ANI (file format) on arvau

Wikipedia / ANI (file format)

The ANI file format is a graphics file format used for animated mouse cursors on the Microsoft Windows operating system.

The format is based on the Microsoft Resource Interchange File Format, which is used as a container for storing the individual frames (which are standard Windows cursors) of the animation.

History

The concept of an animated mouse pointer originated on OS/2 Presentation Manager, whose animated pointers were produced by an early Microsoft animation tool later ported to Windows NT. The RIFF/ACON container was not part of the original 1991 RIFF specification; the form type was registered by Microsoft in April 1993. Early third-party documentation described the flag in the header as selecting between two frame formats: with the flag set, each frame is a complete icon or cursor resource; without it, frames would be raw device-independent bitmaps described by the , , and header fields. This raw-bitmap mode did not appear in Microsoft's own published specification, however, and no version of Windows accepts a frame with the flag unset; in every animated cursor shipped with Windows the flag is set and those four header fields are zero.

The Animated Cursor Editor for Windows NT (ANIEDIT) provides a reference implementation of the ANI format. Its source code was distributed as a sample in the Windows SDK — as source only, with compiled binaries provided instead in the Windows 95 and Windows NT Resource Kits — and is preserved in the MSDN October 2001 Library.

The 16-bit Windows 3.x line had no animated cursor support of any kind. Windows NT 3.5 was the first version to load and display animated cursors, and shipped a set of ANI files — such as the animated hourglass — as part of its default cursor scheme; these early frames were 16-color (4 bpp) 32×32 images, some using a reversing "ping-pong" playback sequence. Windows 95 brought animated cursor support to the consumer line, adding a monochrome (1 bpp) fallback image to the first frame for display adapters running in 16 colors. On Windows 9x, animating a cursor required a protected-mode disk driver together with a suitable display driver; on systems lacking them the pointer was shown in color but did not animate.

Windows Vista introduced 32-bit color cursors with its Aero theme, and its animated cursors were the first to store several sizes within each frame so that a larger pointer could be drawn at higher display scaling — the built-in , for example, carries 32×32, 48×48 and 64×64 variants in every frame, for 100%, 150% and 200% scaling respectively.

File structure

An ANI file is a RIFF container with the chunk identifier . It contains a mandatory animation header chunk (), a mandatory list of frame chunks (), and optional chunks for per-step timing (), frame sequencing (), and metadata ().

define AF_ICON 0x1

typedef struct {

   DWORD cbSizeof;           // 36
   DWORD cFrames;            // unique frame count
   DWORD cSteps;             // animation step count
   DWORD cx, cy;             // unused (legacy)
   DWORD cBitCount, cPlanes; // unused (legacy)
   DWORD jifRate;            // default rate in jiffies (1/60 s)
   DWORD fl;                 // flags; AF_ICON (0x1) must be set; see Sequence and playback

} ANIHEADER;

RIFF('ACON'

   [LIST('INFO'
       [INAM(<ZSTR>)]          // title (optional)
       [IART(<ZSTR>)]          // author (optional)
   )]
   [<DISP-ck>]                 // display preview (optional)
   'anih'(<ANIHEADER>)
   ['rate'(<DWORD>...)]        // exactly cSteps DWORDs; per-step rates in jiffies; see Timing
   ['seq '(<DWORD>...)]        // exactly cSteps DWORDs; 0-based frame indices; see Sequence and playback
   LIST('fram'
       'icon'(<icon_data>)...  // exactly cFrames icon chunks
   )

)

The field must be exactly 36; any other value causes the file to fail to load. The chunk must appear before , , and the list; this is the only strict ordering constraint defined in the specification. The list may contain standard RIFF metadata sub-chunks, including (title) and (author). All are null-terminated strings encoded in ASCII or the system ANSI code page; the original RIFF specification defines ISO 8859/1 as the default. Windows ignores all sub-chunks when loading a cursor; the metadata is only read by third-party editors.

Frames

The flag in is required and marks each frame in the list as a complete CUR-format resource. Because the frame format is identical to a standalone CUR file, a frame may contain images at multiple sizes within a single chunk — this capability is part of the original 1993 specification. Within each chunk, the field of each directory entry is relative to the start of the chunk content and must fit within 16 bits.

must be at least 1; a value of 1 is treated as a static cursor. Both and are effectively 16-bit on modern Windows: non-zero upper bits cause the file to fail to load. Without a chunk, must not exceed ; with one, every frame index in the table must be less than .

Because frames use the ICO/CUR image format, they may also contain PNG-compressed images since Windows Vista (see PNG format). PNG compression can reduce file size by around 40× compared to uncompressed BMP for typical semi-transparent cursors; existing Windows cursor tools only emit uncompressed BMP frames.

Timing

Frame rates are measured in jiffies, with one jiffy equal to 1/60 of a second, or approximately 16.7 ms. The header specifies a default rate () applied to all steps. The optional chunk overrides this with a per-entry rate table, allowing individual frames to be held for different durations. The table must contain exactly entries.

Sequence and playback

The optional chunk contains a table of frame indices, mapping each animation step to a frame index and allowing frames to be played in any order and reused across multiple steps. For example, an animation with three unique images and the step sequence 0–1–2–1–0 only needs to store three frames while playing five steps, saving storage space. The field also carries a bit, not part of Microsoft's own published specification but described in early third-party documentation as a sequence flag — conventionally referred to as — set when a chunk is present. It is informational only: Windows parses the chunk unconditionally whenever it appears, regardless of whether the bit is set.

When an ANI file is used as a Windows cursor, the sequence loops continuously; the field defines no play-once or other playback-control bits. An application can also draw a chosen animation step directly with the Win32 function, whose parameter selects the frame index to render when the handle refers to an animated cursor.

Animated cursor resources

ANI files stored in Portable Executable binaries use the resource type (21) for animated cursors and (22) for animated icons. Unlike static icons and cursors, an animated cursor is embedded as a single unmodified RIFF/ACON blob rather than split into a group resource and individual frame resources. The Win32 , , and functions detect the RIFF/ACON signature automatically and route it to the ANI loader. In a resource-definition script, an animated cursor or icon is declared with the ordinary or statement pointing at the file; the resource compiler recognises the animated format and emits an or resource rather than the static / group-and-image pair.

Security

Because Windows renders animated cursors automatically from files that may come from untrusted sources, the ANI parser has been the target of several remote-code-execution vulnerabilities. On January 11, 2005, Microsoft's security bulletin MS05-002 fixed three such flaws: insufficient validation of cursor, animated-cursor, and icon files could allow remote code execution () or crash the kernel () from a malformed file, and a specific stack-based buffer overflow in the animation-header length field of an ANI file could allow code execution (); affected systems ranged from Windows NT through Windows Server 2003. In late March 2007, a further animated-cursor parsing flaw () — discovered by Alexander Sotirov of Determina Security Research — was disclosed and was already being exploited in the wild. It was a recurrence of the MS05-002 class of bug: the validation added in 2005 checked the length of only the first animation header, so a file carrying a second, malformed header bypassed the check and overflowed a fixed-size buffer. Microsoft released bulletin MS07-017 the following week, covering Windows 2000, Windows XP, Windows Server 2003, and Windows Vista. Later that year, a buffer overflow in the ANI handling of the third-party image viewer IrfanView 3.99 — showing the risk was not limited to Microsoft's own code — was assigned .