You should consider using the
IShellLink interface which is a safe way to handle windows shortcuts. If you have a strong reason not to use that interface then I have to remind you that this file format is not documented by Microsoft. I cannot say that the info gathered here is accurate nor that it will work in the future. | .LNK File Format |
| 1. Header |
| 2. Shell Item Id List |
| 3. File Location Info |
| 4. Description |
| 5. Relative Path |
| 6. Working Directory |
| 7. Command Line Arguments |
| 8. Icon Filename |
| 9. Additonal Info |
| Size | Contents | Description |
| 4 bytes | Always 4C 00 00 00 | This is how windows knows it is a shortcut file |
| 16 bytes | GUID for shortcut files | The current GUID for shortcuts. It may change in the future. 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 46 |
| 1 dword | Shortcut flags | Shortcut flags are explained below |
| 1 dword | Target file flags | Flags are explained below |
| 1 qword | Creation time | |
| 1 qword | Last access time | |
| 1 qword | Modification time | |
| 1 dword | File length | The length of the target file. 0 if the target is not a file. This value is used to find the target when the link is broken. |
| 1 dword | Icon number | If the file has a custom icon (set by the flags bit 6), then this long integer indicates the index of the icon to use. Otherwise it is zero. |
| 1 dword | Show Window | the ShowWnd value to pass to the target application when starting it. 1:Normal Window 2:Minimized 3:Maximized |
| 1 dword | Hot Key | The hot key assigned for this shortcut |
| 1 dword | Reserved | Always 0 |
| 1 dword | Reserved | Always 0 |
| Bit | Meaning |
| 0 | Shell item id list is present |
| 1 | Target is a file or directory |
| 2 | Has a description |
| 3 | Has a relative path |
| 4 | Has a working directory |
| 5 | Has command line arguments |
| 6 | Has a custom icon. |
| Bit | Meaning |
| 0 | Target is read only. |
| 1 | Target is hidden. |
| 2 | Target is a system file. |
| 3 | Target is a volume label. (Not possible) |
| 4 | Target is a directory. |
| 5 | Target has been modified since last backup. (archive) |
| 6 | Target is encrypted (NTFS partitions) |
| 7 | Target is Normal |
| 8 | Target is temporary. |
| 9 | Target is a sparse file. |
| 10 | Target has reparse point data. |
| 11 | Target is compressed. |
| 12 | Target is offline. |
Last Access and Modified time offsets corrected thanks to JimmyW
Shell Item Id List
Note: This section exists only if the first bit for shortcut flags is set the header section. If that bit is not set then this section does not exists.
The first word contains the size of the list in bytes. Each item (except the last) in the list contains its size in a word fallowed by the content. The size includes and the space used to store it. The last item has the size 0. These items are used to store various informations. For more info read the SHITEMID documentation.
File Location Info
This section is always present, but if bit 1 is not set in the flags value, then the length of this section will be zero. The header of this section is described below.
| Size | Description |
| 1 dword | This length value includes all the assorted pathnames and other data structures. All offsets are relative to the start of this section. |
| 1 dword | The offset at which the basic file info structure ends. Should be 1C. |
| 1 dword | File available on local volume (0) or network share(1) |
| 1 dword | Offset to the local volume table. |
| 1 dword | Offset to the base path on the local volume. |
| 1 dword | Offset to the network volume table. |
| 1 dword | Offset to the final part of the pathname. |
Combine the base path string and the final path string to find the filename of the file on the local volume. To find the filename of the file on the network you need to combine the share name in the network volume table with the final path string.
| Size | Description |
| 1 dword | Length of this structure including the volume label string. |
| 1 dword | Type of volume (code below) |
| 1 dword | Volume serial number |
| 1 dword | Offset of the volume name (Always 0x10) |
| ASCIZ | Volume label |
| Code | Description |
| 0 | Unknown |
| 1 | No root directory |
| 2 | Removable (Floppy, Zip ...) |
| 3 | Fixed (Hard disk) |
| 4 | Remote (Network drive) |
| 5 | CD-ROM |
| 6 | Ram drive |
| Size | Description |
| 1 dword | Length of this structure |
| 1 dword | Always 02 |
| 1 dword | Offset of network share name (Always 0x14) |
| 1 dword | Reserved 0 |
| 1 dword | Always 0x20000 |
| ASCIZ | Network share name |
Description
This section is present if bit 2 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. It is a description of the item.
Relative path string
This section is present if bit 3 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. It is a relative path to the target.
Working directory
This section is present if bit 4 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. It is the working directory as specified in the shortcut properties.
Command line arguments
This section is present if bit 5 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. The command line string includes everything except the program name.
Icon filename
This section is present if bit 6 is set in the flags value in the header. The first word value indicates the length of the string. Following the length value is a string of ASCII characters. This the name of the file containing the icon.
Additonal Info Usualy consists of a dword with the value 0.