Start playing with Works 7 and document CFB

This commit is contained in:
~lucidiot 2024-05-06 06:25:26 +02:00
parent a0980e69c2
commit 1319292e81
4 changed files with 107 additions and 3 deletions

99
content/cfb.md Normal file
View File

@ -0,0 +1,99 @@
---
title: Microsoft Compound File Binary
---
Compound File Binary (CFB) is a file format designed by Microsoft as part of the COM API, as an implementation of the COM Structured Storage. It may also be referred to as a Composite Document File V2, OLE container, or OLE file. It is used by a lot of Microsoft software, and even some non-Microsoft. I commonly encounter it while working on weird things at the [Morgue](./computers/#morgue).
## External links
* [Official specification][ms-cfb]
* [Wikipedia article][wiki]
* [Python package][olefile] to read and write those files, as well as some Office-specific metadata
* [7-Zip][7zip], a file archiver that can extract CFB files
## Extractor script
I wrote a smol Python script to extract a CFB file into a directory structure, to make inspection easier.
```python
#!/usr/bin/env python
import argparse
import shutil
from dataclasses import dataclass
from pathlib import Path
from olefile import OleFileIO
@dataclass
class Args:
cfb_file: OleFileIO
output_dir: Path
verbose: bool = False
def main() -> None:
parser = argparse.ArgumentParser(description="Microsoft Compound File Binary extractor")
parser.add_argument("cfb_file", type=OleFileIO)
parser.add_argument("-o", "--output-dir", type=Path, default=".")
parser.add_argument("-v", "--verbose", action="store_true", default=False)
args = parser.parse_args(namespace=Args)
args.output_dir.mkdir(exist_ok=True)
with args.cfb_file as ole:
for storage in ole.listdir(storages=True, streams=False):
dir = args.output_dir.joinpath(*storage)
if args.verbose:
print(f"Creating directory {dir} for storage {storage!r}")
dir.mkdir(exist_ok=True)
for stream_path in ole.listdir(storages=False, streams=True):
output_path = args.output_dir.joinpath(*stream_path)
if args.verbose:
print(f"Extracting stream {stream_path!r} to {output_path}")
with ole.openstream(stream_path) as stream, output_path.open("wb") as f:
shutil.copyfileobj(stream, f)
if __name__ == '__main__':
main()
```
## Occurrences
I have observed CFB in use in the following cases:
* Microsoft Office Word documents (`.doc`)
* Microsoft Office Word templates (`.dot`)
* Microsoft Office Word wizards (`.wiz`)
* Microsoft Office Excel documents (`.xls`)
* Microsoft Office Excel templates (`.xlt`)
* Microsoft Office Excel add-ins (`.xla`)
* Microsoft Office PowerPoint documents (`.ppt`)
* Microsoft Office PowerPoint templates (`.pot`)
* Microsoft Office Access data projects (`.adp`)
* Microsoft Office Access templates (`.mdz`)
* Microsoft Office Outlook messages (`.msg`)
* Microsoft Office Visio diagrams (`.vsd`)
* Microsoft Office Visio stencils (`.vss`)
* Microsoft Office Visio templates (`.vst`)
* Microsoft Office Publisher documents (`.pub`)
* Microsoft Office FrontPage and Visual Studio 6 user interface preferences (`.prf`)
* Microsoft Photodraw files (`.mix`)
* Microsoft Management Console files (`.msc`)
* Microsoft HTML Help cache (`hh.dat`)
* Microsoft Works Word Processor documents (`.wps`)
* Microsoft Works Word Processor templates (`.wpt`)
* Microsoft Works Word Processor wizards (`.wwp`)
* Microsoft Works Word Processor borders (`.ibd`)
* Microsoft Works Spreadsheet spreadsheets (`.wks`, `.xlr`)
* Microsoft Works Spreadsheet wizards (`.wws`)
* Microsoft Works Database databases (`.wdb`)
* Microsoft Works Database database backups (`.bdb`)
* Microsoft Works Database wizards (`.wwd`)
* [Microsoft Works Portfolio](./msworks/portfolio.html) (`.wsb`)
* Windows Installer packages (`.msi`)
* Windows 7 Sticky Notes (`.snt`)
[7zip]: https://7-zip.org/
[ms-cfb]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/53989ce4-7b05-4f8d-829b-d08d6148375b
[olefile]: https://github.com/decalage2/olefile/
[wiki]: https://en.wikipedia.org/wiki/Compound_File_Binary_Format

View File

@ -6,6 +6,8 @@ Under the *Format* menu of Works Word Processor, the *Format Gallery* dialog box
The default styles for templates and for blank documents are text files with a `.fmt` extension, found at `%Program Files%\Microsoft Works\<LCID>\WkThm*.fmt`. The default style for blank documents ("general") is called `WkThmGen.fmt`. Removing all the other `.fmt` files does not seem to have any effect, so I am not sure what they really are for.
The Format Gallery was introduced in Works 6.0, in 2001. I have for now tested this with Works 7.0 on Windows 98SE, 8.0 on Windows 2000, and 9.0 on Windows XP.
## Format files
::: todo

View File

@ -2,7 +2,11 @@
title: Microsoft Works Portfolio
---
The Portfolio is Microsoft Works' answer to Microsoft Office Binder. It is a lot more basic than Binder though; where Binder can transform itself into whatever program is needed to display each supported file, Portfolio just groups some files together, supports copy-pasting to and from those collections of files, lets you add comments, and lets you send those files to a new Word Processor document, a printer, an e-mail recipient or a folder. You can get a preview for a few supported formats, but to open a file, you will first have to send it to a folder and open it yourself. If you need to update the file, first remove the old file, and then put the new one back in. This is more like the Office Clipboard Manager than Binder!
The Portfolio is Microsoft Works' answer to Microsoft Office Binder. It was introduced in Works 6.0, in 2001, the same year when Office XP came out and removed Binder.
It is a lot more basic than Binder though; where Binder can transform itself into whatever program is needed to display each supported file, Portfolio just groups some files together, supports copy-pasting to and from those collections of files, lets you add comments, and lets you send those files to a new Word Processor document, a printer, an e-mail recipient or a folder.
You can get a preview for a few supported formats, but to open a file, you will first have to send it to a folder and open it yourself. If you need to update the file, first remove the old file, and then put the new one back in. This is more like the Office Clipboard Manager than Binder!
The executable for Works Portfolio is named `WksSb.exe`, which might mean *Works Shoebox*. This is not to be confused with the actual Shoebox, which is the Works clipart manager.
@ -257,4 +261,4 @@ Document those values
`BigModeMaximized`
: TODO
[ms-cfb]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/53989ce4-7b05-4f8d-829b-d08d6148375b
[ms-cfb]: ../cfb.html

View File

@ -47,7 +47,6 @@ Note that <online> tasks can use registry keys
-->
:::
### Cache
The XTR files are a static source of tasks, but tasks may also be dynamically added. `WkDStore.exe`, the Works Data Store, runs alongside all Works applications, allowing them to retrieve and store tasks and recently used files. You can view its type library using OleView, one of the tools distributed along with Visual Studio 6 and the Windows SDK.