The OLE fields should actually rather be called long binary fields. They can contain a number of different kinds of values. I know of the following:
They start with an 8 byte header:
Name | Length | Type | Description |
---|---|---|---|
Storage Type | 4 bytes | UINT 32 LE |
|
Uncompressed Size | 4 bytes | UINT 32 LE | The uncompressed size of the package. |
The package then follows this header. If it is a compressed package, the bytes are compressed using the DEFLATE algorithm. Use the zlib library to uncompress them.
The package consists of a short header and the payload:
Name | Length | Type | Description |
---|---|---|---|
Package Header Length | 4 bytes | UINT 32 LE |
|
Unknown | 4 bytes | UINT 32 LE | Contains the value 1 |
Extension Length | 4 bytes | UINT 32 LE | The length (in characters) of the file name extension / file type. |
Extension | 2n bytes | CHAR 16 LE | The file name extension of the payload, zero terminated, in UCS-2 / UTF-16. |
The rest of the package is the payload, ie. the wrapped file.