DB2
Documented by VX.
File structure
section | description | notes |
---|---|---|
header | main information about file contains | |
table indexes | used rows counter | not exist if a string columns not present |
sum of lengths of all strings in row | ||
main table | ||
strings | all strings in table | if string columns not present, one zero byte exist anyway |
I think would be more handy explain this on sample
Item-sparse.db2 is more useful because contain a string type columns
Header
offset | 0 1 2 3 | reference | 4 5 6 7 | reference | 8 9 A B | reference | C D E F | reference |
---|---|---|---|---|---|---|---|---|
00000000 | 57444232 | *1 | E0C00000 | *2 | 83000000 | *3 | 0C020000 | *4 |
00000010 | B8BA1500 | *5 | 4EE59B91 | *6 | 37350000 | *7 | 00000000 | *8 |
00000020 | 19000000 | *9 | CF0C0100 | *10 | 01000000 | *11 | 00000000 | *12 |
- 1 "WDB2" just a file header
- 2 number of rows (h0000C0E0 = 49376 rows)
- 3 number of columns (h00000083 = 131 columns)
- 4 bytes per row. originally all columns size is 4 bytes, but not always (for sample in KeyChain.db2 only first column size is 4 bytes, but all other is 1 byte per column)
- 5 size of strings data block (h0015BAB8 = 1424056 bytes)
- 6 unknown. looks like a some hash and different for different files, but stay static for different version of same files
- 7 client minor version (revision). also read reversed i.e. h00003537 = 13623
- 8 unknown. always saw only as zero
- 9 first row index. it's a first used row in table (h00000019 = 25). zero, if string columns not present.
- 10 last row index h00010CCF = 68815. zero, if string columns not present.
- 11 locale code. for eu clients is:
code locale 08000000 deDE 01000000 enGB 40000000 esES 04000000 frFR 00010000 ruRU
- 12 unknown. always saw only as zero
Table indexes
this section separated on two:
- used rows counter
- sum of lengths of all strings in row
used rows counter
this section is a solid 4 byte cells from first used index till last include unused. it's ordinary counter what skip unused rows.
for sample, if you have array with used "rows" 4,5,7,10 it means this section for this array would be:
cell value | in hex | array (row) index |
---|---|---|
begin of section | ||
1 | 01000000 | 4 - first used row. value from field *9 of header) |
2 | 02000000 | 5 |
0 | 00000000 | unused |
3 | 03000000 | 7 |
0 | 00000000 | unused |
0 | 00000000 | unused |
4 | 04000000 | 10 - last used row. (value from field *10 of header) |
end of section |
Length of strings in row
this section simple like previous, but has 2 byte per cell. as previous from first used row till last include unused. value for unused rows equal zero too, but value for used rows is a length of all strings from all columns in this row include zero separator for each.
for sample, if you row has a 3 string field:
"str1","string2","string 3"
length would be = length1+1 + length2+1 + length3+1 = 4+1 + 7+1 + 8+1 = 22 = h1600
Main table
contain only used rows data. have no idea how it detect field (column) type.
string column contain an offset to used string. for sample, if strings section begins from h019116FA and offset is 11, it means string must be at h0191170B. uses till first zero byte.
Strings
- contain all strings separated by zero byte.
- section begins and ends by zero byte.
- if section is not used (no string columns in table), one zero byte exists anyway.
Thanks
Carlos Ramzuel. files converted by his parser was greatly useful.