A Word 6.0 or Word 95 document is a compound file with one document stream,
WordDocument. The File Information Block at the start of it has fixed offsets.
Microsoft published no specification of this version of the FIB; the offsets below are
those seen in real files and used by other readers.
Base fields
| Offset | Size | Field | Meaning |
|---|---|---|---|
0 | 2 | wIdent | 0xA5DC |
2 | 2 | nFib | 101 in Word 6.0, 104 in Word 95 |
4 | 2 | nProduct | The build that wrote the file |
6 | 2 | lid | The language identifier of the program |
8 | 2 | pnNext | A page holding an AutoText FIB (512-byte pages) |
10 | 2 | flags | Bit 0: template; bit 1: AutoText; bit 2: fast-saved (fComplex); bit 3: has pictures; bits 4–7: quick saves; bit 8: password protected |
12 | 2 | nFibBack | The oldest compatible version |
14 | 4 | lKey | A key used by password protection |
18 | 2 | environment and flags | |
20 | 2 | chse | The character set of the text: 0 Windows ANSI, 256 Macintosh |
22 | 2 | chseTables | The character set of style names and other tables |
24 | 4 | fcMin | Where the text begins |
28 | 4 | fcMac | Where the text ends |
32 | 4 | cbMac | The length of the stream that is used |
Text lengths
| Offset | Size | Field | Meaning |
|---|---|---|---|
0x34 | 4 | ccpText | Characters in the main document |
0x38 | 4 | ccpFtn | Footnotes |
0x3C | 4 | ccpHdd | Headers and footers |
0x40 | 4 | ccpMcr | Macro text |
0x44 | 4 | ccpAtn | Comments |
0x48 | 4 | ccpEdn | Endnotes |
0x4C | 4 | ccpTxbx | Text boxes |
0x50 | 4 | ccpHdrTxbx | Text boxes in headers |
Offset and length pairs
From offset 0x58 come pairs of a 32-bit offset and a 32-bit length, in the
WordDocument stream. Their order, as far as is known here:
StshfOrig, Stshf (the style sheet), PlcffndRef,
PlcffndTxt, PlcfandRef, PlcfandTxt,
PlcfSed, a page table, PlcfPhe, SttbfGlsy,
PlcfGlsy, PlcfHdd, PlcfBteChpx,
PlcfBtePapx, PlcfSea, SttbfFfn (fonts), the field
tables, SttbfBkmk, PlcfBkf, PlcfBkl, then
Cmds, macro and printer data, Dop, SttbfAssoc
and Clx.
Password protection
Bit 8 of the flags says the file is password protected. Without the password the text is scrambled; the FIB itself remains readable.