OLE fields

The OLE fields should actually rather be called long binary fields. They can contain a number of different kinds of values. I know of the following:

Modern packages

They start with an 8 byte header:

Name Length Type Description
Storage Type 4 bytes UINT 32 LE
  • 0 Uncompressed package
  • 1 Compressed package (DEFLATE)
Uncompressed Size 4 bytes UINT 32 LE The uncompressed size of the package.

The package then follows this header. If it is a compressed package, the bytes are compressed using the DEFLATE algorithm. Use the zlib library to uncompress them.

The package consists of a short header and the payload:

Name Length Type Description
Package Header Length 4 bytes UINT 32 LE
    The total length of this header. The payload size is (uncompressed size) - (package header length)
Unknown 4 bytes UINT 32 LE Contains the value 1
Extension Length 4 bytes UINT 32 LE The length (in characters) of the file name extension / file type.
Extension 2n bytes CHAR 16 LE The file name extension of the payload, zero terminated, in UCS-2 / UTF-16.

The rest of the package is the payload, ie. the wrapped file.