1 2#------------------------------------------------------------------------------ 3# $File: windows,v 1.67 2024/11/09 22:43:01 christos Exp $ 4# windows: file(1) magic for Microsoft Windows 5# 6# This file is mainly reserved for files where programs 7# using them are run almost always on MS Windows 3.x or 8# above, or files only used exclusively in Windows OS, 9# where there is no better category to allocate for. 10# For example, even though WinZIP almost run on Windows 11# only, it is better to treat them as "archive" instead. 12# For format usable in DOS, such as generic executable 13# format, please specify under "msdos" file. 14# 15 16 17# Summary: Outlook Express DBX file 18# Created by: Christophe Monniez 19# Update: Joerg Jenderek 20# URL: http://fileformats.archiveteam.org/wiki/Outlook_Express_Database 21# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbx.trid.xml 22# https://sourceforge.net/projects/ol2mbox/files/LibDBX/ 23# v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT 24# Note: called "Outlook Express Database" by TrID and DROID via PUID fmt/838 fmt/839 25# and partly verified by `undbx --verbosity 4 Posteingang.dbx` 260 string \xCF\xAD\x12\xFE 27# skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file size 28>0x7C ulelong >0 MS Outlook Express DBX file 29#!:mime application/octet-stream 30#!:mime application/vnd.ms-outlook 31!:mime application/x-ms-dbx 32!:ext dbx 33>>4 byte =0xC5 \b, message database 34>>4 byte =0xC6 \b, folder database 35>>4 byte =0xC7 \b, account information 36>>4 byte =0x30 \b, offline database 37# version like: 5.2 5.5 (typical) 38>>20 ulequad !0x0000000500000005 \b, version 39# major version 40>>>24 ulelong x %u 41# minor version 42>>>20 ulelong x \b.%u 43# CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder 44# 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline 45#>>4 guid x \b, CLSID %s 46# file size; total size of file; sometimes real size a little bit higher 47>>0x7C ulelong x \b, ~ %u bytes 48# highest Email ID; the next email will have a number one higher than this 49>>0x5c ulelong x \b, highest ID %#x 50# item count; number of items stored in this DBX file 51>>0xC4 ulelong x \b, %u item 52# plural s 53>>0xC4 ulelong !1 \bs 54# index pointer; file offset pointing to a page of Data Indexes 55>>0xE4 ulelong >0 \b, index pointer %#x 56 57# From: Joerg Jenderek 58# URL: http://fileformats.archiveteam.org/wiki/Nickfile 59# https://www.nirsoft.net/utils/outlook_nk2_edit.html 60# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nk2.trid.xml 61# https://github.com/libyal/libnk2/blob/main/documentation 62# Nickfile%20(NK2)%20format.asciidoc 63# Note: called "Outlook Nickfile" by TrID & TestDisk and 64# "Outlook Nickname File" by Microsoft Outlook and 65# "Outlook AutoComplete File" by Nirsoft NK2Edit 66# partly verfied by NK2Edit Raw Text Edit Mode 670 ubelong 0x0DF0ADBA MS Outlook Nickfile 68#!:mime application/octet-stream 69#!:mime application/vnd.ms-outlook 70!:mime application/x-ms-nickfile 71!:ext nk2/dat/bak 72# nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is used for backup 73#!:ext nick/nk2/dat/bak 74# Unknown; probably a version indicator like: 0000000Ah 0000000Ch 75>4 ulelong x \b, probably version %u 76# Unknown2; probably a version indicator like: 1 0 77>8 ulelong x \b.%u 78# number of rows (nickname or alias items) in file 79>12 ulelong x \b, %u items 80# number of item entries/columns/properties value like: 17h 81>16 ulelong x \b, %u entries 82# value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string 83>20 uleshort x \b, value type %#4.4x 84# entry type/property identifier: 6001h~PR_DOTSTUFF_STATE/PR_NICK_NAME_W 85>22 uleshort x \b, entry type %#4.4x 86# Reserved like: 0013FD90h 87#>24 ulelong x \b, reserved %#8.8x 88# value data array/Irrelevant Union like: 0000000004E31A80h 89#>28 ulequad x \b, data %#16.16llx 90# UTF-16 91>20 uleshort =0x001F 92# unicode string bytes like: 2Ch 93>>36 ulelong x \b, %u bytes 94# unicode string value PT_UNICODE like: janesmith@contoso.org 95>>40 lestring16 x "%s" 96 97# Summary: Windows crash dump 98# Created by: Andreas Schuster (https://computer.forensikblog.de/) 99# https://web.archive.org/web/20101125060849/https://computer.forensikblog.de/en/2008/02/64bit_magic.html 100# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 101# Modified by (2): Joerg Jenderek (addtional fields, extension, URL) 102# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp.trid.xml 103# https://gitlab.com/qemu-project/qemu/-/blob/master/include/qemu/win_dump_defs.h 104# Note: called "Windows memory dump" by TrID 105# and verified by like Windows Kit `Dumpchk.exe 043022-18703-01.dmp` 106# and partly by NirSoft `BlueScreenView.exe 043022-18703-01.dmp` 107# char Signature[4] 1080 string PAGE 109# char ValidDump[4] 110>4 string DUMP MS Windows 32bit crash dump 111#!:mime application/octet-stream 112!:mime application/x-ms-dmp 113# like: Mini111013-01.dmp 114!:ext dmp 115# major version like: 15 116>>8 ulelong x \b, version %u 117# minor version like: 2600 118>>12 ulelong x \b.%u 119# DirectoryTableBase like: 709000 120#>>16 ulelong x \b, DirectoryTableBase %#x 121# PfnDatabase like: 805620c8 122#>>20 ulelong x \b, PfnDatabase %#x 123# PsLoadedModuleList like: 8055d720 124#>>24 ulelong x \b, PsLoadedModuleList %#x 125# PsActiveProcessHead like:805638b8 126#>>28 ulelong x \b, PsActiveProcessHead %#x 127# MachineImageType like: 14c (intel x86) 128>>32 ulelong !0x14c \b, MachineImageType %#x 129# NumberProcessors like: 2 130>>36 ulelong x \b, %u processors 131# BugcheckCode like: e2 132#>>40 ulelong x \b, BugcheckCode %#x 133# BugcheckParameter1 like: 0 134#>>44 ulelong x \b, BugcheckParameter1 %#x 135# BugcheckParameter2 like: 0 136#>>48 ulelong x \b, BugcheckParameter2 %#x 137# BugcheckParameter3 like: 0 138#>>52 ulelong x \b, BugcheckParameter3 %#x 139# BugcheckParameter4 like: 0 140#>>56 ulelong x \b, BugcheckParameter4 %#x 141# VersionUser[32]; like "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 142#>>60 string x \b, VersionUser "%.32s" 143# uint32_t reserved0 like: 45474101 144#>>92 ulelong x \b, reserved0 %#x 145>>0x05c byte 0 \b, no PAE 146>>0x05c byte 1 \b, PAE 147# KdDebuggerDataBlock like: 8054d2e0 148#>>96 ulelong x \b, KdDebuggerDataBlock %#x 149# uint8_t PhysicalMemoryBlockBuffer[700] 150# WinDumpPhyMemDesc32 NumberOfRuns like: 45474150 151#>>100 ulelong x \b, NumberOfRuns %#x 152# WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 153#>>104 ulelong x \b, NumberOfPages %#x 154# WinDumpPhyMemRun32 Run[86]; 688 bytes 155#>>108 ulelong x \b, BasePage %#x 156#>>112 ulelong x \b, PageCount %#x 157# uint8_t reserved1[3200] 158#>>800 string x \b, reserved "%s" 159#>>4000 ulelong x \b, RequiredDumpSpace %#x 160# uint8_t reserved2[92]; 161#>>4004 string x \b, reserved2 "%s" 162>>0xf88 lelong 1 \b, full dump 163>>0xf88 lelong 2 \b, kernel dump 164>>0xf88 lelong 3 \b, small dump 165# like: 4 166>>0xf88 lelong >3 \b, dump type (%#x) 167# WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 168# GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 169#>>104 ulelong x \b, NumberOfPages %#x 170>>0x068 lelong x \b, %d pages 171# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp-64.trid.xml113o 172# Note: called "Windows 64bit Memory Dump" by TrID 173# char ValidDump[4] 174>4 string DU64 MS Windows 64bit crash dump 175#!:mime application/octet-stream 176!:mime application/x-ms-dmp 177# like: c:\Windows\Minidump\020322-18890-01.dmp c:\Windows\MEMORY.DMP 178!:ext dmp 179# major version like: 15 180>>8 ulelong x \b, version %u 181# minor version like: 9600 19041 22621 182>>12 ulelong x \b.%u 183# DirectoryTableBase like: 001ab000 184#>>16 ulequad x \b, DirectoryTableBase %#llx 185# PfnDatabase like: fffffa8000000000 186#>>24 ulequad x \b, PfnDatabase %#llx 187# PsLoadedModuleList like: fffff800c553f650 188#>>32 ulequad x \b, PsLoadedModuleList %#llx 189# PsActiveProcessHead like: fffff800c5525400 190#>>40 ulequad x \b, PsActiveProcessHead %#llx 191# MachineImageType like: 00008664 192>>48 ulelong !0x8664 \b, MachineImageType %#x 193# NumberProcessors like: 2 4 194>>52 ulelong x \b, %u processors 195# BugcheckCode like: 1000007e 196#>>56 ulelong x \b, BugcheckCode %#x 197# unused0 198#>>60 ulelong x \b, unused0 %#x 199# BugcheckParameter1 like: ffffffffc0000005 200#>>64 ulequad x \b, BugcheckParameter1 %#llx 201# BugcheckParameter2 like: fffff801abb2158f 202#>>72 ulequad x \b, BugcheckParameter2 %#llx 203# BugcheckParameter3 like: ffffd000290d4288 204#>>80 ulequad x \b, BugcheckParameter3 %#llx 205# BugcheckParameter4 like: ffffd000290d3aa0 206#>>88 ulequad x \b, BugcheckParameter4 %#llx 207# VersionUser[32]; like "" "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 208#>>96 string x \b, VersionUser "%.32s" 209# KdDebuggerDataBlock like: fffff800c550c530 210#>>128 ulequad x \b, KdDebuggerDataBlock %#llx 211# uint8_t PhysicalMemoryBlockBuffer[704] 212# WinDumpPhyMemDesc64 NumberOfRuns like: 6 7 0x45474150 213#>>136 ulelong x \b, NumberOfRuns %#x 214# WinDumpPhyMemDesc64 unused like: 0 0x45474150 215#>>140 ulelong x \b, unused %#x 216# WinDumpPhyMemRun64 Run[43] BasePage like: 1 217#>>152 ulequad x \b, BasePage %#llx 218# WinDumpPhyMemRun64 Run[43] PageCount like: 57h 219#>>160 ulequad x \b, PageCount %#llx 220# uint8_t ContextBuffer[3000] like: "" "\001" "\0207J\266\001\340\377\377&8\007\312" 221#>>840 string x \b, ContextBuffer "%s" 222# WinDumpExceptionRecord ExceptionCode 223#>>3840 ulelong x \b, ExceptionCode %#x 224# WinDumpExceptionRecord ExceptionFlags 225#>>3844 ulelong x \b, ExceptionFlags %#x 226# WinDumpExceptionRecord ExceptionRecord 227#>>3848 ulequad x \b, ExceptionRecord %#llx 228# WinDumpExceptionRecord ExceptionAddress 229#>>3856 ulequad x \b, ExceptionAddress %#llx 230# WinDumpExceptionRecord NumberParameters 231#>>3864 ulelong x \b, NumberParameters %#x 232# WinDumpExceptionRecord unused 233#>>3868 ulelong x \b, unsed %#x 234# WinDumpExceptionRecord ExceptionInformation[15] 235#>>3872 ulequad x \b, ExceptionInformation[0] %#llx 236# https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options 237# but DumpType like: 4~small 5~full (MEMORY.DMP) 6~kernel (MEMORY.DMP) 238>>0xf98 ulelong x \b, 239>>>0xf98 lelong 5 full dump 240>>>0xf98 lelong 6 kernel dump 241>>>0xf98 lelong 4 small dump 242# This probably never occur 243>>>0xf98 default x DumpType 244>>>>0xf98 ulelong x (%#x) 245# WinDumpPhyMemDesc64 uint64_t NumberOfPages like: 3142425 8341923 8366500 1162297680 4992030524978970960 246# GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 247>>0x090 lequad x \b, %lld pages 248 249# Summary: Vista Event Log 250# Created by: Andreas Schuster (https://computer.forensikblog.de/) 251# Update: Joerg Jenderek 252# URL: https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc 253# Reference (1): https://web.archive.org/web/20110803085000/ 254# https://computer.forensikblog.de/en/2007/05/some_magic.html 255# http://mark0.net/download/triddefs_xml.7z/defs/e/evtx.trid.xml 256# Note: called "Vista Event Log" by TrID and "Event Log" by Windows 257# verified partly by `wevtutil.exe gli /lf:true dumpfile.evtx` 2580 string ElfFile\0 MS Windows 259#!:mime application/octet-stream 260!:mime application/x-ms-evtx 261!:ext evtx 262# Major+Minor format version: 3.1~Vista and later 3.2~Windows 10 (2004) and later 263>0x24 ulelong =0x00030001 Vista-8.1 Event Log 264>0x24 ulelong !0x00030001 10-11 Event Log, version 265>>0x26 uleshort x %u 266>>0x24 uleshort x \b.%u 267>0x2a leshort x \b, %d chunks 268>>0x10 lelong x \b (no. %d in use) 269>0x18 lelong >1 \b, next record no. %d 270>0x18 lelong =1 \b, empty 271>0x78 lelong &1 \b, DIRTY 272>0x78 lelong &2 \b, FULL 273 274# Summary: Windows Event Trace Log 275# From: Joerg Jenderek 276# URL: http://fileformats.archiveteam.org/wiki/ETL 277# Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/etl.trid.xml 278# https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracelog/trace_logfile_header.htm 279# Note: called "Window tracing/diagnostic binary log" by TrID 280# verified by `tracerpt.EXE Wifi.etl -of EVTX` 281# and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml` 282# Every ETL file begins with a WMI_BUFFER_HEADER, a SYSTEM_TRACE_HEADER and a TRACE_LOGFILE_HEADER 2830 ubyte 0 284# look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl 285>0 search/0x699087/b .\0e\0t\0l\0\0\0 286# GRR: line above only works if in ../../src/file.h FILE_BYTES_MAX is raised above 699086h (6,59 MiB) 287>>0 use trace-etl 288# display information of Windows Performance Analyzer Trace File (file name) 2890 name trace-etl 290>0 ubyte x Windows Event Trace Log 291#!:mime application/x-ms-etl 292# http://extension.nirsoft.net/etl 293!:mime application/etl 294!:ext etl 295# look for DOS drive letter part of log file name like: PhotosAppTracing_startedInBGMode.etl 296>0 search/0x2b4/sb :\0\x5c\0 297# like: "c:\Windows\Logs\NetSetup\service.0.etl" "C:\Windows\System32\LogFiles\WMI\Wifi.etl" 298>>&-2 lestring16 x "%s" 299 300# Summary: Windows System Deployment Image 301# Created by: Joerg Jenderek 302# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 303# Reference: http://skolk.livejournal.com/1320.html 3040 string $SDI 305>4 string 0001 System Deployment Image 306!:mime application/x-ms-sdi 307#!:mime application/octet-stream 308# \Boot\boot.sdi 309!:ext sdi 310# MDBtype: 0~Unspecified 1~RAM 2~ROM 311>>8 ulequad !0 \b, MDBtype %#llx 312# BootCodeOffset 313>>16 ulequad !0 \b, BootCodeOffset %#llx 314# BootCodeSize 315>>24 ulequad !0 \b, BootCodeSize %#llx 316# VendorID 317>>32 ulequad !0 \b, VendorID %#llx 318# DeviceID 319>>40 ulequad !0 \b, DeviceID %#llx 320# DeviceModel 321>>48 ulequad !0 \b, DeviceModel %#llx 322>>>56 ulequad !0 \b%llx 323# DeviceRole 324>>64 ulequad !0 \b, DeviceRole %#llx 325# Reserved1; reserved fields and gaps between BLOBs are padded with \0 326#>>72 ulequad !0 \b, Reserved1 %#llx 327# RuntimeGUID 328>>80 ulequad !0 \b, RuntimeGUID %#llx 329>>>88 ulequad !0 \b%llx 330# RuntimeOEMrev 331>>96 ulequad !0 \b, RuntimeOEMrev %#llx 332# Reserved2 333#>>104 ulequad !0 \b, Reserved2 %#llx 334# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 335>>112 ulequad !0 \b, PageAlignment %llu 336# Reserved3[48] 337#>>120 ulequad !0 \b, Reserved3 %#llx 338# SDI checksum 39h 339>>0x1f8 ulequad x \b, checksum %#llx 340# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 341>>0x400 string >\0 \b, type %-3.8s 342# 0~non-filesystem 7~NTFS 6~BIGFAT 343>>>0x420 ulequad !0 (%#llx) 344# ATTRibutes 345>>>0x408 ulequad !0 %#llx attributes 346# Offset 347>>>0x410 ulequad x at %#llx 348# print 1 space after size and then handles NTFS boot sector by ./filesystems 349>>>0x418 ulequad >0 %llu bytes 350>>>>(0x410.l) indirect x 351# 2nd BLOB: WIM 352>>0x440 string >\0 \b, type %-3.8s 353>>>0x428 ulequad !0 (%#llx) 354# ATTRibutes 355>>>0x448 ulequad !0 %#llx attributes 356# Offset 357>>>0x450 ulequad x at %#llx 358>>>0x458 ulequad >0 %llu bytes 359>>>>(0x450.l) indirect x 360# 3rd BLOB 361>>0x480 string >\0 \b, type %-3.8s 362 363# Summary: Windows boot status log BOOTSTAT.DAT 364# From: Joerg Jenderek 365# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 366# Note: mainly refers to older Windows Vista, sometimes 367# BOOTSTAT.DAT only contains nulls or invalid data 368# checking for valid version below 5 3690 ulelong <5 370# skip many ISO images by checking for valid 64 KiB file size 371>8 ulelong =0x00010000 372>>0 use bootstat-dat 373# display information of BOOTSTAT.DAT 3740 name bootstat-dat 375>0 ulelong x Windows boot log 376#!:mime application/octet-stream 377!:mime application/x-ms-dat 378# BOOTSTAT.DAT in BOOT subdirectory 379!:ext dat 380# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 381>0 ulelong >2 \b, version %u 382# apparently the size of the header: often 10h in older Windows, 14h, 18h 383>4 ulelong !0x10 \b, header size %#x 384#>4 ulelong !0x10 \b, header size %u 385# apparently the size of the file: always 0x00010000~64KiB 386# the file is acceptable to BOOTMGR only if it is exactly 64 KiB 387>8 ulelong !0x00010000 \b, file size %#x 388# size of valid data, in bytes: C8h 50h 172h 5D5Ch 389>0xc ulelong x \b, %#x valid bytes 390# skip header and jump to first bootstat entry and display information 391>(0x4.l-1) ubyte x 392>>&0 use bootstat-entry 393# jump to first entry again because pointer are bad after "use" 394>(0x4.l-1) ubyte x 395# by 1st entry size jump to 2nd entry and display information 396>>&(&0x18.l-1) ubyte x 397>>>&0 use bootstat-entry 398# jump to possible 3rd boot entry and display information 399# >(0x4.l-1) ubyte x 400# >>&(&0x18.l-1) ubyte x 401# >>>&(&0x18.l-1) ubyte x 402# >>>>&0 use bootstat-entry 403# display BOOTSTAT.DAT entry 4040 name bootstat-entry 405#>0x00 ubequad x \b, ENTRY %16.16llx 406# size of entry, in bytes: 40h(init) 78h(launced) 9Ch 407#>0x18 ulelong x \b; entry size %u 408>0x18 ulelong x \b; entry size %#x 409# time stamp, in seconds 410>0x00 ulelong x \b, %#x seconds 411# always zero, significance unknown 412>0x04 ulelong !0 \b, not null %u 413# GUID of event source; but empty if event source is BOOTMGR 414>0x08 ubequad !0 \b, GUID %#16.16llx 415>>0x10 ubequad x \b%16.16llx 416# severity code: 1~informational 3~errors 417>0x1C ulelong !1 \b, severity %#x 418# apparently a version number: 2 419>0x20 ulelong !2 \b, version %u 420# event identifier 1~log file initialised 11h~boot application launched 421#>0x24 ulelong x \b, event %#x 422>0x24 ulelong !1 423>>0x24 ulelong !0x11 \b, event %#x 424# entry data; size depends on event identifier 425#>0x28 ubequad x \b, data %#16.16llx 426>0x24 ulelong =0x1 \b, Init 427# always 0, significance unknown 428>>0x34 uleshort !0 \b, not null %u 429# always 7, significance unknown 430>>0x36 uleshort !7 \b, not seven %u 431# year 432>>0x28 uleshort x %u 433# month 434>>0x2A uleshort x \b-%u 435# day 436>>0x2C uleshort x \b-%u 437# hour 438>>0x2E uleshort x %u 439# minute 440>>0x30 uleshort x \b:%u 441# second 442>>0x32 uleshort x \b:%u 443# boot application launched 444>0x24 ulelong =0x11 \b, launched 445# type of start: 0 normally, 1 or 2 maybe in a recovery sequence 446>>0x38 uleshort !0 \b, type %u 447# pathname of boot application, as null-terminated Unicode string; typically 448# \Windows\system32\winload.exe \Windows\system32\winload.efi 449>>0x3C lestring16 x %s 450 451# Summary: Windows Error Report text files 452# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 453# Reference: https://www.nirsoft.net/utils/app_crash_view.html 454# Created by: Joerg Jenderek 455# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 456# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 4570 lestring16 Version= 458>22 lestring16 EventType Windows Error Report 459!:mime text/plain 460# Report.wer 461!:ext wer 462 463# Summary: Windows 3.1 group files 464# Extension: .grp 465# Created by: unknown 4660 string \120\115\103\103 MS Windows 3.1 group files 467 468 469# Summary: Old format help files 470# URL: https://en.wikipedia.org/wiki/WinHelp 471# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 472# Update: Joerg Jenderek 473# Created by: Dirk Jagdmann <doj@cubic.org> 474# 475# check and then display version and date inside MS Windows HeLP file fragment 4760 name help-ver-date 477# look for Magic of SYSTEMHEADER 478>0 leshort 0x036C 479# version Major 1 for right file fragment 480>>4 leshort 1 Windows 481# print non empty string above to avoid error message 482# Warning: Current entry does not yet have a description for adding a MIME type 483# not officially registered at IANA 484#!:mime application/winhelp 485#!:mime application/winhlp 486!:mime application/x-winhelp 487# version Minor of help file format is hint for windows version 488# HC30 Windows 3.0 help file 489>>>2 leshort 15 3.0 490# HC31 Windows 3.1 help file 491>>>2 leshort 21 3.1 492# WMVC/MMVC media view file 493>>>2 leshort 27 494# MVC or HCW 4.00 Windows 95 495>>>2 leshort 33 95 496# next line should not happen 497>>>2 default x y.z 498>>>>2 leshort x %#x 499# to complete message string like "MS Windows 3.x help file" 500>>>2 leshort !27 501# HLP or few MVB like NOTEPLAY.MVB 502>>>>2 leshort x help 503!:ext hlp 504# URL: http://fileformats.archiveteam.org/wiki/Multimedia_Viewer_Book 505# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mvb.trid.xml 506# Note: called "Multimedia Viewer Book" by TrID and by DROID via PUID fmt/1800 507>>>2 leshort =27 Multimedia Viewer Book 508!:ext mvb 509# GenDate often older than file creation date 510>>>6 ldate x \b, %s 511# flags determine the compression 512#>>>10 uleshort x \b, flags %#x 513>>>2 leshort <17 514# HelpFileTitle 515>>>>12 string x \b, title "%s" 516>>>2 leshort >16 517# SYSTEMREC[].RecordType type of data in record; 1~help file title 2~COPYRIGHT 3~TOPICOFFSET Contents 4~Macro 5~*.ICO 6~HPJ-structure 518#>>>>12 uleshort x \b, RecordType %u 519# DataSize size of data 520#>>>>14 uleshort x \b, DataSize %u 521>>>>12 uleshort 1 522>>>>>14 pstring/h >\0 \b, title "%s" 523# Magic for HeLP files 524# URL: http://fileformats.archiveteam.org/wiki/HLP_(WinHelp) 525# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp.trid.xml 526# Note: called "Windows HELP File" by TrID, "Windows Help File" by DROID via PUID fmt/474 and 527# "WinHelp help file" by shared MIME-info database from freedesktop.org 5280 lelong 0x00035f3f 529# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 530# file header magic 0x293B at DirectoryStart+9 531>(4.l+9) uleshort 0x293B MS 532# URL: http://fileformats.archiveteam.org/wiki/WinHelp_annotation 533# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ann.trid.xml 534# look for @VERSION bmf.. like IBMAVW.ANN 535>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 536!:mime application/x-winhelp 537!:ext ann 538>>0xD4 string !\x62\x6D\x66\x01\x00 539# "GID Help index" by TrID by gid.trid.xml 540# sometimes at little higher offset like in corelap.GID 541>>>(4.l+0x65) search/26 |Pete Windows help Global Index 542!:mime application/x-winhelp 543!:ext gid 544# HeLP Bookmark or 545# Multimedia_Viewer_Book or 546# "Windows HELP File" by TrID by hlp.trid.xml 547>>>(4.l+0x65) default x 548# maybe there exist a cleaner way to detect HeLP fragments 549# brute search for Magic 0x036C with matching Major maximal 13 iterations 550# https://sembiance.com/fileFormatSamples/document/multimediaViewerBook/viewerht.mvb 551>>>>16 search/0x1bbc370/s \x6c\x03 552>>>>>&0 use help-ver-date 553>>>>>&4 leshort !1 554# viewerht.mvb 555>>>>>>&-2 search/0x1c4b6f0/s \x6c\x03 556>>>>>>>&0 use help-ver-date 557>>>>>>>&4 leshort !1 558# https://sembiance.com/fileFormatSamples/document/multimediaViewerBook/clarkhow.mvb 559>>>>>>>>&0 search/0x34ab80/s \x6c\x03 560>>>>>>>>>&0 use help-ver-date 561>>>>>>>>>&4 leshort !1 562>>>>>>>>>>&0 search/0x473ab0/s \x6c\x03 563>>>>>>>>>>>&0 use help-ver-date 564>>>>>>>>>>>&4 leshort !1 565>>>>>>>>>>>>&0 search/0x739680/s \x6c\x03 566>>>>>>>>>>>>>&0 use help-ver-date 567>>>>>>>>>>>>>&4 leshort !1 568>>>>>>>>>>>>>>&0 search/0x76c030/s \x6c\x03 569>>>>>>>>>>>>>>>&0 use help-ver-date 570>>>>>>>>>>>>>>>&4 leshort !1 571>>>>>>>>>>>>>>>>&0 search/0x805c80/s \x6c\x03 572# GCC.HLP is detected after 7 iterations 573>>>>>>>>>>>>>>>>>&0 use help-ver-date 574>>>>>>>>>>>>>>>>>&4 leshort !1 575>>>>>>>>>>>>>>>>>>&0 search/0x805c80/s \x6c\x03 576>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 577>>>>>>>>>>>>>>>>>>>&4 leshort !1 578>>>>>>>>>>>>>>>>>>>>&0 search/0xb63480/s \x6c\x03 579>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 580>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 581>>>>>>>>>>>>>>>>>>>>>>&0 search/0xb7fe80/s \x6c\x03 582>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 583>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 584>>>>>>>>>>>>>>>>>>>>>>>>&0 search/0xb8ade0/s \x6c\x03 585>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 586>>>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 587>>>>>>>>>>>>>>>>>>>>>>>>>>&0 search/0x371d4/s \x6c\x03 588>>>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 589>>>>>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 590>>>>>>>>>>>>>>>>>>>>>>>>>>>>&0 search/0x371d4/s \x6c\x03 591>>>>>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 592>>>>>>>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 593# https://sembiance.com/fileFormatSamples/document/multimediaViewerBook/arivideo.mvb 594>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>8 lelong !0xFFffFFff Windows Multimedia Viewer Book 595!:mime application/x-winhelp 596!:ext mvb 597# repeat search again or following default line does not work 598>>>>16 search/0x49AF/s \x6c\x03 599# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 7 8.1 64-bit) 600# typically found inside directory %LOCALAPPDATA%\Help 601>>>>16 default x Windows help Bookmark 602!:mime application/x-winhelp 603!:ext /bmk 604# DirectoryStart offset of FILEHEADER of internal directory 605#>4 lelong x \b, DirectoryStart %8.8x 606## FirstFreeBlock normally for *HLP FFFFFFFFh if no free list or 10h for *ANN 607#>>8 lelong x \b, FirstFreeBlock %#8.8x 608## ReservedSpace normally 042Fh AFh for *.ANN 609#>>(4.l) lelong x \b, ReservedSpace %#8.8x 610## UsedSpace normally 0426h A6h for *.ANN 611#>>(4.l+4) lelong x \b, UsedSpace %#8.8x 612## FileFlags normally 04... 613#>>(4.l+5) lelong x \b, FileFlags %#8.8x 614## file header magic 0x293B 615#>>(4.l+9) uleshort x \b, file header magic %#4.4x 616## file header Flags 0x0402 617#>>(4.l+11) uleshort x \b, file header Flags %#4.4x 618## file header PageSize 0400h 80h for *.ANN 619#>>(4.l+13) uleshort x \b, PageSize %#4.4x 620## Structure[16] z4 621#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 622## MustBeZero 0 623#>>(4.l+31) uleshort x \b, MustBeZero %#4.4x 624## PageSplits 625#>>(4.l+33) uleshort x \b, PageSplits %#4.4x 626## RootPage 627#>>(4.l+35) uleshort x \b, RootPage %#4.4x 628## MustBeNegOne 0xffff 629#>>(4.l+37) uleshort x \b, MustBeNegOne %#4.4x 630## TotalPages 1 631#>>(4.l+39) uleshort x \b, TotalPages %#4.4x 632## NLevels 0x0001 633#>>(4.l+41) uleshort x \b, NLevels %#4.4x 634## TotalBtreeEntries 635#>>(4.l+43) ulelong x \b, TotalBtreeEntries %#8.8x 636## pages of the B+ tree 637#>>(4.l+47) ubequad x \b, PageStart %#16.16llx 638# GRR: offset is not reachable in few samples like STMMHLP.MVB because probably damaged file 639# or DROID fmt-474-signature-id-748.hlp 640# or for example run file command with higher --parameter bytes=30335189 641>(4.l+9) uleshort !0x293B MS Windows Multimedia Viewer Book 642#!:mime application/octet-stream 643!:ext mvb 644# GRR: next line is not executed! 645>>12 lelong x (damaged or use higher '-P bytes' option) 646# EntireFileSize; biggest 1551334 for CORELDRW.HLP 30335189 for viewerht.mvb; smallest 28672 for open.mvb 647>12 lelong x \b, %d bytes 648 649# start with colon or semicolon for comment line like Back2Life.cnt 6500 regex \^(:|;) 651# look for first keyword Base 652>0 search/45 :Base 653>>&0 use cnt-name 654# only solution to search again from beginning , because relative offsets changes when use is called 655>0 search/45 :Base 656>0 default x 657# look for other keyword Title like in putty.cnt 658>>0 search/45 :Title 659>>>&0 use cnt-name 660# 661# display mime type and name of Windows help Content source 6620 name cnt-name 663# skip space at beginning 664>0 string \040 665# name without extension and greater character or name with hlp extension 666>>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s" 667!:mime text/plain 668!:apple ????TEXT 669!:ext cnt 670# URL: https://en.wikipedia.org/wiki/WinHelp 671# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fts.trid.xml 672# Note: called "Windows Help Full-Text Search index" by TrID 673# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 6740 string tfMR MS Windows help Full Text Search index 675!:mime application/x-winhelp-fts 676!:ext fts 677# path of corresponding MS Windows help like: "C:\CDCREATR\creatr32.hlp" "C:\PROGRAMME\IPHOTO PLUS 4\PROGRAMS\Guide.hlp" 678>16 string >\0 for "%s" 679# From: Joerg Jenderek 680# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftg-winhelp.trid.xml 681# Note: called "Windows Help Full-Text search Group" by TrID 6820 string gfMR MS Windows help Full Text search Group 683!:mime application/x-winhelp-ftg 684!:ext ftg 685# path of corresponding FTS like: "C:\Windows\Help\winhlp32.FTS" 686>16 string >\0 for "%s" 687 688# Summary: Hyper terminal 689# Created by: unknown 690# Update: Joerg Jenderek 691# URL: https://en.wikipedia.org/wiki/HyperACCESS 692# https://www.hilgraeve.com/hyperterminal/ 693# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/ht.trid.xml 694# Note: called "HyperTerminal data file" by TrID and "HyperTerminal File" on English Windows 6950 string HyperTerminal\040 696>14 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 697#!:mime application/octet-stream 698!:mime application/x-ms-ht 699!:ext ht 700 701# https://ithreats.files.wordpress.com/2009/05/\040 702# lnk_the_windows_shortcut_file_format.pdf 703# Summary: Windows shortcut 704# Created by: unknown 705# Update: Joerg Jenderek 706# URL: http://fileformats.archiveteam.org/wiki/Windows_Shortcut 707# https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/ 708# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lnk-shortcut.trid.xml 709# https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf 710# Note: called "Windows Shortcut" by TrID, "Microsoft Windows Shortcut" by DROID via PUID x-fmt/428 and "Windows shortcut file" by ./msdos (v 1.158) 711# partly verified by command like `lnkinfo AOL.lnk` 712# 'L' + GUUID 713# HeaderSize + LinkCLSID 00021401-0000-0000-C000-000000000046 7140 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 715!:mime application/x-ms-shortcut 716!:ext lnk 717# LinkFlags 718# HasLinkTargetIDList; if set a LinkTargetIDList structure MUST follow the ShellLinkHeader; If is not set, structure MUST NOT be present 719>20 lelong&1 1 \b, Item id list present 720# HasLinkInfo; if set a LinkInfo structure MUST follow the ShellLinkHeader or LinkTargetIDList; If is not set, structure MUST NOT be present 721>20 lelong&2 2 \b, Points to a file or directory 722>20 lelong&4 4 \b, Has Description string 723>20 lelong&8 8 \b, Has Relative path 724>20 lelong&16 16 \b, Has Working directory 725>20 lelong&32 32 \b, Has command line arguments 726>20 lelong&64 64 \b, Icon 727# IconIndex 728>>56 lelong x \b number=%d 729# IsUnicode; If set then StringData section contains Unicode-encoded strings 730>20 lelong&128 128 \b, Unicoded 731# ForceNoLinkInfo; LinkInfo structure is ignored 732>20 lelong&256 256 \b, NoLinkInfo 733# HasExpString; with an EnvironmentVariableDataBlock 734>20 lelong&512 512 \b, HasEnvironment 735# look for BlockSize 314h and EnvironmentVariableDataBlock BlockSignature A0000001h 736>>76 search/1972 \x14\x03\x00\x00\x01\x00\x00\xa0 737# TargetAnsi (260 bytes); NULL-terminated path to environment variable encoded with system default code page 738#>>>&0 string x '%s' 739# TargetUnicode (520 bytes): optional NULL-terminated path to same environment variable Unicode encoded 740# like: "%windir%\system32\calc.exe" 741>>>&260 lestring16 x "%s" 742# RunInSeparateProcess; run in a separate virtual machine when launching a 16-bit application; no examples found 743>20 lelong&1024 1024 \b, RunInSeparateProcess 744# Unused1; undefined and MUST be ignored 745#>20 lelong&2048 2048 \b, Unused1 746# HasDarwinID; with a DarwinDataBlock 747>20 lelong&4096 4096 \b, HasDarwinID 748# look for BlockSize 314h and DarwinDataBlock BlockSignature A0000006h 749>>76 search/1972 \x14\x03\x00\x00\x06\x00\x00\xa0 750# DarwinDataAnsi (260 bytes); NULL-terminated application identifier encoded with system default code page; SHOULD be ignored 751#>>>&0 string x '%s' 752# DarwinDataUnicode (520 bytes); NULL-terminated application identifier Unicode encoded 753>>>&260 lestring16 x "%s" 754# RunAsUser; target application is run as a different user 755>20 lelong&8192 8192 \b, RunAsUser 756# HasExpIcon; with an IconEnvironmentDataBlock 757>20 lelong&16384 16384 \b, HasExpIcon 758# look for BlockSize 314h and IconEnvironmentDataBlock BlockSignature A0000007h 759>>76 search/1972 \x14\x03\x00\x00\x07\x00\x00\xa0 760# TargetAnsi (260 bytes); NULL-terminated path to environment icon variable encoded with system default code page 761#>>>&0 string x '%s' 762# TargetUnicode (520 bytes); optional NULL-terminated path to same icon environment variable Unicode encoded 763# like: "%SystemDrive%\Program Files\YaCy\addon\YaCy.ico" 764>>>&260 lestring16 x "%s" 765# NoPidlAlias; represented in the shell namespace; no examples found 766>20 lelong&32768 32768 \b, NoPidlAlias 767# Unused2; undefined and MUST be ignored 768#>20 lelong&65536 65536 \b, Unused2 769# RunWithShimLayer; with a ShimDataBlock; no examples found 770>20 lelong&131072 131072 \b, RunWithShimLayer 771# ForceNoLinkTrack; TrackerDataBlock is ignored; no examples found 772>20 lelong&262144 262144 \b, ForceNoLinkTrack 773>20 lelong&262144 0 774# look for BlockSize 60h, TrackerDataBlock BlockSignature A0000003h, it length 58h and Version 0 775>>76 search/1972 \x60\x00\x00\x00\x03\x00\x00\xa0\x58\x00\x00\x00\0\0\0\0 776# MachineID (16 bytes); a NULL-terminated NetBIOS name encoded with system default code page of the machine 777>>>&0 string x \b, MachineID %0.16s 778# Droid (32 bytes) 779# 780# DroidBirth (32 bytes) 781# 782# EnableTargetMetadata; collect target properties and store in PropertyStoreDataBlock 783>20 lelong&524288 524288 \b, EnableTargetMetadata 784# look for BlockSize >= Ch, PropertyStoreDataBlock BlockSignature A0000009h 785#>>76 search/1972 \x00\x00\x09\x00\x00\xa0 786# PropertyStore (variable) 787# 788# DisableLinkPathTracking; EnvironmentVariableDataBlock is ignored; no examples found 789>20 lelong&1048576 1048576 \b, DisableLinkPathTracking 790# DisableKnownFolderTracking; SpecialFolderDataBlock and KnownFolderDataBlock are ignored and not saved 791>20 lelong&2097152 2097152 \b, DisableKnownFolderTracking 792>20 lelong&2097152 0 793# look for BlockSize 1Ch and KnownFolderDataBlock BlockSignature A000000Bh 794>>76 search/1972 \x1c\x00\x00\x00\x0B\x00\x00\xa0 795# https://learn.microsoft.com/en-us/dotnet/desktop/winforms/controls/known-folder-guids-for-file-dialog-custom-places 796# KnownFolderID specifies the folder GUID ID 797# ProgramFiles 905E63B6-C1BF-494E-B29C-65B732D3D21A 798# ProgramFilesX86 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E 799>>>&0 guid x KnownFolderID %s 800# DisableKnownFolderAlias; unaliased form of the known folder IDList SHOULD be used; no examples found 801>20 lelong&4194304 4194304 \b, DisableKnownFolderAlias 802# AllowLinkToLink; link that references another link is enabled; no examples found 803>20 lelong&8388608 8388608 \b, AllowLinkToLink 804# UnaliasOnSave; unaliased form of that known folder or the target IDList SHOULD be used; no examples found 805>20 lelong&16777216 16777216 \b, UnaliasOnSave 806# PreferEnvironmentPath; path specified in the EnvironmentVariableDataBlock SHOULD be used 807>20 lelong&33554432 33554432 \b, PreferEnvironmentPath 808# KeepLocalIDListForUNCTarget; UNC name SHOULD be stored in local path IDList in PropertyStoreDataBlock; no examples found 809>20 lelong&67108864 67108864 \b, KeepLocalIDListForUNCTarget 810# FileAttributes 811>24 lelong&1 1 \b, Read-Only 812>24 lelong&2 2 \b, Hidden 813>24 lelong&4 4 \b, System 814# Reserved1; MUST be zero 815>24 lelong&8 8 \b, Reserved1 816>24 lelong&16 16 \b, Directory 817>24 lelong&32 32 \b, Archive 818# Reserved2; MUST be zero 819>24 lelong&64 64 \b, Reserved2 820>24 lelong&128 128 \b, Normal 821>24 lelong&256 256 \b, Temporary 822# no examples found 823>24 lelong&512 512 \b, Sparse 824# no examples found 825>24 lelong&1024 1024 \b, Reparse point 826>24 lelong&2048 2048 \b, Compressed 827>24 lelong&4096 4096 \b, Offline 828# FILE_ATTRIBUTE_NOT_CONTENT_INDEXED; contents need to be indexed 829>24 lelong&8192 8192 \b, NeedIndexed 830# FILE_ATTRIBUTE_ENCRYPTED; file or directory is encrypted 831>24 lelong&16384 16384 \b, Encrypted 832# value zero means there is no time set on the target 833>28 leqwdate !0 \b, ctime=%s 834# Access time of target in UTC 835>36 leqwdate !0 \b, atime=%s 836# write time of target in UTC 837>44 leqwdate !0 \b, mtime=%s 838# FileSize; 32 bit size of target in bytes 839>52 lelong x \b, length=%u, window= 840# ShowCommand; 1~SW_SHOWNORMAL 3~SW_SHOWMAXIMIZED HerzlichMEDION.lnk 7~SW_SHOWMINNOACTIVE YaCy.lnk Privoxy.lnk; All other values like 2 MUST be treated as SW_SHOWNORMAL 841#>60 lelong x ShowCommand=%#x 842>60 lelong x 843>>60 lelong 3 \bshowmaximized 844>>60 lelong 7 \bshowminnoactive 845>>60 default x \bnormal 846# Hotkey 847>64 uleshort >0 \b, hot key 848# 41h~A 42h~B ... 849>>64 ubyte x %c 850# modifier keys: 0x01~HOTKEYF_SHIFT 0x02~HOTKEYF_CONTROL 0x04~HOTKEYF_ALT 851>>65 ubyte&1 1 \b+SHIFT 852>>65 ubyte&2 2 \b+CONTROL 853>>65 ubyte&4 4 \b+ALT 854# Reserved; MUST be zero 855#>66 uleshort !0 \b, reserved %#x 856# Reserved2; MUST be zero 857#>68 ulelong !0 \b, reserved2 %#x 858# Reserved3; MUST be zero 859#>72 ulelong !0 \b, reserved3 %#x 860# optional LINKTARGET_IDLIST if LinkFlags bit HasLinkTargetIDList is set 861>20 lelong&1 1 862# IDListSize; size of IDList 863>>76 uleshort x \b, IDListSize %#4.4x 864# 1st item 865>>78 use lnk-item 866# 2nd possible item 867>>(78.s+78) uleshort >0 868>>>(78.s+78) use lnk-item 869# 3rd possible item 870>>>&(&-2.s-2) uleshort >0 871>>>>&-2 use lnk-item 872# 4th possible item 873>>>>&(&-2.s-2) uleshort >0 874>>>>>&-2 use lnk-item 875# Because HasLinkInfo is set, a LinkInfo structure follows 876>20 lelong&2 2 877# if no LINKTARGET_IDLIST (no HasLinkTargetIDList) then direct after header; no example found 878>>20 lelong&1 =0 879>>>76 use lnk-info 880# if LINKTARGET_IDLIST (HasLinkTargetIDList) then after LINKTARGET_IDLIST by addtional IDListSize bytes 881>>20 lelong&1 =1 882>>>76 uleshort >0 883#>>>>(76.s+78) use lnk-info 884>>>>(76.s+78) ubelong x 885# move pointer to beginnig of LinkInfo structure 886>>>>>&-8 ubelong x 887#>>>>>>&16 ulelong x \b, LocalBasePathOffset=%#8.8x 888>>>>>>&(&16.l) string x \b, LocalBasePath "%s" 889# check and then display link item (size,data) 8900 name lnk-item 891# size value 0x0000 means TerminalID; indicates the end of the item IDs list 892>0 uleshort >0 893#>>0 uleshort x \b, ItemIDSize %#4.4x 894# item Data 895#>>2 ubequad x \b, Item data=%#16.16llx 896#>>2 ubyte x \b, Item type=%#x 897>>2 ubyte =0x1f \b, Root folder 898# like: "26EE0668-A00A-44D7-9371-BEB064C98683" Control Panel 899# "20D04FE0-3AEA-1069-A2D8-08002B30309D" My Computer 900# "871C5380-42A0-1069-A2EA-08002B30309D" Internet Explorer 901>>>4 guid x "%s" 902>>2 ubyte =0x2f \b, Volume 903# like: "C:\" "D:\" 904>>>3 string x "%s" 905# Control panel category 906#>>2 ubyte foo \b, Control panel category 907# display LinkInfo structure (size,flags,offsets) 9080 name lnk-info 909# LinkInfoSize; size of the LinkInfo structure 910>0 ulelong x \b, LinkInfoSize %#x 911# LinkInfoHeaderSize; if 1C no optional fields; >=24 optional fields are specified 912>4 ulelong x \b, LinkInfoHeaderSize %#x 913# LinkInfoFlags; 914#>8 ulelong x \b, LinkInfoFlags=%#x 915>8 ulelong&1 1 \b, VolumeIDAndLocalBasePath 916# VolumeIDOffset; location of the VolumeID field (VolumeIDSize DriveType DriveSerialNumber VolumeLabelOffset ... ) inside LinkInfo structure 917>>12 ulelong x \b, VolumeIDOffset %#x 918# LocalBasePathOffset; location of LocalBasePath field like "C:\test\a.txt" inside LinkInfo structure 919>>16 ulelong x \b, LocalBasePathOffset %#x 920# LocalBasePathOffsetUnicode; location of the LocalBasePathUnicode field inside LinkInfo structure 921>>4 ulelong >23 922>>>28 ulelong x \b, LocalBasePathOffsetUnicode %#x 923>8 ulelong&2 2 \b, CommonNetworkRelativeLinkAndPathSuffix 924# CommonNetworkRelativeLinkOffset; location of the CommonNetworkRelativeLink field inside LinkInfo structure 925>>20 ulelong x \b, CommonNetworkRelativeLinkOffset %#x 926# CommonPathSuffixOffset; location of CommonPathSuffix field 927>24 ulelong x \b, CommonPathSuffixOffset %#x 928# CommonPathSuffixOffsetUnicode; location of CommonPathSuffixUnicode field inside LinkInfo structure 929>4 ulelong >23 930>>32 ulelong x \b, CommonPathSuffixOffsetUnicode %#x 931 932# Summary: Outlook Personal Folders 933# Created by: unknown 934# Update: Joerg Jenderek 935# URL: http://fileformats.archiveteam.org/wiki/Personal_Folder_File 936# https://en.wikipedia.org/wiki/Personal_Storage_Table 937# Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf 938# http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 939# dwMagic !BDN 9400 lelong 0x4E444221 941# skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-261.pst 942# by check for existance of bPlatformCreate value 943>14 ubyte x Microsoft Outlook 944#!:mime application/octet-stream 945# NOT official registered ! 946!:mime application/vnd.ms-outlook 947# dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit 948#>>4 ulelong !0 \b, CRC %#x 949# wMagicClient; AB (4142h) is used for PAB files; SM (534Dh) is used for PST files; SO (534Fh) is used for OST files 950#>>8 leshort x \b, wMagicClient=%#x 951# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 952# Note: called "Microsoft Personal Address Book" by TrID and 953# "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75 954>>8 leshort 0x4142 Personal Address Book 955#!:mime application/x-ms-pab 956!:ext pab 957# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst.trid.xml 958# http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml 959# Note: called "Microsoft OutLook Personal Folder" by TrID and 960# by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode 961#>>8 leshort 0x4D53 \b, PST~ 962# called "Microsoft Outlook email folder" in ./windows version 1.37 and older 963>>8 leshort 0x4D53 Personal Storage 964#!:mime application/x-ms-pst 965!:ext pst 966# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/ost.trid.xml 967# Note: called "Outlook Exchange Offline Storage" by TrID 968>>8 leshort 0x4F53 Offline Storage 969#!:mime application/x-ms-ost 970!:ext ost 971# wVer; file format version. 14 or 15 if the file is ANSI; > 21 or 23(=17h) if Unicode; 37 for written by Outlook with WIP 972>>10 uleshort x ( 973# probably NO intermediate versions exist 974>>10 leshort <0x10 \b<=2002, ANSI, 975>>10 leshort >0x14 \b>=2003, Unicode, 976>>10 uleshort x version %u) 977# wVerClient; client file format version like: 19 22 978#>>12 uleshort x \b, wVerClient=%u 979# bPlatformCreate; This value MUST be set to 1 but also found 2 980>>14 ubyte >1 \b, bPlatformCreate=%u 981# bPlatformAccess; This value MUST be set to 1 but also found 2 982>>15 ubyte >1 \b, bPlatformAccess=%u 983# dwReserved1; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 984>>16 ulelong !0 \b, dwReserved1=%#x 985# dwReserved2; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 986>>20 ulelong !0 \b, dwReserved2=%#x 987# ANSI 32-bit variant Outlook 1997-2002 988>>10 uleshort <16 989# bidNextB; next BlockID (ANSI 4 bytes) 990#>>>24 ulelong !0 \b, bidNextB=%#x 991# bidNextP; Next available back BlockID pointer 992#>>>28 ulelong !0 \b, bidNextP=%#x 993# dwUnique; value monotonically increased when modifying PST; so CRC is changing 994>>>32 ulelong !0 \b, dwUnique=%#x 995# rgnid[128]; A fixed array of 32 NodeIDs, each corresponding to one of the 32 possible NID_TYPEs 996#>>>36 ubequad x \b, rgnid=%#llx... 997# dwReserved; Implementations SHOULD ignore this value and SHOULD NOT modify it; Initialized zero 998>>>164 ulelong !0 \b, dwReserved=%#x 999# ibFileEof; the size of the PST file, in bytes (ANSI 4 bytes) 1000>>>168 ulelong x \b, %u bytes 1001# ibAMapLast; offset to the last AMap page 1002#>>>172 ulelong x \b, ibAMapLast=%#x 1003# bSentinel; MUST be set to 0x80 1004>>>460 ubyte !0x80 \b, bSentinel=%#x 1005# bCryptMethod: 0~No encryption 1~encryption with permutation 2~encryption with cyclic 16~encryption with Windows Information Protection (WIP) 1006>>>461 ubyte >0 \b, bCryptMethod=%u 1007# UNICODE 64-bit variant Outlook 2003-2007 1008>>10 uleshort >20 1009# bidUnused; Unused 8 bytes padding (Unicode only); sometimes like: 0x0000000100000004 1010>>>24 ulequad !0x0000000100000004 \b, bidUnused=%#16.16llx 1011# dwUnique; value monotonically increased when modifying PST; so CRC is changing 1012>>>40 ulelong !0 \b, dwUnique=%#x 1013# rgnid[] (128 bytes): A fixed array of 32 NIDs, each corresponding to one of the 32 possible 1014#>>>44 ubequad x \b, rgnid=%#llx... 1015# ibFileEof; the size of the PST file, in bytes (Unicode 8 bytes) 1016>>>184 ulequad x \b, %llu bytes 1017# bSentinel; MUST be set to 0x80 1018>>>512 ubyte !0x80 \b, bSentinel=%#x 1019# bCryptMethod; Encryption type like: 0 1 2 16 1020>>>513 ubyte >0 \b, bCryptMethod=%u 1021# dwCRC; 32-bit CRC of the of the previous 516 bytes 1022>>>524 ulelong x \b, CRC32 %#x 1023 1024 1025# Summary: Windows help cache 1026# Created by: unknown 10270 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 1028 1029 1030# Summary: IE cache file 1031# Created by: Christophe Monniez 10320 string Client\ UrlCache\ MMF Internet Explorer cache file 1033>20 string >\0 version %s 1034 1035 1036# Summary: Registry files 1037# Created by: unknown 1038# Modified by (1): Joerg Jenderek 10390 string regf MS Windows registry file, NT/2000 or above 10400 string CREG MS Windows 95/98/ME registry file 10410 string SHCC3 MS Windows 3.1 registry file 1042 1043 1044# Summary: Windows Registry text 1045# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 1046# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 1047# Submitted by: Abel Cheung <abelcheung@gmail.com> 1048# Update: Joerg Jenderek 1049# Windows 3-9X variant 10500 string REGEDIT 1051# skip ASCII text like "REGEDITor.txt" but match 1052# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 1053>7 search/3 \n Windows Registry text 1054!:mime text/x-ms-regedit 1055!:ext reg 1056# Windows 9X variant 1057>>0 string REGEDIT4 (Win95 or above) 1058# Windows 2K ANSI variant 10590 string Windows\ Registry\ Editor\ 1060>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 1061!:mime text/x-ms-regedit 1062!:ext reg 1063# Windows 2K UTF-16 variant 10642 lestring16 Windows\ Registry\ Editor\ 1065>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 1066# relative offset not working 1067#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 1068!:mime text/x-ms-regedit 1069!:ext reg 1070# WINE variant 1071# URL: https://en.wikipedia.org/wiki/Wine_(software) 1072# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 1073# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 1074# instead binary hiv structure like Windows 10750 string WINE\ REGISTRY\ Version\ WINE registry text 1076# version 2 1077>&0 string x \b, version %s 1078!:mime text/x-wine-extension-reg 1079!:ext reg 1080 1081# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 1082# empty ,comment , section 1083# PR/383: remove unicode BOM because it is not portable across regex impls 1084#0 regex/s \\`(\\r\\n|;|[[]) 1085# empty line CRLF 10860 ubeshort 0x0D0A 1087>0 use ini-file 1088# comment line starting with semicolon 10890 string ; 1090# look for phrase of Windows policy ADMinistrative template (with starting remark) 1091# like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm 1092>1 search/3548 END\040CATEGORY 1093# ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant 1094# if no Windows policy ADMinistrative template then Windows INItialization 1095>1 default x 1096>>0 use ini-file 1097# section line starting with left bracket 10980 string [ 1099>0 use ini-file 1100# check and then display Windows INItialization configuration 11010 name ini-file 1102# look for left bracket in section line 1103>0 search/8192 [ 1104# https://en.wikipedia.org/wiki/Autorun.inf 1105# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 1106# space after right bracket 1107# or AutoRun.Amd64 for 64 bit systems 1108# or only NL separator 1109>>&0 regex/c \^autorun 1110# but sometimes total commander directory tree file "treeinfo.wc" with lines like 1111# [AUTORUN] 1112# [boot] 1113>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 1114!:mime text/plain 1115!:ext wc 1116# From: Pal Tamas <folti@balabit.hu> 1117# Autorun File 1118>>>&0 string !]\r\n[ Microsoft Windows Autorun file 1119!:mime application/x-setupscript 1120!:ext inf 1121# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 1122# version strings ASCII coded case-independent for Windows setup information script file 1123>>&0 regex/c \^(version|strings)] Windows setup INFormation 1124!:mime application/x-setupscript 1125#!:mime application/x-wine-extension-inf 1126!:ext inf 1127# NETCRC.INF OEMCPL.INF 1128>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 1129!:mime application/x-setupscript 1130!:ext inf 1131# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 1132# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 1133# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 1134>>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 1135!:mime application/x-wine-extension-ini 1136#!:mime text/plain 1137# https://support.microsoft.com/kb/84709/ 1138>>&0 regex/c \^don't\ load] Windows CONTROL.INI 1139!:mime application/x-wine-extension-ini 1140!:ext ini 1141>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 1142!:mime application/x-wine-extension-ini 1143!:ext ini 1144# https://technet.microsoft.com/en-us/library/cc722567.aspx 1145# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 1146>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 1147!:mime application/x-wine-extension-ini 1148!:ext ini 1149# https://en.wikipedia.org/wiki/SYSTEM.INI 1150>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 1151!:mime application/x-wine-extension-ini 1152!:ext ini 1153# http://www.mdgx.com/newtip6.htm 1154>>&0 regex/c \^SafeList] Windows IOS.INI 1155!:mime application/x-wine-extension-ini 1156!:ext ini 1157# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 1158>>&0 regex/c \^boot\x20loader] Windows boot.ini 1159!:mime application/x-wine-extension-ini 1160!:ext ini 1161# https://en.wikipedia.org/wiki/CONFIG.SYS 1162>>&0 regex/c \^menu] MS-DOS CONFIG.SYS 1163# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 1164# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 1165# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 1166# dos and w40 used in dual booting scene 1167!:ext sys/dos/w40 1168# https://support.microsoft.com/kb/118579/ 1169>>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS 1170!:ext sys/dos 1171# http://chmspec.nongnu.org/latest/INI.html#HHP 1172>>&0 regex/c \^options]\r\n Microsoft HTML Help Project 1173!:mime text/plain 1174!:ext hhp 1175# From: Joerg Jenderek 1176# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm 1177# Reference: https://www.garykessler.net/library/file_sigs.html 1178# http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml 1179# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 1180# second word often Latin but sometimes Cyrillic like in 12510866.CPX 1181>>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator 1182#!:mime text/plain 1183!:mime text/x-ms-cpx 1184# like: 12510866.CPX 1185!:ext cpx 1186# From: Joerg Jenderek 1187# URL: https://en.wikipedia.org/wiki/File_Explorer 1188# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml 1189# Note: called "Windows Explorer Command Shell File" by TrID and "File Explorer Command" by Windows via SHCmdFile 1190>>&0 regex/c \^Shell]\r\n Windows Explorer Shell Command File 1191#!:mime text/plain 1192!:mime text/x-ms-scf 1193# like: channels.scf desktop.scf explorer.scf "Desktop anzeigen.scf" 1194!:ext scf 1195# look for icon file directive maybe pointing to malicious file 1196>>>1 search/128 IconFile= \b, icon 1197>>>>&0 string x "%s" 1198# From: Joerg Jenderek 1199# URL: http://en.wikipedia.org/wiki/VIA_Technologies 1200# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml 1201# Note: called "VIA setup configuration file" by TrID 1202>>&0 regex/c \^SCF]\r\n VIA setup configuration 1203#!:mime text/plain 1204!:mime text/x-via-scf 1205# like: SETUP.SCF 1206!:ext scf 1207# From: Joerg Jenderek 1208# URL: https://en.wikipedia.org/wiki/InstallShield 1209# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml 1210# Note: contain also 3 keywords like: count Default key0 1211>>&0 regex/c \^Languages] InstallShield Language Identifier 1212#!:mime text/plain 1213!:mime text/x-installshield-lid 1214# like: SETUP.LID 1215!:ext lid 1216# From: Joerg Jenderek 1217# URL: https://www.file-extensions.org/tag-file-extension 1218# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml 1219# Note: contain also keywords like: Application Category Company Misc Version 1220>>&0 regex/c \^TagInfo] TagInfo 1221#!:mime text/plain 1222#!:mime text/prs.lines.tag 1223!:mime text/x-ms-tag 1224# like: DATA.TAG 1225!:ext tag 1226# URL: https://en.wikipedia.org/wiki/Flatpak 1227# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/flatpakref.trid.xml 1228# Note: called "Flatpack Reference" by TrID 1229>>&0 string Flatpak\ Ref] Flatpak repository reference 1230#!:mime text/plain 1231# https://reposcope.com/mimetype/application/vnd.flatpak.ref 1232!:mime application/vnd.flatpak.ref 1233!:ext flatpakref 1234# From: Joerg Jenderek 1235# URL: https://en.wikipedia.org/wiki/CloneCD 1236# Reference: https://en.wikipedia.org/wiki/CloneCD_Control_File 1237# http://mark0.net/download/triddefs_xml.7z/defs/c/cdimage-clonecd-cue.trid.xml 1238# Note: called "CloneCD CDImage (description)" by TrID and "CloneCD Control File" by DROID via PUID fmt/1760 1239>>&0 string CloneCD] CloneCD CD-image Description 1240#!:mime text/plain 1241!:mime text/x-ccd 1242!:ext ccd 1243# unknown keyword after opening bracket 1244>>&0 default x 1245#>>>&0 string/c x UNKNOWN [%s 1246# look for left bracket of second section 1247>>>&0 search/8192 [ 1248# version Strings FileIdentification 1249>>>>&0 string/c version Windows setup INFormation 1250!:mime application/x-setupscript 1251!:ext inf 1252# From: Joerg Jenderek 1253# URL: https://cdrtfe.sourceforge.io/ 1254# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cfp-cdrtfe.trid.xml 1255>>>>&0 string FileExplorer] cdrtfe Project 1256!:mime text/x-cfp 1257!:ext cfp 1258# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 1259>>>>&0 default x 1260>>>>>&0 ubyte x 1261# characters, digits, underscore and white space followed by right bracket 1262# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 1263>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 1264# NETDEF.INF multiarc.ini 1265#!:mime application/x-setupscript 1266!:mime application/x-wine-extension-ini 1267#!:mime text/plain 1268!:ext ini/inf 1269# samples with only 1 and unknown section name 1270# XXX: matches a file containing '[1] 2' 1271#>>>&0 default x Generic INItialization configuration 1272#>>>>0 string x \b, 1st line "%s" 1273# UTF-16 BOM 12740 ubeshort =0xFFFE 1275# look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml) 1276# like: wuau.adm 1277>2 search/0x384A E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0 1278>>0 use windows-adm 1279# if no Windows policy ADMinistrative template then Windows INFormation 1280>2 default x 1281# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 1282>>0 ubelong&0xFFff89FF =0xFFFE0900 1283# look for left bracket in section line 1284>>>2 search/8192 [ 1285# keyword without 1st letter which is maybe up-/down-case 1286>>>>&3 lestring16 ersion] Windows setup INFormation 1287!:mime application/x-setupscript 1288# like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf 1289!:ext inf 1290>>>>&3 lestring16 trings] Windows setup INFormation 1291!:mime application/x-setupscript 1292# like: arduino_gemma.inf iis.inf MSM8960.inf 1293!:ext inf 1294>>>>&3 lestring16 ourceDisksNames] Windows setup INFormation 1295!:mime application/x-setupscript 1296# like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf 1297!:ext inf 1298# netnwcli.inf start with ;---[ NetNWCli.INX ] 1299>>>>&3 default x 1300# look for NL followed by left bracket 1301>>>>>&0 search/8192 \x0A\x00\x5b 1302# like: defltwk.inf netvwifibus.inf WSDPrint.inf 1303>>>>>>&3 lestring16 ersion] Windows setup INFormation 1304!:mime application/x-setupscript 1305!:ext inf 1306 1307# Summary: Windows Policy ADMinistrative template 1308# From: Joerg Jenderek 1309# URL: https://en.wikipedia.org/wiki/Administrative_Template 1310# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml 1311# Note: typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM 1312# worst case ASCII variant starting with remark line like: inetset.adm 13130 search/0x4E CLASS\040 1314>&0 string MACHINE 1315>>0 use windows-adm 1316>&0 string USER 1317>>0 use windows-adm 1318# display information about Windows policy ADMinistrative template 13190 name windows-adm Windows Policy Administrative Template 1320!:mime text/x-ms-adm 1321!:ext adm 1322# UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml) 1323>0 ubeshort =0xFFFE 1324>>2 lestring16 x \b, 1st line "%s" 1325# look for UTF-16 encoded CarriageReturn LineFeed 1326>>>2 search/0x3A \r\0\n\0 1327>>>>&0 lestring16 x \b, 2nd line "%s" 1328# no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml) 1329>0 ubeshort !0xFFFE 1330>>0 string x \b, 1st line "%s" 1331#>>>&0 ubequad x \b, 2ND %16.16llx 1332# 2nd line empty 1333>>>&2 beshort =0x0D0A 1334>>>>&0 beshort !0x0D0A \b, 3th line 1335>>>>>&-2 string x "%s" 1336# 2nd line with content 1337>>>&2 beshort !0x0D0A \b, 2nd line 1338>>>>&-2 string x "%s" 1339 1340# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 1341# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 1342# URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 1343# Reference: http://en.verysource.com/code/10350344_1/inf.h.html 1344# Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 1345# check for valid major and minor versions: 101h - 303h 13460 leshort&0xFcFc =0x0000 1347# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 1348>0 leshort&0x0303 !0x0000 1349# test for valid InfStyles: 1 2 1350>>2 uleshort >0 1351>>>2 uleshort <3 1352# look for colon in WinDirPath after PNF header 1353#>>>>0x59 search/18 : 1354# skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some 1355# Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low section name" \0 1356>>>>(20.l) ubelong >0x40004000 1357>>>>>0 use PreCompiledInf 13580 name PreCompiledInf 1359>0 uleshort x Windows Precompiled iNF 1360!:mime application/x-pnf 1361!:ext pnf 1362# major version 1 for older Windows like XP and 3 since about Windows Vista 1363# 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11 1364>1 ubyte x \b, version %u 1365>0 ubyte x \b.%u 1366>0 uleshort =0x0101 (Windows 1367>>4 ulelong&0x00000001 !0x00000001 95-98) 1368>>4 ulelong&0x00000001 =0x00000001 XP) 1369>0 uleshort =0x0301 (Windows Vista-8.1) 1370>0 uleshort =0x0302 (Windows 10 older) 1371>0 uleshort =0x0303 (Windows 10-11) 1372# 1 ,2 (windows 98 SE) 1373>2 uleshort !2 \b, InfStyle %u 1374# PNF_FLAG_IS_UNICODE 0x00000001 1375# PNF_FLAG_HAS_STRINGS 0x00000002 1376# PNF_FLAG_SRCPATH_IS_URL 0x00000004 1377# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 1378# PNF_FLAG_INF_VERIFIED 0x00000010 1379# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 1380# UNKNOWN8 0x00000080 1381# UNKNOWN 0x00000100 1382# UNKNOWN1 0x01000000 1383# UNKNOWN2 0x02000000 1384>4 ulelong&0x03000180 >0 \b, flags 1385>>4 ulelong x %#x 1386>4 ulelong&0x00000001 0x00000001 \b, unicoded 1387>4 ulelong&0x00000002 0x00000002 \b, has strings 1388>4 ulelong&0x00000004 0x00000004 \b, src URL 1389>4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 1390>4 ulelong&0x00000010 0x00000010 \b, verified 1391>4 ulelong&0x00000020 0x00000020 \b, digitally signed 1392# >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 1393# >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 1394# >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 1395# >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 1396#>8 ulelong x \b, InfSubstValueListOffset %#x 1397# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 1398# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 1399#>12 uleshort x \b, InfSubstValueCount %#x 1400# only < 9 found: 8 hcw85b64.PNF 1401#>14 uleshort x \b, InfVersionDatumCount %#x 1402# only found values lower 0x0000ffff ?? 1403#>16 ulelong x \b, InfVersionDataSize %#x 1404# only found positive values lower 0x00ffFFff for InfVersionDataOffset 1405>20 ulelong x \b, at %#x 1406>4 ulelong&0x00000001 =0x00000001 1407# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 1408>>(20.l) lestring16 x "%s" 1409>4 ulelong&0x00000001 !0x00000001 1410>>(20.l) string x "%s" 1411# FILETIME is number of 100-nanosecond intervals since 1 January 1601 1412#>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 1413>24 qwdate x \b, InfVersionLastWriteTime %s 1414# for Windows 98, XP 1415>0 uleshort <0x0102 1416# only found values lower 0x00ffFFff 1417# often 70 but also 78h for corelist.PNF 1418# >>32 ulelong x \b, StringTableBlockOffset %#x 1419# >>36 ulelong x \b, StringTableBlockSize %#x 1420# >>40 ulelong x \b, InfSectionCount %#x 1421# >>44 ulelong x \b, InfSectionBlockOffset %#x 1422# >>48 ulelong x \b, InfSectionBlockSize %#x 1423# >>52 ulelong x \b, InfLineBlockOffset %#x 1424# >>56 ulelong x \b, InfLineBlockSize %#x 1425# >>60 ulelong x \b, InfValueBlockOffset %#x 1426# >>64 ulelong x \b, InfValueBlockSize %#x 1427# WinDirPathOffset 1428# like 58h, which means direct after PNF header 1429#>>68 ulelong x \b, at %#x 1430>>68 ulelong x 1431>>>4 ulelong&0x00000001 =0x00000001 1432#>>>>(68.l) ubequad =0x43003a005c005700 1433# normally unicoded C:\Windows 1434#>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1435>>>>(68.l) ubequad !0x43003a005c005700 1436>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1437>>>4 ulelong&0x00000001 !0x00000001 1438# normally ASCII C:\WINDOWS 1439#>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 1440>>>>(68.l) string !C:\\WINDOWS 1441>>>>>(68.l) string x \b, WinDirPath "%s" 1442# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 1443>>>72 ulelong >0 \b, 1444>>>>4 ulelong&0x00000001 =0x00000001 1445>>>>>(72.l) lestring16 x OsLoaderPath "%s" 1446>>>>4 ulelong&0x00000001 !0x00000001 1447# seldom C:\ instead empty 1448>>>>>(72.l) string x OsLoaderPath "%s" 1449# 1fdh 1450#>>>76 uleshort x \b, StringTableHashBucketCount %#x 1451# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 1452# only 407h found 1453>>>78 uleshort !0x409 \b, LanguageID %x 1454#>>>78 uleshort =0x409 \b, LanguageID %x 1455# InfSourcePathOffset often 0 1456>>>80 ulelong >0 \b, at %#x 1457>>>>4 ulelong&0x00000001 =0x00000001 1458>>>>>(80.l) lestring16 x SourcePath "%s" 1459>>>>4 ulelong&0x00000001 !0x00000001 1460>>>>>(80.l) string >\0 SourcePath "%s" 1461# OriginalInfNameOffset often 0 1462>>>84 ulelong >0 \b, at %#x 1463>>>>4 ulelong&0x00000001 =0x00000001 1464>>>>>(84.l) lestring16 x InfName "%s" 1465>>>>4 ulelong&0x00000001 !0x00000001 1466>>>>>(84.l) string >\0 InfName "%s" 1467 1468# for newer Windows like Vista, 7 , 8.1 , 10 1469>0 uleshort >0x0101 1470>>80 ulelong x \b, at %#x WinDirPath 1471>>>4 ulelong&0x00000001 0x00000001 1472# normally unicoded C:\Windows 1473#>>>>(80.l) ubequad =0x43003a005c005700 1474#>>>>>(80.l) lestring16 x "%s" 1475>>>>(80.l) ubequad !0x43003a005c005700 1476>>>>>(80.l) lestring16 x "%s" 1477# language id: 0 407h~german 409h~English_US 1478>>90 uleshort !0x409 \b, LanguageID %x 1479#>>90 uleshort =0x409 \b, LanguageID %x 1480>>92 ulelong >0 \b, at %#x 1481>>>4 ulelong&0x00000001 0x00000001 1482# language string like: de-DE en-US 1483>>>>(92.l) lestring16 x language %s 1484 1485# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 1486# Extension: .bkf 1487# Created by: Joerg Jenderek 1488# URL: https://en.wikipedia.org/wiki/NTBackup 1489# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 1490# Descriptor BloCK name of Microsoft Tape Format 14910 string TAPE 1492# Format Logical Address is zero 1493>20 ulequad 0 1494# Reserved for MBC is zero 1495>>28 uleshort 0 1496# Control Block ID is zero 1497>>>36 ulelong 0 1498# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 1499>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 1500#!:mime application/x-ntbackup 1501!:ext bkf 1502# OS ID 1503>>>>>10 ubyte 1 \b NetWare 1504>>>>>10 ubyte 13 \b NetWare SMS 1505>>>>>10 ubyte 14 \b NT 1506>>>>>10 ubyte 24 \b 3 1507>>>>>10 ubyte 25 \b OS/2 1508>>>>>10 ubyte 26 \b 95 1509>>>>>10 ubyte 27 \b Macintosh 1510>>>>>10 ubyte 28 \b UNIX 1511# OS Version (2) 1512#>>>>>11 ubyte x OS V=%x 1513# MTF_CONTINUATION Media Sequence Number > 1 1514#>>>>>4 ulelong&0x00000001 !0 \b, continued 1515# MTF_COMPRESSION 1516>>>>>4 ulelong&0x00000004 !0 \b, compressed 1517# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 1518>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 1519>>>>>4 ulelong&0x00020000 0 1520# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 1521>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 1522# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 1523>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 1524# Offset To First Event 238h,240h,28Ch 1525#>>>>>8 uleshort x \b, event offset %4.4x 1526# Displayable Size (20e0230h 20e024ch 20e0224h) 1527#>>>>>8 ulequad x dis. size %16.16llx 1528# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 1529#>>>>>52 ulelong x family ID %8.8x 1530# TAPE Attributes (3) 1531#>>>>>56 ulelong x TAPE %8.8x 1532# Media Sequence Number 1533>>>>>60 uleshort >1 \b, sequence %u 1534# Password Encryption Algorithm (3) 1535>>>>>62 uleshort >0 \b, %#x encrypted 1536# Soft Filemark Block Size * 512 (2) 1537#>>>>>64 uleshort =2 \b, soft size %u*512 1538>>>>>64 uleshort !2 \b, soft size %u*512 1539# Media Based Catalog Type (1,2) 1540#>>>>>66 uleshort x \b, catalog type %4.4x 1541# size of Media Name (66,68,6Eh) 1542>>>>>68 uleshort >0 1543# offset of Media Name (5Eh) 1544>>>>>>70 uleshort >0 1545# 0~, 1~ANSI, 2~UNICODE 1546>>>>>>>48 ubyte 1 1547# size terminated ansi coded string normally followed by "MTF Media Label" 1548>>>>>>>>(70.s) string >\0 \b, name: %s 1549>>>>>>>48 ubyte 2 1550# Not null, but size terminated unicoded string 1551>>>>>>>>(70.s) lestring16 x \b, name: %s 1552# size of Media Label (104h) 1553#>>>>>72 uleshort >0 1554# offset of Media Label (C4h,C6h,CCh) 1555>>>>>74 uleshort >0 1556>>>>>>48 ubyte 1 1557#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 1558>>>>>>>(74.s) string >\0 \b, label: %s 1559>>>>>>48 ubyte 2 1560>>>>>>>(74.s) lestring16 x \b, label: %s 1561# size of password name (0,1Ch) 1562#>>>>>76 uleshort >0 \b, password size %4.4x 1563# Software Vendor ID (CBEh) 1564>>>>>86 uleshort x \b, software (%#x) 1565# size of Software Name (6Eh) 1566>>>>>80 uleshort >0 1567# offset of Software Name (1C8h,1CAh,1D0h) 1568>>>>>>82 uleshort >0 1569# 1~ANSI, 2~UNICODE 1570>>>>>>>48 ubyte 1 1571>>>>>>>>(82.s) string >\0 \b: %s 1572>>>>>>>48 ubyte 2 1573# size terminated unicoded coded string normally followed by "SPAD" 1574>>>>>>>>(82.s) lestring16 x \b: %s 1575# Format Logical Block Size (512,1024) 1576#>>>>>84 uleshort =1024 \b, block size %u 1577>>>>>84 uleshort !1024 \b, block size %u 1578# Media Date of MTF_DATE_TIME type with 5 bytes 1579#>>>>>>88 ubequad x DATE %16.16llx 1580# MTF Major Version (1) 1581#>>>>>>93 ubyte x \b, MFT version %x 1582# 1583 1584# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 1585# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 1586# Created by: Joerg Jenderek 1587# Note: there exist other color palette formats also with .pal extension 15880 string JASC-PAL\r\n PaintShop Pro color palette 1589#!:mime text/plain 1590# PspPalette extension is used by newer (probably 8) PaintShopPro versions 1591!:ext pal/PspPalette 1592# 2nd line contains palette file version. For example "0100" 1593>10 string !0100 \b, version %.4s 1594# third line contains the number of colours: 16 256 ... 1595>16 string x \b, %.3s colors 1596 1597# URL: https://en.wikipedia.org/wiki/Innosetup 1598# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 1599# Created by: Joerg Jenderek 1600# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 1601# TrID labeles the entry as "Inno Setup Uninstall Log" 1602# TUninstallLogID 16030 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 1604!:mime application/x-innosetup 1605# unins000.dat, unins001.dat, ... 1606!:ext dat 1607# " 64-bit" variant 1608>0x1c string >\0 \b%.7s 1609# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 1610>0xc0 string x %s 1611# AppId[0x80] is similar to AppName or 1612# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 1613>0x40 ubyte 0x7b 1614>>0x40 string x %-.38s 1615# do not know how this log version correlates to program version 1616>0x140 ulelong x \b, version %#x 1617# NumRecs 1618#>0x144 ulelong x \b, %#4.4x records 1619# EndOffset means files size 1620>0x148 ulelong x \b, %u bytes 1621# Flags 5 25h 35h 1622#>0x14c ulelong x \b, flags %8.8x 1623# Reserved: array[0..26] of Longint 1624# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 1625>0x140 ulelong <1000 1626# hostname 1627>>0x1d6 pstring x \b, %s 1628# user name 1629>>>&0 pstring x \b\%s 1630# directory like C:\Program Files (x86)\GnuWin32 1631>>>>&0 pstring x \b, "%s" 1632# version 1000 or higher implies unicode 1633>0x140 ulelong >999 1634# hostname 1635>>0x1db lestring16 x \b, %-.9s 1636# utf string variant with prepending fe??ffFFff 1637>>0x1db search/43 \xFF\xFF\xFF 1638# user name 1639>>>&0 lestring16 x \b\%-.9s 1640>>>&0 search/43 \xFF\xFF\xFF 1641# directory like C:\Program Files\GIMP 2 1642>>>>&0 lestring16 x \b, %-.42s 1643 1644# URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 1645# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 1646# From: Joerg Jenderek 16470 string Inno\ Setup\ Messages\ ( 1648# null padded til 0x40 boundary 1649>0x38 quad 0 InnoSetup messages 1650!:mime application/x-innosetup-msg 1651# unins000.msg, unins001.msg, ... 1652!:ext msg 1653# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 1654>>0x15 string x \b, version %.5s 1655# look for 6th char of version string or terminating right parentheses 1656>>>0x1a ubyte !0x29 \b%c 1657# NumMessages 1658>>0x40 ulelong x \b, %u messages 1659# TotalSize: Cardinal; 1660#>>0x44 ulelong x \b, TotalSize %u 1661# NotTotalSize: Cardinal; 1662#>>0x48 ulelong x \b, NotTotalSize %u 1663# CRCMessages: Longint; 1664#>>0x4C ulelong x \b, CRC %#x 1665>>0x40 ulelong x 1666# (u) after version means unicoded messages 1667>>>0x1c search/2 (u) (UTF-16), 1668>>>>0x50 lestring16 x %s 1669# ASCII coded message 1670>>>0x1c default x (ASCII), 1671>>>>0x50 string x %s 1672 1673# Windows Imaging (WIM) Image 1674# Update: Joerg Jenderek at Mar 2019, 2021 1675# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 1676# http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 1677# Reference: https://download.microsoft.com/download/f/e/f/ 1678# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 1679# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 16800 string MSWIM\000\000\000 1681>0 use wim-archive 1682# https://wimlib.net/man1/wimoptimize.html 16830 string WLPWM\000\000\000 1684>0 use wim-archive 16850 name wim-archive 1686# _WIMHEADER_V1_PACKED ImageTag[8] 1687>0 string x Windows imaging 1688!:mime application/x-ms-wim 1689# TO avoid in file version 5.36 error like 1690# Magdir/windows, 760: Warning: Current entry does not yet have a description 1691# file: could not find any valid magic files! (No error) 1692# split WIM 1693>16 ulelong &0x00000008 (SWM 1694!:ext swm 1695# usPartNumber; 1, unless the file was split into multiple parts 1696>>40 uleshort x \b %u 1697# usTotalParts; The total number of WIM file parts in a spanned set 1698>>42 uleshort x \b of %u) image 1699# non split WIM 1700>16 ulelong ^0x00000008 1701# https://wimlib.net/man1/wimmount.html 1702# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 1703>>12 ulelong 3584 (ESD) image 1704!:ext esd 1705>>12 ulelong !3584 ( 1706# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 1707>>>156 search/68233/s RunTime.xml \bWindows provisioning package) 1708!:ext ppkg 1709# if is is not a Windows provisioning package, then it is a WIM 1710>>>156 default x \bWIM) image 1711# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 1712!:ext wim/wim2 1713>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 1714# cbSize size of the WIM header in bytes like 208 1715#>8 ulelong x \b, headersize %u 1716# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 1717>14 uleshort x v%u 1718>13 ubyte x \b.%u 1719# dwImageCount; The number of images contained in the WIM file 1720>44 ulelong >1 \b, %u images 1721# dwBootIndex 1722# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 1723>0x78 ulelong >0 \b, bootable no. %u 1724# dwFlags 1725#>16 ulelong x \b, flags %#8.8x 1726#define FLAG_HEADER_COMPRESSION 0x00000002 1727#define FLAG_HEADER_READONLY 0x00000004 1728#define FLAG_HEADER_SPANNED 0x00000008 1729#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 1730#define FLAG_HEADER_METADATA_ONLY 0x00000020 1731#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 1732#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 1733#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 1734#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 1735#define FLAG_HEADER_COMPRESS_LZX 0x00040000 1736#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 1737#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 1738# XPRESS, with small chunk size 1739>16 ulelong &0x00100000 \b, XPRESS2 1740>16 ulelong &0x00080000 \b, LZMS 1741>16 ulelong &0x00040000 \b, LZX 1742>16 ulelong &0x00020000 \b, XPRESS 1743>16 ulelong &0x00000002 compressed 1744>16 ulelong &0x00000004 \b, read only 1745>16 ulelong &0x00000010 \b, resource only 1746>16 ulelong &0x00000020 \b, metadata only 1747>16 ulelong &0x00000080 \b, reparse point fixup 1748#>16 ulelong &0x00010000 \b, RESERVED 1749# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 1750#>20 ulelong >0 \b, chunk size %u bytes 1751# gWIMGuid 1752#>24 ubequad x \b, GUID %#16.16llx 1753#>>32 ubequad x \b%16.16llx 1754# rhOffsetTable; the location of the resource lookup table 1755# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 1756#>48 ubequad x \b, rhOffsetTable %#16.16llx 1757# rhXmlData; the location of the XML data 1758#>0x50 ulelong x \b, at %#8.8x 1759# NOT WORKING \xff\xfe<\0W\0I\0M\0 1760#>(0x50.l) ubequad x \b, xml=%16.16llx 1761# rhBootMetadata; the location of the metadata resource 1762#>0x60 ubequad x \b, rhBootMetadata %#16.16llx 1763# rhIntegrity; the location of integrity table used to verify files 1764#>0x7c ubequad x \b, rhIntegrity %#16.16llx 1765# Unused[60] 1766#>148 ubequad !0 \b,unused %#16.16llx 1767# 1768 1769# From: Joerg Jenderek 1770# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 1771# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 1772# Note: called "Windows Easy Transfer migration data" by TrID, 1773# "Migration Store" or "EasyTransfer file" by Microsoft 17740 string 1giM Windows Easy Transfer migration data 1775#!:mime application/octet-stream 1776!:mime application/x-ms-mig 1777!:ext mig 1778>0x18 string =MRTS without password 1779# data offset with 1 space at end 1780>>0x1c ulelong+0x38 x \b, at %#x 1781# look for zlib compressed data by ./compress 1782>>(0x1c.l+0x38) ubyte x 1783>>>&-1 indirect x 1784# in password protected examples MRTS comes some bytes further 1785>0x18 string !MRTS with password 1786# look for first MRTS tag 1787>0x18 search/29/b MRTS 1788# probably first file name length like 178, ... 1789#>>&0 ulelong x \b, 1st length %u 1790# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1791>>&20 lestring16 x \b, 1st %-s 1792 1793# Microsoft SYLK 1794# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 1795# https://outflank.nl/upload/sylksum.txt 17960 string ID;P Microsoft SYLK program 1797>4 string >0 \b, created by %s 1798!:ext slk/sylk 1799 1800# Summary: Windows Performance Monitor Alert 1801# From: Joerg Jenderek 1802# URL: https://en.wikipedia.org/wiki/Performance_Monitor 1803# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml 1804# Note: called "Windows Performance Monitor Alert" by TrID 18050 ubelong =0xDC058340 1806>4 ubyte =0 Windows Performance Monitor Alert 1807#!:mime application/octet-stream 1808# https://www.thoughtco.com/mime-types-by-content-type-3469108 1809# https://filext.com/file-extension/PAM 1810!:mime application/x-perfmon 1811#!:mime application/x-ms-pma 1812!:ext pma 1813# metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics" 1814>>80 string x \b, "%s" 1815 1816# From: Joerg Jenderek 1817# URL: https://en.wikipedia.org/wiki/InstallShield 1818# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml 1819# Note: contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK 18200 ubelong 0xB8C90C00 InstallShield Script 1821#!:mime application/octet-stream 1822!:mime application/x-installshield-ins 1823# like test.ins Setup.ins 1824!:ext ins 1825# UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700 1826# 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700 1827#>4 ubequad x \b, at 4 %#16.16llx 1828# copyright text like: "Stirling Technologies, Inc. (c) 1990-1994" 1829# "InstallSHIELD Software Corporation (c) 1990-1997" 1830>13 pstring/h x "%s" 1831# look for specific ASCII variable names 1832>1 search/0x121/s SRCDIR \b, variable names: 1833# 1st like: SRCDIR 1834>>&-4 leshort x #%u 1835>>&-2 pstring/h x %s 1836# 2nd like: SRCDISK 1837>>>&0 leshort x #%u 1838>>>&2 pstring/h x %s 1839# 3rd like: TARGETDISK 1840>>>>&0 leshort x #%u 1841>>>>&2 pstring/h x %s 1842# 4th like: TARGETDIR 1843#>>>>>&0 leshort x #%u 1844#>>>>>&2 pstring/h x %s 1845# 5th like: WINDIR 1846#>>>>>>&0 leshort x #%u 1847#>>>>>>&2 pstring/h x %s 1848# 6th like: WINDISK 1849#>>>>>>>&0 leshort x #%u 1850#>>>>>>>&2 pstring/h x %s 1851# 7th like: WINSYSDIR 1852#>>>>>>>>&0 leshort x #%u 1853#>>>>>>>>&2 pstring/h x %s 1854# ... LOGHANDLE 1855>0 ubelong x ... 1856# 1857 1858# Summary: Microsoft Remote Desktop Protocol connection 1859# From: Joerg Jenderek 1860# URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files 1861# Reference: http://mark0.net/download/triddefs_xml.7z/defs/r/rdp.trid.xml 1862# Note: called "Remote Desktop Connection Settings" by TrID 18630 string screen\040mode\040id:i: Remote Desktop Protocol connection 1864#!:mime text/plain 1865!:mime text/x-ms-rdp 1866!:ext rdp 1867# Screen mode: 1~session appear in a window 2~session appear full screen 1868>17 string 1 \b, window mode 1869>17 string 2 \b, full screen mode 1870 18710 guid 7B5C52E4-D88C-4DA7-AEB1-5378D02996D3 Microsoft OneNote 1872!:ext one 1873!:mime application/onenote 18740 guid 43FF2FA1-EFD9-4C76-9EE2-10EA5722765F Microsoft OneNote Revision Store File 1875 1876# Microsoft XAML Binary Format 1877# From: Alexandre Iooss <erdnaxe@crans.org> 1878# URL: https://github.com/WalkingCat/XbfDump/blob/8832d2ffcaa738434d803fefa2ba99d3af37ed29/xbf_data.h 18790 string XBF\0 1880>12 ulelong <0xFF 1881>>16 ulelong <0xFF Microsoft XAML Binary Format 1882!:ext xbf 1883>>>12 ulelong x %d 1884>>>16 ulelong x \b.%d 1885>>>4 ulelong x \b, metadata size: %d bytes 1886>>>8 ulelong x \b, node size: %d bytes 1887 1888# Metaswitch MetaView Service Assurance Server exports 18890 string MetaView\x20Service\x20Assurance\x20Export\x20File MetaView SAS export 1890>39 string Version\x20 1891>>47 byte x \b, version %c 1892 1893# Active Directory Group Policy Registry Policy File Format 1894# From: Yuuta Liang <yuuta@yuuta.moe> 1895# URL: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-file-format 18960 string PReg 1897>4 lelong x Group Policy Registry Policy, Version=%d 1898 1899# Microsoft Type Library Format (.TLB file) 1900# Stores metadata on calling COM APIs (method parameters/etc) 1901# Exists in two formats: the original (SLTG aka Type 1) and a newer format (MSFT aka Type 2) 1902# SLTG: https://www.nationalarchives.gov.uk/PRONOM/fmt/1601 1903# MSFT: https://www.nationalarchives.gov.uk/PRONOM/fmt/1602 1904# (Pronom claims these formats are due to Borland, but that appears to be incorrect, Microsoft invented them.) 1905# The MSFT format is documented here: https://gist.github.com/djhohnstein/e4a346ee1506895000ca0fa93e5a0024 1906# Which is a copy of original: http://theircorp.byethost11.com/files/TypeLib.txt (but which displays incorrectly due to encoding issues) 1907# The MSFT format is generated by the Windows CreateTypeLib2 API: https://learn.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-createtypelib2 1908# The SLTG format is generated by the Windows CreateTypeLib API: https://learn.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-createtypelib 1909# 1910# Note type libraries can also be embedded as resources inside executables/DLL. No attempt is made here to detect that scenario. 1911 1912# Legacy SLTG format 19130 string SLTG 1914>-36 string TYPELIB Type Library (legacy SLTG format) 1915 1916# MSFT format 19170 string MSFT\x02\x00\x01\x00 Type Library (MSFT format) 1918