Dictionaries are laid out in sections called blocks. Some blocks are dedicated to certain tasks like block 1 being the module table, block 2 being module names, and block 3 being the block table itself.
Blocks are not numbered by where they appear in the file, instead they are numbered by their index in the block table. For instance, block 2 could be placed in the file before block 1 and block 2 would still be block 2 as long as its record is 2nd in the block table.
The block table does not have a header for itself. All you need to know is the location and size of the table from the dictionary's header.
256 records are allocated by default in a blank dictionary, and there will always be three blocks in the same position with the same types every time. Their offsets and sizes are usually different between each file.
| Block # | Type | Purpose |
|---|---|---|
| 1 | 1 | Module Table |
| 2 | 3 | Module Names |
| 3 | 6 | Block Table |
Records are 14 (0xE) bytes in size. Block number comes from the record's index in the table, starting at 1.
| Offset (hex) | Purpose | Data type |
|---|---|---|
| 00 | Block Type | UInt16 |
| 01 | ||
| 02 | Block Start Offset | UInt32 |
| 03 | ||
| 04 | ||
| 05 | ||
| 06 | Block Size (bytes) | UInt32 |
| 07 | ||
| 08 | ||
| 09 | ||
| 0A | Unused Space (bytes) | UInt32 |
| 0B | ||
| 0C | ||
| 0D |
Everything in a dictionary (except the file header) is contained in a block. Blocks are always required to have an entry in the block table.
Blocks can also have some blank space on the end that's allocated but not used yet. This blank space is marked by the Unused field in the block table. This blank space is (assumed to be) always on the end of the block.
Entire blocks also can be blank space, and are marked as type 0 in the block table. Type 0 is also for blocks that aren't allocated at all. To distinguish between unused (but allocated) and unallocated blocks, check the block table. Unallocated blocks have all zeroes for values. Unused blocks have a size and an offset defined (assumed).
Each block has a type associated with it. The type indicates what the block's contents are.
Have not been able to find anything that uses block type 5. The type value is a 16 bit integer so there theoretically could be 65,535 types.
| Type | Purpose |
|---|---|
| 0 | Unallocated/Unused |
| 1 | Module Table |
| 2 | Module Directory |
| 3 | Module Names |
| 4 | Module Data |
| 5 | Unknown |
| 6 | Block Table |