Skip to content

ccSubSDK

Brian Maloney edited this page Mar 25, 2021 · 1 revision

ccSubSDK

Symantec Endpoint Protection clients automatically submit pseudonymous information about detections, network, and configuration to Symantec Security Response. Symantec uses this pseudonymous information to address new and changing threats as well as to improve product performance. Pseudonymous data is not directly identified with a particular user. The detection information that clients send includes information about antivirus detections, intrusion prevention, SONAR, and file reputation detections.

submissions.idx

submissions.idx can be found in the following location: C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\ccSubSDK\submissions.idx

Header

Offset Length Field Description
0 4 Header Always 0x3216144C
4 4 Unknown Will require further investigation as to the purpose of this entry.
8 4 Size Size of submissions.idx
12 4 Unknown Will require further investigation as to the purpose of this entry.
16 4 Unknown Will require further investigation as to the purpose of this entry.
20 8 Unknown Will require further investigation as to the purpose of this entry.
28 20 Unknown Will require further investigation as to the purpose of this entry.

Index

Continues to end of file.

Offset Length Field Description
0 4 Header Always 0x4099C689
4 4 Unknown Will require further investigation as to the purpose of this entry.
8 8 Start of Index Offset to begining of Index
16 8 Start of Last Index Offset to begining of previous Index
24 4 Lenght 1 Total size of Data including Blowfish Key
28 4 Lenght 2 Actual size of Data including Blowfish Key
*If length is 0, record is deleted.
32 8 Unknown Will require further investigation as to the purpose of this entry.
40 16 Blowfish Key Symmetric-key for Blowfish
56 Length 1 - 16 Data Data appears to be in ASN.1 format. It is comprised of a series of tags.
Code Value Length Extra Data
0x01 1 None
0x0A 1 None
0x03 4 None
0x06 4 None
0x04 8 None
0x07 4 NUL-terminated ASCII String (of length controlled by dword following 0x07 code)
0x08 4 NUL-terminated Unicode String (of length controlled by dword following 0x08 code)
0x09 4 Container (of length controlled by dword following 0x09 code)
0x0F 16 None
0x10 16 None

{GUID} Files

{GUID} files can be found in the following location: C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\ccSubSDK\{GUID}

Offset Length Field Description
0 16 GUID GUID of dll responsible for submission.
16 16 Blowfish Key Symmetric-key for Blowfish
32 varies Data Data appears to be in ASN.1 format. It is comprised of a series of tags.
Code Value Length Extra Data
0x01 1 None
0x0A 1 None
0x03 4 None
0x06 4 None
0x04 8 None
0x07 4 NUL-terminated ASCII String (of length controlled by dword following 0x07 code)
0x08 4 NUL-terminated Unicode String (of length controlled by dword following 0x08 code)
0x09 4 Container (of length controlled by dword following 0x09 code)
0x0F 16 None
0x10 16 None