3.1.2.4 Run 1

  • Article

The first run is 11 bytes long.

 000010: 41 00 04 20 57 58 59 5a 0d 6e 7d

Bytes

Description

41

Control byte: 0x41

Bits: %b01000001

00 04

Dictionary reference: 0004

Offset: 0x000 (0)

Length: [0x4+2](6)

Content: "{\rtf1"

20

' '

57

'W'

58

'X'

59

'Y'

5a

'Z'

0d 6e

Dictionary reference: 0d6e

Offset: 0x0d6 (214)

Length: [0xe+2](16)

Content: "WXYZWXYZWXYZWXYZ"

7d

'}'

After the first dictionary reference and the first five literal tokens are processed, the dictionary is as follows.

 WritePosition: 218
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\rtf1 WXYZ
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output is now as follows.

"{\rtf1 WXYZ"

 000018:0d 6e 7d

The next token in the input is a dictionary reference at offset 214 and length 16. There are only 4 bytes in the dictionary following that offset. As each byte of the dictionary reference is copied to the output, it is also added to the dictionary. Therefore, after the first four bytes of the dictionary reference are copied, the dictionary is as follows.

 WritePosition: 222
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195b\i\u\tab\tx{\ref1 WXYZWXYZ
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The offset from which the dictionary reference is being copied has now been advanced from 214 to 218, which points to the newly written bytes, so the expansion continues with those bytes. The full expansion of the dictionary reference leads to a dictionary of the following.

 WritePosition: 234
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195b\i\u\tab\tx{\ref1 WXYZWXYZWXYZWXYZWXYZ
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output is as follows.

"{\ref1 WXYZWXYZWXYZWXYZWXYZ"

There is one more literal token in this run, as follows.

 00001a: 7d

When decoded, this token leads to a dictionary of the following.

 WritePosition: 235
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\ref1 WXYZWXYZWXYZWXYZWXYZ}
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output is as follows.

"{\ref1 WXYZWXYZWXYZWXYZWXYZ}"