2.2.3.1 Marshaled Stream
A Marshaled Stream (including the EFSRPC Metadata stream) MUST be formatted as follows.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Length |
|||||||||||||||||||||||||||||||
|
0x4e |
0x00 |
0x54 |
0x00 |
||||||||||||||||||||||||||||
|
0x46 |
0x00 |
0x53 |
0x00 |
||||||||||||||||||||||||||||
|
Flag |
|||||||||||||||||||||||||||||||
|
Reserved |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Name Length |
|||||||||||||||||||||||||||||||
|
Stream Name (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Stream Data Segment 1 (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Stream Data Segment n (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
Length (4 bytes): The length, in bytes, of this stream header from the start of this field to the end of the Stream Name field. It MUST be a 32-bit unsigned integer in little-endian format.
Flag (4 bytes): This MUST be a 32-bit unsigned integer in little-endian format. It MUST be set to 0x00000000 if the stream data is encrypted with the FEK. Otherwise, it MUST be set to 0x00000001. It MUST always be set to zero in the case of the EFSRPC Metadata stream, and ignored by the server in that case.
-
Value
Meaning
0x00000000
FEK encryption present
0x00000001
FEK encryption not present
Reserved (8 bytes): This field MUST be set to zero and ignored.
Name Length (4 bytes): The length, in bytes, of the Stream Name field. It MUST be a 32-bit unsigned integer in little-endian format. This field MUST be set to 0x00000002 for the EFSRPC Metadata stream.
Stream Name (variable): The name of the stream. This is set to either a null-terminated Unicode string in UTF-16 encoding, or an integer value stored in binary form. For the EFSRPC Metadata stream, this is always set to 0x1910.
-
Value
Meaning
0x1910
EFSRPC Metadata stream
Stream Data Segment 1 ... n: These segments MUST contain the contents of the stream as well as some metadata for reassembling the segments. For encrypted streams, these segments MUST also contain some metadata to aid in decryption. They MUST be formatted as specified in section 2.2.3.2.