Mercurial > libpst
view xml/libpst.in @ 41:183ae993b9ad
security fix for potential buffer overrun in lz decompress
| author | carl |
|---|---|
| date | Tue, 02 Oct 2007 15:49:44 -0700 |
| parents | 6fe121a971c9 |
| children | f6db1f060a95 |
line wrap: on
line source
<reference> <title>@PACKAGE@ Utilities - Version @VERSION@</title> <partintro> <title>Packages</title> <para>This is a fork of the libpst project at SourceForge. Another fork is located at <ulink url="http://alioth.debian.org/projects/libpst/">http://alioth.debian.org/projects/libpst/</ulink> </para> <para>The various source and binary packages are available at <ulink url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink> The most recent documentation is available at <ulink url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink> </para> </partintro> <refentry id="readpst.1"> <refentryinfo> <date>2007-07-10</date> </refentryinfo> <refmeta> <refentrytitle>readpst</refentrytitle> <manvolnum>1</manvolnum> <refmiscinfo>readpst @VERSION@</refmiscinfo> </refmeta> <refnamediv id='readpst.name.1'> <refname>readpst</refname> <refpurpose>convert PST (MS Outlook Personal Folders) files to mbox format</refpurpose> </refnamediv> <refsynopsisdiv id='readpst.synopsis.1'> <title>Synopsis</title> <cmdsynopsis> <command>readpst</command> <arg><option>-b</option></arg> <arg><option>-c <replaceable class="parameter">format</replaceable></option></arg> <arg><option>-d <replaceable class="parameter">debug-file</replaceable></option></arg> <arg><option>-h</option></arg> <arg><option>-k</option></arg> <arg><option>-o <replaceable class="parameter">output-directory</replaceable></option></arg> <arg><option>-q</option></arg> <arg><option>-r</option></arg> <arg><option>-S</option></arg> <arg><option>-M</option></arg> <arg><option>-V</option></arg> <arg><option>-w</option></arg> <arg rep='repeat' choice='plain'>files</arg> </cmdsynopsis> </refsynopsisdiv> <refsect1 id='readpst.description.1'> <title>Description</title> <para><command>readpst</command> is a program that can read an Outlook PST (Personal Folders) file and convert it into an mbox file, a format suitable for KMail, a recursive mbox structure, or separate emails. </para> </refsect1> <refsect1 id='readpst.options.1'> <title>Options</title> <variablelist> <varlistentry> <term>-b</term> <listitem><para> Do not save the attachments for the RTF format of the email body. </para></listitem> </varlistentry> <varlistentry> <term>-c <replaceable class="parameter">format</replaceable></term> <listitem><para> Set the Contact output mode. Use -cv for vcard format or -cl for an email list. </para></listitem> </varlistentry> <varlistentry> <term>-d <replaceable class="parameter">debug-file</replaceable></term> <listitem><para> Specify name of debug log file. The log file is not an ascii file, it is a binary file readable by <command>readpstlog</command>. </para></listitem> </varlistentry> <varlistentry> <term>-h</term> <listitem><para> Show summary of options and exit. </para></listitem> </varlistentry> <varlistentry> <term>-k</term> <listitem><para> Changes the output format to KMail. </para></listitem> </varlistentry> <varlistentry> <term>-o <replaceable class="parameter">output-directory</replaceable></term> <listitem><para> Specifies the output directory. The directory must already exist, and is entered after the PST file is opened, but before any processing of files commences. </para></listitem> </varlistentry> <varlistentry> <term>-q</term> <listitem><para> Changes to silent mode. No feedback is printed to the screen, except for error messages. </para></listitem> </varlistentry> <varlistentry> <term>-r</term> <listitem><para> Changes the output format to Recursive. This will create folders as named in the PST file, and will put all emails in a file called "mbox" inside each folder. These files are then compatible with all mbox-compatible email clients. </para></listitem> </varlistentry> <varlistentry> <term>-S</term> <listitem><para> Output messages into separate files. This will create folders as named in the PST file, and will put each email in its own file. These files will be numbered from 1 increasing in intervals of 1 (ie 1, 2, 3, ...). Any attachments are saved alongside each email as XXXXXXXXX-attach1, XXXXXXXXX-attach2 and so on, or with the name of the attachment if one is present. </para></listitem> </varlistentry> <varlistentry> <term>-M</term> <listitem><para> Output messages in MH format as separate files. This will create folders as named in the PST file, and will put each email together with any attachments into its own file. These files will be numbered from 1 to n with no leading zeros. </para></listitem> </varlistentry> <varlistentry> <term>-V</term> <listitem><para> Show program version and exit. </para></listitem> </varlistentry> <varlistentry> <term>-w</term> <listitem><para> Overwrite any previous output files. Beware: When used with the -S switch, this will remove all files from the target folder before writing. This is to keep the count of emails and attachments correct. </para></listitem> </varlistentry> </variablelist> </refsect1> <refsect1 id='readpst.also.1'> <title>See Also</title> <para> <citerefentry><refentrytitle>readpstlog</refentrytitle> <manvolnum>1</manvolnum> </citerefentry> </para> </refsect1> <refsect1 id='readpst.author.1'> <title>Author</title> <para> This manual page was originally written by Dave Smith <dave.s@earthcorp.com>, and updated by Joe Nahmias <joe@nahmias.net> for the Debian GNU/Linux system (but may be used by others). It was subsequently updated by Brad Hards <bradh@frogmouth.net>, and converted to xml format by Carl Byington <carl@five-ten-sg.com>. </para> </refsect1> <refsect1 id='readpst.copyright.1'> <title>Copyright</title> <para> Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>. XML version Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com>. </para> <para> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. </para> <para> You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. </para> </refsect1> <refsect1 id='readpst.version.1'> <title>CVS Version</title> <para> $Id$ </para> </refsect1> </refentry> <refentry id="readpstlog.1"> <refentryinfo> <date>2007-07-10</date> </refentryinfo> <refmeta> <refentrytitle>readpstlog</refentrytitle> <manvolnum>1</manvolnum> <refmiscinfo>readpstlog @VERSION@</refmiscinfo> </refmeta> <refnamediv id='readpstlog.name.1'> <refname>readpstlog</refname> <refpurpose>convert a <command>readpst</command> logfile to text format</refpurpose> </refnamediv> <refsynopsisdiv id='readpstlog.synopsis.1'> <title>Synopsis</title> <cmdsynopsis> <command>readpstlog</command> <arg><option>-f <replaceable class="parameter">format</replaceable></option></arg> <arg><option>-t <replaceable class="parameter">include-types</replaceable></option></arg> <arg><option>-x <replaceable class="parameter">exclude-types</replaceable></option></arg> <arg choice='plain'>logfile</arg> </cmdsynopsis> </refsynopsisdiv> <refsect1 id='readpstlog.description.1'> <title>Description</title> <para><command>readpstlog</command> is a program that converts the binary logfile generated by <command>readpst</command> to a more desirable text format. </para> </refsect1> <refsect1 id='readpstlog.options.1'> <title>Options</title> <variablelist> <varlistentry> <term>-f <replaceable class="parameter">format</replaceable></term> <listitem><para> Sets the format of the text log output. Currently, the only valid output formats are T, for single line text, D for the default default multi line format, and I for an indented style with single line text. </para></listitem> </varlistentry> <varlistentry> <term>-t <replaceable class="parameter">include-types</replaceable></term> <listitem><para> Print only the specified types of log messages. Types are specified in a comma-delimited list (e.g. 3,10,5,6). </para></listitem> </varlistentry> <varlistentry> <term>-x <replaceable class="parameter">exclude-types</replaceable></term> <listitem><para> Exclude the specified types of log messages. Types are specified in a comma-delimited list (e.g. 3,10,5,6). </para></listitem> </varlistentry> </variablelist> </refsect1> <refsect1 id='readpstlog.message.types.1'> <title>Message Types</title> <para><command>readpstlog</command> understands the following types of log messages: </para> <variablelist> <varlistentry> <term>1</term> <listitem><para> File accesses </para></listitem> </varlistentry> <varlistentry> <term>2</term> <listitem><para> Index accesses </para></listitem> </varlistentry> <varlistentry> <term>3</term> <listitem><para> New email found </para></listitem> </varlistentry> <varlistentry> <term>4</term> <listitem><para> Warnings </para></listitem> </varlistentry> <varlistentry> <term>5</term> <listitem><para> Read accesses </para></listitem> </varlistentry> <varlistentry> <term>6</term> <listitem><para> Informational messages </para></listitem> </varlistentry> <varlistentry> <term>7</term> <listitem><para> Main function calls </para></listitem> </varlistentry> <varlistentry> <term>8</term> <listitem><para> Decrypting calls </para></listitem> </varlistentry> <varlistentry> <term>9</term> <listitem><para> Function entries </para></listitem> </varlistentry> <varlistentry> <term>10</term> <listitem><para> Function exits </para></listitem> </varlistentry> <varlistentry> <term>11</term> <listitem><para> HexDump calls </para></listitem> </varlistentry> </variablelist> </refsect1> <refsect1 id='readpstlog.author.1'> <title>Author</title> <para> This manual page was written by Joe Nahmias <joe@nahmias.net> for the Debian GNU/Linux system (but may be used by others). It was converted to xml format by Carl Byington <carl@five-ten-sg.com>. </para> </refsect1> <refsect1 id='readpstlog.copyright.1'> <title>Copyright</title> <para> Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>. XML version Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>. </para> <para> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. </para> <para> You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. </para> </refsect1> <refsect1 id='readpstlog.version.1'> <title>CVS Version</title> <para> $Id$ </para> </refsect1> </refentry> <refentry id="pst2ldif.1"> <refentryinfo> <date>2007-07-10</date> </refentryinfo> <refmeta> <refentrytitle>pst2ldif</refentrytitle> <manvolnum>1</manvolnum> <refmiscinfo>pst2ldif @VERSION@</refmiscinfo> </refmeta> <refnamediv id='pst2ldif.name.1'> <refname>pst2ldif</refname> <refpurpose>extract contacts from a MS Outlook .pst file in .ldif format</refpurpose> </refnamediv> <refsynopsisdiv id='pst2ldif.synopsis.1'> <title>Synopsis</title> <cmdsynopsis> <command>pst2ldif</command> <arg><option>-h</option></arg> <arg><option>-V</option></arg> <arg><option>-b <replaceable class="parameter">ldap-base</replaceable></option></arg> <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> <arg><option>-d <replaceable class="parameter">debug-file</replaceable></option></arg> <arg choice='plain'>pstfilename</arg> </cmdsynopsis> </refsynopsisdiv> <refsect1 id='pst2ldif.options.1'> <title>Options</title> <variablelist> <varlistentry> <term>-h</term> <listitem><para> Show summary of options. Subsequent options are then ignored. </para></listitem> </varlistentry> <varlistentry> <term>-V <replaceable class="parameter">include-types</replaceable></term> <listitem><para> Show program version. Subsequent options are then ignored. </para></listitem> </varlistentry> <varlistentry> <term>-b <replaceable class="parameter">ldap-base</replaceable></term> <listitem><para> Sets the ldap base value used in the dn records. You probably want to use something like "o=organization, c=US". </para></listitem> </varlistentry> <varlistentry> <term>-c <replaceable class="parameter">class</replaceable></term> <listitem><para> Sets the objectClass values for the contact items. This class needs to be defined in the schema used by your LDAP server, and at a minimum it must contain the ldap attributes given below. </para></listitem> </varlistentry> <varlistentry> <term>-d <replaceable class="parameter">debug-file</replaceable></term> <listitem><para> Specify name of debug log file. The log file is not an ascii file, it is a binary file readable by <command>readpstlog</command>. </para></listitem> </varlistentry> </variablelist> </refsect1> <refsect1 id='pst2ldif.description.1'> <title>Description</title> <para><command>pst2ldif</command> reads the contact information from a MS Outlook .pst file and produces a .ldif file that may be used to import those contacts into an LDAP database. The following ldap attributes are generated: <simplelist> <member>cn </member> <member>givenName </member> <member>sn </member> <member>personalTitle </member> <member>company </member> <member>mail </member> <member>postalAddress </member> <member>l </member> <member>st </member> <member>postalCode </member> <member>c </member> <member>homePhone </member> <member>telephoneNumber </member> <member>facsimileTelephoneNumber </member> <member>mobile </member> <member>description </member> </simplelist> </para> </refsect1> <refsect1 id='pst2ldif.copyright.1'> <title>Copyright</title> <para> Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com> </para> <para> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. </para> <para> You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. </para> </refsect1> <refsect1 id='pst2ldif.version.1'> <title>CVS Version</title> <para> $Id$ </para> </refsect1> </refentry> <refentry id="pst.5"> <refentryinfo> <date>2007-07-10</date> </refentryinfo> <refmeta> <refentrytitle>outlook.pst</refentrytitle> <manvolnum>5</manvolnum> </refmeta> <refnamediv id='pst.name.1'> <refname>outlook.pst</refname> <refpurpose>format of MS Outlook .pst file</refpurpose> </refnamediv> <refsynopsisdiv id='pst.synopsis.1'> <title>Synopsis</title> <cmdsynopsis> <command>outlook.pst</command> </cmdsynopsis> </refsynopsisdiv> <refsect1 id='pst.file.overview.5'> <title>Overview</title> <para> Each item in a .pst file is identified by two id values ID1 and ID2. There are two separate b-trees indexed by these ID1 and ID2 values. </para> </refsect1> <refsect1 id='pst.file.header.5'> <title>File Header</title> <para> The file header is located at offset 0 in the .pst file. </para> <literallayout class="monospaced"><![CDATA[ 0000 21 42 44 4e 49 f8 64 d9 53 4d 0e 00 13 00 01 01 0010 00 00 00 00 00 00 00 00 50 d6 03 00 bd 1e 02 00 0020 08 4c 00 00 00 04 00 00 00 04 00 00 0f 04 00 00 0030 0d 40 00 00 99 0a 01 00 18 04 00 00 0d 40 00 00 0040 0d 40 00 00 11 80 00 00 02 04 00 00 0a 04 00 00 0050 00 04 00 00 00 04 00 00 0f 04 00 00 0f 04 00 00 0060 0f 04 00 00 0d 40 00 00 00 04 00 00 00 04 00 00 0070 04 40 00 00 00 04 00 00 00 04 00 00 00 04 00 00 0080 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 0090 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00a0 0c 09 00 00 00 00 00 00 00 04 27 00 00 24 23 00 00b0 c0 09 0a 00 00 c8 00 00 bc 1e 02 00 00 7e 0c 00 00c0 b4 1e 02 00 00 54 00 00 01 00 00 00 23 55 44 d1 00d0 5a 4f ce 6b 80 ff ff ff 00 00 00 00 00 00 00 00 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0140 00 00 00 00 00 00 00 00 00 00 00 00 3f ff ff ff 0150 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0160 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0170 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0180 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0190 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 01a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 01b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 01c0 ff ff ff ff ff ff ff ff ff ff ff ff 80 01 00 00 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 signature [4 bytes] 0x4e444221 constant 000a indexType [1 byte] 0x0e constant 01cd encryptionType [1 byte] 0x01 constant 00a8 total file size [4 bytes] 0x270400 in this case 00c0 backPointer1 [4 bytes] 0x021eb4 in this case 00c4 offsetIndex1 [4 bytes] 0x005400 in this case 00b8 backPointer2 [4 bytes] 0x021ebc in this case 00bc offsetIndex2 [4 bytes] 0x0c7e00 in this case ]]></literallayout> <para> We only support index type 0x0E and encryption type 0x01. </para> <para> offsetIndex1 is the file offset of the root of the index1 b-tree, which contains (ID1, offset, size, unknown) tuples for each item in the file. backPointer1 is the value that should appear in the parent pointer of that root node. </para> <para> offsetIndex2 is the file offset of the root of the index2 b-tree, which contains (ID2, DESC-ID1, LIST-ID1, PARENT-ID2) tuples for each item in the file. backPointer2 is the value that should appear in the parent pointer of that root node. </para> </refsect1> <refsect1 id='pst.file.node1.5'> <title>Index 1 Node</title> <para> The index1 b-tree nodes are 516 byte blocks with the following format. </para> <literallayout class="monospaced"><![CDATA[ 0000 04 00 00 00 8a 1e 02 00 00 1c 0b 00 000c 58 27 03 00 b3 1e 02 00 00 52 00 00 0018 00 00 00 00 00 00 00 00 00 00 00 00 0024 00 00 00 00 00 00 00 00 00 00 00 00 0030 00 00 00 00 00 00 00 00 00 00 00 00 003c 00 00 00 00 00 00 00 00 00 00 00 00 0048 00 00 00 00 00 00 00 00 00 00 00 00 0054 00 00 00 00 00 00 00 00 00 00 00 00 0060 00 00 00 00 00 00 00 00 00 00 00 00 006c 00 00 00 00 00 00 00 00 00 00 00 00 0078 00 00 00 00 00 00 00 00 00 00 00 00 0084 00 00 00 00 00 00 00 00 00 00 00 00 0090 00 00 00 00 00 00 00 00 00 00 00 00 009c 00 00 00 00 00 00 00 00 00 00 00 00 00a8 00 00 00 00 00 00 00 00 00 00 00 00 00b4 00 00 00 00 00 00 00 00 00 00 00 00 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00cc 00 00 00 00 00 00 00 00 00 00 00 00 00d8 00 00 00 00 00 00 00 00 00 00 00 00 00e4 00 00 00 00 00 00 00 00 00 00 00 00 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00fc 00 00 00 00 00 00 00 00 00 00 00 00 0108 00 00 00 00 00 00 00 00 00 00 00 00 0114 00 00 00 00 00 00 00 00 00 00 00 00 0120 00 00 00 00 00 00 00 00 00 00 00 00 012c 00 00 00 00 00 00 00 00 00 00 00 00 0138 00 00 00 00 00 00 00 00 00 00 00 00 0144 00 00 00 00 00 00 00 00 00 00 00 00 0150 00 00 00 00 00 00 00 00 00 00 00 00 015c 00 00 00 00 00 00 00 00 00 00 00 00 0168 00 00 00 00 00 00 00 00 00 00 00 00 0174 00 00 00 00 00 00 00 00 00 00 00 00 0180 00 00 00 00 00 00 00 00 00 00 00 00 018c 00 00 00 00 00 00 00 00 00 00 00 00 0198 00 00 00 00 00 00 00 00 00 00 00 00 01a4 00 00 00 00 00 00 00 00 00 00 00 00 01b0 00 00 00 00 00 00 00 00 00 00 00 00 01bc 00 00 00 00 00 00 00 00 00 00 00 00 01c8 00 00 00 00 00 00 00 00 00 00 00 00 01d4 00 00 00 00 00 00 00 00 00 00 00 00 01e0 00 00 00 00 00 00 00 00 00 00 00 00 01ec 00 00 00 00 02 29 0c 02 80 80 b6 4a 01f8 b4 1e 02 00 27 9c cc 56 58 27 03 00 01f0 itemCount [1 byte] 0x02 in this case 01f1 maxItemCount [1 byte] 0x29 constant 01f3 nodeLevel [1 byte] 0x02 in this case 01f8 backPointer [4 bytes] 0x021eb4 in this case ]]></literallayout> <para> The itemCount specifies the number of 12 byte records that are active. The nodeLevel is non-zero for this style of nodes. The leaf nodes have a different format. The backPointer must match the backPointer from the triple that pointed to this node. </para> <para> Each item in this node is a triple of (ID1, backPointer, offset) where the offset points to the next deeper node in the tree, the backPointer value must match the backPointer in that deeper node, and ID1 is the lowest ID1 value in the subtree. </para> </refsect1> <refsect1 id='pst.file.leaf1.5'> <title>Index 1 Leaf Node</title> <para> The index1 b-tree leaf nodes are 516 byte blocks with the following format. </para> <literallayout class="monospaced"><![CDATA[ 0000 04 00 00 00 00 58 00 00 64 00 0f 00 000c 08 00 00 00 80 58 00 00 ac 00 06 00 0018 0c 00 00 00 40 59 00 00 ac 00 06 00 0024 10 00 00 00 00 5a 00 00 bc 00 03 00 0030 14 00 00 00 00 5b 00 00 a4 00 02 00 003c 18 00 00 00 c0 5b 00 00 64 00 02 00 0048 1c 00 00 00 40 5c 00 00 5c 00 02 00 0054 50 00 00 00 80 62 00 00 60 00 02 00 0060 74 00 00 00 00 77 00 00 5e 00 02 00 006c 7c 00 00 00 80 77 00 00 66 00 02 00 0078 84 00 00 00 00 76 00 00 ca 00 02 00 0084 88 00 00 00 00 63 00 00 52 00 02 00 0090 90 00 00 00 00 79 00 00 58 00 02 00 009c cc 00 00 00 c0 61 00 00 76 00 02 00 00a8 e0 00 00 00 00 61 00 00 74 00 02 00 00b4 f4 00 00 00 80 65 00 00 6e 00 02 00 00c0 8c 01 00 00 40 60 00 00 70 00 02 00 00cc ea 01 00 00 80 61 00 00 10 00 02 00 00d8 ec 01 00 00 40 8a 00 00 f3 01 02 00 00e4 f0 01 00 00 80 93 00 00 f4 1f 02 00 00f0 fa 01 00 00 c0 7f 00 00 10 00 02 00 00fc 00 02 00 00 00 89 00 00 34 01 02 00 0108 1c 02 00 00 40 ec 00 00 12 06 02 00 0114 22 02 00 00 00 84 00 00 10 00 02 00 0120 24 02 00 00 c0 ea 00 00 3c 01 02 00 012c 40 02 00 00 00 f4 00 00 0a 06 02 00 0138 46 02 00 00 40 8c 00 00 10 00 02 00 0144 48 02 00 00 80 f2 00 00 36 01 02 00 0150 64 02 00 00 80 fb 00 00 bf 07 02 00 015c 6a 02 00 00 80 63 00 00 10 00 02 00 0168 6c 02 00 00 40 fa 00 00 2a 01 02 00 0174 6c 02 00 00 40 fa 00 00 2a 01 02 00 0180 6c 02 00 00 40 fa 00 00 2a 01 02 00 018c 6c 02 00 00 40 fa 00 00 2a 01 02 00 0198 6c 02 00 00 40 fa 00 00 2a 01 02 00 01a4 6c 02 00 00 40 fa 00 00 2a 01 02 00 01b0 64 02 00 00 80 fb 00 00 bf 07 02 00 01bc 64 02 00 00 80 fb 00 00 bf 07 02 00 01c8 64 02 00 00 80 fb 00 00 bf 07 02 00 01d4 64 02 00 00 80 fb 00 00 bf 07 02 00 01e0 64 02 00 00 80 fb 00 00 bf 07 02 00 01ec 00 00 00 00 1f 29 0c 00 80 80 5b b3 01f8 5a 67 01 00 4f ae 70 a7 92 06 00 00 01f0 itemCount [1 byte] 0x1f in this case 01f1 maxItemCount [1 byte] 0x29 constant 01f3 nodeLevel [1 byte] 0x00 in this case 01f8 backPointer [4 bytes] 0x01675a in this case ]]></literallayout> <para> The itemCount specifies the number of 12 byte records that are active. The nodeLevel is zero for these leaf nodes. The backPointer must match the backPointer from the triple that pointed to this node. </para> <para> Each item in this node is a tuple of (ID1, offset, size, unknown) The two low order bits of the ID1 value seem to be flags. I have never seen a case with bit zero set. Bit one indicates that the item is <emphasis>not</emphasis> encrypted. Note that references to these ID1 values elsewhere may have the low order bit set (and I don't know what that means), but when we do the search in this tree we need to clear that bit so that we can find the correct item. </para> </refsect1> <refsect1 id='pst.file.node2.5'> <title>Index 2 Node</title> <para> The index2 b-tree nodes are 516 byte blocks with the following format. </para> <literallayout class="monospaced"><![CDATA[ 0000 21 00 00 00 bb 1e 02 00 00 e2 0b 00 000c 64 78 20 00 8c 1e 02 00 00 dc 0b 00 0018 00 00 00 00 00 00 00 00 00 00 00 00 0024 00 00 00 00 00 00 00 00 00 00 00 00 0030 00 00 00 00 00 00 00 00 00 00 00 00 003c 00 00 00 00 00 00 00 00 00 00 00 00 0048 00 00 00 00 00 00 00 00 00 00 00 00 0054 00 00 00 00 00 00 00 00 00 00 00 00 0060 00 00 00 00 00 00 00 00 00 00 00 00 006c 00 00 00 00 00 00 00 00 00 00 00 00 0078 00 00 00 00 00 00 00 00 00 00 00 00 0084 00 00 00 00 00 00 00 00 00 00 00 00 0090 00 00 00 00 00 00 00 00 00 00 00 00 009c 00 00 00 00 00 00 00 00 00 00 00 00 00a8 00 00 00 00 00 00 00 00 00 00 00 00 00b4 00 00 00 00 00 00 00 00 00 00 00 00 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00cc 00 00 00 00 00 00 00 00 00 00 00 00 00d8 00 00 00 00 00 00 00 00 00 00 00 00 00e4 00 00 00 00 00 00 00 00 00 00 00 00 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00fc 00 00 00 00 00 00 00 00 00 00 00 00 0108 00 00 00 00 00 00 00 00 00 00 00 00 0114 00 00 00 00 00 00 00 00 00 00 00 00 0120 00 00 00 00 00 00 00 00 00 00 00 00 012c 00 00 00 00 00 00 00 00 00 00 00 00 0138 00 00 00 00 00 00 00 00 00 00 00 00 0144 00 00 00 00 00 00 00 00 00 00 00 00 0150 00 00 00 00 00 00 00 00 00 00 00 00 015c 00 00 00 00 00 00 00 00 00 00 00 00 0168 00 00 00 00 00 00 00 00 00 00 00 00 0174 00 00 00 00 00 00 00 00 00 00 00 00 0180 00 00 00 00 00 00 00 00 00 00 00 00 018c 00 00 00 00 00 00 00 00 00 00 00 00 0198 00 00 00 00 00 00 00 00 00 00 00 00 01a4 00 00 00 00 00 00 00 00 00 00 00 00 01b0 00 00 00 00 00 00 00 00 00 00 00 00 01bc 00 00 00 00 00 00 00 00 00 00 00 00 01c8 00 00 00 00 00 00 00 00 00 00 00 00 01d4 00 00 00 00 00 00 00 00 00 00 00 00 01e0 00 00 00 00 00 00 00 00 00 00 00 00 01ec 00 00 00 00 02 29 0c 02 81 81 b2 60 01f8 bc 1e 02 00 7e 70 dc e3 21 00 00 00 01f0 itemCount [1 byte] 0x02 in this case 01f1 maxItemCount [1 byte] 0x29 constant 01f3 nodeLevel [1 byte] 0x02 in this case 01f8 backPointer [4 bytes] 0x021ebc in this case ]]></literallayout> <para> The itemCount specifies the number of 12 byte records that are active. The nodeLevel is non-zero for this style of nodes. The leaf nodes have a different format. The backPointer must match the backPointer from the triple that pointed to this node. </para> <para> Each item in this node is a triple of (ID2, backPointer, offset) where the offset points to the next deeper node in the tree, the backPointer value must match the backPointer in that deeper node, and ID2 is the lowest ID2 value in the subtree. </para> </refsect1> <refsect1 id='pst.file.leaf2.5'> <title>Index 2 Leaf Node</title> <para> The index2 b-tree leaf nodes are 516 byte blocks with the following format. </para> <literallayout class="monospaced"><![CDATA[ 0000 21 00 00 00 38 e6 00 00 00 00 00 00 00 00 00 00 0010 61 00 00 00 2c a8 02 00 36 a8 02 00 00 00 00 00 0020 22 01 00 00 20 a2 02 00 00 00 00 00 22 01 00 00 0030 2d 01 00 00 88 7b 03 00 00 00 00 00 00 00 00 00 0040 2e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 0050 2f 01 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 0060 e1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0070 01 02 00 00 b4 e4 02 00 00 00 00 00 00 00 00 00 0080 61 02 00 00 a0 e4 02 00 00 00 00 00 00 00 00 00 0090 0d 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00A0 0e 06 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00B0 0f 06 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00C0 10 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00D0 2b 06 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00E0 4c 06 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00F0 71 06 00 00 18 00 00 00 00 00 00 00 00 00 00 00 0100 92 06 00 00 14 00 00 00 00 00 00 00 00 00 00 00 0110 23 22 00 00 14 a0 02 00 00 00 00 00 22 01 00 00 0120 26 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0130 27 22 00 00 1c a0 02 00 00 00 00 00 00 00 00 00 0140 22 80 00 00 50 00 00 00 00 00 00 00 22 01 00 00 0150 2d 80 00 00 f8 9f 02 00 00 00 00 00 00 00 00 00 0160 2e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00 0170 2f 80 00 00 34 e6 00 00 00 00 00 00 00 00 00 00 0180 42 80 00 00 3c 6d 02 00 00 00 00 00 22 80 00 00 0190 4d 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01A0 4e 80 00 00 10 6d 02 00 00 00 00 00 00 00 00 00 01B0 4f 80 00 00 ec 23 00 00 00 00 00 00 00 00 00 00 01C0 62 80 00 00 38 78 02 00 00 00 00 00 22 01 00 00 01D0 6d 80 00 00 34 78 02 00 00 00 00 00 00 00 00 00 01E0 6e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00 01F0 10 1f 10 00 81 81 a0 9a ae 1e 02 00 89 44 6a 0f 0200 b8 b1 03 00 01f0 itemCount [1 byte] 0x10 in this case 01f1 maxItemCount [1 byte] 0x1f constant 01f3 nodeLevel [1 byte] 0x00 in this case 01f8 backPointer [4 bytes] 0x021eae in this case ]]></literallayout> <para> The itemCount specifies the number of 16 byte records that are active. The nodeLevel is zero for these leaf nodes. The backPointer must match the backPointer from the triple that pointed to this node. </para> <para> Each item in this node is a tuple of (ID2, DESC-ID1, LIST-ID1, PARENT-ID2) </para> </refsect1> <refsect1 id='pst.file.list.5'> <title>Associated List Item</title> <para> Contains associations between id1 and id2 for the items controlled by the record. In the above leaf node, we have a tuple of (0x61, 0x02a82c, 0x02a836, 0) 0x02a836 is the ID1 of the associated list, and we can lookup that ID1 value in the index1 b-tree to find the (offset,size) of the data in the .pst file. </para> <literallayout class="monospaced"><![CDATA[ 0000 02 00 01 00 9f 81 00 00 30 a8 02 00 00 00 00 00 0000 unknown [2 bytes] 0x0002 constant 0002 count [2 bytes] 0x0001 in this case repeating 0004 id2 [4 bytes] 0x00819f in this case 0008 id [4 bytes] 0x02a830 in this case 000c unknown [4 bytes] 0 in this case ]]></literallayout> </refsect1> <refsect1 id='pst.file.desc.5'> <title>Associated Descriptor Item 0xbcec</title> <para> Contains information about the item, which may be email, contact, or other outlook types. In the above leaf node, we have a tuple of (0x21, 0x00e638, 0, 0) 0x00e638 is the ID1 of the associated descriptor, and we can lookup that ID1 value in the index1 b-tree to find the (offset,size) of the data in the .pst file. </para> <literallayout class="monospaced"><![CDATA[ 0000 3c 01 ec bc 20 00 00 00 00 00 00 00 b5 02 06 00 0010 40 00 00 00 f9 0f 02 01 60 00 00 00 01 30 1e 00 0020 80 00 00 00 04 30 1e 00 00 00 00 00 df 35 03 00 0030 ff 00 00 00 e0 35 02 01 a0 00 00 00 e2 35 02 01 0040 e0 00 00 00 e3 35 02 01 c0 00 00 00 e4 35 02 01 0050 00 01 00 00 e5 35 02 01 20 01 00 00 e6 35 02 01 0060 40 01 00 00 e7 35 02 01 60 01 00 00 1e 66 0b 00 0070 00 00 00 00 ff 67 03 00 00 00 00 00 d2 7f 17 d8 0080 64 8c d5 11 83 24 00 50 04 86 95 45 53 74 61 6e 0090 6c 65 79 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83 00A0 24 00 50 04 86 95 45 22 80 00 00 00 00 00 00 d2 00B0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 42 00C0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83 00D0 24 00 50 04 86 95 45 a2 80 00 00 00 00 00 00 d2 00E0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 c2 00F0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83 0100 24 00 50 04 86 95 45 e2 80 00 00 00 00 00 00 d2 0110 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 02 0120 81 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83 0130 24 00 50 04 86 95 45 62 80 00 00 00 0b 00 00 00 0140 0c 00 14 00 7c 00 8c 00 93 00 ab 00 c3 00 db 00 0150 f3 00 0b 01 23 01 3b 01 0000 indexOffset [2 bytes] 0x013c in this case 0002 signature [2 bytes] 0xbcec constant 0004 b5offset [4 bytes] 0x0020 index reference ]]></literallayout> <para> Note the signature of 0xbcec. There are other descriptor block formats with other signatures. Note the indexOffset of 0x013c - starting at that position in the descriptor block, we have an array of two byte integers. The first integer (0x000b) is a (count-1) of the number of overlapping pairs following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14) and the last (12th) pair is (0x123, 0x13b). These pairs are (start,end+1) offsets of items in this block. So we have count+2 integers following the count value. </para> <para> Note the b5offset of 0x0020, which is a type that I will call an index reference. Such index references have at least two different forms, and may point to data either in this block, or in some other block. External pointer references have the low order 4 bits all set, and are ID2 values that can be used to fetch data. This value of 0x0020 is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0002, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xc, 0x14) pair. </para> <para> Finally, we have the offset and size of the "b5" block located at offset 0xc with a size of 8 bytes in this descriptor block. The "b5" block has the following format: </para> <literallayout class="monospaced"><![CDATA[ 0000 signature [2 bytes] 0x02b5 constant 0002 unknown [2 bytes] 0x0006 in this case 0004 descoffset [4 bytes] 0x0040 index reference ]]></literallayout> <para> Note the descoffset of 0x0040, which again is an index reference. In this case, it is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0004, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0x14, 0x7c) pair. We now have the offset 0x14 of the descriptor array, composed of 8 byte entries. Each descriptor entry has the following format: </para> <literallayout class="monospaced"><![CDATA[ 0000 itemType [2 bytes] 0002 referenceType [2 bytes] 0004 value [4 bytes] ]]></literallayout> <para> For some reference types (2, 3, 0xb) the value is used directly. Otherwise, the value is an index reference, which is either an ID2 value, or an offset, to be right shifted by 4 bits and used to fetch a pair from the index table to find the offset and size of the item in this descriptor block. </para> <para> The following reference types are known, but not all of these are implemented in the code yet. </para> <literallayout class="monospaced"><![CDATA[ 0x0002 - Signed 16bit value 0x0003 - Signed 32bit value 0x0004 - 4-byte floating point 0x0005 - Floating point double 0x0006 - Signed 64-bit int 0x0007 - Application Time 0x000A - 32-bit error value 0x000B - Boolean (non-zero = true) 0x000D - Embedded Object 0x0014 - 8-byte signed integer (64-bit) 0x001E - Null terminated String 0x001F - Unicode string 0x0040 - Systime - Filetime structure 0x0048 - OLE Guid 0x0102 - Binary data 0x1003 - Array of 32bit values 0x1014 - Array of 64bit values 0x101E - Array of Strings 0x1102 - Array of Binary data ]]></literallayout> <para> The following item types are known, but not all of these are implemented in the code yet. Note: it appears that some types can have a IPOS value or a ID2 value depending on the size of the field in question. It is safer to check every field than for me to say what the "usually" contain. Absolute values though, are generally going to be constant. </para> <literallayout class="monospaced"><![CDATA[ 0002 AutoForward allowed 0003 Extended Attributes Table 0017 Importance Level 001a IPM Context. What type of message is this 0023 Global Delivery Report 0026 Priority 0029 Read Receipt 002b Reassignment Prohibited 002e Original Sensitivity 0036 Sensitivity 0037 Email Subject. The referenced item is of type "Subject Type" 0039 Date. This is likely to be the arrival date 003b Outlook Address of Sender 003f Outlook structure describing the recipient 0040 Name of the Outlook recipient structure 0041 Outlook structure describing the sender 0042 Name of the Outlook sender structure 0043 Another structure describing the recipient 0044 Name of the second recipient structure 004f Reply-To Outlook Structure 0050 Name of the Reply-To structure 0051 Outlook Name of recipient 0052 Second Outlook name of recipient 0057 My address in TO field 0058 My address in CC field 0059 Message addressed to me 0063 Response requested 0064 Sender's Address access method (SMTP, EX) 0065 Sender's Address 0070 Processed Subject (with Fwd:, Re, ... removed) 0071 Date. Another date 0075 Recipient Address Access Method (SMTP, EX) 0076 Recipient's Address 0077 Second Recipient Access Method (SMTP, EX) 0078 Second Recipient Address 007d Email Header. This is the header that was attached to the email 0c17 Reply Requested 0c19 Second sender struct 0c1a Name of second sender struct 0c1d Second outlook name of sender 0c1e Second sender access method (SMTP, EX) 0c1f Second Sender Address 0e01 Delete after submit 0e03 CC Address? 0e04 SentTo Address 0e06 Date. 0e07 Flag - contains IsSeen value 0e08 Message Size 0e0a Sentmail EntryID 0e1f Compressed RTF in Sync 0e20 Attachment Size 0ff9 binary record header 1000 Plain Text Email Body. Does not exist if the email doesn't have a plain text version 1006 RTF Sync Body CRC 1007 RTF Sync Body character count 1008 RTF Sync body tag 1009 RTF Compressed body 1010 RTF whitespace prefix count 1011 RTF whitespace tailing count 1013 HTML Email Body. Does not exist if the email doesn't have an HTML version 1035 Message ID 1042 In-Reply-To or Parent's Message ID 1046 Return Path 3001 Folder Name? I have seen this value used for the contacts record aswell 3002 Address Type 3003 Contact Address 3004 Comment 3007 Date item creation 3008 Date item modification 300b binary record header 35df Valid Folder Mask 35e0 binary record found in first item. Contains the reference to "Top of Personal Folder" item 35e3 binary record with a reference to "Deleted Items" item 35e7 binary record with a reference to "Search Root" item 3602 the number of emails stored in a folder 3603 the number of unread emails in a folder 360a Has Subfolders 3613 the folder content description 3617 Associate Content count 3701 Binary Data attachment 3704 Attachment Filename 3705 Attachement method 3707 Attachment Filename long 370b Attachment Position 370e Attachment mime encoding 3710 Attachment Mime Sequence 3a00 Contact's Account name 3a01 Contact Alternate Recipient 3a02 Callback telephone number 3a03 Message Conversion Prohibited 3a05 Contacts Suffix 3a06 Contacts First Name 3a07 Contacts Government ID Number 3a08 Business Telephone Number 3a09 Home Telephone Number 3a0a Contacts Initials 3a0b Keyword 3a0c Contact's Language 3a0d Contact's Location 3a0e Mail Permission 3a0f MHS Common Name 3a10 Organizational ID # 3a11 Contacts Surname 3a12 original entry id 3a13 original display name 3a14 original search key 3a15 Default Postal Address 3a16 Company Name 3a17 Job Title 3a18 Department Name 3a19 Office Location 3a1a Primary Telephone 3a1b Business Phone Number 2 3a1c Mobile Phone Number 3a1d Radio Phone Number 3a1e Car Phone Number 3a1f Other Phone Number 3a20 Transmittable Display Name 3a21 Pager Phone Number 3a22 user certificate 3a23 Primary Fax Number 3a24 Business Fax Number 3a25 Home Fax Number 3a26 Business Address Country 3a27 Business Address City 3a28 Business Address State 3a29 Business Address Street 3a2a Business Postal Code 3a2b Business PO Box 3a2c Telex Number 3a2d ISDN Number 3a2e Assistant Phone Number 3a2f Home Phone 2 3a30 Assistant's Name 3a40 Can receive Rich Text 3a41 Wedding Anniversary 3a42 Birthday 3a43 Hobbies 3a44 Middle Name 3a45 Display Name Prefix (Title) 3a46 Profession 3a47 Preferred By Name 3a48 Spouse's Name 3a49 Computer Network Name 3a4a Customer ID 3a4b TTY/TDD Phone 3a4c Ftp Site 3a4d Gender 3a4e Manager's Name 3a4f Nickname 3a50 Personal Home Page 3a51 Business Home Page 3a57 Company Main Phone 3a58 childrens names 3a59 Home Address City 3a5a Home Address Country 3a5b Home Address Postal Code 3a5c Home Address State or Province 3a5d Home Address Street 3a5e Home Address Post Office Box 3a5f Other Address City 3a60 Other Address Country 3a61 Other Address Postal Code 3a62 Other Address State 3a63 Other Address Street 3a64 Other Address Post Office box 65e3 Entry ID 67f2 Attachment ID2 value 67ff Password checksum 6f02 Secure HTML Body 6f04 Secure Text Body 7c07 Top of folders RecID 8000 Contain extra bits of information that have been taken from the email's header. I call them extra lines 8005 Contact Fullname 801a Home Address 801b Business Address 801c Other Address 8082 Email Address 1 Transport 8083 Email Address 1 Address 8084 Email Address 1 Description 8085 Email Address 1 Record 8092 Email Address 2 Transport 8093 Email Address 2 Address 8094 Email Address 2 Description 8095 Email Address 2 Record 80a2 Email Address 3 Transport 80a3 Email Address 3 Address 80a4 Email Address 3 Description 80a5 Email Address 3 Record 80d8 Internet Free/Busy 8205 Appointment shows as 8208 Appointment Location 8214 Label for appointment 8215 All day appointment flag 8234 TimeZone of times 8235 Appointment Start Time 8236 Appointment End Time 8516 Duplicate Time Start 8517 Duplicate Time End 8530 Followup String 8534 Mileage 8535 Billing Information 8554 Outlook Version 8560 Appointment Reminder Time 8700 Journal Entry Type 8706 Start Timestamp 8708 End Timestamp 8712 Journal Entry Type ]]></literallayout> </refsect1> <refsect1 id='pst.file.desc2.5'> <title>Associated Descriptor Item 0x7cec</title> <para> This style of descriptor block is similar to the 0xbcec format. </para> <literallayout class="monospaced"><![CDATA[ 0000 7a 01 ec 7c 40 00 00 00 00 00 00 00 b5 04 02 00 0010 60 00 00 00 7c 18 60 00 60 00 62 00 65 00 20 00 0020 00 00 80 00 00 00 00 00 00 00 03 00 20 0e 0c 00 0030 04 03 1e 00 01 30 2c 00 04 0b 1e 00 03 37 28 00 0040 04 0a 1e 00 04 37 14 00 04 05 03 00 05 37 10 00 0050 04 04 1e 00 07 37 24 00 04 09 1e 00 08 37 20 00 0060 04 08 02 01 0a 37 18 00 04 06 03 00 0b 37 08 00 0070 04 02 1e 00 0d 37 1c 00 04 07 1e 00 0e 37 40 00 0080 04 10 02 01 0f 37 30 00 04 0c 1e 00 11 37 34 00 0090 04 0d 1e 00 12 37 3c 00 04 0f 1e 00 13 37 38 00 00A0 04 0e 03 00 f2 67 00 00 04 00 03 00 f3 67 04 00 00B0 04 01 03 00 09 69 44 00 04 11 03 00 fa 7f 5c 00 00C0 04 15 40 00 fb 7f 4c 00 08 13 40 00 fc 7f 54 00 00D0 08 14 03 00 fd 7f 48 00 04 12 0b 00 fe 7f 60 00 00E0 01 16 0b 00 ff 7f 61 00 01 17 45 82 00 00 00 00 00F0 45 82 00 00 78 3c 00 00 ff ff ff ff 49 1e 00 00 0100 06 00 00 00 00 00 00 00 a0 00 00 00 00 00 00 00 0110 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 40 dd a3 0140 57 45 b3 0c 00 40 dd a3 57 45 b3 0c 02 00 00 00 0150 00 00 fa 10 3e 2a 86 48 86 f7 14 03 0a 03 02 01 0160 4a 2e 20 44 61 76 69 64 20 4b 61 72 61 6d 27 73 0170 20 42 69 72 74 68 64 61 79 00 06 00 00 00 0c 00 0180 14 00 ea 00 f0 00 55 01 60 01 79 01 0000 indexOffset [2 bytes] 0x017a in this case 0002 signature [2 bytes] 0x7cec constant 0004 7coffset [4 bytes] 0x0040 index reference ]]></literallayout> <para> Note the signature of 0x7cec. There are other descriptor block formats with other signatures. Note the indexOffset of 0x017a - starting at that position in the descriptor block, we have an array of two byte integers. The first integer (0x0006) is a (count-1) of the number of overlapping pairs following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14) and the last (7th) pair is (0x160, 0x179). These pairs are (start,end+1) offsets of items in this block. So we have count+2 integers following the count value. </para> <para> Note the 7coffset of 0x0040, which is an index reference. In this case, it is an internal reference pointer, which needs to be right shifted by 4 bits to become 0x0004, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0x14, 0xea) pair. We have the offset and size of the "7c" block located at offset 0x14 with a size of 214 bytes in this case. The "7c" block starts with a header with the following format: </para> <literallayout class="monospaced"><![CDATA[ 0000 signature [1 bytes] 0x7c constant 0001 itemCount [1 bytes] 0x18 in this case 0002 unknown [2 bytes] 0x0060 in this case 0004 unknown [2 bytes] 0x0060 in this case 0006 unknown [2 bytes] 0x0062 in this case 0008 recordSize [2 bytes] 0x0065 in this case 000a b5Offset [4 bytes] 0x0020 index reference 000e index2Offset [4 bytes] 0x0080 index reference 0010 unknown [2 bytes] 0x0000 in this case 0012 unknown [2 bytes] 0x0000 in this case 0014 unknown [2 bytes] 0x0000 in this case ]]></literallayout> <para> Note the b5Offset of 0x0020, which is an index reference. In this case, it is an internal reference pointer, which needs to be right shifted by 4 bits to become 0x0002, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xc, 0x14) pair. Finally, we have the offset and size of the "b5" block located at offset 0xc with a size of 8 bytes in this descriptor block. The "b5" block has the following format: </para> <literallayout class="monospaced"><![CDATA[ 0000 signature [2 bytes] 0x04b5 constant 0002 unknown [2 bytes] 0x0002 in this case 0004 descoffset [4 bytes] 0x0060 index reference ]]></literallayout> <para> Note the descoffset of 0x0060, which again is an index reference. In this case, it is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0006, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xea, 0xf0) pair. That gives us (0xf0 - 0xea)/6 = 1, so we have a recordCount of one. The actual data between 0xea and 0xf0 is unknown and unused here. </para> <para> Note the index2Offset above of 0x0080, which again is an index reference. In this case, it is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0008, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xf0, 0x155) pair. This is an array of tables of four byte integers. We will call these the IND2 tables. The size of each of these tables is specified by the recordSize field of the "7c" header. The number of these tables is the above recordCount value derived from the "b5" block. </para> <para> Now the remaining data in the "7c" block after the header starts at offset 0x2a. There should be itemCount 8 byte items here, with the following format: </para> <literallayout class="monospaced"><![CDATA[ 0000 referenceType [2 bytes] 0002 itemType [2 bytes] 0004 ind2Offset [2 bytes] 0006 size [1 byte] 0007 unknown [1 byte] ]]></literallayout> <para> The ind2Offset is a byte offset into the current IND2 table of some value. If that is a four byte integer value, then once we fetch that, we have the same triple (item type, reference type, value) as we find in the 0xbcec style descriptor blocks. If not, then this value is used directly. These 8 byte descriptors are processed recordCount times, each time using the next IND2 table. The item and reference types are as described above for the 0xbcec format descriptor block. </para> </refsect1> <refsect1 id='pst.file.desc3.5'> <title>Associated Descriptor Item 0x0002</title> <para> This style of descriptor block is almost unknown here. It seems to contain a list of ID1 values. </para> <literallayout class="monospaced"><![CDATA[ 0000 01 01 02 00 26 28 00 00 18 77 0c 00 b8 04 00 00 0000 signature [2 bytes] 0x0101 constant 0002 count [2 bytes] 0x0002 in this case 0004 unknown [4 bytes] 0x002826 in this case repeating 0008 id [4 bytes] 0x0c7718 in this case 000c id [4 bytes] 0x0004b8 in this case ]]></literallayout> </refsect1> </refentry> </reference>