a section from a R2010 file (at least some of my sample files) is build like this:
- sentinel (16 bytes)
- data_size (4 bytes)
- if maintenance_release_version is > 3 than an unknown long follows (4 bytes)
- bit_size (4 bytes)
With the bit_size the location of the string stream could be calculated like in a R2007 file with one exception:
in the 2007 string_stream_init() function the bitpos variable is incremented by 0x8F
in the 2010 string_stream_init() function the bitpos variable must be incremented by 0xAF
The maintenance_release_version variable mentioned earlier is the variable from the file header.
Am 16.01.2014 um 18:42 schrieb Felipe Castro:
Well, I didn´t found any of those streams after the integer and float variables of the header.
While reading the variables, the only handle to be read directly is the
HANDSEED, the others should be read from some handle stream. The same with strings, they should be fetched from some stream in other place.
But in R2010, there is no bitsize to get the string stream after the variables (as with R2007).
Also, after reading the variables, a bit 0 is found, no way to get a string stream from there.
So, I have searched for strings and handles after reading the variables, and did not succeed anyway.
Till, only after 2 months I'm having the time to get back looking at the code here, thanks for your suggestion, I'll take a look at those string offsets.
I would suggest that the string and handle chains are handled like in R2007. Have a look at the r2007 branch and if you are lucky not much has to be changed.
Am 11.11.2013 um 10:46 schrieb Felipe Castro:
I was trying to decode R2010, but I have an issue, where to get the string chain for the header variables section. Anyone can help on this with more information?