windows revision 290152
1108983Simp 2108983Simp#------------------------------------------------------------------------------ 3108983Simp# $File: windows,v 1.12 2015/08/29 07:10:35 christos Exp $ 4108983Simp# windows: file(1) magic for Microsoft Windows 5108983Simp# 6108983Simp# This file is mainly reserved for files where programs 7108983Simp# using them are run almost always on MS Windows 3.x or 8108983Simp# above, or files only used exclusively in Windows OS, 9108983Simp# where there is no better category to allocate for. 10108983Simp# For example, even though WinZIP almost run on Windows 11225861Swblock# only, it is better to treat them as "archive" instead. 12225861Swblock# For format usable in DOS, such as generic executable 13225861Swblock# format, please specify under "msdos" file. 14225861Swblock# 15108983Simp 16108983Simp 17108983Simp# Summary: Outlook Express DBX file 18108983Simp# Extension: .dbx 19108983Simp# Created by: Christophe Monniez 20148471Simp0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 21108983Simp>4 byte =0xC5 \b, message database 22139027Sbrueffer>4 byte =0xC6 \b, folder database 23146969Smarius>4 byte =0xC7 \b, account information 24139027Sbrueffer>4 byte =0x30 \b, offline database 25108983Simp 26108983Simp 27108983Simp# Summary: Windows crash dump 28108983Simp# Extension: .dmp 29108983Simp# Created by: Andreas Schuster (http://computer.forensikblog.de/) 30108983Simp# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 31159126Sthompsa# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 32159126Sthompsa0 string PAGE 33108983Simp>4 string DUMP MS Windows 32bit crash dump 34187743Ssam>>0x05c byte 0 \b, no PAE 35225861Swblock>>0x05c byte 1 \b, PAE 36225861Swblock>>0xf88 lelong 1 \b, full dump 37247660Sschweikh>>0xf88 lelong 2 \b, kernel dump 38187743Ssam>>0xf88 lelong 3 \b, small dump 39159126Sthompsa>>0x068 lelong x \b, %d pages 40159126Sthompsa>4 string DU64 MS Windows 64bit crash dump 41226775Shrs>>0xf98 lelong 1 \b, full dump 42159126Sthompsa>>0xf98 lelong 2 \b, kernel dump 43159126Sthompsa>>0xf98 lelong 3 \b, small dump 44108983Simp>>0x090 lequad x \b, %lld pages 45108983Simp 46147088Sbrooks 47225861Swblock# Summary: Vista Event Log 48147088Sbrooks# Extension: .evtx 49216983Sjpaetzel# Created by: Andreas Schuster (http://computer.forensikblog.de/) 50147088Sbrooks# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 51147088Sbrooks0 string ElfFile\0 MS Windows Vista Event Log 52147088Sbrooks>0x2a leshort x \b, %d chunks 53147088Sbrooks>>0x10 lelong x \b (no. %d in use) 54147088Sbrooks>0x18 lelong >1 \b, next record no. %d 55148642Ssam>0x18 lelong =1 \b, empty 56175683Smtm>0x78 lelong &1 \b, DIRTY 57147088Sbrooks>0x78 lelong &2 \b, FULL 58147088Sbrooks 59148642Ssam 60148642Ssam# Summary: Windows 3.1 group files 61148642Ssam# Extension: .grp 62148642Ssam# Created by: unknown 63148642Ssam0 string \120\115\103\103 MS Windows 3.1 group files 64148642Ssam 65148642Ssam 66148642Ssam# Summary: Old format help files 67148642Ssam# Extension: .hlp 68148642Ssam# Created by: Dirk Jagdmann <doj@cubic.org> 69148642Ssam0 lelong 0x00035f3f MS Windows 3.x help file 70148642Ssam 71148642Ssam 72148642Ssam# Summary: Hyper terminal 73148642Ssam# Extension: .ht 74148642Ssam# Created by: unknown 75148642Ssam0 string HyperTerminal\ 76175683Smtm>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 77148642Ssam 78148642Ssam# http://ithreats.files.wordpress.com/2009/05/\ 79108983Simp# lnk_the_windows_shortcut_file_format.pdf 80108983Simp# Summary: Windows shortcut 81108983Simp# Extension: .lnk 82139281Sbrueffer# Created by: unknown 83108983Simp# 'L' + GUUID 84108983Simp0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 85108983Simp>20 lelong&1 1 \b, Item id list present 86108983Simp>20 lelong&2 2 \b, Points to a file or directory 87108983Simp>20 lelong&4 4 \b, Has Description string 88108983Simp>20 lelong&8 8 \b, Has Relative path 89108983Simp>20 lelong&16 16 \b, Has Working directory 90108983Simp>20 lelong&32 32 \b, Has command line arguments 91225861Swblock>20 lelong&64 64 \b, Icon 92152326Semax>>56 lelong x \b number=%d 93152326Semax>24 lelong&1 1 \b, Read-Only 94175683Smtm>24 lelong&2 2 \b, Hidden 95152326Semax>24 lelong&4 4 \b, System 96152326Semax>24 lelong&8 8 \b, Volume Label 97152326Semax>24 lelong&16 16 \b, Directory 98175683Smtm>24 lelong&32 32 \b, Archive 99152326Semax>24 lelong&64 64 \b, Encrypted 100152326Semax>24 lelong&128 128 \b, Normal 101215195Semax>24 lelong&256 256 \b, Temporary 102215195Semax>24 lelong&512 512 \b, Sparse 103215195Semax>24 lelong&1024 1024 \b, Reparse point 104215195Semax>24 lelong&2048 2048 \b, Compressed 105215195Semax>24 lelong&4096 4096 \b, Offline 106215195Semax>28 leqwdate x \b, ctime=%s 107215195Semax>36 leqwdate x \b, mtime=%s 108139281Sbrueffer>44 leqwdate x \b, atime=%s 109134584Sbrooks>52 lelong x \b, length=%u, window= 110134584Sbrooks>60 lelong&1 1 \bhide 111156782Semax>60 lelong&2 2 \bnormal 112134584Sbrooks>60 lelong&4 4 \bshowminimized 113134584Sbrooks>60 lelong&8 8 \bshowmaximized 114134584Sbrooks>60 lelong&16 16 \bshownoactivate 115156331Semax>60 lelong&32 32 \bminimize 116134584Sbrooks>60 lelong&64 64 \bshowminnoactive 117134584Sbrooks>60 lelong&128 128 \bshowna 118240891Shselasky>60 lelong&256 256 \brestore 119240891Shselasky>60 lelong&512 512 \bshowdefault 120240891Shselasky#>20 lelong&1 0 121240891Shselasky#>>20 lelong&2 2 122261509Shselasky#>>>(72.l-64) pstring/h x \b [%s] 123261509Shselasky#>20 lelong&1 1 124261509Shselasky#>>20 lelong&2 2 125261509Shselasky#>>>(72.s) leshort x 126261509Shselasky#>>>&75 pstring/h x \b [%s] 127261509Shselasky 128261509Shselasky# Summary: Outlook Personal Folders 129261509Shselasky# Created by: unknown 130261509Shselasky0 lelong 0x4E444221 Microsoft Outlook email folder 131240891Shselasky>10 leshort 0x0e (<=2002) 132240891Shselasky>10 leshort 0x17 (>=2003) 133240891Shselasky 134138175Siedowse 135138175Siedowse# Summary: Windows help cache 136240891Shselasky# Created by: unknown 137240891Shselasky0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 138240891Shselasky 139261509Shselasky 140261509Shselasky# Summary: IE cache file 141261509Shselasky# Created by: Christophe Monniez 142261509Shselasky0 string Client\ UrlCache\ MMF Internet Explorer cache file 143261509Shselasky>20 string >\0 version %s 144261509Shselasky 145261509Shselasky 146261509Shselasky# Summary: Registry files 147261509Shselasky# Created by: unknown 148240891Shselasky# Modified by (1): Joerg Jenderek 149240891Shselasky0 string regf MS Windows registry file, NT/2000 or above 150240891Shselasky0 string CREG MS Windows 95/98/ME registry file 151240891Shselasky0 string SHCC3 MS Windows 3.1 registry file 152208060Sdougb 153179804Skmacy 154153300Siedowse# Summary: Windows Registry text 155225861Swblock# Extension: .reg 156153300Siedowse# Submitted by: Abel Cheung <abelcheung@gmail.com> 157153300Siedowse0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 158153300Siedowse0 string Windows\ Registry\ Editor\ 159153300Siedowse>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 160153300Siedowse 161153300Siedowse# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013 162153300Siedowse# empty ,comment , section 163153300Siedowse# PR/383: remove unicode BOM because it is not portable across regex impls 164153300Siedowse0 regex/s \\`(\\r\\n|;|[[]) 165153300Siedowse# left bracket in section line 166153300Siedowse>&0 search/8192 [ 167153300Siedowse# http://en.wikipedia.org/wiki/Autorun.inf 168153300Siedowse# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 169192198Smaxim>>&0 regex/c \^(autorun)]\r\n 170153300Siedowse>>>&0 ubyte =0x5b INItialization configuration 171153300Siedowse!:mime application/x-wine-extension-ini 172153300Siedowse# From: Pal Tamas <folti@balabit.hu> 173153300Siedowse# Autorun File 174153300Siedowse>>>&0 ubyte !0x5b Microsoft Windows Autorun file 175207020Sthompsa!:mime application/x-setupscript 176207020Sthompsa# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 177207020Sthompsa# version strings ASCII coded case-independent for Windows setup information script file 178207020Sthompsa>>&0 regex/c \^(version|strings)] Windows setup INFormation 179207020Sthompsa!:mime application/x-setupscript 180207020Sthompsa#!:mime application/inf 181207020Sthompsa#!:mime application/x-wine-extension-inf 182207020Sthompsa>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 183153300Siedowse!:mime text/inf 184153300Siedowse# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 185108983Simp# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 186247660Sschweikh# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 187148471Simp>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 188108983Simp!:mime application/x-wine-extension-ini 189108983Simp#!:mime text/plain 190108983Simp# http://support.microsoft.com/kb/84709/ 191131646Simp>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 192108983Simp!:mime application/x-wine-extension-ini 193108983Simp>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 194108983Simp!:mime application/x-wine-extension-ini 195114799Simp# http://technet.microsoft.com/en-us/library/cc722567.aspx 196166754Simp# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 197166754Simp>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 198119254Simp!:mime application/x-wine-extension-ini 199114852Simp# http://en.wikipedia.org/wiki/SYSTEM.INI 200119254Simp>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 201108983Simp!:mime application/x-wine-extension-ini 202166701Sjoerg# http://www.mdgx.com/newtip6.htm 203166701Sjoerg>>&0 regex/c \^(SafeList)] Windows IOS.INI 204166701Sjoerg!:mime application/x-wine-extension-ini 205166701Sjoerg# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 206166701Sjoerg>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 207166701Sjoerg!:mime application/x-wine-extension-ini 208166701Sjoerg>>>&0 ubyte x 209166701Sjoerg# http://en.wikipedia.org/wiki/CONFIG.SYS 210166701Sjoerg>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS 211166701Sjoerg# http://support.microsoft.com/kb/118579/ 212166701Sjoerg>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 213166701Sjoerg# VERS string unicoded case-independent 214166701Sjoerg>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 215166701Sjoerg# ION] string unicoded case-independent 216166701Sjoerg>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 217166701Sjoerg!:mime application/x-setupscript 218166701Sjoerg# STRI string unicoded case-independent 219166701Sjoerg>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049 220166701Sjoerg# NGS] string unicoded case-independent 221166701Sjoerg>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation 222166701Sjoerg!:mime application/x-setupscript 223166701Sjoerg# unknown keyword after opening bracket 224166701Sjoerg>>&0 default x 225166701Sjoerg>>>&0 search/8192 [ 226166701Sjoerg# version Strings FileIdentification 227166701Sjoerg>>>>&0 string/c version Windows setup INFormation 228166701Sjoerg!:mime application/x-setupscript 229166701Sjoerg# VERS string unicoded case-independent 230166701Sjoerg>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 231166701Sjoerg# ION] string unicoded case-independent 232139281Sbrueffer>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 233123626Snjl!:mime application/x-setupscript 234123626Snjl# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 235123626Snjl#>>>>&0 default x Generic INItialization configuration 236125366Snjl#!:mime application/x-wine-extension-ini 237123626Snjl 238123626Snjl# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 239125366Snjl# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 240125366Snjl# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 241125366Snjl0 leshort&0xFeFe 0x0000 242125366Snjl!:strength -5 243125366Snjl# test for unused null bits in PNF_FLAGs 244125366Snjl>4 ulelong&0xFCffFe00 0x00000000 245125366Snjl# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 246125366Snjl>>68 ulelong >0x57 247125366Snjl# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 248125366Snjl# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 249170976Snjl>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 250170976Snjl!:mime application/x-pnf 251170976Snjl# currently only found Major Version=1 and Minor Version=1 252170976Snjl#>>>>0 uleshort =0x0101 253170976Snjl#>>>>>1 ubyte x \b, version %u 254170976Snjl#>>>>>0 ubyte x \b.%u 255170976Snjl>>>>0 uleshort !0x0101 256170976Snjl>>>>>1 ubyte x \b, version %u 257170976Snjl>>>>>0 ubyte x \b.%u 258170976Snjl# 1 ,2 (windows 98 SE) 259170976Snjl#>>>>2 uleshort =2 \b, InfStyle %u 260170976Snjl>>>>2 uleshort !2 \b, InfStyle %u 261170976Snjl# PNF_FLAG_IS_UNICODE 0x00000001 262108983Simp# PNF_FLAG_HAS_STRINGS 0x00000002 263108983Simp# PNF_FLAG_SRCPATH_IS_URL 0x00000004 264225861Swblock# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 265225861Swblock# PNF_FLAG_INF_VERIFIED 0x00000010 266225861Swblock# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 267225861Swblock# ?? 0x00000100 268225861Swblock# ?? 0x01000000 269108983Simp# ?? 0x02000000 270108983Simp>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 271108983Simp>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 272108983Simp#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 273108983Simp# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 274108983Simp#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 275108983Simp# only < 9 found 276108983Simp#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 277108983Simp# only found values lower 0x0000ffff 278108983Simp#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 279108983Simp# only found positive values lower 0x00ffFFff for InfVersionDataOffset 280108983Simp>>>>20 ulelong x \b, at 0x%x 281108983Simp>>>>4 ulelong&0x00000001 =0x00000001 282108983Simp# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 283108983Simp>>>>>(20.l) lestring16 x "%s" 284121493Snjl>>>>4 ulelong&0x00000001 !0x00000001 285121493Snjl>>>>>(20.l) string x "%s" 286225861Swblock# FILETIME is number of 100-nanosecond intervals since 1 January 1601 287121493Snjl#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 288121493Snjl# only found values lower 0x00ffFFff 289121493Snjl#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 290121493Snjl#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 291121493Snjl#>>>>40 ulelong x \b, InfSectionCount 0x%x 292121493Snjl#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 293121493Snjl#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 294121493Snjl#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 295247660Sschweikh#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 296247660Sschweikh#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 297247660Sschweikh#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 298247660Sschweikh# WinDirPathOffset 299170976Snjl#>>>>68 ulelong x \b, at 0x%x 300247660Sschweikh>>>>68 ulelong >0x57 301121493Snjl>>>>>4 ulelong&0x00000001 =0x00000001 302121493Snjl>>>>>>(68.l) ubequad =0x43003a005c005700 303121493Snjl# normally unicoded C:\Windows 304121493Snjl#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 305121493Snjl>>>>>>(68.l) ubequad !0x43003a005c005700 306121493Snjl>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 307121493Snjl>>>>>4 ulelong&0x00000001 !0x00000001 308121493Snjl# normally ASCII C:\WINDOWS 309121493Snjl#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 310121493Snjl>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 311220168Strasz# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 312220168Strasz#>>>>72 ulelong >0 \b, at 0x%x 313319223Sasomers>>>>72 ulelong >0 \b, 314220168Strasz>>>>>4 ulelong&0x00000001 =0x00000001 315220168Strasz>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 316319223Sasomers>>>>>4 ulelong&0x00000001 !0x00000001 317238308Shrs# seldom C:\ instead empty 318220168Strasz>>>>>>(72.l) string x OsLoaderPath "%s" 319220168Strasz# 1fdh 320283226Strasz#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 321283223Strasz>>>>78 uleshort !0x407 \b, LanguageId %x 322283226Strasz# only 407h found 323283226Strasz#>>>>78 uleshort =0x407 \b, LanguageId %x 324283226Strasz# InfSourcePathOffset often 0 325283223Strasz#>>>>80 ulelong >0 \b, at 0x%x 326283223Strasz>>>>80 ulelong >0 \b, 327322848Swill>>>>>4 ulelong&0x00000001 =0x00000001 328322848Swill>>>>>>(80.l) lestring16 x SourcePath "%s" 329322848Swill>>>>>4 ulelong&0x00000001 !0x00000001 330322848Swill>>>>>>(80.l) string >\0 SourcePath "%s" 331322848Swill# OriginalInfNameOffset often 0 332322848Swill#>>>>84 ulelong >0 \b, at 0x%x 333322848Swill>>>>84 ulelong >0 \b, 334322848Swill>>>>>4 ulelong&0x00000001 =0x00000001 335322848Swill>>>>>>(84.l) lestring16 x InfName "%s" 336322848Swill>>>>>4 ulelong&0x00000001 !0x00000001 337322848Swill>>>>>>(84.l) string >\0 InfName "%s" 338322848Swill 339108983Simp