2.2.3 EFSRPC Raw Data Format
The EFSRPC raw data format is used by the EFSRPC raw methods. The output of the EfsRpcReadFileRaw method MUST conform to this format. The input to the EfsRpcWriteFileRaw method MUST conform to the EFSRPC Raw Data Format. The details of this format are implementation dependent. An EFSRPC client SHOULD NOT parse this format and SHOULD NOT rely on it having any particular structure. An EFSRPC server MUST validate input data passed to it by the EfsRpcWriteFileRaw method, and SHOULD abort the EfsRpcWriteFileRaw operation with an RPC exception if this data is in an unsupported format.
The EFSRPC Raw Data Format SHOULD be formatted as follows.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
0x00 |
0x01 |
0x00 |
0x00 |
||||||||||||||||||||||||||||
|
0x52 |
0x00 |
0x4f |
0x00 |
||||||||||||||||||||||||||||
|
0x42 |
0x00 |
0x53 |
0x00 |
||||||||||||||||||||||||||||
|
Reserved |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
EFSRPC Metadata Stream (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Additional Stream 1 (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Additional Stream n (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
Reserved (8 bytes): MUST be set to zero and ignored.
EFSRPC Metadata Stream (variable): This field MUST be formatted as specified in section 2.2.3.1. This field MUST contain the EFSRPC Metadata for the file, along with a header. The structure of the EFSRPC Metadata is specified in section 2.2.2.
Additional Stream 1 ... n: These MUST correspond to marshaled versions of all the streams (except for EFSRPC Metadata) in the given file. They are optional and might not exist (for example, for folders with no alternate streams). For more information on NTFS file streams, see [MSFT-NTFS]. These fields MUST be formatted as specified in section 2.2.3.1.