Nick Burch wrote:
On Tue, 24 Jan 2006, Nick Burch wrote:
Alas, all the documentation I can find on BinaryTagData is "The value of PST_ProgBinaryTag is the size of the binary data.", which isn't much help

I've just noticed within the slide one:

(8 byte record header)
0F 00 E0 2E A2 00 00 00 Container record
 00 00 BA 0F 14 00 00 00 (0x14=20 bytes of who made the edit, in unicode)
 10 00 BA 0F 50 00 00 00 (0x50=80 bytes of the comment text, in unicode)
 20 00 BA 0F 02 00 00 00 44 00
 00 00 E1 2E 1C 00 00 00 (0x1c=28 bytes of data)

E0 2E -> 2E E0 = 12000 = ?
BA 0F -> 0F BA = 4026 = CString, so this is looking quite possible
E1 2E -> 2E E1 = 12001 = ?

Looks like it's a nested structure of records. I'm not sure how we'd tell it's comments though, I guess just trial and error looking at the sub records
Yeah.  I see the same structure too, I was disassembling it last night.

 0f 00 e0 2e 7c 00 00 00    Container record, type = 12000, length = 124

 00 00 ba 0f 16 00 00 00    Record, type = 4026 (CString), length = 22
 Next 22 bytes is the name of the person who made the comment.

 10 00 ba 0f 24 00 00 00    Record, type = 4026 (CString), length = 36
 Next 36 bytes is the text of the comment.

 20 00 ba 0f 06 00 00 00    Record, type = 4026 (CString), length = 6
 Next 6 bytes are the initials of the person who made the comment.

 00 00 e1 2e 1c 00 00 00    Record, type = 12001, length = 28
 Next 28 bytes are god-knows what, but I'm thinking the comment date
 has to be in here somewhere as PowerPoint knows what time the comment
 was added.
     01 00 00 00 d6 07 01 00 02 00 18 00 10 00 0e 00
     34 00 d4 01 0a 00 00 00 0a 00 00 00

Type 12000 must be a comment container.  Judging from the way other such
containers are laid out, could 12001 be a comment atom?

Mystery 1:
 The "00 00", "01 00", "02 00" that appear in the header for the
 CString records... I have no idea what the first short value in a
 record header means, but they're always the same for comments as
 far as I can see.

Mystery 2:
 This final block which is at the end of the other comment records:
   00 00 eb 2e 08 00 00 00     type = 12011, length = 8
   a5 20 c6 01 90 f0 f3 11

Daniel

--
Daniel Noll

Nuix Australia Pty Ltd
Suite 79, 89 Jones St, Ultimo NSW 2007, Australia
Phone: (02) 9280 0699
Fax:   (02) 9212 6902

This message is intended only for the named recipient. If you are not
the intended recipient you are notified that disclosing, copying,
distributing or taking any action in reliance on the contents of this
message or attachment is strictly prohibited.


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
Mailing List:     http://jakarta.apache.org/site/mail2.html#poi
The Apache Jakarta Poi Project:  http://jakarta.apache.org/poi/

Reply via email to