Re: RFC: WMI Enhancements

["Pali Rohár" <pali.rohar@gmail.com>]

[-- Attachment #1: Type: Text/Plain, Size: 1283 bytes --]

I updated my bmfdec.c (git://github.com/pali/bmfdec.git) and here is
guessed header description:

/*
 * BMF file is compressed by DS-01 algorithm with additional header:
 * 4 bytes: 46 4f 4d 42 - 'F' 'O' 'M' 'B'
 * 4 bytes: 01 00 00 00 - version 0x01
 * 4 bytes: size of compressed data (low endian) without this header
 * 4 bytes: size of decompressed data (low endian) without this header
 */

/*
 * Decompressed part of BMF file contains:
 * 4 bytes: 46 4f 4d 42 - 'F' 'O' 'M' 'B'
 * 4 bytes: N = size of first part (low endian) since beginning
 * N-8 bytes: first part data
 * 16 bytes: 42 4d 4f 46 51 55 41 4c 46 4c 41 56 4f 52 31 31 - "BMOFQUALFLAVOR11"
 * M bytes: second part data of unknown length
 */

First part of decompressed data contains UTF-16 strings terminated by
two zero bytes and between two strings are some binary data. Those
strings are just literals found in decompiled MOF file, so looks like
binary parts just decodes types and MOF language keywords.

And it looks like second part is not required and sometimes missing.
It contains only binary data, no idea what is there.

Now somebody with knowledge of MOF language should be able to describe
what and how is stored in first part.

-- 
Pali Rohár
pali.rohar@gmail.com

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]