Detect wim format

Question

Hello,

According to the magic numbers mentioned here:

https://en.wikipedia.org/wiki/Windows_Imaging_Format

I'm reading the initial 11 bytes of files to find if it's wim format:

{&H4D, &H53, &H57, &H49, &H4D, &H5C, &H30, &H5C, &H30, &H5C, &H30}

I tested it against a Windows.iso image > sources\install.wim and it does not match, any help please?

Answer 1

Hi @Peter Volz ,

According to the wiki List of file signatures, the Magic number of WIM filr type is 4D 53 57 49 4D 00 00 00 D0 00 00 00 00 .

    Function IsWimFile(filename As String) As Boolean
        Dim magicNumber As Byte() = {&H4D, &H53, &H57, &H49, &H4D, &H0, &H0, &H0, &HD0, &H0, &H0, &H0, &H0}
        Try
            Using fileStream As New FileStream(filename, FileMode.Open, FileAccess.Read)
                Dim header(magicNumber.Length - 1) As Byte
                fileStream.Read(header, 0, header.Length)
                Return header.SequenceEqual(magicNumber)
            End Using
        Catch ex As Exception
            Console.WriteLine("An error occurred: " & ex.Message)
            Return False
        End Try
    End Function

Best Regards.

Jiachen Li

---

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Try another signature: {&H4D, &H53, &H57, &H49, &H4D, &H0, &H0, &H0}.

Or {&H4D, &H53, &H57, &H49, &H4D, &H0, &H0, &H0, &HD0, &H0, &H0, &H0, &H0} according to https://en.wikipedia.org/wiki/List_of_file_signatures.

Answer 3

The official specification is 8-byte fixed char + 4-byte header size + 4-byte version value+...

4D 53 57 49 4D 00 00 00 D0 00 00 00

typedef struct _WIMHEADER_V1_PACKED {
   byte   ImageTag[8]; // "MSWIM\0\0" +\0
   dword  cbSize;      // 0x000000D0 sizeof(WIMHEADER_V1_PACKED)
   dword  dwVersion;
   dword  dwFlags;
   dword  dwCompressionSize;
   byte   gWIMGuid[16];
   word   usPartNumber;
   word   usTotalParts;
   dword  dwImageCount;

   byte	  rhOffsetTable[24];
   byte   rhXmlData[24];
   byte   rhBootMetadata[24];

   dword  dwBootIndex;

   byte   rhIntegrity[24];

   byte   bUnused[60];
} WIMHEADER_V1_PACKED;

ImageTag and cbSize are considered invariant, but dwVersion is not. Therefore, the 13th byte may not be 0x00.