What Is a DOCX File? Unzip One and the Text Is Right There

# work on copies, never on the original
# 1. first 4 bytes zeroed: write the ZIP signature back
cp broken.docx fixed-1.docx
printf '\x50\x4b\x03\x04' | dd of=fixed-1.docx bs=1 seek=0 conv=notrunc
# 2. junk in front: check_docx.py said the ZIP signature is at offset 512
tail -c +513 broken.docx > fixed-2.docx
# 3. junk at the end: cut the last 1,024 bytes
head -c -1024 broken.docx > fixed-3.docx
# 4. text-mode transfer: change every 0D 0A back to 0A
python3 -c "d=open('broken.docx','rb').read().replace(b'\r\n',b'\n'); open('fixed-4.docx','wb').write(d)"

#!/usr/bin/env python3
"""repair_docx.py: small, safe fixes for a damaged .docx. Writes a new file, never touches the original.
Usage: python3 repair_docx.py damaged.docx fixed.docx
Steps, in order (every one is printed):
  1. undo a text-mode transfer (0D 0A back to 0A) when every 0A has a 0D in front of it
  2. cut junk in front of the first ZIP signature, and bytes after the end record
  3. if the ZIP still does not open: scan for local headers, inflate every part, keep the parts that pass
     the CRC test, and write a fresh ZIP with a new central directory
  4. put back a missing [Content_Types].xml, _rels/.rels or word/_rels/document.xml.rels from standard rules
  5. if word/document.xml is cut short or damaged, keep every full paragraph before the damage
It cannot bring back text that was never stored, a deflate stream after a flipped bit, or a password."""
import struct, sys, zlib, re, io, zipfile
from xml.sax.saxutils import escape

NS_W = 'http://schemas.openxmlformats.org/wordprocessingml/2006/main'
MAIN = 'application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml'
OV = {
    'word/styles.xml': ('wordprocessingml.styles+xml', 'styles'),
    'word/numbering.xml': ('wordprocessingml.numbering+xml', 'numbering'),
    'word/settings.xml': ('wordprocessingml.settings+xml', 'settings'),
    'word/fontTable.xml': ('wordprocessingml.fontTable+xml', 'fontTable'),
    'word/webSettings.xml': ('wordprocessingml.webSettings+xml', 'webSettings'),
    'word/footnotes.xml': ('wordprocessingml.footnotes+xml', 'footnotes'),
    'word/endnotes.xml': ('wordprocessingml.endnotes+xml', 'endnotes'),
    'word/comments.xml': ('wordprocessingml.comments+xml', 'comments'),
}
IMG = {'png': 'image/png', 'jpeg': 'image/jpeg', 'jpg': 'image/jpeg', 'gif': 'image/gif', 'emf': 'image/x-emf', 'wmf': 'image/x-wmf', 'bmp': 'image/bmp'}

def inflate_partial(raw):
    """Inflate as far as the data allows. Returns (bytes, finished_cleanly)."""
    d, out = zlib.decompressobj(-15), b''
    try:
        for i in range(0, len(raw), 64):
            out += d.decompress(raw[i:i + 64])
            if d.eof: return out, True
    except zlib.error:
        return out, False
    return out, d.eof

def scan_parts(b):
    """Walk the local headers. Returns {name: (data, status)} with status ok, bad-crc or partial."""
    parts, p = {}, 0
    while True:
        p = b.find(b'PK\x03\x04', p)
        if p < 0 or p + 30 > len(b): break
        flag, meth = struct.unpack_from('<HH', b, p + 6)
        crc, cs, us = struct.unpack_from('<III', b, p + 14)
        nl, el = struct.unpack_from('<HH', b, p + 26)
        name = b[p + 30:p + 30 + nl].decode('utf-8', 'replace')
        s = p + 30 + nl + el
        if not re.fullmatch(r'[\w\[\]\-. /]+', name) or nl == 0:
            p += 4; continue
        if meth == 0:
            data = b[s:s + cs] if not flag & 8 else b[s:s + us]
            st = 'ok' if len(data) == us and (zlib.crc32(data) & 0xffffffff) == crc else 'partial'
            if flag & 8 and st == 'partial': st = 'ok'
        elif meth == 8:
            data, fin = inflate_partial(b[s:s + cs] if cs and not flag & 8 else b[s:])
            st = ('ok' if (zlib.crc32(data) & 0xffffffff) == crc or flag & 8 else 'bad-crc') if fin else 'partial'
        else:
            p += 4; continue
        if name not in parts or st == 'ok': parts[name] = (data, st)
        p = s
    return parts

def paragraphs_before_damage(xml):
    t = xml.decode('utf-8', 'replace')
    out = []
    for m in re.finditer(r'<w:p[ >].*?</w:p>', t, re.S):
        txt = ''.join(re.findall(r'<w:t[^>]*>([^<]*)</w:t>', m.group(0)))
        out.append(txt)
    return out

def plain_document(paras):
    body = ''.join(f'<w:p><w:r><w:t xml:space="preserve">{p}</w:t></w:r></w:p>' for p in paras)
    return (f'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<w:document xmlns:w="{NS_W}"><w:body>{body}'
            '<w:sectPr><w:pgSz w:w="12240" w:h="15840"/></w:sectPr></w:body></w:document>').encode()

def content_types(names):
    x = ['<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">',
         '<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>',
         '<Default Extension="xml" ContentType="application/xml"/>']
    exts = {n.rsplit('.', 1)[-1].lower() for n in names if '.' in n.rsplit('/', 1)[-1]}
    for e in sorted(exts & set(IMG)): x.append(f'<Default Extension="{e}" ContentType="{IMG[e]}"/>')
    x.append(f'<Override PartName="/word/document.xml" ContentType="{MAIN}"/>')
    for n, (t, _) in OV.items():
        if n in names: x.append(f'<Override PartName="/{n}" ContentType="application/vnd.openxmlformats-officedocument.{t}"/>')
    if 'word/theme/theme1.xml' in names: x.append('<Override PartName="/word/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/>')
    if 'word/stylesWithEffects.xml' in names: x.append('<Override PartName="/word/stylesWithEffects.xml" ContentType="application/vnd.ms-word.stylesWithEffects+xml"/>')
    for n in sorted(names):
        if re.fullmatch(r'customXml/itemProps\d+\.xml', n): x.append(f'<Override PartName="/{n}" ContentType="application/vnd.openxmlformats-officedocument.customXmlProperties+xml"/>')
    if 'docProps/core.xml' in names: x.append('<Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/>')
    if 'docProps/app.xml' in names: x.append('<Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/>')
    x.append('</Types>')
    return ''.join(x).encode()

def root_rels(names):
    R = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships'
    x = ['<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">',
         f'<Relationship Id="rId1" Type="{R}/officeDocument" Target="word/document.xml"/>']
    if 'docProps/core.xml' in names: x.append('<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/>')
    if 'docProps/app.xml' in names: x.append(f'<Relationship Id="rId3" Type="{R}/extended-properties" Target="docProps/app.xml"/>')
    x.append('</Relationships>')
    return ''.join(x).encode()

def doc_rels(names, docxml):
    R = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships'
    x = ['<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">']
    i = 1
    for n, (_, rt) in OV.items():
        if n in names: x.append(f'<Relationship Id="rId{i}" Type="{R}/{rt}" Target="{n[5:]}"/>'); i += 1
    if 'word/theme/theme1.xml' in names: x.append(f'<Relationship Id="rId{i}" Type="{R}/theme" Target="theme/theme1.xml"/>'); i += 1
    ids = list(dict.fromkeys(re.findall(r'r:embed="([^"]+)"', docxml.decode('utf-8', 'replace'))))
    media = sorted(n for n in names if n.startswith('word/media/'))
    for rid, m in zip(ids, media):
        x.append(f'<Relationship Id="{rid}" Type="{R}/image" Target="{m[5:]}"/>')
    x.append('</Relationships>')
    return ''.join(x).encode(), (len(ids), len(media))

def prune(keep, log):
    """Drop relationships and content-type overrides that point at parts which are gone."""
    import posixpath
    for rp in [n for n in keep if n.endswith('.rels')]:
        base = posixpath.dirname(posixpath.dirname(rp))
        x = keep[rp].decode('utf-8', 'replace'); gone = []
        def chk(m):
            tag = m.group(0)
            if 'TargetMode="External"' in tag: return tag
            t = re.search(r'Target="([^"]+)"', tag)
            if not t: return tag
            tgt = t.group(1).lstrip('/') if t.group(1).startswith('/') else posixpath.normpath(posixpath.join(base, t.group(1)))
            if tgt in keep: return tag
            gone.append(tgt); return ''
        y = re.sub(r'<Relationship\b[^>]*/>', chk, x)
        if gone:
            keep[rp] = y.encode(); log.append(f'{rp}: removed {len(gone)} link(s) to missing parts ({", ".join(gone)})')
    ct = keep['[Content_Types].xml'].decode('utf-8', 'replace')
    ct2 = re.sub(r'<Override PartName="/([^"]+)"[^>]*/>', lambda m: m.group(0) if m.group(1) in keep else '', ct)
    if ct2 != ct: keep['[Content_Types].xml'] = ct2.encode(); log.append('[Content_Types].xml: removed overrides for missing parts')

def zip_opens(b):
    try:
        z = zipfile.ZipFile(io.BytesIO(b)); return z.testzip() is None
    except Exception:
        return False

def xml_ok(d):
    try:
        import xml.dom.minidom as md; md.parseString(d); return True
    except Exception:
        return False

def fix(b):
    log = []
    if b[:4] == b'PK\x03\x04' and not zip_opens(b):
        try:
            u = b.decode('utf-8').encode('latin-1')
            if zip_opens(u): b = u; log.append('converted the bytes back from UTF-8 to single bytes (undo a UTF-8 resave)')
        except Exception:
            pass
    if b[:4] == b'PK\x03\x04' and b.count(b'\r\n') > 20 and b'\n' not in b.replace(b'\r\n', b''):
        b = b.replace(b'\r\n', b'\n'); log.append('replaced 0D 0A with 0A (undo a text-mode transfer)')
    at = b[:65536].find(b'PK\x03\x04')
    if at > 0 and b[:4] != b'PK\x03\x04' and any(b[:at]) and b[:4] != bytes(4):
        b = b[at:]; log.append(f'removed {at} bytes in front of the first ZIP signature')
    e = b.rfind(b'PK\x05\x06')
    if e >= 0 and e + 22 <= len(b):
        clen, = struct.unpack_from('<H', b, e + 20)
        if e + 22 + clen < len(b):
            n = len(b) - (e + 22 + clen); b = b[:e + 22 + clen]; log.append(f'removed {n} bytes after the end record')
    parts = scan_parts(b)
    keep, dropped = {}, []
    for n, (d, st) in parts.items():
        if st == 'ok': keep[n] = d
        elif st == 'bad-crc' and (n.startswith('word/media/') or xml_ok(d)):
            keep[n] = d; log.append(f'{n}: CRC does not match but the data inflates{"" if n.startswith("word/media/") else " and parses as XML"}; kept it, check the result')
        elif st == 'partial' and n.startswith('word/media/'):
            keep[n] = d; log.append(f'{n}: cut short; kept the part so the link still points somewhere (the picture will not show)')
        else: dropped.append(f'{n} ({st})')
    if dropped: log.append('dropped damaged parts: ' + ', '.join(dropped))
    names = set(keep)
    doc = keep.get('word/document.xml')
    if not doc and 'word/document.xml' in parts:
        data, st = parts['word/document.xml']
        paras = paragraphs_before_damage(data) if data else []
        if paras:
            doc = plain_document(paras); log.append(f'word/document.xml was {st}: kept {len(paras)} complete paragraphs as plain text (formatting and tables are lost)')
            keep['word/document.xml'] = doc; names.add('word/document.xml')
    if not doc:
        log.append('word/document.xml could not be recovered: there is no text left to rebuild from')
        return None, log, 'no document part'
    if not re.search(rb'</w:document>\s*$', doc) or not xml_ok(doc):
        paras = paragraphs_before_damage(doc)
        if not paras:
            log.append('word/document.xml is damaged and has no full paragraph'); return None, log, 'no document text'
        keep['word/document.xml'] = doc = plain_document(paras); log.append(f'word/document.xml did not end cleanly: rebuilt from {len(paras)} complete paragraphs (formatting and tables are lost)')
    rebuilt = False
    if '[Content_Types].xml' not in keep:
        keep['[Content_Types].xml'] = content_types(names); log.append('wrote a new [Content_Types].xml from standard rules'); rebuilt = True
    if '_rels/.rels' not in keep:
        keep['_rels/.rels'] = root_rels(names); log.append('wrote a new _rels/.rels from standard rules'); rebuilt = True
    if 'word/_rels/document.xml.rels' not in keep:
        r, (ni, nm) = doc_rels(names, doc); keep['word/_rels/document.xml.rels'] = r
        log.append(f'wrote a new word/_rels/document.xml.rels (picture links are a guess: {ni} used, {nm} stored)'); rebuilt = True
    prune(keep, log)
    heavy = bool(dropped or rebuilt or any('CRC does not match' in l or 'cut short' in l or 'did not end' in l or 'complete paragraphs' in l or 'missing parts' in l for l in log))
    if not heavy and zip_opens(b):
        return b, log, ('fixed without rewriting any part' if log else 'nothing to fix: the ZIP opens and every required part is there')
    bio = io.BytesIO(); zo = zipfile.ZipFile(bio, 'w', zipfile.ZIP_DEFLATED)
    order = ['[Content_Types].xml', '_rels/.rels'] + [n for n in keep if n not in ('[Content_Types].xml', '_rels/.rels')]
    for n in order: zo.writestr(n, keep[n])
    zo.close()
    log.insert(0, f'scanned local headers: {len(parts)} parts found, {sum(1 for d, st in parts.values() if st == "ok")} pass the CRC test')
    return bio.getvalue(), log, 'new ZIP written'

if __name__ == '__main__':
    b = open(sys.argv[1], 'rb').read()
    if not b: print('empty file: nothing to repair'); sys.exit(1)
    out, log, note = fix(b)
    for l in log: print('fix:', l)
    print(note)
    if out is None: sys.exit(1)
    open(sys.argv[2], 'wb').write(out)
    print(f'wrote {sys.argv[2]} ({len(out):,} bytes)')

fix: removed 512 bytes in front of the first ZIP signature
fixed without rewriting any part
wrote fixed.docx (76,357 bytes)

unzip -p broken.docx word/document.xml | sed 's/<[^>]*>/ /g' > text.txt

#!/usr/bin/env python3
"""text_pass.py: print the text of a DOCX file, even when the ZIP directory is damaged.
Usage: python3 text_pass.py damaged.docx > text.txt
It ignores the central directory. It scans for local headers, inflates what it
can of every part and prints the w:t text of every paragraph it finds."""
import re, struct, sys, zlib

def parts(b):
    p = 0
    while True:
        p = b.find(b'PK\x03\x04', p)
        if p < 0 or p + 30 > len(b): return
        meth, = struct.unpack_from('<H', b, p + 8)
        nl, el = struct.unpack_from('<HH', b, p + 26)
        name = b[p + 30:p + 30 + nl].decode('utf-8', 'replace')
        start = p + 30 + nl + el
        if meth == 8 and name.endswith('.xml'):
            d, out = zlib.decompressobj(-15), b''
            try:
                for i in range(start, len(b), 64):
                    out += d.decompress(b[i:i + 64])
                    if d.eof: break
            except zlib.error:
                pass
            yield name, out
        p += 4

for path in sys.argv[1:]:
    b = open(path, 'rb').read()
    for name, xml in parts(b):
        t = xml.decode('utf-8', 'replace')
        if '<w:t' not in t: continue
        for para in re.findall(r'<w:p[ >].*?(?:</w:p>|$)', t, re.S):
            line = ''.join(re.findall(r'<w:t[^>]*>([^<]*)', para))
            if line: print(line)

$ python3 text_pass.py broken.docx | wc -l
53
$ python3 text_pass.py broken.docx | head -2
Harbor Notes
Paragraph 01: The harbor report for week 1 lists 52 boats and 255 crates.

zip -FF broken.docx --out fixed.docx
# answer y when it asks about a single-disk archive
unzip -t fixed.docx