Quote:
Originally Posted by arnezami
@Founditalso: Thanks. I'm just looking if there is an easy way to predict these Volume IDs. Maybe there are too many types and we have to find and reveal the private host key (or just accept sniffing as part of the process).
Code:
Constantine 05/12/2006 5:05
Hex: 40 00 30 06 53 05 16 11 57 47 48 44 56 4d 00 00
Ascii: W G H D V M
16 Blocks 05/18/2006 2:48
Hex: 40 00 07 06 02 05 17 17 57 47 48 44 56 4d 00 00
Ascii: W G H D V M
Kiss Kiss Bang Bang 05/25/2006 4:07
Hex: 40 00 12 06 51 05 15 24 57 47 48 44 56 4d 00 00
Ascii: W G H D V M
Lady in the Water 10/19/2006 8:36
Hex: 40 00 08 06 16 10 23 18 57 47 48 44 56 4d 00 00
Ascii: W G H D V M
Appollo 13:
Hex: 40 00 04 06 32 04 20 11 57 47 48 44 56 4D 00 00
Ascii: W G H D V M
Batman Begins:
Hex: 40 00 40 06 26 08 10 15 57 47 48 44 56 4D 00 00
Ascii: W G H D V M
The 06 is very likely YY. So I suspect the other numbers have something to do with time/date or something aswell. The last two bolded ones look like HHMM. |
Blue = YY (year)
Red = MM (month)
Orange = DD minus 1 (date)
I guess the two bytes in between YY, MM & DD are mm (minute) and hh (hour) respectively and the byte before YY is probably ss (second).
So the embedded time and date stamp is probably in this order: 40 00
ss YY mm MM hh DD 57 47 48 44 56 4D 00 00