# Simple test script to understand GeViSet structure $filePath = "C:\Users\Administrator\Desktop\GeViSoft.set" $data = [System.IO.File]::ReadAllBytes($filePath) Write-Host "Analyzing first 200 bytes of structure..." -ForegroundColor Cyan Write-Host "" # Manual parsing of first few elements $pos = 0 function Read-LengthPrefixedString { param([ref]$position, [byte[]]$data, [int]$lengthBytes) $length = 0 if ($lengthBytes -eq 1) { $length = $data[$position.Value] $position.Value++ } else { $length = [BitConverter]::ToUInt16($data, $position.Value) $position.Value += 2 } $text = [System.Text.Encoding]::UTF8.GetString($data, $position.Value, $length) $position.Value += $length return @{Length = $length; Text = $text} } # Try parsing with different length assumptions Write-Host "=== Attempt 1: First byte as type, next byte as 1-byte length ===" -ForegroundColor Yellow $pos = 0 $type = $data[$pos++] Write-Host "Type marker: 0x$($type.ToString('X2'))" $length = $data[$pos++] Write-Host "Length: $length" $text = [System.Text.Encoding]::UTF8.GetString($data, $pos, $length) $pos += $length Write-Host "Text: '$text'" Write-Host "Next 20 bytes: $([BitConverter]::ToString($data[$pos..($pos+19)]))" Write-Host "" # Try parsing with 2-byte length Write-Host "=== Attempt 2: First byte as type, next 2 bytes as 2-byte LE length ===" -ForegroundColor Yellow $pos = 0 $type = $data[$pos++] Write-Host "Type marker: 0x$($type.ToString('X2'))" $length = [BitConverter]::ToUInt16($data, $pos) $pos += 2 Write-Host "Length: $length" if ($length -lt 200) { $text = [System.Text.Encoding]::UTF8.GetString($data, $pos, $length) $pos += $length Write-Host "Text: '$text'" Write-Host "Next 20 bytes: $([BitConverter]::ToString($data[$pos..($pos+19)]))" } else { Write-Host "Length too large ($length), probably wrong interpretation" } Write-Host "" # Look at structure around the user section Write-Host "=== Looking for 'SysAdmin' string ===" -ForegroundColor Yellow $text = [System.Text.Encoding]::GetEncoding("ISO-8859-1").GetString($data) $sysAdminPos = $text.IndexOf("SysAdmin") if ($sysAdminPos -ge 0) { Write-Host "Found 'SysAdmin' at offset: 0x$($sysAdminPos.ToString('X8'))" Write-Host "Context (60 bytes before):" $start = [Math]::Max(0, $sysAdminPos - 60) Write-Host ([BitConverter]::ToString($data[$start..($sysAdminPos + 20)])) Write-Host "" Write-Host "As text:" Write-Host ([System.Text.Encoding]::UTF8.GetString($data[$start..($sysAdminPos + 40)]) -replace '[^\x20-\x7E]', '.') }