A .ppt file is a Compound File (also called an OLE2 or Compound File Binary
file), a small file system inside one file. The same container holds Word
(.doc) and Excel (.xls) files. Microsoft specifies it in
[MS-CFB]. A compound file holds named streams, which can be arranged in storages. Its data
is held in numbered sectors, and each stream is a chain of sectors, which need not be next
to each other.
0x0000Header signature, sector sizes, where the tables start512 bytes0x0200Sectors numbered from 0: FAT, directory, mini FAT and stream data512 or 4,096 bytes each
The header
The first 512 bytes are the header. Numbers are little-endian. A sector number can be a real sector or one of the special values at the end of this section.
| Offset | Size | Field | Value |
|---|---|---|---|
| 0x00 | 8 | Signature | D0 CF 11 E0 A1 B1 1A E1 |
| 0x08 | 16 | Header CLSID | Reserved, all zero. |
| 0x18 | 2 | Minor version | 0x003E. |
| 0x1A | 2 | Major version | 3 (512-byte sectors) or 4 (4,096-byte sectors). |
| 0x1C | 2 | Byte order | 0xFFFE: little-endian, the only order. |
| 0x1E | 2 | Sector shift | 9 for version 3, 12 for version 4: a sector is 2 to this power. |
| 0x20 | 2 | Mini sector shift | 6: a mini sector is 64 bytes. |
| 0x22 | 6 | Reserved | Zero. |
| 0x28 | 4 | Directory sectors | 0 in version 3, which does not count them. |
| 0x2C | 4 | FAT sectors | How many sectors hold the FAT. |
| 0x30 | 4 | First directory sector | A sector number. |
| 0x34 | 4 | Transaction signature | Zero. |
| 0x38 | 4 | Mini stream cutoff | 4,096: streams smaller than this live in the mini stream. |
| 0x3C | 4 | First mini FAT sector | A sector number, or ENDOFCHAIN. |
| 0x40 | 4 | Mini FAT sectors | A count. |
| 0x44 | 4 | First DIFAT sector | A sector number, or ENDOFCHAIN. |
| 0x48 | 4 | DIFAT sectors | A count. |
| 0x4C | 436 | DIFAT | The first 109 FAT sector numbers. |
A version 4 file has a 4,096-byte header sector: the rest of it is zero.
| Value | Name | Meaning |
|---|---|---|
| 0xFFFFFFFF | FREESECT | Unallocated. |
| 0xFFFFFFFE | ENDOFCHAIN | The last sector of a chain. |
| 0xFFFFFFFD | FATSECT | A sector that holds the FAT. |
| 0xFFFFFFFC | DIFSECT | A sector that holds the DIFAT. |
Sectors
Sector 0 starts directly after the header. Sector n is at byte (n + 1) × sector size. A file is meant to be a whole number of sectors; some writers cut the last sector short.
The FAT
The File Allocation Table is a list of 32-bit values, one per sector. The value for sector n is the next sector of the same chain, or a special value. The sectors that hold the FAT are listed by the DIFAT.
The DIFAT
The header has room for 109 FAT sector numbers. A larger file continues in DIFAT sectors, each with 127 entries (in a 512-byte sector) followed by the number of the next DIFAT sector.
The mini stream and the mini FAT
Streams smaller than the cutoff are stored in the mini stream, a stream made of 64-byte mini sectors, chained by the mini FAT in the same way as the FAT chains sectors. The mini stream itself is held in the sectors of the root storage’s stream.
The mini FAT
The mini FAT has one 32-bit value per mini sector and is held in its own chain of sectors, which starts at the sector named in the header.
The directory
The directory is a chain of sectors of 128-byte entries, one per storage or stream. Entries form a red-black tree by name: a storage’s Child field is the root of the tree of what it holds.
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 64 | Name | UTF-16LE, ending with a zero character, at most 31 characters. |
| 64 | 2 | Name length | In bytes, including the zero character. |
| 66 | 1 | Object type | 0 unused, 1 storage, 2 stream, 5 root storage. |
| 67 | 1 | Colour | 0 red, 1 black. |
| 68 | 4 | Left sibling | Entry number, or 0xFFFFFFFF. |
| 72 | 4 | Right sibling | Entry number, or 0xFFFFFFFF. |
| 76 | 4 | Child | For a storage, the root of its tree. |
| 80 | 16 | CLSID | A class id for a storage. |
| 96 | 4 | State bits | Application flags. |
| 100 | 8 | Created | FILETIME; zero for streams. |
| 108 | 8 | Modified | FILETIME; zero for streams. |
| 116 | 4 | Start sector | A stream’s first sector or mini sector; for the root, the mini stream’s first sector. |
| 120 | 8 | Size | The stream’s size in bytes. Version 3 uses only the low 32 bits. |
The streams of a presentation
| Stream | Holds |
|---|---|
Current User | The CurrentUserAtom: where the newest edit is. Required. |
PowerPoint Document | The records of the presentation. Required. |
Pictures | The pictures, when there are any. |
\005SummaryInformation | Title, author, dates and statistics. |
\005DocumentSummaryInformation | Company, category and more properties. |
PP97_DUALSTORAGE | A storage that holds the streams in the 97 format, in files saved for two versions at once. See older versions. |
EncryptedSummary | Encrypted properties of an encrypted file. |
Reference
- [MS-CFB] – Microsoft’s specification of the compound file container