fse_dump 3.1.6

Dumps the fseventsd entries from a mac
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <std/mem.pat>

struct Record {
    char path[];
    be u64 event_id;
    be u32 flag;
    le u64 node_id;
    u32 unknown;
};

struct Info {
    u8 extra[4];
    u8 id[4];
    le u32 plen;
    Record records[while(!std::mem::eof())];
};

Info info @ 0x00;