Search code examples
windowshexstructureshortcut

What is the internal structure of a Windows shortcut?

3 HDD in one computer: 2 with Windows XP, 1 with Windows 7, sequentially load the operating system from each of them.

I discover that some working shortcuts (not all) which created in first XP don't work in second XP and Windows 7 (not available for viewing the object for the shortcut).

To understand why it's don't work I create the same shortcut in windows 7 and open both files of these shorcuts in hex editor.

I discover that it's structures is diffrent but I do not know how to compare it.

What is the internal structure of a Windows shortcut?

What start and end bytes of some usefull blocks of shortcut's content?

Solution

  • Shortcut (.lnk) file format information can be found at [MS.Docs]: [MS-SHLLINK]: Shell Link (.LNK) Binary File Format.

    However, to spare you from reading that whole .pdf, one thing that is stored within a shortcut for sure (can be checked by "looking" at the shortcut using a hex viewer) is the (full) target path that it references (!!!important!!! at creation time): so it's "DriveLetter:\the_full_path".

    To clear up confusion, I'd suggest playing with shortcuts that have targets on the same drive.

    When switching HDDs, the DriveLetters (aka "C:") point to different things:

    • Let's say that you created on one of them a shortcut: "C:\shortcut.lnk" ("C:" is the DriveLetter assigned to the HDD where Win booted from): let's call this HDD1.
      The shortcut points to target file located on another HDD (and partition): let's call this HDD2 (e.g. "E:\target.txt)

    • When you'll switch HDDs (making HDD2 primary boot disk) the DriveLetters will change too, so now:

      • HDD2 will be "C:"
      • HDD1 will be "D:"


      Things complicate even more when introducing HDD3 and so on.

    As an answer to our question: the .lnk files don't work because their target is no longer present.