C # stripping. SPL into an. emf file format

This paper reproduces the http://www.cppblog.com/rawdata/archive/2009/02/23/74653.html from Star Wars Violet FAI

But C # code implementation for my original. Https://github.com/SnailDev/SnailDev.EmfParser Welcome star or Fork

Keywords: print SPL EMF file format

Spool printing for Windows is windows\system32\spool\ The. SPL and. shd files are generated under the Priners directory, where the printed content is stored in the. spl file, but the. spl file format does not appear to be public, so how can you peel an unknown. spl file into an. emf file?

First, let's look at the Windows printing mechanism, which is a print flow picture of Microsoft's official website:

The ISV is the application software interface, IHV is the hardware interface, the left is the XP print model, the right is the latest XPS print model of Vista, but the two can be converted to each other, with good compatibility. However, for the time being, it only concerns the printing process of XP system.

Network Printing process diagram:

But these graphs don't seem to be detailed enough, so take a look at the following: (excerpt from the paper: "Print data interception system based on keyword matching"):

The basic idea is that when the printing process occurs, the GDI module and the print driver (provided by the printer vendor) perform basic data exchange, and in the context of the spool setup, Generate printer Command file:. SPL or. emf files, as a job for a print pool, and then the Windows spool thread processes the print job, sends the data file to the printer to print, and prints out the print file.
OK, now get back to the point: how can the. spl file be stripped into. emf? See an example:
Open a. spl file in Winhex:

Reference: Definitions of some print structures in HTTP://WWW.UNDOCPRINT.ORG/FORMATS/WINSPOOL/SPL.
First, the. spl file starts with a 0x00010000 signature, and then a DWORD is the file offset of the EMF-dependent area, the 3rd DWORD is the file offset of the document description string (Unicode), and the 4th DWORD describes the port description string (Unicode). The approximate structure is as follows:

The end of the file is like this:

When you navigate to the file location of 0x50 and read the 2 DWORD data, the. emf file begins: The EMF file format is public and very simple, a series of EMR_XXX open structures that are tightly arranged, usually beginning with Emr_header (0x01), to Emr_ EOF (0x0E) ends. In fact, there is no need to parse the. emf file format, the Windows SDK has a api,3 function that specifically displays the. emf file:
Henhmetafile hemf = GetEnhMetaFile ("emf_dumpok.emf");
Playenhmetafile (DC.M_HDC, HEMF, &RC);
DeleteEnhMetaFile (HEMF);
Then the. spl file has a few things that haven't been parsed yet, but the. emf file has been stripped out, and the latter can be ignored first.

Code See my GitHub warehouse Https://github.com/SnailDev/SnailDev.EmfParser

C # strips. SPL into an. emf file format