【转】快捷方式lnk文件格式详解（英文）

转自：http://www.stdlib.com/art6-Shortcut-File-Format-lnk.html

You should consider using the

IShellLink

interface which is a safe way to handle windows shortcuts. If you have a strong reason not to use that interface then I have to remind you that this file format is not documented by Microsoft. I cannot say that the info gathered here is accurate nor that it will work in the future.

.LNK File Format

1. Header

2. Shell Item Id List

3. File Location Info

4. Description

5. Relative Path

6. Working Directory

7. Command Line Arguments

8. Icon Filename

9. Additonal Info

[align=center]1. Header[/align]

Size	Contents	Description
4 bytes	Always 4C 00 00 00	This is how windows knows it is a shortcut file
16 bytes	GUID for shortcut files	The current GUID for shortcuts. It may change in the future. 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 46
1 dword	Shortcut flags	Shortcut flags are explained below
1 dword	Target file flags	Flags are explained below
1 qword	Creation time
1 qword	Last access time
1 qword	Modification time
1 dword	File length	The length of the target file. 0 if the target is not a file. This value is used to find the target when the link is broken.
1 dword	Icon number	If the file has a custom icon (set by the flags bit 6), then this long integer indicates the index of the icon to use. Otherwise it is zero.
1 dword	Show Window	the ShowWnd value to pass to the target application when starting it. 1:Normal Window 2:Minimized 3:Maximized
1 dword	Hot Key	The hot key assigned for this shortcut
1 dword	Reserved	Always 0
1 dword	Reserved	Always 0

[align=center]Shortcut flags[/align]

Bit	Meaning
0	Shell item id list is present
1	Target is a file or directory
2	Has a description
3	Has a relative path
4	Has a working directory
5	Has command line arguments
6	Has a custom icon.

[align=center]Target flags[/align]

Bit	Meaning
0	Target is read only.
1	Target is hidden.
2	Target is a system file.
3	Target is a volume label. (Not possible)
4	Target is a directory.
5	Target has been modified since last backup. (archive)
6	Target is encrypted (NTFS partitions)
7	Target is Normal
8	Target is temporary.
9	Target is a sparse file.
10	Target has reparse point data.
11	Target is compressed.
12	Target is offline.

Last Access and Modified time offsets corrected thanks to JimmyW

Shell Item Id List

Note: This section exists only if the first bit for shortcut flags is set the header section. If that bit is not set then this section does not exists.

The first

word

contains the size of the list in bytes. Each item (except the last) in the list contains its size in a

word

fallowed by the content. The size includes and the space used to store it. The last item has the size 0. These items are used to store various informations. For more info read the

SHITEMID

documentation.

File Location Info

This section is always present, but if bit 1 is not set in the flags value, then the length of this section will be zero. The header of this section is described below.

Size	Description
1 dword	This length value includes all the assorted pathnames and other data structures. All offsets are relative to the start of this section.
1 dword	The offset at which the basic file info structure ends. Should be 1C.
1 dword	File available on local volume (0) or network share(1)
1 dword	Offset to the local volume table.
1 dword	Offset to the base path on the local volume.
1 dword	Offset to the network volume table.
1 dword	Offset to the final part of the pathname.

Combine the base path string and the final path string to find the filename of the file on the local volume. To find the filename of the file on the network you need to combine the share name in the network volume table with the final path string.

[align=center]The local volume table[/align]

Size	Description
1 dword	Length of this structure including the volume label string.
1 dword	Type of volume (code below)
1 dword	Volume serial number
1 dword	Offset of the volume name (Always 0x10)
ASCIZ	Volume label

[align=center]Type of volumes[/align]

Code	Description
0	Unknown
1	No root directory
2	Removable (Floppy, Zip ...)
3	Fixed (Hard disk)
4	Remote (Network drive)
5	CD-ROM
6	Ram drive

[align=center]The network volume table[/align]

Size	Description
1 dword	Length of this structure
1 dword	Always 02
1 dword	Offset of network share name (Always 0x14)
1 dword	Reserved 0
1 dword	Always 0x20000
ASCIZ	Network share name

Description

This section is present if bit 2 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. It is a description of the item.

Relative path string

This section is present if bit 3 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. It is a relative path to the target.

Working directory

This section is present if bit 4 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. It is the working directory as specified in the shortcut properties.

Command line arguments

This section is present if bit 5 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. The command line string includes everything except the program name.

Icon filename

This section is present if bit 6 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. This the name of the file containing the icon.

Additonal Info Usualy consists of a dword with the value 0.