微软MS-CFB官方文档：解析Office文件格式技术详解

需积分: 5 52 浏览量更新于2024-07-17 收藏 1.47MB PDF 举报

"[MS-CFB].pdf"文档是微软官方发布的关于复合文件二进制文件格式（CompoundFileBinaryFileFormat）的规范，版本为2018年9月12日。该文档的主要目的是为了帮助开发者解析和逆向分析Word、Excel和PowerPoint等Microsoft Office文档的底层结构，以便于软件开发和兼容性处理。文档的核心内容围绕着以下几点： 1. 知识产权声明：文档包含了微软对于开放规格文档的知识产权保护，指出Microsoft发布的此类技术文档涵盖了协议、文件格式、数据可移植性和计算机语言等方面的信息。这些文档不仅用于技术交流，还涉及了不同协议之间的关系和交互。 2. 版权政策：尽管这个文档可能受微软版权保护，但允许用户出于开发目的复制和分发文档内容，以便在实施描述在此文档中的技术时使用。开发者可以在自己的实现中使用文档中提供的schema、IDL（接口描述语言）和代码示例，甚至对其进行修改，只要目的是正确地文档化他们的实现。 3. 适用范围：这份文档特别关注的是复合文件格式，这是Microsoft Office中一种常用的存储机制，将多个独立的文件（如文本、图像、表格等）组合成一个单一的文件，便于管理。它被广泛应用于各种Office应用程序中，包括Word的.docx、Excel的.xlsx和PowerPoint的.pptx文件。 4. 版本更新：文档的发布日期为2018年9月12日，这意味着此后可能会有后续更新或修订，开发者应定期查阅以确保对最新标准的了解。通过深入理解并遵循[MS-CFB]规范，开发者能够更好地处理Microsoft Office文档的读写操作，包括但不限于加载、修改、保存和提取元数据，以及处理嵌套的容器和流结构。这对于开发支持这些文档的应用程序或工具来说是至关重要的知识基础。同时，了解文档格式的细节也有助于优化文件大小、提高性能和确保数据的一致性与兼容性。

8 / 46

[MS-CFB] - v20180912

Compound File Binary File Format

Release: September 12, 2018

case that two replicas contain "the same objects". In this usage, objects in two replicas are

considered the same if they have the same value of the identifying attribute and if there is a

process in place (replication) to converge the values of the remaining attributes. When the

members of a set of replicas are considered to be the same, it is common to say "an object" as

shorthand referring to the set of corresponding objects in the replicas.

object class: In COM, a category of objects identified by a CLSID, members of which can be

obtained through activation of the CLSID.

parent object: An object is either the root of a tree of objects or has a parent. If two objects have

the same parent, they must have different values in their relative distinguished names (RDNs).

See also, object in section 1 of [MS-ADTS] and section 1 of [MS-DRSR].

root storage object: A storage object in a compound file that must be accessed before any other

storage objects and stream objects are referenced. It is the uppermost parent object in the

storage object and stream object hierarchy.

sector: The smallest addressable unit of a disk.

sector chain: A linked list of sectors, where each sector can be located in a different location

inside a compound file.

sector number: A nonnegative integer identifying a particular sector that is located in a

compound file.

sector size: The size, in bytes, of a sector in a compound file, typically 512 bytes.

storage: A storage object, as defined in [MS-CFB].

storage object: An object in a compound file that is analogous to a file system directory. The

parent object of a storage object must be another storage object or the root storage

object.

stream: An element of a compound file, as described in [MS-CFB]. A stream contains a sequence

of bytes that can be read from or written to by an application, and they can exist only in

storages.

stream object: An object in a compound file that is analogous to a file system file. The

parent object of a stream object must be a storage object or the root storage object.

Stream object: A Server object that is used to read and write large string and binary properties.

unallocated free sector: An empty sector that can be allocated to hold data.

Unicode: A character encoding standard developed by the Unicode Consortium that represents

almost all of the written languages of the world. The Unicode standard [UNICODE5.0.0/2007]

provides three forms (UTF-8, UTF-16, and UTF-32) and seven schemes (UTF-8, UTF-16, UTF-16

BE, UTF-16 LE, UTF-32, UTF-32 LE, and UTF-32 BE).

user-defined data: The main stream portion of a stream object.

UTF-16: A standard for encoding Unicode characters, defined in the Unicode standard, in which the

most commonly used characters are defined as double-byte characters. Unless specified

otherwise, this term refers to the UTF-16 encoding form specified in [UNICODE5.0.0/2007]

section 3.9.

MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as defined

in [RFC2119]. All statements of optional behavior use either MAY, SHOULD, or SHOULD NOT.

9 / 46

[MS-CFB] - v20180912

Compound File Binary File Format

Release: September 12, 2018

1.2 References

Links to a document in the Microsoft Open Specifications library point to the correct section in the

most recently published version of the referenced document. However, because individual documents

in the library are not updated at the same time, the section numbers in the documents may not

match. You can confirm the correct section numbering by checking the Errata.

1.2.1 Normative References

We conduct frequent surveys of the normative references to assure their continued availability. If you

have any issue with finding a normative reference, please contact dochelp@microsoft.com. We will

assist you in finding the relevant information.

[MS-DTYP] Microsoft Corporation, "Windows Data Types".

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC

2119, March 1997, http://www.rfc-editor.org/rfc/rfc2119.txt

[UNICODE3.0.1] The Unicode Consortium, "Unicode Default Case Conversion Algorithm 3.0.1", August

2001, http://www.unicode.org/Public/3.1-Update1/CaseFolding-4.txt

[UNICODE5.0.0] The Unicode Consortium, "Unicode Default Case Conversion Algorithm 5.0.0", March

2006, http://www.unicode.org/Public/5.0.0/ucd/CaseFolding.txt

1.2.2 Informative References

[MS-OLEDS] Microsoft Corporation, "Object Linking and Embedding (OLE) Data Structures".

[MS-OLEPS] Microsoft Corporation, "Object Linking and Embedding (OLE) Property Set Data

Structures".

[MSDN-SS] Microsoft Corporation, "Structured Storage", http://msdn.microsoft.com/en-

us/library/aa380369.aspx

[MSDN-STGMC] Microsoft Corporation, "STGM Constants", http://msdn.microsoft.com/en-

us/library/aa380337.aspx

1.3 Overview

A compound file is a structure that is used to store a hierarchy of storage objects and stream

objects into a single file or memory buffer.

A storage object is analogous to a file system directory. Just as a directory can contain other

directories and files, a storage object can contain other storage objects and stream objects. Also like a

directory, a storage object tracks the locations and sizes of the child storage object and stream

objects that are nested beneath it.

A stream object is analogous to the traditional notion of a file. Like a file, a stream contains user-

defined data that is stored as a consecutive sequence of bytes.

The hierarchy is defined by a parent object/child object relationship. Stream objects cannot

contain child objects. Storage objects can contain stream objects and/or other storage objects, each of

which has a name that uniquely identifies it among the child objects of its parent storage object.

The root storage object has no parent object. The root storage object also has no name. Because

names are used to identify child objects, a name for the root storage object is unnecessary and the

file format does not provide a representation for it.

10 / 46

[MS-CFB] - v20180912

Compound File Binary File Format

Release: September 12, 2018

Figure 3: Example of a structured storage compound file

A compound file consists of the root storage object with optional child storage objects and stream

objects in a nested hierarchy. Stream objects can contain user-defined data that is stored as an array

of bytes. Storage objects can contain an object class GUID that is called a class identifier (CLSID),

which can identify an application that can read/write stream objects under that storage object.

The benefits of compound files include the following:

 Because the compound file implementation provides a file system-like abstraction within a file,

independent of the details of the underlying file system, compound files can be accessed by

different applications on different platform operating systems. The compound file can be a generic

container file format that holds data for multiple applications.

 Because the separate objects in a compound file are saved in a standard format, any browser

utility that is reading the standard format can list the storage objects and stream objects in the

compound file, even though data within a particular object can be in a proprietary format.

 Standardized data structures exist for writing certain types of stream objects--for example,

summary information property sets (for more information about property sets, see [MS-OLEPS]).

Applications can read these stream objects by using parsers for these data structures, even when

the rest of the stream objects cannot be understood.

The compound file implementation constructs a level of indirection by supporting a file system within a

file. A single flat file requires a large contiguous sequence of bytes on the disk. By contrast, compound

files define how to treat a single file as a structured collection of storage objects and stream objects

that act as file system directories and files, respectively.

剩余45页未读，继续阅读

delete_513

粉丝: 1
资源: 2

微软MS-CFB官方文档：解析Office文件格式技术详解

aesJS.zip，包含aes.js和crypto-js.js

加密解密资源包crypto-js、aes.js、sha(1-512).js、md5.js、mode-cfb.js(系列)等等

SPD-Conv-main.zip

Docker从零走向实战视频（上）.zip

《狼》教学设计.docx

房屋租赁平台：提升租赁交易透明度的数字化路径

四轮独立驱动横摆角速度控制，LQR 基于LQR算法的 基于二自由度动力学方程，通过主动转向afs和直接横摆力矩dyc实现的横摆角速度跟踪 ，模型包括期望横摆角速度，质心侧偏角，稳定性因素，lqr模块等

ESP8266、ESP32网页配网 支持中文SSID

Python圣诞节倒计时与节日活动管理系统

双目立体匹配三维重建点云C++ 本工程基于网上开源代码进行修改，内容如下： 1.修改为 VS2015 Debug win32 版本，支持利用特征点和 OpenCV 立体匹配算法进行进行三维重建及显示

最新资源

四轮独立驱动横摆角速度控制，LQR 基于LQR算法的基于二自由度动力学方程，通过主动转向afs和直接横摆力矩dyc实现的横摆角速度跟踪，模型包括期望横摆角速度，质心侧偏角，稳定性因素，lqr模块等

ESP8266、ESP32网页配网支持中文SSID