lkml.org 
[lkml]   [2017]   [May]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: RFC: WMI Enhancements
Date
I updated my bmfdec.c (git://github.com/pali/bmfdec.git) and here is
guessed header description:

/*
* BMF file is compressed by DS-01 algorithm with additional header:
* 4 bytes: 46 4f 4d 42 - 'F' 'O' 'M' 'B'
* 4 bytes: 01 00 00 00 - version 0x01
* 4 bytes: size of compressed data (low endian) without this header
* 4 bytes: size of decompressed data (low endian) without this header
*/

/*
* Decompressed part of BMF file contains:
* 4 bytes: 46 4f 4d 42 - 'F' 'O' 'M' 'B'
* 4 bytes: N = size of first part (low endian) since beginning
* N-8 bytes: first part data
* 16 bytes: 42 4d 4f 46 51 55 41 4c 46 4c 41 56 4f 52 31 31 - "BMOFQUALFLAVOR11"
* M bytes: second part data of unknown length
*/

First part of decompressed data contains UTF-16 strings terminated by
two zero bytes and between two strings are some binary data. Those
strings are just literals found in decompiled MOF file, so looks like
binary parts just decodes types and MOF language keywords.

And it looks like second part is not required and sometimes missing.
It contains only binary data, no idea what is there.

Now somebody with knowledge of MOF language should be able to describe
what and how is stored in first part.

--
Pali Rohár
pali.rohar@gmail.com
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2017-05-10 21:20    [W:0.199 / U:0.884 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site