SHD文件结构（print spooler）

#define SHD_SIGNATURE_WIN98    $0000494B //Windows 98

#define SHD_SIGNATURE_WINNT    $00004966 //Windows NT

#define SHD_SIGNATURE_WIN2000  $00004967 //Win2000/XP 

#define SHD_SIGNATURE_WIN2003  $00004968 //Windows 2003


typedef struct _SHADOW_FILE_HEADER_WIN98 {

  DWORD dwSignature;        //SHD_SIGNATURE_WIN98

  WORD wStatus;

  WORD wUnknown1;

  DWORD dwJobID;

  DWORD dwPriority;

  DWORD offUserName;        //Offset of WideChar+0

  DWORD offNotifyName;      //Offset of WideChar+0

  DWORD offDocumentName;    //Offset of WideChar+0

  DWORD offPort;            //Offset of WideChar+0

  DWORD offPrinterName;     //Offset of WideChar+0

  DWORD offDriverName;      //Offset of WideChar+0

  DWORD offDevMode;         //Offset of DEVMODE

        //Note that the dmCopies in this structure will hold

        //the wrong value when the Microsoft Word multiple 

        //copies bug occurs.

        //In this case use the dmCopies from the SPL file

  DWORD offPrintProcessor;  //Offset of WideChar+0

  DWORD offDataFormat;      //Offset of WideChar+0

  DWORD dwUnknown2;

  SYSTEMTIME stSubmitTime;

  DWORD dwStartTime;

  DWORD dwUntilTime;

  DWORD dwSizeSPL;          //Size of SPL File

  DWORD dwPageCount;

  DWORD dwSizeSecurityInfo; //Size of SecurityInfo

  DWORD offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR

  DWORD dwUnknown3;

} SHADOW_FILE_HEADER_WIN98, *PSHADOW_FILE_HEADER_WIN98;


typedef struct _SHADOW_FILE_HEADER_WINNT {

  DWORD dwSignature;        //SHD_SIGNATURE_WINNT

  WORD wStatus;

  WORD wUnknown1;

  DWORD dwJobID;

  DWORD dwPriority;

  DWORD offUserName;        //Offset of WideChar+0

  DWORD offNotifyName;      //Offset of WideChar+0

  DWORD offDocumentName;    //Offset of WideChar+0

  DWORD offPort;            //Offset of WideChar+0

  DWORD offPrinterName;     //Offset of WideChar+0

  DWORD offDriverName;      //Offset of WideChar+0

  DWORD offDevMode;         //Offset of DEVMODE

        //Note that the dmCopies in this structure will hold

        //the wrong value when the Microsoft Word multiple 

        //copies bug occurs.

        //In this case use the dmCopies from the SPL file

  DWORD offPrintProcessor;  //Offset of WideChar+0

  DWORD offDataFormat;      //Offset of WideChar+0

  DWORD dwUnknown2;

  SYSTEMTIME stSubmitTime;

  DWORD dwStartTime;

  DWORD dwUntilTime;

  DWORD dwSizeSPL;          //Size of SPL File

  DWORD dwPageCount;

  DWORD dwSizeSecurityInfo; //Size of SecurityInfo

  DWORD offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR

  DWORD dwUnknown3;

  DWORD dwUnknown4;

  DWORD dwUnknown5;

} SHADOW_FILE_HEADER_WINNT, *PSHADOW_FILE_HEADER_WINNT;


typedef struct _SHADOW_FILE_HEADER_WIN2000 {

  DWORD dwSignature;        //SHD_SIGNATURE_WIN2000

  DWORD dwHeaderSize;

  WORD wStatus;

  WORD wUnknown1;

  DWORD dwJobID;

  DWORD dwPriority;

  DWORD offUserName;        //Offset of WideChar+0

  DWORD offNotifyName;      //Offset of WideChar+0

  DWORD offDocumentName;    //Offset of WideChar+0

  DWORD offPort;            //Offset of WideChar+0

  DWORD offPrinterName;     //Offset of WideChar+0

  DWORD offDriverName;      //Offset of WideChar+0

  DWORD offDevMode;         //Offset of DEVMODE

        //Note that the dmCopies in this structure will hold

        //the wrong value when the Microsoft Word multiple 

        //copies bug occurs.

        //In this case use the dmCopies from the SPL file

  DWORD offPrintProcessor;  //Offset of WideChar+0

  DWORD offDataFormat;      //Offset of WideChar+0

  DWORD dwUnknown2;

  SYSTEMTIME stSubmitTime;

  DWORD dwStartTime;

  DWORD dwUntilTime;

  DWORD dwSizeSPL;          //Size of SPL File

  DWORD dwPageCount;

  DWORD dwSizeSecurityInfo; //Size of SecurityInfo

  DWORD offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR

  DWORD dwUnknown3;

  DWORD dwUnknown4;

  DWORD dwUnknown5;

  DWORD offComputername;    //Offset of WideChar+0

  DWORD dwSPLSize2;

} SHADOW_FILE_HEADER_WIN2000, *PSHADOW_FILE_HEADER_WIN2000;


/* _SHADOW_FILE_HEADER_WIN2003 looks similar to _SHADOW_FILE_HEADER_WIN2000 */

typedef _SHADOW_FILE_HEADER_WIN2000 _SHADOW_FILE_HEADER_WIN2003;

typedef _SHADOW_FILE_HEADER_WIN2003 SHADOW_FILE_HEADER_WIN2003, *PSHADOW_FILE_HEADER_WIN2003;