[File] Excel BIFF 2-8 BOF Magic Decoding

Christos Zoulas christos at zoulas.com
Sun Jan 28 17:51:17 UTC 2024


Committed, thanks!

christos

> On May 8, 2023, at 5:23 PM, Brian Inglis <Brian.Inglis at Shaw.ca> wrote:
> 
> Hi folks,
> 
> Attached is ExcelBIFF2-8BOF.magic that works well with existing file and Excel magic to decode ancient Excel 2.0-8.x Binary Interchange File Format versions 2, 3, 4, 5, 8 [6 and 7 may have been MS internal only] Beginning Of File records that also happen to be generated by common PDF etc. to XLS converters, as a side effect of a personal project to extract the data, as existing xls2csv converters only work for MS Office Composite Document types.
> 
> All the required information should be included, except the sources of my test files, which I downloaded from:
> 
> 	https://telparia.com/fileFormatSamples/document/xls/
> and
> 	https://webarchive.nationalarchives.gov.uk/ukgwa/
> 
> as it allows selection by year and file types and PRONOM fmt/55... terms to get ancient formats.
> 
> Please license the attached under your standard terms, whether public domain, BSD, MIT, X, or more formal, and rename, modify, fold, spindle, mutilate to match your standards.
> 
> Some example outputs are in the attached log: personal files have been elided (tested with file -L -m /usr/share/misc/magic:ExcelBIFF2-8BOF.magic *.xl*).
> 
> The BIFF 5/8 decoding may not be seen in standalone files in the wild, except possibly for converter output, but may be helpful in combination with CDF object decoding to expand on bare V2, which do not even mention Excel, as in the attached log, towards the bottom.
> 
> I also noticed a couple of other anomalies in the attached log:
> 
> * code page is printed as signed, it should be unsigned uleshort, so "Code page: -535" should show as 65001 Unicode:
> 
> 	$ printf "%d\n" $((-535&0xffff))
> 	65001
> 
> * an xlsx file shows up as just a zip, at the bottom of the log; to download:
> 
> https://www.blackviper.com/service-configurations/black-vipers-windows-10-service-configurations/
> 
> click on EXCEL download button above table near bottom: it opens normally in my Excel emulators Gnumeric and LibreOffice calc.
> 
> -- 
> Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada
> 
> La perfection est atteinte                   Perfection is achieved
> non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
> mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
>                                 -- Antoine de Saint-Exupéry<ExcelBIFF2-8BOF_magic.DEFANGED-267587><file-m-ExcelBIFF2-8BOF-test.log>-- 
> File mailing list
> File at astron.com
> https://mailman.astron.com/mailman/listinfo/file
> <sanitizer.log>



More information about the File mailing list