Mailing List Archive

Just to try to help, I created a word doc (using Microsoft Word 2000) and
used (Insert, Object... from file) to insert three files.. one a zip, one
a com file, and one an exe. When I hex edit that doc your byte string
doesn't show up (A0 46 1D F0). However, I did notice a couple of
things.. if you search for (50 61 63 6b 61 67 65 00 f4 39 b2 71) you'll
get "close" to an attachment. That byte string is actually "Package" +
zero termination + a specific byte string f4 39 b2 71. Anyway, the other
patterns I noticed is that the attachment header always starts at
0x???00h... and that the attachment header itself begins with a relative
offset to the end of the attachment. Also, right before the data to the
attachement begins (after the filename is duplicated three times), there
is the size of the attachment itself. Btw, both the relative offset and
the attachment size are big endian (read: backwards) and are four bytes
long. I hope this helps.


On Tue, 1 Jul 2003, Paul L Daniels wrote:

> So far, here's the information I have:
>
> The header format is:
>
> A0 46 1D F0 <25 bytes of unknown formatted data> <Start of attachment...... >
>
> Within the 25 bytes, there is most likely something indicating the attachment
> length. Aquiring even that small peice of information will be incredibly
> useful.
>
> For linked-objects (file-insert), the header is different again:
>
> <4 bytes> 00 02 <filename> 00 <file path> 00 <8 bytes> <file path> 00 <4
> bytes> <Start of attachment....>
>
>
>
>