Descriptions of Omega TradeStation’s MWRKArea.WRK File

When someone performs the import wizard of Omega TradeStation’s ELD file, the platform should first carry out the ELD extraction routine before proceed to the next step.

After that, it will provides the user with the options to select which analysis types and names that is registered in the decompressed ELD file, which now in the form of files with .WRK file extension.

Suppose I have exported ELD file which contains ActivityBar analysis type and myTest1 as its name, then the import wizard will show the selection list for the analysis types to be imported :

And then the available analysis techniques to be imported, after the user pressed the next button :

We have already known that the decompressed ELD file consists of several WRK files, but the question is, which of the WRK file that the application is accessed to convey the above information (i.e. the analysis type and analysis techniques) ?

The answer, it turns out, is inside the MWRKArea.wrk file. This file is accessed via orlib20!LoadMasterRecsEX function which accepts analysis type code as one of its parameter. In the above case, the type code for ActivityBar analysis type is 0x3.

The LoadMasterRecsEX function in turns, using the WaitForSingleObject for certain event. As I have already explained in previous article, this routine usually waits for the thread that eventually calls to some method(s) in the WHServer.exe application.

To prove the above statement, and also to determine which method that gets called in the thread for LoadMasterRecsEX function, using WinDBG, I performed break before the entry to the function. Then, after I arrive at the desired breakpoint location, I performed break at any of the ObjectStublessClient* calls.

After performing breakpoint in the above fashion, I then performed WinDBG’s g (continue execution) statement. And the ObjectStublessClient* that is invoked at this time happened to be ObjectStublessClient49. This stubless calls is actually mapped to the GetPropertiesList method in WHServer.exe application.

So, it is conjectured that it is inside the GetPropertiesList method that the analysis types and analysis techniques is obtained from MWRKArea.wrk file.

To prove the above conjecture, let’s view the MWRKArea.wrk file using the compound file storage object viewer :

From the above screen shot, it is obvious that the L_3 stream name convey the analysis type, and the list of available techniques for ActivityBar will be recorded inside the L_3 stream. The application will created each stream for each analysis type.

Now, when I change the L_3 to L_1 using the hex editor at the time when the MWRKArea.wrk is created just before it is compressed to ELD file via orlib20!ZipDir routine at export wizard, the import wizard will show :

Now instead of ActivityBar, it now show Function as its analysis type name, which is analysis type description for code 0x1.

The conclusion is, among the other information, the MWRKArea.wrk contains list of exported analysis techniques that is grouped based on analysis types.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: