cybersecurity · intermediate · ~15 min · safe pentest lab

MFT first-attribute offset

Read a little-endian 16-bit field at an offset.

Challenge

Read the offset to an MFT record's first attribute — following it takes you to the record's attribute list.

Task

Implement int mft_attr_offset(const unsigned char *b) that returns the little-endian 16-bit value at byte 20, i.e. b[20] | (b[21] << 8).

Input

  • b: a byte buffer of at least 22 bytes holding a (mock) MFT record. The grader passes a fixed buffer.

Output

Returns int: the LE16 first-attribute offset at byte 20.

Example

b[20] = 0x38, b[21] = 0x00
mft_attr_offset(b)   ->   0x38

Edge cases

  • Assemble the two bytes little-endian; b[20] is the low byte.

Input format

A byte buffer b of at least 22 bytes.

Output format

An int: the LE16 value at offset 20.

Constraints

Offset is the LE16 at byte 20 (b[20] | b[21]<<8).

Starter code

int mft_attr_offset(const unsigned char *b) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.