windows 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338
  1. #------------------------------------------------------------------------------
  2. # $File: windows,v 1.12 2015/08/29 07:10:35 christos Exp $
  3. # windows: file(1) magic for Microsoft Windows
  4. #
  5. # This file is mainly reserved for files where programs
  6. # using them are run almost always on MS Windows 3.x or
  7. # above, or files only used exclusively in Windows OS,
  8. # where there is no better category to allocate for.
  9. # For example, even though WinZIP almost run on Windows
  10. # only, it is better to treat them as "archive" instead.
  11. # For format usable in DOS, such as generic executable
  12. # format, please specify under "msdos" file.
  13. #
  14. # Summary: Outlook Express DBX file
  15. # Extension: .dbx
  16. # Created by: Christophe Monniez
  17. 0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
  18. >4 byte =0xC5 \b, message database
  19. >4 byte =0xC6 \b, folder database
  20. >4 byte =0xC7 \b, account information
  21. >4 byte =0x30 \b, offline database
  22. # Summary: Windows crash dump
  23. # Extension: .dmp
  24. # Created by: Andreas Schuster (http://computer.forensikblog.de/)
  25. # Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
  26. # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
  27. 0 string PAGE
  28. >4 string DUMP MS Windows 32bit crash dump
  29. >>0x05c byte 0 \b, no PAE
  30. >>0x05c byte 1 \b, PAE
  31. >>0xf88 lelong 1 \b, full dump
  32. >>0xf88 lelong 2 \b, kernel dump
  33. >>0xf88 lelong 3 \b, small dump
  34. >>0x068 lelong x \b, %d pages
  35. >4 string DU64 MS Windows 64bit crash dump
  36. >>0xf98 lelong 1 \b, full dump
  37. >>0xf98 lelong 2 \b, kernel dump
  38. >>0xf98 lelong 3 \b, small dump
  39. >>0x090 lequad x \b, %lld pages
  40. # Summary: Vista Event Log
  41. # Extension: .evtx
  42. # Created by: Andreas Schuster (http://computer.forensikblog.de/)
  43. # Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
  44. 0 string ElfFile\0 MS Windows Vista Event Log
  45. >0x2a leshort x \b, %d chunks
  46. >>0x10 lelong x \b (no. %d in use)
  47. >0x18 lelong >1 \b, next record no. %d
  48. >0x18 lelong =1 \b, empty
  49. >0x78 lelong &1 \b, DIRTY
  50. >0x78 lelong &2 \b, FULL
  51. # Summary: Windows 3.1 group files
  52. # Extension: .grp
  53. # Created by: unknown
  54. 0 string \120\115\103\103 MS Windows 3.1 group files
  55. # Summary: Old format help files
  56. # Extension: .hlp
  57. # Created by: Dirk Jagdmann <doj@cubic.org>
  58. 0 lelong 0x00035f3f MS Windows 3.x help file
  59. # Summary: Hyper terminal
  60. # Extension: .ht
  61. # Created by: unknown
  62. 0 string HyperTerminal\
  63. >15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
  64. # http://ithreats.files.wordpress.com/2009/05/\
  65. # lnk_the_windows_shortcut_file_format.pdf
  66. # Summary: Windows shortcut
  67. # Extension: .lnk
  68. # Created by: unknown
  69. # 'L' + GUUID
  70. 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
  71. >20 lelong&1 1 \b, Item id list present
  72. >20 lelong&2 2 \b, Points to a file or directory
  73. >20 lelong&4 4 \b, Has Description string
  74. >20 lelong&8 8 \b, Has Relative path
  75. >20 lelong&16 16 \b, Has Working directory
  76. >20 lelong&32 32 \b, Has command line arguments
  77. >20 lelong&64 64 \b, Icon
  78. >>56 lelong x \b number=%d
  79. >24 lelong&1 1 \b, Read-Only
  80. >24 lelong&2 2 \b, Hidden
  81. >24 lelong&4 4 \b, System
  82. >24 lelong&8 8 \b, Volume Label
  83. >24 lelong&16 16 \b, Directory
  84. >24 lelong&32 32 \b, Archive
  85. >24 lelong&64 64 \b, Encrypted
  86. >24 lelong&128 128 \b, Normal
  87. >24 lelong&256 256 \b, Temporary
  88. >24 lelong&512 512 \b, Sparse
  89. >24 lelong&1024 1024 \b, Reparse point
  90. >24 lelong&2048 2048 \b, Compressed
  91. >24 lelong&4096 4096 \b, Offline
  92. >28 leqwdate x \b, ctime=%s
  93. >36 leqwdate x \b, mtime=%s
  94. >44 leqwdate x \b, atime=%s
  95. >52 lelong x \b, length=%u, window=
  96. >60 lelong&1 1 \bhide
  97. >60 lelong&2 2 \bnormal
  98. >60 lelong&4 4 \bshowminimized
  99. >60 lelong&8 8 \bshowmaximized
  100. >60 lelong&16 16 \bshownoactivate
  101. >60 lelong&32 32 \bminimize
  102. >60 lelong&64 64 \bshowminnoactive
  103. >60 lelong&128 128 \bshowna
  104. >60 lelong&256 256 \brestore
  105. >60 lelong&512 512 \bshowdefault
  106. #>20 lelong&1 0
  107. #>>20 lelong&2 2
  108. #>>>(72.l-64) pstring/h x \b [%s]
  109. #>20 lelong&1 1
  110. #>>20 lelong&2 2
  111. #>>>(72.s) leshort x
  112. #>>>&75 pstring/h x \b [%s]
  113. # Summary: Outlook Personal Folders
  114. # Created by: unknown
  115. 0 lelong 0x4E444221 Microsoft Outlook email folder
  116. >10 leshort 0x0e (<=2002)
  117. >10 leshort 0x17 (>=2003)
  118. # Summary: Windows help cache
  119. # Created by: unknown
  120. 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
  121. # Summary: IE cache file
  122. # Created by: Christophe Monniez
  123. 0 string Client\ UrlCache\ MMF Internet Explorer cache file
  124. >20 string >\0 version %s
  125. # Summary: Registry files
  126. # Created by: unknown
  127. # Modified by (1): Joerg Jenderek
  128. 0 string regf MS Windows registry file, NT/2000 or above
  129. 0 string CREG MS Windows 95/98/ME registry file
  130. 0 string SHCC3 MS Windows 3.1 registry file
  131. # Summary: Windows Registry text
  132. # Extension: .reg
  133. # Submitted by: Abel Cheung <abelcheung@gmail.com>
  134. 0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
  135. 0 string Windows\ Registry\ Editor\
  136. >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
  137. # Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
  138. # empty ,comment , section
  139. # PR/383: remove unicode BOM because it is not portable across regex impls
  140. 0 regex/s \\`(\\r\\n|;|[[])
  141. # left bracket in section line
  142. >&0 search/8192 [
  143. # http://en.wikipedia.org/wiki/Autorun.inf
  144. # http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
  145. >>&0 regex/c \^(autorun)]\r\n
  146. >>>&0 ubyte =0x5b INItialization configuration
  147. !:mime application/x-wine-extension-ini
  148. # From: Pal Tamas <folti@balabit.hu>
  149. # Autorun File
  150. >>>&0 ubyte !0x5b Microsoft Windows Autorun file
  151. !:mime application/x-setupscript
  152. # http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
  153. # version strings ASCII coded case-independent for Windows setup information script file
  154. >>&0 regex/c \^(version|strings)] Windows setup INFormation
  155. !:mime application/x-setupscript
  156. #!:mime application/inf
  157. #!:mime application/x-wine-extension-inf
  158. >>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation
  159. !:mime text/inf
  160. # http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
  161. # http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
  162. # .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
  163. >>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini
  164. !:mime application/x-wine-extension-ini
  165. #!:mime text/plain
  166. # http://support.microsoft.com/kb/84709/
  167. >>&0 regex/c \^(don't\ load)] Windows CONTROL.INI
  168. !:mime application/x-wine-extension-ini
  169. >>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI
  170. !:mime application/x-wine-extension-ini
  171. # http://technet.microsoft.com/en-us/library/cc722567.aspx
  172. # http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
  173. >>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI
  174. !:mime application/x-wine-extension-ini
  175. # http://en.wikipedia.org/wiki/SYSTEM.INI
  176. >>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI
  177. !:mime application/x-wine-extension-ini
  178. # http://www.mdgx.com/newtip6.htm
  179. >>&0 regex/c \^(SafeList)] Windows IOS.INI
  180. !:mime application/x-wine-extension-ini
  181. # http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
  182. >>&0 regex/c \^(boot\x20loader)] Windows boot.ini
  183. !:mime application/x-wine-extension-ini
  184. >>>&0 ubyte x
  185. # http://en.wikipedia.org/wiki/CONFIG.SYS
  186. >>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS
  187. # http://support.microsoft.com/kb/118579/
  188. >>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS
  189. # VERS string unicoded case-independent
  190. >>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
  191. # ION] string unicoded case-independent
  192. >>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
  193. !:mime application/x-setupscript
  194. # STRI string unicoded case-independent
  195. >>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
  196. # NGS] string unicoded case-independent
  197. >>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
  198. !:mime application/x-setupscript
  199. # unknown keyword after opening bracket
  200. >>&0 default x
  201. >>>&0 search/8192 [
  202. # version Strings FileIdentification
  203. >>>>&0 string/c version Windows setup INFormation
  204. !:mime application/x-setupscript
  205. # VERS string unicoded case-independent
  206. >>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
  207. # ION] string unicoded case-independent
  208. >>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
  209. !:mime application/x-setupscript
  210. # http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other
  211. #>>>>&0 default x Generic INItialization configuration
  212. #!:mime application/x-wine-extension-ini
  213. # Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
  214. # http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
  215. # GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
  216. 0 leshort&0xFeFe 0x0000
  217. !:strength -5
  218. # test for unused null bits in PNF_FLAGs
  219. >4 ulelong&0xFCffFe00 0x00000000
  220. # only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
  221. >>68 ulelong >0x57
  222. # test for zero high byte of InfValueBlockSize, followed by WinDirPath like
  223. # C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
  224. >>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF
  225. !:mime application/x-pnf
  226. # currently only found Major Version=1 and Minor Version=1
  227. #>>>>0 uleshort =0x0101
  228. #>>>>>1 ubyte x \b, version %u
  229. #>>>>>0 ubyte x \b.%u
  230. >>>>0 uleshort !0x0101
  231. >>>>>1 ubyte x \b, version %u
  232. >>>>>0 ubyte x \b.%u
  233. # 1 ,2 (windows 98 SE)
  234. #>>>>2 uleshort =2 \b, InfStyle %u
  235. >>>>2 uleshort !2 \b, InfStyle %u
  236. # PNF_FLAG_IS_UNICODE 0x00000001
  237. # PNF_FLAG_HAS_STRINGS 0x00000002
  238. # PNF_FLAG_SRCPATH_IS_URL 0x00000004
  239. # PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008
  240. # PNF_FLAG_INF_VERIFIED 0x00000010
  241. # PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020
  242. # ?? 0x00000100
  243. # ?? 0x01000000
  244. # ?? 0x02000000
  245. >>>>4 ulelong&0x00000001 0x00000001 \b, unicoded
  246. >>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed
  247. #>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x
  248. # many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
  249. #>>>>12 uleshort x \b, InfSubstValueCount 0x%x
  250. # only < 9 found
  251. #>>>>14 uleshort x \b, InfVersionDatumCount 0x%x
  252. # only found values lower 0x0000ffff
  253. #>>>>16 ulelong x \b, InfVersionDataSize 0x%x
  254. # only found positive values lower 0x00ffFFff for InfVersionDataOffset
  255. >>>>20 ulelong x \b, at 0x%x
  256. >>>>4 ulelong&0x00000001 =0x00000001
  257. # case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
  258. >>>>>(20.l) lestring16 x "%s"
  259. >>>>4 ulelong&0x00000001 !0x00000001
  260. >>>>>(20.l) string x "%s"
  261. # FILETIME is number of 100-nanosecond intervals since 1 January 1601
  262. #>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx
  263. # only found values lower 0x00ffFFff
  264. #>>>>32 ulelong x \b, StringTableBlockOffset 0x%x
  265. #>>>>36 ulelong x \b, StringTableBlockSize 0x%x
  266. #>>>>40 ulelong x \b, InfSectionCount 0x%x
  267. #>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x
  268. #>>>>48 ulelong x \b, InfSectionBlockSize 0x%x
  269. #>>>>52 ulelong x \b, InfLineBlockOffset 0x%x
  270. #>>>>56 ulelong x \b, InfLineBlockSize 0x%x
  271. #>>>>60 ulelong x \b, InfValueBlockOffset 0x%x
  272. #>>>>64 ulelong x \b, InfValueBlockSize 0x%x
  273. # WinDirPathOffset
  274. #>>>>68 ulelong x \b, at 0x%x
  275. >>>>68 ulelong >0x57
  276. >>>>>4 ulelong&0x00000001 =0x00000001
  277. >>>>>>(68.l) ubequad =0x43003a005c005700
  278. # normally unicoded C:\Windows
  279. #>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
  280. >>>>>>(68.l) ubequad !0x43003a005c005700
  281. >>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
  282. >>>>>4 ulelong&0x00000001 !0x00000001
  283. # normally ASCII C:\WINDOWS
  284. #>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s"
  285. >>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s"
  286. # found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
  287. #>>>>72 ulelong >0 \b, at 0x%x
  288. >>>>72 ulelong >0 \b,
  289. >>>>>4 ulelong&0x00000001 =0x00000001
  290. >>>>>>(72.l) lestring16 x OsLoaderPath "%s"
  291. >>>>>4 ulelong&0x00000001 !0x00000001
  292. # seldom C:\ instead empty
  293. >>>>>>(72.l) string x OsLoaderPath "%s"
  294. # 1fdh
  295. #>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x
  296. >>>>78 uleshort !0x407 \b, LanguageId %x
  297. # only 407h found
  298. #>>>>78 uleshort =0x407 \b, LanguageId %x
  299. # InfSourcePathOffset often 0
  300. #>>>>80 ulelong >0 \b, at 0x%x
  301. >>>>80 ulelong >0 \b,
  302. >>>>>4 ulelong&0x00000001 =0x00000001
  303. >>>>>>(80.l) lestring16 x SourcePath "%s"
  304. >>>>>4 ulelong&0x00000001 !0x00000001
  305. >>>>>>(80.l) string >\0 SourcePath "%s"
  306. # OriginalInfNameOffset often 0
  307. #>>>>84 ulelong >0 \b, at 0x%x
  308. >>>>84 ulelong >0 \b,
  309. >>>>>4 ulelong&0x00000001 =0x00000001
  310. >>>>>>(84.l) lestring16 x InfName "%s"
  311. >>>>>4 ulelong&0x00000001 !0x00000001
  312. >>>>>>(84.l) string >\0 InfName "%s"