The current version of the MS-PST open specification document can be found here: http://msdn.microsoft.com/en-us/library/ff385210(office.12).aspx Introduction The PST is a structured binary file format that contains messages, folders, and attachments...

Encryption Negotiation in RDP connection The RDP connections between clients and servers are normally encrypted for better security. When we observe the network traffic to troubleshoot the RDP related problems, we may notice that the traffic between...

This article deals with the content contained in ECMA-376 Part 1. The 3rd edition of ECMA-376 was released in June of 2011 and can be downloaded from the following location: http://www.ecma-international.org/publications/standards/Ecma-376.htm Where...

This blog provides details on how the PassStub is used when establishing a remote assistance session of type 1 . It presents the password encryption flow and illustrates with Windows APIs and sample data. Remote assistance overview Remote...

This article will explain how to edit and deploy an “in-box” Netmon parser. By “in-box”, I refer to a parser that was installed with the Netmon package or was downloaded and installed via http://nmparsers.codeplex.com . The...

Alternate Calendars As you may or may not be aware, Outlook supports multiple calendars. Not only does it support multiple calendars, it also supports alternate calendar types. Some languages that enable alternate calendars are Arabic, English, Hebrew...

Yesterday, the Office Interoperability team announced the public release of the Beta version of the Microsoft Office Binary File Format Validator, also known as BFFValidator. You can read the official announcement from the Office Interoperability team...

What is NegoEx ? Why do we need it ? Before Windows 7 was introduced, applications utilize the SPNEGO to provide the ability to negotiate the authentication support between Kerberos SSP and NTLM SSP. SPNEGO itself is also implemented as a Negotiate...

In today’s fast-paced market, availability of an individual is increasingly important. Thus presents the need to be able to schedule an appointment/meeting with a person even if they are not available. Exchange provides such a service by storing...

EMF File Overview Generally, most people are familiar with two types of graphics files: bitmap and vector. Bitmapped graphics present a 1-to-1 pixel representation of an image. This is also known as raster graphics. These types of files cannot...

Hi y’all, Sebastian from Texas here! I’ve been at the File Sharing Plugfest last week. This time around I’ve had the chance to give a presentation on how we use the different sets of tools that we have at hand (both internal and...

I am writing this blog in response to a need I felt when I was new to authentication in Windows. The blog does not intend to reinvent the wheel, instead to help someone new to Windows authentication to get started and find the resources one needs to understand...

Incremental Change Synchronization ICS provides a means for the client to replicate changes in a folder or hierarchy between two different points in time. This protocol is actively used by Outlook to synchronize changes between the Exchange server...

In Part 2, I concluded my dissection of the rights managed email message example, with locating the DRMTransform\Primary stream. At the time, I didn’t go into much detail because I was focused on a) finding the message.rpmsg attachment and b) showing...

Exploring the CFB File Format 9 File Security Due to the nature of a compound file, a single file in a file-system, the operating system security mechanisms is ultimately what controls the security regarding the file in question. Using the ACL, you...

Exchange ActiveSync Provisioning EAS Provisioning is a means to download and apply devices on an activesync device. The provisioning process on a client will generally occur when the server requests that the provisioning is necessary. If a client...

Exploring the CFB File Format 8 Range Lock Sectors A range lock sector is a part of a CFB file that is used for concurrency and transactions. The range sector will only appear in files greater than 2 GB. As we have seen in previous posts, there...

Exploring the CFB File Format 7 ------------------------------- [- Red-Black Trees -] As we have seen, OLE Structured Storage files are a series of storages and streams like a modern day FAT filesystem. One design goal of a filesystem in this...

If you were not already familiar with decoding Exchange Server to Client communication, or have done so manually in the past, I present to you The Microsoft Exchange RPC Extractor (RPX). RPX is a command-line driven tool that parses network captures and...

In one of my previous blog( http://blogs.msdn.com/b/openspecification/archive/2010/11/17/encryption-type-selection-in-kerberos-exchanges.aspx ) , I have talked about how the encryption types of the various encrypted parts of the Kerberos exchanges are...

Intro I have recently received some inquiries about [MS-SSTP] . I must admit that I had to review most of the information about this “fairly” newly introduced VPN protocol (it was first shipped with Windows Vista) since I hadn’t...

Directory Entries The general concept of a CFB File is the containment of a hierarchical structure of storages and streams. These are analogous to directories and files in the traditional FAT file system used in the DOS and Windows Operating Systems...

In Microsoft Open Protocol documents, there are many algorithms that involve with crypto operations in some particular ways. Sometimes the protocol documents also provide specific protocol examples that include the initial input, the intermediate results...

This blog talks about key version number (kvno) in a read-only domain controller (RODC) environment. A previous blog introduced kvno in general. Here, I look at specifics in RODC environment. For a refresher, the kvno is a field of the EncryptedData...

Microsoft introduced a new remote desktop (RDP) technology called RemoteFX in Windows 7 SP1 and Windows Server 2008 R2 SP1. Remote FX shifts most of the graphics processing to server from client. As such, thin clients can display 3D images and stunning...