Last active
October 7, 2021 02:29
-
-
Save poizan42/ccbdce8f667a6386783e78d1ae1d09b7 to your computer and use it in GitHub Desktop.
EwsId reverse engineered format
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
IdStorageType (byte): | |
MailboxItemSmtpAddressBased = 0, // Exchange 2007 (EwsLegacyId) | |
PublicFolder = 1, | |
PublicFolderItem = 2, | |
MailboxItemMailboxGuidBased = 3, | |
ConversationIdMailboxGuidBased = 4, | |
ActiveDirectoryObject = 5, // Exchange 2013 | |
MailboxItemMailboxGuidBasedWithFallback = 6 // Exchange 2016 | |
CompressionId (byte): | |
NoCompression = 0, | |
RleCompression = 1 | |
IdProcessingInstruction (byte): | |
Normal = 0, | |
Recurrence = 1, | |
Series = 2, | |
Multiple = 3 | |
RLE compression: | |
If two bytes following each other are distinct then the first byte is verbatim | |
If they are equal then the byte following contains count - 2, | |
i.e. if buf[i] == buf[i+1] then output buf[i] c+2 times where c = buf[i+2]. | |
(or output buf[i] and buf[i+1] are printed verbatim, then buf[i] is printed | |
buf[i+2] more times and buf[i+2] is then skipped) | |
Base64 encoded EwsId: | |
0 CompressionId compression id | |
1-... <payload (max length 1024)> | |
Decompressed payload: | |
0 IdStorageType storage type | |
1-... <storage specific content> | |
CountedContent: | |
0 Int16 len | |
1-len <content> | |
DateTime: .NET datetime, 2 bits Kind, 62 bits 100-nanosecond ticks since 01-01-01 0:00:00 UTC | |
Moniker: CountedContent | |
Email moniker: Moniker with UTF8 encoded string, max length 1000 | |
Guid moniker: Moniker with Guid as "D" format ascii string, max length 50 | |
InternetMessageId: CountedContent with UTF-8 string | |
StoreId: CountedContent, dependent on IdProcessingInstruction | |
case Multiple: | |
CountedContent+ | |
(Conversion to StoreObjectId uses first content as ENTRYID) | |
case Normal, Series: | |
ENTRYID | |
default: (Recurrence or unknown) | |
if last byte == 16: | |
OccurenceStoreObjectId | |
else: | |
ENTRYID | |
OccurenceStoreObjectId: | |
0 byte value: 8 | |
1-8 DateTime big endian OccurenceDate | |
9 ENTRYID | |
MailboxItemSmtpAddressBased storage content: | |
Email moniker MailboxId | |
IdProcessingInstruction IdProcessingInstruction | |
StoreId StoreId | |
MailboxItemMailboxGuidBased, ConversationIdMailboxGuidBased storage content: | |
Guid moniker MailboxId | |
IdProcessingInstruction IdProcessingInstruction | |
StoreId StoreId | |
MailboxItemMailboxGuidBasedWithFallback storage content: | |
Guid moniker MailboxId | |
IdProcessingInstruction IdProcessingInstruction | |
StoreId StoreId | |
InternetMessageId InternetMessageId | |
PublicFolder storage content: | |
StoreId StoreId | |
ActiveDirectoryObject: | |
CountedContent<Guid> ADObjectId | |
PublicFolderItem storage content: | |
IdProcessingInstruction IdProcessingInstruction | |
StoreId StoreId | |
StoreId FolderId | |
Id types: | |
EntryId.length == 46: FolderId | |
EntryId.length == 70: MessageId | |
(EWS validates that the EntryId has one of these length) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment