Blackberry COD file format. Part II.

Ok. Here is the next piece of Blackberry pie. In my previous post I presented a header structure of COD file. Another major structure of COD file is a data segment header structure. It starts from offset 0x2C plus codfh.code_size:

typedef struct {
ubyte
flags;
ubyte
version;
ushort
num_icalls;
ubyte
num_modules;
ubyte
num_classes ;
ushort
exported_string_offset;
ushort
data_bytes_offset;
ushort
empty_field;
ushort
class_definitions;
ushort
array_of_unknow_fields[14];
ushort
aliases;
ushort
array_of_unknow_fields[22];
} DATASEGTHEADER;

SizeOf (DATASEGHEADER) = 0x34
The next structure is

ushort classes_offsets[num_classes];

each record represents an offset from the begining of a data segment and points to a CLASS_STRUC.

Then we have

ushort module_offset;

ushort modules_offsets [num_modules-1];

ushort modules_offsets2[num_modules];

I still need to research this a bit, but usually module_offset field stores an offset to a string with a program or library name, modules_offsets array contains a similar offsets to additional modules if a program or library has more than one COD file. The modules_offsets2 contains an offset to a string with a version number (?).

Well the next post will be about DATABYTES and CLASS_STRUC structures.

8 Responses to Blackberry COD file format. Part II.

  1. Charlie says:

    Hey I find this reverse engineering of the blackberry interesting. Where did you happen to come by the resources to gain this information? It seems that this is proprietary to RIM I am unable to locate information to do my own research on RIM cod executables.

  2. Dr. Bolsen says:

    Mate, I’ll be back soon and happy to answer your question.

  3. Intman says:

    Any success here ?

  4. Alakananda says:

    Hi
    I am working as a gaming engg. we generally deal with blackberry devices . so i will be glad if i will some more info regarding .cod files

  5. Spelunker says:

    Is this thread alive yet?

  6. vietpa says:

    Hi,
    I’m looking for your next topic
    DATASEG & TAIL

    Regards.

  7. sc0ty says:

    Hi, I found a mistake here:

    ushort array_of_unknow_fields[14];
    ushort array_of_unknow_fields[22];

    both should be ubyte. Still great job.

  8. adepoju says:

    Please hOw can switch back my bbm contact from a friend phone bbm i mistakingly use my I.d for in his new bbm. Pls help me out

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: