xnu-4903.241.1/bsd/security/audit/audit_bsm_token.c
/*
 * token ID                1 byte
 * seconds of time         4 bytes
 * milliseconds of time    4 bytes
 * file name len           2 bytes
 * file pathname           N bytes + 1 terminating NULL byte
 */
token ID                1 byte
seconds of time         4 bytes
milliseconds of time    4 bytes
file name len           2 bytes
file pathname           N bytes + 1 terminating NULL byte
token ID 1 byte seconds of time 4 bytes milliseconds of time 4 bytes file name len 2 bytes file pathname N bytes + 1 terminating NULL byte
token_t *
au_to_file(const char *file, struct timeval tm)
{
	token_t *t;
	u_char *dptr = NULL;
	u_int16_t filelen;
	u_int32_t timems;
	filelen = strlen(file);
	filelen += 1;
	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
	    sizeof(u_int16_t) + filelen);
	timems = tm.tv_usec/1000;
	ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
	ADD_U_INT32(dptr, tm.tv_sec);
	ADD_U_INT32(dptr, timems);	
	ADD_U_INT16(dptr, filelen);
	ADD_STRING(dptr, file, filelen);
	return (t);
}
token_t * au_to_file ( const char * file , struct timeval tm ) { token_t * t ; u_char * dptr = NULL ; u_int16_t filelen ; u_int32_t timems ; filelen = strlen ( file ) ; filelen += 1 ; GET_TOKEN_AREA ( t , dptr , sizeof ( u_char ) + 2 * sizeof ( u_int32_t ) + sizeof ( u_int16_t ) + filelen ) ; timems = tm . tv_usec / 1000 ; ADD_U_CHAR ( dptr , AUT_OTHER_FILE32 ) ; ADD_U_INT32 ( dptr , tm . tv_sec ) ; ADD_U_INT32 ( dptr , timems ) ; ADD_U_INT16 ( dptr , filelen ) ; ADD_STRING ( dptr , file , filelen ) ; return ( t ) ; }
token ID                1 byte
 seconds of time         4 bytes
 milliseconds of time    4 bytes
 file name len           2 bytes
 file pathname           N bytes + 1 terminating NULL byte
token ID 1 byte seconds of time 4 bytes milliseconds of time 4 bytes file name len 2 bytes file pathname N bytes + 1 terminating NULL byte
/* We need time in ms. */