int for(ensic){blog;}

Let's use the example from the last post again:

<EventID>1234</EventID>

This was encoded as follows:

0x0f 0x01 EventID 0x02 1234 0x04 0x00

The contained value, the EventID, is an unsigned 16bit integer. The internal code for this data type is 0x06.
The value shall be stored in slot no. 3 of the substitution array. Note that the index is zero-based.

We now replace the value in the sequence above with a placeholder, the NormalSubstitution system token:

0x0f 0x01 EventID 0x02 0x0d 0x0003 0x06 0x04 0x00

As it can be seen here, the system token is followed by a DWORD stating the slot number and the type.

A NormalSubstitution token will unconditionally insert the corresponding value from the substitution array. While this was the normal procedure in the early beta versions of Vista (hence the name), it's the exception nowadays. Usually there will be an OptionalSubstitution system token. In the final encoding only the token code will change:

0x0f 0x01 EventID 0x02 0x0e 0x0003 0x06 0x04 0x00

The optional substitution mechanism first checks the type code recorded in the proper slot of the substitution array. If it is different from TypeNull (0x00), the optional substitution will behave like a normal substitution. If, however, the type is TypeNull then the element which embeds the substitution will be suppressed. In the above example, this would be the whole <EventID> container element.

08/12/2007: Fixed two typos in the code samples. Thanks to "newsoft" for the report.