Header:
Header size = 0x218
typedef struct _HEADER {
uint32 Version;
uint32 unknown;
uint32 unknown1;
char syncTokenData[516]; // Applies to personal accounts only
uint32 syncTokenData_size;
uint32 unknown2;
} HEADER;
<UsrCid>.dat versions
dat version = 29
Data structure size = 0x418
OneDrive versions = 17.3.6673.1011
17.3.6915.0529
#define BLOCK_CONSTANT 1048
#define FOLDER_CONSTANT 299
#define DELETE_CONSTANT 1032
#define LSCOPE_CONSTANT 208
#define LFOLDER_CONSTANT 825
#define VAULT_CONSTANT 320
#define ASCOPE_CONSTANT 176
dat version = 2a
Data structure size = 0x438
OneDrive versions = 17.3.6931.0609
17.3.7131.1115
#define BLOCK_CONSTANT 1080
#define FOLDER_CONSTANT 331
#define DELETE_CONSTANT 1064
#define LSCOPE_CONSTANT 240
#define LFOLDER_CONSTANT 857
#define VAULT_CONSTANT 352
#define ASCOPE_CONSTANT 208
dat version = 2b
Data structure size = 0x438
OneDrive versions = 17.3.7289.1207
18.091.0503.0003
#define BLOCK_CONSTANT 1080
#define FOLDER_CONSTANT 331
#define DELETE_CONSTANT 1064
#define LSCOPE_CONSTANT 240
#define LFOLDER_CONSTANT 857
#define VAULT_CONSTANT 352
#define ASCOPE_CONSTANT 208
dat version = 2c
Data structure size = 0x448
OneDrive versions = 18.095.0510.0001
19.074.0416.0001
#define BLOCK_CONSTANT 1096
#define FOLDER_CONSTANT 347
#define DELETE_CONSTANT 1080
#define LSCOPE_CONSTANT 256
#define LFOLDER_CONSTANT 873
#define VAULT_CONSTANT 368
#define ASCOPE_CONSTANT 224
dat version = 2d
Data structure size = 0x450
OneDrive versions = 19.086.0502.0003
20.064.0329.0008
#define BLOCK_CONSTANT 1098
#define FOLDER_CONSTANT 347
#define DELETE_CONSTANT 1082
#define LSCOPE_CONSTANT 258
#define LFOLDER_CONSTANT 875
#define VAULT_CONSTANT 370
#define ASCOPE_CONSTANT 226
dat version = 2e
Data structure size = 0x468
OneDrive version = 20.084.0426.0006
#define BLOCK_CONSTANT 1128
#define FOLDER_CONSTANT 371
#define DELETE_CONSTANT 1112
#define LSCOPE_CONSTANT 288
#define LFOLDER_CONSTANT 905
#define VAULT_CONSTANT 400
#define ASCOPE_CONSTANT 256
dat version = 2f
Data structure size = 0x468
OneDrive versions = 20.103.0521.0002
20.174.0830.0002
#define BLOCK_CONSTANT 1128
#define FOLDER_CONSTANT 371
#define DELETE_CONSTANT 1112
#define LSCOPE_CONSTANT 288
#define LFOLDER_CONSTANT 905
#define VAULT_CONSTANT 400
#define ASCOPE_CONSTANT 256
dat version = 30
Data structure size = 0x480
OneDrive versions = 20.189.0920.0005
21.002.0104.0004
#define BLOCK_CONSTANT 1152
#define FOLDER_CONSTANT 395
#define DELETE_CONSTANT 1136
#define LSCOPE_CONSTANT 312
#define LFOLDER_CONSTANT 929
#define VAULT_CONSTANT 424
#define ASCOPE_CONSTANT 280
dat version = 31
Data structure size = 0x488
OneDrive versions = 21.011.0117.0001
21.020.0128.0002
#define BLOCK_CONSTANT 1160
#define FOLDER_CONSTANT 403
#define DELETE_CONSTANT 1144
#define LSCOPE_CONSTANT 320
#define LFOLDER_CONSTANT 937
#define VAULT_CONSTANT 432
#define ASCOPE_CONSTANT 288
dat version = 32
Data structure size = 0x488
OneDrive versions = 21.025.0204.0003
21.200.0926.0001
#define BLOCK_CONSTANT 1160
#define FOLDER_CONSTANT 403
#define DELETE_CONSTANT 1144
#define LSCOPE_CONSTANT 320
#define LFOLDER_CONSTANT 937
#define VAULT_CONSTANT 432
#define ASCOPE_CONSTANT 288
dat version = 33
Data structure size = 0x488
OneDrive versions = 21.205.1003.0002
21.215.1017.0001
#define BLOCK_CONSTANT 1160
#define FOLDER_CONSTANT 403
#define DELETE_CONSTANT 1144
#define LSCOPE_CONSTANT 320
#define LFOLDER_CONSTANT 937
#define VAULT_CONSTANT 432
#define ASCOPE_CONSTANT 288
dat version = 34
Data structure size = 0x488
OneDrive versions = 21.220.1024.0001
22.077.0410.0007
#define BLOCK_CONSTANT 1160
#define FOLDER_CONSTANT 403
#define DELETE_CONSTANT 1144
#define LSCOPE_CONSTANT 320
#define LFOLDER_CONSTANT 937
#define VAULT_CONSTANT 432
#define ASCOPE_CONSTANT 288
dat version = 35
Data structure size = 0x498
OneDrive versions = 22.082.0417.0001
22.116.0529.0003
#define BLOCK_CONSTANT 1176
#define FOLDER_CONSTANT 419
#define DELETE_CONSTANT 1160
#define LSCOPE_CONSTANT 336
#define LFOLDER_CONSTANT 953
#define VAULT_CONSTANT 448
#define ASCOPE_CONSTANT 304
dat version = 36
Data atructure size = 0x4D0
OneDrive versions = 22.121.0605.0002
#define BLOCK_CONSTANT 1232
#define FOLDER_CONSTANT 475
#define DELETE_CONSTANT 1216
#define LSCOPE_CONSTANT 392
#define LFOLDER_CONSTANT 1009
#define VAULT_CONSTANT 504
#define ASCOPE_CONSTANT 360
syncTokenData:
URL encoded data
LM%3d63635913785420%3bID%3dA3936C317AC1474E!101%3bLR%3d63636004635103%3bEP%3d16%3bSI%3d53%3bTD%3dTrue%3bSG%3d1%3bSO%3d2%3bPI%3d3
LM=63635913785420;ID=A3936C317AC1474E!101;LR=63636004635103;EP=16;SI=53;TD=True;SG=1;SO=2;PI=3
Data Structure Types
First data structure starts at 0x218
01 = File
02 = Folder
03 = Deleted
09 = libraryScope
0A = libraryFolder
0B = vault
0C = AddedScope
File Structure:
typedef struct _DAT_FILE_v29 {
uint32 header; // 01 = File
uint32 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint64 unknown3;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint64 size;
wchar fileName[260];
uint8 unknown5;
uint16 fileStatus;
uint8 unknown6;
char unknown7[308];
uint32 spoPermissions;
char unknown8[4];
} DAT_FILE_v29;
typedef struct _DAT_FILE_v2a {
uint32 header; // 01 = File
uint32 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint64 unknown3;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint64 size;
wchar fileName[260];
uint8 unknown5;
uint16 fileStatus;
uint8 unknown6;
char unknown7[308];
uint32 spoPermissions;
char unknown8[36];
} DAT_FILE_v2a;
typedef struct _DAT_FILE_v2b {
uint32 header; // 01 = File
uint32 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint64 unknown3;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint64 size;
wchar fileName[260];
uint8 unknown5;
uint16 fileStatus;
uint8 unknown6;
char unknown7[308];
uint32 spoPermissions;
char unknown8[36];
} DAT_FILE_v2b;
typedef struct _DAT_FILE_v2c {
uint32 header; // 01 = File
uint32 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[44];
} DAT_FILE_v2c;
typedef struct _DAT_FILE_v2d {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[44];
} DAT_FILE_v2d;
typedef struct _DAT_FILE_v2e {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[68];
} DAT_FILE_v2e;
typedef struct _DAT_FILE_v2f {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[68];
} DAT_FILE_v2f;
typedef struct _DAT_FILE_v30 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[92];
} DAT_FILE_v30;
typedef struct _DAT_FILE_v31 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[100];
} DAT_FILE_v31;
typedef struct _DAT_FILE_v32 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[100];
} DAT_FILE_v32;
typedef struct _DAT_FILE_v33 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[100];
} DAT_FILE_v33;
typedef struct _DAT_FILE_v34 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
char unknown8[308];
uint32 spoPermissions;
char unknown9[100];
} DAT_FILE_v34;
typedef struct _DAT_FILE_v35 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
uint32 unknown8;
uint64 serverSize;
uint64 serverLastChange;
char serverHashDigest[20];
uint64 unknown9;
char localWaterlineData[27];
char unknown10[49];
uint32 spoPermissions;
char localWriteValidationToken[20];
char localCobaltHashAlgorithm[20];
char localSyncTokenData[24];
char unknown11[212];
uint32 mediaDateTaken;
uint64 unknown12;
uint32 unknown13;
uint32 mediaWidth;
uint32 mediaHeight;
} DAT_FILE_v35;
typedef struct _DAT_FILE_v36 {
uint64 header; // 01 = File
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
char localHashDigest[20]; // quickXor, SHA1
uint32 unknown4;
uint32 lastChange;
uint32 unknown5;
uint64 size;
wchar fileName[260];
uint8 unknown6;
uint16 fileStatus;
uint8 unknown7;
uint32 unknown8;
uint64 serverSize;
uint64 serverLastChange;
char serverHashDigest[20];
uint64 unknown9;
char localWaterlineData[27];
char unknown10[49];
uint32 spoPermissions;
char localWriteValidationToken[20];
char localCobaltHashAlgorithm[20];
char localSyncTokenData[24];
char unknown11[268];
uint32 mediaDateTaken;
uint64 unknown12;
uint32 unknown13;
uint32 mediaWidth;
uint32 mediaHeight;
} DAT_FILE_v36;
bitMask
0x0 = EmptyMask
0x1 = unknown
0x2 = unknown
0x4 = sharedItem
0x8 = ocsiModified
0x10 = unknown
0x20 = unknown
0x40 = unknown
0x80 = unknown
0x100 = unknown
0x200 = lastModifiedViaOcsi
0x400 = unknown
0x800 = unknown
0x1000 = unknown
0x2000 = isOneNoteShortcut
0x4000 = unknown
0x8000 = unknown
0x10000 = unknown
0x20000 = mediaFileMetadataUpToDate
fileStatus
2 = available on this device
5 = Excluded
6 = not synced
7 = not linked
8 = available when online
Folder Structure:
typedef struct _DAT_FOLDER_v29-v2c {
uint32 header; // 02 = Folder
uint32 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
wchar folderName[260];
uint32 jumpLinkType;
char parentScopeID[40];
uint8 folderStatus;
uint8 unknown4;
uint8 syncChildrenFiles;
uint8 unknown5;
uint8 spoPermissions;
uint8 unknown6;
uint8 unknown7;
uint8 unknown8;
uint8 unknown9;
char unknown10[FOLDER_CONSTANT];
} DAT_FOLDER_v29-v2c;
typedef struct _DAT_FOLDERv2d_v36 {
uint64 header; // 02 = Folder
uint64 entry_offset;
uint64 unknown1;
char resourceID[39];
char parentResourceID[39];
char eTag[56];
uint16 unknown2;
uint64 volumeID;
uint64 itemIndex;
uint32 unknown3;
uint32 bitMask;
wchar folderName[260];
uint32 jumpLinkType;
char parentScopeID[40];
uint8 folderStatus;
uint8 unknown4;
uint8 syncChildrenFiles;
uint8 unknown5;
uint8 spoPermissions;
uint8 unknown6;
uint8 unknown7;
uint8 unknown8;
uint8 unknown9;
char unknown10[FOLDER_CONSTANT];
} DAT_FOLDERv2d_v36;
bitMask
0x0 = EmptyMask
0x1 = unknown
0x2 = unknown
0x4 = unknown
0x8 = unknown
0x10 = unknown
0x20 = unknown
0x40 = unknown
0x80 = unknown
0x100 = teamsChannelFolder
0x200 = unknown
0x400 = unknown
0x800 = unknown
0x1000 = unknown
0x2000 = unknown
0x4000 = unknown
0x8000 = unknown
0x10000 = unknown
0x20000 = unknown
folderStatus
5 = Excluded
7 = visible
9 = synced
10 = not synced
11 = not linked
Deleted Structure:
typedef struct _DAT_DELETED {
uint64 header; // 03 = Deleted
uint64 entry_offset;
char unknown[DELETE_CONSTANT];
} DAT_DELETED;
libraryScope:
typedef struct _DAT_LIBRARY_SCOPE {
uint64 header; // 09 = LibraryScope
uint64 entry_offset;
uint32 unknown1;
uint32 unknown2;
char scopeID[39];
char unknown3[117];
uint32 flags;
char siteID[39]; // The SiteId is the unique GUID for the site collection.
char webID[39]; // The WebId is the ID for a site (or subsite) in a site collection.
char listID[39]; // Document library
char unknown4[3];
uint32 libraryType;
uint32 unknown5;
uint32 unknown6;
char syncTokenData[516];
uint32 syncTokenData_size;
uint32 spoPermissions;
char unknown7[LSCOPE_CONSTANT];
} DAT_LIBRARY_SCOPE;
syncTokenData:
URL encoded data
3;%234;%231;3;639f5341-a86e-44e5-bd04-56ade4724bad;638040335274070000;812462148;%23;%23;%230
3;#4;#1;3;639f5341-a86e-44e5-bd04-56ade4724bad;638040335274070000;812462148;#;#;#0
libraryFolder Structure:
typedef struct _DAT_LIBRARY_FOLDER {
uint64 header; // 0A = libraryFolder
uint64 entry_offset;
uint32 unknown1;
uint32 unknown2;
char resourceID[39];
char unknown4[121];
char listID[39]; // Document library
char unknown5[LFOLDER_CONSTANT];
} DAT_LIBRARY_FOLDER;
vault Structure:
typedef struct _DAT_VAULT {
uint64 header; // 0B = Unknown
uint64 entry_offset;
uint32 unknown1;
uint32 unknown2;
char resourceID[39];
char unknown3[649];
uint64 shortcutVolumeID;
uint64 shortcutItemIndex;
char unknown6[VAULT_CONSTANT];
} DAT_VAULT;
AddedScope:
typedef struct _DAT_ADDED_SCOPE {
uint64 header; // 0C = AddedScope
uint64 entry_offset;
uint32 unknown1;
uint32 unknown2;
char scopeID[39];
char unknown3[117];
uint32 flags;
char siteID[39]; // The SiteId is the unique GUID for the site collection.
char webID[39]; // The WebId is the ID for a site (or subsite) in a site collection.
char listID[39]; // Document library
char sourceResourceID[39]; // Document library
uint32 libraryType;
uint32 unknown5;
char syncTokenData[516];
uint32 syncTokenData_size;
uint32 spoPermissions;
char unknown6[LSCOPE_CONSTANT];
} DAT_ADDED_SCOPE;
No comments:
Post a Comment