Comments in WMF files

Windows Metafile (WMF) is a vector graphics format native to Microsoft Windows 3.x. It was succeeded by Enhanced Metafile (EMF) in 32-bit versions of Windows, but it seems to have remained in use, alongside EMF, long after Windows 3.x became obsolete. It was often embedded inside other file formats, such as PowerPoint (.ppt) or Write (.wri), so it was more widely used than it may have appeared to be.

Based on any moderately recent version of Microsoft’s WMF specification, there doesn’t appear to be a good way to store private application-defined data in a WMF file. But in an older specification, we find:

2.3.6.1 META_ESCAPE Record [= 0x0626]

EscapeFunction (2 bytes): A 16-bit unsigned integer that defines the escape function. The value MUST be one of the values in the MetafileEscapes Enumeration.

and:

2.1.19 MetafileEscapes Enumeration

MFCOMMENT [= 0x000F]: Adds arbitrary private data to the metafile. This data MAY be completely application-specific and undefined in this specification.

In a modern specification (I’m using v20171201), META_ESCAPE is still there, but there is no sign of MFCOMMENT. MetafileEscape #0x000F still exists, but it’s now named META_ESCAPE_ENHANCED_METAFILE.

The documentation of META_ESCAPE_ENHANCED_METAFILE says nothing about private data. Instead, it describes a way to embed EMF data in a WMF file. Weirdly, it does talks about “comment records”, and has fields it names “CommentIdentifier” and “CommentType”. But nowhere does it explain what a comment record is.

So, it appears that Microsoft did some revisionist history. At some point they decided they no longer wanted MFCOMMENT records to be used. Instead of simply advising programmers not to use them, they deleted all information about how to use them. But there was one type of MFCOMMENT record that they still wanted to allow: the embedded-EMF record. So they changed the documentation to say that MetafileEscape #0x000F is only for embedded EMF, and renamed it from MFCOMMENT to META_ESCAPE_ENHANCED_METAFILE. My web searches failed to turn up the story of why this happened.

This would all be okay if nobody had ever created private MFCOMMENT records. But that’s not the case. Even my small collection of WMF files has a handful of different MFCOMMENT records that are not META_ESCAPE_ENHANCED_METAFILE records. There are some that were clearly created by PowerPoint, and others containing the string “Adobe Systems, Inc.” According to the old specification, these are perfectly valid MFCOMMENT records. But according to the modern specification, they are malformed META_ESCAPE_ENHANCED_METAFILE records.

Just to give a specific example, this file <FONTSHOW.WRI> has two embedded WMF files with MFCOMMENTs, beginning at file offsets 271 and 32662.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s