Hi @Vlado,
I did the parsing of your sample document (TS_4.doc) by hand and my findings are that the 3rd row has table properties with definitions for the cells using sprmTInsert
among other properties.
<WARNING: The below offsets may not match yours as I do some rearranging of sectors to make editing the hex bytes in the file easier>
Here is the text run in hex (i.e. ccpText
):
The end of row TTPM is at offset 0x4223 (0x07). Note this is after the para marker (0x07) for "E3" and the para marker (0x07) for the merged cell under "D".
If you go through the algorithm in MS-DOC 2.4.6.1 "Direct Paragraph Formatting", you'll arrive at a PapxInFkp
(eventually) for this mark:
PapxInFkp
@ 0x4C00 + 2*BxPap.bOffset
= 0x4C00 + 2*0xEB = 0x4DD6:
00 04 00 00 46 66 92 02 00 00
Inside this is a grpprl
@0x4DD0 (after the cb
, cb'
and GrpprlAndIstd.istd
which is 0x0000):
46 66 92 02 00 00
This (0x6646) is a sprmPHugePapx
.
Breaking this open, we are led to a PrcData
with GrpPrl
:
PrcData
@ 0x292+Data Stream
= 0xE92:
PrcData.cbGrpprl
= 0x1FB
PrcData
addresses: 0xE92 -> 0x108F
And the first Prl
in GrpPrl
is:
6B 64 95 01 00 00
sprmPTableProps
(0x646B)
Ok, so PrcData
@ 0x195 into Data Stream
:
Range for PrcData
: 0xD95 -> 0xE91
At this point, after offset 0x0D95 in the above hex dump (which is the length of the PrcData
, you can actually visually scan the Prl's to see that there the following (and I won't list all of them):
Offset Sprm (Id)
=================
0xD97 sprmPFInTable(0x2416)
0xD9A sprmPFTtp(0x2417)
0xD9D sprmPItap(0x6649)
0xDA7 sprmTInsert(0x7621)
Etc... I won't list them all. But this should be where the 3rd row cell definitions are found.
Best regards,
Tom Jebo
Microsoft Open Specifications Support