3.2.1.1.2 String Named Property

The following 8 bytes represent an entry from the entry stream  (in hexadecimal notation):

 10 00 00 00 07 00 05 00

The structure specified in the entry stream  section is applied to these bytes to obtain the following values:

String offset = 0x10

Property index = 0x05

GUID index = 0x03

Property Kind = 1

From these values it is determined that this is a string named property with a string offset of 0x10.

The string offset is then used to fetch the entry from the string stream  ("__substg1.0_00040102"), which is contained inside the named property mapping storage ("__nameid_version1.0"). The structure in the table specified in the string stream  section is applied to those bytes, taking into consideration that the data is stored in little-endian format.

If the string stream  is as follows:

 09 92 7D 46 35 2E 7D 1A 41 11 92 72 01 F2 30 12 00 00 00 1C 00 5A 00 5C 00 91 00 48 00 45 00 44 00 41 00 45 00 52 00 20 00 53 00 49 00 5A 00 44 8A 6F BB 4D 12 52 E4 11 09 91

The 4 bytes at offset 0x10 constitute the ULONG ([MS-DTYP]) 0x0000001C. The string name starts at 0x10 + 0x04 = 0x14 and extends till 0x14 + 0x1C = 0x2F. Hence, it will be the following:

 00 5A 00 5C 00 91 00 48 00 45 00 44 00 41 00 45 00 52 00 20 00 53 00 49 00 5A 00 44