[MS-PST] - 2.2.2.7.7.1 BTPAGE ANSI format and padding

Question

Root

0x7E00    21 00 00 00 ee 00 00 00 00 78 00 00 6f 80 00 00
0x7E10    f3 00 00 00 00 7c 00 00 64 00 20 00 f5 00 00 00
0x7E20    00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00
...
0x7FF0    03 29 0c 01 81 81 f4 7e f4 00 00 00 6a 7d 9f 2c

Searching for NID 20004400 leads to page located at 0x7C00

0x7C00    6f 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7C10    82 80 00 00 90 00 00 00 00 00 00 00 22 80 00 00
0x7C20    8d 80 00 00 1c 02 00 00 00 00 00 00 00 00 00 00
0x7C30    8e 80 00 00 84 00 00 00 00 00 00 00 00 00 00 00
0x7C40    8f 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7C50    a2 80 00 00 f4 00 00 00 00 00 00 00 82 80 00 00
0x7C60    ad 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00
0x7C70    ae 80 00 00 f0 00 00 00 00 00 00 00 00 00 00 00
0x7C80    af 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7C90    c2 80 00 00 28 01 00 00 00 00 00 00 82 80 00 00
0x7CA0    cd 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00
0x7CB0    ce 80 00 00 24 01 00 00 00 00 00 00 00 00 00 00
0x7CC0    cf 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7CD0    e2 80 00 00 7c 01 00 00 00 00 00 00 82 80 00 00
0x7CE0    ed 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00
0x7CF0    ee 80 00 00 78 01 00 00 00 00 00 00 00 00 00 00
0x7D00    ef 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7D10    02 81 00 00 b0 01 00 00 00 00 00 00 82 80 00 00
0x7D20    0d 81 00 00 04 00 00 00 00 00 00 00 00 00 00 00
0x7D30    0e 81 00 00 ac 01 00 00 00 00 00 00 00 00 00 00
0x7D40    0f 81 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7D50    22 81 00 00 e4 01 00 00 00 00 00 00 82 80 00 00
0x7D60    2d 81 00 00 04 00 00 00 00 00 00 00 00 00 00 00
0x7D70    2e 81 00 00 e0 01 00 00 00 00 00 00 00 00 00 00
0x7D80    2f 81 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7D90    42 81 00 00 18 02 00 00 00 00 00 00 82 80 00 00
0x7DA0    4d 81 00 00 04 00 00 00 00 00 00 00 00 00 00 00
0x7DB0    4e 81 00 00 14 02 00 00 00 00 00 00 00 00 00 00
0x7DC0    4f 81 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
0x7DD0    24 00 20 00 ec 00 00 00 e6 00 00 00 a2 80 00 00
0x7DE0    44 00 20 00 20 01 00 00 00 00 00 00 c2 80 00 00
0x7DF0    1f 1f 10 00 81 81 f3 7c f3 00 00 00 54 f7 73 fa

I am unsure which version of Outlook created this file, but it appears that when it was created rgentries was increased to 496 bytes and the dwPadding was left off.  This is an ANSI format PST file.

I think the documentation is lacking in this area.  The doc says to use cbEnt to iterate over the structures stored in rgentries as there are other considerations (such as padding) to take into account.  It does not say that under certain circumstances dwPadding may not exist and that rgentries could end up being larger than what is specified in the documentation.  It may also be the case that rgentries is actually 496 bytes for ANSI PSTs and that dwPadding value doesn't exist at all.  I would like a little clarification on what is happening in my example please.

Answer 1

Helo Steven HW,
                        Thank you for your inquiry about [MS-PST] protocol. One of the Open specifications team member will contact you shortly.

 
Regards,
Sreekanth Nadendla
Microsoft Windows Open specifications

Answer 2

Hi Steven, I am the engineer who will be working with you on this issue. I am currently researching the problem and will provide you with an update soon. Thank you for your patience.

---

Josh Curry (jcurry) | Escalation Engineer | Open Specifications Support Team

Answer 3

Hi Steven, would it be possible for you to share your PST file with me? You can send that to me at dochelp(at)microsoft(dot)com and reference this thread.

In the first set of bytes above, are you showing a portion of the root page of the NBT?

---

Josh Curry (jcurry) | Escalation Engineer | Open Specifications Support Team

Answer 4

Steven, please disregard my previous post. There is no need to send me your PST file. I see the issue that you are referring to.

It appears that the rgentries array in the BTPage above contains 31 entries, each of which is 16 bytes, for a total of 496 bytes. Per MS-PST section 2.2.2.7.7.1, in an ANSI PST file the limit should be 492 bytes with 4 bytes of padding before the 4 bytes preceeding the page trailer.

I will continue to look into this and let you know when I have more information.

---

Josh Curry (jcurry) | Escalation Engineer | Open Specifications Support Team

Answer 5

Thanks Josh.  It would also be nice to know if the size specified for the entires in the documentation is incorrect for UNICODE PST's as well.

Answer 6

Also, the BTPage Diagram here (http://msdn.microsoft.com/en-us/library/ff385991%28v=office.12%29.aspx) shows that the page trailer for ANSI BTPages is 16 bytes, but the description says it's 12 bytes.

Answer 7

Hi Steven, thank you for pointing that out. I will submit a request to have that fixed as well.

---

Josh Curry (jcurry) | Escalation Engineer | Open Specifications Support Team

Answer 8

Hi Steven, I have been able to confirm that what you are seeing in your ANSI PST file is the correct behavior. When cLevel is 0x0 the rgEntires array will be 496 bytes total with no padding between it and cEnt. I have filed a request to have this corrected in the documentation. Thank you for bringing this to our attention.

---

Josh Curry (jcurry) | Escalation Engineer | Open Specifications Support Team