Hi Arto,

I don't see anything that could give a clue about CLSID location.

>
>I examined couples of ole field where CLSID is located in different places.
>Only logigal place (?) that differs between OLEs was in offset 0x200 - 0x250
>
>

>* CLSID in 0x800+1
>00000200 FD FF FF FF FE FF FF FF FE FF FF FF FE FF FF FF
>00000210 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>00000220 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>00000230 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>00000240 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>00000250 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>
>* CLSID in 0x8CC+1  Excel.Sheet.8
>00000200 FD FF FF FF 04 00 00 00 FE FF FF FF 05 00 00 00
>00000210 0A 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00
>00000220 09 00 00 00 0B 00 00 00 FE FF FF FF 0C 00 00 00
>00000230 FE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>00000240 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>00000250 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
>
>* CLSID in 0x900+1
>00000200 FD FF FF FF FE FF FF FF FE FF FF FF FE FF FF FF
>00000210 05 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00
>00000220 09 00 00 00 0A 00 00 00 FE FF FF FF FF FF FF FF
>00000230 0D 00 00 00 0E 00 00 00 0F 00 00 00 10 00 00 00
>00000240 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00
>00000250 04 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF
>

>
>What do you think?
>
>I try to decrypt above but will see as binary isn't my strongest asset :(
>
>AT