Windows_Protocols__2017_Dec_01_cfb

2 Structures

2.1 Compound File Sector Numbers and Types

Each sector, except for the header, is identified by a nonnegative, 32-bit sector number. The following sector numbers above 0xFFFFFFFA are reserved and MUST NOT be used to identify the location of a sector in a compound file.

Followings are definitions of SectIDs:

#define SID_MAXREG (0xfffffffa)

#define SID_FUTURE  ((SectID)(SID_MAXREG + 1))

#define SID_MSAT_SECTOR ((SectID)(SID_MAXREG + 2))

#define SID_SAT_SECTOR ((SectID)(SID_MAXREG + 3))

#define SID_END_OF_CHAIN    ((SectID)(SID_MAXREG + 4))

#define SID_UNUSED_SECTOR ((SectID)(SID_MAXREG + 5))

/*
[MS-CFB] or [MS-CFB] errata 2.9 Compound File Size Limits:
...4,096 bytes/sector x MAXREGSECT (0xFFFFFFFA) sectors...
so SID_MAXREG is also a special ID.
*/
#define SID_IS_SPECIAL(sid) ((SectID)(sid) >= SID_MAXREG)

The following list contains the types of sectors that are allowed in a compound file:

Header: A single sector with fields that are needed to read the other structures of the compound file.For version 4 compound files, the header size (512 bytes) is less than the sector size (4,096 bytes), so the remaining part of the header (3,584 bytes) MUST be filled with all zeroes. We can take head_size as equals with sect_size.

FAT: Sector Allocation Table(OpenOffice: SAT).

DIFAT: Used to locate FAT sectors in the compound file(OpenOffice: MSAT).

Mini FAT: FAT for short streams(OpenOffice: SSAT).

Directory:
User-defined Data:
Unallocated Free:

Range Lock:A single sector that is used to manage concurrent access to the compound file. This sector must cover file offset 0x7FFFFFFF(OpenOffice:Not used).

2.6 Compound File Directory Sectors

2.6.1 Compound File Directory Entry

The valid values for a stream ID, which are used in the Child ID, Right Sibling ID, and Left Sibling ID fields, are 0 through MAXREGSID (excluding).

Directory Entry Name (64 bytes):
storage and stream names are limited to 32 UTF-16 code points, including the terminating null character. When locating an object in the compound file except for the root storage, the directory entry name is compared by using a special case-insensitive uppercase mapping, described in Red-Black Tree. The following characters are illegal and MUST NOT be part of the name: '/', '\', ':', '!'.

Directory Entry Name Length (2 bytes):
This field MUST match the length of the Directory Entry Name Unicode string in bytes. The length MUST be a multiple of 2 and include the terminating null character in the count.
A secured parser shall not use this field.

Object Type (offset 66, 0x42): This field MUST be 0x00, 0x01, 0x02, or 0x05, depending on the actual type of object. All other values are not valid: 0 for Unknown or unallocated; 1 for Storage Object; 2 for Stream Object; 5 for Root Storage Object. 

Color Flag (offset 67, 0x43): This field MUST be 0x00 (red) or 0x01 (black). 

Left Sibling ID(offset 68, 0x44): This field contains the stream ID of the left sibling. If there is no left sibling, the field MUST be set to NOSTREAM (0xFFFFFFFF).

Right Sibling ID (offset 72, 0x48): 

Child ID (offset 76, 0x4C): This field contains the stream ID of a child object. If there is no child object, the field MUST be set to NOSTREAM (0xFFFFFFFF). 

CLSID (offset 80, 0x50): This field contains an object class GUID(can be used as a parameter to start applications.), if this entry is a storage or root storage. If no object class GUID is set on this object, the field MUST be set to all zeroes. 

State Bits (offset 96, 0x60): This field contains the user-defined flags if this entry is a storage object or root storage object. If no state bits are set on the object, this field MUST be set to all zeroes. 

Creation Time(8 bytes):Modified Time (8 bytes): 

Starting Sector Location (offset 116, 0x74): This field contains the first sector location if this is a stream object. For a root storage object, this field MUST contain the first sector of the mini stream, if the mini stream exists.

Stream Size (8 bytes): Streams whose size is less than the Cutoff value exist in the mini stream. Parsers must trust Stream Size to decide it's mini or standard stream,
while maintains a size telling the size figured out through sector chain of this stream.

2.6.4 Red-Black Tree

According rbtree, followings are true:

The root storage object MUST always be black. 
wo consecutive nodes MUST NOT both be red.(if one node is red, it's left/right must be black)
The left sibling MUST always be less than the right sibling. (root object has const name, its name don't compare; root object has no left and right)

This sorting relationship is defined as follows:

A node that has a shorter name is less than a node that has a longer name. 

For each UTF-16 code point, convert to uppercase by using the Unicode Default 
Case Conversion Algorithm