This is an amazing tool, but I found a little bug in your code! about ruler HOT 3 OPEN

Reading through this it looks like the flag bug was likely because of the ReadUnicodeString bug

        } else if property.PropertyType == PtypString {
                   trow.ValueArray, pos = utils.ReadUnicodeString(pos, resp)
                   rows[k] = append(rows[k], trow)
-                 if len(trow.ValueArray) > 0 { //empty string means no extra null byte.
-                            pos++
-                 }

The flag needs to be set in the loop as it should be part of the PropertyRow (page 70): https://interoperability.blob.core.windows.net/files/MS-OXCDATA/%5BMS-OXCDATA%5D-080627.pdf
I worked off of the RopQueryRows Response documented here: https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxcrops/45a36946-5db6-4342-9403-80958fbe537c

from ruler.

Thanks for trying it out and the kind words @l0kihardt!

It seems like the ReadUnicodeString bug might be playing a role in this bug report as well: #121 (comment)

I'll have a look at these asap, but your suggestions make sense 😃

Thanks again 🙏

from ruler.

Yeah, I think you are correct. I found that the response of the form display request has different formats...
Some of the delimiters are 0x00 0x00 0x00 0x00, and others are 0x00 0x00 0x00 0x01

But as the picture I uploaded before shows, there is only two NULL byte as the delimiters.
Then if you use the same parse program, there will be some bug.

from ruler.