Analyzing some Windows Write files

Write is the word processing program that came with Microsoft Windows 3.x (and earlier versions of Windows, but it’s 3.x that I’m concerned with here). Many thousands of free and shareware programs were written for Windows 3.x, and a lot of them include some documentation in Write’s WRI file format. Objectively, most of them should have used the HLP help file format instead. But Microsoft made it very difficult and/or expensive to create an HLP file, whereas WRI was extremely easy to create, at no extra charge. So, WRI it was.

I’m not so interested in the actual words in WRI files, but they can also contain images, and other objects, stored in a variety of different ways. I wanted to learn how to extract these things (for Deark, my file decoder utility), so I decided to download a bunch of Windows 3.x software, in search of WRI files, to see what was in them.

To start with, I decided on a collection named “CICA – The Ultimate Collection of Shareware for Windows”, which is available on two CD-ROM images that you can get from the Internet Archive. I unpacked all the ZIP and similar files on the CDs, and found about 800 items with at least one WRI file, for a total of about 1100 WRI files.

Let’s dig into WRI format. I’m going to use some terminology based on the only WRI documentation I can find, but it’s unofficial, and I don’t know how correct the terminology is.

The main contents of a WRI file are divided into elements called “paragraphs”.

Paragraph

Roughly speaking, there are three kinds of paragraph:

  • Text
  • Header or footer definition
  • “Picture”

“Text” is what it sounds like. “Picture” is the only kind of paragraph I’m interested in.

Paragraph / Picture

“Picture” isn’t a great name for Picture paragraphs. “Object” might be better. But I’ll stick with “Picture”.

There are three known “storage types” that a Picture paragraph can have:

  • Bitmap
  • Metafile
  • OLE Object

In the files I analyzed, there are a total of 1074 Picture paragraphs, broken down as follows:

Storage type   Count
Bitmap            66
Metafile         333
OLE object       675

Paragraph / Picture / Bitmap

The “Bitmap” picture type is uncommon. It only appears in older WRI files, and apparently was only used for black and white images.

It’s easy enough to decode, though I found a few examples where the image seems to be corrupt. Or maybe I’m doing it wrong.

Paragraph / Picture / Metafile

“Metafile” means WMF, a vector graphics format. While there can sometimes be interesting things inside metafiles, that’s beyond the scope of this post.

Paragraph / Picture / OLE Object

This segment has some WRI-specific fields, followed by a standard OLE1.0 object. (Well, sometimes it’s a standard OLE1.0 object.)

There are three kinds of objects it could contain: static, embedded, or linked. I didn’t find any files that use the “linked” type.

Type         Count
static         350
embedded       325
linked           0

Paragraph / Picture / OLE Object / Static

A static “OLE object” is just an embedded image, not associated with an external application.

This object type is a little strange, because it’s not a legal OLE object type, at least not according to modern OLE documentation. It appears to be the same format as a “Presentation” object (a part of an embedded object), except that the FormatID field is 3 instead of 5.

Not that there’s anything wrong with that. Write can use whatever format it wants here; it doesn’t have to be valid OLE. But it does make me wonder if this is an undocumented OLE feature.

There are three types of static OLE objects, and I found examples of each:

Type            Count
"BITMAP"           83
"DIB"             243
"METAFILEPICT"     24

Paragraph / Picture / OLE Object / Static / DIB

“DIB” is the common “DIB” (device independent bitmap) image format. It’s a BMP file, but without the file header.

Paragraph / Picture / OLE Object / Static / METAFILEPICT

“METAFILEPICT” is just another way of storing a WMF metafile.

Paragraph / Picture / OLE Object / Static / BITMAP

“BITMAP” is an old-style “device-dependent bitmap”, similar to the “Picture / Bitmap” format above, except that color images definitely are allowed here. The portability of these images seems to be poor. And I could not get Windows 3.1 Write to display any of them, which is weird, because that’s allegedly the only version of Write that creates OLE Objects.

Paragraph / Picture / OLE Object / Embedded

This part of the format is officially documented. It’s an “OLE1.0 EmbeddedObject”.

And embedded OLE object contains data associated with another application, in a format suitable for that application. Its type is indicated by a “ClassName” field. Embedded data types found:

Type               Count
"PBrush"             267
"ShapewareVISIO20"    26
"Package"             12
"MSDraw"               4
"CDraw"                3
"PhotoPaint"           3
"PaintShopPro"         2
"Word.Document.6"      2
"WordArt"              2
"EnhancerImage"        1
"Excel.Chart.5"        1
"ExcelWorksheet"       1
"Word.Picture.6"       1

The “PBrush” and “Package” types are discussed below. Some of the others contain a standard file format that can be usefully extracted, but each needs to be investigated individually. And, of course, this is just a list of the types I found, not a complete list of all the possibilities.

An embedded object can optionally contain a “Presentation” object, which is a simple graphic that can be used as an icon, or similar. The possible types are the same as for “static” objects. Presentation objects found:

Type            Count
"BITMAP"            0
"DIB"               4
"METAFILEPICT"     60

Windows icons are raster graphics, but the metafile (vector) format is probably used so that transparency can be supported.

Paragraph / Picture / OLE Object / Embedded / PBrush

This is an object associated with Windows Paintbrush, the paint program that came with Windows 3.x. In all cases I’ve seen, it’s in the form of a standard Windows BMP image file.

Paragraph / Picture / OLE Object / Embedded / Package

The “Package” type is what you get when you simply drag and drop a file (say, from File Manager) onto your Write document. It can also be created using the “Insert Object” command, which opens the Object Packager utility. That gives you more flexibility.

For an idea of the things a Package could contain, here’s part of the table of contents from the Object Packager help file:

I found some attempts to document the Package data format, though I don’t think they’re perfect. But it seems to be a straightforward format in the case that it contains a complete document. It has a label/caption, a filename that I think is the source of the icon, an icon number, a code number of some sort, the original filename, and the embedded contents of the file.

Packages that contain a complete document are just the sort of thing I’m looking for, but unfortunately, at least in my set of test files, they are quite rare. I found only four examples: two WRI files, one WAV audio file, and one MIDI music file. The other Packages in my test files appear to be links or special commands.

WRI in WRI

I don’t want to pick on anyone, but I can’t resist bringing up one of the programs, CHGWALL.ZIP, which comes with two WRI files (the documentation in two languages). The author attempted to make each file link to the other, so that you could click on an icon in one file, and the other file would be opened. That’s possible, I think, but not necessarily easy.

What the author actually did was to make each file contain a complete copy of the other file. Which is technically impossible, but Write tried its best. After updating the embedded content a few times, the result is that file-1 contains a copy of file-2, which contains an older version of file-1, which contains an older version of file-2, and so on (until you get back in time to before the files were embedded):

References

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s