2.1 ShellLinkHeader

The ShellLinkHeader structure contains identification information, timestamps, and flags that specify the presence of optional structures, including LinkTargetIDList (section 2.2), LinkInfo (section 2.3), and StringData (section 2.4).


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

HeaderSize

LinkCLSID (16 bytes)

...

...

LinkFlags

FileAttributes

CreationTime

...

AccessTime

...

WriteTime

...

FileSize

IconIndex

ShowCommand

HotKey

Reserved1

Reserved2

Reserved3

HeaderSize (4 bytes): The size, in bytes, of this structure. This value MUST be 0x0000004C.

LinkCLSID (16 bytes): A class identifier (CLSID). This value MUST be 00021401-0000-0000-C000-000000000046.

LinkFlags (4 bytes): A LinkFlags structure (section 2.1.1) that specifies information about the shell link and the presence of optional portions of the structure.

FileAttributes (4 bytes): A FileAttributesFlags structure (section 2.1.2) that specifies information about the link target.

CreationTime (8 bytes): A FILETIME structure ([MS-DTYP] section 2.3.3) that specifies the creation time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is no creation time set on the link target.

AccessTime (8 bytes): A FILETIME structure ([MS-DTYP] section 2.3.3) that specifies the access time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is no access time set on the link target.

WriteTime (8 bytes): A FILETIME structure ([MS-DTYP] section 2.3.3) that specifies the write time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is no write time set on the link target.

FileSize (4 bytes): A 32-bit unsigned integer that specifies the size, in bytes, of the link target. If the link target file is larger than 0xFFFFFFFF, this value specifies the least significant 32 bits of the link target file size.

IconIndex (4 bytes): A 32-bit signed integer that specifies the index of an icon within a given icon location.

ShowCommand (4 bytes): A 32-bit unsigned integer that specifies the expected window state of an application launched by the link. This value SHOULD be one of the following.

Value

Meaning

SW_SHOWNORMAL

0x00000001

The application is open and its window is open in a normal fashion.

SW_SHOWMAXIMIZED

0x00000003

The application is open, and keyboard focus is given to the application, but its window is not shown.

SW_SHOWMINNOACTIVE

0x00000007

The application is open, but its window is not shown. It is not given the keyboard focus.

All other values MUST be treated as SW_SHOWNORMAL.

HotKey (2 bytes): A HotKeyFlags structure (section 2.1.3) that specifies the keystrokes used to launch the application referenced by the shortcut key. This value is assigned to the application after it is launched, so that pressing the key activates that application.

Reserved1 (2 bytes): A value that MUST be zero.

Reserved2 (4 bytes): A value that MUST be zero.

Reserved3 (4 bytes): A value that MUST be zero.