Share via

2.11.1.1 COUNT Data Type Values

  • Article

COUNT data type values are either 2 bytes or 4 bytes, depending on the context where this data type is referenced, though within a given buffer, they are 2 bytes or 4 bytes, never a mix of the two. COUNT values are typically used to specify the size of an associated field.

In the context of ROP buffers, byte counts for PtypBinary property values are 16 bits wide and value counts for all PtypMultiple property values are 32 bits wide. But in the context of extended rules, as specified in [MS-OXORULE] section 2.2.4, byte counts and property value counts are 32 bits wide.

Such "count" fields have a width designation of COUNT, rather than an explicit width, throughout section 2.11.1.