Hello trid users,
some days ago i want to remove the Windows Media Player and had some
difficulties to do that. So i looked at the files belonging to Windows Media
Player. In this session i will only handle files with name suffix WMZ.
So i run trid utility on my WMZ examples (about 46). Many of my samples are
described correctly with highest priority as "Windows Media Player skin" by
wmz.trid.xml with correct file name suffix WMZ and no mime type. These samples
are also described with lower priority as "ZIP compressed archive" by
ark-zip.trid.xml with mime type application/zip and wrong file suffix
ZIP. Some samples (often with name Revert.wmz) are only described as ZIP
archive whereas also many Revert.wmz are described correctly.
For comparison reason i also run the file format identification utility DROID
(See
https://sourceforge.net/projects/droid/). Here the examples are described
as "ZIP Format" with mime type application/zip by PUID x-fmt/263. For samples
with WMZ suffix the names are considered as invalid (EXTENSION_MISMATCH true).
For comparison reason i also run file command (version 5.45) on the
samples. Here samples described as ZIP by TrID are here also generic as "Zip
archive data" (see appended output/file-5.45.txt). Therefore the mime type is
here also application/zip (see appended file-i-5.45.txt in output). The file
name suffix is also not recognized (see appended file-ext-5.45.txt in output).
For control reasons i looked inside WMZ samples with help of unpacking tool
7-zip (see appended 7z-l.txt in output). Here i see no difference between the
recognized samples like (Revert-ok.wmz) and not detected samples (like
$R5O0I0N.wmz Revert.wmz). All samples are here also described as zip
type. That is expressed inside TrID definition by construct like:
<Bytes>504B0304</Bytes>
<ASCII> P K</ASCII>
<Pos>0</Pos>
All samples contain some JavaScript files (with file names like *.js) and
apparently Windows Media Player specific instruction files (with file names
like *.wms). These facts were expressed inside global strings section by lines
like:
<String>.JSPK</String>
<String>.WMSPK</String>
According to zip documentation after the file name in local file header can
come extra field. If there is no extra filed then afterwards the next zip
fragment starts which it self start with PK magic string.
Apparently the not detected sample contains some extra fields in local
header. This can be verified when running 7-zip with option -slt to show
technical information for list command (see appended 7z-l-slt.txt in
output). For the recognized samples there are no characteristics after file
name whereas for not detected samples there are characteristics (like
UT:MAC:1) after file name.
So i update wmz.trid.xml by running tridscan. Now i get inside global strings
section only one line like:
<String>.WMS</String>
That is what you expected for samples with extra field. The 2 byte string PK
vanished after file name extension. For the JavaScript samples this would
shrink to 3 byte string .JS but that is considered as too short by trid. So
the line for JavaScript totally vanished.
In the TrID definition a page on Microsoft server was used. Unfortunately this
link is dead. So i replace it with a link on another better suited page on
Microsoft server. That is expressed by line like:
<RefURL>
https://support.microsoft.com/en-us/topic/file-types-supported-by-windows-media-player-32d9998e-dc8f-af54-7ba1-e996f74375d9 </RefURL>
In current definition no mime type is listed. Because WMZ are ZIP archives the
could the associated mime type, but i found on Microsoft server an own
type. That information can also be found on extension page of nirsoft.net
server. So this mime type is now expressed by line like:
<Mime>application/x-ms-wmz</Mime>
With the updated trid definition now all my Windows Media Player skins are
described. TrID definitions and output are stored in archive wmz_.zip. I hope
that my definition can be used in future version of triddefs.
Unfortunately the file name suffix is also used for other file formats. I will
try to handle this in future session.
With best wishes
Jörg Jenderek
