thanks.. that makes sense.. I was thinking that the values in the transaction IN added up to the values in the transaction out, but in the example I gave you, this is not the case.. Most of the time the aggregate values in tx_in was equal to the values of the tx_out..
All of the input values do add up to the output values in that block. Are you counting all of the outputs of the input transactions, perhaps?
I forgot to answer part of your original question: you can get the actual addresses by parsing the scriptSig/scriptPubKey. My tools are useful for doing the necessary conversions:
http://blockexplorer.com/q/hashpubkeyhttp://blockexplorer.com/q/hashtoaddresshttp://blockexplorer.com/q/addresstohashTransactions to addresses use:
scriptPubKey: OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <sig> <pubKey>
Various other less usual transactions use:
scriptPubKey: <pubKey> OP_CHECKSIG
scriptSig: <sig>
You can put pubKeyHash through hashtoaddress to get the address, or you can put pubKey through hashpubkey+hashtoaddress.
Addresses can't be easily determined for non-standard transactions such as this:
http://blockexplorer.com/testnet/tx/802b9e557161b9bffdc2e12cc755eb4379f88014f288c2484bb39b831bb9938e#o1