Kaspersky report file
The Kaspersky Anti-Virus report files are stored in a propriety file format.
The following information is based on the current understanding of the Kaspersky Report File format.
Overview
A Kaspersky Report File consists of:
- file header
- log record index
- array of log records
File header
The file header is 80 bytes of size and consists of:
| Offset | Size | Value | Description |
|---|---|---|---|
| 0 | 4 | "RPD2" | Signature |
| 4 | 4 | 2 | Unknown, version? |
| 8 | 8 | Unknown (empty values?) | |
| 16 | 4 | Unknown A. Next available record number or 0? | |
| 20 | 4 | 0x1000 | Unknown (record index size?) |
| 24 | 4 | Unknown (Record offset?) | |
| 28 | 4 | Unknown (empty value) | |
| 32 | 4 | File size | |
| 36 | 4 | Unknown (empty value) | |
| 40 | 8 | Unknown timestamp. Creation time? | |
| 48 | 8 | Unknown timestamp. Last write time? | |
| 56 | 8 | Unknown timestamp. Access time? | |
| 64 | 8 | Unknown (empty values?) | |
| 72 | 4 | Next available record number? | |
| 76 | 4 | Unknown (empty value) |
Log records index
Log records index entry
The file header is 80 bytes of size and consists of:
| Offset | Size | Value | Description |
|---|---|---|---|
| 0 | 4 | Record offset. The offset is relative to the start of the file | |
| 4 | 4 | Unknown (empty value) | |
| 8 | 4 | Record number | |
| 12 | 4 | Unknown (empty value) |
Log records
Log record header
| Offset | Size | Value | Description |
|---|---|---|---|
| 0 | 4 | Log record data size. Log record size = Log record data size + 12 | |
| 4 | 8 | Unknown timestamp. Creation time? | |
| 12 | ... | Log record data |
Log record data
The record data contains some types, followed by the data. Currently it is assumed that the record data format is (partially) dependent on the subsystem, e.g. on-access scan (oas), that generated the log record data.
Date and time values
The date and time values are stored in intervals of 10 ns since January 1, 1 00:00:00 local time.
E.g. the timestamp: 0x582db22720fb9bc9
import datetime
print(datetime.datetime(1, 1, 1) + datetime.timedelta(microseconds=0x582db22720fb9bc9 / 100))
2014-06-25 15:01:44.164668