using System; namespace BinaryObjectScanner.Models.CFB { /// public sealed class FileHeader { /// /// Iddentification signature for the compound file structure, and MUST be /// set to the value 0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1. /// public ulong Signature; /// /// Reserved and unused class ID that MUST be set to all zeroes (CLSID_NULL) /// public Guid CLSID; /// /// Version number for nonbreaking changes. This field SHOULD be set to /// 0x003E if the major version field is either 0x0003 or 0x0004. /// public ushort MinorVersion; /// /// Version number for breaking changes. This field MUST be set to either /// 0x0003 (version 3) or 0x0004 (version 4). /// public ushort MajorVersion; /// /// This field MUST be set to 0xFFFE. This field is a byte order mark for /// all integer fields, specifying little-endian byte order. /// public ushort ByteOrder; /// /// This field MUST be set to 0x0009, or 0x000c, depending on the Major /// Version field. This field specifies the sector size of the compound file /// as a power of 2. /// /// If Major Version is 3, the Sector Shift MUST be 0x0009, specifying a /// sector size of 512 bytes. /// /// If Major Version is 4, the Sector Shift MUST be 0x000C, specifying a /// sector size of 4096 bytes. /// public ushort SectorShift; /// /// This field MUST be set to 0x0006. This field specifies the sector size /// of the Mini Stream as a power of 2. The sector size of the Mini Stream /// MUST be 64 bytes. /// public ushort MiniSectorShift; /// /// This field MUST be set to all zeroes. /// public byte[] Reserved; /// /// This integer field contains the count of the number of directory sectors /// in the compound file. /// /// If Major Version is 3, the Number of Directory Sectors MUST be zero. This /// field is not supported for version 3 compound files. /// public uint NumberOfDirectorySectors; /// /// This integer field contains the count of the number of FAT sectors in the /// compound file. /// public uint NumberOfFATSectors; /// /// This integer field contains the starting sector number for the directory stream. /// public uint FirstDirectorySectorLocation; /// /// This integer field MAY contain a sequence number that is incremented every time /// the compound file is saved by an implementation that supports file transactions. /// This is the field that MUST be set to all zeroes if file transactions are not /// implemented. /// public uint TransactionSignatureNumber; /// /// This integer field MUST be set to 0x00001000. This field specifies the maximum /// size of a user-defined data stream that is allocated from the mini FAT and mini /// stream, and that cutoff is 4,096 bytes. Any user-defined data stream that is /// greater than or equal to this cutoff size must be allocated as normal sectors from /// the FAT. /// public uint MiniStreamCutoffSize; /// /// This integer field contains the starting sector number for the mini FAT. /// public uint FirstMiniFATSectorLocation; /// /// This integer field contains the count of the number of mini FAT sectors in the /// compound file. /// public uint NumberOfMiniFATSectors; /// /// This integer field contains the starting sector number for the DIFAT. /// public uint FirstDIFATSectorLocation; /// /// This integer field contains the count of the number of DIFAT sectors in the /// compound file. /// public uint NumberOfDIFATSectors; /// /// This array of 32-bit integer fields contains the first 109 FAT sector /// locations of the compound file /// public SectorNumber[] DIFAT; } }