SHADOW files

[constancio]

Dears, good afternoon,

Do I have a code for reading of files SHADOW of the windows, however when compiling mistake it is returning, can you help me?

define SHD_SIGNATURE_67 $00004967 //Win2000/XP
typedef struct _SHADOW_FILE_HEADER_67 {
DWORD dwSignature; //SHD_SIGNATURE_67
WORD wStatus;
WORD wUnknown1;
DWORD dwJobID;
DWORD dwPriority;
DWORD dwUnknown2;
SYSTEMTIME stSubmitTime;
DWORD dwUntilTime;
DWORD dwSizeSPL; //Size of SPL File
DWORD dwSizeSecurityInfo; //Size of SecurityInfo
DWORD offSecurityInfo; //Offset of SECURITY_DESCRIPTOR
DWORD dwUnknown3;
DWORD dwUnknown4;
DWORD dwUnknown5;
DWORD offComputername; //Offset of WideChar+0
DWORD dwSPLSize2;
} SHADOW_FILE_HEADER_67, *PSHADOW_FILE_HEADER_67;

Mistakes:

1 C:\Dev-Cpp\Examples\WinMenu\teste.cpp `define' does not name a type
31 C:\Dev-Cpp\Examples\WinMenu\teste.cpp expected constructor, destructor, or type conversion before ',' token
31 C:\Dev-Cpp\Examples\WinMenu\teste.cpp expected constructor, destructor, or type conversion before ';' token

Thanks

[scwizzo]

define SHD_SIGNATURE_67 $00004967 //Win2000/XP

should be

#define SHD_SIGNATURE_67 $00004967 //Win2000/XP

This is an easy problem that could easily be fixed by googling it.

[constancio]

Dear Scwizzo, thank you for his return, I corrected the code. But do you possess an idea of how to read the files that are generated inside of the spool of the windows with this code? C:\WINDOWS\system32\spool\PRINTERS

#include <windows.h>
#define SHD_SIGNATURE_67 $00004967 //Win2000/XP
typedef struct _SHADOW_FILE_HEADER_67 {
DWORD dwSignature; //SHD_SIGNATURE_67
WORD wStatus;
WORD wUnknown1;
DWORD dwJobID;
DWORD dwPriority;
DWORD dwUnknown2;
SYSTEMTIME stSubmitTime;
DWORD dwUntilTime;
DWORD dwSizeSPL; //Size of SPL File
DWORD dwSizeSecurityInfo; //Size of SecurityInfo
DWORD offSecurityInfo; //Offset of SECURITY_DESCRIPTOR
DWORD dwUnknown3;
DWORD dwUnknown4;
DWORD dwUnknown5;
DWORD offComputername; //Offset of WideChar+0
DWORD dwSPLSize2;
} SHADOW_FILE_HEADER_67, *PSHADOW_FILE_HEADER_67;

[Elysia]

Please, please PLEASE do not put your reply inside the code tags! The result is obvious - now we have to scroll to read your reply. It is annoying and infuriating.
ONLY code inside the code tags!

[Mario F.]

Constancio,

That code is only defining the structure needed to interpret the contents of a .shd file. Assuming that is the correct format, you have only defined how to interpret the file contents. That code is doing nothing. Just specifying how the file is structured.

As a comparison, that code only gives instructions on how to create a toy car mold. You will still need to code how to fill that mold with the contents of a .shd file. And you will also need to create the code to interpret the contents of that structure you shown us.

Since you obviously have no clue what you are doing, neither you have any idea how to program in C++ (which is fine, really), there is no way anyone can help you since they would have to write that code for you. It's not something that can be shown that easily, the same you cannot expect any useful reply on how to build a car by just asking.

You need to learn first how to program in C++... and then all things will fit into place.

[constancio]

I thank all.