1186690Sobrien 2186690Sobrien#------------------------------------------------------------------------------ 3298192Sdelphij# $File: windows,v 1.14 2015/12/15 01:06:17 christos Exp $ 4186690Sobrien# windows: file(1) magic for Microsoft Windows 5186690Sobrien# 6186690Sobrien# This file is mainly reserved for files where programs 7186690Sobrien# using them are run almost always on MS Windows 3.x or 8186690Sobrien# above, or files only used exclusively in Windows OS, 9186690Sobrien# where there is no better category to allocate for. 10186690Sobrien# For example, even though WinZIP almost run on Windows 11186690Sobrien# only, it is better to treat them as "archive" instead. 12186690Sobrien# For format usable in DOS, such as generic executable 13186690Sobrien# format, please specify under "msdos" file. 14186690Sobrien# 15186690Sobrien 16186690Sobrien 17186690Sobrien# Summary: Outlook Express DBX file 18186690Sobrien# Extension: .dbx 19186690Sobrien# Created by: Christophe Monniez 20186690Sobrien0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 21186690Sobrien>4 byte =0xC5 \b, message database 22186690Sobrien>4 byte =0xC6 \b, folder database 23186690Sobrien>4 byte =0xC7 \b, account information 24186690Sobrien>4 byte =0x30 \b, offline database 25186690Sobrien 26186690Sobrien 27186690Sobrien# Summary: Windows crash dump 28186690Sobrien# Extension: .dmp 29186690Sobrien# Created by: Andreas Schuster (http://computer.forensikblog.de/) 30186690Sobrien# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 31186690Sobrien# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 32186690Sobrien0 string PAGE 33186690Sobrien>4 string DUMP MS Windows 32bit crash dump 34186690Sobrien>>0x05c byte 0 \b, no PAE 35186690Sobrien>>0x05c byte 1 \b, PAE 36186690Sobrien>>0xf88 lelong 1 \b, full dump 37186690Sobrien>>0xf88 lelong 2 \b, kernel dump 38186690Sobrien>>0xf88 lelong 3 \b, small dump 39267843Sdelphij>>0x068 lelong x \b, %d pages 40186690Sobrien>4 string DU64 MS Windows 64bit crash dump 41186690Sobrien>>0xf98 lelong 1 \b, full dump 42186690Sobrien>>0xf98 lelong 2 \b, kernel dump 43186690Sobrien>>0xf98 lelong 3 \b, small dump 44186690Sobrien>>0x090 lequad x \b, %lld pages 45186690Sobrien 46186690Sobrien 47186690Sobrien# Summary: Vista Event Log 48186690Sobrien# Extension: .evtx 49186690Sobrien# Created by: Andreas Schuster (http://computer.forensikblog.de/) 50186690Sobrien# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 51186690Sobrien0 string ElfFile\0 MS Windows Vista Event Log 52186690Sobrien>0x2a leshort x \b, %d chunks 53186690Sobrien>>0x10 lelong x \b (no. %d in use) 54186690Sobrien>0x18 lelong >1 \b, next record no. %d 55186690Sobrien>0x18 lelong =1 \b, empty 56186690Sobrien>0x78 lelong &1 \b, DIRTY 57186690Sobrien>0x78 lelong &2 \b, FULL 58186690Sobrien 59186690Sobrien 60186690Sobrien# Summary: Windows 3.1 group files 61186690Sobrien# Extension: .grp 62186690Sobrien# Created by: unknown 63186690Sobrien0 string \120\115\103\103 MS Windows 3.1 group files 64186690Sobrien 65186690Sobrien 66186690Sobrien# Summary: Old format help files 67298192Sdelphij# URL: https://en.wikipedia.org/wiki/WinHelp 68298192Sdelphij# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm 69298192Sdelphij# Update: Joerg Jenderek 70186690Sobrien# Created by: Dirk Jagdmann <doj@cubic.org> 71298192Sdelphij# 72298192Sdelphij# check and then display version and date inside MS Windows HeLP file fragment 73298192Sdelphij0 name help-ver-date 74298192Sdelphij# look for Magic of SYSTEMHEADER 75298192Sdelphij>0 leshort 0x036C 76298192Sdelphij# version Major 1 for right file fragment 77298192Sdelphij>>4 leshort 1 Windows 78298192Sdelphij# print non empty string above to avoid error message 79298192Sdelphij# Warning: Current entry does not yet have a description for adding a MIME type 80298192Sdelphij!:mime application/winhelp 81298192Sdelphij!:ext hlp 82298192Sdelphij# version Minor of help file format is hint for windows version 83298192Sdelphij>>>2 leshort 0x0F 3.x 84298192Sdelphij>>>2 leshort 0x15 3.0 85298192Sdelphij>>>2 leshort 0x21 3.1 86298192Sdelphij>>>2 leshort 0x27 x.y 87298192Sdelphij>>>2 leshort 0x33 95 88298192Sdelphij>>>2 default x y.z 89298192Sdelphij>>>>2 leshort x 0x%x 90298192Sdelphij# to complete message string like "MS Windows 3.x help file" 91298192Sdelphij>>>2 leshort x help 92298192Sdelphij# GenDate often older than file creation date 93298192Sdelphij>>>6 ldate x \b, %s 94298192Sdelphij# 95298192Sdelphij# Magic for HeLP files 96298192Sdelphij0 lelong 0x00035f3f 97298192Sdelphij# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 98298192Sdelphij# file header magic 0x293B at DirectoryStart+9 99298192Sdelphij>(4.l+9) uleshort 0x293B MS 100298192Sdelphij# look for @VERSION bmf.. like IBMAVW.ANN 101298192Sdelphij>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 102298192Sdelphij!:mime application/x-winhelp 103298192Sdelphij!:ext ann 104298192Sdelphij>>0xD4 string !\x62\x6D\x66\x01\x00 105298192Sdelphij# "GID Help index" by TrID 106298192Sdelphij>>>(4.l+0x65) string =|Pete Windows help Global Index 107298192Sdelphij!:mime application/x-winhelp 108298192Sdelphij!:ext gid 109298192Sdelphij# HeLP Bookmark or 110298192Sdelphij# "Windows HELP File" by TrID 111298192Sdelphij>>>(4.l+0x65) string !|Pete 112298192Sdelphij# maybe there exist a cleaner way to detect HeLP fragments 113298192Sdelphij# brute search for Magic 0x036C with matching Major maximal 7 iterations 114298192Sdelphij# discapp.hlp 115298192Sdelphij>>>>16 search/0x49AF/s \x6c\x03 116298192Sdelphij>>>>>&0 use help-ver-date 117298192Sdelphij>>>>>&4 leshort !1 118298192Sdelphij# putty.hlp 119298192Sdelphij>>>>>>&0 search/0x69AF/s \x6c\x03 120298192Sdelphij>>>>>>>&0 use help-ver-date 121298192Sdelphij>>>>>>>&4 leshort !1 122298192Sdelphij>>>>>>>>&0 search/0x49AF/s \x6c\x03 123298192Sdelphij>>>>>>>>>&0 use help-ver-date 124298192Sdelphij>>>>>>>>>&4 leshort !1 125298192Sdelphij>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 126298192Sdelphij>>>>>>>>>>>&0 use help-ver-date 127298192Sdelphij>>>>>>>>>>>&4 leshort !1 128298192Sdelphij>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 129298192Sdelphij>>>>>>>>>>>>>&0 use help-ver-date 130298192Sdelphij>>>>>>>>>>>>>&4 leshort !1 131298192Sdelphij>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 132298192Sdelphij>>>>>>>>>>>>>>>&0 use help-ver-date 133298192Sdelphij>>>>>>>>>>>>>>>&4 leshort !1 134298192Sdelphij>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 135298192Sdelphij# GCC.HLP is detected after 7 iterations 136298192Sdelphij>>>>>>>>>>>>>>>>>&0 use help-ver-date 137298192Sdelphij# this only happens if bigger hlp file is detected after used search iterations 138298192Sdelphij>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 139298192Sdelphij!:mime application/winhelp 140298192Sdelphij!:ext hlp 141298192Sdelphij# repeat search again or following default line does not work 142298192Sdelphij>>>>16 search/0x49AF/s \x6c\x03 143298192Sdelphij# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 144298192Sdelphij>>>>16 default x Windows help Bookmark 145298192Sdelphij!:mime application/x-winhelp 146298192Sdelphij!:ext /bmk 147298192Sdelphij## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 148298192Sdelphij##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 149298192Sdelphij# EntireFileSize 150298192Sdelphij>>12 lelong x \b, %d bytes 151298192Sdelphij## ReservedSpace normally 042Fh AFh for *.ANN 152298192Sdelphij#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 153298192Sdelphij## UsedSpace normally 0426h A6h for *.ANN 154298192Sdelphij#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 155298192Sdelphij## FileFlags normally 04... 156298192Sdelphij#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 157298192Sdelphij## file header magic 0x293B 158298192Sdelphij#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 159298192Sdelphij## file header Flags 0x0402 160298192Sdelphij#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 161298192Sdelphij## file header PageSize 0400h 80h for *.ANN 162298192Sdelphij#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 163298192Sdelphij## Structure[16] z4 164298192Sdelphij#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 165298192Sdelphij## MustBeZero 0 166298192Sdelphij#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 167298192Sdelphij## PageSplits 168298192Sdelphij#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 169298192Sdelphij## RootPage 170298192Sdelphij#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 171298192Sdelphij## MustBeNegOne 0xffff 172298192Sdelphij#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 173298192Sdelphij## TotalPages 1 174298192Sdelphij#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 175298192Sdelphij## NLevels 0x0001 176298192Sdelphij#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 177298192Sdelphij## TotalBtreeEntries 178298192Sdelphij#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 179298192Sdelphij## pages of the B+ tree 180298192Sdelphij#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 181186690Sobrien 182298192Sdelphij# start with colon or semicolon for comment line like Back2Life.cnt 183298192Sdelphij0 regex \^(:|;) 184298192Sdelphij# look for first keyword Base 185298192Sdelphij>0 search/45 :Base 186298192Sdelphij>>&0 use cnt-name 187298192Sdelphij# only solution to search again from beginning , because relative offsets changes when use is called 188298192Sdelphij>0 search/45 :Base 189298192Sdelphij>0 default x 190298192Sdelphij# look for other keyword Title like in putty.cnt 191298192Sdelphij>>0 search/45 :Title 192298192Sdelphij>>>&0 use cnt-name 193298192Sdelphij# 194298192Sdelphij# display mime type and name of Windows help Content source 195298192Sdelphij0 name cnt-name 196298192Sdelphij# skip space at beginning 197298192Sdelphij>0 string \ 198298192Sdelphij# name without extension and greater character or name with hlp extension 199298192Sdelphij>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 200298192Sdelphij!:mime text/plain 201298192Sdelphij!:apple ????TEXT 202298192Sdelphij!:ext cnt 203298192Sdelphij# 204298192Sdelphij# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 205298192Sdelphij0 string tfMR MS Windows help Full Text Search index 206298192Sdelphij!:mime application/x-winhelp-fts 207298192Sdelphij!:ext fts 208298192Sdelphij>16 string >\0 for "%s" 209186690Sobrien 210186690Sobrien# Summary: Hyper terminal 211186690Sobrien# Extension: .ht 212186690Sobrien# Created by: unknown 213186690Sobrien0 string HyperTerminal\ 214186690Sobrien>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 215186690Sobrien 216267843Sdelphij# http://ithreats.files.wordpress.com/2009/05/\ 217267843Sdelphij# lnk_the_windows_shortcut_file_format.pdf 218186690Sobrien# Summary: Windows shortcut 219186690Sobrien# Extension: .lnk 220186690Sobrien# Created by: unknown 221267843Sdelphij# 'L' + GUUID 222186690Sobrien0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 223267843Sdelphij>20 lelong&1 1 \b, Item id list present 224267843Sdelphij>20 lelong&2 2 \b, Points to a file or directory 225267843Sdelphij>20 lelong&4 4 \b, Has Description string 226267843Sdelphij>20 lelong&8 8 \b, Has Relative path 227267843Sdelphij>20 lelong&16 16 \b, Has Working directory 228267843Sdelphij>20 lelong&32 32 \b, Has command line arguments 229267843Sdelphij>20 lelong&64 64 \b, Icon 230288143Sdelphij>>56 lelong x \b number=%d 231267843Sdelphij>24 lelong&1 1 \b, Read-Only 232267843Sdelphij>24 lelong&2 2 \b, Hidden 233267843Sdelphij>24 lelong&4 4 \b, System 234267843Sdelphij>24 lelong&8 8 \b, Volume Label 235267843Sdelphij>24 lelong&16 16 \b, Directory 236267843Sdelphij>24 lelong&32 32 \b, Archive 237267843Sdelphij>24 lelong&64 64 \b, Encrypted 238267843Sdelphij>24 lelong&128 128 \b, Normal 239267843Sdelphij>24 lelong&256 256 \b, Temporary 240267843Sdelphij>24 lelong&512 512 \b, Sparse 241267843Sdelphij>24 lelong&1024 1024 \b, Reparse point 242267843Sdelphij>24 lelong&2048 2048 \b, Compressed 243267843Sdelphij>24 lelong&4096 4096 \b, Offline 244267843Sdelphij>28 leqwdate x \b, ctime=%s 245267843Sdelphij>36 leqwdate x \b, mtime=%s 246267843Sdelphij>44 leqwdate x \b, atime=%s 247267843Sdelphij>52 lelong x \b, length=%u, window= 248267843Sdelphij>60 lelong&1 1 \bhide 249267843Sdelphij>60 lelong&2 2 \bnormal 250267843Sdelphij>60 lelong&4 4 \bshowminimized 251267843Sdelphij>60 lelong&8 8 \bshowmaximized 252267843Sdelphij>60 lelong&16 16 \bshownoactivate 253267843Sdelphij>60 lelong&32 32 \bminimize 254267843Sdelphij>60 lelong&64 64 \bshowminnoactive 255267843Sdelphij>60 lelong&128 128 \bshowna 256267843Sdelphij>60 lelong&256 256 \brestore 257267843Sdelphij>60 lelong&512 512 \bshowdefault 258267843Sdelphij#>20 lelong&1 0 259267843Sdelphij#>>20 lelong&2 2 260267843Sdelphij#>>>(72.l-64) pstring/h x \b [%s] 261267843Sdelphij#>20 lelong&1 1 262267843Sdelphij#>>20 lelong&2 2 263267843Sdelphij#>>>(72.s) leshort x 264267843Sdelphij#>>>&75 pstring/h x \b [%s] 265186690Sobrien 266186690Sobrien# Summary: Outlook Personal Folders 267186690Sobrien# Created by: unknown 268186690Sobrien0 lelong 0x4E444221 Microsoft Outlook email folder 269186690Sobrien>10 leshort 0x0e (<=2002) 270186690Sobrien>10 leshort 0x17 (>=2003) 271186690Sobrien 272186690Sobrien 273186690Sobrien# Summary: Windows help cache 274186690Sobrien# Created by: unknown 275186690Sobrien0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 276186690Sobrien 277186690Sobrien 278186690Sobrien# Summary: IE cache file 279186690Sobrien# Created by: Christophe Monniez 280186690Sobrien0 string Client\ UrlCache\ MMF Internet Explorer cache file 281186690Sobrien>20 string >\0 version %s 282186690Sobrien 283186690Sobrien 284186690Sobrien# Summary: Registry files 285186690Sobrien# Created by: unknown 286186690Sobrien# Modified by (1): Joerg Jenderek 287186690Sobrien0 string regf MS Windows registry file, NT/2000 or above 288186690Sobrien0 string CREG MS Windows 95/98/ME registry file 289186690Sobrien0 string SHCC3 MS Windows 3.1 registry file 290186690Sobrien 291186690Sobrien 292186690Sobrien# Summary: Windows Registry text 293186690Sobrien# Extension: .reg 294186690Sobrien# Submitted by: Abel Cheung <abelcheung@gmail.com> 295186690Sobrien0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 296186690Sobrien0 string Windows\ Registry\ Editor\ 297186690Sobrien>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 298192348Sdelphij 299267843Sdelphij# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013 300275698Sdelphij# empty ,comment , section 301275698Sdelphij# PR/383: remove unicode BOM because it is not portable across regex impls 302275698Sdelphij0 regex/s \\`(\\r\\n|;|[[]) 303267843Sdelphij# left bracket in section line 304267843Sdelphij>&0 search/8192 [ 305267843Sdelphij# http://en.wikipedia.org/wiki/Autorun.inf 306267843Sdelphij# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 307267843Sdelphij>>&0 regex/c \^(autorun)]\r\n 308267843Sdelphij>>>&0 ubyte =0x5b INItialization configuration 309267843Sdelphij!:mime application/x-wine-extension-ini 310192348Sdelphij# From: Pal Tamas <folti@balabit.hu> 311192348Sdelphij# Autorun File 312267843Sdelphij>>>&0 ubyte !0x5b Microsoft Windows Autorun file 313267843Sdelphij!:mime application/x-setupscript 314267843Sdelphij# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 315267843Sdelphij# version strings ASCII coded case-independent for Windows setup information script file 316267843Sdelphij>>&0 regex/c \^(version|strings)] Windows setup INFormation 317267843Sdelphij!:mime application/x-setupscript 318267843Sdelphij#!:mime application/inf 319267843Sdelphij#!:mime application/x-wine-extension-inf 320267843Sdelphij>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 321267843Sdelphij!:mime text/inf 322267843Sdelphij# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 323267843Sdelphij# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 324267843Sdelphij# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 325267843Sdelphij>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 326267843Sdelphij!:mime application/x-wine-extension-ini 327267843Sdelphij#!:mime text/plain 328267843Sdelphij# http://support.microsoft.com/kb/84709/ 329267843Sdelphij>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 330267843Sdelphij!:mime application/x-wine-extension-ini 331267843Sdelphij>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 332267843Sdelphij!:mime application/x-wine-extension-ini 333267843Sdelphij# http://technet.microsoft.com/en-us/library/cc722567.aspx 334267843Sdelphij# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 335267843Sdelphij>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 336267843Sdelphij!:mime application/x-wine-extension-ini 337267843Sdelphij# http://en.wikipedia.org/wiki/SYSTEM.INI 338267843Sdelphij>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 339267843Sdelphij!:mime application/x-wine-extension-ini 340267843Sdelphij# http://www.mdgx.com/newtip6.htm 341267843Sdelphij>>&0 regex/c \^(SafeList)] Windows IOS.INI 342267843Sdelphij!:mime application/x-wine-extension-ini 343267843Sdelphij# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 344267843Sdelphij>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 345267843Sdelphij!:mime application/x-wine-extension-ini 346267843Sdelphij>>>&0 ubyte x 347267843Sdelphij# http://en.wikipedia.org/wiki/CONFIG.SYS 348267843Sdelphij>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS 349267843Sdelphij# http://support.microsoft.com/kb/118579/ 350267843Sdelphij>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 351267843Sdelphij# VERS string unicoded case-independent 352267843Sdelphij>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 353267843Sdelphij# ION] string unicoded case-independent 354267843Sdelphij>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 355267843Sdelphij!:mime application/x-setupscript 356267843Sdelphij# STRI string unicoded case-independent 357267843Sdelphij>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049 358267843Sdelphij# NGS] string unicoded case-independent 359267843Sdelphij>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation 360267843Sdelphij!:mime application/x-setupscript 361267843Sdelphij# unknown keyword after opening bracket 362267843Sdelphij>>&0 default x 363267843Sdelphij>>>&0 search/8192 [ 364267843Sdelphij# version Strings FileIdentification 365267843Sdelphij>>>>&0 string/c version Windows setup INFormation 366267843Sdelphij!:mime application/x-setupscript 367267843Sdelphij# VERS string unicoded case-independent 368267843Sdelphij>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 369267843Sdelphij# ION] string unicoded case-independent 370267843Sdelphij>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 371267843Sdelphij!:mime application/x-setupscript 372267843Sdelphij# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 373267843Sdelphij#>>>>&0 default x Generic INItialization configuration 374267843Sdelphij#!:mime application/x-wine-extension-ini 375267843Sdelphij 376267843Sdelphij# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 377267843Sdelphij# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 378267843Sdelphij# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 379267843Sdelphij0 leshort&0xFeFe 0x0000 380288143Sdelphij!:strength -5 381267843Sdelphij# test for unused null bits in PNF_FLAGs 382267843Sdelphij>4 ulelong&0xFCffFe00 0x00000000 383267843Sdelphij# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 384267843Sdelphij>>68 ulelong >0x57 385267843Sdelphij# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 386267843Sdelphij# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 387267843Sdelphij>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 388267843Sdelphij!:mime application/x-pnf 389267843Sdelphij# currently only found Major Version=1 and Minor Version=1 390267843Sdelphij#>>>>0 uleshort =0x0101 391267843Sdelphij#>>>>>1 ubyte x \b, version %u 392267843Sdelphij#>>>>>0 ubyte x \b.%u 393267843Sdelphij>>>>0 uleshort !0x0101 394267843Sdelphij>>>>>1 ubyte x \b, version %u 395267843Sdelphij>>>>>0 ubyte x \b.%u 396267843Sdelphij# 1 ,2 (windows 98 SE) 397267843Sdelphij#>>>>2 uleshort =2 \b, InfStyle %u 398267843Sdelphij>>>>2 uleshort !2 \b, InfStyle %u 399267843Sdelphij# PNF_FLAG_IS_UNICODE 0x00000001 400267843Sdelphij# PNF_FLAG_HAS_STRINGS 0x00000002 401267843Sdelphij# PNF_FLAG_SRCPATH_IS_URL 0x00000004 402267843Sdelphij# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 403267843Sdelphij# PNF_FLAG_INF_VERIFIED 0x00000010 404267843Sdelphij# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 405267843Sdelphij# ?? 0x00000100 406267843Sdelphij# ?? 0x01000000 407267843Sdelphij# ?? 0x02000000 408267843Sdelphij>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 409267843Sdelphij>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 410267843Sdelphij#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 411267843Sdelphij# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 412267843Sdelphij#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 413267843Sdelphij# only < 9 found 414267843Sdelphij#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 415267843Sdelphij# only found values lower 0x0000ffff 416267843Sdelphij#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 417267843Sdelphij# only found positive values lower 0x00ffFFff for InfVersionDataOffset 418267843Sdelphij>>>>20 ulelong x \b, at 0x%x 419267843Sdelphij>>>>4 ulelong&0x00000001 =0x00000001 420267843Sdelphij# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 421267843Sdelphij>>>>>(20.l) lestring16 x "%s" 422267843Sdelphij>>>>4 ulelong&0x00000001 !0x00000001 423267843Sdelphij>>>>>(20.l) string x "%s" 424267843Sdelphij# FILETIME is number of 100-nanosecond intervals since 1 January 1601 425267843Sdelphij#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 426267843Sdelphij# only found values lower 0x00ffFFff 427267843Sdelphij#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 428267843Sdelphij#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 429267843Sdelphij#>>>>40 ulelong x \b, InfSectionCount 0x%x 430267843Sdelphij#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 431267843Sdelphij#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 432267843Sdelphij#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 433267843Sdelphij#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 434267843Sdelphij#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 435267843Sdelphij#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 436267843Sdelphij# WinDirPathOffset 437267843Sdelphij#>>>>68 ulelong x \b, at 0x%x 438267843Sdelphij>>>>68 ulelong >0x57 439267843Sdelphij>>>>>4 ulelong&0x00000001 =0x00000001 440267843Sdelphij>>>>>>(68.l) ubequad =0x43003a005c005700 441267843Sdelphij# normally unicoded C:\Windows 442267843Sdelphij#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 443267843Sdelphij>>>>>>(68.l) ubequad !0x43003a005c005700 444267843Sdelphij>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 445267843Sdelphij>>>>>4 ulelong&0x00000001 !0x00000001 446267843Sdelphij# normally ASCII C:\WINDOWS 447267843Sdelphij#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 448267843Sdelphij>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 449267843Sdelphij# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 450267843Sdelphij#>>>>72 ulelong >0 \b, at 0x%x 451267843Sdelphij>>>>72 ulelong >0 \b, 452267843Sdelphij>>>>>4 ulelong&0x00000001 =0x00000001 453267843Sdelphij>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 454267843Sdelphij>>>>>4 ulelong&0x00000001 !0x00000001 455267843Sdelphij# seldom C:\ instead empty 456267843Sdelphij>>>>>>(72.l) string x OsLoaderPath "%s" 457267843Sdelphij# 1fdh 458267843Sdelphij#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 459267843Sdelphij>>>>78 uleshort !0x407 \b, LanguageId %x 460267843Sdelphij# only 407h found 461267843Sdelphij#>>>>78 uleshort =0x407 \b, LanguageId %x 462267843Sdelphij# InfSourcePathOffset often 0 463267843Sdelphij#>>>>80 ulelong >0 \b, at 0x%x 464267843Sdelphij>>>>80 ulelong >0 \b, 465267843Sdelphij>>>>>4 ulelong&0x00000001 =0x00000001 466267843Sdelphij>>>>>>(80.l) lestring16 x SourcePath "%s" 467267843Sdelphij>>>>>4 ulelong&0x00000001 !0x00000001 468267843Sdelphij>>>>>>(80.l) string >\0 SourcePath "%s" 469267843Sdelphij# OriginalInfNameOffset often 0 470267843Sdelphij#>>>>84 ulelong >0 \b, at 0x%x 471267843Sdelphij>>>>84 ulelong >0 \b, 472267843Sdelphij>>>>>4 ulelong&0x00000001 =0x00000001 473267843Sdelphij>>>>>>(84.l) lestring16 x InfName "%s" 474267843Sdelphij>>>>>4 ulelong&0x00000001 !0x00000001 475267843Sdelphij>>>>>>(84.l) string >\0 InfName "%s" 476267843Sdelphij 477298192Sdelphij# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 478298192Sdelphij# Extension: .bkf 479298192Sdelphij# Created by: Joerg Jenderek 480298192Sdelphij# URL: http://en.wikipedia.org/wiki/NTBackup 481298192Sdelphij# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 482298192Sdelphij# Descriptor BloCK name of Microsoft Tape Format 483298192Sdelphij0 string TAPE 484298192Sdelphij# Format Logical Address is zero 485298192Sdelphij>20 ulequad 0 486298192Sdelphij# Reserved for MBC is zero 487298192Sdelphij>>28 uleshort 0 488298192Sdelphij# Control Block ID is zero 489298192Sdelphij>>>36 ulelong 0 490298192Sdelphij# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 491298192Sdelphij>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 492298192Sdelphij#!:mime application/x-ntbackup 493298192Sdelphij!:ext bkf 494298192Sdelphij# OS ID 495298192Sdelphij>>>>>10 ubyte 1 \b NetWare 496298192Sdelphij>>>>>10 ubyte 13 \b NetWare SMS 497298192Sdelphij>>>>>10 ubyte 14 \b NT 498298192Sdelphij>>>>>10 ubyte 24 \b 3 499298192Sdelphij>>>>>10 ubyte 25 \b OS/2 500298192Sdelphij>>>>>10 ubyte 26 \b 95 501298192Sdelphij>>>>>10 ubyte 27 \b Macintosh 502298192Sdelphij>>>>>10 ubyte 28 \b UNIX 503298192Sdelphij# OS Version (2) 504298192Sdelphij#>>>>>11 ubyte x OS V=%x 505298192Sdelphij# MTF_CONTINUATION Media Sequence Number > 1 506298192Sdelphij#>>>>>4 ulelong&0x00000001 !0 \b, continued 507298192Sdelphij# MTF_COMPRESSION 508298192Sdelphij>>>>>4 ulelong&0x00000004 !0 \b, compressed 509298192Sdelphij# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 510298192Sdelphij>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 511298192Sdelphij>>>>>4 ulelong&0x00020000 0 512298192Sdelphij# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 513298192Sdelphij>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 514298192Sdelphij# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 515298192Sdelphij>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 516298192Sdelphij# Offset To First Event 238h,240h,28Ch 517298192Sdelphij#>>>>>8 uleshort x \b, event offset %4.4x 518298192Sdelphij# Displayable Size (20e0230h 20e024ch 20e0224h) 519298192Sdelphij#>>>>>8 ulequad x dis. size %16.16llx 520298192Sdelphij# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 521298192Sdelphij#>>>>>52 ulelong x family ID %8.8x 522298192Sdelphij# TAPE Attributes (3) 523298192Sdelphij#>>>>>56 ulelong x TAPE %8.8x 524298192Sdelphij# Media Sequence Number 525298192Sdelphij>>>>>60 uleshort >1 \b, sequence %u 526298192Sdelphij# Password Encryption Algorithm (3) 527298192Sdelphij>>>>>62 uleshort >0 \b, 0x%x encrypted 528298192Sdelphij# Soft Filemark Block Size * 512 (2) 529298192Sdelphij#>>>>>64 uleshort =2 \b, soft size %u*512 530298192Sdelphij>>>>>64 uleshort !2 \b, soft size %u*512 531298192Sdelphij# Media Based Catalog Type (1,2) 532298192Sdelphij#>>>>>66 uleshort x \b, catalog type %4.4x 533298192Sdelphij# size of Media Name (66,68,6Eh) 534298192Sdelphij>>>>>68 uleshort >0 535298192Sdelphij# offset of Media Name (5Eh) 536298192Sdelphij>>>>>>70 uleshort >0 537298192Sdelphij# 0~, 1~ANSI, 2~UNICODE 538298192Sdelphij>>>>>>>48 ubyte 1 539298192Sdelphij# size terminated ansi coded string normally followed by "MTF Media Label" 540298192Sdelphij>>>>>>>>(70.s) string >\0 \b, name: %s 541298192Sdelphij>>>>>>>48 ubyte 2 542298192Sdelphij# Not null, but size terminated unicoded string 543298192Sdelphij>>>>>>>>(70.s) lestring16 x \b, name: %s 544298192Sdelphij# size of Media Label (104h) 545298192Sdelphij>>>>>72 uleshort >0 546298192Sdelphij# offset of Media Label (C4h,C6h,CCh) 547298192Sdelphij>>>>>74 uleshort >0 548298192Sdelphij>>>>>>48 ubyte 1 549298192Sdelphij#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 550298192Sdelphij>>>>>>>(74.s) string >\0 \b, label: %s 551298192Sdelphij>>>>>>48 ubyte 2 552298192Sdelphij>>>>>>>(74.s) lestring16 x \b, label: %s 553298192Sdelphij# size of password name (0,1Ch) 554298192Sdelphij#>>>>>76 uleshort >0 \b, password size %4.4x 555298192Sdelphij# Software Vendor ID (CBEh) 556298192Sdelphij>>>>>86 uleshort x \b, software (0x%x) 557298192Sdelphij# size of Software Name (6Eh) 558298192Sdelphij>>>>>80 uleshort >0 559298192Sdelphij# offset of Software Name (1C8h,1CAh,1D0h) 560298192Sdelphij>>>>>>82 uleshort >0 561298192Sdelphij# 1~ANSI, 2~UNICODE 562298192Sdelphij>>>>>>>48 ubyte 1 563298192Sdelphij>>>>>>>>(82.s) string >\0 \b: %s 564298192Sdelphij>>>>>>>48 ubyte 2 565298192Sdelphij# size terminated unicoded coded string normally followed by "SPAD" 566298192Sdelphij>>>>>>>>(82.s) lestring16 x \b: %s 567298192Sdelphij# Format Logical Block Size (512,1024) 568298192Sdelphij#>>>>>84 uleshort =1024 \b, block size %u 569298192Sdelphij>>>>>84 uleshort !1024 \b, block size %u 570298192Sdelphij# Media Date of MTF_DATE_TIME type with 5 bytes 571298192Sdelphij#>>>>>>88 ubequad x DATE %16.16llx 572298192Sdelphij# MTF Major Version (1) 573298192Sdelphij#>>>>>>93 ubyte x \b, MFT version %x 574298192Sdelphij# 575298192Sdelphij 576