Windows Metafile

Structures of original and placeable Windows metafiles[17]

WMF files were not originally designed to be device independent, meaning that you could not playback the file on output devices that differed from the original device on which the file was recorded. A partial solution to this issue was invented by Aldus Corporation, who added an additional "placeable" header, called the "APM header",[18] which added a bounding rectable, a metafile version, metafile size, number of objects in the metafile and the size of the largest single record in the metafile.[19][20] This was later incorporated into the WMF format by Microsoft, starting in Windows 2000.[21]

WMF files are structured by a series of records, starting with a number of control records: the header record,[19][22] the aforementioned optional placeable record, [23] and finished by an end of file record.[19][24]

Encapsulated by the control records are the records that make up the image itself. These records work within what is known as the playback device context, which is the collection of properties and objects that make up a device's graphical environment as the metafile is being "played back" onto this output device.[25]

Records other than control records can be largely grouped into bitmap records, drawing records, object records, state records and escape records.

Bitmap records manage and output bitmap images.

Drawing records produce graphics output.

Object records create and manage graphics objects. In WMF files there are two broad categories of objects – graphics objects and structure objects. Structure objects are not explicitly created or deleted in a WMF, they are instead of complex structures. For example, the BitmapCoreHeader contains information about the dimensions and color format of a device-independent bitmap,[52] which is itself part of a DeviceIndependentBitmap object.[53] A graphics object, however, specifies parameters for graphics output and during playback of the WMF it sets up the playback device context.[54]

Graphics objects can be brushes (defines the style, color and pattern of a brush which defines how to paint an area of the graphic), fonts (defines properties that affect how text is displayed), palettes (specifies colors as device-independent values, defined by an application), pens (specifies the graphical attributes of a line), and regions (which specify line and curve segments that define a shape).[54]

State records manage the graphics properties of the playback device context.[67]

WMF generic escape record

Escape records are a means to extend metafile functionality via records that are not otherwise defined as a WMF record type. Each escape record contains a record function, an escape function and potentially escape data.

The following escape records make up a WMF file.

There was a major vulnerability found in escape records around the Abort escape record, which stores the abort procedure code within the record itself. This affected Windows systems (see CVE-2005-4560) and the Wine project (see CVE-2006-0106). According to Secunia, "The vulnerability is caused due to an error in the handling of Windows Metafile files ('.wmf') containing specially crafted SETABORTPROC 'Escape' records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails."[142] According to the Windows 3.1 SDK documentation, the SETABORTPROC escape was obsoleted and replaced by the function of the same name in Windows 3.1, long before the WMF vulnerability was discovered.[143] However the obsoleted escape code was retained for compatibility with 16 bit programs written for (or at least backwards compatible with) Windows 3.0. This change happened at approximately the same time as Microsoft was creating the 32 bit reimplementation of GDI for Windows NT, and it is likely that the vulnerability occurred during this effort.

After Steve Gibson from Gibson Research Corporation accused Microsoft of deliberately implementing a backdoor into their code,[144][145] Mark Russinovich provided a rebuttal, and stated that:

...things were different when the format was architected. In the Windows 3.1 “large” memory model code is inherently location-independent and Windows was never patched, so both Windows and an application could simply copy an application function into the WMF file and assume it would work when played back by the same application in a later run session. In any case, its not clear that the developers envisioned applications creating on-disk metafiles with abort procedures. Also, as Microsoft’s Stephen Toulouse pointed out in Microsoft’s rebuttal to Steve’s claims, the security landscape in the early 1990s was very different than today and all code, including that stored in a WMF file, was inherently trusted.[146]

Peter Ferrie of Symantec Security Response, USA also disagreed with Gibson, noting that:

Gibson claimed that a thread is created to run the SetAbortProc handler. In fact, no thread is created to run the handler – it is a callback, which is called by the parser, and the parser has to wait until the callback returns, otherwise the whole point of the function (to abort the printing) is lost. By his own admission, Gibson did not read the documentation (in fact, he claimed that he couldn’t find it, although it is freely available on Microsoft’s Web site), and he claimed that the device context is not available to the function handler. Of course the device context is available to the function handler — it is one of the two parameters that is passed to it (see above), and it is required in order to abort the printing. Finally, Gibson claimed that the control flow could not return to Windows. It is simply a matter of the function returning and discarding the parameters that were passed on the stack. If the record is well formed, Windows will continue to parse the file, as before. ... Gibson admits that he was guessing about a number of things. Unfortunately, he guessed poorly. I guess we know better now.[147]

Windows Enhanced Metafile headers

EMF files have three possible versions of headers. The original headers is just a container for images, the second and third version encapsulates the original header and contains a pixel format record and support for OpenGL records, and the third version encapsulates the second header extension and increases EMF accuracy and scalability of EMFs as it adds the ability to measure distances of device surfaces using the metric system.[148]

Each EMF header starts with an EMR_HEADER record, and records the relevant properties of the device on which the metafile image was recorded. The original EMF header has an 80 byte header and an optional variable length description string.[149] Other metafiles contain extension fields, which encapsulate the original header. EmfMetafileHeaderExtension1 is a record that is inserted directly after the original EMF header, specifies whether there is a pixel format descriptor and the offset to the descriptor object within the header, as well as a field that specifies if OpenGL records exist in the metafile.[150] The pixel format descriptor specifies the capabilities of the drawing surface and whether a pixel is encoded in RGBA or is an index into a color table.[151] EmfMetafileHeaderExtension2 is a record that is inserted directly after the EmfMetafileHeaderExtension1 record, and it contains two fields with the X and Y values to measure the device surface in micrometers.[152]

Like WMF files, records can be classified by function, however there are more record types in EMF files than there are in WMF files. Records can be classified as control, bitmap, clipping, comment, drawing, escape, object creation, object manipulation, OpenGL, path bracket, state and transform records.

With the release of Windows XP, the Enhanced Metafile Format Plus Extensions (EMF+) format was introduced. EMF+ provides a way to serialize calls to the GDI+ API in the same way that WMF/EMF stores calls to GDI.

There are also compressed versions of Windows Metafiles known as Compressed Windows Metafile (WMZ) and Compressed Windows Enhanced Metafile (EMZ),[153] which are basically gzip compressed WMF and EMF files correspondingly.