Reverse Engeneering of Disky with OllyDebug:

aClmId, aPfsID, aPthID, aVmmID sind im Segment data -> keine Funktionen

Vmm steht fr Volume Manager -> aVmmID hat was mit volumes zu tun und knnte
der Zeiger darauf sein.
fs steht sicher fr File System -> aPfsID evtl. Zeiger auf Partition File System
pth steht sicher fr Path -> aPthID evtl. Zeiger auf die Pfadangabe, auf die sich
viele Funktionen beziehen.
Clm knnte Clustermanager sein



aVmmID enthlt den Partitionsnamen, mit Ascii " " aufgefllt
ab Offset 0x02, da knnte also noch zwei byte davor sein

1008A120 >      4E 4F 20 4E 41 4D    NO NAM
1008A128  45 20 20 20 20           E

aPthID enthlt die SCSI Kennungsinformationen:
ab Offset 0x04, da knnte also noch 4 byte oder ein long davor sein

100898E0 >            32 3A 36 3A 30     2:6:0

aClmID enthlt viele gleichartige Eintrge:
wobei der erste mit FF FF abschliesst, die anderen aber mit FE FF

es knnten 50 Eintrge sein

Die Eintrge entsprechen genau der Startadresse des nchsten Elements:
Beispiel:
1009C438  40 C4 09 10
to LEndian: 1009C440 
-> das knnte eine Struktur sein, die einen Zeiger auf die nchste Struktur enthlt
und somit eine einfach verkette Liste darstellt.
-> das heisst dann, dass die Sturkur 16 Byte lang ist.

1009C420 >FF FF 00 00 00 00 00 00   ......
1009C428  30 C4 09 10 00 00 00 00   0.....
1009C430  FF FF 00 00 00 00 00 00   ......
1009C438  40 C4 09 10 00 00 00 00   @.....
1009C440  FE FF 00 00 00 00 00 00   ......
1009C448  50 C4 09 10 00 00 00 00   P.....
1009C450  FE FF 00 00 00 00 00 00   ......
1009C458  60 C4 09 10 00 00 00 00   `.....
1009C460  FE FF 00 00 00 00 00 00   ......
1009C468  70 C4 09 10 00 00 00 00   p.....
1009C470  FE FF 00 00 00 00 00 00   ......
1009C478  80 C4 09 10 00 00 00 00   .....
1009C480  FE FF 00 00 00 00 00 00   ......
1009C488  90 C4 09 10 00 00 00 00   .....
1009C490  FE FF 00 00 00 00 00 00   ......
1009C498  A0 C4 09 10 00 00 00 00   .....
1009C4A0  FE FF 00 00 00 00 00 00   ......
1009C4A8  B0 C4 09 10 00 00 00 00   .....
1009C4B0  FE FF 00 00 00 00 00 00   ......
1009C4B8  C0 C4 09 10 00 00 00 00   .....
1009C4C0  FE FF 00 00 00 00 00 00   ......
1009C4C8  D0 C4 09 10 00 00 00 00   .....
1009C4D0  FE FF 00 00 00 00 00 00   ......
1009C4D8  E0 C4 09 10 00 00 00 00   .....
1009C4E0  FE FF 00 00 00 00 00 00   ......
1009C4E8  F0 C4 09 10 00 00 00 00   .....
1009C4F0  FE FF 00 00 00 00 00 00   ......
1009C4F8  00 C5 09 10 00 00 00 00   ......
1009C500  FE FF 00 00 00 00 00 00   ......
1009C508  10 C5 09 10 00 00 00 00   .....
1009C510  FE FF 00 00 00 00 00 00   ......
1009C518  20 C5 09 10 00 00 00 00    .....
1009C520  FE FF 00 00 00 00 00 00   ......
1009C528  30 C5 09 10 00 00 00 00   0.....
1009C530  FE FF 00 00 00 00 00 00   ......
1009C538  40 C5 09 10 00 00 00 00   @.....
1009C540  FE FF 00 00 00 00 00 00   ......
1009C548  50 C5 09 10 00 00 00 00   P.....
1009C550  FE FF 00 00 00 00 00 00   ......
1009C558  60 C5 09 10 00 00 00 00   `.....
1009C560  FE FF 00 00 00 00 00 00   ......
1009C568  70 C5 09 10 00 00 00 00   p.....
1009C570  FE FF 00 00 00 00 00 00   ......
1009C578  80 C5 09 10 00 00 00 00   .....
1009C580  FE FF 00 00 00 00 00 00   ......
1009C588  90 C5 09 10 00 00 00 00   .....
1009C590  FE FF 00 00 00 00 00 00   ......
1009C598  A0 C5 09 10 00 00 00 00   .....
1009C5A0  FE FF 00 00 00 00 00 00   ......
1009C5A8  B0 C5 09 10 00 00 00 00   .....
1009C5B0  FE FF 00 00 00 00 00 00   ......
1009C5B8  C0 C5 09 10 00 00 00 00   .....
1009C5C0  FE FF 00 00 00 00 00 00   ......
1009C5C8  D0 C5 09 10 00 00 00 00   .....
1009C5D0  FE FF 00 00 00 00 00 00   ......
1009C5D8  E0 C5 09 10 00 00 00 00   .....
1009C5E0  FE FF 00 00 00 00 00 00   ......
1009C5E8  F0 C5 09 10 00 00 00 00   .....
1009C5F0  FE FF 00 00 00 00 00 00   ......
1009C5F8  00 C6 09 10 00 00 00 00   ......
1009C600  FE FF 00 00 00 00 00 00   ......
1009C608  10 C6 09 10 00 00 00 00   .....
1009C610  FE FF 00 00 00 00 00 00   ......
1009C618  20 C6 09 10 00 00 00 00    .....
1009C620  FE FF 00 00 00 00 00 00   ......
1009C628  30 C6 09 10 00 00 00 00   0.....
1009C630  FE FF 00 00 00 00 00 00   ......
1009C638  40 C6 09 10 00 00 00 00   @.....
1009C640  FE FF 00 00 00 00 00 00   ......
1009C648  50 C6 09 10 00 00 00 00   P.....
1009C650  FE FF 00 00 00 00 00 00   ......
1009C658  60 C6 09 10 00 00 00 00   `.....
1009C660  FE FF 00 00 00 00 00 00   ......
1009C668  70 C6 09 10 00 00 00 00   p.....
1009C670  FE FF 00 00 00 00 00 00   ......
1009C678  80 C6 09 10 00 00 00 00   .....
1009C680  FE FF 00 00 00 00 00 00   ......
1009C688  90 C6 09 10 00 00 00 00   .....
1009C690  FE FF 00 00 00 00 00 00   ......
1009C698  A0 C6 09 10 00 00 00 00   .....
1009C6A0  FE FF 00 00 00 00 00 00   ......
1009C6A8  B0 C6 09 10 00 00 00 00   .....
1009C6B0  FE FF 00 00 00 00 00 00   ......
1009C6B8  C0 C6 09 10 00 00 00 00   .....
1009C6C0  FE FF 00 00 00 00 00 00   ......
1009C6C8  D0 C6 09 10 00 00 00 00   .....
1009C6D0  FE FF 00 00 00 00 00 00   ......
1009C6D8  E0 C6 09 10 00 00 00 00   .....
1009C6E0  FE FF 00 00 00 00 00 00   ......
1009C6E8  F0 C6 09 10 00 00 00 00   .....
1009C6F0  FE FF 00 00 00 00 00 00   ......
1009C6F8  00 C7 09 10 00 00 00 00   ......
1009C700  FE FF 00 00 00 00 00 00   ......
1009C708  10 C7 09 10 00 00 00 00   .....
1009C710  FE FF 00 00 00 00 00 00   ......
1009C718  20 C7 09 10 00 00 00 00    .....
1009C720  FE FF 00 00 00 00 00 00   ......
1009C728  30 C7 09 10 00 00 00 00   0.....
1009C730  FE FF 00 00 00 00 00 00   ......
1009C738  00 00 00 00 00 00 00 00   ........
1009C740  68 04 1B 01 00 00 00 00   h....

Annahme: letzter Eintrag ist auch wieder ein Pointer, so ergbe sich die 
Adresse 011B0468

aPfsId enthlt ebenfalls sowas:
Beispiel:
100248E0 >            F4 48 02 10
-> 100248F4
-> Diese Struktur ist 20 Byte lang

100248E0 >FF FF FF FF F4 48 02 10   H
100248E8  00 00 00 00 00 00 00 00   ........
100248F0  00 00 00 00 FF FF FF FF   ....
100248F8  08 49 02 10 00 00 00 00   I....
10024900  00 00 00 00 00 00 00 00   ........
10024908  FE FF FF FF 1C 49 02 10   I
10024910  00 00 00 00 00 00 00 00   ........
10024918  00 00 00 00 FE FF FF FF   ....
10024920  30 49 02 10 00 00 00 00   0I....
10024928  00 00 00 00 00 00 00 00   ........
10024930  FE FF FF FF 44 49 02 10   DI
10024938  00 00 00 00 00 00 00 00   ........
10024940  00 00 00 00 FE FF FF FF   ....
10024948  58 49 02 10 00 00 00 00   XI....
10024950  00 00 00 00 00 00 00 00   ........
10024958  FE FF FF FF 6C 49 02 10   lI
10024960  00 00 00 00 00 00 00 00   ........
10024968  00 00 00 00 FE FF FF FF   ....
10024970  80 49 02 10 00 00 00 00   I....
10024978  00 00 00 00 00 00 00 00   ........
10024980  FE FF FF FF 94 49 02 10   I
10024988  00 00 00 00 00 00 00 00   ........
10024990  00 00 00 00 FE FF FF FF   ....
10024998  A8 49 02 10 00 00 00 00   I....
100249A0  00 00 00 00 00 00 00 00   ........
100249A8  FE FF FF FF BC 49 02 10   I
100249B0  00 00 00 00 00 00 00 00   ........
100249B8  00 00 00 00 FE FF FF FF   ....
100249C0  D0 49 02 10 00 00 00 00   I....
100249C8  00 00 00 00 00 00 00 00   ........
100249D0  FE FF FF FF E4 49 02 10   I
100249D8  00 00 00 00 00 00 00 00   ........
100249E0  00 00 00 00 FE FF FF FF   ....
100249E8  F8 49 02 10 00 00 00 00   I....
100249F0  00 00 00 00 00 00 00 00   ........
100249F8  FE FF FF FF 0C 4A 02 10   .J
10024A00  00 00 00 00 00 00 00 00   ........
10024A08  00 00 00 00 FE FF FF FF   ....
10024A10  20 4A 02 10 00 00 00 00    J....
10024A18  00 00 00 00 00 00 00 00   ........
10024A20  FE FF FF FF 34 4A 02 10   4J
10024A28  00 00 00 00 00 00 00 00   ........
10024A30  00 00 00 00 FE FF FF FF   ....
10024A38  48 4A 02 10 00 00 00 00   HJ....
10024A40  00 00 00 00 00 00 00 00   ........
10024A48  FE FF FF FF 5C 4A 02 10   \J
10024A50  00 00 00 00 00 00 00 00   ........
10024A58  00 00 00 00 FE FF FF FF   ....
10024A60  70 4A 02 10 00 00 00 00   pJ....
10024A68  00 00 00 00 00 00 00 00   ........
10024A70  FE FF FF FF 84 4A 02 10   J
10024A78  00 00 00 00 00 00 00 00   ........
10024A80  00 00 00 00 FE FF FF FF   ....
10024A88  98 4A 02 10 00 00 00 00   J....
10024A90  00 00 00 00 00 00 00 00   ........
10024A98  FE FF FF FF AC 4A 02 10   J
10024AA0  00 00 00 00 00 00 00 00   ........
10024AA8  00 00 00 00 FE FF FF FF   ....
10024AB0  C0 4A 02 10 00 00 00 00   J....
10024AB8  00 00 00 00 00 00 00 00   ........
10024AC0  FE FF FF FF D4 4A 02 10   J
10024AC8  00 00 00 00 00 00 00 00   ........
10024AD0  00 00 00 00 FE FF FF FF   ....
10024AD8  E8 4A 02 10 00 00 00 00   J....
10024AE0  00 00 00 00 00 00 00 00   ........
10024AE8  FE FF FF FF FC 4A 02 10   J
10024AF0  00 00 00 00 00 00 00 00   ........
10024AF8  00 00 00 00 FE FF FF FF   ....
10024B00  10 4B 02 10 00 00 00 00   K....
10024B08  00 00 00 00 00 00 00 00   ........
10024B10  FE FF FF FF 24 4B 02 10   $K
10024B18  00 00 00 00 00 00 00 00   ........
10024B20  00 00 00 00 FE FF FF FF   ....
10024B28  38 4B 02 10 00 00 00 00   8K....
10024B30  00 00 00 00 00 00 00 00   ........
10024B38  FE FF FF FF 4C 4B 02 10   LK
10024B40  00 00 00 00 00 00 00 00   ........
10024B48  00 00 00 00 FE FF FF FF   ....
10024B50  60 4B 02 10 00 00 00 00   `K....
10024B58  00 00 00 00 00 00 00 00   ........
10024B60  FE FF FF FF 74 4B 02 10   tK
10024B68  00 00 00 00 00 00 00 00   ........
10024B70  00 00 00 00 FE FF FF FF   ....
10024B78  88 4B 02 10 00 00 00 00   K....
10024B80  00 00 00 00 00 00 00 00   ........
10024B88  FE FF FF FF 9C 4B 02 10   K
10024B90  00 00 00 00 00 00 00 00   ........
10024B98  00 00 00 00 FE FF FF FF   ....
10024BA0  B0 4B 02 10 00 00 00 00   K....
10024BA8  00 00 00 00 00 00 00 00   ........
10024BB0  FE FF FF FF C4 4B 02 10   K
10024BB8  00 00 00 00 00 00 00 00   ........
10024BC0  00 00 00 00 FE FF FF FF   ....
10024BC8  D8 4B 02 10 00 00 00 00   K....
10024BD0  00 00 00 00 00 00 00 00   ........
10024BD8  FE FF FF FF EC 4B 02 10   K
10024BE0  00 00 00 00 00 00 00 00   ........
10024BE8  00 00 00 00 FE FF FF FF   ....
10024BF0  00 4C 02 10 00 00 00 00   .L....
10024BF8  00 00 00 00 00 00 00 00   ........
10024C00  FE FF FF FF 14 4C 02 10   L
10024C08  00 00 00 00 00 00 00 00   ........
10024C10  00 00 00 00 FE FF FF FF   ....
10024C18  28 4C 02 10 00 00 00 00   (L....
10024C20  00 00 00 00 00 00 00 00   ........
10024C28  FE FF FF FF 3C 4C 02 10   <L
10024C30  00 00 00 00 00 00 00 00   ........
10024C38  00 00 00 00 FE FF FF FF   ....
10024C40  50 4C 02 10 00 00 00 00   PL....
10024C48  00 00 00 00 00 00 00 00   ........
10024C50  FE FF FF FF 64 4C 02 10   dL
10024C58  00 00 00 00 00 00 00 00   ........
10024C60  00 00 00 00 FE FF FF FF   ....
10024C68  78 4C 02 10 00 00 00 00   xL....
10024C70  00 00 00 00 00 00 00 00   ........
10024C78  FE FF FF FF 8C 4C 02 10   L
10024C80  00 00 00 00 00 00 00 00   ........
10024C88  00 00 00 00 FE FF FF FF   ....
10024C90  A0 4C 02 10 00 00 00 00   L....
10024C98  00 00 00 00 00 00 00 00   ........
10024CA0  FE FF FF FF B4 4C 02 10   L
10024CA8  00 00 00 00 00 00 00 00   ........
10024CB0  00 00 00 00 FE FF FF FF   ....
10024CB8  C8 4C 02 10 00 00 00 00   L....
10024CC0  00 00 00 00 00 00 00 00   ........
10024CC8  FE FF FF FF DC 4C 02 10   L
10024CD0  00 00 00 00 00 00 00 00   ........
10024CD8  00 00 00 00 FE FF FF FF   ....
10024CE0  F0 4C 02 10 00 00 00 00   L....
10024CE8  00 00 00 00 00 00 00 00   ........
10024CF0  FE FF FF FF 04 4D 02 10   M
10024CF8  00 00 00 00 00 00 00 00   ........
10024D00  00 00 00 00 FE FF FF FF   ....
10024D08  18 4D 02 10 00 00 00 00   M....
10024D10  00 00 00 00 00 00 00 00   ........
10024D18  FE FF FF FF 2C 4D 02 10   ,M
10024D20  00 00 00 00 00 00 00 00   ........
10024D28  00 00 00 00 FE FF FF FF   ....
10024D30  40 4D 02 10 00 00 00 00   @M....
10024D38  00 00 00 00 00 00 00 00   ........
10024D40  FE FF FF FF 54 4D 02 10   TM
10024D48  00 00 00 00 00 00 00 00   ........
10024D50  00 00 00 00 FE FF FF FF   ....
10024D58  68 4D 02 10 00 00 00 00   hM....
10024D60  00 00 00 00 00 00 00 00   ........
10024D68  FE FF FF FF 7C 4D 02 10   |M
10024D70  00 00 00 00 00 00 00 00   ........
10024D78  00 00 00 00 FE FF FF FF   ....
10024D80  90 4D 02 10 00 00 00 00   M....
10024D88  00 00 00 00 00 00 00 00   ........
10024D90  FE FF FF FF A4 4D 02 10   M
10024D98  00 00 00 00 00 00 00 00   ........
10024DA0  00 00 00 00 FE FF FF FF   ....
10024DA8  B8 4D 02 10 00 00 00 00   M....
10024DB0  00 00 00 00 00 00 00 00   ........
10024DB8  FE FF FF FF CC 4D 02 10   M
10024DC0  00 00 00 00 00 00 00 00   ........
10024DC8  00 00 00 00 FE FF FF FF   ....
10024DD0  E0 4D 02 10 00 00 00 00   M....
10024DD8  00 00 00 00 00 00 00 00   ........
10024DE0  FE FF FF FF F4 4D 02 10   M
10024DE8  00 00 00 00 00 00 00 00   ........
10024DF0  00 00 00 00 FE FF FF FF   ....
10024DF8  08 4E 02 10 00 00 00 00   N....
10024E00  00 00 00 00 00 00 00 00   ........
10024E08  FE FF FF FF 1C 4E 02 10   N
10024E10  00 00 00 00 00 00 00 00   ........
10024E18  00 00 00 00 FE FF FF FF   ....
10024E20  30 4E 02 10 00 00 00 00   0N....
10024E28  00 00 00 00 00 00 00 00   ........
10024E30  FE FF FF FF 44 4E 02 10   DN
10024E38  00 00 00 00 00 00 00 00   ........
10024E40  00 00 00 00 FE FF FF FF   ....
10024E48  58 4E 02 10 00 00 00 00   XN....
10024E50  00 00 00 00 00 00 00 00   ........
10024E58  FE FF FF FF 6C 4E 02 10   lN
10024E60  00 00 00 00 00 00 00 00   ........
10024E68  00 00 00 00 FE FF FF FF   ....
10024E70  80 4E 02 10 00 00 00 00   N....
10024E78  00 00 00 00 00 00 00 00   ........
10024E80  FE FF FF FF 94 4E 02 10   N
10024E88  00 00 00 00 00 00 00 00   ........
10024E90  00 00 00 00 FE FF FF FF   ....
10024E98  A8 4E 02 10 00 00 00 00   N....
10024EA0  00 00 00 00 00 00 00 00   ........
10024EA8  FE FF FF FF BC 4E 02 10   N
10024EB0  00 00 00 00 00 00 00 00   ........
10024EB8  00 00 00 00 FE FF FF FF   ....
10024EC0  D0 4E 02 10 00 00 00 00   N....
10024EC8  00 00 00 00 00 00 00 00   ........
10024ED0  FE FF FF FF E4 4E 02 10   N
10024ED8  00 00 00 00 00 00 00 00   ........
10024EE0  00 00 00 00 FE FF FF FF   ....
10024EE8  F8 4E 02 10 00 00 00 00   N....
10024EF0  00 00 00 00 00 00 00 00   ........
10024EF8  FE FF FF FF 0C 4F 02 10   .O
10024F00  00 00 00 00 00 00 00 00   ........
10024F08  00 00 00 00 FE FF FF FF   ....
10024F10  20 4F 02 10 00 00 00 00    O....
10024F18  00 00 00 00 00 00 00 00   ........
10024F20  FE FF FF FF 34 4F 02 10   4O
10024F28  00 00 00 00 00 00 00 00   ........
10024F30  00 00 00 00 FE FF FF FF   ....
10024F38  48 4F 02 10 00 00 00 00   HO....
10024F40  00 00 00 00 00 00 00 00   ........
10024F48  FE FF FF FF 5C 4F 02 10   \O
10024F50  00 00 00 00 00 00 00 00   ........
10024F58  00 00 00 00 FE FF FF FF   ....
10024F60  70 4F 02 10 00 00 00 00   pO....
10024F68  00 00 00 00 00 00 00 00   ........
10024F70  FE FF FF FF 84 4F 02 10   O
10024F78  00 00 00 00 00 00 00 00   ........
10024F80  00 00 00 00 FE FF FF FF   ....
10024F88  98 4F 02 10 00 00 00 00   O....
10024F90  00 00 00 00 00 00 00 00   ........
10024F98  FE FF FF FF AC 4F 02 10   O
10024FA0  00 00 00 00 00 00 00 00   ........
10024FA8  00 00 00 00 FE FF FF FF   ....
10024FB0  C0 4F 02 10 00 00 00 00   O....
10024FB8  00 00 00 00 00 00 00 00   ........
10024FC0  FE FF FF FF D4 4F 02 10   O
10024FC8  00 00 00 00 00 00 00 00   ........
10024FD0  00 00 00 00 FE FF FF FF   ....
10024FD8  E8 4F 02 10 00 00 00 00   O....
10024FE0  00 00 00 00 00 00 00 00   ........
10024FE8  FE FF FF FF FC 4F 02 10   O
10024FF0  00 00 00 00 00 00 00 00   ........
10024FF8  00 00 00 00 FE FF FF FF   ....
10025000  10 50 02 10 00 00 00 00   P....
10025008  00 00 00 00 00 00 00 00   ........
10025010  FE FF FF FF 24 50 02 10   $P
10025018  00 00 00 00 00 00 00 00   ........
10025020  00 00 00 00 FE FF FF FF   ....
10025028  38 50 02 10 00 00 00 00   8P....
10025030  00 00 00 00 00 00 00 00   ........
10025038  FE FF FF FF 4C 50 02 10   LP
10025040  00 00 00 00 00 00 00 00   ........
10025048  00 00 00 00 FE FF FF FF   ....
10025050  60 50 02 10 00 00 00 00   `P....
10025058  00 00 00 00 00 00 00 00   ........
10025060  FE FF FF FF 74 50 02 10   tP
10025068  00 00 00 00 00 00 00 00   ........
10025070  00 00 00 00 FE FF FF FF   ....
10025078  88 50 02 10 00 00 00 00   P....
10025080  00 00 00 00 00 00 00 00   ........
10025088  FE FF FF FF 9C 50 02 10   P
10025090  00 00 00 00 00 00 00 00   ........
10025098  00 00 00 00 FE FF FF FF   ....
100250A0  00 00 00 00 00 00 00 00   ........
100250A8  00 00 00 00 00 00 00 00   ........
100250B0  20 00 1B 01 00 00 00 00    .....
100250B8  00 00 00 00 00 00 00 00   ........
100250C0  59 41 4D 41 48 41 5F 64   YAMAHA_d
100250C8  65 76 33 00 00 00 00 00   ev3.....


Verbindung zwischen Disky und a3kfsio.dll:
Memory map, item 67 
 Address=10001000 Size=0001C000 (114688.) Owner=A3KFSIO  10000000
 Section=.text Contains=code Type=Imag 01001002 Access=R Initial access=RWE
 
 Memory map, item 68
  Address=1001D000  Size=00002000 (8192.)  Owner=A3KFSIO  10000000
  Section=.rdata  Contains=exports  Type=Imag 01001002  Access=R  Initial access=RWE

Memory map, item 69
 Address=1001F000 Size=0007F000 (520192.) Owner=A3KFSIO  10000000
 Section=.data Contains=data Type=Imag 01001002 Access=R Initial access=RWE

Memory map, item 70
 Address=1009E000 Size=00001000 (4096.) Owner=A3KFSIO  10000000
 Section=.idata Contains=imports Type=Imag 01001002 Access=R Initial access=RWE

Memory map, item 71
 Address=1009F000 Size=00002000 (8192.) Owner=A3KFSIO  10000000
 Section=.reloc Contains=relocations Type=Imag 01001002 Access=R Initial access=RWE



