3.1.4.7.3 Type System

Each value (in BinXml encoding) of templates has an accompanying type. Likewise, each value has an accompanying byte length. This is redundant for fixed size types, but is necessary for variable-length types such as strings and binary large objects (BLOBs).

Each BinXml type has a canonical XML representation. This is the format used to represent the value when the BinXml is rendered as XML text. The following table gives the meaning of each type and also lists its canonical XML representation by association with XSD types. An XS: prefix specifies the XML Schema namespace (as specified in [XMLSCHEMA1.1/2:2008]), and an EVT: prefix specifies types defined in the event.xsd (as specified in [MSDN-EVENTS]).

The binary encoding of all number types MUST be little-endian. Additionally, no alignment is assumed in the binary encoding for any of these types.

This table can be used to convert between BinXml and canonical XML. That is, if an application converts BinXml to text, the binary form on the left is replaced with the type on the right, where the type column corresponds to a field in the ABNF, as specified in section 2.2.12.

 BinXml type

 Meaning

 Canonical XML representation

NullType

No value.

"" ( Empty String )

StringType

A sequence of [UNICODE] characters. Not assumed to be null terminated. The string length is derived from the byte length accompanying value.

xs:String

AnsiStringType

A sequence of ANSI characters. Not assumed to be null terminated. The string length is derived from the Byte length accompanying value.

xs:String

Int8Type

A signed 8-bit integer.

xs:byte

UInt8Type

An unsigned 8-bit integer.

xs:unsignedByte

Int16Type

A signed 16-bit integer.

xs:short

UInt16Type

An unsigned 16-bit integer.

xs:unsignedShort

Int32Type

A signed 32-bit integer.

xs:int

UInt32Type

An unsigned 32-bit integer.

xs:unsignedInt

HexInt32Type

An unsigned 32-bit integer.

evt:hexInt32

Int64Type

A signed 64-bit integer.

xs:long

UInt64Type

An unsigned 64-bit integer.

xs:unsignedLong

HexInt64Type

An unsigned 64-bit integer.

evt:hexInt64

Real32Type

An IEEE 4-byte floating point number.

xs:float

Real64Type

An IEEE 8-byte floating point number.

xs:double

BoolType

An 8-bit integer that MUST be 0x00 or 0x01 (mapping to true or false, respectively).

xs:Boolean

BinaryType

A variable size sequence of bytes.

xs:hexBinary

GuidType

A 128-bit UUID, as specified in [C706], for example, {2d4d81d2-94bd-4667-a2af-2343f9d83462}. The canonical form in XML contains braces.

evt:GUID

SizeTType

A 32-bit unsigned integer, if the server is a 32-bit platform; or a 64-bit unsigned integer, if the server is a 64-bit platform.

evt:hexInt32 or Evt::hexInt64

FileTimeType

An 8-byte FILETIME structure, as specified in [MS-DTYP] Appendix A.

xs:dateTime

SysTimeType

A 16-byte SYSTEMTIME structure, as specified [MS-DTYP].

xs:dateTime

SidType

A binary representation of the SID, as specified in [MS-DTYP]. While the structure has variable size, its length is contained within the data itself. The canonical form is the output of the Security Descriptor Definition Language (SDDL) string SID representation, as specified in [MS-DTYP].

xs:string

BinXmlTyp

e

Specified in section 3.1.4.7.4.

Show: