The file is dissected here: http://blog.erratasec.com/2014/07/reading-xkeyscore-rules-so...