The Windows Shortcut File Format

as reverse-engineered by Jesse Hager [email protected] Document Version 1.0 Disclaimer

This document is provided AS-IS basis, without any warranties or representations express, implied or statutory; including, without limitation, warranties of quality, performance, non-infringement, merchantability or fitness for a particular purpose. Jesse Hager does not warrant that this document will meet your needs or be free from errors.

This document assumes that you are familiar with shortcuts and the IShellLink interface. If not, this in probably not the best place to start. This document is also unofficial, so I dont claim that it is 100% accurate. This information is based solely on the examination of hundreds of shortcut files and comparing them to the documented IShellLink interface. Theres still a few things Im unsure of, namely which time value is which, the contents of the network volume structure and the extra stuff at the end of the file. If youre writing software under Windows I highly recommend you use the IShellLink interface. For the DOS, Linux, JAVA and other crowds, this is the document you need, cause MS isnt gonna give you squat.

Basic File Structure

The file is structured like this: File header Shell item ID list Item 1 Item 2 etc.. File locator info Local path Network path Description string Relative path string Working directory string Command line string Icon filename string Extra stuff

The File Header

This is of course at the start of the file.

.LNK File Header

Offset 0h 4h 14h 18h 1Ch 24h 2Ch 34h 38h 3Ch 40h 44h Size/Type 1 dword 16 bytes 1 dword 1 dword 1 qword 1 qword 1 qword 1 dword 1 dword 1 dword 1 dword 2 dwords Contents Always 0000004Ch L GUID of shortcut files Flags File attributes Time 1 Time 2 Time 3 File length Icon number ShowWnd value Hot key Unknown, always zero

The first 4 bytes of the file form a long integer that is always set to 4Ch this it the ASCII value for the uppercase letter L. This is used to identify a valid shell link file. The next 16 bytes is the globally unique identifier GUID of the shell links which is: {00021401-0000-0000-00C0-000000000046} in standard GUID notation or {01h, 14h, 02h, 00h, 00h, 00h, 00h, 00h, C0h, 00h, 00h, 00h, 00h, 00h, 46h} as it is composed of bytes in the file. It appears that in the future, Microsoft may redefine the file format and this will be used to indicate which version to use. The next item is a long integer which consists of a number of flags. This is important, because it indicates which of the optional parts of the file are present.

The flags
Bit 0 1 2 3 4 5 6 Meaning when 1 The shell item id list is present. Points to a file or directory. Has a description string. Has a relative path string. Has a working directory. Has command line arguments. Has a custom icon. when 0 The shell item id list is absent. Points to something else. No description string. No relative path. No working directory. No command line arguments. Has the default icon.

The next item is a long integer that contains file attributes of the target file. If the target is not a file (see flags bit 1), then this is set to zero. The resolver uses these when the link is broken to match the link with the correct target. File Attributes Bit 0 1 2 3 4 5 6 7 8 9 10 11 12 Meaning when set Target is read only. Target is hidden. Target is a system file. Target is a volume label. (Not possible) Target is a directory. Target has been modified since last backup. (archive) Target is encrypted (NTFS EFS) Target is Normal?? Target is temporary. Target is a sparse file. Target has reparse point data. Target is compressed. Target is offline.

The next three items are 64 bit integers that specifiy the various time information for the file. Creation time Modification time Last access time The next item is a long integer which contains the length of the target file. If the file has a custom icon (see flags bit 6), then this long integer indicates the index of the icon to use. Otherwise it is zero. The next long integer specifies the ShowWnd value to pass to the target application when starting it. For your convenience, the values are reproduced below. It is unlikely, that most of these values are valid. Only values 1, 2 and 3 are permitted in the shortcut property page. SW_HIDE SW_NORMAL SW_SHOWMINIMIZED SW_SHOWMAXIMIZED SW_SHOWNOACTIVATE SW_SHOW SW_MINIMIZE SW_SHOWMINNOACTIVE SW_SHOWNA SW_RESTORE SW_SHOWDEFAULT 0 1 2 3 4 5 6 7 8 9 10 Cool...

The next long integer specifies the hotkey assigned to the shortcut. The last two long integers are always zero. They are probably reserved for future use.

The Shell Item Id List.

This item is only present if bit 0 is set in the flags word of the header. An entire book could be written on the contents of this item. Essentially it indicates how to get from the desktop to the specified item. The actual contents are highly variable. The following are the only constant items about the list. The first unsigned short integer indicates the total length of the list so it can be skipped easily.

Inside the list, each item begins with an unsigned short integer that indicates the length of the item. The length includes the size of the length value. The last item is length 0. Lookup ITEMIDLIST in most any Win32 documentation for more info on this item.

File Location Info

This item is always present, but if bit 1 is not set in the flags value, then the length of this structure will be zero. The following table shows the structure of the header of this item.

File Location Info

Offset 0h 4h 8h Ch 10h 14h 18h Size 1 dword 1 dword 1 dword 1 dword 1 dword 1 dword 1 dword Contents This is the total length of this structure and all following data This is a pointer to first offset after this structure. 1Ch Flags Offset of local volume info Offset of base pathname on local system Offset of network volume info Offset of remaining pathname

Notes: The first length value includes all the assorted pathnames and other data structures. All offsets are relative to the start of this structure. The first long integer indicates the size of the file location info. The next long integer is the offset at which the basic file info structure ends. Should be 1Ch under normal conditions. The next long integer is the flags that indicate which types of volumes the file is available on.

Volume flags
Bit 0 1 Meaning Available on a local volume Available on a network share

The next long integer is the offset to the local volume table. (See below) ( Random garbage when bit 0 is clear in volume flags) The next long integer is the offset to the base path on the local volume. ( Random garbage when bit 0 is clear in volume flags) The next long integer is the offset to the network volume table. (See below) Random garbage when bit 1 is clear in volume flags) ( The next long integer is the offset to the final part of the pathname. To find the filename of the file on the local volume, combine the base path string and the final path string. To find the filename of the file on the network, combine the share name in the network volume table with the final path string.

The local volume table

Offset 0h 4h 8h Ch 10h Size 1 dword 1 dword 1 dword 1 dword ASCIZ Contents Length of this structure. Type of volume Volume serial number Offset of the volume name (Always 10h) Volume label

The first long integer in the local volume table is the length of the structure including the volume label string. The next long integer is the type of volume. 0 1 2 3 4 5 6 Unknown No root directory Removable (Floppy, Zip, etc..) Fixed (Hard disk) Remote (Network drive) CD-ROM Ram drive (Shortcuts to stuff on a ram drive, now thats smart...)

The next long integer is the volume serial number.

The next long integer is the offset of the volume label within the structure. Always 10h under normal conditions.

The network volume table

Offset 0h 4h 8h Ch 10h 14h Size 1 dword 1 dword 1 dword 1 dword 1 dword ASCIZ Contents Length of this structure Unknown, always 2h? Offset of network share name (Always 14h) Unknown, always zero? Unknown, always 20000h? Network share name

Note 1: The above unknown values are the same for a printer or file share. Note 2: The above values are for Microsoft Networks, I dont have a NetWare server to test. The first long integer is the length of the structure including the length of the network share name. The next long integer is unknown, it seems to always be 2h on Microsoft Networks. The next long integer is the offset to the share name within the structure. The next two long integers are unknown. The share name specifies the share name that the item is available under.

Description string
If bit 2 is set in the flags value in the header, then this string is present. The first unsigned short int value indicates the length of the string. Following the length value is a string of ASCII characters. It is a description of the item.

Relative path string

If bit 3 is set in the flags value in the header, then this string is present. The first unsigned short int value indicates the length of the string. Following the length value is a string of ASCII characters. It is a relative path to the target.

Working directory
If bit 4 is set in the flags value in the header, then this string is present. The first unsigned short int value indicates the length of the string. Following the length value is a string of ASCII characters. It is the working directory as specified in the shortcut properties.

Command line string

If bit 5 is set in the flags value in the header, then this string is present. The first unsigned short int value indicates the length of the string. Following the length value is a string of ASCII characters. The command line string includes everything except the program name.

Icon filename string

If bit 6 is set in the flags value in the header, then this string is present. The first unsigned short int value indicates the length of the string. Following the length value is a string of ASCII characters. This the name of the file containing the icon.

Extra stuff
The last item in the file is usually a long integer with the value zero. In rare cases, this long integer seems to be the length of some unknown structure that follows. The only values Ive ever seen in here are: 1 dword 1 dword 1 dword 1 dword 1 dword 10h A0000005h 1Ah 6Ch 0 Length of following data ? ? ? ?

Another possible arrangement is: 1 dword 3 dwords 1 dword 10h x 0 Length of first structure Remainder of first structure Length of next structure

Disassembly of a hypothetical shortcut file

Offset Header 0000 0004 Bytes 4C 01 00 C0 00 3F 00 04 00 00 00 00 00 02 00 00 00 00 00 00 00 00 46 00 Contents L Magic value GUID of shortcut files

0014

Flags Has item id list Target is a file Has description string Has relative pathname Has a working directory Has a custom icon File attibutes Archive Time 1 Time 2 Time 3 File length is 34464 bytes. 86A0h Icon number 5 Normal window Ctrl-Alt-F hotkey Always zero, unknown/reserved Always zero, unknown/reserved Size of item id list Length of first item ??? File length ??? File attributes? best_773.mid Long name Null terminator BEST_773.MID Null terminator

0018 001C

20 00 00 00 0E 20 08 20 47 15 86 00 00 06 00 00 00 00 00 86 25 00 65 33 82 BE BF BE AA BE 00 00 00 00 00 00 D5 01 46 01 EC 01 00 00 00 00 00 00

C0 C1 0024 00 D5 002C 00 EC 0034 A0 0038 05 003C 01 0040 46 0044 00 0048 00 Item Id List 004C 2A First item 004E 28 0050 32 0052 A0 0056 76 005A 20 005C 62 37 00 0069 42 37 00 Last item 0076 00

00 00 71 3E 73 74 5F 37 2E 6D 69 64

45 53 54 5F 37 33 2E 4D 49 44

Short name

00

Zero length value

Offset Bytes File location info 0078 74 00 00 00 007C 1C 00 00 00 0080 03 00 00 00

Contents Structure length Offset past last item in structure Flags Local volume Network volume Offset of local volume table Offset of local path string Offset of network volume table Offset of final path string Length of local volume table Fixed disk Volume serial number 3A33-07D0 Offset to volume label DRIVE C,0 C:\WINDOWS\ local path string

0084 1C 00 00 00 0088 34 00 00 00 008C 40 00 00 00 0090 5F 00 00 00 Local volume table 0094 18 00 00 00 0098 03 00 00 00 009C D0 07 33 3A 00A0 10 00 00 00 00A4 44 52 49 56 45 43 00 00AC 43 3A 5C 57 49 44 4F 57 53 5C Network volume table 00B8 1F 00 00 00 00BC 02 00 00 00 00C0 14 00 00 00 00C4 00 00 00 00 00C8 00 00 02 00 00CC 5C 5C 4A 45 53 45 5C 57 44 00 00D7 44 65 73 6B 74 70 5C 62 65 73 5F 37 37 33 2E 69 64 00 Description string 00EC 12 00 00EE 42 65 73 74 20 37 33 20 6D 69 69 20 66 69 6C Relative path 0100 0E 00 0102 2E 5C 62 65 73 5F 37 37 33 2E 69 64 Working directory 0114 12 00 0116 43 3A 5C 57 49 44 4F 57 53 5C 65 73 6B 74 6F

20 4E 00

53 6F 74 6D

Length of network volume table ??? Offset of share name ??? ??? \\JESSE\WD,0 Share name Desktop\best_773.mid,0 Final path name

37 64 65

Length of string Best 773 midi file

74 6D

Length of string .\best_773.mid

4E 44 70

Length of string C:\WINDOWS\Desktop

Offset Bytes Command line arguments 0128 06 00 012A 2F 63 6C 6F 73 Icon file 0130 16 00 0132 43 3A 5C 57 49 44 4F 57 53 5C 70 6C 61 79 65 2E 65 78 65 Ending stuff 0148 00 00 00 00

Contents

65

/close Length of string C:\WINDOWS\Mplayer.exe

4E 4D 72

Length 0 - no more stuff

The target is located at: C:\WINDOWS\Desktop\best_773.mid The windows directory is shared as: \\JESSE\WD