Hello trid users,
Some weeks ago i send definitions pe?-imaginfo.trid.xml for Ulead Imaginfo
thumbnails. When running newest file command ( version > 5.42 with images
1.226) it show now more information. The IMAGINFO.PE? examples are now
described as "Ulead Imaginfo thumbnail". Also the original directory with
images like "E:\iPE\CDSample\Images\PCD" and the image type like JPG or pcd
is displayed by phrase like "with JPG images". For some examples "with TPL
images" is shown. So i look for such images. I found these in sub directory
Template in program directory of software iPhoto Plus version 4.
So i run trid utility on these TPL examples. All are described generic with
low rate as "Generic OLE2 / Multistream Compound" by docfile.trid.xml. Some
are misidentified as "Windows Thumbnail Database" by thumbsdb.trid.xml (See
appended output/trid-v-old.txt)
For comparison reason i check these examples by file command utility. When
running file command (version 5.42). Here all examples are also described
generic as "Composite Document File V2 Document" (See appended
output/file-5.42.txt) or as "OLE 2 Compound Document" with -e cdf option. It
was not able to do sub classification , but it display directory entry
names. So second one apparently seem to be always TplHeader, third seems to
be TplMainImage and third seems to be TplPreview encoded at UTF-16 string
after first directory entry, which is always "Root Entry" (See appended
output/file-5.42.txt).
For comparison reason i also run the file format identification utility
DROID ( See
https://sourceforge.net/projects/droid/). This identifies all
examples also only generic as "OLE2 Compound Document Format" by PUID
fmt/111 (See appended output/droid-tpl-ulead.csv).
Because TPL are OLE2 Compound container we can inspect such examples by
suited tools like Michal Mutl Structured Storage Viewer for example. There
we see that such examples contain at least 3 streams with names shown by file
command.
Unfortunately i found no little hint with information about file
format. When searching for information i at least get a link with CD
download of software "iPhoto Plus 4". This contains such TPL samples. So i
choose that as reference URL. That is expressed by line like:
<RefURL>
https://archive.org/details/iPhoto-Plus-4</RefURL>
A little bit of information about file name suffix can be found on web sites
filext.com and file-extensions.org.
After running tridscan to generate definition tpl-ulead.trid.xml i looked
what XML construct are created and try to understand it. The first XML
construct looked like:
<Pattern>
<Bytes>D0CF11E0A1B11AE1000000000000000000000000000000003E000300FEFF09000600
<Pos>0</Pos>
</Pattern>
This looks like the starting magic of Generic OLE2 / Multistream Compound
files done by docfile.trid.xml. There this looks like:
<Pattern>
<Bytes>D0CF11E0A1B11AE1</Bytes>
<Pos>0</Pos>
</Pattern>
I would like to reduce the XML construct, but i was not able to do this. So
the byte 3E000300 means version 3.62 like reported by file command. And FFFE
sequence means little-endian.
But i have only some dozen of such TPL examples and found no hint of
information about file format. So i do not know if this is always true or
just triggered by lucky circumstances. So i keep first XML construct. The
same considerations applies to most other XML constructs.
The definition contains short nil sequences like:
<Pattern>
<Bytes>000000</Bytes>
<Pos>81</Pos>
</Pattern>
<Pattern>
<Bytes>0000</Bytes>
<Pos>1530</Pos>
</Pattern>
I assume that this are generated by lucky circumstances. So delete such
constructs.
The definition contains some short non nil sequences like:
<Pattern>
<Bytes>000004000000</Bytes>
<Pos>522</Pos>
</Pattern>
<Pattern>
<Bytes>53000000</Bytes>
<ASCII> S</ASCII>
<Pos>1864</Pos>
</Pattern>
Probably this are also generated by luck circumstances, but i am unsure
about that item. So i keep such constructs.
The relevant parts are 3 lines in global strings section like:
<String>T'P'L'P'R'E'V'I'E'W'I'M'A'G'E</String>
<String>T'P'L'M'A'I'N'I'M'A'G'E</String>
<String>T'P'L'H'E'A'D'E'R</String>
These describes streams inside TPL image.
In global section are lines, which looks like garbage like:
<String>(''')'''*'''+</String>
<String>O'''P'''Q'''R</String>
<String>O'S'-'0</String>
<String>O'S'-'1</String>
<String>O'S'-'2</String>
<String>O'S'-'3</String>
<String>$'''%</String>
<String>-'''.</String>
<String>8'''9</String>
<String>X'J0</String>
The definition contain no mime type. Because TPL are OLE2 documents i could
add generic mime type application/x-ole-storage. But i choose an user
defined one that meets image and Ulead as producer. That is expressed by
line like:
<Mime>image/x-ulead-tpl</Mime>
With the new trid definition now all my Ulead TPL examples are described now
more precisely (see appended output/trid-v-new.txt). TrID definition and
output are stored in archive tpl_cdf.zip. I hope that my XML file can be
used in future version of triddefs.
With best wishes
Jörg Jenderek
