Windows Shortcut Link File Structure

This is based on http://msdn.microsoft.com/en-us/library/dd871305.aspx

Note: I could not find a good breakdown of the Shortcut file structure and so worked through it and documented here. Some of the Microsoft documentation is wrong, giving the order of some sections one way in one place and the opposite in another, sometimes on the same page.

I created a PowerShell Parser for shortcut files which is available here parse-shortcut.ps1. It is still a work in progress, since there are so many variations. Except for the SHELL_LINK_HEADER section, all the other sections are optional. I also tired of the process when I got to the EXTRA_DATA section and the script does not parse this section.

The shortcut file structure consists of the following data structures: SHELL_LINK_HEADER [LINKTARGET_IDLIST] [LINKINFO] [STRING_DATA] [EXTRA_DATA]. All the structures after the SHELL_LINK_HEADER are optional and controlled by LinkFlags.

The EXTRA_DATA block consists of the following optional data structures


Table 1: Shell Link Header
Offset Size/Type Description
0x00 DWord HeaderSize: The size, in bytes, of this structure. This value MUST be 0x0000004C.
0x04 16 bytes LinkCLSID: A class identifier (CLSID). This value MUST be 00021401-0000-0000-C000-000000000046.
0x14 DWord LinkFlags: A LinkFlags structure (Table 6) that specifies information about the shell link and the presence of optional portions of the structure.
0x18 DWord FileAttributes: A FileAttributesFlags structure (Table 7) that specifies information about the link target.
0x1c FileTime QWord CreationTime: A FILETIME structure ([MS-DTYP]) that specifies the creation time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is no creation time set on the link target.
0x24 FileTime QWord AccessTime: A FILETIME structure ([MS-DTYP]) that specifies the access time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is no access time set on the link target.
0x2c FileTime QWord WriteTime: A FILETIME structure ([MS-DTYP]) that specifies the write time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is no write time set on the link target.
0x34 DWord FileSize: A 32-bit unsigned integer that specifies the size, in bytes, of the link target. If the link target file is larger than 0xFFFFFFFF, this value specifies the least significant 32 bits of the link target file size.
0x38 DWord (Signed) IconIndex: A 32-bit signed integer that specifies the index of an icon within a given icon location.
0x3c DWord ShowCommand: A 32-bit unsigned integer that specifies the expected window state of an application launched by the link. (Table 8)
0x40 Word HotKey: A HotKeyFlags structure (Table 9 and Table 10) that specifies the keystrokes used to launch the application referenced by the shortcut key. This value is assigned to the application after it is launched, so that pressing the key activates that application.
0x42 10 bytes A value that MUST be zero.

LINKTARGET_IDLIST -- the first of the optional areas. If bit 1 HasLinkTargetIDList of the Link Flags is set this section must be present. The section contains a list of ItemId's followed by a TerminalID (2 bytes). The TerminalID is a 16-bit, unsigned integer, with a zero value, that indicates the end of the item IDs.

The official documentation describes these items as "The data stored in a given ItemID is defined by the source that corresponds to the location in the target namespace of the preceding ItemIDs. This data uniquely identifies the items in that part of the namespace.". Whatever that means.

The first two bytes of the structure contains the length of the LINKTARGET_IDLIST as an unsigned int 16bit. Each ItemID consists of a 16 bit unsigned integer length followed by the data. Note the length bytes are included in the length.Table 2

Table 2: Item ID Structure
Offset Size/Type Description
0x0 Word ItemIDSize: A 16-bit, unsigned integer that specifies the size, in bytes, of the ItemID structure, including the ItemIDSize field.
0x02 Variable Data: The shell data source-defined data that specifies an item.

LINK INFO. If bit 2 HasLinkInfo of the Link Flags is set this section must be present. The LinkInfo structure specifies information necessary to resolve a link target if it is not found in its original location. This includes information about the volume that the target was stored on, the mapped drive letter, and a Universal Naming Convention (UNC) form of the path if one existed when the link was created.

Table 3: Link Info
Offset Size/Type Description
0x0 DWord LinkInfoSize: A 32-bit, unsigned integer that specifies the size, in bytes, of the LinkInfo structure. All offsets specified in this structure MUST be less than this value, and all strings contained in this structure MUST fit within the extent defined by this size.
0x04 DWord LinkInfoHeaderSize: A 32-bit, unsigned integer that specifies the size, in bytes, of the LinkInfo header section, which is composed of the LinkInfoSize, LinkInfoHeaderSize, LinkInfoFlags, VolumeIDOffset, LocalBasePathOffset, CommonNetworkRelativeLinkOffset, CommonPathSuffixOffset fields, and, if included, the LocalBasePathOffsetUnicode and CommonPathSuffixOffsetUnicode fields. Note: In Windows, Unicode characters are stored in this structure if the data cannot be represented as ANSI characters due to truncation of the values. In this case, the value of the LinkInfoHeaderSize field is greater than or equal to 36.
0x08 DWORD LinkInfoFlags: Flags that specify whether the VolumeID, LocalBasePath, LocalBasePathUnicode, and CommonNetworkRelativeLink fields are present in this structure. If bit 1 is sent then VolumeID And Local Base Path are present. If bit 2 is set then Common Network Relative Link And Path Suffix are present. (Table 11)
0x0c DWord VolumeIDOffset: A 32-bit, unsigned integer that specifies the location of the VolumeID field. If the VolumeIDAndLocalBasePath flag is set, this value is an offset, in bytes, from the start of the LinkInfo structure; otherwise, this value MUST be zero.
0x10 DWord LocalBasePathOffset: A 32-bit, unsigned integer that specifies the location of the LocalBasePath field. If the VolumeIDAndLocalBasePath flag is set, this value is an offset, in bytes, from the start of the LinkInfo structure; otherwise, this value MUST be zero.
0x14 DWord CommonNetworkRelativeLinkOffset: A 32-bit, unsigned integer that specifies the location of the CommonNetworkRelativeLink field. If the CommonNetworkRelativeLinkAndPathSuffix flag is set, this value is an offset, in bytes, from the start of the LinkInfo structure; otherwise, this value MUST be zero.
0x18 DWord CommonPathSuffixOffset: A 32-bit, unsigned integer that specifies the location of the CommonPathSuffix field. This value is an offset, in bytes, from the start of the LinkInfo structure.
0x1c DWord LocalBasePathOffsetUnicode: An optional, 32-bit, unsigned integer that specifies the location of the LocalBasePathUnicode field. If the VolumeIDAndLocalBasePath flag is set, this value is an offset, in bytes, from the start of the LinkInfo structure; otherwise, this value MUST be zero. This field can be present only if the value of the LinkInfoHeaderSize field is greater than or equal to 0x00000024.
0x20 DWord CommonPathSuffixOffsetUnicode: An optional, 32-bit, unsigned integer that specifies the location of the CommonPathSuffixUnicode field. This value is an offset, in bytes, from the start of the LinkInfo structure. This field can be present only if the value of the LinkInfoHeaderSize field is greater than or equal to 0x00000024.
Variable Variable VolumeID: An optional VolumeID structure (Table 12) that specifies information about the volume that the link target was on when the link was created. This field is present if the VolumeIDAndLocalBasePath flag is set.
Variable Variable LocalBasePath: An optional, NULL–terminated string, defined by the system default code page, which is used to construct the full path to the link item or link target by appending the string in the CommonPathSuffix field. This field is present if the VolumeIDAndLocalBasePath flag is set.
Variable Variable CommonPathSuffix: A NULL–terminated string, defined by the system default code page, which is used to construct the full path to the link item or link target by being appended to the string in the LocalBasePath field. This field is present if the VolumeIDAndLocalBasePath flag is set.
Variable Variable CommonNetworkRelativeLink: An optional CommonNetworkRelativeLink structure (Table 14) that specifies information about the network location where the link target is stored.
Variable Variable LocalBasePathUnicode: An optional, NULL–terminated, Unicode string that is used to construct the full path to the link item or link target by appending the string in the CommonPathSuffixUnicode field. This field can be present only if the VolumeIDAndLocalBasePath flag is set and the value of the LinkInfoHeaderSize field is greater than or equal to 0x00000024.
Variable Variable CommonPathSuffixUnicode: An optional, NULL–terminated, Unicode string that is used to construct the full path to the link item or link target by being appended to the string in the LocalBasePathUnicode field. This field can be present only if the value of the LinkInfoHeaderSize field is greater than or equal to 0x00000024.

String Data Section -- All strings are preceded by a 16 bit int giving the length. Most are unicode strings

Table 4: String Data
Name Description
NAME_STRING An optional structure that specifies a description of the shortcut that is displayed to end users to identify the purpose of the shell link. This structure MUST be present if the HasName flag is set.
RELATIVE_PATH An optional structure that specifies the location of the link target relative to the file that contains the shell link. When specified, this string SHOULD be used when resolving the link. This structure MUST be present if the HasRelativePath flag is set.
WORKING_DIR An optional structure that specifies the file system path of the working directory to be used when activating the link target. This structure MUST be present if the HasWorkingDir flag is set.
COMMAND_LINE_ARGUMENTS An optional structure that stores the command-line arguments that should be specified when activating the link target. This structure MUST be present if the HasArguments flag is set.
ICON_LOCATION An optional structure that specifies the location of the icon to be used when displaying a shell link item in an icon view. This structure MUST be present if the HasIconLocation flag is set.

Table 5: Extra Data: A series of Optional Data Blocks
Name Description
CONSOLE_PROPS The ConsoleDataBlock structure specifies the display settings to use when a link target specifies an application that is run in a console window.
CONSOLE_FE_PROPS The ConsoleFEDataBlock structure specifies the code page to use for displaying text when a link target specifies an application that is run in a console window.
DARWIN_PROPS The DarwinDataBlock structure specifies an application identifier that can be used instead of a link targetIDList to install an application when a shell link is activated.
ENVIRONMENT_PROPS The EnvironmentVariableDataBlock structure specifies a path to environment variable information when the link target refers to a location that has a corresponding environment variable.
ICON_ENVIRONMENT_PROPS The IconEnvironmentDataBlock structure specifies the path to an icon. The path is encoded using environment variables, which makes it possible to find the icon across machines where the locations vary but are expressed using environment variables.
KNOWN_FOLDER_PROPS The KnownFolderDataBlock structure specifies the location of a known folder. This data can be used when a link target is a known folder to keep track of the folder so that the link target IDList can be translated when the link is loaded.
PROPERTY_STORE_PROPS A PropertyStoreDataBlock structure specifies a set of properties that can be used by applications to store extra data in the shell link.
SHIM_PROPS The ShimDataBlock structure specifies the name of a shim that can be applied when activating a link target.
SPECIAL_FOLDER_PROPS The SpecialFolderDataBlock structure specifies the location of a special folder. This data can be used when a link target is a special folder to keep track of the folder, so that the link target IDList can be translated when the link is loaded.
TRACKER_PROPS The TrackerDataBlock structure specifies data that can be used to resolve a link target if it is not found in its original location when the link is resolved. This data is passed to the Link Tracking service [MS-DLTW] to find the link target.
VISTA_AND_ABOVE_IDLIST_PROPS The VistaAndAboveIDListDataBlock structure specifies an alternate IDList that can be used instead of the LINKTARGETID_LIST structure on platforms that support it.

Table 6: Link Flags
Bit Mask Description
1 0x01 HasLinkTargetIDList: The shell link is saved with an item ID list (IDList). If this bit is set, a LINKTARGETID_LIST structure MUST follow the ShellLinkHeader. If this bit is not set, this structure MUST NOT be present.
2 0x02 HasLinkInfo: The shell link is saved with link information. If this bit is set, a LinkInfo structure MUST be present. If this bit is not set, this structure MUST NOT be present.
3 0x04 HasName: The shell link is saved with a name string. If this bit is set, a NAME_STRING StringData structure MUST be present. If this bit is not set, this structure MUST NOT be present.
4 0x08 HasRelativePath: The shell link is saved with a relative path string. If this bit is set, a RELATIVE_PATH StringData structure MUST be present. If this bit is not set, this structure MUST NOT be present.
5 0x10 HasWorkingDir: The shell link is saved with a working directory string. If this bit is set, a WORKING_DIR StringData structure MUST be present. If this bit is not set, this structure MUST NOT be present.
6 0x20 HasArguments: The shell link is saved with command line arguments. If this bit is set, a COMMAND_LINE_ARGUMENTS StringData structure MUST be present. If this bit is not set, this structure MUST NOT be present.
7 0x40 HasIconLocation: The shell link is saved with an icon location string. If this bit is set, an ICON_LOCATION StringData structure MUST be present. If this bit is not set, this structure MUST NOT be present.
8 0x80 IsUnicode: The shell link contains Unicode encoded strings. This bit SHOULD be set. If this bit is set, the StringData section should contain Unicode-encoded strings; otherwise, it should contain strings that are encoded using the system default code page.
9 0x100 ForceNoLinkInfo: The LinkInfo structure (Table 3) is ignored.
10 0x200 HasExpString: The shell link is saved with an EnvironmentVariableDataBlock (Table 21).
11 0x400 RunInSeparateProcess: The target is run in a separate virtual machine when launching a link target that is a 16-bit application.
12 0x800 Unused1: A bit that is undefined and MUST be ignored.
13 0x1000 HasDarwinID: The shell link is saved with a DarwinDataBlock (Table 20).
14 0x2000 RunAsUser: The application is run as a different user when the target of the shell link is activated.
15 0x4000 HasExpIcon: The shell link is saved with an IconEnvironmentDataBlock (Table 22).
16 0x8000 NoPidlAlias: The file system location is represented in the shell namespace when the path to an item is parsed into an IDList.
17 0x10000 Unused2: A bit that is undefined and MUST be ignored.
18 0x20000 RunWithShimLayer: The shell link is saved with a ShimDataBlock (Table 27).
19 0x40000 ForceNoLinkTrack: The TrackerDataBlock (Table 29) is ignored.
20 0x80000 EnableTargetMetadata: The shell link attempts to collect target properties and store them in the PropertyStoreDataBlock (Table 25) when the link target is set.
21 0x100000 DisableLinkPathTracking: The EnvironmentVariableDataBlock is ignored (Table 21).
22 0x200000 DisableKnownFolderTracking: The SpecialFolderDataBlock ((Table 28)) and the KnownFolderDataBlock ((Table 23)) are ignored when loading the shell link. If this bit is set, these extra data blocks SHOULD NOT be saved when saving the shell link.
23 0x400000 DisableKnownFolderAlias: If the link has a KnownFolderDataBlock ((Table 23)), the unaliased form of the known folder IDList SHOULD be used when translating the target IDList at the time that the link is loaded.
24 0x800000 AllowLinkToLink: Creating a link that references another link is enabled. Otherwise, specifying a link as the target IDList SHOULD NOT be allowed.
25 0x1000000 UnaliasOnSave: When saving a link for which the target IDList is under a known folder, either the unaliased form of that known folder or the target IDList SHOULD be used.
26 0x2000000 PreferEnvironmentPath: The target IDList SHOULD NOT be stored; instead, the path specified in the EnvironmentVariableDataBlock ((Table 21)) SHOULD be used to refer to the target.
27 0x4000000 KeepLocalIDListForUNCTarget: When the target is a UNC name that refers to a location on a local machine, the local path IDList in the PropertyStoreDataBlock ((Table 25)) SHOULD be stored, so it can be used when the link is loaded on the local machine.

Table 7: File Attributes Flags
Bit Mask Description
1 0x01 E_ATTRIBUTE_READONLY: The file or directory is read-only. For a file, if this bit is set, applications can read the file but cannot write to it or delete it. For a directory, if this bit is set, applications cannot delete the directory.
2 0x02 FILE_ATTRIBUTE_HIDDEN: The file or directory is hidden. If this bit is set, the file or folder is not included in an ordinary directory listing.
3 0x04 FILE_ATTRIBUTE_SYSTEM: The file or directory is part of the operating system or is used exclusively by the operating system.
4 0x08 Reserved1: A bit that MUST be zero.
5 0x10 FILE_ATTRIBUTE_DIRECTORY: The link target is a directory instead of a file.
6 0x20 FILE_ATTRIBUTE_ARCHIVE: The file or directory is an archive file. Applications use this flag to mark files for backup or removal.
7 0x40 Reserved2: A bit that MUST be zero.
8 0x80 FILE_ATTRIBUTE_NORMAL: The file or directory has no other flags set. If this bit is 1, all other bits in this structure MUST be clear.
9 0x100 FILE_ATTRIBUTE_TEMPORARY: The file is being used for temporary storage.
10 0x200 FILE_ATTRIBUTE_SPARSE_FILE: The file is a sparse file.
11 0x400 FILE_ATTRIBUTE_REPARSE_POINT: The file or directory has an associated reparse point.
12 0x800 FILE_ATTRIBUTE_COMPRESSED: The file or directory is compressed. For a file, this means that all data in the file is compressed. For a directory, this means that compression is the default for newly created files and subdirectories.
13 0x1000 FILE_ATTRIBUTE_OFFLINE: The data of the file is not immediately available.
14 0x2000 FILE_ATTRIBUTE_NOT_CONTENT_INDEXED: The contents of the file need to be indexed.
15 x04000 FILE_ATTRIBUTE_ENCRYPTED: The file or directory is encrypted. For a file, this means that all data in the file is encrypted. For a directory, this means that encryption is the default for newly created files and subdirectories.

Table 8: Show Command
Value Meaning
0x00000001 SW_SHOWNORMAL: The application is open and its window is open in a normal fashion.
0x00000003 SW_SHOWMAXIMIZED: The application is open, and keyboard focus is given to the application, but its window is not shown.
0x00000007 SW_SHOWMINNOACTIVE: The application is open, but its window is not shown. It is not given the keyboard focus.
All other values MUST be treated as SW_SHOWNORMAL

Table 9: Hot Keys Byte 1
Value Meaning
0x30 "0" key
0x31 "1" key
0x32 "2" key
0x33 "3" key
0x34 "4" key
0x35 "5" key
0x36 "6" key
0x37 "7" key
0x38 "8" key
0x39 "9" key
0x41 "A" key
0x42 "B" key
0x43 "C" key
0x44 "D" key
0x45 "E" key
0x46 "F" key
0x47 "G" key
0x48 "H" key
0x49 "I" key
0x4A "J" key
0x4B "K" key
0x4C "L" key
0x4D "M" key
0x4E "N" key
0x4F "O" key
0x50 "P" key
0x51 "Q" key
0x52 "R" key
0x53 "S" key
0x54 "T" key
0x55 "U" key
0x56 "V" key
0x57 "W" key
0x58 "X" key
0x59 "Y" key
0x5A "Z" key
0x70 "F1" key
0x71 "F2" key
0x72 "F3" key
0x73 "F4" key
0x74 "F5" key
0x75 "F6" key
0x76 "F7" key
0x77 "F8" key
0x78 "F9" key
0x79 "F10" key
0x7A "F11" key
0x7B "F12" key
0x7C "F13" key
0x7D "F14" key
0x7E "F15" key
0x7F "F16" key
0x80 "F17" key
0x81 "F18" key
0x82 "F19" key
0x83 "F20" key
0x84 "F21" key
0x85 "F22" key
0x86 "F23" key
0x87 "F24" key
0x90 "NUM LOCK" key
0x91 "SCROLL LOCK" key

Table 10: Hot Keys Byte 2
Value Meaning
0x01 The "SHIFT" key on the keyboard.
0x02 The "CTRL" key on the keyboard.
0x04 The "ALT" key on the keyboard

Table 11: LinkInfo Flags
Bit Description
1 VolumeIDAndLocalBasePath : If set, the VolumeID and LocalBasePath fields are present, and their locations are specified by the values of the VolumeIDOffset and LocalBasePathOffset fields, respectively. If the value of the LinkInfoHeaderSize field is greater than or equal to 0x00000024, the LocalBasePathUnicode field is present, and its location is specified by the value of the LocalBasePathOffsetUnicode field.
If not set, the VolumeID, LocalBasePath, and LocalBasePathUnicode fields are not present, and the values of the VolumeIDOffset and LocalBasePathOffset fields are zero. If the value of the LinkInfoHeaderSize field is greater than or equal to 0x00000024, the value of the LocalBasePathOffsetUnicode field is zero.
2 CommonNetworkRelativeLinkAndPathSuffix: If set, the CommonNetworkRelativeLink field is present, and its location is specified by the value of the CommonNetworkRelativeLinkOffset field.
If not set, the CommonNetworkRelativeLink field is not present, and the value of the CommonNetworkRelativeLinkOffset field is zero.

Table 12: VolumeID Structure
Offset Size/Type Description
0x0 DWord VolumeIDSize: A 32-bit, unsigned integer that specifies the size, in bytes, of this structure. This value MUST be greater than 0x00000010. All offsets specified in this structure MUST be less than this value, and all strings contained in this structure MUST fit within the extent defined by this size.
0x04 DWord DriveType: A 32-bit, unsigned integer that specifies the type of drive the link target is stored on. See Table 13
0x08 DWord DriveSerialNumber: A 32-bit, unsigned integer that specifies the drive serial number of the volume the link target is stored on.
0x0c DWord VolumeLabelOffset: A 32-bit, unsigned integer that specifies the location of a string that contains the volume label of the drive that the link target is stored on. This value is an offset, in bytes, from the start of the VolumeID structure to a NULL-terminated string of characters, defined by the system default code page. The volume label string is located in the Data field of this structure.
If the value of this field is 0x00000014, it MUST be ignored, and the value of the VolumeLabelOffsetUnicode field MUST be used to locate the volume label string.
0x10 DWord VolumeLabelOffsetUnicode: An optional, 32-bit, unsigned integer that specifies the location of a string that contains the volume label of the drive that the link target is stored on. This value is an offset, in bytes, from the start of the VolumeID structure to a NULL-terminated string of Unicode characters. The volume label string is located in the Data field of this structure.
If the value of the VolumeLabelOffset field is not 0x00000014, this field MUST be ignored, and the value of the VolumeLabelOffset field MUST be used to locate the volume label string.
0x14 Variable Data: A buffer of data that contains the volume label of the drive as a string defined by the system default code page or Unicode characters, as specified by preceding fields.

Table 13: DriveType
Value Meaning
0x00 DRIVE_UNKNOWN: The drive type cannot be determined.
0x01 DRIVE_NO_ROOT_DIR: The root path is invalid; for example, there is no volume mounted at the path.
0x02 DRIVE_REMOVABLE: The drive has removable media, such as a floppy drive, thumb drive, or flash card reader.
0x03 DRIVE_FIXED: The drive has fixed media, such as a hard drive or flash drive.
0x04 DRIVE_REMOTE: The drive is a remote (network) drive.
0x05 DRIVE_CDROM: The drive is a CD-ROM drive.
0x06 DRIVE_RAMDISK: The drive is a RAM disk.

Table 14: Common Network Relative Link Structure
Offset Size/Type Description
0x0 DWord CommonNetworkRelativeLinkSize: A 32-bit, unsigned integer that specifies the size, in bytes, of the CommonNetworkRelativeLink structure. This value MUST be greater than or equal to 0x00000014. All offsets specified in this structure MUST be less than this value, and all strings contained in this structure MUST fit within the extent defined by this size.
0x04 DWord CommonNetworkRelativeLinkFlags: Flags that specify the contents of the DeviceNameOffset and NetProviderType fields.
Bit 1 -- ValidDevice: If set, the DeviceNameOffset field contains an offset to the device name. If not set, the DeviceNameOffset field does not contain an offset to the device name, and its value MUST be zero.
Bit 2 -- ValidNetType: If set, the NetProviderType field contains the network provider type. If not set, the NetProviderType field does not contain the network provider type, and its value MUST be zero.
0x08 DWord NetNameOffset: A 32-bit, unsigned integer that specifies the location of the NetName field. This value is an offset, in bytes, from the start of the CommonNetworkRelativeLink structure.
0x0c DWord DeviceNameOffset: A 32-bit, unsigned integer that specifies the location of the DeviceName field. If the ValidDevice flag is set, this value is an offset, in bytes, from the start of the CommonNetworkRelativeLink structure; otherwise, this value MUST be zero.
0x10 DWord NetworkProviderType: A 32-bit, unsigned integer that specifies the type of network provider. If the ValidNetType flag is set, this value MUST be one of those in Table 15; otherwise, this value MUST be ignored.
0x14 DWord NetNameOffsetUnicode: An optional, 32-bit, unsigned integer that specifies the location of the NetNameUnicode field. This value is an offset, in bytes, from the start of the CommonNetworkRelativeLink structure. This field MUST be present if the value of the NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be present.
0x18 DWord DeviceNameOffsetUnicode: An optional, 32-bit, unsigned integer that specifies the location of the DeviceNameUnicode field. This value is an offset, in bytes, from the start of the CommonNetworkRelativeLink structure. This field MUST be present if the value of the NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be present.
0x1c Variable NetName: A NULL-terminated string, as defined by the system default code page, which specifies a server share path; for example, "\\server\share".
Variable Variable DeviceName: A NULL-terminated string, as defined by the system default code page, which specifies a device; for example, the drive letter "D:".
Variable Variable NetNameUnicode: An optional, NULL-terminated, Unicode string that is the Unicode version of the NetName string. This field MUST be present if the value of the NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be present.
Variable Variable DeviceNameUnicode: An optional, NULL-terminated, Unicode string that is the Unicode version of the DeviceName string. This field MUST be present if the value of the NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be present.

Table 15: NetworkProviderType
Vendor Value
WNNC_NET_AVID 0x001A0000
WNNC_NET_DOCUSPACE 0x001B0000
WNNC_NET_MANGOSOFT 0x001C0000
NNC_NET_SERNET 0x001D0000
WNNC_NET_RIVERFRONT1 0X001E0000
WNNC_NET_RIVERFRONT2 0x001F0000
WNNC_NET_DECORB 0x00200000
WNNC_NET_PROTSTOR 0x00210000
WNNC_NET_FJ_REDIR 0x00220000
WNNC_NET_DISTINCT 0x00230000
WNNC_NET_TWINS 0x00240000
WNNC_NET_RDR2SAMPLE 0x00250000
WNNC_NET_CSC 0x00260000
WNNC_NET_3IN1 0x00270000
WNNC_NET_EXTENDNET 0x00290000
WNNC_NET_STAC 0x002A0000
WNNC_NET_FOXBAT 0x002B0000
WNNC_NET_YAHOO 0x002C0000
WNNC_NET_EXIFS 0x002D0000
WNNC_NET_DAV 0x002E0000
WNNC_NET_KNOWARE 0x002F0000
WNNC_NET_OBJECT_DIRE 0x00300000
WNNC_NET_MASFAX 0x00310000
WNNC_NET_HOB_NFS 0x00320000
WNNC_NET_SHIVA 0x00330000
WNNC_NET_IBMAL 0x00340000
WNNC_NET_LOCK 0x00350000
WNNC_NET_TERMSRV 0x00360000
WNNC_NET_SRT 0x00370000
WNNC_NET_QUINCY 0x00380000
WNNC_NET_OPENAFS 0x00390000
WNNC_NET_AVID1 0X003A0000
WNNC_NET_DFS 0x003B0000
WNNC_NET_KWNP 0x003C0000
WNNC_NET_ZENWORKS 0x003D0000
WNNC_NET_DRIVEONWEB 0x003E0000
WNNC_NET_VMWARE 0x003F0000
WNNC_NET_RSFX 0x00400000
WNNC_NET_MFILES 0x00410000
WNNC_NET_MS_NFS 0x00420000
WNNC_NET_GOOGLE 0x00430000

Table 16: Console Data Block
Offset Size Description
0x0 DWord Block Size: A 32-bit, unsigned integer that specifies the size of the ConsoleDataBlock structure. This value MUST be 0x000000CC.
0x04 DWord Block Signature: A 32-bit, unsigned integer that specifies the signature of the ConsoleDataBlock extra data section. This value MUST be 0xA0000002.
0x08 Word Fill Attributes: A 16-bit, unsigned integer that specifies the fill attributes that control the foreground and background text colors in the console window. The following bit definitions can be combined to specify 16 different values each for the foreground and background colors: See Table 17
0x0a Word Popup Fill Attributes: A 16-bit, unsigned integer that specifies the fill attributes that control the foreground and background text color in the console window popup. The values are the same as for the FillAttributes field.
0x0c Word Screen Buffer Size X: A 16-bit, signed integer that specifies the horizontal size (X axis), in characters, of the console window buffer.
0x0e Word Screen Buffer Size Y: A 16-bit, signed integer that specifies the vertical size (Y axis), in characters, of the console window buffer.
0x10 Word Window Size X: A 16-bit, signed integer that specifies the horizontal size (X axis), in characters, of the console window.
0x12 Word Window Size Y: A 16-bit, signed integer that specifies the vertical size (Y axis), in characters, of the console window.
0x14 Word Window Origin X: A 16-bit, signed integer that specifies the horizontal coordinate (X axis), in pixels, of the console window origin.
0x16 Word Window Origin Y: A 16-bit, signed integer that specifies the vertical coordinate (Y axis), in pixels, of the console window origin.
0x18 DWord Unused1: A value that is undefined and MUST be ignored.
0x1c DWord Unused2: A value that is undefined and MUST be ignored.
0x20 DWord Font Size: A 32-bit, unsigned integer that specifies the size, in pixels, of the font used in the console window.
0x24 DWord Font Family: A 32-bit, unsigned integer that specifies the family of the font used in the console window. This value MUST be one of those in Table 18
0x28 DWord Font Weight: A 16-bit, unsigned integer that specifies the stroke weight of the font used in the console window. If value = 700 Bold Font. If value < 700 Regular weight font.
0x2c 64 Bytes Face Name: A 32-character Unicode string that specifies the face name of the font used in the console window.
0x6c DWord Cursor Size: A 32-bit, unsigned integer that specifies the size of the cursor, in pixels, used in the console window. Value = 25 A small cursor. 26 — 50 A medium cursor. 51 — 100 A large cursor.
0x70 DWord Full Screen: A 32-bit, unsigned integer that specifies whether to open the console window in full-screen mode. Value 0x00 Full-screen mode is off. not 0x00 Full-screen mode is on.
0x74 DWord Quick Edit: A 32-bit, unsigned integer that specifies whether to open the console window in QuikEdit mode. In QuickEdit mode, the mouse can be used to cut, copy, and paste text in the console window. Value 0x00 = QuikEdit mode is off. not 0x00 = QuikEdit mode is on.
0x78 DWord Insert Mode: A 32-bit, unsigned integer that specifies insert mode in the console window. Value 0x00 = Insert mode is disabled. not 0x00 = Insert mode is enabled.
0x7c DWord Auto Position: A 32-bit, unsigned integer that specifies auto-position mode of the console window. Value 0x00 = The values of the WindowOriginX and WindowOriginY fields are used to position the console window. not 0x00 = The console window is positioned automatically.
0x80 DWord History Buffer Size: A 32-bit, unsigned integer that specifies the size, in characters, of the buffer that is used to store a history of user input into the console window.
0x84 DWord Number Of History Buffers: A 32-bit, unsigned integer that specifies the number of history buffers to use.
0x88 DWord History No Dup: A 32-bit, unsigned integer that specifies whether to remove duplicates in the history buffer. Value 0x00 = Duplicates are not allowed. not 0x00 = Duplicates are allowed.
0x8c DWord Color Table: A table of 16 32-bit, unsigned integers specifying the RGB colors that are used for text in the console window. The values of the fill attribute fields FillAttributes and PopupFillAttributes are used as indexes into this table to specify the final foreground and background color for a character.

Table 17: Fill Attributes
Value Meaning
FOREGROUND_BLUE 0x0001 The foreground text color contains blue.
FOREGROUND_GREEN 0x0002 The foreground text color contains green.
FOREGROUND_RED 0x0004 The foreground text color contains red.
FOREGROUND_INTENSITY 0x0008 The foreground text color is intensified.
BACKGROUND_BLUE 0x0010 The background text color contains blue.
BACKGROUND_GREEN 0x0020 The background text color contains green.
BACKGROUND_RED 0x0040 The background text color contains red.
BACKGROUND_INTENSITY 0x0080 The background text color is intensified.

Table 18: FontFamily
Value Meaning
F_DONTCARE 0x0000 The font family is unknown.
FF_ROMAN 0x0010 The font is variable-width with serifs; for example, "Times New Roman".
FF_SWISS 0x0020 The font is variable-width without serifs; for example, "Arial".
FF_MODERN 0x0030 The font is fixed-width, with or without serifs; for example, "Courier New".
FF_SCRIPT 0x0040 The font is designed to look like handwriting; for example, "Cursive".
FF_DECORATIVE 0x0050 The font is a novelty font; for example, "Old English".

Table 19: Console FE Data Block
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the ConsoleFEDataBlock structure. This value MUST be 0x0000000C.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the ConsoleFEDataBlock extra data section. This value MUST be 0xA0000004.
0x08 DWord CodePage: A 32-bit, unsigned integer that specifies a code page language code identifier. For details concerning the structure and meaning of language code identifiers, see [MS-LCID]. For additional background information, see [MSCHARSET] and [MSDN-CODEPAGE].

Table 20: Darwin Data Block
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the DarwinDataBlock structure. This value MUST be 0x00000314.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the DarwinDataBlock extra data section. This value MUST be 0xA0000006.
0x08 260 Bytes DarwinDataAnsi: A NULL–terminated string, defined by the system default code page, which specifies an application identifier. This field SHOULD be ignored.
0x268 520 Bytes DarwinDataUnicode: An optional, NULL–terminated, Unicode string that specifies an application identifier.

Table 21: Environment Variable Data Block
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the EnvironmentVariableDataBlock structure. This value MUST be 0x00000314.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the EnvironmentVariableDataBlock extra data section. This value MUST be 0xA0000001.
0x08 260 Bytes TargetAnsi: A NULL-terminated string, defined by the system default code page, which specifies a path to environment variable information.
0x268 520 Bytes TargetUnicode: An optional, NULL-terminated, Unicode string that specifies a path to environment variable information.

Table 22: Icon Environment Data Block
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the IconEnvironmentDataBlock structure. This value MUST be 0x00000314.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the IconEnvironmentDataBlock extra data section. This value MUST be 0xA0000007.
0x08 260 Bytes TargetAnsi: A NULL-terminated string, defined by the system default code page, which specifies a path that is constructed with environment variables.
0x268 520 Bytes TargetUnicode: An optional, NULL-terminated, Unicode string that specifies a path that is constructed with environment variables.

Table 23: Known Folder Data Block
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the KnownFolderDataBlock structure. This value MUST be 0x0000001C.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the KnownFolderDataBlock extra data section. This value MUST be 0xA000000B.
0x08 16 Bytes KnownFolderID: A value in GUID packet representation ([MS-DTYP] Table 24) that specifies the folder GUID ID.
0x18 DWord Offset: A 32-bit, unsigned integer that specifies the location of the ItemID of the first child segment of the IDList specified by KnownFolderID. This value is the offset, in bytes, into the link target IDList.

Table 24: GUID
Offset Size Description
0x0 DWord Data1: A 32-bit, unsigned integer
0x04 Word Data2: A 16-bit, unsigned integer
0x06 Word Data3: A 16-bit, unsigned integer
0x08 DWord Data4: A 32-bit, unsigned integer

Table 25: Property Store Data Block
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the PropertyStoreDataBlock structure. This value MUST be greater than or equal to 0x0000000C.
0x04 DWord BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the PropertyStoreDataBlock extra data section. This value MUST be 0xA0000009.
0x08 DWord PropertyStore (variable): A serialized property storage structure ([MS-PROPSTORE] see Table 26).

Table 26: MS-PROPSTORE -- Serialized Property Storage
Offset Size Description
0x0 DWord Storage Size: An unsigned integer that specifies the total size, in bytes, of this structure. It MUST be 0x00000000 if this is the last Serialized Property Storage in the enclosing Serialized Property Store.
0x04 DWord Version: MUST be equal to 0x53505331.
0x08 16 Bytes Format ID: A GUID (Table 19) that specifies the semantics and expected usage of the properties contained in this Serialized Property Storage structure. It MUST be unique in the set of serialized property storage structures.
0x18 Variable Serialized Property Value (variable): A sequence of one or more property values. If the Format ID field is equal to the GUID {D5CDD505-2E9C-101B-9397-08002B2CF9AE}, then all values in the sequence MUST be Serialized Property Value string structures; otherwise, all values MUST be Serialized Property Value Interger structures. The last Serialized Property Value in the sequence MUST specify 0x00000 for the Value Size.

Table 27: Shim Data Block. A shim is a mechanism used to provide custom behavior to applications that do not work on newer versions of the operating system.
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the ShimDataBlock structure. This value MUST be greater than or equal to 0x00000088.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the ShimDataBlock extra data section. This value MUST be 0xA0000008.
0x08 Variable LayerName: A Unicode string that specifies the name of a shim layer to apply to a link target when it is being activated.

Table 28: Special Folder Data Block. The SpecialFolderDataBlock structure specifies the location of a special folder. This data can be used when a link target is a special folder to keep track of the folder, so that the link target IDList can be translated when the link is loaded.
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the SpecialFolderDataBlock structure. This value MUST be 0x00000010.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the SpecialFolderDataBlock extra data section. This value MUST be 0xA0000005.
0x08 DWord SpecialFolderID: A 32-bit, unsigned integer that specifies the folder integer ID.
0x0c DWord Offset: A 32-bit, unsigned integer that specifies the location of the ItemID of the first child segment of the IDList specified by SpecialFolderID. This value is the offset, in bytes, into the link target IDList.

Table 29: Tracker Data Block. The TrackerDataBlock structure specifies data that can be used to resolve a link target if it is not found in its original location when the link is resolved. This data is passed to the Link Tracking service [MS-DLTW] to find the link target.
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the TrackerDataBlock structure. This value MUST be 0x00000060.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the TrackerDataBlock extra data section. This value MUST be 0xA0000003.
0x08 DWord Length: A 32-bit, unsigned integer. This value MUST be greater than or equal to 0x0000058.
0x0c DWord Version: A 32-bit, unsigned integer. This value MUST be 0x00000000.
0x10 Variable MachineID (variable): A character string, as defined by the system default code page, which specifies the NetBIOS name of the machine where the link target was last known to reside.
Variable 32 Bytes Droid: Two values in GUID packet representation ([MS-DTYP] Table 24) that are used to find the link target with the Link Tracking service, as specified in [MS-DLTW].
Variable 32 Bytes DroidBirth: Two values in GUID packet representation ([MS-DTYP] Table 24) that are used to find the link target with the Link Tracking service

Table 30: Vista and Above ID List Data Block -- The VistaAndAboveIDListDataBlock structure specifies an alternate IDList that can be used instead of the LinkTargetIDList structure on platforms that support it.
Offset Size Description
0x0 DWord BlockSize: A 32-bit, unsigned integer that specifies the size of the VistaAndAboveIDListDataBlock structure. This value MUST be greater than or equal to 0x0000000A.
0x04 DWord BlockSignature: A 32-bit, unsigned integer that specifies the signature of the VistaAndAboveIDListDataBlock extra data section. This value MUST be 0xA000000C.
0x08 Variable IDList: An IDList structure (Table 2).

Table 31: FileTime Structure - The FILETIME structure is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since January 1, 1601, Coordinated Universal Time (UTC).
Size Description
DWord dwLowDateTime: A 32-bit unsigned integer that contains the low-order bits of the file time.
DWord dwHighDateTime: A 32-bit unsigned integer that contains the high-order bits of the file time.