.DOC File Format – File Information Block

Word 97–2003 document

Every Word binary file starts its WordDocument stream with a File Information Block (FIB). It has a fixed base and three counted arrays. The last array holds the offset and size of every other structure, in the WordDocument or table stream. All numbers are little-endian.

Layout

  1. FibBasethe identifier, version, flags and key32
  2. csw14: the number of 16-bit values2
  3. fibRgWreserved values and the East Asian language28
  4. cslw22: the number of 32-bit values2
  5. fibRgLwcbMac and the counts of characters in each part88
  6. cbRgFcLcbthe number of fc/lcb pairs2
  7. fibRgFcLcbeight bytes for each pair: offset, then lengthvaries
  8. cswNew0, or the count of the values after it2
  9. fibRgCswNewnFibNew and more, when cswNew is not zerovaries
The whole FIB. The array sizes are the values given by the specification.

FibBase

OffsetSizeFieldMeaning
02wIdent0xA5EC: Word 97 or later
22nFibThe file format version, usually 0x00C1 (193)
42unusedUndefined
62lidThe install language
82pnNextIn a template, the 512-byte page holding the FIB of its AutoText document
102flagsBit 0: a template. Bit 1: holds only AutoText. Bit 2: the last save was incremental. Bit 3: has pictures. Bits 4–7: count of quick saves. Bit 8: encrypted. Bit 9: fWhichTblStm, the table stream is 1Table. Bit 10: read-only recommended. Bit 11: write reservation. Bit 12: fExtChar. Bit 13: fLoadOverride. Bit 14: an East Asian install. Bit 15: XOR obfuscation when also encrypted.
122nFibBackThe oldest version that can read this file, 0x00BF or 0x00C1
144lKeyFor an encrypted file, the password verifier or the size of the encryption header at the start of the table stream
182flagsEnvironment and rarely used flags
2012reservedIgnored

fibRgW

Fourteen 16-bit values, mostly reserved. The last, lidFE, is the East Asian language when fFarEast is set.

fibRgLw

Twenty-two 32-bit values. Those that matter:

Offset in the arrayFieldMeaning
0cbMacThe meaningful length of WordDocument
12ccpTextCharacters in the main document
16ccpFtnCharacters in footnotes
20ccpHddCharacters in headers and footers
28ccpAtnCharacters in comments
32ccpEdnCharacters in endnotes
36ccpTxbxCharacters in text boxes of the main document
40ccpHdrTxbxCharacters in text boxes of headers and footers

fibRgFcLcb

An array of pairs: a 32-bit offset (fc) and a 32-bit length (lcb). cbRgFcLcb at offset 152 is the number of pairs: 93 for nFib 193, and more when nFibNew marks a later version. Offsets are in the table stream. The structure names that follow are the specification’s. A length of zero means the structure is absent, and its offset is ignored.

IndexNameHolds
1StshfThe style sheet
2, 3PlcffndRef, PlcffndTxtFootnotes
4, 5PlcfandRef, PlcfandTxtComments
6PlcfSedSection descriptors
11PlcfHddHeaders and footers
12, 13PlcfBteChpx, PlcfBtePapxCharacter and paragraph property pages
15SttbfFfnThe font table
16–20PlcfFldMom and othersPositions of fields in each part
21–23SttbfBkmk, PlcfBkf, PlcfBklBookmarks
31DopDocument properties
33ClxThe piece table
40, 41PlcSpaMom, PlcSpaHdrAnchors of drawn objects
46, 47PlcfendRef, PlcfendTxtEndnotes
50DggInfoOffice drawing data
73, 74PlfLst, PlfLfoList definitions and overrides

Versions

nFib stays 193 in most Word 97 and later files; a later Word writes the real version in nFibNew, the first value of fibRgCswNew.

nFibNewWritten bycbRgFcLcbcswNew
0x00C1Word 97930
0x00D9Word 20001082
0x0101Word 20021362
0x010CWord 20031642
0x0112Word 20071835

Encryption and obfuscation

Bit 8 of the flags, fEncrypted, says the file is password protected. With fObfuscated (bit 15) also set, it uses XOR obfuscation and lKey is the password verifier. Otherwise the first lKey bytes of the table stream are an encryption header, which says whether Office binary document RC4 or RC4 CryptoAPI is used. The first 68 bytes of WordDocument and the header are readable; the text and most tables are not.