I have a structured storage file that I am working to reverse engineer. The object has multiple streams embedded within it - some of which are compressed. After decompressing the streams I am left with the resulting data which I know for a fact contains both handles and pointers to different objects. My question is that, if you assume I know what I am looking at is a pointer, then does the pointer point to a location within each stream embedded in the structured storage or does it point to a location in the structured storage as a whole?

How would I even be able to tell? Is it safe to assume that due to the compression the pointer values must be meant for the individual streams?

0

There are 0 answers