Getting started with Powerpoint RRS feed

  • Question

  • I'm trying to follow the powerpoint specification here:

    I have a .ppt file  made in Powerpoint 2013. I can open the file in a text editor and see that the first 8 bytes are:

    d0cf 11e0 a1b1 1ae1

    The table for record headers shows:

    The spec also says " The packet diagrams for this documentation are big-endian"

    However, it also says

    "The underlying file format enumerations, objects, and records are little-endian."

    "Unless otherwise specified, all data in the PowerPoint Binary File Format is stored in little-endian format."

    So I'm a little confused as to what's what.

    So a1b1 1ae1 should be the recLen, right? But that can't be, because that's 2gb worth of bytes, when converted to a base 10 number.

    So how do I find the recLen?

    • Edited by G52d9f Friday, December 4, 2015 11:23 PM
    Friday, December 4, 2015 11:10 PM


All replies

  • Thank you for your question. An engineer from the Microsoft Protocols support team will contact you soon.


    Jeff McCashland | Microsoft Protocols Open Specifications Team

    Friday, December 4, 2015 11:53 PM
  • Hello G52d9f

    Bytes (xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1) you have parsed/referenced are actually CFB header signature and not PPT specific stream. Please refer section 2.2 of MS-CFB ( for further details.


    Tarun Chopra | Escalation Engineer | Open Specifications Support Team

    Saturday, December 5, 2015 7:23 AM