Editing Windows Metafile (section)

====Escape records====
[[File:WMF Escape Record.svg|thumb|WMF generic escape record]]
Escape records are a means to extend metafile functionality via records that are not otherwise defined as a WMF record type. Each escape record contains a record function, an escape function and potentially escape data.

The following escape records make up a WMF file.

{| class="wikitable"
|- valign="bottom"
! Name
! Description
|-
| ABORTDOC
| Stops processing the current document.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.2. ABORTDOC Record|pages=158–159|access-date=2020-01-28}}</ref>
|-
| BEGIN_PATH
| Opens a path.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.3. BEGIN_PATH Record|page=159|access-date=2020-01-28}}</ref>
|-
| CHECK_JPEGFORMAT
| Determines whether it can handle the given [[JPEG]] image.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.4. CHECK_JPEGFORMAT Record|pages=159–160|access-date=2020-01-28}}</ref>
|-
| CHECK_PNGFORMAT
| Determines whether it can handle the given [[Portable Network Graphics|PNG]] image.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.5. CHECK_PNGFORMAT Record|page=160|access-date=2020-01-28}}</ref>
|-
| CLIP_TO_PATH
| Applies a function to the current [[PostScript]] clipping path.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.6. CLIP_TO_PATH Record|page=160|access-date=2020-01-28}}</ref>
|-
| CLOSE_CHANNEL
| Same as ENDDOC.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.7. CLOSE_CHANNEL Record|page=162|access-date=2020-01-28}}</ref>
|-
| DOWNLOAD_FACE
| Sets the font face name on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.8. DOWNLOAD_FACE Record|pages=162–163|access-date=2020-01-28}}</ref>
|-
| DOWNLOAD_HEADER
| Downloads sets of PostScript procedures.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.9. DOWNLOAD_HEADER Record|pages=158–159|access-date=2020-01-28}}</ref>
|-
| DRAW_PATTERNRECT
| Draws a rectangle with a defined pattern.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.10. DRAW_PATTERNRECT Record|pages=163–164|access-date=2020-01-28}}</ref>
|-
| ENCAPSULATED_POSTSCRIPT
| Sends arbitrary [[encapsulated PostScript]] (EPS) data directly to the printer driver.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.11. ENCAPSULATED_POSTSCRIPT Record|page=164|access-date=2020-01-28}}</ref>
|-
| END_PATH
| Ends a path.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.12. END_PATH Record|pages=164–165|access-date=2020-01-28}}</ref>
|-
| ENDDOC
| Notifies the printer driver that a new print job is ending.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.13. ENDDOC Record|pages=165|access-date=2020-01-28}}</ref>
|-
| EPS_PRINTING
| Indicates the start and end of EPS printing.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.14. EPS_PRINTING Record|pages=165–166|access-date=2020-01-28}}</ref>
|-
| EXTTEXTOUT
| Draws text using the currently selected font, background color, and text color.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.15. EXTTEXTOUT Record|pages=166–167|access-date=2020-01-28}}</ref>
|-
| GET_COLORTABLE
| Gets color table values from the printer driver.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.16. GET_COLORTABLE Record|pages=167–168|access-date=2020-01-28}}</ref>
|-
| GET_DEVICEUNITS
| Gets the device units currently configured on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.17. GET_DEVICEUNITS Record|page=168|access-date=2020-01-28}}</ref>
|-
| GET_EXTENDED_TEXTMETRICS
| Gets the extended text metrics that are currently configured on the printer driver.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.18. GET_EXTENDED_TEXTMETRICS Record|pages=168–169|access-date=2020-01-28}}</ref>
|-
| GET_FACENAME
| Gets the font face name currently configured on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.19. GET_FACENAME Record|page=169|access-date=2020-01-28}}</ref>
|-
| GET_PAIRKERNTABLE
| Gets the [[kerning|font kern]] table currently defined on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.20. GET_PAIRKERNTABLE Record|pages=169–170|access-date=2020-01-28}}</ref>
|-
| GET_PHYSPAGESIZE
| Retrieves the physical page size currently selected on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.21. GET_PHYSPAGESIZE Record|page=170|access-date=2020-01-28}}</ref>
|-
| GET_PRINTINGOFFSET
| Retrieves the offset from the upper-left corner of the physical page where the actual printing or drawing begins.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.22. GET_PRINTINGOFFSET Record|pages=170–171|access-date=2020-01-28}}</ref>
|-
| GET_PS_FEATURESETTING
| Queries the printer driver for information about PostScript features supported on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.23. GET_PS_FEATURESETTING Record|page=171|access-date=2020-01-28}}</ref>
|-
| GET_SCALINGFACTOR
| Retrieves the scaling factors for the x-axis and the y-axis of a printer.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.24. GET_SCALINGFACTOR Record|pages=171–172|access-date=2020-01-28}}</ref>
|-
| META_ESCAPE_ENHANCED_METAFILE
| Used to embed an EMF metafile within a WMF metafile.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.25. META_ESCAPE_ENHANCED_METAFILE Record|pages=172–173|access-date=2020-01-28}}</ref>
|-
| METAFILE_DRIVER
| Queries the printer driver about its support for metafiles on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.26. METAFILE_DRIVER Record|pages=173–174|access-date=2020-01-28}}</ref>
|-
| NEWFRAME
| Notifies the printer driver that the application has finished writing to a page.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.27. NEWFRAME Record|pages=174–175|access-date=2020-01-28}}</ref>
|-
| NEXTBAND
| Notifies the printer driver that the application has finished writing to a band.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.28. NEXTBAND Record|pages=174–175|access-date=2020-01-28}}</ref>
|-
| PASSTHROUGH
| Passes through arbitrary data to the printer driver.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.29. PASSTHROUGH Record|page=175|access-date=2020-01-28}}</ref>
|-
| POSTSCRIPT_DATA
| Sends arbitrary PostScript data to the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.30. POSTSCRIPT_DATA Record|page=176|access-date=2020-01-28}}</ref>
|-
| POSTSCRIPT_IDENTIFY
| Sets the printer driver to either PostScript-centric or GDI-centric mode.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.31. POSTSCRIPT_IDENTIFY Record|pages=176–177|access-date=2020-01-28}}</ref>
|-
| POSTSCRIPT_IGNORE
| Notifies the output device to ignore PostScript data.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.32. POSTSCRIPT_IGNORE Record|page=177|access-date=2020-01-28}}</ref>
|-
| POSTSCRIPT_INJECTION
| Inserts a block of raw data into a PostScript stream.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.33. POSTSCRIPT_INJECTION Record|pages=177–178|access-date=2020-01-28}}</ref>
|-
| POSTSCRIPT_PASSTHROUGH
| Sends arbitrary data directly to a printer driver, which is expected to process this data only when in PostScript mode.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.34. POSTSCRIPT_PASSTHROUGH Record|page=178|access-date=2020-01-28}}</ref>
|-
| OPEN_CHANNEL
| Acts the same as STARTDOC, with a NULL document and output filename, and data in raw mode.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.35. OPEN_CHANNEL Record|page=179|access-date=2020-01-28}}</ref>
|-
| QUERY_DIBSUPPORT
| Queries the printer driver about its support for DIBs on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.36. QUERY_DIBSUPPORT Record|pages=179–180|access-date=2020-01-28}}</ref>
|-
| QUERY_ESCSUPPORT
| Queries the printer driver to determine whether a specific WMF escape function is supported on the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.37. QUERY_ESCSUPPORT Record|page=180|access-date=2020-01-28}}</ref>
|-
| SET_COLORTABLE
| Sets color table values.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.38. SET_COLORTABLE Record|pages=180–181|access-date=2020-01-28}}</ref>
|-
| SET_COPYCOUNT
| Sets the number of copies.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.39. SET_COPYCOUNT Record|page=181|access-date=2020-01-28}}</ref>
|-
| SET_LINECAP
| Specifies the line-ending mode to use in drawing to the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.40. SET_LINECAP Record|pages=181–182|access-date=2020-01-28}}</ref>
|-
| SET_LINEJOIN
| Specifies the line-joining mode to use in drawing to the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.41. SET_LINEJOIN Record|pages=182–183|access-date=2020-01-28}}</ref>
|-
| SET_MITERLIMIT
| Sets the limit for the length of miter joins to use in drawing to the output device.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.42. SET_MITERLIMIT Record|page=183|access-date=2020-01-28}}</ref>
|-
| SPCLPASSTHROUGH2
| Enables documents to include private procedures and other arbitrary data in documents.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.43. SPCLPASSTHROUGH2 Record|pages=183–184|access-date=2020-01-28}}</ref>
|-
| STARTDOC
| Notifies the printer driver that a new print job is starting.<ref>{{citation|url=https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf|title=<nowiki>[MS-WMF]:</nowiki> Windows Metafile Format Specification|section=2.3.6.44. STARTDOC Record|page=184|access-date=2020-01-28}}</ref>
|}

There was a [[Windows Metafile vulnerability|major vulnerability]] found in escape records around the Abort escape record, which stores the abort procedure code within the record itself. This affected Windows systems (see {{CVE|2005-4560}}) and the [[Wine (software)|Wine project]] (see {{CVE|2006-0106}}). According to [[Secunia]], "The vulnerability is caused due to an error in the handling of Windows Metafile files ('.wmf') containing specially crafted SETABORTPROC 'Escape' records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails."<ref name=secunia>{{cite web|archive-url=https://web.archive.org/web/20060102123654/http://secunia.com/advisories/18255/|archive-date=January 2, 2006|url=http://secunia.com/advisories/18255/|title=Microsoft Windows WMF "SETABORTPROC" Arbitrary Code Execution|id=Secunia Advisory: SA18255|publisher=[[Secunia]]}}</ref> According to the Windows 3.1 SDK documentation, the SETABORTPROC escape was obsoleted and replaced by the function of the same name in Windows 3.1, long before the WMF vulnerability was discovered.<ref>{{citation|url=https://docs.microsoft.com/en-us/windows-hardware/drivers/print/pscript-supported-escapes|title=Pscript-Supported Escapes|publisher=Microsoft|access-date=2020-01-28}}</ref> However the obsoleted escape code was retained for compatibility with 16 bit programs written for (or at least backwards compatible with) Windows 3.0. This change happened at approximately the same time as Microsoft was creating the 32 bit reimplementation of GDI for Windows NT, and it is likely that the vulnerability occurred during this effort.

After [[Steve Gibson (computer programmer)|Steve Gibson]] accused Microsoft of deliberately implementing a [[backdoor (computing)|backdoor]] into their code,<ref>{{cite podcast|url=https://media.grc.com/sn/sn-022.mp3|title=The Windows MetaFile Backdoor?|website=GRC Security Now!|publisher=[[Gibson Research Corporation]]|date=January 12, 2006|access-date=2020-01-28}}</ref><ref>{{citation|title = Re: You won't want to miss tonight's Security Now!, #22|first=Steve|last=Gibson|author-link=Steve Gibson (computer programmer)|date=January 12, 2006|work=grc.news.feedback|url=https://www.grc.com/x/news.exe?cmd=article&group=grc.news.feedback&item=60006|access-date=2020-01-28}}</ref> [[Mark Russinovich]] provided a rebuttal, and stated that:

{{blockquote|...things were different when the format was architected. In the Windows 3.1 “large” memory model code is inherently location-independent and Windows was never patched, so both Windows and an application could simply copy an application function into the WMF file and assume it would work when played back by the same application in a later run session. In any case, its not clear that the developers envisioned applications creating on-disk metafiles with abort procedures. Also, as Microsoft’s Stephen Toulouse pointed out in [https://web.archive.org/web/20060116042756/http://blogs.technet.com/msrc/archive/2006/01/13/417431.aspx Microsoft’s rebuttal] to Steve’s claims, the security landscape in the early 1990s was very different than today and all code, including that stored in a WMF file, was inherently trusted.<ref>{{citation|url=https://techcommunity.microsoft.com/t5/windows-blog-archive/inside-the-wmf-backdoor/ba-p/723489|first=Mark|last=Russinovich|author-link=Mark Russinovich|title=Inside the WMF Backdoor|publisher=Microsoft|work=TechNet|via=Microsoft Tech Community|date=January 18, 2006}}</ref>}}

Peter Ferrie of Symantec Security Response, USA also disagreed with Gibson, noting that:

{{blockquote|Gibson claimed that a thread is created to run the SetAbortProc handler. In fact, no thread is created to run the handler – it is a callback, which is called by the parser, and the parser has to wait until the callback returns, otherwise the whole point of the function (to abort the printing) is lost. By his own admission, Gibson did not read the documentation (in fact, he claimed that he couldn’t find it, although it is freely available on Microsoft’s Web site), and he claimed that the device context is not available to the function handler. Of course the device context is available to the function handler &mdash; it is one of the two parameters that is passed to it (see above), and it is required in order to abort the printing. Finally, Gibson claimed that the control flow could not return to Windows. It is simply a matter of the function returning and discarding the parameters that were passed on the stack. If the record is well formed, Windows will continue to parse the file, as before. ... Gibson admits that he was guessing about a number of things. Unfortunately, he guessed poorly. I guess we know better now.<ref>{{citation|title=Inside the Windows Meta File Format|publisher=[[Virus Bulletin]]|date=February 2, 2006|first=Peter|surname=Ferrie|url=https://www.symantec.com/avcenter/reference/inside.the.windows.meta.file.format.pdf|archive-url=https://web.archive.org/web/20080516052826/http://www.symantec.com/avcenter/reference/inside.the.windows.meta.file.format.pdf|url-status=dead|archive-date=May 16, 2008|via=[[NortonLifeLock|Symantec]]|access-date=2020-01-24}}</ref>}}