@davehull The structs are so regular, I bet you could build a wtmp detector by looking for the increasing time values...