SHD - Microsoft® Windows Shadow File Format

The print job’s spooled data is contained in a spool file. The shadow file includes some additional informations used by the spooler, like job settings.

For each print job there are two spool files generated by the Windows® NT/2000 spooler. One file with the .SHD extension for job settings, and one with the .SPL extension for the drawing commands.

Warning

While you might use the informations you find here to extract EMF and other data from the Windows spoolfiles, you should remember, that this informations is undocumented and might change without prior notice!

You can probably locate the information about the EMF structs in 
the spool file format. But note that one major caveat with this 
approach is that since the spool file format is MS proprietary, 
it might change in future releases without notice. So if your 
driver is dependent on a particular spool file format, it could 
break on future releases. This is the reason for us recommending 
that you not rely on the spool file format.
//Ashwin, Microsoft 

This document includes documentation for the Shadow File Format.

Hi,

Iam developing an application/service for printers.The scenario is as follows

1. When a user selects a document and then he says the print command(no through my application...he selects normal print in file menu)then i have to catch some details like printername,no.of pages,document name..and so on...This action should be done before it get out from spooler.

2. As all of you that after printing data from spooler will be deleted..but in general for example for HP printer 3 files like lpr1234.tmp,shockwaveobject file ,.shd are generated. In this I have take take required files and keep them in my own spooler.

             On my extensive search I came to know that by using WMI and WindowsAPI functions I can get to this goal...

         But Iam unable to get into the right way....

If I have to use APIs then kindly tell what are the method I have to implement(if possible give me documentation link)

If through WMI....kindly guide me for the same

       ALL these should be act as a service.....

thanks in Advance

The SHD file consists of a header followed by the data.

/*****************************************************************************
 * Terms of Use
 * Copyright © 2005 by Christoph Lindemann. All rights reserved.
 *
 * Permission is granted to copy, distribute and/or modify this document under
 * the terms of the GNU Free  Documentation License, Version 1.2 or any later 
 * version published by the Free Software Foundation; with no Invariant 
 * Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the 
 * license is included in the section entitled "GNU Free Documentation 
 * License".
 *----------------------------------------------------------------------------
 * History:
 *  16-07-2003  Initial Document
 *   Christoph Lindemann, christoph@lindemann.nu
 *  
 *  29-09-2003  Release to public
 *   Christoph Lindemann, christoph@lindemann.nu
 *  
 *  27-04-2004 Added signatures, for different versions
 *   Christoph Lindemann, christoph@lindemann.nu
 *  
 *  26-05-2004 Added signature for Windows 2003
 *   Jean Rodolfo Taruhn
 *  
 *  19-07-2005 Clean up of names
 *   Christoph Lindemann, christoph@lindemann.nu
 *
 *  02-11-2005  Added comment about copy count
 *     Thanks to Krzys
 *
 *****************************************************************************/
 
#define SHD_SIGNATURE_WIN98    $0000494B //Windows 98
#define SHD_SIGNATURE_WINNT    $00004966 //Windows NT
#define SHD_SIGNATURE_WIN2000  $00004967 //Win2000/XP 
#define SHD_SIGNATURE_WIN2003  $00004968 //Windows 2003
 
typedef struct _SHADOW_FILE_HEADER_WIN98 {
  DWORD dwSignature;        //SHD_SIGNATURE_WIN98
  WORD wStatus;
  WORD wUnknown1;
  DWORD dwJobID;
  DWORD dwPriority;
  DWORD offUserName;        //Offset of WideChar+0
  DWORD offNotifyName;      //Offset of WideChar+0
  DWORD offDocumentName;    //Offset of WideChar+0
  DWORD offPort;            //Offset of WideChar+0
  DWORD offPrinterName;     //Offset of WideChar+0
  DWORD offDriverName;      //Offset of WideChar+0
  DWORD offDevMode;         //Offset of DEVMODE
        //Note that the dmCopies in this structure will hold
        //the wrong value when the Microsoft Word multiple 
        //copies bug occurs.
        //In this case use the dmCopies from the SPL file
  DWORD offPrintProcessor;  //Offset of WideChar+0
  DWORD offDataFormat;      //Offset of WideChar+0
  DWORD dwUnknown2;
  SYSTEMTIME stSubmitTime;
  DWORD dwStartTime;
  DWORD dwUntilTime;
  DWORD dwSizeSPL;          //Size of SPL File
  DWORD dwPageCount;
  DWORD dwSizeSecurityInfo; //Size of SecurityInfo
  DWORD offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
  DWORD dwUnknown3;
} SHADOW_FILE_HEADER_WIN98, *PSHADOW_FILE_HEADER_WIN98;
 
typedef struct _SHADOW_FILE_HEADER_WINNT {
  DWORD dwSignature;        //SHD_SIGNATURE_WINNT
  WORD wStatus;
  WORD wUnknown1;
  DWORD dwJobID;
  DWORD dwPriority;
  DWORD offUserName;        //Offset of WideChar+0
  DWORD offNotifyName;      //Offset of WideChar+0
  DWORD offDocumentName;    //Offset of WideChar+0
  DWORD offPort;            //Offset of WideChar+0
  DWORD offPrinterName;     //Offset of WideChar+0
  DWORD offDriverName;      //Offset of WideChar+0
  DWORD offDevMode;         //Offset of DEVMODE
        //Note that the dmCopies in this structure will hold
        //the wrong value when the Microsoft Word multiple 
        //copies bug occurs.
        //In this case use the dmCopies from the SPL file
  DWORD offPrintProcessor;  //Offset of WideChar+0
  DWORD offDataFormat;      //Offset of WideChar+0
  DWORD dwUnknown2;
  SYSTEMTIME stSubmitTime;
  DWORD dwStartTime;
  DWORD dwUntilTime;
  DWORD dwSizeSPL;          //Size of SPL File
  DWORD dwPageCount;
  DWORD dwSizeSecurityInfo; //Size of SecurityInfo
  DWORD offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
  DWORD dwUnknown3;
  DWORD dwUnknown4;
  DWORD dwUnknown5;
} SHADOW_FILE_HEADER_WINNT, *PSHADOW_FILE_HEADER_WINNT;
 
typedef struct _SHADOW_FILE_HEADER_WIN2000 {
  DWORD dwSignature;        //SHD_SIGNATURE_WIN2000
  DWORD dwHeaderSize;
  WORD wStatus;
  WORD wUnknown1;
  DWORD dwJobID;
  DWORD dwPriority;
  DWORD offUserName;        //Offset of WideChar+0
  DWORD offNotifyName;      //Offset of WideChar+0
  DWORD offDocumentName;    //Offset of WideChar+0
  DWORD offPort;            //Offset of WideChar+0
  DWORD offPrinterName;     //Offset of WideChar+0
  DWORD offDriverName;      //Offset of WideChar+0
  DWORD offDevMode;         //Offset of DEVMODE
        //Note that the dmCopies in this structure will hold
        //the wrong value when the Microsoft Word multiple 
        //copies bug occurs.
        //In this case use the dmCopies from the SPL file
  DWORD offPrintProcessor;  //Offset of WideChar+0
  DWORD offDataFormat;      //Offset of WideChar+0
  DWORD dwUnknown2;
  SYSTEMTIME stSubmitTime;
  DWORD dwStartTime;
  DWORD dwUntilTime;
  DWORD dwSizeSPL;          //Size of SPL File
  DWORD dwPageCount;
  DWORD dwSizeSecurityInfo; //Size of SecurityInfo
  DWORD offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
  DWORD dwUnknown3;
  DWORD dwUnknown4;
  DWORD dwUnknown5;
  DWORD offComputername;    //Offset of WideChar+0
  DWORD dwSPLSize2;
} SHADOW_FILE_HEADER_WIN2000, *PSHADOW_FILE_HEADER_WIN2000;
 
/* _SHADOW_FILE_HEADER_WIN2003 looks similar to _SHADOW_FILE_HEADER_WIN2000 */
typedef _SHADOW_FILE_HEADER_WIN2000 _SHADOW_FILE_HEADER_WIN2003;
typedef _SHADOW_FILE_HEADER_WIN2003 SHADOW_FILE_HEADER_WIN2003, *PSHADOW_FILE_HEADER_WIN2003;

With the infamous Word Copy Count bug... the dmCopies filed is 1 in the SHD. The correct value is found in the DEVMODE record in the SPL file (if it’s an EMF spool).
The only other way i found was to monitor the PrintedPages field of the JOB_INFO_2 structure, when the job has been sent to the printer, and see if it is a multiple of TotalPages.
— Krzys 2005/07/25 14:32

What happens is not a Word bug, but a Windows bug. Word calls startDoc always with copies set to 1. After that calls DocumentProperties and makes the change in dmCopies and calls ResetDC to make the update. It is a strange way of printing but not wrong. The problem is that the shd file and printer_info is not updated with this information, just keeps the Devmode info set on the StartDoc call.

But the call to the ResetDC generating a new DevMode is kept on the SPL file. You can get that info too if youo hook DocumentProperties API calls.