0

I have a structured storage file that I am working to reverse engineer. The object has multiple streams embedded within it - some of which are compressed. After decompressing the streams I am left with the resulting data which I know for a fact contains both handles and pointers to different objects. My question is that, if you assume I know what I am looking at is a pointer, then does the pointer point to a location within each stream embedded in the structured storage or does it point to a location in the structured storage as a whole?

How would I even be able to tell? Is it safe to assume that due to the compression the pointer values must be meant for the individual streams?

too honest for this site
  • 12,050
  • 4
  • 30
  • 52
Andy
  • 134
  • 8
  • Without knowing the format of your uncompressed streams it's hard to tell anything. – Jabberwocky Apr 12 '17 at 14:24
  • This depends entirely on the particular format. You should find the specification, or just use a standard implementation. – Oliver Charlesworth Apr 12 '17 at 14:28
  • A sorted file or network stream hardly contains pointers. More likely they are offsets into the file/stream. Anyway, without further information it is not possible to provide an educated guess, less a definitive answer.. – too honest for this site Apr 12 '17 at 14:53

0 Answers0