The formula is as follows:
A. File head, a total of 8 bytes B. The end address of several records country and region C. In accordance with several start addresses of starting address end address from small to large arrangements, fixed length, 7-byte D. All IPs are recorded with 4 bytes integers and follow the intel order, the high is behind, the low position is before. E. All offsets are absolutely offset, which is calculated from the beginning of the file. F. In addition to the file header uses two 4-byte offset, the remaining offsets are 3 bytes. G. All offsets are also low in front, high in H. Some string compression technology
1. File head, a total of 8 bytes firststartipoffset: 4 The absolute offset of the first start IP LastStartIPOFFSET: 4 The absolute offset of the last start IP
2. Start Address End Address Offset Recorder Each record is recorded, according to the start address from small to large
Startip: 4 Start Address, IP Endipoffset: 3 End Address absolute offset
3. End Address Country Region Record Area
Endip: 4 Country Region Record: Unordered
4. Country regional records, there are several forms 4.1. Country string, end the area string of 0x0, end with 0x0
4.2. FLAG: 1 Identification value: 0x1, there is no local record 0x2, and there is Local Record ScountryOffset: 3 The actual string is going to find the offset position to find LocalRec: Not set, optional according to FLAG. This record is similar to Country, which may be compressed
4.3 LocalRec Structure A Flag: 1 is not very understanding of this Flag meaning, value 0x1 or 0x2 slocaloffset: 3
4.4 LocalRec Structure 2 Slocal: Unlike long conformance string
Note: The location of ScountryOffset points may still be 4.2 format, do not know why this is designed.
When Flag takes 0x1, the position of ScountryOffset points to the FLAG is 0x2. At this time, LocalRec is also looking for.
I don't understand what is the logo of 0x2 when the location of the record.
In qqwry.dat, there seems to have some errors. Individual record locals will be written as: 0x2, 0x0, 0x0, 0x0 according to rules, should go to the file to find, but the most out of the file is obviously not recorded.
