1 2 #------------------------------------------------------------------------------ 3 # $File: windows,v 1.63 2023/07/17 16:56:13 christos Exp $ 4 # windows: file(1) magic for Microsoft Windows 5 # 6 # This file is mainly reserved for files where programs 7 # using them are run almost always on MS Windows 3.x or 8 # above, or files only used exclusively in Windows OS, 9 # where there is no better category to allocate for. 10 # For example, even though WinZIP almost run on Windows 11 # only, it is better to treat them as "archive" instead. 12 # For format usable in DOS, such as generic executable 13 # format, please specify under "msdos" file. 14 # 15 16 17 # Summary: Outlook Express DBX file 18 # Created by: Christophe Monniez 19 # Update: Joerg Jenderek 20 # URL: http://fileformats.archiveteam.org/wiki/Outlook_Express_Database 21 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbx.trid.xml 22 # https://sourceforge.net/projects/ol2mbox/files/LibDBX/ 23 # v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT 24 # Note: called "Outlook Express Database" by TrID and DROID via PUID fmt/838 fmt/839 25 # and partly verified by `undbx --verbosity 4 Posteingang.dbx` 26 0 string \xCF\xAD\x12\xFE 27 # skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file size 28 >0x7C ulelong >0 MS Outlook Express DBX file 29 #!:mime application/octet-stream 30 #!:mime application/vnd.ms-outlook 31 !:mime application/x-ms-dbx 32 !:ext dbx 33 >>4 byte =0xC5 \b, message database 34 >>4 byte =0xC6 \b, folder database 35 >>4 byte =0xC7 \b, account information 36 >>4 byte =0x30 \b, offline database 37 # version like: 5.2 5.5 (typical) 38 >>20 ulequad !0x0000000500000005 \b, version 39 # major version 40 >>>24 ulelong x %u 41 # minor version 42 >>>20 ulelong x \b.%u 43 # CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder 44 # 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline 45 #>>4 guid x \b, CLSID %s 46 # file size; total size of file; sometimes real size a little bit higher 47 >>0x7C ulelong x \b, ~ %u bytes 48 # highest Email ID; the next email will have a number one higher than this 49 >>0x5c ulelong x \b, highest ID %#x 50 # item count; number of items stored in this DBX file 51 >>0xC4 ulelong x \b, %u item 52 # plural s 53 >>0xC4 ulelong !1 \bs 54 # index pointer; file offset pointing to a page of Data Indexes 55 >>0xE4 ulelong >0 \b, index pointer %#x 56 57 # From: Joerg Jenderek 58 # URL: http://fileformats.archiveteam.org/wiki/Nickfile 59 # https://www.nirsoft.net/utils/outlook_nk2_edit.html 60 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nk2.trid.xml 61 # https://github.com/libyal/libnk2/blob/main/documentation 62 # Nickfile%20(NK2)%20format.asciidoc 63 # Note: called "Outlook Nickfile" by TrID & TestDisk and 64 # "Outlook Nickname File" by Microsoft Outlook and 65 # "Outlook AutoComplete File" by Nirsoft NK2Edit 66 # partly verfied by NK2Edit Raw Text Edit Mode 67 0 ubelong 0x0DF0ADBA MS Outlook Nickfile 68 #!:mime application/octet-stream 69 #!:mime application/vnd.ms-outlook 70 !:mime application/x-ms-nickfile 71 !:ext nk2/dat/bak 72 # nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is used for backup 73 #!:ext nick/nk2/dat/bak 74 # Unknown; probably a version indicator like: 0000000Ah 0000000Ch 75 >4 ulelong x \b, probably version %u 76 # Unknown2; probably a version indicator like: 1 0 77 >8 ulelong x \b.%u 78 # number of rows (nickname or alias items) in file 79 >12 ulelong x \b, %u items 80 # number of item entries/columns/properties value like: 17h 81 >16 ulelong x \b, %u entries 82 # value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string 83 >20 uleshort x \b, value type %#4.4x 84 # entry type/property identifier: 6001h~PR_DOTSTUFF_STATE/PR_NICK_NAME_W 85 >22 uleshort x \b, entry type %#4.4x 86 # Reserved like: 0013FD90h 87 #>24 ulelong x \b, reserved %#8.8x 88 # value data array/Irrelevant Union like: 0000000004E31A80h 89 #>28 ulequad x \b, data %#16.16llx 90 # UTF-16 91 >20 uleshort =0x001F 92 # unicode string bytes like: 2Ch 93 >>36 ulelong x \b, %u bytes 94 # unicode string value PT_UNICODE like: janesmith (a] contoso.org 95 >>40 lestring16 x "%s" 96 97 # Summary: Windows crash dump 98 # Created by: Andreas Schuster (https://computer.forensikblog.de/) 99 # https://web.archive.org/web/20101125060849/https://computer.forensikblog.de/en/2008/02/64bit_magic.html 100 # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 101 # Modified by (2): Joerg Jenderek (addtional fields, extension, URL) 102 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp.trid.xml 103 # https://gitlab.com/qemu-project/qemu/-/blob/master/include/qemu/win_dump_defs.h 104 # Note: called "Windows memory dump" by TrID 105 # and verified by like Windows Kit `Dumpchk.exe 043022-18703-01.dmp` 106 # and partly by NirSoft `BlueScreenView.exe 043022-18703-01.dmp` 107 # char Signature[4] 108 0 string PAGE 109 # char ValidDump[4] 110 >4 string DUMP MS Windows 32bit crash dump 111 #!:mime application/octet-stream 112 !:mime application/x-ms-dmp 113 # like: Mini111013-01.dmp 114 !:ext dmp 115 # major version like: 15 116 >>8 ulelong x \b, version %u 117 # minor version like: 2600 118 >>12 ulelong x \b.%u 119 # DirectoryTableBase like: 709000 120 #>>16 ulelong x \b, DirectoryTableBase %#x 121 # PfnDatabase like: 805620c8 122 #>>20 ulelong x \b, PfnDatabase %#x 123 # PsLoadedModuleList like: 8055d720 124 #>>24 ulelong x \b, PsLoadedModuleList %#x 125 # PsActiveProcessHead like:805638b8 126 #>>28 ulelong x \b, PsActiveProcessHead %#x 127 # MachineImageType like: 14c (intel x86) 128 >>32 ulelong !0x14c \b, MachineImageType %#x 129 # NumberProcessors like: 2 130 >>36 ulelong x \b, %u processors 131 # BugcheckCode like: e2 132 #>>40 ulelong x \b, BugcheckCode %#x 133 # BugcheckParameter1 like: 0 134 #>>44 ulelong x \b, BugcheckParameter1 %#x 135 # BugcheckParameter2 like: 0 136 #>>48 ulelong x \b, BugcheckParameter2 %#x 137 # BugcheckParameter3 like: 0 138 #>>52 ulelong x \b, BugcheckParameter3 %#x 139 # BugcheckParameter4 like: 0 140 #>>56 ulelong x \b, BugcheckParameter4 %#x 141 # VersionUser[32]; like "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 142 #>>60 string x \b, VersionUser "%.32s" 143 # uint32_t reserved0 like: 45474101 144 #>>92 ulelong x \b, reserved0 %#x 145 >>0x05c byte 0 \b, no PAE 146 >>0x05c byte 1 \b, PAE 147 # KdDebuggerDataBlock like: 8054d2e0 148 #>>96 ulelong x \b, KdDebuggerDataBlock %#x 149 # uint8_t PhysicalMemoryBlockBuffer[700] 150 # WinDumpPhyMemDesc32 NumberOfRuns like: 45474150 151 #>>100 ulelong x \b, NumberOfRuns %#x 152 # WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 153 #>>104 ulelong x \b, NumberOfPages %#x 154 # WinDumpPhyMemRun32 Run[86]; 688 bytes 155 #>>108 ulelong x \b, BasePage %#x 156 #>>112 ulelong x \b, PageCount %#x 157 # uint8_t reserved1[3200] 158 #>>800 string x \b, reserved "%s" 159 #>>4000 ulelong x \b, RequiredDumpSpace %#x 160 # uint8_t reserved2[92]; 161 #>>4004 string x \b, reserved2 "%s" 162 >>0xf88 lelong 1 \b, full dump 163 >>0xf88 lelong 2 \b, kernel dump 164 >>0xf88 lelong 3 \b, small dump 165 # like: 4 166 >>0xf88 lelong >3 \b, dump type (%#x) 167 # WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 168 # GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 169 #>>104 ulelong x \b, NumberOfPages %#x 170 >>0x068 lelong x \b, %d pages 171 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp-64.trid.xml113o 172 # Note: called "Windows 64bit Memory Dump" by TrID 173 # char ValidDump[4] 174 >4 string DU64 MS Windows 64bit crash dump 175 #!:mime application/octet-stream 176 !:mime application/x-ms-dmp 177 # like: c:\Windows\Minidump\020322-18890-01.dmp c:\Windows\MEMORY.DMP 178 !:ext dmp 179 # major version like: 15 180 >>8 ulelong x \b, version %u 181 # minor version like: 9600 19041 22621 182 >>12 ulelong x \b.%u 183 # DirectoryTableBase like: 001ab000 184 #>>16 ulequad x \b, DirectoryTableBase %#llx 185 # PfnDatabase like: fffffa8000000000 186 #>>24 ulequad x \b, PfnDatabase %#llx 187 # PsLoadedModuleList like: fffff800c553f650 188 #>>32 ulequad x \b, PsLoadedModuleList %#llx 189 # PsActiveProcessHead like: fffff800c5525400 190 #>>40 ulequad x \b, PsActiveProcessHead %#llx 191 # MachineImageType like: 00008664 192 >>48 ulelong !0x8664 \b, MachineImageType %#x 193 # NumberProcessors like: 2 4 194 >>52 ulelong x \b, %u processors 195 # BugcheckCode like: 1000007e 196 #>>56 ulelong x \b, BugcheckCode %#x 197 # unused0 198 #>>60 ulelong x \b, unused0 %#x 199 # BugcheckParameter1 like: ffffffffc0000005 200 #>>64 ulequad x \b, BugcheckParameter1 %#llx 201 # BugcheckParameter2 like: fffff801abb2158f 202 #>>72 ulequad x \b, BugcheckParameter2 %#llx 203 # BugcheckParameter3 like: ffffd000290d4288 204 #>>80 ulequad x \b, BugcheckParameter3 %#llx 205 # BugcheckParameter4 like: ffffd000290d3aa0 206 #>>88 ulequad x \b, BugcheckParameter4 %#llx 207 # VersionUser[32]; like "" "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 208 #>>96 string x \b, VersionUser "%.32s" 209 # KdDebuggerDataBlock like: fffff800c550c530 210 #>>128 ulequad x \b, KdDebuggerDataBlock %#llx 211 # uint8_t PhysicalMemoryBlockBuffer[704] 212 # WinDumpPhyMemDesc64 NumberOfRuns like: 6 7 0x45474150 213 #>>136 ulelong x \b, NumberOfRuns %#x 214 # WinDumpPhyMemDesc64 unused like: 0 0x45474150 215 #>>140 ulelong x \b, unused %#x 216 # WinDumpPhyMemRun64 Run[43] BasePage like: 1 217 #>>152 ulequad x \b, BasePage %#llx 218 # WinDumpPhyMemRun64 Run[43] PageCount like: 57h 219 #>>160 ulequad x \b, PageCount %#llx 220 # uint8_t ContextBuffer[3000] like: "" "\001" "\0207J\266\001\340\377\377&8\007\312" 221 #>>840 string x \b, ContextBuffer "%s" 222 # WinDumpExceptionRecord ExceptionCode 223 #>>3840 ulelong x \b, ExceptionCode %#x 224 # WinDumpExceptionRecord ExceptionFlags 225 #>>3844 ulelong x \b, ExceptionFlags %#x 226 # WinDumpExceptionRecord ExceptionRecord 227 #>>3848 ulequad x \b, ExceptionRecord %#llx 228 # WinDumpExceptionRecord ExceptionAddress 229 #>>3856 ulequad x \b, ExceptionAddress %#llx 230 # WinDumpExceptionRecord NumberParameters 231 #>>3864 ulelong x \b, NumberParameters %#x 232 # WinDumpExceptionRecord unused 233 #>>3868 ulelong x \b, unsed %#x 234 # WinDumpExceptionRecord ExceptionInformation[15] 235 #>>3872 ulequad x \b, ExceptionInformation[0] %#llx 236 # https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options 237 # but DumpType like: 4~small 5~full (MEMORY.DMP) 6~kernel (MEMORY.DMP) 238 >>0xf98 ulelong x \b, 239 >>>0xf98 lelong 5 full dump 240 >>>0xf98 lelong 6 kernel dump 241 >>>0xf98 lelong 4 small dump 242 # This probably never occur 243 >>>0xf98 default x DumpType 244 >>>>0xf98 ulelong x (%#x) 245 # WinDumpPhyMemDesc64 uint64_t NumberOfPages like: 3142425 8341923 8366500 1162297680 4992030524978970960 246 # GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 247 >>0x090 lequad x \b, %lld pages 248 249 # Summary: Vista Event Log 250 # Created by: Andreas Schuster (https://computer.forensikblog.de/) 251 # Update: Joerg Jenderek 252 # URL: https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc 253 # Reference (1): https://web.archive.org/web/20110803085000/ 254 # https://computer.forensikblog.de/en/2007/05/some_magic.html 255 # http://mark0.net/download/triddefs_xml.7z/defs/e/evtx.trid.xml 256 # Note: called "Vista Event Log" by TrID and "Event Log" by Windows 257 # verified partly by `wevtutil.exe gli /lf:true dumpfile.evtx` 258 0 string ElfFile\0 MS Windows 259 #!:mime application/octet-stream 260 !:mime application/x-ms-evtx 261 !:ext evtx 262 # Major+Minor format version: 3.1~Vista and later 3.2~Windows 10 (2004) and later 263 >0x24 ulelong =0x00030001 Vista-8.1 Event Log 264 >0x24 ulelong !0x00030001 10-11 Event Log, version 265 >>0x26 uleshort x %u 266 >>0x24 uleshort x \b.%u 267 >0x2a leshort x \b, %d chunks 268 >>0x10 lelong x \b (no. %d in use) 269 >0x18 lelong >1 \b, next record no. %d 270 >0x18 lelong =1 \b, empty 271 >0x78 lelong &1 \b, DIRTY 272 >0x78 lelong &2 \b, FULL 273 274 # Summary: Windows Event Trace Log 275 # From: Joerg Jenderek 276 # URL: http://fileformats.archiveteam.org/wiki/ETL 277 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/etl.trid.xml 278 # https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracelog/trace_logfile_header.htm 279 # Note: called "Window tracing/diagnostic binary log" by TrID 280 # verified by `tracerpt.EXE Wifi.etl -of EVTX` 281 # and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml` 282 # Every ETL file begins with a WMI_BUFFER_HEADER, a SYSTEM_TRACE_HEADER and a TRACE_LOGFILE_HEADER 283 0 ubyte 0 284 # look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl 285 >0 search/0x699087/b .\0e\0t\0l\0\0\0 286 # GRR: line above only works if in ../../src/file.h FILE_BYTES_MAX is raised above 699086h (6,59 MiB) 287 >>0 use trace-etl 288 # display information of Windows Performance Analyzer Trace File (file name) 289 0 name trace-etl 290 >0 ubyte x Windows Event Trace Log 291 #!:mime application/x-ms-etl 292 # http://extension.nirsoft.net/etl 293 !:mime application/etl 294 !:ext etl 295 # look for DOS drive letter part of log file name like: PhotosAppTracing_startedInBGMode.etl 296 >0 search/0x2b4/sb :\0\x5c\0 297 # like: "c:\Windows\Logs\NetSetup\service.0.etl" "C:\Windows\System32\LogFiles\WMI\Wifi.etl" 298 >>&-2 lestring16 x "%s" 299 300 # Summary: Windows System Deployment Image 301 # Created by: Joerg Jenderek 302 # URL: http://en.wikipedia.org/wiki/System_Deployment_Image 303 # Reference: http://skolk.livejournal.com/1320.html 304 0 string $SDI 305 >4 string 0001 System Deployment Image 306 !:mime application/x-ms-sdi 307 #!:mime application/octet-stream 308 # \Boot\boot.sdi 309 !:ext sdi 310 # MDBtype: 0~Unspecified 1~RAM 2~ROM 311 >>8 ulequad !0 \b, MDBtype %#llx 312 # BootCodeOffset 313 >>16 ulequad !0 \b, BootCodeOffset %#llx 314 # BootCodeSize 315 >>24 ulequad !0 \b, BootCodeSize %#llx 316 # VendorID 317 >>32 ulequad !0 \b, VendorID %#llx 318 # DeviceID 319 >>40 ulequad !0 \b, DeviceID %#llx 320 # DeviceModel 321 >>48 ulequad !0 \b, DeviceModel %#llx 322 >>>56 ulequad !0 \b%llx 323 # DeviceRole 324 >>64 ulequad !0 \b, DeviceRole %#llx 325 # Reserved1; reserved fields and gaps between BLOBs are padded with \0 326 #>>72 ulequad !0 \b, Reserved1 %#llx 327 # RuntimeGUID 328 >>80 ulequad !0 \b, RuntimeGUID %#llx 329 >>>88 ulequad !0 \b%llx 330 # RuntimeOEMrev 331 >>96 ulequad !0 \b, RuntimeOEMrev %#llx 332 # Reserved2 333 #>>104 ulequad !0 \b, Reserved2 %#llx 334 # BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 335 >>112 ulequad !0 \b, PageAlignment %llu 336 # Reserved3[48] 337 #>>120 ulequad !0 \b, Reserved3 %#llx 338 # SDI checksum 39h 339 >>0x1f8 ulequad x \b, checksum %#llx 340 # BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 341 >>0x400 string >\0 \b, type %-3.8s 342 # 0~non-filesystem 7~NTFS 6~BIGFAT 343 >>>0x420 ulequad !0 (%#llx) 344 # ATTRibutes 345 >>>0x408 ulequad !0 %#llx attributes 346 # Offset 347 >>>0x410 ulequad x at %#llx 348 # print 1 space after size and then handles NTFS boot sector by ./filesystems 349 >>>0x418 ulequad >0 %llu bytes 350 >>>>(0x410.l) indirect x 351 # 2nd BLOB: WIM 352 >>0x440 string >\0 \b, type %-3.8s 353 >>>0x428 ulequad !0 (%#llx) 354 # ATTRibutes 355 >>>0x448 ulequad !0 %#llx attributes 356 # Offset 357 >>>0x450 ulequad x at %#llx 358 >>>0x458 ulequad >0 %llu bytes 359 >>>>(0x450.l) indirect x 360 # 3rd BLOB 361 >>0x480 string >\0 \b, type %-3.8s 362 363 # Summary: Windows boot status log BOOTSTAT.DAT 364 # From: Joerg Jenderek 365 # Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 366 # Note: mainly refers to older Windows Vista, sometimes 367 # BOOTSTAT.DAT only contains nulls or invalid data 368 # checking for valid version below 5 369 0 ulelong <5 370 # skip many ISO images by checking for valid 64 KiB file size 371 >8 ulelong =0x00010000 372 >>0 use bootstat-dat 373 # display information of BOOTSTAT.DAT 374 0 name bootstat-dat 375 >0 ulelong x Windows boot log 376 #!:mime application/octet-stream 377 !:mime application/x-ms-dat 378 # BOOTSTAT.DAT in BOOT subdirectory 379 !:ext dat 380 # apparently a version number: 2 for older like Vista, 3, 4 Windows 10 381 >0 ulelong >2 \b, version %u 382 # apparently the size of the header: often 10h in older Windows, 14h, 18h 383 >4 ulelong !0x10 \b, header size %#x 384 #>4 ulelong !0x10 \b, header size %u 385 # apparently the size of the file: always 0x00010000~64KiB 386 # the file is acceptable to BOOTMGR only if it is exactly 64 KiB 387 >8 ulelong !0x00010000 \b, file size %#x 388 # size of valid data, in bytes: C8h 50h 172h 5D5Ch 389 >0xc ulelong x \b, %#x valid bytes 390 # skip header and jump to first bootstat entry and display information 391 >(0x4.l-1) ubyte x 392 >>&0 use bootstat-entry 393 # jump to first entry again because pointer are bad after "use" 394 >(0x4.l-1) ubyte x 395 # by 1st entry size jump to 2nd entry and display information 396 >>&(&0x18.l-1) ubyte x 397 >>>&0 use bootstat-entry 398 # jump to possible 3rd boot entry and display information 399 # >(0x4.l-1) ubyte x 400 # >>&(&0x18.l-1) ubyte x 401 # >>>&(&0x18.l-1) ubyte x 402 # >>>>&0 use bootstat-entry 403 # display BOOTSTAT.DAT entry 404 0 name bootstat-entry 405 #>0x00 ubequad x \b, ENTRY %16.16llx 406 # size of entry, in bytes: 40h(init) 78h(launced) 9Ch 407 #>0x18 ulelong x \b; entry size %u 408 >0x18 ulelong x \b; entry size %#x 409 # time stamp, in seconds 410 >0x00 ulelong x \b, %#x seconds 411 # always zero, significance unknown 412 >0x04 ulelong !0 \b, not null %u 413 # GUID of event source; but empty if event source is BOOTMGR 414 >0x08 ubequad !0 \b, GUID %#16.16llx 415 >>0x10 ubequad x \b%16.16llx 416 # severity code: 1~informational 3~errors 417 >0x1C ulelong !1 \b, severity %#x 418 # apparently a version number: 2 419 >0x20 ulelong !2 \b, version %u 420 # event identifier 1~log file initialised 11h~boot application launched 421 #>0x24 ulelong x \b, event %#x 422 >0x24 ulelong !1 423 >>0x24 ulelong !0x11 \b, event %#x 424 # entry data; size depends on event identifier 425 #>0x28 ubequad x \b, data %#16.16llx 426 >0x24 ulelong =0x1 \b, Init 427 # always 0, significance unknown 428 >>0x34 uleshort !0 \b, not null %u 429 # always 7, significance unknown 430 >>0x36 uleshort !7 \b, not seven %u 431 # year 432 >>0x28 uleshort x %u 433 # month 434 >>0x2A uleshort x \b-%u 435 # day 436 >>0x2C uleshort x \b-%u 437 # hour 438 >>0x2E uleshort x %u 439 # minute 440 >>0x30 uleshort x \b:%u 441 # second 442 >>0x32 uleshort x \b:%u 443 # boot application launched 444 >0x24 ulelong =0x11 \b, launched 445 # type of start: 0 normally, 1 or 2 maybe in a recovery sequence 446 >>0x38 uleshort !0 \b, type %u 447 # pathname of boot application, as null-terminated Unicode string; typically 448 # \Windows\system32\winload.exe \Windows\system32\winload.efi 449 >>0x3C lestring16 x %s 450 451 # Summary: Windows Error Report text files 452 # URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 453 # Reference: https://www.nirsoft.net/utils/app_crash_view.html 454 # Created by: Joerg Jenderek 455 # Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 456 # %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 457 0 lestring16 Version= 458 >22 lestring16 EventType Windows Error Report 459 !:mime text/plain 460 # Report.wer 461 !:ext wer 462 463 # Summary: Windows 3.1 group files 464 # Extension: .grp 465 # Created by: unknown 466 0 string \120\115\103\103 MS Windows 3.1 group files 467 468 469 # Summary: Old format help files 470 # URL: https://en.wikipedia.org/wiki/WinHelp 471 # Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 472 # Update: Joerg Jenderek 473 # Created by: Dirk Jagdmann <doj (a] cubic.org> 474 # 475 # check and then display version and date inside MS Windows HeLP file fragment 476 0 name help-ver-date 477 # look for Magic of SYSTEMHEADER 478 >0 leshort 0x036C 479 # version Major 1 for right file fragment 480 >>4 leshort 1 Windows 481 # print non empty string above to avoid error message 482 # Warning: Current entry does not yet have a description for adding a MIME type 483 !:mime application/winhelp 484 !:ext hlp 485 # version Minor of help file format is hint for windows version 486 >>>2 leshort 0x0F 3.x 487 >>>2 leshort 0x15 3.0 488 >>>2 leshort 0x21 3.1 489 >>>2 leshort 0x27 x.y 490 >>>2 leshort 0x33 95 491 >>>2 default x y.z 492 >>>>2 leshort x %#x 493 # to complete message string like "MS Windows 3.x help file" 494 >>>2 leshort x help 495 # GenDate often older than file creation date 496 >>>6 ldate x \b, %s 497 # 498 # Magic for HeLP files 499 0 lelong 0x00035f3f 500 # ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 501 # file header magic 0x293B at DirectoryStart+9 502 >(4.l+9) uleshort 0x293B MS 503 # look for @VERSION bmf.. like IBMAVW.ANN 504 >>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 505 !:mime application/x-winhelp 506 !:ext ann 507 >>0xD4 string !\x62\x6D\x66\x01\x00 508 # "GID Help index" by TrID 509 >>>(4.l+0x65) string =|Pete Windows help Global Index 510 !:mime application/x-winhelp 511 !:ext gid 512 # HeLP Bookmark or 513 # "Windows HELP File" by TrID 514 >>>(4.l+0x65) string !|Pete 515 # maybe there exist a cleaner way to detect HeLP fragments 516 # brute search for Magic 0x036C with matching Major maximal 7 iterations 517 # discapp.hlp 518 >>>>16 search/0x49AF/s \x6c\x03 519 >>>>>&0 use help-ver-date 520 >>>>>&4 leshort !1 521 # putty.hlp 522 >>>>>>&0 search/0x69AF/s \x6c\x03 523 >>>>>>>&0 use help-ver-date 524 >>>>>>>&4 leshort !1 525 >>>>>>>>&0 search/0x49AF/s \x6c\x03 526 >>>>>>>>>&0 use help-ver-date 527 >>>>>>>>>&4 leshort !1 528 >>>>>>>>>>&0 search/0x49AF/s \x6c\x03 529 >>>>>>>>>>>&0 use help-ver-date 530 >>>>>>>>>>>&4 leshort !1 531 >>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 532 >>>>>>>>>>>>>&0 use help-ver-date 533 >>>>>>>>>>>>>&4 leshort !1 534 >>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 535 >>>>>>>>>>>>>>>&0 use help-ver-date 536 >>>>>>>>>>>>>>>&4 leshort !1 537 >>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 538 # GCC.HLP is detected after 7 iterations 539 >>>>>>>>>>>>>>>>>&0 use help-ver-date 540 # this only happens if bigger hlp file is detected after used search iterations 541 >>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 542 !:mime application/winhelp 543 !:ext hlp 544 # repeat search again or following default line does not work 545 >>>>16 search/0x49AF/s \x6c\x03 546 # remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 547 >>>>16 default x Windows help Bookmark 548 !:mime application/x-winhelp 549 !:ext bmk 550 ## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 551 ##>>8 lelong x \b, FirstFreeBlock %#8.8x 552 # EntireFileSize 553 >>12 lelong x \b, %d bytes 554 ## ReservedSpace normally 042Fh AFh for *.ANN 555 #>>(4.l) lelong x \b, ReservedSpace %#8.8x 556 ## UsedSpace normally 0426h A6h for *.ANN 557 #>>(4.l+4) lelong x \b, UsedSpace %#8.8x 558 ## FileFlags normally 04... 559 #>>(4.l+5) lelong x \b, FileFlags %#8.8x 560 ## file header magic 0x293B 561 #>>(4.l+9) uleshort x \b, file header magic %#4.4x 562 ## file header Flags 0x0402 563 #>>(4.l+11) uleshort x \b, file header Flags %#4.4x 564 ## file header PageSize 0400h 80h for *.ANN 565 #>>(4.l+13) uleshort x \b, PageSize %#4.4x 566 ## Structure[16] z4 567 #>>(4.l+15) string >\0 \b, Structure_"%-.16s" 568 ## MustBeZero 0 569 #>>(4.l+31) uleshort x \b, MustBeZero %#4.4x 570 ## PageSplits 571 #>>(4.l+33) uleshort x \b, PageSplits %#4.4x 572 ## RootPage 573 #>>(4.l+35) uleshort x \b, RootPage %#4.4x 574 ## MustBeNegOne 0xffff 575 #>>(4.l+37) uleshort x \b, MustBeNegOne %#4.4x 576 ## TotalPages 1 577 #>>(4.l+39) uleshort x \b, TotalPages %#4.4x 578 ## NLevels 0x0001 579 #>>(4.l+41) uleshort x \b, NLevels %#4.4x 580 ## TotalBtreeEntries 581 #>>(4.l+43) ulelong x \b, TotalBtreeEntries %#8.8x 582 ## pages of the B+ tree 583 #>>(4.l+47) ubequad x \b, PageStart %#16.16llx 584 585 # start with colon or semicolon for comment line like Back2Life.cnt 586 0 regex \^(:|;) 587 # look for first keyword Base 588 >0 search/45 :Base 589 >>&0 use cnt-name 590 # only solution to search again from beginning , because relative offsets changes when use is called 591 >0 search/45 :Base 592 >0 default x 593 # look for other keyword Title like in putty.cnt 594 >>0 search/45 :Title 595 >>>&0 use cnt-name 596 # 597 # display mime type and name of Windows help Content source 598 0 name cnt-name 599 # skip space at beginning 600 >0 string \040 601 # name without extension and greater character or name with hlp extension 602 >>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s" 603 !:mime text/plain 604 !:apple ????TEXT 605 !:ext cnt 606 # 607 # Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 608 0 string tfMR MS Windows help Full Text Search index 609 !:mime application/x-winhelp-fts 610 !:ext fts 611 >16 string >\0 for "%s" 612 613 # Summary: Hyper terminal 614 # Created by: unknown 615 # Update: Joerg Jenderek 616 # URL: https://en.wikipedia.org/wiki/HyperACCESS 617 # https://www.hilgraeve.com/hyperterminal/ 618 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/ht.trid.xml 619 # Note: called "HyperTerminal data file" by TrID and "HyperTerminal File" on English Windows 620 0 string HyperTerminal\040 621 >14 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 622 #!:mime application/octet-stream 623 !:mime application/x-ms-ht 624 !:ext ht 625 626 # https://ithreats.files.wordpress.com/2009/05/\040 627 # lnk_the_windows_shortcut_file_format.pdf 628 # Summary: Windows shortcut 629 # Created by: unknown 630 # Update: Joerg Jenderek 631 # URL: http://fileformats.archiveteam.org/wiki/Windows_Shortcut 632 # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/ 633 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lnk-shortcut.trid.xml 634 # https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf 635 # Note: called "Windows Shortcut" by TrID, "Microsoft Windows Shortcut" by DROID via PUID x-fmt/428 and "Windows shortcut file" by ./msdos (v 1.158) 636 # partly verified by command like `lnkinfo AOL.lnk` 637 # 'L' + GUUID 638 # HeaderSize + LinkCLSID 00021401-0000-0000-C000-000000000046 639 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 640 !:mime application/x-ms-shortcut 641 !:ext lnk 642 # LinkFlags 643 # HasLinkTargetIDList; if set a LinkTargetIDList structure MUST follow the ShellLinkHeader; If is not set, structure MUST NOT be present 644 >20 lelong&1 1 \b, Item id list present 645 # HasLinkInfo; if set a LinkInfo structure MUST follow the ShellLinkHeader or LinkTargetIDList; If is not set, structure MUST NOT be present 646 >20 lelong&2 2 \b, Points to a file or directory 647 >20 lelong&4 4 \b, Has Description string 648 >20 lelong&8 8 \b, Has Relative path 649 >20 lelong&16 16 \b, Has Working directory 650 >20 lelong&32 32 \b, Has command line arguments 651 >20 lelong&64 64 \b, Icon 652 # IconIndex 653 >>56 lelong x \b number=%d 654 # IsUnicode; If set then StringData section contains Unicode-encoded strings 655 >20 lelong&128 128 \b, Unicoded 656 # ForceNoLinkInfo; LinkInfo structure is ignored 657 >20 lelong&256 256 \b, NoLinkInfo 658 # HasExpString; with an EnvironmentVariableDataBlock 659 >20 lelong&512 512 \b, HasEnvironment 660 # look for BlockSize 314h and EnvironmentVariableDataBlock BlockSignature A0000001h 661 >>76 search/1972 \x14\x03\x00\x00\x01\x00\x00\xa0 662 # TargetAnsi (260 bytes); NULL-terminated path to environment variable encoded with system default code page 663 #>>>&0 string x '%s' 664 # TargetUnicode (520 bytes): optional NULL-terminated path to same environment variable Unicode encoded 665 # like: "%windir%\system32\calc.exe" 666 >>>&260 lestring16 x "%s" 667 # RunInSeparateProcess; run in a separate virtual machine when launching a 16-bit application; no examples found 668 >20 lelong&1024 1024 \b, RunInSeparateProcess 669 # Unused1; undefined and MUST be ignored 670 #>20 lelong&2048 2048 \b, Unused1 671 # HasDarwinID; with a DarwinDataBlock 672 >20 lelong&4096 4096 \b, HasDarwinID 673 # look for BlockSize 314h and DarwinDataBlock BlockSignature A0000006h 674 >>76 search/1972 \x14\x03\x00\x00\x06\x00\x00\xa0 675 # DarwinDataAnsi (260 bytes); NULL-terminated application identifier encoded with system default code page; SHOULD be ignored 676 #>>>&0 string x '%s' 677 # DarwinDataUnicode (520 bytes); NULL-terminated application identifier Unicode encoded 678 >>>&260 lestring16 x "%s" 679 # RunAsUser; target application is run as a different user 680 >20 lelong&8192 8192 \b, RunAsUser 681 # HasExpIcon; with an IconEnvironmentDataBlock 682 >20 lelong&16384 16384 \b, HasExpIcon 683 # look for BlockSize 314h and IconEnvironmentDataBlock BlockSignature A0000007h 684 >>76 search/1972 \x14\x03\x00\x00\x07\x00\x00\xa0 685 # TargetAnsi (260 bytes); NULL-terminated path to environment icon variable encoded with system default code page 686 #>>>&0 string x '%s' 687 # TargetUnicode (520 bytes); optional NULL-terminated path to same icon environment variable Unicode encoded 688 # like: "%SystemDrive%\Program Files\YaCy\addon\YaCy.ico" 689 >>>&260 lestring16 x "%s" 690 # NoPidlAlias; represented in the shell namespace; no examples found 691 >20 lelong&32768 32768 \b, NoPidlAlias 692 # Unused2; undefined and MUST be ignored 693 #>20 lelong&65536 65536 \b, Unused2 694 # RunWithShimLayer; with a ShimDataBlock; no examples found 695 >20 lelong&131072 131072 \b, RunWithShimLayer 696 # ForceNoLinkTrack; TrackerDataBlock is ignored; no examples found 697 >20 lelong&262144 262144 \b, ForceNoLinkTrack 698 >20 lelong&262144 0 699 # look for BlockSize 60h, TrackerDataBlock BlockSignature A0000003h, it length 58h and Version 0 700 >>76 search/1972 \x60\x00\x00\x00\x03\x00\x00\xa0\x58\x00\x00\x00\0\0\0\0 701 # MachineID (16 bytes); a NULL-terminated NetBIOS name encoded with system default code page of the machine 702 >>>&0 string x \b, MachineID %0.16s 703 # Droid (32 bytes) 704 # 705 # DroidBirth (32 bytes) 706 # 707 # EnableTargetMetadata; collect target properties and store in PropertyStoreDataBlock 708 >20 lelong&524288 524288 \b, EnableTargetMetadata 709 # look for BlockSize >= Ch, PropertyStoreDataBlock BlockSignature A0000009h 710 #>>76 search/1972 \x00\x00\x09\x00\x00\xa0 711 # PropertyStore (variable) 712 # 713 # DisableLinkPathTracking; EnvironmentVariableDataBlock is ignored; no examples found 714 >20 lelong&1048576 1048576 \b, DisableLinkPathTracking 715 # DisableKnownFolderTracking; SpecialFolderDataBlock and KnownFolderDataBlock are ignored and not saved 716 >20 lelong&2097152 2097152 \b, DisableKnownFolderTracking 717 >20 lelong&2097152 0 718 # look for BlockSize 1Ch and KnownFolderDataBlock BlockSignature A000000Bh 719 >>76 search/1972 \x1c\x00\x00\x00\x0B\x00\x00\xa0 720 # https://learn.microsoft.com/en-us/dotnet/desktop/winforms/controls/known-folder-guids-for-file-dialog-custom-places 721 # KnownFolderID specifies the folder GUID ID 722 # ProgramFiles 905E63B6-C1BF-494E-B29C-65B732D3D21A 723 # ProgramFilesX86 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E 724 >>>&0 guid x KnownFolderID %s 725 # DisableKnownFolderAlias; unaliased form of the known folder IDList SHOULD be used; no examples found 726 >20 lelong&4194304 4194304 \b, DisableKnownFolderAlias 727 # AllowLinkToLink; link that references another link is enabled; no examples found 728 >20 lelong&8388608 8388608 \b, AllowLinkToLink 729 # UnaliasOnSave; unaliased form of that known folder or the target IDList SHOULD be used; no examples found 730 >20 lelong&16777216 16777216 \b, UnaliasOnSave 731 # PreferEnvironmentPath; path specified in the EnvironmentVariableDataBlock SHOULD be used 732 >20 lelong&33554432 33554432 \b, PreferEnvironmentPath 733 # KeepLocalIDListForUNCTarget; UNC name SHOULD be stored in local path IDList in PropertyStoreDataBlock; no examples found 734 >20 lelong&67108864 67108864 \b, KeepLocalIDListForUNCTarget 735 # FileAttributes 736 >24 lelong&1 1 \b, Read-Only 737 >24 lelong&2 2 \b, Hidden 738 >24 lelong&4 4 \b, System 739 # Reserved1; MUST be zero 740 >24 lelong&8 8 \b, Reserved1 741 >24 lelong&16 16 \b, Directory 742 >24 lelong&32 32 \b, Archive 743 # Reserved2; MUST be zero 744 >24 lelong&64 64 \b, Reserved2 745 >24 lelong&128 128 \b, Normal 746 >24 lelong&256 256 \b, Temporary 747 # no examples found 748 >24 lelong&512 512 \b, Sparse 749 # no examples found 750 >24 lelong&1024 1024 \b, Reparse point 751 >24 lelong&2048 2048 \b, Compressed 752 >24 lelong&4096 4096 \b, Offline 753 # FILE_ATTRIBUTE_NOT_CONTENT_INDEXED; contents need to be indexed 754 >24 lelong&8192 8192 \b, NeedIndexed 755 # FILE_ATTRIBUTE_ENCRYPTED; file or directory is encrypted 756 >24 lelong&16384 16384 \b, Encrypted 757 # value zero means there is no time set on the target 758 >28 leqwdate !0 \b, ctime=%s 759 # Access time of target in UTC 760 >36 leqwdate !0 \b, atime=%s 761 # write time of target in UTC 762 >44 leqwdate !0 \b, mtime=%s 763 # FileSize; 32 bit size of target in bytes 764 >52 lelong x \b, length=%u, window= 765 # ShowCommand; 1~SW_SHOWNORMAL 3~SW_SHOWMAXIMIZED HerzlichMEDION.lnk 7~SW_SHOWMINNOACTIVE YaCy.lnk Privoxy.lnk; All other values like 2 MUST be treated as SW_SHOWNORMAL 766 #>60 lelong x ShowCommand=%#x 767 >60 lelong x 768 >>60 lelong 3 \bshowmaximized 769 >>60 lelong 7 \bshowminnoactive 770 >>60 default x \bnormal 771 # Hotkey 772 >64 uleshort >0 \b, hot key 773 # 41h~A 42h~B ... 774 >>64 ubyte x %c 775 # modifier keys: 0x01~HOTKEYF_SHIFT 0x02~HOTKEYF_CONTROL 0x04~HOTKEYF_ALT 776 >>65 ubyte&1 1 \b+SHIFT 777 >>65 ubyte&2 2 \b+CONTROL 778 >>65 ubyte&4 4 \b+ALT 779 # Reserved; MUST be zero 780 #>66 uleshort !0 \b, reserved %#x 781 # Reserved2; MUST be zero 782 #>68 ulelong !0 \b, reserved2 %#x 783 # Reserved3; MUST be zero 784 #>72 ulelong !0 \b, reserved3 %#x 785 # optional LINKTARGET_IDLIST if LinkFlags bit HasLinkTargetIDList is set 786 >20 lelong&1 1 787 # IDListSize; size of IDList 788 >>76 uleshort x \b, IDListSize %#4.4x 789 # 1st item 790 >>78 use lnk-item 791 # 2nd possible item 792 >>(78.s+78) uleshort >0 793 >>>(78.s+78) use lnk-item 794 # 3rd possible item 795 >>>&(&-2.s-2) uleshort >0 796 >>>>&-2 use lnk-item 797 # 4th possible item 798 >>>>&(&-2.s-2) uleshort >0 799 >>>>>&-2 use lnk-item 800 # Because HasLinkInfo is set, a LinkInfo structure follows 801 >20 lelong&2 2 802 # if no LINKTARGET_IDLIST (no HasLinkTargetIDList) then direct after header; no example found 803 >>20 lelong&1 =0 804 >>>76 use lnk-info 805 # if LINKTARGET_IDLIST (HasLinkTargetIDList) then after LINKTARGET_IDLIST by addtional IDListSize bytes 806 >>20 lelong&1 =1 807 >>>76 uleshort >0 808 #>>>>(76.s+78) use lnk-info 809 >>>>(76.s+78) ubelong x 810 # move pointer to beginnig of LinkInfo structure 811 >>>>>&-8 ubelong x 812 #>>>>>>&16 ulelong x \b, LocalBasePathOffset=%#8.8x 813 >>>>>>&(&16.l) string x \b, LocalBasePath "%s" 814 # check and then display link item (size,data) 815 0 name lnk-item 816 # size value 0x0000 means TerminalID; indicates the end of the item IDs list 817 >0 uleshort >0 818 #>>0 uleshort x \b, ItemIDSize %#4.4x 819 # item Data 820 #>>2 ubequad x \b, Item data=%#16.16llx 821 #>>2 ubyte x \b, Item type=%#x 822 >>2 ubyte =0x1f \b, Root folder 823 # like: "26EE0668-A00A-44D7-9371-BEB064C98683" Control Panel 824 # "20D04FE0-3AEA-1069-A2D8-08002B30309D" My Computer 825 # "871C5380-42A0-1069-A2EA-08002B30309D" Internet Explorer 826 >>>4 guid x "%s" 827 >>2 ubyte =0x2f \b, Volume 828 # like: "C:\" "D:\" 829 >>>3 string x "%s" 830 # Control panel category 831 #>>2 ubyte foo \b, Control panel category 832 # display LinkInfo structure (size,flags,offsets) 833 0 name lnk-info 834 # LinkInfoSize; size of the LinkInfo structure 835 >0 ulelong x \b, LinkInfoSize %#x 836 # LinkInfoHeaderSize; if 1C no optional fields; >=24 optional fields are specified 837 >4 ulelong x \b, LinkInfoHeaderSize %#x 838 # LinkInfoFlags; 839 #>8 ulelong x \b, LinkInfoFlags=%#x 840 >8 ulelong&1 1 \b, VolumeIDAndLocalBasePath 841 # VolumeIDOffset; location of the VolumeID field (VolumeIDSize DriveType DriveSerialNumber VolumeLabelOffset ... ) inside LinkInfo structure 842 >>12 ulelong x \b, VolumeIDOffset %#x 843 # LocalBasePathOffset; location of LocalBasePath field like "C:\test\a.txt" inside LinkInfo structure 844 >>16 ulelong x \b, LocalBasePathOffset %#x 845 # LocalBasePathOffsetUnicode; location of the LocalBasePathUnicode field inside LinkInfo structure 846 >>4 ulelong >23 847 >>>28 ulelong x \b, LocalBasePathOffsetUnicode %#x 848 >8 ulelong&2 2 \b, CommonNetworkRelativeLinkAndPathSuffix 849 # CommonNetworkRelativeLinkOffset; location of the CommonNetworkRelativeLink field inside LinkInfo structure 850 >>20 ulelong x \b, CommonNetworkRelativeLinkOffset %#x 851 # CommonPathSuffixOffset; location of CommonPathSuffix field 852 >24 ulelong x \b, CommonPathSuffixOffset %#x 853 # CommonPathSuffixOffsetUnicode; location of CommonPathSuffixUnicode field inside LinkInfo structure 854 >4 ulelong >23 855 >>32 ulelong x \b, CommonPathSuffixOffsetUnicode %#x 856 857 # Summary: Outlook Personal Folders 858 # Created by: unknown 859 # Update: Joerg Jenderek 860 # URL: http://fileformats.archiveteam.org/wiki/Personal_Folder_File 861 # https://en.wikipedia.org/wiki/Personal_Storage_Table 862 # Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf 863 # http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 864 # dwMagic !BDN 865 0 lelong 0x4E444221 866 # skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-261.pst 867 # by check for existance of bPlatformCreate value 868 >14 ubyte x Microsoft Outlook 869 #!:mime application/octet-stream 870 # NOT official registered ! 871 !:mime application/vnd.ms-outlook 872 # dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit 873 #>>4 ulelong !0 \b, CRC %#x 874 # wMagicClient; AB (4142h) is used for PAB files; SM (534Dh) is used for PST files; SO (534Fh) is used for OST files 875 #>>8 leshort x \b, wMagicClient=%#x 876 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 877 # Note: called "Microsoft Personal Address Book" by TrID and 878 # "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75 879 >>8 leshort 0x4142 Personal Address Book 880 #!:mime application/x-ms-pab 881 !:ext pab 882 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst.trid.xml 883 # http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml 884 # Note: called "Microsoft OutLook Personal Folder" by TrID and 885 # by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode 886 #>>8 leshort 0x4D53 \b, PST~ 887 # called "Microsoft Outlook email folder" in ./windows version 1.37 and older 888 >>8 leshort 0x4D53 Personal Storage 889 #!:mime application/x-ms-pst 890 !:ext pst 891 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/ost.trid.xml 892 # Note: called "Outlook Exchange Offline Storage" by TrID 893 >>8 leshort 0x4F53 Offline Storage 894 #!:mime application/x-ms-ost 895 !:ext ost 896 # wVer; file format version. 14 or 15 if the file is ANSI; > 21 or 23(=17h) if Unicode; 37 for written by Outlook with WIP 897 >>10 uleshort x ( 898 # probably NO intermediate versions exist 899 >>10 leshort <0x10 \b<=2002, ANSI, 900 >>10 leshort >0x14 \b>=2003, Unicode, 901 >>10 uleshort x version %u) 902 # wVerClient; client file format version like: 19 22 903 #>>12 uleshort x \b, wVerClient=%u 904 # bPlatformCreate; This value MUST be set to 1 but also found 2 905 >>14 ubyte >1 \b, bPlatformCreate=%u 906 # bPlatformAccess; This value MUST be set to 1 but also found 2 907 >>15 ubyte >1 \b, bPlatformAccess=%u 908 # dwReserved1; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 909 >>16 ulelong !0 \b, dwReserved1=%#x 910 # dwReserved2; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 911 >>20 ulelong !0 \b, dwReserved2=%#x 912 # ANSI 32-bit variant Outlook 1997-2002 913 >>10 uleshort <16 914 # bidNextB; next BlockID (ANSI 4 bytes) 915 #>>>24 ulelong !0 \b, bidNextB=%#x 916 # bidNextP; Next available back BlockID pointer 917 #>>>28 ulelong !0 \b, bidNextP=%#x 918 # dwUnique; value monotonically increased when modifying PST; so CRC is changing 919 >>>32 ulelong !0 \b, dwUnique=%#x 920 # rgnid[128]; A fixed array of 32 NodeIDs, each corresponding to one of the 32 possible NID_TYPEs 921 #>>>36 ubequad x \b, rgnid=%#llx... 922 # dwReserved; Implementations SHOULD ignore this value and SHOULD NOT modify it; Initialized zero 923 >>>164 ulelong !0 \b, dwReserved=%#x 924 # ibFileEof; the size of the PST file, in bytes (ANSI 4 bytes) 925 >>>168 ulelong x \b, %u bytes 926 # ibAMapLast; offset to the last AMap page 927 #>>>172 ulelong x \b, ibAMapLast=%#x 928 # bSentinel; MUST be set to 0x80 929 >>>460 ubyte !0x80 \b, bSentinel=%#x 930 # bCryptMethod: 0~No encryption 1~encryption with permutation 2~encryption with cyclic 16~encryption with Windows Information Protection (WIP) 931 >>>461 ubyte >0 \b, bCryptMethod=%u 932 # UNICODE 64-bit variant Outlook 2003-2007 933 >>10 uleshort >20 934 # bidUnused; Unused 8 bytes padding (Unicode only); sometimes like: 0x0000000100000004 935 >>>24 ulequad !0x0000000100000004 \b, bidUnused=%#16.16llx 936 # dwUnique; value monotonically increased when modifying PST; so CRC is changing 937 >>>40 ulelong !0 \b, dwUnique=%#x 938 # rgnid[] (128 bytes): A fixed array of 32 NIDs, each corresponding to one of the 32 possible 939 #>>>44 ubequad x \b, rgnid=%#llx... 940 # ibFileEof; the size of the PST file, in bytes (Unicode 8 bytes) 941 >>>184 ulequad x \b, %llu bytes 942 # bSentinel; MUST be set to 0x80 943 >>>512 ubyte !0x80 \b, bSentinel=%#x 944 # bCryptMethod; Encryption type like: 0 1 2 16 945 >>>513 ubyte >0 \b, bCryptMethod=%u 946 # dwCRC; 32-bit CRC of the of the previous 516 bytes 947 >>>524 ulelong x \b, CRC32 %#x 948 949 950 # Summary: Windows help cache 951 # Created by: unknown 952 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 953 954 955 # Summary: IE cache file 956 # Created by: Christophe Monniez 957 0 string Client\ UrlCache\ MMF Internet Explorer cache file 958 >20 string >\0 version %s 959 960 961 # Summary: Registry files 962 # Created by: unknown 963 # Modified by (1): Joerg Jenderek 964 0 string regf MS Windows registry file, NT/2000 or above 965 0 string CREG MS Windows 95/98/ME registry file 966 0 string SHCC3 MS Windows 3.1 registry file 967 968 969 # Summary: Windows Registry text 970 # URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 971 # Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 972 # Submitted by: Abel Cheung <abelcheung (a] gmail.com> 973 # Update: Joerg Jenderek 974 # Windows 3-9X variant 975 0 string REGEDIT 976 # skip ASCII text like "REGEDITor.txt" but match 977 # L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 978 >7 search/3 \n Windows Registry text 979 !:mime text/x-ms-regedit 980 !:ext reg 981 # Windows 9X variant 982 >>0 string REGEDIT4 (Win95 or above) 983 # Windows 2K ANSI variant 984 0 string Windows\ Registry\ Editor\ 985 >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 986 !:mime text/x-ms-regedit 987 !:ext reg 988 # Windows 2K UTF-16 variant 989 2 lestring16 Windows\ Registry\ Editor\ 990 >0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 991 # relative offset not working 992 #>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 993 !:mime text/x-ms-regedit 994 !:ext reg 995 # WINE variant 996 # URL: https://en.wikipedia.org/wiki/Wine_(software) 997 # Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 998 # Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 999 # instead binary hiv structure like Windows 1000 0 string WINE\ REGISTRY\ Version\ WINE registry text 1001 # version 2 1002 >&0 string x \b, version %s 1003 !:mime text/x-wine-extension-reg 1004 !:ext reg 1005 1006 # Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 1007 # empty ,comment , section 1008 # PR/383: remove unicode BOM because it is not portable across regex impls 1009 #0 regex/s \\`(\\r\\n|;|[[]) 1010 # empty line CRLF 1011 0 ubeshort 0x0D0A 1012 >0 use ini-file 1013 # comment line starting with semicolon 1014 0 string ; 1015 # look for phrase of Windows policy ADMinistrative template (with starting remark) 1016 # like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm 1017 >1 search/3548 END\040CATEGORY 1018 # ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant 1019 # if no Windows policy ADMinistrative template then Windows INItialization 1020 >1 default x 1021 >>0 use ini-file 1022 # section line starting with left bracket 1023 0 string [ 1024 >0 use ini-file 1025 # check and then display Windows INItialization configuration 1026 0 name ini-file 1027 # look for left bracket in section line 1028 >0 search/8192 [ 1029 # https://en.wikipedia.org/wiki/Autorun.inf 1030 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 1031 # space after right bracket 1032 # or AutoRun.Amd64 for 64 bit systems 1033 # or only NL separator 1034 >>&0 regex/c \^autorun 1035 # but sometimes total commander directory tree file "treeinfo.wc" with lines like 1036 # [AUTORUN] 1037 # [boot] 1038 >>>&0 string =]\r\n[ Total commander directory treeinfo.wc 1039 !:mime text/plain 1040 !:ext wc 1041 # From: Pal Tamas <folti (a] balabit.hu> 1042 # Autorun File 1043 >>>&0 string !]\r\n[ Microsoft Windows Autorun file 1044 !:mime application/x-setupscript 1045 !:ext inf 1046 # https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 1047 # version strings ASCII coded case-independent for Windows setup information script file 1048 >>&0 regex/c \^(version|strings)] Windows setup INFormation 1049 !:mime application/x-setupscript 1050 #!:mime application/x-wine-extension-inf 1051 !:ext inf 1052 # NETCRC.INF OEMCPL.INF 1053 >>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 1054 !:mime application/x-setupscript 1055 !:ext inf 1056 # http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 1057 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 1058 # .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 1059 >>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 1060 !:mime application/x-wine-extension-ini 1061 #!:mime text/plain 1062 # https://support.microsoft.com/kb/84709/ 1063 >>&0 regex/c \^don't\ load] Windows CONTROL.INI 1064 !:mime application/x-wine-extension-ini 1065 !:ext ini 1066 >>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 1067 !:mime application/x-wine-extension-ini 1068 !:ext ini 1069 # https://technet.microsoft.com/en-us/library/cc722567.aspx 1070 # http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 1071 >>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 1072 !:mime application/x-wine-extension-ini 1073 !:ext ini 1074 # https://en.wikipedia.org/wiki/SYSTEM.INI 1075 >>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 1076 !:mime application/x-wine-extension-ini 1077 !:ext ini 1078 # http://www.mdgx.com/newtip6.htm 1079 >>&0 regex/c \^SafeList] Windows IOS.INI 1080 !:mime application/x-wine-extension-ini 1081 !:ext ini 1082 # https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 1083 >>&0 regex/c \^boot\x20loader] Windows boot.ini 1084 !:mime application/x-wine-extension-ini 1085 !:ext ini 1086 # https://en.wikipedia.org/wiki/CONFIG.SYS 1087 >>&0 regex/c \^menu] MS-DOS CONFIG.SYS 1088 # @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 1089 # CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 1090 # CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 1091 # dos and w40 used in dual booting scene 1092 !:ext sys/dos/w40 1093 # https://support.microsoft.com/kb/118579/ 1094 >>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS 1095 !:ext sys/dos 1096 # http://chmspec.nongnu.org/latest/INI.html#HHP 1097 >>&0 regex/c \^options]\r\n Microsoft HTML Help Project 1098 !:mime text/plain 1099 !:ext hhp 1100 # From: Joerg Jenderek 1101 # URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm 1102 # Reference: https://www.garykessler.net/library/file_sigs.html 1103 # http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml 1104 # Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 1105 # second word often Latin but sometimes Cyrillic like in 12510866.CPX 1106 >>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator 1107 #!:mime text/plain 1108 !:mime text/x-ms-cpx 1109 # like: 12510866.CPX 1110 !:ext cpx 1111 # From: Joerg Jenderek 1112 # URL: https://en.wikipedia.org/wiki/File_Explorer 1113 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml 1114 # Note: called "Windows Explorer Command Shell File" by TrID and "File Explorer Command" by Windows via SHCmdFile 1115 >>&0 regex/c \^Shell]\r\n Windows Explorer Shell Command File 1116 #!:mime text/plain 1117 !:mime text/x-ms-scf 1118 # like: channels.scf desktop.scf explorer.scf "Desktop anzeigen.scf" 1119 !:ext scf 1120 # look for icon file directive maybe pointing to malicious file 1121 >>>1 search/128 IconFile= \b, icon 1122 >>>>&0 string x "%s" 1123 # From: Joerg Jenderek 1124 # URL: http://en.wikipedia.org/wiki/VIA_Technologies 1125 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml 1126 # Note: called "VIA setup configuration file" by TrID 1127 >>&0 regex/c \^SCF]\r\n VIA setup configuration 1128 #!:mime text/plain 1129 !:mime text/x-via-scf 1130 # like: SETUP.SCF 1131 !:ext scf 1132 # From: Joerg Jenderek 1133 # URL: https://en.wikipedia.org/wiki/InstallShield 1134 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml 1135 # Note: contain also 3 keywords like: count Default key0 1136 >>&0 regex/c \^Languages] InstallShield Language Identifier 1137 #!:mime text/plain 1138 !:mime text/x-installshield-lid 1139 # like: SETUP.LID 1140 !:ext lid 1141 # From: Joerg Jenderek 1142 # URL: https://www.file-extensions.org/tag-file-extension 1143 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml 1144 # Note: contain also keywords like: Application Category Company Misc Version 1145 >>&0 regex/c \^TagInfo] TagInfo 1146 #!:mime text/plain 1147 #!:mime text/prs.lines.tag 1148 !:mime text/x-ms-tag 1149 # like: DATA.TAG 1150 !:ext tag 1151 # URL: https://en.wikipedia.org/wiki/Flatpak 1152 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/flatpakref.trid.xml 1153 # Note: called "Flatpack Reference" by TrID 1154 >>&0 string Flatpak\ Ref] Flatpak repository reference 1155 #!:mime text/plain 1156 # https://reposcope.com/mimetype/application/vnd.flatpak.ref 1157 !:mime application/vnd.flatpak.ref 1158 !:ext flatpakref 1159 # From: Joerg Jenderek 1160 # URL: https://en.wikipedia.org/wiki/CloneCD 1161 # Reference: https://en.wikipedia.org/wiki/CloneCD_Control_File 1162 # http://mark0.net/download/triddefs_xml.7z/defs/c/cdimage-clonecd-cue.trid.xml 1163 # Note: called "CloneCD CDImage (description)" by TrID and "CloneCD Control File" by DROID via PUID fmt/1760 1164 >>&0 string CloneCD] CloneCD CD-image Description 1165 #!:mime text/plain 1166 !:mime text/x-ccd 1167 !:ext ccd 1168 # unknown keyword after opening bracket 1169 >>&0 default x 1170 #>>>&0 string/c x UNKNOWN [%s 1171 # look for left bracket of second section 1172 >>>&0 search/8192 [ 1173 # version Strings FileIdentification 1174 >>>>&0 string/c version Windows setup INFormation 1175 !:mime application/x-setupscript 1176 !:ext inf 1177 # From: Joerg Jenderek 1178 # URL: https://cdrtfe.sourceforge.io/ 1179 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cfp-cdrtfe.trid.xml 1180 >>>>&0 string FileExplorer] cdrtfe Project 1181 !:mime text/x-cfp 1182 !:ext cfp 1183 # https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 1184 >>>>&0 default x 1185 >>>>>&0 ubyte x 1186 # characters, digits, underscore and white space followed by right bracket 1187 # terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 1188 >>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 1189 # NETDEF.INF multiarc.ini 1190 #!:mime application/x-setupscript 1191 !:mime application/x-wine-extension-ini 1192 #!:mime text/plain 1193 !:ext ini/inf 1194 # samples with only 1 and unknown section name 1195 # XXX: matches a file containing '[1] 2' 1196 #>>>&0 default x Generic INItialization configuration 1197 #>>>>0 string x \b, 1st line "%s" 1198 # UTF-16 BOM 1199 0 ubeshort =0xFFFE 1200 # look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml) 1201 # like: wuau.adm 1202 >2 search/0x384A E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0 1203 >>0 use windows-adm 1204 # if no Windows policy ADMinistrative template then Windows INFormation 1205 >2 default x 1206 # UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 1207 >>0 ubelong&0xFFff89FF =0xFFFE0900 1208 # look for left bracket in section line 1209 >>>2 search/8192 [ 1210 # keyword without 1st letter which is maybe up-/down-case 1211 >>>>&3 lestring16 ersion] Windows setup INFormation 1212 !:mime application/x-setupscript 1213 # like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf 1214 !:ext inf 1215 >>>>&3 lestring16 trings] Windows setup INFormation 1216 !:mime application/x-setupscript 1217 # like: arduino_gemma.inf iis.inf MSM8960.inf 1218 !:ext inf 1219 >>>>&3 lestring16 ourceDisksNames] Windows setup INFormation 1220 !:mime application/x-setupscript 1221 # like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf 1222 !:ext inf 1223 # netnwcli.inf start with ;---[ NetNWCli.INX ] 1224 >>>>&3 default x 1225 # look for NL followed by left bracket 1226 >>>>>&0 search/8192 \x0A\x00\x5b 1227 # like: defltwk.inf netvwifibus.inf WSDPrint.inf 1228 >>>>>>&3 lestring16 ersion] Windows setup INFormation 1229 !:mime application/x-setupscript 1230 !:ext inf 1231 1232 # Summary: Windows Policy ADMinistrative template 1233 # From: Joerg Jenderek 1234 # URL: https://en.wikipedia.org/wiki/Administrative_Template 1235 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml 1236 # Note: typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM 1237 # worst case ASCII variant starting with remark line like: inetset.adm 1238 0 search/0x4E CLASS\040 1239 >&0 string MACHINE 1240 >>0 use windows-adm 1241 >&0 string USER 1242 >>0 use windows-adm 1243 # display information about Windows policy ADMinistrative template 1244 0 name windows-adm Windows Policy Administrative Template 1245 !:mime text/x-ms-adm 1246 !:ext adm 1247 # UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml) 1248 >0 ubeshort =0xFFFE 1249 >>2 lestring16 x \b, 1st line "%s" 1250 # look for UTF-16 encoded CarriageReturn LineFeed 1251 >>>2 search/0x3A \r\0\n\0 1252 >>>>&0 lestring16 x \b, 2nd line "%s" 1253 # no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml) 1254 >0 ubeshort !0xFFFE 1255 >>0 string x \b, 1st line "%s" 1256 #>>>&0 ubequad x \b, 2ND %16.16llx 1257 # 2nd line empty 1258 >>>&2 beshort =0x0D0A 1259 >>>>&0 beshort !0x0D0A \b, 3th line 1260 >>>>>&-2 string x "%s" 1261 # 2nd line with content 1262 >>>&2 beshort !0x0D0A \b, 2nd line 1263 >>>>&-2 string x "%s" 1264 1265 # Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 1266 # http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 1267 # URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 1268 # Reference: http://en.verysource.com/code/10350344_1/inf.h.html 1269 # Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 1270 # check for valid major and minor versions: 101h - 303h 1271 0 leshort&0xFcFc =0x0000 1272 # GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 1273 >0 leshort&0x0303 !0x0000 1274 # test for valid InfStyles: 1 2 1275 >>2 uleshort >0 1276 >>>2 uleshort <3 1277 # look for colon in WinDirPath after PNF header 1278 #>>>>0x59 search/18 : 1279 # skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some 1280 # Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low section name" \0 1281 >>>>(20.l) ubelong >0x40004000 1282 >>>>>0 use PreCompiledInf 1283 0 name PreCompiledInf 1284 >0 uleshort x Windows Precompiled iNF 1285 !:mime application/x-pnf 1286 !:ext pnf 1287 # major version 1 for older Windows like XP and 3 since about Windows Vista 1288 # 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11 1289 >1 ubyte x \b, version %u 1290 >0 ubyte x \b.%u 1291 >0 uleshort =0x0101 (Windows 1292 >>4 ulelong&0x00000001 !0x00000001 95-98) 1293 >>4 ulelong&0x00000001 =0x00000001 XP) 1294 >0 uleshort =0x0301 (Windows Vista-8.1) 1295 >0 uleshort =0x0302 (Windows 10 older) 1296 >0 uleshort =0x0303 (Windows 10-11) 1297 # 1 ,2 (windows 98 SE) 1298 >2 uleshort !2 \b, InfStyle %u 1299 # PNF_FLAG_IS_UNICODE 0x00000001 1300 # PNF_FLAG_HAS_STRINGS 0x00000002 1301 # PNF_FLAG_SRCPATH_IS_URL 0x00000004 1302 # PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 1303 # PNF_FLAG_INF_VERIFIED 0x00000010 1304 # PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 1305 # UNKNOWN8 0x00000080 1306 # UNKNOWN 0x00000100 1307 # UNKNOWN1 0x01000000 1308 # UNKNOWN2 0x02000000 1309 >4 ulelong&0x03000180 >0 \b, flags 1310 >>4 ulelong x %#x 1311 >4 ulelong&0x00000001 0x00000001 \b, unicoded 1312 >4 ulelong&0x00000002 0x00000002 \b, has strings 1313 >4 ulelong&0x00000004 0x00000004 \b, src URL 1314 >4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 1315 >4 ulelong&0x00000010 0x00000010 \b, verified 1316 >4 ulelong&0x00000020 0x00000020 \b, digitally signed 1317 # >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 1318 # >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 1319 # >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 1320 # >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 1321 #>8 ulelong x \b, InfSubstValueListOffset %#x 1322 # many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 1323 # , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 1324 #>12 uleshort x \b, InfSubstValueCount %#x 1325 # only < 9 found: 8 hcw85b64.PNF 1326 #>14 uleshort x \b, InfVersionDatumCount %#x 1327 # only found values lower 0x0000ffff ?? 1328 #>16 ulelong x \b, InfVersionDataSize %#x 1329 # only found positive values lower 0x00ffFFff for InfVersionDataOffset 1330 >20 ulelong x \b, at %#x 1331 >4 ulelong&0x00000001 =0x00000001 1332 # case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 1333 >>(20.l) lestring16 x "%s" 1334 >4 ulelong&0x00000001 !0x00000001 1335 >>(20.l) string x "%s" 1336 # FILETIME is number of 100-nanosecond intervals since 1 January 1601 1337 #>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 1338 >24 qwdate x \b, InfVersionLastWriteTime %s 1339 # for Windows 98, XP 1340 >0 uleshort <0x0102 1341 # only found values lower 0x00ffFFff 1342 # often 70 but also 78h for corelist.PNF 1343 # >>32 ulelong x \b, StringTableBlockOffset %#x 1344 # >>36 ulelong x \b, StringTableBlockSize %#x 1345 # >>40 ulelong x \b, InfSectionCount %#x 1346 # >>44 ulelong x \b, InfSectionBlockOffset %#x 1347 # >>48 ulelong x \b, InfSectionBlockSize %#x 1348 # >>52 ulelong x \b, InfLineBlockOffset %#x 1349 # >>56 ulelong x \b, InfLineBlockSize %#x 1350 # >>60 ulelong x \b, InfValueBlockOffset %#x 1351 # >>64 ulelong x \b, InfValueBlockSize %#x 1352 # WinDirPathOffset 1353 # like 58h, which means direct after PNF header 1354 #>>68 ulelong x \b, at %#x 1355 >>68 ulelong x 1356 >>>4 ulelong&0x00000001 =0x00000001 1357 #>>>>(68.l) ubequad =0x43003a005c005700 1358 # normally unicoded C:\Windows 1359 #>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1360 >>>>(68.l) ubequad !0x43003a005c005700 1361 >>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1362 >>>4 ulelong&0x00000001 !0x00000001 1363 # normally ASCII C:\WINDOWS 1364 #>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 1365 >>>>(68.l) string !C:\\WINDOWS 1366 >>>>>(68.l) string x \b, WinDirPath "%s" 1367 # found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 1368 >>>72 ulelong >0 \b, 1369 >>>>4 ulelong&0x00000001 =0x00000001 1370 >>>>>(72.l) lestring16 x OsLoaderPath "%s" 1371 >>>>4 ulelong&0x00000001 !0x00000001 1372 # seldom C:\ instead empty 1373 >>>>>(72.l) string x OsLoaderPath "%s" 1374 # 1fdh 1375 #>>>76 uleshort x \b, StringTableHashBucketCount %#x 1376 # https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 1377 # only 407h found 1378 >>>78 uleshort !0x409 \b, LanguageID %x 1379 #>>>78 uleshort =0x409 \b, LanguageID %x 1380 # InfSourcePathOffset often 0 1381 >>>80 ulelong >0 \b, at %#x 1382 >>>>4 ulelong&0x00000001 =0x00000001 1383 >>>>>(80.l) lestring16 x SourcePath "%s" 1384 >>>>4 ulelong&0x00000001 !0x00000001 1385 >>>>>(80.l) string >\0 SourcePath "%s" 1386 # OriginalInfNameOffset often 0 1387 >>>84 ulelong >0 \b, at %#x 1388 >>>>4 ulelong&0x00000001 =0x00000001 1389 >>>>>(84.l) lestring16 x InfName "%s" 1390 >>>>4 ulelong&0x00000001 !0x00000001 1391 >>>>>(84.l) string >\0 InfName "%s" 1392 1393 # for newer Windows like Vista, 7 , 8.1 , 10 1394 >0 uleshort >0x0101 1395 >>80 ulelong x \b, at %#x WinDirPath 1396 >>>4 ulelong&0x00000001 0x00000001 1397 # normally unicoded C:\Windows 1398 #>>>>(80.l) ubequad =0x43003a005c005700 1399 #>>>>>(80.l) lestring16 x "%s" 1400 >>>>(80.l) ubequad !0x43003a005c005700 1401 >>>>>(80.l) lestring16 x "%s" 1402 # language id: 0 407h~german 409h~English_US 1403 >>90 uleshort !0x409 \b, LanguageID %x 1404 #>>90 uleshort =0x409 \b, LanguageID %x 1405 >>92 ulelong >0 \b, at %#x 1406 >>>4 ulelong&0x00000001 0x00000001 1407 # language string like: de-DE en-US 1408 >>>>(92.l) lestring16 x language %s 1409 1410 # Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 1411 # Extension: .bkf 1412 # Created by: Joerg Jenderek 1413 # URL: https://en.wikipedia.org/wiki/NTBackup 1414 # Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 1415 # Descriptor BloCK name of Microsoft Tape Format 1416 0 string TAPE 1417 # Format Logical Address is zero 1418 >20 ulequad 0 1419 # Reserved for MBC is zero 1420 >>28 uleshort 0 1421 # Control Block ID is zero 1422 >>>36 ulelong 0 1423 # BIT4-BIT15, BIT18-BIT31 of block attributes are unused 1424 >>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 1425 #!:mime application/x-ntbackup 1426 !:ext bkf 1427 # OS ID 1428 >>>>>10 ubyte 1 \b NetWare 1429 >>>>>10 ubyte 13 \b NetWare SMS 1430 >>>>>10 ubyte 14 \b NT 1431 >>>>>10 ubyte 24 \b 3 1432 >>>>>10 ubyte 25 \b OS/2 1433 >>>>>10 ubyte 26 \b 95 1434 >>>>>10 ubyte 27 \b Macintosh 1435 >>>>>10 ubyte 28 \b UNIX 1436 # OS Version (2) 1437 #>>>>>11 ubyte x OS V=%x 1438 # MTF_CONTINUATION Media Sequence Number > 1 1439 #>>>>>4 ulelong&0x00000001 !0 \b, continued 1440 # MTF_COMPRESSION 1441 >>>>>4 ulelong&0x00000004 !0 \b, compressed 1442 # MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 1443 >>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 1444 >>>>>4 ulelong&0x00020000 0 1445 # MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 1446 >>>>>>4 ulelong&0x00010000 !0 \b, with catalog 1447 # MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 1448 >>>>>4 ulelong&0x00020000 !0 \b, with file catalog 1449 # Offset To First Event 238h,240h,28Ch 1450 #>>>>>8 uleshort x \b, event offset %4.4x 1451 # Displayable Size (20e0230h 20e024ch 20e0224h) 1452 #>>>>>8 ulequad x dis. size %16.16llx 1453 # Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 1454 #>>>>>52 ulelong x family ID %8.8x 1455 # TAPE Attributes (3) 1456 #>>>>>56 ulelong x TAPE %8.8x 1457 # Media Sequence Number 1458 >>>>>60 uleshort >1 \b, sequence %u 1459 # Password Encryption Algorithm (3) 1460 >>>>>62 uleshort >0 \b, %#x encrypted 1461 # Soft Filemark Block Size * 512 (2) 1462 #>>>>>64 uleshort =2 \b, soft size %u*512 1463 >>>>>64 uleshort !2 \b, soft size %u*512 1464 # Media Based Catalog Type (1,2) 1465 #>>>>>66 uleshort x \b, catalog type %4.4x 1466 # size of Media Name (66,68,6Eh) 1467 >>>>>68 uleshort >0 1468 # offset of Media Name (5Eh) 1469 >>>>>>70 uleshort >0 1470 # 0~, 1~ANSI, 2~UNICODE 1471 >>>>>>>48 ubyte 1 1472 # size terminated ansi coded string normally followed by "MTF Media Label" 1473 >>>>>>>>(70.s) string >\0 \b, name: %s 1474 >>>>>>>48 ubyte 2 1475 # Not null, but size terminated unicoded string 1476 >>>>>>>>(70.s) lestring16 x \b, name: %s 1477 # size of Media Label (104h) 1478 >>>>>72 uleshort >0 1479 # offset of Media Label (C4h,C6h,CCh) 1480 >>>>>74 uleshort >0 1481 >>>>>>48 ubyte 1 1482 #Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 1483 >>>>>>>(74.s) string >\0 \b, label: %s 1484 >>>>>>48 ubyte 2 1485 >>>>>>>(74.s) lestring16 x \b, label: %s 1486 # size of password name (0,1Ch) 1487 #>>>>>76 uleshort >0 \b, password size %4.4x 1488 # Software Vendor ID (CBEh) 1489 >>>>>86 uleshort x \b, software (%#x) 1490 # size of Software Name (6Eh) 1491 >>>>>80 uleshort >0 1492 # offset of Software Name (1C8h,1CAh,1D0h) 1493 >>>>>>82 uleshort >0 1494 # 1~ANSI, 2~UNICODE 1495 >>>>>>>48 ubyte 1 1496 >>>>>>>>(82.s) string >\0 \b: %s 1497 >>>>>>>48 ubyte 2 1498 # size terminated unicoded coded string normally followed by "SPAD" 1499 >>>>>>>>(82.s) lestring16 x \b: %s 1500 # Format Logical Block Size (512,1024) 1501 #>>>>>84 uleshort =1024 \b, block size %u 1502 >>>>>84 uleshort !1024 \b, block size %u 1503 # Media Date of MTF_DATE_TIME type with 5 bytes 1504 #>>>>>>88 ubequad x DATE %16.16llx 1505 # MTF Major Version (1) 1506 #>>>>>>93 ubyte x \b, MFT version %x 1507 # 1508 1509 # URL: https://en.wikipedia.org/wiki/PaintShop_Pro 1510 # Reference: https://www.cryer.co.uk/file-types/p/pal.htm 1511 # Created by: Joerg Jenderek 1512 # Note: there exist other color palette formats also with .pal extension 1513 0 string JASC-PAL\r\n PaintShop Pro color palette 1514 #!:mime text/plain 1515 # PspPalette extension is used by newer (probably 8) PaintShopPro versions 1516 !:ext pal/PspPalette 1517 # 2nd line contains palette file version. For example "0100" 1518 >10 string !0100 \b, version %.4s 1519 # third line contains the number of colours: 16 256 ... 1520 >16 string x \b, %.3s colors 1521 1522 # URL: https://en.wikipedia.org/wiki/Innosetup 1523 # Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 1524 # Created by: Joerg Jenderek 1525 # Note: created by like "InnoSetup self-extracting archive" inside ./msdos 1526 # TrID labeles the entry as "Inno Setup Uninstall Log" 1527 # TUninstallLogID 1528 0 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 1529 !:mime application/x-innosetup 1530 # unins000.dat, unins001.dat, ... 1531 !:ext dat 1532 # " 64-bit" variant 1533 >0x1c string >\0 \b%.7s 1534 # AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 1535 >0xc0 string x %s 1536 # AppId[0x80] is similar to AppName or 1537 # GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 1538 >0x40 ubyte 0x7b 1539 >>0x40 string x %-.38s 1540 # do not know how this log version correlates to program version 1541 >0x140 ulelong x \b, version %#x 1542 # NumRecs 1543 #>0x144 ulelong x \b, %#4.4x records 1544 # EndOffset means files size 1545 >0x148 ulelong x \b, %u bytes 1546 # Flags 5 25h 35h 1547 #>0x14c ulelong x \b, flags %8.8x 1548 # Reserved: array[0..26] of Longint 1549 # the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 1550 >0x140 ulelong <1000 1551 # hostname 1552 >>0x1d6 pstring x \b, %s 1553 # user name 1554 >>>&0 pstring x \b\%s 1555 # directory like C:\Program Files (x86)\GnuWin32 1556 >>>>&0 pstring x \b, "%s" 1557 # version 1000 or higher implies unicode 1558 >0x140 ulelong >999 1559 # hostname 1560 >>0x1db lestring16 x \b, %-.9s 1561 # utf string variant with prepending fe??ffFFff 1562 >>0x1db search/43 \xFF\xFF\xFF 1563 # user name 1564 >>>&0 lestring16 x \b\%-.9s 1565 >>>&0 search/43 \xFF\xFF\xFF 1566 # directory like C:\Program Files\GIMP 2 1567 >>>>&0 lestring16 x \b, %-.42s 1568 1569 # URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 1570 # Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 1571 # From: Joerg Jenderek 1572 0 string Inno\ Setup\ Messages\ ( 1573 # null padded til 0x40 boundary 1574 >0x38 quad 0 InnoSetup messages 1575 !:mime application/x-innosetup-msg 1576 # unins000.msg, unins001.msg, ... 1577 !:ext msg 1578 # version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 1579 >>0x15 string x \b, version %.5s 1580 # look for 6th char of version string or terminating right parentheses 1581 >>>0x1a ubyte !0x29 \b%c 1582 # NumMessages 1583 >>0x40 ulelong x \b, %u messages 1584 # TotalSize: Cardinal; 1585 #>>0x44 ulelong x \b, TotalSize %u 1586 # NotTotalSize: Cardinal; 1587 #>>0x48 ulelong x \b, NotTotalSize %u 1588 # CRCMessages: Longint; 1589 #>>0x4C ulelong x \b, CRC %#x 1590 >>0x40 ulelong x 1591 # (u) after version means unicoded messages 1592 >>>0x1c search/2 (u) (UTF-16), 1593 >>>>0x50 lestring16 x %s 1594 # ASCII coded message 1595 >>>0x1c default x (ASCII), 1596 >>>>0x50 string x %s 1597 1598 # Windows Imaging (WIM) Image 1599 # Update: Joerg Jenderek at Mar 2019, 2021 1600 # URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 1601 # http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 1602 # Reference: https://download.microsoft.com/download/f/e/f/ 1603 # fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 1604 # Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 1605 0 string MSWIM\000\000\000 1606 >0 use wim-archive 1607 # https://wimlib.net/man1/wimoptimize.html 1608 0 string WLPWM\000\000\000 1609 >0 use wim-archive 1610 0 name wim-archive 1611 # _WIMHEADER_V1_PACKED ImageTag[8] 1612 >0 string x Windows imaging 1613 !:mime application/x-ms-wim 1614 # TO avoid in file version 5.36 error like 1615 # Magdir/windows, 760: Warning: Current entry does not yet have a description 1616 # file: could not find any valid magic files! (No error) 1617 # split WIM 1618 >16 ulelong &0x00000008 (SWM 1619 !:ext swm 1620 # usPartNumber; 1, unless the file was split into multiple parts 1621 >>40 uleshort x \b %u 1622 # usTotalParts; The total number of WIM file parts in a spanned set 1623 >>42 uleshort x \b of %u) image 1624 # non split WIM 1625 >16 ulelong ^0x00000008 1626 # https://wimlib.net/man1/wimmount.html 1627 # solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 1628 >>12 ulelong 3584 (ESD) image 1629 !:ext esd 1630 >>12 ulelong !3584 ( 1631 # look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 1632 >>>156 search/68233/s RunTime.xml \bWindows provisioning package) 1633 !:ext ppkg 1634 # if is is not a Windows provisioning package, then it is a WIM 1635 >>>156 default x \bWIM) image 1636 # second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 1637 !:ext wim/wim2 1638 >0 string/b WLPWM\000\000\000 \b, wimlib pipable format 1639 # cbSize size of the WIM header in bytes like 208 1640 #>8 ulelong x \b, headersize %u 1641 # dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 1642 >14 uleshort x v%u 1643 >13 ubyte x \b.%u 1644 # dwImageCount; The number of images contained in the WIM file 1645 >44 ulelong >1 \b, %u images 1646 # dwBootIndex 1647 # 1-based index of the bootable image of the WIM, or 0 if no image is bootable 1648 >0x78 ulelong >0 \b, bootable no. %u 1649 # dwFlags 1650 #>16 ulelong x \b, flags %#8.8x 1651 #define FLAG_HEADER_COMPRESSION 0x00000002 1652 #define FLAG_HEADER_READONLY 0x00000004 1653 #define FLAG_HEADER_SPANNED 0x00000008 1654 #define FLAG_HEADER_RESOURCE_ONLY 0x00000010 1655 #define FLAG_HEADER_METADATA_ONLY 0x00000020 1656 #define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 1657 #define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 1658 #define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 1659 #define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 1660 #define FLAG_HEADER_COMPRESS_LZX 0x00040000 1661 #define FLAG_HEADER_COMPRESS_LZMS 0x00080000 1662 #define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 1663 # XPRESS, with small chunk size 1664 >16 ulelong &0x00100000 \b, XPRESS2 1665 >16 ulelong &0x00080000 \b, LZMS 1666 >16 ulelong &0x00040000 \b, LZX 1667 >16 ulelong &0x00020000 \b, XPRESS 1668 >16 ulelong &0x00000002 compressed 1669 >16 ulelong &0x00000004 \b, read only 1670 >16 ulelong &0x00000010 \b, resource only 1671 >16 ulelong &0x00000020 \b, metadata only 1672 >16 ulelong &0x00000080 \b, reparse point fixup 1673 #>16 ulelong &0x00010000 \b, RESERVED 1674 # dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 1675 #>20 ulelong >0 \b, chunk size %u bytes 1676 # gWIMGuid 1677 #>24 ubequad x \b, GUID %#16.16llx 1678 #>>32 ubequad x \b%16.16llx 1679 # rhOffsetTable; the location of the resource lookup table 1680 # wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 1681 #>48 ubequad x \b, rhOffsetTable %#16.16llx 1682 # rhXmlData; the location of the XML data 1683 #>0x50 ulelong x \b, at %#8.8x 1684 # NOT WORKING \xff\xfe<\0W\0I\0M\0 1685 #>(0x50.l) ubequad x \b, xml=%16.16llx 1686 # rhBootMetadata; the location of the metadata resource 1687 #>0x60 ubequad x \b, rhBootMetadata %#16.16llx 1688 # rhIntegrity; the location of integrity table used to verify files 1689 #>0x7c ubequad x \b, rhIntegrity %#16.16llx 1690 # Unused[60] 1691 #>148 ubequad !0 \b,unused %#16.16llx 1692 # 1693 1694 # From: Joerg Jenderek 1695 # URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 1696 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 1697 # Note: called "Windows Easy Transfer migration data" by TrID, 1698 # "Migration Store" or "EasyTransfer file" by Microsoft 1699 0 string 1giM Windows Easy Transfer migration data 1700 #!:mime application/octet-stream 1701 !:mime application/x-ms-mig 1702 !:ext mig 1703 >0x18 string =MRTS without password 1704 # data offset with 1 space at end 1705 >>0x1c ulelong+0x38 x \b, at %#x 1706 # look for zlib compressed data by ./compress 1707 >>(0x1c.l+0x38) ubyte x 1708 >>>&-1 indirect x 1709 # in password protected examples MRTS comes some bytes further 1710 >0x18 string !MRTS with password 1711 # look for first MRTS tag 1712 >0x18 search/29/b MRTS 1713 # probably first file name length like 178, ... 1714 #>>&0 ulelong x \b, 1st length %u 1715 # URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1716 >>&20 lestring16 x \b, 1st %-s 1717 1718 # Microsoft SYLK 1719 # https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 1720 # https://outflank.nl/upload/sylksum.txt 1721 0 string ID;P Microsoft SYLK program 1722 >4 string >0 \b, created by %s 1723 !:ext slk/sylk 1724 1725 # Summary: Windows Performance Monitor Alert 1726 # From: Joerg Jenderek 1727 # URL: https://en.wikipedia.org/wiki/Performance_Monitor 1728 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml 1729 # Note: called "Windows Performance Monitor Alert" by TrID 1730 0 ubelong =0xDC058340 1731 >4 ubyte =0 Windows Performance Monitor Alert 1732 #!:mime application/octet-stream 1733 # https://www.thoughtco.com/mime-types-by-content-type-3469108 1734 # https://filext.com/file-extension/PAM 1735 !:mime application/x-perfmon 1736 #!:mime application/x-ms-pma 1737 !:ext pma 1738 # metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics" 1739 >>80 string x \b, "%s" 1740 1741 # From: Joerg Jenderek 1742 # URL: https://en.wikipedia.org/wiki/InstallShield 1743 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml 1744 # Note: contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK 1745 0 ubelong 0xB8C90C00 InstallShield Script 1746 #!:mime application/octet-stream 1747 !:mime application/x-installshield-ins 1748 # like test.ins Setup.ins 1749 !:ext ins 1750 # UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700 1751 # 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700 1752 #>4 ubequad x \b, at 4 %#16.16llx 1753 # copyright text like: "Stirling Technologies, Inc. (c) 1990-1994" 1754 # "InstallSHIELD Software Corporation (c) 1990-1997" 1755 >13 pstring/h x "%s" 1756 # look for specific ASCII variable names 1757 >1 search/0x121/s SRCDIR \b, variable names: 1758 # 1st like: SRCDIR 1759 >>&-4 leshort x #%u 1760 >>&-2 pstring/h x %s 1761 # 2nd like: SRCDISK 1762 >>>&0 leshort x #%u 1763 >>>&2 pstring/h x %s 1764 # 3rd like: TARGETDISK 1765 >>>>&0 leshort x #%u 1766 >>>>&2 pstring/h x %s 1767 # 4th like: TARGETDIR 1768 #>>>>>&0 leshort x #%u 1769 #>>>>>&2 pstring/h x %s 1770 # 5th like: WINDIR 1771 #>>>>>>&0 leshort x #%u 1772 #>>>>>>&2 pstring/h x %s 1773 # 6th like: WINDISK 1774 #>>>>>>>&0 leshort x #%u 1775 #>>>>>>>&2 pstring/h x %s 1776 # 7th like: WINSYSDIR 1777 #>>>>>>>>&0 leshort x #%u 1778 #>>>>>>>>&2 pstring/h x %s 1779 # ... LOGHANDLE 1780 >0 ubelong x ... 1781 # 1782 1783 # Summary: Microsoft Remote Desktop Protocol connection 1784 # From: Joerg Jenderek 1785 # URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files 1786 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/r/rdp.trid.xml 1787 # Note: called "Remote Desktop Connection Settings" by TrID 1788 0 string screen\040mode\040id:i: Remote Desktop Protocol connection 1789 #!:mime text/plain 1790 !:mime text/x-ms-rdp 1791 !:ext rdp 1792 # Screen mode: 1~session appear in a window 2~session appear full screen 1793 >17 string 1 \b, window mode 1794 >17 string 2 \b, full screen mode 1795 1796 0 guid 7B5C52E4-D88C-4DA7-AEB1-5378D02996D3 Microsoft OneNote 1797 !:ext one 1798 !:mime application/onenote 1799 0 guid 43FF2FA1-EFD9-4C76-9EE2-10EA5722765F Microsoft OneNote Revision Store File 1800 1801 # Microsoft XAML Binary Format 1802 # From: Alexandre Iooss <erdnaxe (a] crans.org> 1803 # URL: https://github.com/WalkingCat/XbfDump/blob/8832d2ffcaa738434d803fefa2ba99d3af37ed29/xbf_data.h 1804 0 string XBF\0 1805 >12 ulelong <0xFF 1806 >>16 ulelong <0xFF Microsoft XAML Binary Format 1807 !:ext xbf 1808 >>>12 ulelong x %d 1809 >>>16 ulelong x \b.%d 1810 >>>4 ulelong x \b, metadata size: %d bytes 1811 >>>8 ulelong x \b, node size: %d bytes 1812 1813 # Metaswitch MetaView Service Assurance Server exports 1814 0 string MetaView\x20Service\x20Assurance\x20Export\x20File MetaView SAS export 1815 >39 string Version\x20 1816 >>47 byte x \b, version %c 1817 1818 # Active Directory Group Policy Registry Policy File Format 1819 # From: Yuuta Liang <yuuta (a] yuuta.moe> 1820 # URL: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-file-format 1821 0 string PReg 1822 >4 lelong x Group Policy Registry Policy, Version=%d 1823
Indexes created Sat Feb 28 05:31:39 UTC 2026