cph at oce
Jul 7, 2003, 12:33 PM
Post #5 of 6
> I can see the data
> of the image, but I can't accurately get to it.
> Do you have the original image that you 'inserted' into
> the document handy? So
> I can do a byte-match/offset. I did notice the word EMBED in
> ole-stream.2 of
> your decoded document.
> Back to you...
OK, I've been doing a bit of digging, and it appears that Word (2000)
converts GIF's to PNG's when embedding them, which complicates things
slightly (seems to do the same with TIFF's as well).
I tried extracting a Word document with a GIF and a JPEG in and the JPEG is
there, but I couldn't see the GIF anywhere until I noticed the letters PNG.
Looking at the raw file in a hex editor, it looks like the original path
including filename appears followed by 16 bytes then 24 bytes then the same
16 bytes again immediately before the file data starts.
Just an educated guess, but the last 2 bytes of the 16 that are repeated
might be the file size (big endian), as converted within the document.
Anyway, I've included the original GIF and also converted it to PNG.
Hope this helps.