Hello trid users,
some days ago i handled WordPerfect files with name extension CBT.
So i looked for other WordPerfect samples. There exist samples
with FIL file name extension and names like: WPHELP.FIL.
These start with 2 letter phrase WP. That apparently is the abbreviation for
WordPerfect.
I found no information especially about file format specification about such
WordPerfect files, but luckily some basic info are found in unofficial
WordPerfect File Format description WPFF_DocumentStructure.htm. So i choose that page as
reference. That is expressed by line like:
<RefURL>
https://github.com/OneWingedShark/WordPerfect/blob/master/ doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
</RefURL>
When i run TrID on such examples these are described correctly but
unspecific like "WordPerfect (generic)" by definition wp-generic.trid.xml
(see appended output/trid-v-old.txt).
For comparison reason i also run the file utility (version 5.42). This
describes the examples as "WordPerfect" with sub classification as "help file" and "v5.0" (see appended
output/file-5.42.txt).
So i run tridscan on my examples to generate fil-wp.trid.xml. So we see that
not only the first 4 bytes are the same like \xFFWPC that is generic for all
WordPerfect samples, but also all the bytes are the same. That is
expressed by XML construct like:
<Bytes>FF57504310000000010200000000000004002200000091AB0000C6640100661E</Bytes>
<ASCII> . W P C . . . . . . . . . . . . . . " . . . . . . . . d . . f</ASCII>
<Pos>0</Pos>
Unfortunately the definition is based only on 1 sample.
At offset 4 pointer to document area is stored as 4 byte little endian
integer. In my example this value was always 10 hexadecimal. That
means only the first 16 bytes are relevant.
At offset
the 8 and 9 the product and file type are stored. In my example this value
was always 1 and 2. At offset 10 the
major version and minor version fields are stored as byte value. In my
examples this value was always 5.0 ( that are nil bytes).
Assuming that there exist examples with other document area pointer, other
encryption field and other index pointers this becomes according to
documentation like:
<Pattern>
<Bytes>FF575043</Bytes>
<ASCII> . W P C</ASCII>
<Pos>0</Pos>
</Pattern>
<Pattern>
<Bytes>0102</Bytes>
<Pos>8</Pos>
</Pattern>
With the new definition now WordPerfect help FIL example is described
more precisely ( see appended output/trid-v-new.txt). TrID definition and
output are stored in archive fil.zip. I hope that the XML file can be used
in future version of triddefs.
Unfortunately the FIL suffix is also used for other Word Perfect
files. So i mentioned this in a remark line.
With best wishes
Jörg Jenderek
