Template GUID variable type

Log Out | Topics | Search Moderators | Edit Profile

Author Message   mikat Username: mikat Registered: N/A Posted on Friday, Dec 11, 2009 - 17:18:    Hi, I've been trying to display partition GUIDs in a template I've made. I was just using hex at first and noticed things were a bit switched around. I found that "the first three blocks are byte-swapped" in a partition type GUID so I tried getting each of those blocks individually and switching endian-ness with no change. Then I discovered there was actually the GUID variable type and I tried that. That gave me the beginning correctly but the end appeared wrong (after the 9th byte). Maybe I'm missing something. Here it is for a Windows Microsoft Reserved Partition - How it displays in WinHex main window and if I do hex 16 in the template: 16 E3 C9 E3 5C 0B B8 4D 81 7D F9 2D F0 02 15 AE When I use GUID in the template: {E3C9E316-0B5C-4DB8-8100-040000000000} What it should be: E3C9E316-0B5C-4DB8-817D-F92DF00215AE What is causing the difference and what should I do to display GUID correctly? Thanks for any help!   Stefan Fleischmann Username: admin Registered: 1-2001 Posted on Friday, Dec 11, 2009 - 23:20:    I cannot reproduce this phenomenon. Feel free to e-mail a screenshot that shows the template and the data window with the offset and hex column with that GUID in the background.   mikat Username: mikat Registered: N/A Posted on Monday, Dec 14, 2009 - 17:44:    Ok, email sent!   Stefan Fleischmann Username: admin Registered: 1-2001 Posted on Tuesday, Dec 15, 2009 - 11:19:    Thanks, will be fixed in the next version.