PidTagExtendedRuleMessageCondition format

Question

I am trying to reconcile the description of the PidTagExtendedRuleMessageCondition in [MS-OXCSPAM] with the SRestriction format in [MS-OXCDATA].
Firstly, contrary to what [MS-OXCDATA] states, the restriction format used by the search folders (which I was able to read in the past) and that used by PidTagExtendedRuleMessageCondition is clearly different. The restriction type size is different (1 bytes vs 4), strings in search folder restrictions have length prefixes, while PidTagExtendedRuleMessageCondition strings do not (they are 0x0 terminated), etc.

Would it be possible to review the propety format? Even the example given in [MS-OXCSPAM] makes no sense from the [MS-OXCDATA] point of view.
Firstly, it looks like the first 2 bytes must be skipped (why?).
Third byte (0x) is RES_AND, bytes 4 through 7 are the number of RES_AND element (4 bytes, not 1), etc.

Thanks!

0000: 00 00 00 02 00 00 00 01-02 00 00 00 01 03 00 00

0010: 00 03 00 00 01 00 1F 00-1F 0C 1F 00 1F 0C 62 00

---

OutlookSpy and Redemption - http://www.dimastr.com

Answer 1

Dmitry,

Thank you for your questions. One of our engineers will be following up with you shortly in regards to this inquiry.

Dominic Salemno
Senior Support Escalation Engineer

Answer 2

Dmitry,

I am the engineer who has taken ownership of your issue. I am currently investigating your questions and shall follow-up with you as things progress.

Dominic Salemno
Senior Support Escalation Engineer

Answer 3

Dmitry,

Upon reviewing [MS-OXCDATA], I was unable to locate SRestriction, I assume you are referring to SizeRestriction in Section 2.13.8?
If I understand your inquiry correctly, you believe [MS-OXCSPAM] to be incorrect in the denotation of the PidTagExtendedRuleMessageCondition property?

Dominic Salemno
Senior Support Escalation Engineer

Answer 4

Looks like I am not taking into account NamePropertyInformation prefix. Let me see whta's going on...
Thanks1

---

OutlookSpy and Redemption - http://www.dimastr.com

Answer 5

Dmitry,

Did you find sufficient information to the resolution of your issue?

Dominic Salemno
Senior Support Escalation Engineer

Answer 6

I think so, I will know more this weekend.
If I run into problems, I'll post in this thread.

Thank you!

---

OutlookSpy and Redemption - http://www.dimastr.com