Wireshark-bugs: [Wireshark-bugs] [Bug 10754] cannot open rf5 file

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 06 Dec 2014 21:36:09 +0000

changed bug 10754


What Removed Added
Status CONFIRMED INCOMPLETE

Comment # 2 on bug 10754 from 
So is the the file exactly as saved on the K1205?  Or did some other programs
process it?

It begins with:

    0x95 0x22

    0x00 0x00 0x02 0x00

    the null-terminated string "2r3.4f5"

    the null-terminated string
"C:\Users\ro1h0035\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.Word\2re.rf5"

    0x00 0x00 0x03 0x00

    a 4-byte little-endian value of 45, followed by the 45-byte null-terminated
string "C:\Users\ro1h0035\AppData\Local\Temp\2re.rf5" (45 bytes including the
terminating \0)

    a 4-byte little-endian value of 8386, which is the size of the file

followed by what looks like a valid RF5 file header, in which the file size
fields have a value of 8386, suggesting that the stuff before the RF5 file
header is part of the file.

However, the count of records in the file is larger than the actual number of
records in the file.  The records themselves look OK (although some changes
needed to be made to the RF5-reading code, but the previous code was making
some incorrect assumptions).

You are receiving this mail because:
  • You are watching all bug changes.