Disk Editor Templates

Apart built-in templates, Disk Editor supports custom templates to view and edit different disk structures. Conditions, "goto" operators, simple arithmetics can be used to parse complex disk structures, such as MFT records.

By default templates are loaded from the file template.txt. To use different files ini-parameter editortemplates= can be used, wildcards are allowed (e.g., editortemplates=template*).

Template File Structure

Each template begins with a name in square brackets [Template Name] followed by the template parameters and instructions (one per line).

Template Parameters

guid:{GUID} - the template identifier.
o:1 - the template can be applied to a not sector-aligned structure (offset can be applied).
fuse:0 - do not use the template.
flow:0 - display a single record at a time.
flow:1 - display records in a flow.
big-endian:1 - use big-endian byte order.
h:Header - display static Header at the top.

Constants

Constants are specified as decimal and hexadecimal (0x prefixed) integers.

Variables

$RECSIZE - size of the record
$RECDEVOFS - position of the current record on the disk (in bytes from the beginning of the disk)
$NEXTOFS - offset applied to data blocks (see below)
$OFFSET - additional relative offset applied to data blocks
$XOFS - additional column offset for the output (see below x:X)
$1 ... $4 - global custom variables (64-bit signed integers)
$varname - a local variable (64-bit signed integer), where varname is case-sensitive and may contain digits, latin letters, and underscores. A local variable must be initialized with the assignment operator := and is valid only within the block of the instructions where it is initialized.

Data Block

Data block is usually a single byte/word/dword at a fixed position but it also can be a range or series of bytes/bits which are processed like a single variable. Data block is specified in braces {...}.

{Z} defines range of Z bytes starting at offset $NEXTOFS (and $NEXTOFS is increased by Z then);
{X,Z} defines range of Z bytes starting at offset X,
{X:Y,Z} defines range of Z bits starting at offset X byte and Y bits,
where X, Y, and Z can be any variables or constants,
several ranges can be separated by a semicolon, e.g. {0x00,4;$1:$2,4}.

Data Block Formats

Format defines how data block is represented and edited (e.g. as integer / char / string, etc.).

The following formats are supported:
%u - unsigned integer (up to 64bit)
%d - signed integer (up to 64bit)
%X / %x - hexadecimal (up to 64bit)
%c - ANSI character (8bit)
C - array of ANSI characters
U - array of Unicode characters (UTF-16)
u - utf-8 encoded string
T - array of text characters (depending on encoding table)
CXm - byte-by-byte hex output in multiple lines
UNIXDATE - Unix date (seconds since epox)
FILETIME - Windows file time (nanoseconds since 1601)
F:ABCD.. - Flags (where A is displayed if bit 0 is set, and B if bit 0 is clear, etc.)

Output

Output instruction defines the position on the screen and format for a data block or variable or simply outputs text.

{...},x:X,w:W,c:C,Format outputs data block {...} at column X with the max. width W using the format Format.
x:X,w:W,c:C,Text outputs Text at column X with the maximum width W in color C. The Text can be enclosed in quotation marks ("Text").

Parameters w:W and c:C are optional (0 - the default color, 1 - title, 8 - red, 10 - grayed).

The output is performed at the current line, the instruction = (equal sign) moves output to the next line.

Operators and Expressions

Expression is a combination of variables, constants, data blocks, and operators (~, NOT; *, /, %; +, -; <<, >>; <, <=, >, >=; =, !=; &; ^; |; AND; OR), e.g.
$2+{0x08:$1,5}

Assignment operator := is used to copy the result of the expression to the variable, e.g.
$1:=$2+{0x08:$1,5}
$2:=$OFFSET & 8

Conditions, Cycles, and Transitions

Conditions

Cycles