I've read [MS-OXMSG].pdf thoroughly but still can't find out how numerical named properties (to start with) in .MSG compound files are encoded.
The docs say:
3.2.1.1.1 Numerical Named Property
The following 8 bytes represent an entry from the entry stream (in hexadecimal notation):
1C 81 00 00 08 00 05 00
The structure specified in the entry stream section is applied to these bytes to obtain the following
values:
Name identifier = 0x811C
Property index = 0x05
GUID index = 0x04
Also it says that the second 4-byte DWORD of this 8-byte block has the following little-endian format:
- property index (sequentially increasing, 2-byte WORD)
- GUID index (15-bits and "Kind" bit, zero for numeric properties). GUID index is said to be Value-3.
From the above, I'd say:
Name identifier = 0x811C
Property index = 0x08
GUID index = 0x05-3=0x02
Obviously, this differs from what is in the spec.
Checking real MSG files shows that most of them have second DWORD of 8-byte blocks as something like (in square brackets, little-endian):
0000 0000 [0700 0000]
2800 0000 [0700 0100]
5000 0000 [0700 0200]
1485 0000 [0800 0300]
I.e. sequentially increasing is the higher word of the entire DWORD (while the specs say that a property index must be the lower word in that DWORD, little-endian). As for the first word in each DWORD (0700, 0700, 0700, 0800), it's often the same for different entries. I expected it to be unique for every GUID entry (maybe not sequentially increasing but unique at least). I.e. even if the order of words in DWORD is mixed up (e.g. if somehow it's not fully little-endian so that GUID part precedes property index part), it still doesn't make any sense for me.