record{}: 0x1b8-0x1bf.7 (8) 0x1b0| 00 00 00 00 | .... | length: 0 0x1b8-0x1bb.7 (4) 0x1b0| 01 05 00 00| ....| type: "boolean_true" (1281) (True) 0x1bc-0x1bf.7 (4) 0x2a0|0f 00 0f 00 |.... | key: 983055 0x2a0-0x2a3.7 (4) 0x2a0| 88 01 00 00 | .... | offset_to_record: 392 0x2a4-0x2a7.7 (4) -0x040| 00 00 00| ...| unknown0: raw bits 0x4d-0x4f.7 (3) -0x060| 00 00 00 | ... | unknown1: raw bits 0x65-0x67.7 (3) -0x070| 00 | . | unknown2: raw bits 0x77-0x77.7 (1) -0x0e0| 00 00 00 00 00 00| ......| unknown3: raw bits 0xea.1-0xef.7 (5.7) -0x0f0| 00 00 00 00 00 00 | ...... | unknown4: raw bits 0xf2.1-0xf7.7 (5.7) -0x190| 00 00 00 | ... | unknown5: raw bits 0x199.7-0x19b.7 (2.1) -0x1a0| 00 00 00 | ... | unknown6: raw bits 0x1a1.7-0x1a3.7 (2.1) -0x1b0| 00 00 00 | ... | unknown7: raw bits 0x1b5-0x1b7.7 (3) +0x2a0| 00 00 00 00| | ....| | unused: 0 0x2a8-0x2ab.7 (4) | | | toc_headers[0:1]: 0x1c0-0x1d3.7 (20) | | | [0]{}: toc_header 0x1c0-0x1d3.7 (20) 0x1c0|e4 00 00 00 |.... | toc_size: 228 0x1c0-0x1c3.7 (4) @@ -322,24 +344,6 @@ $ fq dv sample2.book 0x1c0| 01 00 00 00 | .... | identifier: 1 0x1c8-0x1cb.7 (4) 0x1c0| 00 00 00 00| ....| next_toc_offset: 0 0x1cc-0x1cf.7 (4) 0x1d0|12 00 00 00 |.... | num_entries_in_toc: 18 0x1d0-0x1d3.7 (4) -0x1d0| 00 00 00 00| ....| unknown8: raw bits 0x1dc-0x1df.7 (4) -0x1e0| 00 00 00 00 | .... | unknown9: raw bits 0x1e8-0x1eb.7 (4) -0x1f0| 00 00 00 00 | .... | unknown10: raw bits 0x1f4-0x1f7.7 (4) -0x200|00 00 00 00 |.... | unknown11: raw bits 0x200-0x203.7 (4) -0x200| 00 00 00 00| ....| unknown12: raw bits 0x20c-0x20f.7 (4) -0x210| 00 00 00 00 | .... | unknown13: raw bits 0x218-0x21b.7 (4) -0x220| 00 00 00 00 | .... | unknown14: raw bits 0x224-0x227.7 (4) -0x230|00 00 00 00 |.... | unknown15: raw bits 0x230-0x233.7 (4) -0x230| 00 00 00 00| ....| unknown16: raw bits 0x23c-0x23f.7 (4) -0x240| 00 00 00 00 | .... | unknown17: raw bits 0x248-0x24b.7 (4) -0x250| 00 00 00 00 | .... | unknown18: raw bits 0x254-0x257.7 (4) -0x260|00 00 00 00 |.... | unknown19: raw bits 0x260-0x263.7 (4) -0x260| 00 00 00 00| ....| unknown20: raw bits 0x26c-0x26f.7 (4) -0x270| 00 00 00 00 | .... | unknown21: raw bits 0x278-0x27b.7 (4) -0x280| 00 00 00 00 | .... | unknown22: raw bits 0x284-0x287.7 (4) -0x290|00 00 00 00 |.... | unknown23: raw bits 0x290-0x293.7 (4) -0x290| 00 00 00 00| ....| unknown24: raw bits 0x29c-0x29f.7 (4) -0x2a0| 00 00 00 00| | ....| | unknown25: raw bits 0x2a8-0x2ab.7 (4) $ fq torepr sample2.book { "983055": true, diff --git a/format/applebookmark/testdata/sample3.fqtest b/format/applebookmark/testdata/sample3.fqtest index 29c85502..4a96485a 100644 --- a/format/applebookmark/testdata/sample3.fqtest +++ b/format/applebookmark/testdata/sample3.fqtest @@ -8,53 +8,60 @@ $ fq dv sample3.book 0x010|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| reserved: raw bits 0x10-0x2f.7 (32) 0x020|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| 0x030|18 02 00 00 |.... | first_toc_offset: 536 0x30-0x33.7 (4) - | | | bookmark_entries[0:18]: 0x34-0x32f.7 (764) - | | | [0]{}: entry 0x40-0x263.7 (548) + | | | bookmark_entries[0:18]: 0x34-0x333.7 (768) + | | | [0]{}: entry 0x40-0x267.7 (552) | | | record{}: 0x40-0xd7.7 (152) | | | data[0:6]: 0x40-0xd7.7 (152) | | | [0]{}: element 0x40-0xc3.7 (132) - | | | record{}: 0x40-0x4c.7 (13) + | | | record{}: 0x40-0x4f.7 (16) 0x040|05 00 00 00 |.... | length: 5 0x40-0x43.7 (4) 0x040| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x44-0x47.7 (4) 0x040| 55 73 65 72 73 | Users | data: "Users" 0x48-0x4c.7 (5) +0x040| 00 00 00| ...| alignment_bytes: raw bits 0x4d-0x4f.7 (3) 0x0c0|10 00 00 00 |.... | offset: 16 0xc0-0xc3.7 (4) | | | [1]{}: element 0x50-0xc7.7 (120) - | | | record{}: 0x50-0x64.7 (21) + | | | record{}: 0x50-0x67.7 (24) 0x050|0d 00 00 00 |.... | length: 13 0x50-0x53.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x54-0x57.7 (4) 0x050| 64 61 76 69 64 6d 63 64| davidmcd| data: "davidmcdonald" 0x58-0x64.7 (13) 0x060|6f 6e 61 6c 64 |onald | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x65-0x67.7 (3) 0x0c0| 20 00 00 00 | ... | offset: 32 0xc4-0xc7.7 (4) | | | [2]{}: element 0x68-0xcb.7 (100) - | | | record{}: 0x68-0x78.7 (17) + | | | record{}: 0x68-0x7b.7 (20) 0x060| 09 00 00 00 | .... | length: 9 0x68-0x6b.7 (4) 0x060| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0x6c-0x6f.7 (4) 0x070|44 6f 63 75 6d 65 6e 74 73 |Documents | data: "Documents" 0x70-0x78.7 (9) +0x070| 00 00 00 | ... | alignment_bytes: raw bits 0x79-0x7b.7 (3) 0x0c0| 38 00 00 00 | 8... | offset: 56 0xc8-0xcb.7 (4) | | | [3]{}: element 0x7c-0xcf.7 (84) - | | | record{}: 0x7c-0x8a.7 (15) + | | | record{}: 0x7c-0x8b.7 (16) 0x070| 07 00 00 00| ....| length: 7 0x7c-0x7f.7 (4) 0x080|01 01 00 00 |.... | type: "string" (257) (UTF-8 String) 0x80-0x83.7 (4) 0x080| 41 72 64 75 69 6e 6f | Arduino | data: "Arduino" 0x84-0x8a.7 (7) +0x080| 00 | . | alignment_bytes: raw bits 0x8b-0x8b.7 (1) 0x0c0| 4c 00 00 00| L...| offset: 76 0xcc-0xcf.7 (4) | | | [4]{}: element 0x8c-0xd3.7 (72) - | | | record{}: 0x8c-0xa5.7 (26) + | | | record{}: 0x8c-0xa7.7 (28) 0x080| 12 00 00 00| ....| length: 18 0x8c-0x8f.7 (4) 0x090|01 01 00 00 |.... | type: "string" (257) (UTF-8 String) 0x90-0x93.7 (4) 0x090| 67 65 6e 65 72 61 74 65 64 5f 65 78| generated_ex| data: "generated_examples" 0x94-0xa5.7 (18) 0x0a0|61 6d 70 6c 65 73 |amples | +0x0a0| 00 00 | .. | alignment_bytes: raw bits 0xa6-0xa7.7 (2) 0x0d0|5c 00 00 00 |\... | offset: 92 0xd0-0xd3.7 (4) | | | [5]{}: element 0xa8-0xd7.7 (48) - | | | record{}: 0xa8-0xb4.7 (13) + | | | record{}: 0xa8-0xb7.7 (16) 0x0a0| 05 00 00 00 | .... | length: 5 0xa8-0xab.7 (4) 0x0a0| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0xac-0xaf.7 (4) 0x0b0|42 6c 69 6e 6b |Blink | data: "Blink" 0xb0-0xb4.7 (5) +0x0b0| 00 00 00 | ... | alignment_bytes: raw bits 0xb5-0xb7.7 (3) 0x0d0| 78 00 00 00 | x... | offset: 120 0xd4-0xd7.7 (4) 0x0b0| 18 00 00 00 | .... | length: 24 0xb8-0xbb.7 (4) 0x0b0| 01 06 00 00| ....| type: "array" (1537) (Array of 4-byte offsets to data items) 0xbc-0xbf.7 (4) 0x250| 04 10 00 00| ....| key: "target_path" (4100) (Array of individual path components) 0x25c-0x25f.7 (4) 0x260|88 00 00 00 |.... | offset_to_record: 136 0x260-0x263.7 (4) - | | | [1]{}: entry 0xd8-0x26f.7 (408) +0x260| 00 00 00 00 | .... | unused: 0 0x264-0x267.7 (4) + | | | [1]{}: entry 0xd8-0x273.7 (412) | | | record{}: 0xd8-0x157.7 (128) | | | data[0:6]: 0xd8-0x157.7 (128) | | | [0]{}: element 0xd8-0x143.7 (108) @@ -97,7 +104,8 @@ $ fq dv sample3.book 0x130| 01 06 00 00| ....| type: "array" (1537) (Array of 4-byte offsets to data items) 0x13c-0x13f.7 (4) 0x260| 05 10 00 00 | .... | key: "target_cnid_path" (4101) (Array of CNIDs) 0x268-0x26b.7 (4) 0x260| 08 01 00 00| ....| offset_to_record: 264 0x26c-0x26f.7 (4) - | | | [2]{}: entry 0x168-0x27b.7 (276) +0x270|00 00 00 00 |.... | unused: 0 0x270-0x273.7 (4) + | | | [2]{}: entry 0x168-0x27f.7 (280) | | | record{}: 0x168-0x187.7 (32) 0x160| 18 00 00 00 | .... | length: 24 (valid) 0x168-0x16b.7 (4) 0x160| 01 02 00 00| ....| raw_type: "data" (513) (valid) 0x16c-0x16f.7 (4) @@ -120,6 +128,7 @@ $ fq dv sample3.book 0x170| 00 | . | is_executable: false 0x171.6-0x171.6 (0.1) 0x170| 00 | . | is_alias_file: false 0x171.7-0x171.7 (0.1) 0x170| 00 | . | is_mount_trigger: false 0x172-0x172 (0.1) +0x170| 00 00 00 00 00 00 | ...... | unused_property_bits: raw bits 0x172.1-0x177.7 (5.7) | | | enabled_property_flags{}: 0x178-0x17a (2.1) 0x170| 1f | . | is_regular_file: false 0x178-0x178 (0.1) 0x170| 1f | . | is_directory: false 0x178.1-0x178.1 (0.1) @@ -138,24 +147,29 @@ $ fq dv sample3.book 0x170| 02 | . | is_executable: true 0x179.6-0x179.6 (0.1) 0x170| 02 | . | is_alias_file: false 0x179.7-0x179.7 (0.1) 0x170| 00 | . | is_mount_trigger: false 0x17a-0x17a (0.1) +0x170| 00 00 00 00 00 00| ......| unused_indicator_bits: raw bits 0x17a.1-0x17f.7 (5.7) 0x180|1a 02 00 00 00 00 00 00 |........ | reserved: raw bits 0x180-0x187.7 (8) 0x270| 10 10 00 00 | .... | key: "target_flags" (4112) (flag bitfield) 0x274-0x277.7 (4) 0x270| 38 01 00 00 | 8... | offset_to_record: 312 0x278-0x27b.7 (4) - | | | [3]{}: entry 0x158-0x287.7 (304) +0x270| 00 00 00 00| ....| unused: 0 0x27c-0x27f.7 (4) + | | | [3]{}: entry 0x158-0x28b.7 (308) | | | record{}: 0x158-0x167.7 (16) 0x150| 08 00 00 00 | .... | length: 8 0x158-0x15b.7 (4) 0x150| 00 04 00 00| ....| type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0x15c-0x15f.7 (4) 0x160|41 c4 11 9d 61 74 66 30 |A...atf0 | data: 6.733974429093685e+08 (2022-05-04T22:50:42Z) 0x160-0x167.7 (8) 0x280|40 10 00 00 |@... | key: "target_creation_date" (4160) (Date) 0x280-0x283.7 (4) 0x280| 28 01 00 00 | (... | offset_to_record: 296 0x284-0x287.7 (4) - | | | [4]{}: entry 0x234-0x293.7 (96) - | | | record{}: 0x234-0x23c.7 (9) +0x280| 00 00 00 00 | .... | unused: 0 0x288-0x28b.7 (4) + | | | [4]{}: entry 0x234-0x297.7 (100) + | | | record{}: 0x234-0x23f.7 (12) 0x230| 01 00 00 00 | .... | length: 1 0x234-0x237.7 (4) 0x230| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x238-0x23b.7 (4) 0x230| 2f | / | data: "/" 0x23c-0x23c.7 (1) +0x230| 00 00 00| ...| alignment_bytes: raw bits 0x23d-0x23f.7 (3) 0x280| 02 20 00 00| . ..| key: "volume_path" (8194) (Array of individual path components) 0x28c-0x28f.7 (4) 0x290|04 02 00 00 |.... | offset_to_record: 516 0x290-0x293.7 (4) - | | | [5]{}: entry 0x1a4-0x29f.7 (252) +0x290| 00 00 00 00 | .... | unused: 0 0x294-0x297.7 (4) + | | | [5]{}: entry 0x1a4-0x2a3.7 (256) | | | record{}: 0x1a4-0x1b3.7 (16) 0x1a0| 08 00 00 00 | .... | length: 8 0x1a4-0x1a7.7 (4) 0x1a0| 01 09 00 00 | .... | type: "url" (2305) (UTF-8 string) 0x1a8-0x1ab.7 (4) @@ -163,37 +177,44 @@ $ fq dv sample3.book 0x1b0|3a 2f 2f 2f |:/// | 0x290| 05 20 00 00 | . .. | key: "volume_url" (8197) (URL of volume root) 0x298-0x29b.7 (4) 0x290| 74 01 00 00| t...| offset_to_record: 372 0x29c-0x29f.7 (4) - | | | [6]{}: entry 0x1b4-0x2ab.7 (248) - | | | record{}: 0x1b4-0x1c7.7 (20) +0x2a0|00 00 00 00 |.... | unused: 0 0x2a0-0x2a3.7 (4) + | | | [6]{}: entry 0x1b4-0x2af.7 (252) + | | | record{}: 0x1b4-0x1cb.7 (24) 0x1b0| 0c 00 00 00 | .... | length: 12 0x1b4-0x1b7.7 (4) 0x1b0| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x1b8-0x1bb.7 (4) 0x1b0| 4d 61 63 69| Maci| data: "Macintosh HD" 0x1bc-0x1c7.7 (12) 0x1c0|6e 74 6f 73 68 20 48 44 |ntosh HD | +0x1c0| 08 00 00 00 | .... | alignment_bytes: raw bits 0x1c8-0x1cb.7 (4) 0x2a0| 10 20 00 00 | . .. | key: "volume_name" (8208) (String) 0x2a4-0x2a7.7 (4) 0x2a0| 84 01 00 00 | .... | offset_to_record: 388 0x2a8-0x2ab.7 (4) - | | | [7]{}: entry 0x1e8-0x2b7.7 (208) - | | | record{}: 0x1e8-0x213.7 (44) +0x2a0| 00 00 00 00| ....| unused: 0 0x2ac-0x2af.7 (4) + | | | [7]{}: entry 0x1e8-0x2bb.7 (212) + | | | record{}: 0x1e8-0x217.7 (48) 0x1e0| 24 00 00 00 | $... | length: 36 0x1e8-0x1eb.7 (4) 0x1e0| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0x1ec-0x1ef.7 (4) 0x1f0|38 41 38 32 39 41 30 33 2d 39 42 32 34 2d 34 30|8A829A03-9B24-40| data: "8A829A03-9B24-4085-8051-18978712E4BE" 0x1f0-0x213.7 (36) * |until 0x213.7 (36) | | +0x210| 18 00 00 00 | .... | alignment_bytes: raw bits 0x214-0x217.7 (4) 0x2b0|11 20 00 00 |. .. | key: "volume_uuid" (8209) (String UUID) 0x2b0-0x2b3.7 (4) 0x2b0| b8 01 00 00 | .... | offset_to_record: 440 0x2b4-0x2b7.7 (4) - | | | [8]{}: entry 0x1c8-0x2c3.7 (252) +0x2b0| 00 00 00 00 | .... | unused: 0 0x2b8-0x2bb.7 (4) + | | | [8]{}: entry 0x1c8-0x2c7.7 (256) | | | record{}: 0x1c8-0x1d7.7 (16) 0x1c0| 08 00 00 00 | .... | length: 8 0x1c8-0x1cb.7 (4) 0x1c0| 04 03 00 00| ....| type: "long" (772) ((signed 64-bit) 8-byte number) 0x1cc-0x1cf.7 (4) 0x1d0|00 a0 20 68 74 00 00 00 |.. ht... | data: 499963174912 0x1d0-0x1d7.7 (8) 0x2b0| 12 20 00 00| . ..| key: "volume_size" (8210) (8-byte integer) 0x2bc-0x2bf.7 (4) 0x2c0|98 01 00 00 |.... | offset_to_record: 408 0x2c0-0x2c3.7 (4) - | | | [9]{}: entry 0x1d8-0x2cf.7 (248) +0x2c0| 00 00 00 00 | .... | unused: 0 0x2c4-0x2c7.7 (4) + | | | [9]{}: entry 0x1d8-0x2d3.7 (252) | | | record{}: 0x1d8-0x1e7.7 (16) 0x1d0| 08 00 00 00 | .... | length: 8 0x1d8-0x1db.7 (4) 0x1d0| 00 04 00 00| ....| type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0x1dc-0x1df.7 (4) 0x1e0|41 c1 de 44 80 00 00 00 |A..D.... | data: 5.995584e+08 (2020-01-01T08:00:00Z) 0x1e0-0x1e7.7 (8) 0x2c0| 13 20 00 00 | . .. | key: "volume_creation_date" (8211) (Date) 0x2c8-0x2cb.7 (4) 0x2c0| a8 01 00 00| ....| offset_to_record: 424 0x2cc-0x2cf.7 (4) - | | | [10]{}: entry 0x214-0x2db.7 (200) +0x2d0|00 00 00 00 |.... | unused: 0 0x2d0-0x2d3.7 (4) + | | | [10]{}: entry 0x214-0x2df.7 (204) | | | record{}: 0x214-0x233.7 (32) 0x210| 18 00 00 00 | .... | length: 24 (valid) 0x214-0x217.7 (4) 0x210| 01 02 00 00 | .... | raw_type: "data" (513) (valid) 0x218-0x21b.7 (4) @@ -246,6 +267,7 @@ $ fq dv sample3.book 0x220| 00 | . | supports_decmp_fs_compression: false 0x221.4-0x221.4 (0.1) 0x220| 00 | . | has64_bit_object_ids: false 0x221.5-0x221.5 (0.1) 0x220| 00 | . | property_flags_all: false 0x221.6-0x221.6 (0.1) +0x220| 00 00 00 | ... | unused_property_bits: raw bits 0x221.7-0x223.7 (2.1) | | | enabled_property_flags{}: 0x224-0x229.6 (5.7) 0x220| ef | . | is_local: true 0x224-0x224 (0.1) 0x220| ef | . | is_automount: true 0x224.1-0x224.1 (0.1) @@ -294,69 +316,69 @@ $ fq dv sample3.book 0x220| 00 | . | supports_decmp_fs_compression: false 0x229.4-0x229.4 (0.1) 0x220| 00 | . | has64_bit_object_ids: false 0x229.5-0x229.5 (0.1) 0x220| 00 | . | property_flags_all: false 0x229.6-0x229.6 (0.1) +0x220| 00 00 00 | ... | unused_indicator_bits: raw bits 0x229.7-0x22b.7 (2.1) 0x220| 00 00 00 00| ....| reserved: raw bits 0x22c-0x233.7 (8) 0x230|00 00 00 00 |.... | 0x2d0| 20 20 00 00 | .. | key: "volume_flags" (8224) (flag bitfield) 0x2d4-0x2d7.7 (4) 0x2d0| e4 01 00 00 | .... | offset_to_record: 484 0x2d8-0x2db.7 (4) - | | | [11]{}: entry 0x240-0x2e7.7 (168) +0x2d0| 00 00 00 00| ....| unused: 0 0x2dc-0x2df.7 (4) + | | | [11]{}: entry 0x240-0x2eb.7 (172) | | | record{}: 0x240-0x247.7 (8) 0x240|00 00 00 00 |.... | length: 0 0x240-0x243.7 (4) 0x240| 01 05 00 00 | .... | type: "boolean_true" (1281) (True) 0x244-0x247.7 (4) 0x2e0|30 20 00 00 |0 .. | key: "volume_is_root" (8240) (True if the volume was the filesystem root) 0x2e0-0x2e3.7 (4) 0x2e0| 10 02 00 00 | .... | offset_to_record: 528 0x2e4-0x2e7.7 (4) - | | | [12]{}: entry 0x188-0x2f3.7 (364) +0x2e0| 00 00 00 00 | .... | unused: 0 0x2e8-0x2eb.7 (4) + | | | [12]{}: entry 0x188-0x2f7.7 (368) | | | record{}: 0x188-0x197.7 (16) 0x180| 08 00 00 00 | .... | length: 8 0x188-0x18b.7 (4) 0x180| 04 03 00 00| ....| type: "long" (772) ((signed 64-bit) 8-byte number) 0x18c-0x18f.7 (4) 0x190|04 00 00 00 00 00 00 00 |........ | data: 4 0x190-0x197.7 (8) 0x2e0| 01 c0 00 00| ....| key: "containing_folder_index" (49153) (Integer index of containing folder in target path array) 0x2ec-0x2ef.7 (4) 0x2f0|58 01 00 00 |X... | offset_to_record: 344 0x2f0-0x2f3.7 (4) - | | | [13]{}: entry 0x50-0x2ff.7 (688) - | | | record{}: 0x50-0x64.7 (21) +0x2f0| 00 00 00 00 | .... | unused: 0 0x2f4-0x2f7.7 (4) + | | | [13]{}: entry 0x50-0x303.7 (692) + | | | record{}: 0x50-0x67.7 (24) 0x050|0d 00 00 00 |.... | length: 13 0x50-0x53.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x54-0x57.7 (4) 0x050| 64 61 76 69 64 6d 63 64| davidmcd| data: "davidmcdonald" 0x58-0x64.7 (13) 0x060|6f 6e 61 6c 64 |onald | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x65-0x67.7 (3) 0x2f0| 11 c0 00 00 | .... | key: "creator_username" (49169) (Name of user that created bookmark) 0x2f8-0x2fb.7 (4) 0x2f0| 20 00 00 00| ...| offset_to_record: 32 0x2fc-0x2ff.7 (4) - | | | [14]{}: entry 0x198-0x30b.7 (372) +0x300|00 00 00 00 |.... | unused: 0 0x300-0x303.7 (4) + | | | [14]{}: entry 0x198-0x30f.7 (376) | | | record{}: 0x198-0x1a3.7 (12) 0x190| 04 00 00 00 | .... | length: 4 0x198-0x19b.7 (4) 0x190| 03 03 00 00| ....| type: "int" (771) ((signed 32-bit) 4-byte number) 0x19c-0x19f.7 (4) 0x1a0|f5 01 00 00 |.... | data: 501 0x1a0-0x1a3.7 (4) 0x300| 12 c0 00 00 | .... | key: "creator_uid" (49170) (UID of user that created bookmark) 0x304-0x307.7 (4) 0x300| 68 01 00 00 | h... | offset_to_record: 360 0x308-0x30b.7 (4) - | | | [15]{}: entry 0x34-0x317.7 (740) +0x300| 00 00 00 00| ....| unused: 0 0x30c-0x30f.7 (4) + | | | [15]{}: entry 0x34-0x31b.7 (744) | | | record{}: 0x34-0x3f.7 (12) 0x030| 04 00 00 00 | .... | length: 4 0x34-0x37.7 (4) 0x030| 03 03 00 00 | .... | type: "int" (771) ((signed 32-bit) 4-byte number) 0x38-0x3b.7 (4) 0x030| 00 00 00 20| ... | data: 536870912 0x3c-0x3f.7 (4) 0x310|10 d0 00 00 |.... | key: "creation_options" (53264) (Integer containing flags passed to CFURLCreateBookmarkData) 0x310-0x313.7 (4) 0x310| 04 00 00 00 | .... | offset_to_record: 4 0x314-0x317.7 (4) - | | | [16]{}: entry 0xa8-0x323.7 (636) - | | | record{}: 0xa8-0xb4.7 (13) +0x310| 00 00 00 00 | .... | unused: 0 0x318-0x31b.7 (4) + | | | [16]{}: entry 0xa8-0x327.7 (640) + | | | record{}: 0xa8-0xb7.7 (16) 0x0a0| 05 00 00 00 | .... | length: 5 0xa8-0xab.7 (4) 0x0a0| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0xac-0xaf.7 (4) 0x0b0|42 6c 69 6e 6b |Blink | data: "Blink" 0xb0-0xb4.7 (5) +0x0b0| 00 00 00 | ... | alignment_bytes: raw bits 0xb5-0xb7.7 (3) 0x310| 17 f0 00 00| ....| key: "display_name" (61463) (String) 0x31c-0x31f.7 (4) 0x320|78 00 00 00 |x... | offset_to_record: 120 0x320-0x323.7 (4) - | | | [17]{}: entry 0x240-0x32f.7 (240) +0x320| 00 00 00 00 | .... | unused: 0 0x324-0x327.7 (4) + | | | [17]{}: entry 0x240-0x333.7 (244) | | | record{}: 0x240-0x247.7 (8) 0x240|00 00 00 00 |.... | length: 0 0x240-0x243.7 (4) 0x240| 01 05 00 00 | .... | type: "boolean_true" (1281) (True) 0x244-0x247.7 (4) 0x320| 0f 00 0f 00 | .... | key: 983055 0x328-0x32b.7 (4) 0x320| 10 02 00 00| ....| offset_to_record: 528 0x32c-0x32f.7 (4) -0x040| 00 00 00| ...| unknown0: raw bits 0x4d-0x4f.7 (3) -0x060| 00 00 00 | ... | unknown1: raw bits 0x65-0x67.7 (3) -0x070| 00 00 00 | ... | unknown2: raw bits 0x79-0x7b.7 (3) -0x080| 00 | . | unknown3: raw bits 0x8b-0x8b.7 (1) -0x0a0| 00 00 | .. | unknown4: raw bits 0xa6-0xa7.7 (2) -0x0b0| 00 00 00 | ... | unknown5: raw bits 0xb5-0xb7.7 (3) -0x170| 00 00 00 00 00 00 | ...... | unknown6: raw bits 0x172.1-0x177.7 (5.7) -0x170| 00 00 00 00 00 00| ......| unknown7: raw bits 0x17a.1-0x17f.7 (5.7) -0x220| 00 00 00 | ... | unknown8: raw bits 0x221.7-0x223.7 (2.1) -0x220| 00 00 00 | ... | unknown9: raw bits 0x229.7-0x22b.7 (2.1) -0x230| 00 00 00| ...| unknown10: raw bits 0x23d-0x23f.7 (3) +0x330|00 00 00 00| |....| | unused: 0 0x330-0x333.7 (4) | | | toc_headers[0:1]: 0x248-0x25b.7 (20) | | | [0]{}: toc_header 0x248-0x25b.7 (20) 0x240| e4 00 00 00 | .... | toc_size: 228 0x248-0x24b.7 (4) @@ -364,24 +386,6 @@ $ fq dv sample3.book 0x250|01 00 00 00 |.... | identifier: 1 0x250-0x253.7 (4) 0x250| 00 00 00 00 | .... | next_toc_offset: 0 0x254-0x257.7 (4) 0x250| 12 00 00 00 | .... | num_entries_in_toc: 18 0x258-0x25b.7 (4) -0x260| 00 00 00 00 | .... | unknown11: raw bits 0x264-0x267.7 (4) -0x270|00 00 00 00 |.... | unknown12: raw bits 0x270-0x273.7 (4) -0x270| 00 00 00 00| ....| unknown13: raw bits 0x27c-0x27f.7 (4) -0x280| 00 00 00 00 | .... | unknown14: raw bits 0x288-0x28b.7 (4) -0x290| 00 00 00 00 | .... | unknown15: raw bits 0x294-0x297.7 (4) -0x2a0|00 00 00 00 |.... | unknown16: raw bits 0x2a0-0x2a3.7 (4) -0x2a0| 00 00 00 00| ....| unknown17: raw bits 0x2ac-0x2af.7 (4) -0x2b0| 00 00 00 00 | .... | unknown18: raw bits 0x2b8-0x2bb.7 (4) -0x2c0| 00 00 00 00 | .... | unknown19: raw bits 0x2c4-0x2c7.7 (4) -0x2d0|00 00 00 00 |.... | unknown20: raw bits 0x2d0-0x2d3.7 (4) -0x2d0| 00 00 00 00| ....| unknown21: raw bits 0x2dc-0x2df.7 (4) -0x2e0| 00 00 00 00 | .... | unknown22: raw bits 0x2e8-0x2eb.7 (4) -0x2f0| 00 00 00 00 | .... | unknown23: raw bits 0x2f4-0x2f7.7 (4) -0x300|00 00 00 00 |.... | unknown24: raw bits 0x300-0x303.7 (4) -0x300| 00 00 00 00| ....| unknown25: raw bits 0x30c-0x30f.7 (4) -0x310| 00 00 00 00 | .... | unknown26: raw bits 0x318-0x31b.7 (4) -0x320| 00 00 00 00 | .... | unknown27: raw bits 0x324-0x327.7 (4) -0x330|00 00 00 00| |....| | unknown28: raw bits 0x330-0x333.7 (4) $ fq torepr sample3.book { "983055": true, diff --git a/format/applebookmark/testdata/sample4.fqtest b/format/applebookmark/testdata/sample4.fqtest index 89878604..f41df4fb 100644 --- a/format/applebookmark/testdata/sample4.fqtest +++ b/format/applebookmark/testdata/sample4.fqtest @@ -8,46 +8,52 @@ $ fq dv sample4.book 0x010|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| reserved: raw bits 0x10-0x2f.7 (32) 0x020|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| 0x030|d8 01 00 00 |.... | first_toc_offset: 472 0x30-0x33.7 (4) - | | | bookmark_entries[0:18]: 0x34-0x2ef.7 (700) - | | | [0]{}: entry 0x40-0x223.7 (484) + | | | bookmark_entries[0:18]: 0x34-0x2f3.7 (704) + | | | [0]{}: entry 0x40-0x227.7 (488) | | | record{}: 0x40-0xab.7 (108) | | | data[0:5]: 0x40-0xab.7 (108) | | | [0]{}: element 0x40-0x9b.7 (92) - | | | record{}: 0x40-0x4c.7 (13) + | | | record{}: 0x40-0x4f.7 (16) 0x040|05 00 00 00 |.... | length: 5 0x40-0x43.7 (4) 0x040| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x44-0x47.7 (4) 0x040| 55 73 65 72 73 | Users | data: "Users" 0x48-0x4c.7 (5) +0x040| 00 00 00| ...| alignment_bytes: raw bits 0x4d-0x4f.7 (3) 0x090| 10 00 00 00 | .... | offset: 16 0x98-0x9b.7 (4) | | | [1]{}: element 0x50-0x9f.7 (80) - | | | record{}: 0x50-0x64.7 (21) + | | | record{}: 0x50-0x67.7 (24) 0x050|0d 00 00 00 |.... | length: 13 0x50-0x53.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x54-0x57.7 (4) 0x050| 64 61 76 69 64 6d 63 64| davidmcd| data: "davidmcdonald" 0x58-0x64.7 (13) 0x060|6f 6e 61 6c 64 |onald | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x65-0x67.7 (3) 0x090| 20 00 00 00| ...| offset: 32 0x9c-0x9f.7 (4) | | | [2]{}: element 0x68-0xa3.7 (60) - | | | record{}: 0x68-0x71.7 (10) + | | | record{}: 0x68-0x73.7 (12) 0x060| 02 00 00 00 | .... | length: 2 0x68-0x6b.7 (4) 0x060| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0x6c-0x6f.7 (4) 0x070|67 6f |go | data: "go" 0x70-0x71.7 (2) +0x070| 00 00 | .. | alignment_bytes: raw bits 0x72-0x73.7 (2) 0x0a0|38 00 00 00 |8... | offset: 56 0xa0-0xa3.7 (4) | | | [3]{}: element 0x74-0xa7.7 (52) - | | | record{}: 0x74-0x7e.7 (11) + | | | record{}: 0x74-0x7f.7 (12) 0x070| 03 00 00 00 | .... | length: 3 0x74-0x77.7 (4) 0x070| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x78-0x7b.7 (4) 0x070| 73 72 63 | src | data: "src" 0x7c-0x7e.7 (3) +0x070| 00| .| alignment_bytes: raw bits 0x7f-0x7f.7 (1) 0x0a0| 44 00 00 00 | D... | offset: 68 0xa4-0xa7.7 (4) | | | [4]{}: element 0x80-0xab.7 (44) - | | | record{}: 0x80-0x8d.7 (14) + | | | record{}: 0x80-0x8f.7 (16) 0x080|06 00 00 00 |.... | length: 6 0x80-0x83.7 (4) 0x080| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x84-0x87.7 (4) 0x080| 74 68 65 73 69 73 | thesis | data: "thesis" 0x88-0x8d.7 (6) +0x080| 00 00| ..| alignment_bytes: raw bits 0x8e-0x8f.7 (2) 0x0a0| 50 00 00 00 | P... | offset: 80 0xa8-0xab.7 (4) 0x090|14 00 00 00 |.... | length: 20 0x90-0x93.7 (4) 0x090| 01 06 00 00 | .... | type: "array" (1537) (Array of 4-byte offsets to data items) 0x94-0x97.7 (4) 0x210| 04 10 00 00| ....| key: "target_path" (4100) (Array of individual path components) 0x21c-0x21f.7 (4) 0x220|60 00 00 00 |`... | offset_to_record: 96 0x220-0x223.7 (4) - | | | [1]{}: entry 0xac-0x22f.7 (388) +0x220| 00 00 00 00 | .... | unused: 0 0x224-0x227.7 (4) + | | | [1]{}: entry 0xac-0x233.7 (392) | | | record{}: 0xac-0x117.7 (108) | | | data[0:5]: 0xac-0x117.7 (108) | | | [0]{}: element 0xac-0x107.7 (92) @@ -84,7 +90,8 @@ $ fq dv sample4.book 0x100|01 06 00 00 |.... | type: "array" (1537) (Array of 4-byte offsets to data items) 0x100-0x103.7 (4) 0x220| 05 10 00 00 | .... | key: "target_cnid_path" (4101) (Array of CNIDs) 0x228-0x22b.7 (4) 0x220| cc 00 00 00| ....| offset_to_record: 204 0x22c-0x22f.7 (4) - | | | [2]{}: entry 0x128-0x23b.7 (276) +0x230|00 00 00 00 |.... | unused: 0 0x230-0x233.7 (4) + | | | [2]{}: entry 0x128-0x23f.7 (280) | | | record{}: 0x128-0x147.7 (32) 0x120| 18 00 00 00 | .... | length: 24 (valid) 0x128-0x12b.7 (4) 0x120| 01 02 00 00| ....| raw_type: "data" (513) (valid) 0x12c-0x12f.7 (4) @@ -107,6 +114,7 @@ $ fq dv sample4.book 0x130| 00 | . | is_executable: false 0x131.6-0x131.6 (0.1) 0x130| 00 | . | is_alias_file: false 0x131.7-0x131.7 (0.1) 0x130| 00 | . | is_mount_trigger: false 0x132-0x132 (0.1) +0x130| 00 00 00 00 00 00 | ...... | unused_property_bits: raw bits 0x132.1-0x137.7 (5.7) | | | enabled_property_flags{}: 0x138-0x13a (2.1) 0x130| 1f | . | is_regular_file: false 0x138-0x138 (0.1) 0x130| 1f | . | is_directory: false 0x138.1-0x138.1 (0.1) @@ -125,24 +133,29 @@ $ fq dv sample4.book 0x130| 02 | . | is_executable: true 0x139.6-0x139.6 (0.1) 0x130| 02 | . | is_alias_file: false 0x139.7-0x139.7 (0.1) 0x130| 00 | . | is_mount_trigger: false 0x13a-0x13a (0.1) +0x130| 00 00 00 00 00 00| ......| unused_indicator_bits: raw bits 0x13a.1-0x13f.7 (5.7) 0x140|1a 02 00 00 00 00 00 00 |........ | reserved: raw bits 0x140-0x147.7 (8) 0x230| 10 10 00 00 | .... | key: "target_flags" (4112) (flag bitfield) 0x234-0x237.7 (4) 0x230| f8 00 00 00 | .... | offset_to_record: 248 0x238-0x23b.7 (4) - | | | [3]{}: entry 0x118-0x247.7 (304) +0x230| 00 00 00 00| ....| unused: 0 0x23c-0x23f.7 (4) + | | | [3]{}: entry 0x118-0x24b.7 (308) | | | record{}: 0x118-0x127.7 (16) 0x110| 08 00 00 00 | .... | length: 8 0x118-0x11b.7 (4) 0x110| 00 04 00 00| ....| type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0x11c-0x11f.7 (4) 0x120|41 c3 ff 97 6f 07 8e 98 |A...o... | data: 6.710351020590391e+08 (2022-04-07T14:38:22Z) 0x120-0x127.7 (8) 0x240|40 10 00 00 |@... | key: "target_creation_date" (4160) (Date) 0x240-0x243.7 (4) 0x240| e8 00 00 00 | .... | offset_to_record: 232 0x244-0x247.7 (4) - | | | [4]{}: entry 0x1f4-0x253.7 (96) - | | | record{}: 0x1f4-0x1fc.7 (9) +0x240| 00 00 00 00 | .... | unused: 0 0x248-0x24b.7 (4) + | | | [4]{}: entry 0x1f4-0x257.7 (100) + | | | record{}: 0x1f4-0x1ff.7 (12) 0x1f0| 01 00 00 00 | .... | length: 1 0x1f4-0x1f7.7 (4) 0x1f0| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x1f8-0x1fb.7 (4) 0x1f0| 2f | / | data: "/" 0x1fc-0x1fc.7 (1) +0x1f0| 00 00 00| ...| alignment_bytes: raw bits 0x1fd-0x1ff.7 (3) 0x240| 02 20 00 00| . ..| key: "volume_path" (8194) (Array of individual path components) 0x24c-0x24f.7 (4) 0x250|c4 01 00 00 |.... | offset_to_record: 452 0x250-0x253.7 (4) - | | | [5]{}: entry 0x164-0x25f.7 (252) +0x250| 00 00 00 00 | .... | unused: 0 0x254-0x257.7 (4) + | | | [5]{}: entry 0x164-0x263.7 (256) | | | record{}: 0x164-0x173.7 (16) 0x160| 08 00 00 00 | .... | length: 8 0x164-0x167.7 (4) 0x160| 01 09 00 00 | .... | type: "url" (2305) (UTF-8 string) 0x168-0x16b.7 (4) @@ -150,37 +163,44 @@ $ fq dv sample4.book 0x170|3a 2f 2f 2f |:/// | 0x250| 05 20 00 00 | . .. | key: "volume_url" (8197) (URL of volume root) 0x258-0x25b.7 (4) 0x250| 34 01 00 00| 4...| offset_to_record: 308 0x25c-0x25f.7 (4) - | | | [6]{}: entry 0x174-0x26b.7 (248) - | | | record{}: 0x174-0x187.7 (20) +0x260|00 00 00 00 |.... | unused: 0 0x260-0x263.7 (4) + | | | [6]{}: entry 0x174-0x26f.7 (252) + | | | record{}: 0x174-0x18b.7 (24) 0x170| 0c 00 00 00 | .... | length: 12 0x174-0x177.7 (4) 0x170| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x178-0x17b.7 (4) 0x170| 4d 61 63 69| Maci| data: "Macintosh HD" 0x17c-0x187.7 (12) 0x180|6e 74 6f 73 68 20 48 44 |ntosh HD | +0x180| 08 00 00 00 | .... | alignment_bytes: raw bits 0x188-0x18b.7 (4) 0x260| 10 20 00 00 | . .. | key: "volume_name" (8208) (String) 0x264-0x267.7 (4) 0x260| 44 01 00 00 | D... | offset_to_record: 324 0x268-0x26b.7 (4) - | | | [7]{}: entry 0x1a8-0x277.7 (208) - | | | record{}: 0x1a8-0x1d3.7 (44) +0x260| 00 00 00 00| ....| unused: 0 0x26c-0x26f.7 (4) + | | | [7]{}: entry 0x1a8-0x27b.7 (212) + | | | record{}: 0x1a8-0x1d7.7 (48) 0x1a0| 24 00 00 00 | $... | length: 36 0x1a8-0x1ab.7 (4) 0x1a0| 01 01 00 00| ....| type: "string" (257) (UTF-8 String) 0x1ac-0x1af.7 (4) 0x1b0|38 41 38 32 39 41 30 33 2d 39 42 32 34 2d 34 30|8A829A03-9B24-40| data: "8A829A03-9B24-4085-8051-18978712E4BE" 0x1b0-0x1d3.7 (36) * |until 0x1d3.7 (36) | | +0x1d0| 18 00 00 00 | .... | alignment_bytes: raw bits 0x1d4-0x1d7.7 (4) 0x270|11 20 00 00 |. .. | key: "volume_uuid" (8209) (String UUID) 0x270-0x273.7 (4) 0x270| 78 01 00 00 | x... | offset_to_record: 376 0x274-0x277.7 (4) - | | | [8]{}: entry 0x188-0x283.7 (252) +0x270| 00 00 00 00 | .... | unused: 0 0x278-0x27b.7 (4) + | | | [8]{}: entry 0x188-0x287.7 (256) | | | record{}: 0x188-0x197.7 (16) 0x180| 08 00 00 00 | .... | length: 8 0x188-0x18b.7 (4) 0x180| 04 03 00 00| ....| type: "long" (772) ((signed 64-bit) 8-byte number) 0x18c-0x18f.7 (4) 0x190|00 a0 20 68 74 00 00 00 |.. ht... | data: 499963174912 0x190-0x197.7 (8) 0x270| 12 20 00 00| . ..| key: "volume_size" (8210) (8-byte integer) 0x27c-0x27f.7 (4) 0x280|58 01 00 00 |X... | offset_to_record: 344 0x280-0x283.7 (4) - | | | [9]{}: entry 0x198-0x28f.7 (248) +0x280| 00 00 00 00 | .... | unused: 0 0x284-0x287.7 (4) + | | | [9]{}: entry 0x198-0x293.7 (252) | | | record{}: 0x198-0x1a7.7 (16) 0x190| 08 00 00 00 | .... | length: 8 0x198-0x19b.7 (4) 0x190| 00 04 00 00| ....| type: "date" (1024) (Big-endian IEEE double precision seconds since 2001-01-01 00:00:00 UTC) 0x19c-0x19f.7 (4) 0x1a0|41 c1 de 44 80 00 00 00 |A..D.... | data: 5.995584e+08 (2020-01-01T08:00:00Z) 0x1a0-0x1a7.7 (8) 0x280| 13 20 00 00 | . .. | key: "volume_creation_date" (8211) (Date) 0x288-0x28b.7 (4) 0x280| 68 01 00 00| h...| offset_to_record: 360 0x28c-0x28f.7 (4) - | | | [10]{}: entry 0x1d4-0x29b.7 (200) +0x290|00 00 00 00 |.... | unused: 0 0x290-0x293.7 (4) + | | | [10]{}: entry 0x1d4-0x29f.7 (204) | | | record{}: 0x1d4-0x1f3.7 (32) 0x1d0| 18 00 00 00 | .... | length: 24 (valid) 0x1d4-0x1d7.7 (4) 0x1d0| 01 02 00 00 | .... | raw_type: "data" (513) (valid) 0x1d8-0x1db.7 (4) @@ -233,6 +253,7 @@ $ fq dv sample4.book 0x1e0| 00 | . | supports_decmp_fs_compression: false 0x1e1.4-0x1e1.4 (0.1) 0x1e0| 00 | . | has64_bit_object_ids: false 0x1e1.5-0x1e1.5 (0.1) 0x1e0| 00 | . | property_flags_all: false 0x1e1.6-0x1e1.6 (0.1) +0x1e0| 00 00 00 | ... | unused_property_bits: raw bits 0x1e1.7-0x1e3.7 (2.1) | | | enabled_property_flags{}: 0x1e4-0x1e9.6 (5.7) 0x1e0| ef | . | is_local: true 0x1e4-0x1e4 (0.1) 0x1e0| ef | . | is_automount: true 0x1e4.1-0x1e4.1 (0.1) @@ -281,68 +302,69 @@ $ fq dv sample4.book 0x1e0| 00 | . | supports_decmp_fs_compression: false 0x1e9.4-0x1e9.4 (0.1) 0x1e0| 00 | . | has64_bit_object_ids: false 0x1e9.5-0x1e9.5 (0.1) 0x1e0| 00 | . | property_flags_all: false 0x1e9.6-0x1e9.6 (0.1) +0x1e0| 00 00 00 | ... | unused_indicator_bits: raw bits 0x1e9.7-0x1eb.7 (2.1) 0x1e0| 00 00 00 00| ....| reserved: raw bits 0x1ec-0x1f3.7 (8) 0x1f0|00 00 00 00 |.... | 0x290| 20 20 00 00 | .. | key: "volume_flags" (8224) (flag bitfield) 0x294-0x297.7 (4) 0x290| a4 01 00 00 | .... | offset_to_record: 420 0x298-0x29b.7 (4) - | | | [11]{}: entry 0x200-0x2a7.7 (168) +0x290| 00 00 00 00| ....| unused: 0 0x29c-0x29f.7 (4) + | | | [11]{}: entry 0x200-0x2ab.7 (172) | | | record{}: 0x200-0x207.7 (8) 0x200|00 00 00 00 |.... | length: 0 0x200-0x203.7 (4) 0x200| 01 05 00 00 | .... | type: "boolean_true" (1281) (True) 0x204-0x207.7 (4) 0x2a0|30 20 00 00 |0 .. | key: "volume_is_root" (8240) (True if the volume was the filesystem root) 0x2a0-0x2a3.7 (4) 0x2a0| d0 01 00 00 | .... | offset_to_record: 464 0x2a4-0x2a7.7 (4) - | | | [12]{}: entry 0x148-0x2b3.7 (364) +0x2a0| 00 00 00 00 | .... | unused: 0 0x2a8-0x2ab.7 (4) + | | | [12]{}: entry 0x148-0x2b7.7 (368) | | | record{}: 0x148-0x157.7 (16) 0x140| 08 00 00 00 | .... | length: 8 0x148-0x14b.7 (4) 0x140| 04 03 00 00| ....| type: "long" (772) ((signed 64-bit) 8-byte number) 0x14c-0x14f.7 (4) 0x150|03 00 00 00 00 00 00 00 |........ | data: 3 0x150-0x157.7 (8) 0x2a0| 01 c0 00 00| ....| key: "containing_folder_index" (49153) (Integer index of containing folder in target path array) 0x2ac-0x2af.7 (4) 0x2b0|18 01 00 00 |.... | offset_to_record: 280 0x2b0-0x2b3.7 (4) - | | | [13]{}: entry 0x50-0x2bf.7 (624) - | | | record{}: 0x50-0x64.7 (21) +0x2b0| 00 00 00 00 | .... | unused: 0 0x2b4-0x2b7.7 (4) + | | | [13]{}: entry 0x50-0x2c3.7 (628) + | | | record{}: 0x50-0x67.7 (24) 0x050|0d 00 00 00 |.... | length: 13 0x50-0x53.7 (4) 0x050| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x54-0x57.7 (4) 0x050| 64 61 76 69 64 6d 63 64| davidmcd| data: "davidmcdonald" 0x58-0x64.7 (13) 0x060|6f 6e 61 6c 64 |onald | +0x060| 00 00 00 | ... | alignment_bytes: raw bits 0x65-0x67.7 (3) 0x2b0| 11 c0 00 00 | .... | key: "creator_username" (49169) (Name of user that created bookmark) 0x2b8-0x2bb.7 (4) 0x2b0| 20 00 00 00| ...| offset_to_record: 32 0x2bc-0x2bf.7 (4) - | | | [14]{}: entry 0x158-0x2cb.7 (372) +0x2c0|00 00 00 00 |.... | unused: 0 0x2c0-0x2c3.7 (4) + | | | [14]{}: entry 0x158-0x2cf.7 (376) | | | record{}: 0x158-0x163.7 (12) 0x150| 04 00 00 00 | .... | length: 4 0x158-0x15b.7 (4) 0x150| 03 03 00 00| ....| type: "int" (771) ((signed 32-bit) 4-byte number) 0x15c-0x15f.7 (4) 0x160|f5 01 00 00 |.... | data: 501 0x160-0x163.7 (4) 0x2c0| 12 c0 00 00 | .... | key: "creator_uid" (49170) (UID of user that created bookmark) 0x2c4-0x2c7.7 (4) 0x2c0| 28 01 00 00 | (... | offset_to_record: 296 0x2c8-0x2cb.7 (4) - | | | [15]{}: entry 0x34-0x2d7.7 (676) +0x2c0| 00 00 00 00| ....| unused: 0 0x2cc-0x2cf.7 (4) + | | | [15]{}: entry 0x34-0x2db.7 (680) | | | record{}: 0x34-0x3f.7 (12) 0x030| 04 00 00 00 | .... | length: 4 0x34-0x37.7 (4) 0x030| 03 03 00 00 | .... | type: "int" (771) ((signed 32-bit) 4-byte number) 0x38-0x3b.7 (4) 0x030| 00 00 00 20| ... | data: 536870912 0x3c-0x3f.7 (4) 0x2d0|10 d0 00 00 |.... | key: "creation_options" (53264) (Integer containing flags passed to CFURLCreateBookmarkData) 0x2d0-0x2d3.7 (4) 0x2d0| 04 00 00 00 | .... | offset_to_record: 4 0x2d4-0x2d7.7 (4) - | | | [16]{}: entry 0x80-0x2e3.7 (612) - | | | record{}: 0x80-0x8d.7 (14) +0x2d0| 00 00 00 00 | .... | unused: 0 0x2d8-0x2db.7 (4) + | | | [16]{}: entry 0x80-0x2e7.7 (616) + | | | record{}: 0x80-0x8f.7 (16) 0x080|06 00 00 00 |.... | length: 6 0x80-0x83.7 (4) 0x080| 01 01 00 00 | .... | type: "string" (257) (UTF-8 String) 0x84-0x87.7 (4) 0x080| 74 68 65 73 69 73 | thesis | data: "thesis" 0x88-0x8d.7 (6) +0x080| 00 00| ..| alignment_bytes: raw bits 0x8e-0x8f.7 (2) 0x2d0| 17 f0 00 00| ....| key: "display_name" (61463) (String) 0x2dc-0x2df.7 (4) 0x2e0|50 00 00 00 |P... | offset_to_record: 80 0x2e0-0x2e3.7 (4) - | | | [17]{}: entry 0x200-0x2ef.7 (240) +0x2e0| 00 00 00 00 | .... | unused: 0 0x2e4-0x2e7.7 (4) + | | | [17]{}: entry 0x200-0x2f3.7 (244) | | | record{}: 0x200-0x207.7 (8) 0x200|00 00 00 00 |.... | length: 0 0x200-0x203.7 (4) 0x200| 01 05 00 00 | .... | type: "boolean_true" (1281) (True) 0x204-0x207.7 (4) 0x2e0| 0f 00 0f 00 | .... | key: 983055 0x2e8-0x2eb.7 (4) 0x2e0| d0 01 00 00| ....| offset_to_record: 464 0x2ec-0x2ef.7 (4) -0x040| 00 00 00| ...| unknown0: raw bits 0x4d-0x4f.7 (3) -0x060| 00 00 00 | ... | unknown1: raw bits 0x65-0x67.7 (3) -0x070| 00 00 | .. | unknown2: raw bits 0x72-0x73.7 (2) -0x070| 00| .| unknown3: raw bits 0x7f-0x7f.7 (1) -0x080| 00 00| ..| unknown4: raw bits 0x8e-0x8f.7 (2) -0x130| 00 00 00 00 00 00 | ...... | unknown5: raw bits 0x132.1-0x137.7 (5.7) -0x130| 00 00 00 00 00 00| ......| unknown6: raw bits 0x13a.1-0x13f.7 (5.7) -0x1e0| 00 00 00 | ... | unknown7: raw bits 0x1e1.7-0x1e3.7 (2.1) -0x1e0| 00 00 00 | ... | unknown8: raw bits 0x1e9.7-0x1eb.7 (2.1) -0x1f0| 00 00 00| ...| unknown9: raw bits 0x1fd-0x1ff.7 (3) +0x2f0|00 00 00 00| |....| | unused: 0 0x2f0-0x2f3.7 (4) | | | toc_headers[0:1]: 0x208-0x21b.7 (20) | | | [0]{}: toc_header 0x208-0x21b.7 (20) 0x200| e4 00 00 00 | .... | toc_size: 228 0x208-0x20b.7 (4) @@ -350,24 +372,6 @@ $ fq dv sample4.book 0x210|01 00 00 00 |.... | identifier: 1 0x210-0x213.7 (4) 0x210| 00 00 00 00 | .... | next_toc_offset: 0 0x214-0x217.7 (4) 0x210| 12 00 00 00 | .... | num_entries_in_toc: 18 0x218-0x21b.7 (4) -0x220| 00 00 00 00 | .... | unknown10: raw bits 0x224-0x227.7 (4) -0x230|00 00 00 00 |.... | unknown11: raw bits 0x230-0x233.7 (4) -0x230| 00 00 00 00| ....| unknown12: raw bits 0x23c-0x23f.7 (4) -0x240| 00 00 00 00 | .... | unknown13: raw bits 0x248-0x24b.7 (4) -0x250| 00 00 00 00 | .... | unknown14: raw bits 0x254-0x257.7 (4) -0x260|00 00 00 00 |.... | unknown15: raw bits 0x260-0x263.7 (4) -0x260| 00 00 00 00| ....| unknown16: raw bits 0x26c-0x26f.7 (4) -0x270| 00 00 00 00 | .... | unknown17: raw bits 0x278-0x27b.7 (4) -0x280| 00 00 00 00 | .... | unknown18: raw bits 0x284-0x287.7 (4) -0x290|00 00 00 00 |.... | unknown19: raw bits 0x290-0x293.7 (4) -0x290| 00 00 00 00| ....| unknown20: raw bits 0x29c-0x29f.7 (4) -0x2a0| 00 00 00 00 | .... | unknown21: raw bits 0x2a8-0x2ab.7 (4) -0x2b0| 00 00 00 00 | .... | unknown22: raw bits 0x2b4-0x2b7.7 (4) -0x2c0|00 00 00 00 |.... | unknown23: raw bits 0x2c0-0x2c3.7 (4) -0x2c0| 00 00 00 00| ....| unknown24: raw bits 0x2cc-0x2cf.7 (4) -0x2d0| 00 00 00 00 | .... | unknown25: raw bits 0x2d8-0x2db.7 (4) -0x2e0| 00 00 00 00 | .... | unknown26: raw bits 0x2e4-0x2e7.7 (4) -0x2f0|00 00 00 00| |....| | unknown27: raw bits 0x2f0-0x2f3.7 (4) $ fq torepr sample4.book { "983055": true,