Advertisement
Guest User

Untitled

a guest
Sep 18th, 2016
1,529
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.83 KB | None | 0 0
  1. struct EAPPX_HEADER {
  2. DWORD Magic; // "EXPH"/"EXSH"/"EXBH"
  3. WORD HeaderSize;
  4. QWORD Version;
  5. QWORD FooterOffset;
  6. QWORD FooterLength;
  7. QWORD FileCount;
  8. QWORD SignatureOffset;
  9. WORD SignatureCompressionType;
  10. DWORD SignatureUncompressedLength;
  11. DWORD SignatureLength;
  12. QWORD CodeIntegrityOffset;
  13. WORD CodeIntegrityCompressionType;
  14. DWORD CodeIntegrityUncompressedLength;
  15. DWORD CodeIntegrityLength;
  16. QWORD BlockMapFileID;
  17. DWORD KeyLength;
  18. WORD KeyIDCount;
  19. EAPPX_KEYID KeyIDs[KeyIDCount];
  20. WORD PackageFullNameStrLen;
  21. WORD PackageFullNameByteLen;
  22. WCHAR PackageFullName[PackageFullNameStrLen];
  23. WORD CryptoAlgoLength;
  24. WCHAR CryptoAlgo[CryptoAlgoLength/2];
  25. WORD DiffusionSupportEnabled;
  26. WORD BlockMapHashAlgoLength;
  27. WCHAR BlockMapHashAlgo[BlockMapHashAlgoLength/2];
  28. WORD BlockMapHashLength;
  29. CHAR BlockMapHash[BlockMapHashLength];
  30. }
  31.  
  32. struct EAPPX_KEYID {
  33. GUID KeyParts[2];
  34. }
  35.  
  36. struct EAPPX_FOOTER {
  37. WORD Magic; // "EF" (EAppx Footer?)
  38. WORD FooterSize; // must be at least 0x28 bytes
  39. WORD KeyIDIndex; // if 0xffff, not encrypted?
  40. WORD CompressionType; // 0: not compressed. 1: raw DEFLATE.
  41. QWORD FileID;
  42. QWORD OffsetToFile;
  43. QWORD UncompressedLength;
  44. QWORD CompressedLength;
  45. }
  46.  
  47. // if KeyParts[0] == {BB1755DB-5052-4B10-B2AB-F3ABF5CA5B41}
  48. // KeyID is 16 bytes long and is KeyParts[1]
  49. // else, KeyID is 32 bytes long, the entirety of KeyParts
  50.  
  51. "EXPH" magic allows empty (ie, 0) CodeIntegrity fields
  52. the others must have them filled.
  53.  
  54. "EXPH" magic must have footers / "appendOffset" (??)
  55.  
  56. "EXBH" magic must have signature included.
  57.  
  58. Package name cannot be over 127 bytes.
  59. There can not be over 0x100 key IDs.
  60.  
  61. "EXSH" magic does no real checks on if the signature offset/size/etc is valid.
  62.  
  63. EXBH => eappxbundle, EXPH => eappx. EXSH => maybe unsigned eappx?
  64.  
  65. eappxbundles contain the various raw eappxes.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement