Mercurial > libpst

comparison xml/libpst.in @ 28:51d826f31329

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
more cleanup from Arne, document 7c block format
author carl
date Sat, 25 Feb 2006 16:03:45 -0800
parents 73e8959cd86b
children b88ceb81dba2
comparison
equal deleted inserted replaced
27:99e6b70cdfb3 28:51d826f31329
45 </cmdsynopsis> 45 </cmdsynopsis>
46 </refsynopsisdiv> 46 </refsynopsisdiv>
47 47
48 <refsect1 id='readpst.description.1'> 48 <refsect1 id='readpst.description.1'>
49 <title>Description</title> 49 <title>Description</title>
50 <para><command>readpst</command> is a program that can read an Outlook PST (Personal Folders) file 50 <para><command>readpst</command> is a program that can read an Outlook
51 and convert it into an mbox file, a format suitable for KMail, a recursive mbox 51 PST (Personal Folders) file and convert it into an mbox file, a format
52 structure, or separate emails. 52 suitable for KMail, a recursive mbox structure, or separate emails.
53 </para> 53 </para>
54 </refsect1> 54 </refsect1>
55 55
56 <refsect1 id='readpst.options.1'> 56 <refsect1 id='readpst.options.1'>
57 <title>Options</title> 57 <title>Options</title>
63 </para></listitem> 63 </para></listitem>
64 </varlistentry> 64 </varlistentry>
65 <varlistentry> 65 <varlistentry>
66 <term>-d <replaceable class="parameter">debug-file</replaceable></term> 66 <term>-d <replaceable class="parameter">debug-file</replaceable></term>
67 <listitem><para> 67 <listitem><para>
68 Specify name of debug log file. Defaults to "readpst.log". The log 68 Specify name of debug log file. Defaults to "readpst.log". The
69 file is not an ascii file, it is a binary file readable by <command>readpstlog</command>. 69 log file is not an ascii file, it is a binary file readable
70 by <command>readpstlog</command>.
70 </para></listitem> 71 </para></listitem>
71 </varlistentry> 72 </varlistentry>
72 <varlistentry> 73 <varlistentry>
73 <term>-h</term> 74 <term>-h</term>
74 <listitem><para> 75 <listitem><para>
108 <varlistentry> 109 <varlistentry>
109 <term>-S</term> 110 <term>-S</term>
110 <listitem><para> 111 <listitem><para>
111 Output messages into separate files. This will create folders as named 112 Output messages into separate files. This will create folders as named
112 in the PST file, and will put each email in its own file. These files 113 in the PST file, and will put each email in its own file. These files
113 will be numbered from 000000000 increasing in intervals of 1 (ie 114 will be numbered from 1 increasing in intervals of 1 (ie 1, 2, 3, ...).
114 000000000, 000000001, 0000000002). Any attachments are saved alongside 115 Any attachments are saved alongside each email as XXXXXXXXX-attach1,
115 each email as 000000000-attach0, or with the name of the attachment if 116 XXXXXXXXX-attach2 and so on, or with the name of the attachment if one
116 one is present. 117 is present.
117 </para></listitem> 118 </para></listitem>
118 </varlistentry> 119 </varlistentry>
119 <varlistentry> 120 <varlistentry>
120 <term>-M</term> 121 <term>-M</term>
121 <listitem><para> 122 <listitem><para>
122 Output messages in MH format as separate files. This will create 123 Output messages in MH format as separate files. This will create
123 folders as named in the PST file, and will put each email in its own 124 folders as named in the PST file, and will put each email together with
124 file. These files will be numbered from 1 to n with no leading zeros. 125 any attachments into its own file. These files will be numbered from 1
125 Any attachments are saved alongside each email as 000000000-attach0, or 126 to n with no leading zeros.
126 with the name of the attachment if one is present.
127 </para></listitem> 127 </para></listitem>
128 </varlistentry> 128 </varlistentry>
129 <varlistentry> 129 <varlistentry>
130 <term>-V</term> 130 <term>-V</term>
131 <listitem><para> 131 <listitem><para>
163 163
164 <refsect1 id='readpst.copyright.1'> 164 <refsect1 id='readpst.copyright.1'>
165 <title>Copyright</title> 165 <title>Copyright</title>
166 <para> 166 <para>
167 Copyright (C) 2002 by David Smith &lt;dave.s@earthcorp.com&gt;. 167 Copyright (C) 2002 by David Smith &lt;dave.s@earthcorp.com&gt;.
168 XML version Copyright (C) 2005 by 510 Software Group &lt;carl@five-ten-sg.com&gt;. 168 XML version Copyright (C) 2006 by 510 Software Group &lt;carl@five-ten-sg.com&gt;.
169 </para> 169 </para>
170 <para> 170 <para>
171 This program is free software; you can redistribute it and/or modify it 171 This program is free software; you can redistribute it and/or modify it
172 under the terms of the GNU General Public License as published by the 172 under the terms of the GNU General Public License as published by the
173 Free Software Foundation; either version 2, or (at your option) any 173 Free Software Foundation; either version 2, or (at your option) any
540 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 540 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
541 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 541 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
542 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 542 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
543 543
544 0000 signature [4 bytes] 0x4e444221 constant 544 0000 signature [4 bytes] 0x4e444221 constant
545 000a index type [1 byte] 0x0e constant 545 000a indexType [1 byte] 0x0e constant
546 01cd encryption type [1 byte] 0x01 constant 546 01cd encryptionType [1 byte] 0x01 constant
547 00a8 total file size [4 bytes] 0x270400 in this case 547 00a8 total file size [4 bytes] 0x270400 in this case
548 00c0 back-pointer-1 [4 bytes] 0x021eb4 in this case 548 00c0 backPointer1 [4 bytes] 0x021eb4 in this case
549 00c4 offset-index-1 [4 bytes] 0x005400 in this case 549 00c4 offsetIndex1 [4 bytes] 0x005400 in this case
550 00b8 back-pointer-2 [4 bytes] 0x021ebc in this case 550 00b8 backPointer2 [4 bytes] 0x021ebc in this case
551 00bc offset-index-2 [4 bytes] 0x0c7e00 in this case 551 00bc offsetIndex2 [4 bytes] 0x0c7e00 in this case
552 ]]></literallayout> 552 ]]></literallayout>
553 <para> 553 <para>
554 We only support index type 0x0E and encryption type 0x01. 554 We only support index type 0x0E and encryption type 0x01.
555 </para> 555 </para>
556 <para> 556 <para>
557 offset-index-1 is the file offset of the root of the 557 offsetIndex1 is the file offset of the root of the
558 index1 b-tree, which contains (ID1, offset, size, unknown) tuples 558 index1 b-tree, which contains (ID1, offset, size, unknown) tuples
559 for each item in the file. back-pointer-1 is the value that should 559 for each item in the file. backPointer1 is the value that should
560 appear in the parent pointer of that root node. 560 appear in the parent pointer of that root node.
561 </para> 561 </para>
562 <para> 562 <para>
563 offset-index-2 is the file offset of the root of the 563 offsetIndex2 is the file offset of the root of the
564 index2 b-tree, which contains (ID2, DESC-ID1, LIST-ID1, PARENT-ID2) 564 index2 b-tree, which contains (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
565 tuples for each item in the file. back-pointer-2 is the value that should 565 tuples for each item in the file. backPointer2 is the value that should
566 appear in the parent pointer of that root node. 566 appear in the parent pointer of that root node.
567 </para> 567 </para>
568 </refsect1> 568 </refsect1>
569 569
570 <refsect1 id='pst.file.node1.5'> 570 <refsect1 id='pst.file.node1.5'>
615 01d4 00 00 00 00 00 00 00 00 00 00 00 00 615 01d4 00 00 00 00 00 00 00 00 00 00 00 00
616 01e0 00 00 00 00 00 00 00 00 00 00 00 00 616 01e0 00 00 00 00 00 00 00 00 00 00 00 00
617 01ec 00 00 00 00 02 29 0c 02 80 80 b6 4a 617 01ec 00 00 00 00 02 29 0c 02 80 80 b6 4a
618 01f8 b4 1e 02 00 27 9c cc 56 58 27 03 00 618 01f8 b4 1e 02 00 27 9c cc 56 58 27 03 00
619 619
620 01f0 item-count [1 byte] 0x02 in this case 620 01f0 itemCount [1 byte] 0x02 in this case
621 01f1 max-item-count [1 byte] 0x29 constant 621 01f1 maxItemCount [1 byte] 0x29 constant
622 01f3 node-level [1 byte] 0x02 in this case 622 01f3 nodeLevel [1 byte] 0x02 in this case
623 01f8 back-pointer [4 bytes] 0x021eb4 in this case 623 01f8 backPointer [4 bytes] 0x021eb4 in this case
624 ]]></literallayout> 624 ]]></literallayout>
625 <para> 625 <para>
626 The item-count specifies the number of 12 byte records that 626 The itemCount specifies the number of 12 byte records that
627 are active. The node-level is non-zero for this style of nodes. 627 are active. The nodeLevel is non-zero for this style of nodes.
628 The leaf nodes have a different format. The back-pointer must 628 The leaf nodes have a different format. The backPointer must
629 match the back-pointer from the triple that pointed to this node. 629 match the backPointer from the triple that pointed to this node.
630 </para> 630 </para>
631 <para> 631 <para>
632 Each item in this node is a triple of (ID, back-pointer, offset) 632 Each item in this node is a triple of (ID, backPointer, offset)
633 where the offset points to the next deeper node in the tree, the 633 where the offset points to the next deeper node in the tree, the
634 back-pointer value must match the back-pointer in that deeper node, 634 backPointer value must match the backPointer in that deeper node,
635 and ID is the lowest ID value in the subtree. 635 and ID is the lowest ID value in the subtree.
636 </para> 636 </para>
637 </refsect1> 637 </refsect1>
638 638
639 <refsect1 id='pst.file.leaf1.5'> 639 <refsect1 id='pst.file.leaf1.5'>
684 01d4 64 02 00 00 80 fb 00 00 bf 07 02 00 684 01d4 64 02 00 00 80 fb 00 00 bf 07 02 00
685 01e0 64 02 00 00 80 fb 00 00 bf 07 02 00 685 01e0 64 02 00 00 80 fb 00 00 bf 07 02 00
686 01ec 00 00 00 00 1f 29 0c 00 80 80 5b b3 686 01ec 00 00 00 00 1f 29 0c 00 80 80 5b b3
687 01f8 5a 67 01 00 4f ae 70 a7 92 06 00 00 687 01f8 5a 67 01 00 4f ae 70 a7 92 06 00 00
688 688
689 01f0 item-count [1 byte] 0x1f in this case 689 01f0 itemCount [1 byte] 0x1f in this case
690 01f1 max-item-count [1 byte] 0x29 constant 690 01f1 maxItemCount [1 byte] 0x29 constant
691 01f3 node-level [1 byte] 0x00 in this case 691 01f3 nodeLevel [1 byte] 0x00 in this case
692 01f8 back-pointer [4 bytes] 0x01675a in this case 692 01f8 backPointer [4 bytes] 0x01675a in this case
693 ]]></literallayout> 693 ]]></literallayout>
694 <para> 694 <para>
695 The item-count specifies the number of 12 byte records that 695 The itemCount specifies the number of 12 byte records that
696 are active. The node-level is zero for these leaf nodes. 696 are active. The nodeLevel is zero for these leaf nodes.
697 The back-pointer must match the back-pointer from the triple 697 The backPointer must match the backPointer from the triple
698 that pointed to this node. 698 that pointed to this node.
699 </para> 699 </para>
700 <para> 700 <para>
701 Each item in this node is a tuple of (ID1, offset, size, unknown) 701 Each item in this node is a tuple of (ID1, offset, size, unknown)
702 </para> 702 </para>
750 01d4 00 00 00 00 00 00 00 00 00 00 00 00 750 01d4 00 00 00 00 00 00 00 00 00 00 00 00
751 01e0 00 00 00 00 00 00 00 00 00 00 00 00 751 01e0 00 00 00 00 00 00 00 00 00 00 00 00
752 01ec 00 00 00 00 02 29 0c 02 81 81 b2 60 752 01ec 00 00 00 00 02 29 0c 02 81 81 b2 60
753 01f8 bc 1e 02 00 7e 70 dc e3 21 00 00 00 753 01f8 bc 1e 02 00 7e 70 dc e3 21 00 00 00
754 754
755 01f0 item-count [1 byte] 0x02 in this case 755 01f0 itemCount [1 byte] 0x02 in this case
756 01f1 max-item-count [1 byte] 0x29 constant 756 01f1 maxItemCount [1 byte] 0x29 constant
757 01f3 node-level [1 byte] 0x02 in this case 757 01f3 nodeLevel [1 byte] 0x02 in this case
758 01f8 back-pointer [4 bytes] 0x021ebc in this case 758 01f8 backPointer [4 bytes] 0x021ebc in this case
759 ]]></literallayout> 759 ]]></literallayout>
760 <para> 760 <para>
761 The item-count specifies the number of 12 byte records that 761 The itemCount specifies the number of 12 byte records that
762 are active. The node-level is non-zero for this style of nodes. 762 are active. The nodeLevel is non-zero for this style of nodes.
763 The leaf nodes have a different format. The back-pointer must 763 The leaf nodes have a different format. The backPointer must
764 match the back-pointer from the triple that pointed to this node. 764 match the backPointer from the triple that pointed to this node.
765 </para> 765 </para>
766 <para> 766 <para>
767 Each item in this node is a triple of (ID2, back-pointer, offset) 767 Each item in this node is a triple of (ID2, backPointer, offset)
768 where the offset points to the next deeper node in the tree, the 768 where the offset points to the next deeper node in the tree, the
769 back-pointer value must match the back-pointer in that deeper node, 769 backPointer value must match the backPointer in that deeper node,
770 and ID2 is the lowest ID2 value in the subtree. 770 and ID2 is the lowest ID2 value in the subtree.
771 </para> 771 </para>
772 </refsect1> 772 </refsect1>
773 773
774 <refsect1 id='pst.file.leaf2.5'> 774 <refsect1 id='pst.file.leaf2.5'>
809 01D0 6d 80 00 00 34 78 02 00 00 00 00 00 00 00 00 00 809 01D0 6d 80 00 00 34 78 02 00 00 00 00 00 00 00 00 00
810 01E0 6e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00 810 01E0 6e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
811 01F0 10 1f 10 00 81 81 a0 9a ae 1e 02 00 89 44 6a 0f 811 01F0 10 1f 10 00 81 81 a0 9a ae 1e 02 00 89 44 6a 0f
812 0200 b8 b1 03 00 812 0200 b8 b1 03 00
813 813
814 01f0 item-count [1 byte] 0x10 in this case 814 01f0 itemCount [1 byte] 0x10 in this case
815 01f1 max-item-count [1 byte] 0x1f constant 815 01f1 maxItemCount [1 byte] 0x1f constant
816 01f3 node-level [1 byte] 0x00 in this case 816 01f3 nodeLevel [1 byte] 0x00 in this case
817 01f8 back-pointer [4 bytes] 0x021eae in this case 817 01f8 backPointer [4 bytes] 0x021eae in this case
818 ]]></literallayout> 818 ]]></literallayout>
819 <para> 819 <para>
820 The item-count specifies the number of 16 byte records that 820 The itemCount specifies the number of 16 byte records that
821 are active. The node-level is zero for these leaf nodes. 821 are active. The nodeLevel is zero for these leaf nodes.
822 The back-pointer must match the back-pointer from the triple 822 The backPointer must match the backPointer from the triple
823 that pointed to this node. 823 that pointed to this node.
824 </para> 824 </para>
825 <para> 825 <para>
826 Each item in this node is a tuple of (ID2, DESC-ID1, LIST-ID1, PARENT-ID2) 826 Each item in this node is a tuple of (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
827 </para> 827 </para>
846 000c unknown [4 bytes] 0 in this case 846 000c unknown [4 bytes] 0 in this case
847 ]]></literallayout> 847 ]]></literallayout>
848 </refsect1> 848 </refsect1>
849 849
850 <refsect1 id='pst.file.desc.5'> 850 <refsect1 id='pst.file.desc.5'>
851 <title>Associated Descriptor Item</title> 851 <title>Associated Descriptor Item 0xbcec</title>
852 <para> 852 <para>
853 Contains information about the item, which may be email, contact, or other outlook types. 853 Contains information about the item, which may be email, contact, or
854 In the above leaf node, we have a tuple of (0x21, 0x00e638, 0, 0) 854 other outlook types. In the above leaf node, we have a tuple of (0x21,
855 0x00e638 is the ID1 of the associated descriptor, and we can lookup that ID1 value 855 0x00e638, 0, 0) 0x00e638 is the ID1 of the associated descriptor, and we
856 in the index1 b-tree to find the (offset,size) of the data in the .pst file. 856 can lookup that ID1 value in the index1 b-tree to find the (offset,size)
857 of the data in the .pst file.
857 </para> 858 </para>
858 <literallayout class="monospaced"><![CDATA[ 859 <literallayout class="monospaced"><![CDATA[
859 0000 3c 01 ec bc 20 00 00 00 00 00 00 00 b5 02 06 00 860 0000 3c 01 ec bc 20 00 00 00 00 00 00 00 b5 02 06 00
860 0010 40 00 00 00 f9 0f 02 01 60 00 00 00 01 30 1e 00 861 0010 40 00 00 00 f9 0f 02 01 60 00 00 00 01 30 1e 00
861 0020 80 00 00 00 04 30 1e 00 00 00 00 00 df 35 03 00 862 0020 80 00 00 00 04 30 1e 00 00 00 00 00 df 35 03 00
877 0120 81 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83 878 0120 81 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
878 0130 24 00 50 04 86 95 45 62 80 00 00 00 0b 00 00 00 879 0130 24 00 50 04 86 95 45 62 80 00 00 00 0b 00 00 00
879 0140 0c 00 14 00 7c 00 8c 00 93 00 ab 00 c3 00 db 00 880 0140 0c 00 14 00 7c 00 8c 00 93 00 ab 00 c3 00 db 00
880 0150 f3 00 0b 01 23 01 3b 01 881 0150 f3 00 0b 01 23 01 3b 01
881 882
882 0000 index-offset [2 bytes] 0x013c in this case 883 0000 indexOffset [2 bytes] 0x013c in this case
883 0002 signature [2 bytes] 0xbcec constant 884 0002 signature [2 bytes] 0xbcec constant
884 0004 offset [2 bytes] 0x0020 in this case 885 0004 offset [2 bytes] 0x0020 in this case
885 ]]></literallayout> 886 ]]></literallayout>
886 <para> 887 <para>
887 Note the index-offset of 0x013c - starting at that position in the 888 Note the signature of 0xbcec. There are other descriptor block
889 formats with other signatures.
890 Note the indexOffset of 0x013c - starting at that position in the
888 descriptor block, we have an array of two byte integers. The first 891 descriptor block, we have an array of two byte integers. The first
889 integer (0x000b) is a count of the number of overlapping pairs 892 integer (0x000b) is a (count-1) of the number of overlapping pairs
890 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14) 893 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
891 and the last (11th) pair is (0x10b, 0x123). These pairs are (start,end+1) 894 and the last (12th) pair is (0x123, 0x13b). These pairs are (start,end+1)
892 offsets of items in this block. So we have count+1 integers following 895 offsets of items in this block. So we have count+2 integers following
893 the count value. 896 the count value.
894 </para> 897 </para>
895 <para> 898 <para>
896 Note the offset of 0x0020, which needs to be right shifted by 4 bits 899 Note the offset of 0x0020, which needs to be right shifted by 4 bits
897 to become 0x0002, which is then a byte offset to be added to the above 900 to become 0x0002, which is then a byte offset to be added to the above
898 index-offset plus two (to skip the count), so it points to the (0xc, 0x14) 901 indexOffset plus two (to skip the count), so it points to the (0xc, 0x14)
899 pair. Finally, we have the offset and size of the "b5" block located at offset 0xc 902 pair. Finally, we have the offset and size of the "b5" block located at offset 0xc
900 with a size of 8 bytes in this descriptor block. The "b5" block has the 903 with a size of 8 bytes in this descriptor block. The "b5" block has the
901 following format: 904 following format:
902 </para> 905 </para>
903 <literallayout class="monospaced"><![CDATA[ 906 <literallayout class="monospaced"><![CDATA[
906 0004 offset [4 bytes] 0x0040 in this case 909 0004 offset [4 bytes] 0x0040 in this case
907 ]]></literallayout> 910 ]]></literallayout>
908 <para> 911 <para>
909 Note the "b5" offset of 0x0040, which needs to be right shifted by 4 bits 912 Note the "b5" offset of 0x0040, which needs to be right shifted by 4 bits
910 to become 0x0004, which is then a byte offset to be added to the above 913 to become 0x0004, which is then a byte offset to be added to the above
911 index-offset plus two (to skip the count), so it points to the (0x14, 0x7c) 914 indexOffset plus two (to skip the count), so it points to the (0x14, 0x7c)
912 pair. We now have the offset 0x14 of the descriptor array, composed of 8 byte 915 pair. We now have the offset 0x14 of the descriptor array, composed of 8 byte
913 entries. Each descriptor entry has the following format: 916 entries. Each descriptor entry has the following format:
914 </para> 917 </para>
915 <literallayout class="monospaced"><![CDATA[ 918 <literallayout class="monospaced"><![CDATA[
916 0000 item-type [2 bytes] 919 0000 itemType [2 bytes]
917 0002 reference-type [2 bytes] 920 0002 referenceType [2 bytes]
918 0004 value [4 bytes] 921 0004 value [4 bytes]
919 ]]></literallayout> 922 ]]></literallayout>
920 <para> 923 <para>
921 For some reference types (2, 3, 0xb) the value is used directly. Otherwise, 924 For some reference types (2, 3, 0xb) the value is used directly. Otherwise,
922 the value is generally a non-zero offset, to be right shifted by 4 bits and used to fetch 925 the value is generally a non-zero offset, to be right shifted by 4 bits and used to fetch
1165 8708 End Timestamp 1168 8708 End Timestamp
1166 8712 Journal Entry Type 1169 8712 Journal Entry Type
1167 ]]></literallayout> 1170 ]]></literallayout>
1168 </refsect1> 1171 </refsect1>
1169 1172
1173 <refsect1 id='pst.file.desc2.5'>
1174 <title>Associated Descriptor Item 0x7cec</title>
1175 <para>
1176 This style of descriptor block is similar to the BCEC format.
1177 </para>
1178 <literallayout class="monospaced"><![CDATA[
1179 0000 7a 01 ec 7c 40 00 00 00 00 00 00 00 b5 04 02 00
1180 0010 60 00 00 00 7c 18 60 00 60 00 62 00 65 00 20 00
1181 0020 00 00 80 00 00 00 00 00 00 00 03 00 20 0e 0c 00
1182 0030 04 03 1e 00 01 30 2c 00 04 0b 1e 00 03 37 28 00
1183 0040 04 0a 1e 00 04 37 14 00 04 05 03 00 05 37 10 00
1184 0050 04 04 1e 00 07 37 24 00 04 09 1e 00 08 37 20 00
1185 0060 04 08 02 01 0a 37 18 00 04 06 03 00 0b 37 08 00
1186 0070 04 02 1e 00 0d 37 1c 00 04 07 1e 00 0e 37 40 00
1187 0080 04 10 02 01 0f 37 30 00 04 0c 1e 00 11 37 34 00
1188 0090 04 0d 1e 00 12 37 3c 00 04 0f 1e 00 13 37 38 00
1189 00A0 04 0e 03 00 f2 67 00 00 04 00 03 00 f3 67 04 00
1190 00B0 04 01 03 00 09 69 44 00 04 11 03 00 fa 7f 5c 00
1191 00C0 04 15 40 00 fb 7f 4c 00 08 13 40 00 fc 7f 54 00
1192 00D0 08 14 03 00 fd 7f 48 00 04 12 0b 00 fe 7f 60 00
1193 00E0 01 16 0b 00 ff 7f 61 00 01 17 45 82 00 00 00 00
1194 00F0 45 82 00 00 78 3c 00 00 ff ff ff ff 49 1e 00 00
1195 0100 06 00 00 00 00 00 00 00 a0 00 00 00 00 00 00 00
1196 0110 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00
1197 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1198 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 40 dd a3
1199 0140 57 45 b3 0c 00 40 dd a3 57 45 b3 0c 02 00 00 00
1200 0150 00 00 fa 10 3e 2a 86 48 86 f7 14 03 0a 03 02 01
1201 0160 4a 2e 20 44 61 76 69 64 20 4b 61 72 61 6d 27 73
1202 0170 20 42 69 72 74 68 64 61 79 00 06 00 00 00 0c 00
1203 0180 14 00 ea 00 f0 00 55 01 60 01 79 01
1204
1205 0000 indexOffset [2 bytes] 0x017a in this case
1206 0002 signature [2 bytes] 0x7cec constant
1207 0004 offset [2 bytes] 0x0040 in this case
1208 ]]></literallayout>
1209 <para>
1210 Note the signature of 0x7cec. There are other descriptor block
1211 formats with other signatures.
1212 Note the indexOffset of 0x017a - starting at that position in the
1213 descriptor block, we have an array of two byte integers. The first
1214 integer (0x0006) is a (count-1) of the number of overlapping pairs
1215 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
1216 and the last (7th) pair is (0x160, 0x179). These pairs are (start,end+1)
1217 offsets of items in this block. So we have count+2 integers following
1218 the count value.
1219 </para>
1220 <para>
1221 Note the offset of 0x0040, which needs to be right shifted by 4 bits
1222 to become 0x0004, which is then a byte offset to be added to the above
1223 indexOffset plus two (to skip the count), so it points to the (0x14, 0xea)
1224 pair. We have the offset and size of the "7c" block located at offset 0x14
1225 with a size of 214 bytes in this case. The "7c" block starts with
1226 a header with the following format:
1227 </para>
1228 <literallayout class="monospaced"><![CDATA[
1229 0000 signature [1 bytes] 0x7c constant
1230 0001 itemCount [1 bytes] 0x18 in this case
1231 0002 unknown [2 bytes] 0x0060 in this case
1232 0004 unknown [2 bytes] 0x0060 in this case
1233 0006 unknown [2 bytes] 0x0062 in this case
1234 0008 recordSize [2 bytes] 0x0065 in this case
1235 000a b5Offset [2 bytes] 0x0020 in this case
1236 000c unknown [2 bytes] 0x0000 in this case
1237 000e index2Offset [2 bytes] 0x0080 in this case
1238 0010 unknown [2 bytes] 0x0000 in this case
1239 0012 unknown [2 bytes] 0x0000 in this case
1240 0014 unknown [2 bytes] 0x0000 in this case
1241 ]]></literallayout>
1242 <para>
1243 Note the b5Offset of 0x0020, which needs to be right shifted by 4 bits
1244 to become 0x0002, which is then a byte offset to be added to the above
1245 indexOffset plus two (to skip the count), so it points to the (0xc,
1246 0x14) pair. Finally, we have the offset and size of the "b5" block
1247 located at offset 0xc with a size of 8 bytes in this descriptor block.
1248 The "b5" block has the following format:
1249 </para>
1250 <literallayout class="monospaced"><![CDATA[
1251 0000 signature [2 bytes] 0x04b5 constant
1252 0002 unknown [2 bytes] 0x0002 in this case
1253 0004 offset [4 bytes] 0x0060 in this case
1254 ]]></literallayout>
1255 <para>
1256 Note the "b5" offset of 0x0060, which needs to be right shifted by 4
1257 bits to become 0x0006, which is then a byte offset to be added to the
1258 above indexOffset plus two (to skip the count), so it points to the
1259 (0xea, 0xf0) pair. That gives us (0xf0 - 0xea)/6 = 1, so we have a
1260 recordCount of one. The actual data between 0xea and 0xf0 is unknown
1261 and unused here.
1262 </para>
1263 <para>
1264 Note the index2Offset above of 0x0080, which needs to be right shifted
1265 by 4 bits to become 0x0008, which is then a byte offset to be added to
1266 the above indexOffset plus two (to skip the count), so it points to the
1267 (0xf0, 0x155) pair. This is an array of tables of four byte integers.
1268 We will call these the IND2 tables. The size of each of these tables is
1269 specified by the recordSize field of the "7c" header. The number of
1270 these tables is the above recordCount value derived from the "b5" block.
1271 </para>
1272 <para>
1273 Now the remaining data in the "7c" block after the header starts at
1274 offset 0x2a. There should be itemCount 8 byte items here, with the
1275 following format:
1276 </para>
1277 <literallayout class="monospaced"><![CDATA[
1278 0000 referenceType [2 bytes]
1279 0002 itemType [2 bytes]
1280 0004 ind2Offset [2 bytes]
1281 0006 unknown [2 bytes]
1282 ]]></literallayout>
1283 <para>
1284 The ind2Offset is a byte offset into the current IND2 table of a four
1285 byte integer value. Once we fetch that, we have the same triple (item
1286 type, reference type, value) as we find in the 0xbcec style descriptor
1287 blocks. These 8 byte descriptors are processed recordCount times, each
1288 time using the next IND2 table. The item and reference types are as
1289 described above for the 0xbcec format descriptor block.
1290 </para>
1291 </refsect1>
1292
1170 </refentry> 1293 </refentry>
1171 </reference> 1294 </reference>