Binary file: Does this look like a link list?
 

Hello all,

I was hope someone can help me figure out what these, what appears to be, pointer addresses. The file was generated by a program called DVdraw which is part of DataViews. This is a very old version that was generated on a Sparc 20. So I assume the file is Big-Endian.

I generated a small binary file and added records using the DVdraw app. This is the hex output of the first record.

Records seem to start with As you can see in Offset 81H, you see and next to it , which to me tells DVdraw that there are no more records. (I could be wrong about the offset, it may start at Offset 80H, but you still have 00 00 00 00 at Offset 84H). At Offset 9CH, it's a byte and tells DVdraw the label's length (starting at Offset 9DH).

Here it is with two records. As you can see, the contents of Offset 85H has been replaced to "point to" the second record (Offset C2H) and at Offset C6H is 0's. Again, I could be off by one location.

Here it is with three records.

So there is a pattern but I can't figure this part out. I hope someone can throw out some suggestions. I have no idea how to predict the next "address".

it seems that they are placed inside pairs.

one_record.png: 15 1d e8 00 -> 15 1d e8 00
two_records.png: 15 1d e8 00 -> 15 1d e8 00, 16 36 80 00 -> 16 36 80 00
three_records.png: 15 1d e8 00 -> 15 1d e8 00, 16 36 80 00 -> 16 36 80 00, 16 3f f0 00 -> 16 3f f0 00,

on three_records.png you forgot to highlight the starting 15 1d e8 00. got any bells ring to it?

edit: maybe you just have to iteratively search all pairs until you find 00 00 00 00.