Hi
all.
I need some help
with something.
I am trying to get
some info out of a file that was created by someone else, and there IS some
doumentation, BUT, I am not sure if I have got the below
right.
Here is info from
the document :-
4 byte EventPack
structure:
xxxx0000 00000000
00000000 00000000 - event class (4 bits)
0000xx00 00000000 00000000 00000000 - event flags (2 bits)
000000xx xx000000 00000000 00000000 - event session (4 bits)
00000000 00xxxxxx 00000000 00000000 - event type (6 bits)
00000000 00000000 xxxxxxxx xx000000 - event size (10 bits)
00000000 00000000 00000000 00xxxxxx - event owner (6 bits)
0000xx00 00000000 00000000 00000000 - event flags (2 bits)
000000xx xx000000 00000000 00000000 - event session (4 bits)
00000000 00xxxxxx 00000000 00000000 - event type (6 bits)
00000000 00000000 xxxxxxxx xx000000 - event size (10 bits)
00000000 00000000 00000000 00xxxxxx - event owner (6 bits)
I have figured it
out like this :-
//declaration
:-
var eventpack :
arry[0..3] of byte;
//read
it eventpack from a memory stream
oMemStream.ReadBuffer(EventPack, sizeof(EventPack));
This is the bit I am
not sure I have right :-
ieventclass := eventpack[0] and
$F0;
ieventflags := eventpack[0] and $0C;
iTmpSession1 := (eventpack[0] and $03 ) shl 2;
iTmpSession2 := (eventpack[1] and $C0) shr 6;
ieventsession := iTmpSession1+ iTmpSession2;
ieventtype := eventpack[1] and $3F;
ieventsize :=(eventpack[2] * 4)+ ((eventpack[3] and $C0) shr 6);
ieventowner :=(eventpack[3] and $3F);
ieventflags := eventpack[0] and $0C;
iTmpSession1 := (eventpack[0] and $03 ) shl 2;
iTmpSession2 := (eventpack[1] and $C0) shr 6;
ieventsession := iTmpSession1+ iTmpSession2;
ieventtype := eventpack[1] and $3F;
ieventsize :=(eventpack[2] * 4)+ ((eventpack[3] and $C0) shr 6);
ieventowner :=(eventpack[3] and $3F);
Am I right? if not,
can someone please guide me here?
Thanks,
Jeremy Coulter
-------------------------------------------------------------------
All email scanned with Nortons Antivirus 2002
-------------------------------------------------------------------