POI-HPBF - A Guide to the Publisher File Format
Overview
Document Streams
The file is made up of a number of POIFS streams. A typical file will be made up as follows:
Changing Text
If you make a change to the text of a file, but not change how much text there is, then the CONTENTS stream will undergo a small change, and the Contents stream will undergo a large change.
If you make a change to the text of a file, and change the amount of text there is, then both the Contents and the CONTENTS streams change.
Changing Shapes
If you alter the size of a textbox, but make no text changes, then both Contents and CONTENTS streams change. There are no changes to the Escher streams.
If you set the background colour of a textbox, but make no changes to the text, (to finish off)
Structure of CONTENTS
First we have "CHNKINK ", followed by 24 bytes.
Next we have 20 sequences of 24 bytes each. If the first two bytes at 0x1800, then that sequence entry exists, but if it's 0x0000 then the entry doesn't exist. If it does exist, we then have 4 bytes of upper case ASCII text, followed by three little endian shorts. The first of these seems to be the count of that type, the second is usually 1, the third is usually zero. The we have another 4 bytes of upper case ASCII text, normally but not always the same as the first text. Finally, we have an unsigned little endian 32 bit offset to the start of the data for this, then an unsigned little endian 32 bit offset of the length of this section.
Normally, the first sequence entry is for TEXT, and the text data will start at 0x200. After that is normally two or three STSH entries (so the first short has values 0, then 1, then 2). After that it seems to vary.
At 0x200 we have the text, stored as little endian 16 bit unicode.
After the text comes all sorts of other stuff, presumably as described by the sequences.
For a contents stream of length 7168 / 0x1c00 bytes, the start looks something like:
We think that the first 4 bytes of text describes the the function of the data at the offset. The first short is then the count of that type, eg the 2nd will have 1. We think that the second 4 bytes of text describes the format of data block at the offset. The format of the text block is easy, but we're still trying to figure out the others.
Structure of TEXT bit
This is very simple. All the text for the document is stored in a single bit of the Quill CONTENTS. The text is stored as little endian 16 bit unicode strings.
Structure of PLC bit
The first four bytes seem to hold the count of the entries in the bit, and the second four bytes seem to hold the type. There is then some pre-data, and then data for each of the entries, the exact format dependant on the type.
Type 0 has 4 2 byte unsigned ints, then a pair of 2 byte unsigned ints for each entry.
Type 4 has 4 2 byte unsigned ints, then a pair of 4 byte unsigned ints for each entry.
Type 8 has 7 2 byte unsigned ints, then a pair of 4 byte unsigned ints for each entry.
Type 12 holds hyperlinks, and is very much more complex. See org.apache.poi.hpbf.model.qcbits.QCPLCBit for our best guess as to how the contents match up.
by Nick Burch