exFAT OEM Parms and the GUID


In my former post https://rshullic.wordpress.com/2010/01/08/sample-c-program-to-parse-out-the-exfat-directory-structure/ where I provided a crude program to parse out the exFAT filesystem I started the definitions with OEM Parameters.

 

In searching for the structure again, I found a copy at http://technet.microsoft.com/de-de/office/ee490605 and it also shows up at other sites today.

One interesting statement is: #define OEM_FLASH_PARAMETER_GUID 0A0C7E46-3399-4021-90C8-FA6D389C4BA2

Now, when I was doing my research back in 2009, I did not have flash memory, did not have Windows CE, and even when the SDXC card came it on 2010, was not able to afford one.

But, a couple of weeks ago I bought two SANDISK 64GB SDXC Media cards and started to browse them using WinHex. Now the OEM Parameters are in a section of the VBR, after the MEBS.

The Main Boot Region of the VBR is composed of five sub-regions of a total of 12 sectors:

  • The Main Boot Sector (MBS)
  • The Main Extended Boot Sectors (MEBS)
  • The OEM Parameters
  • A reserved sector
  • The Checksum Sector

Although the OEM Parameters are defined, they are not being used by the desktop/server exFAT driver. Because of this, until I got my hands on the SDXC card, the OEM PARMS VBR record has always been empty for my research. Then, then I browsed the SDXC card, I came up with one entry with the following GUID:

467EC0C0A99332140 C890FA6D389C4BA2

So, I contacted SANDISK and asked them for the format of this GUID because if you look at the structure, and you look at the WinHex dump, there was only one value, it looked like a big value. Also, when I searched, I could find anything.

SANDISK cam back with an interesting response, which was essentially that this confidential information and they can’t tell me.

Well, sorry SANDISK, if it was confidential, it isn’t anymore.

But, if you are doing research, here is something you may need to know:

Part of the GUID is little endian, and part is not. That is why I could not find it on a search. I had read this somewhere else as well, but I thought I’d mention it here.

The proper notation for the GUID is 5 sections, where the first 4 are little endian, and the last is a string.

{0A0C7E46-3399-4021-90C8-FA6D389C4BA2}If you compare it to the number above, you will see what is reversed and what is not.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s