Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update might be needed for "Jump lists format.asciidoc" #31

Open
Huang-Shuyang opened this issue Dec 25, 2024 · 5 comments
Open

Update might be needed for "Jump lists format.asciidoc" #31

Huang-Shuyang opened this issue Dec 25, 2024 · 5 comments

Comments

@Huang-Shuyang
Copy link

Merry Christmas!
I'm writing a program to resolve the automatic destinations file recently. When I tried to read the "Format Version" field in the DestList header, my program returned 6. I thought it was my fault at first, but after carefully checking my code, nothing wrong was found. Then I tried to resolve these files using EricZimmerman/JumpList, the result was still 6. Therefore, I guess that the version 6 is a new one.
The operating system installed on my computer is Windows 11 24H2 (Edition: Home, Chinese Single Language; Build 26100.2605). All of the automatic destination files on my computer share the same version (version 6). I installed Windows 11 23H2 (Build 22631.4112) of the same edition on the virtual machine and found that the version is also 6. Afterwards, I installed Windows 11 22H2 (Build 22621.4602) and discovered that the DestList format version for Windows 11 22H2 is version 5. I then installed the first Windows 11 RTM version (Build 22000.194), whose automatic destination files is in version 4, which is identical to the latest version of Windows 10, corresopnding with the stock information in the document. In short, version 5 probably came to existence with the release of Windows 11 22H2, and version 6 with the release of Windows 11 23H2. I haven't tested every minor build to determine the exact build where the DestList format version changes due to time limit, but I guess these format versions first appear in the initial build of every major version. Here is a table about the relationship between Windows 11 version and DestList format version:

Windows 11 Version Tested Build No. DestList Version
21H2 22000.194 4
22H2 22621.4602 5
23H2 22631.4112 6
24H2 22631.4112 6

I tried to resolve these files of the new version with EricZimmerman/JumpList (as I didn't trust my understanding of this format), the program resolved it correctly, indicating that the structure of version 5 and 6 is probably very similar to that of version 3 and 4.
Here are three samples of these three versions: samples.zip. The three samples are both automatic desination file for notepad. Each file contains two entries: the first is "test.txt", while the second is "hello_world.txt".
Moreover, there seems to be a spelling mistake at line 44, column 54 ("ascci"=>"ascii"?). The table between lines 109 and 116 seems a bit strange in GitHub previewer (it seems that there is intended to be 3 rows, but the previewer only renders 2). But these issues are too trival to mention.
Since I'm just a freshman, my findings may be faulty and it needs more proof.
In the end, I'd like to express my thanks to all the maintainers. Your efforts helped me a lot in understanding the structure of LNK files (liblnk), compound binary files (libolecf) and jump list files (dtformats).

@joachimmetz
Copy link
Member

Good Holidays to you as well.. Thanks for the detailed report, much appreciated. I'll have a closer look when time permits.

@Huang-Shuyang
Copy link
Author

Sorry to interrupt, but there's one more issue:
In the automatic destination file "5a2098e080cf7ac4.automaticDestinations-ms" (probably for OneDrive) of version 6, the length of an entry seems to be larger than [ 134 + 2 * path_size ]. Referencing EricZimmerman/JumpList, I found that the last 4 bytes mentioned in your document (offset from: 130 + 2 * path_size, to: 134 + 2 * path_size) is actually the length of additional data (property sheet) (it was named 'spsSize' in EricZimmerman/Jumplist, 'ps' refers to property sheet, though I don't know exactly what it means) instead of padding alignment. If this is true, the length of the entry should be [ 134 + 2 * path_size + property_sheet_length ] and the last row of the table might have to be changed to:

Offset Size Value Description
... (130+2*path_size) 4 Property sheet size
Contains the size of optional property sheet, will be 0 if there isn't one
... (134+2*path_size) ... (property_sheet_size) (Optional) Property sheet

I didn't upload a sample due to privacy concerns. If you need one, I'm glad to e-mail it to you.

Huang-Shuyang added a commit to Huang-Shuyang/dtformats that referenced this issue Jan 21, 2025
1. Corrected the use of the last field of DestList entry in version 3+ and added the Property Sheet field
2. Added information about DestList version 5 & 6
3. Fixed a typo and a formatting error

Related issue: libyal#31
@Huang-Shuyang
Copy link
Author

#33

@joachimmetz
Copy link
Member

Sorry to interrupt, but there's one more issue:

noworries take your time, the goal of this project is to study / document data formats

I didn't upload a sample due to privacy concerns. If you need one, I'm glad to e-mail it to you.

Please do email can be found here https://github.com/libyal/dtformats/blob/main/AUTHORS

@Huang-Shuyang
Copy link
Author

The email (with the subject "A Sample of AutoDest File with Property Sheet") has been sent at 01-24-2025 01:07 AM GMT+8. If it can't be found in the inbox, it might be classified as junk mail.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants