Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!cs.utexas.edu!ut-emx!chrisj
From: chrisj@ut-emx.UUCP (Chris Johnson)
Newsgroups: comp.sys.mac
Subject: Re: The not-so-new virus
Message-ID: <19511@ut-emx.UUCP>
Date: 12 Oct 89 15:32:06 GMT
References: <3248@ur-cc.UUCP> <744@sys.uea.ac.uk>
Reply-To: chrisj@emx.UUCP (Chris Johnson)
Organization: U.T. Austin Computation Center
Lines: 23

I posted an article on this STR resource 801 in MacWrite documents business
several days ago to comp.virus, but it hasn't appeared yet.  Here's a short
form version...

You can *expect* to find two STR resources in MacWrite files created by 
(at least) versions 4.5 and 4.6 (probably a few other versions, too).  The
IDs of these resources will be 700 and 801.  They belong there.

To quote from an old copy of Tech. Note #12, "Disk Based MacWrite Format":

"FONT MAPPING - In the document's resources is a resource of type STR with
	the ID #801.  It contains a mapping of font resource IDs and infor-
	mation on real fonts...."

STR 700, by the way, is a table containing the fifteen most commonly used 
letters in the language of the MacWrite that created the document.  It's used
by MacWrite for nibble-wise text compression and decompression.

I hope this helps to dispell a bit of paranoia... :-)

----Chris (Johnson)
----Author of GateKeeper
----chrisj@emx.utexas.edu