Applications with the same issue:
- 7-Zip
- COMODO Internet Security (icon is correct, path is not correct)
- Far Manager 2 x64
- Microsoft Mathematics
- TortoiseSVN
- All games here: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
Say, if I search for "minesweeper", icon is broken, and game even can't launch.
- All shortcuts here: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
- Part of shortcuts here: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
Let's take a closer look at .lnk contents of "bad" link using link parser [1] or [2]. Not relevant fields are excluded.
[Filename]: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SecureFX 7.1\SecureFX 7.1.lnk
[Header]
Icon index: 0
ShowWindow value: 1 (SW_SHOWNORMAL / SW_NORMAL)
Hot key value: 0x0000 (None)
Link flags: 0x0000008b (HasLinkTargetIDList, HasLinkInfo, HasRelativePath, IsUnicode)
[Link Target ID List]
...
[Link Info]
Location flags: 0x00000001 (VolumeIDAndLocalBasePath)
Drive type: 3 (DRIVE_FIXED)
Drive serial number: 368f-2269
Volume label (ASCII): MainSDD
Local path (ASCII): C:\Program Files\VanDyke Software\Clients\SecureFX.exe
[String Data]
Relative path (UNICODE): ..\..\..\..\..\..\Program Files\VanDyke Software\Clients\SecureFX.exe
[Known Folder Location]
Known folder GUID: 905e63b6-c1bf-494e-b29c-65b732d3d21a = ProgramFiles
First child segment offset: 141 bytes
[Metadata Property Store]
Property set GUID: 46588ae2-4cbc-4338-bbfc-139326986dce
ID: 4
Value: 0x001f (VT_LPWSTR) S-1-5-18
[Special Folder Location]
Special folder identifier: 38 (ProgramFiles)
First child segment offset: 141 bytes
Special folder "ProgramFiles" is specified for link. But this variable has different meaning depending on 32- or 64-bit application [3]. On 64-bit OS in 64-bit application FOLDERID_ProgramFiles= %SystemDrive%\Program Files, but in 32-bit application FOLDERID_ProgramFiles = %SystemDrive%\Program Files (x86). That's why link resolves incorrectly in FARR and in any other 32-bit file explorer.
Need to remove KNOWNFOLDERID from shortcut to fix the link. (Also specifying "ProgramFilesX86" will make link correct for uncertain reason).
If you want to get correct icon and path, it is possible. You should ignore Special Folder section, and use just other Icon and Path sections. Here is example of minimal correct link to 64-bit application:
[Filename]: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vovoid VSXu\VSXu Player.lnk
[Header]
Date created: Unknown
Last accessed: Unknown
Last modified: Unknown
File size: 0 bytes
File attributes: 0x00000000 (None)
Icon index: 0
ShowWindow value: 1 (SW_SHOWNORMAL / SW_NORMAL)
Hot key value: 0x0000 (None)
Link flags: 0x00000099 (HasLinkTargetIDList, HasRelativePath, HasWorkingDir, IsUnicode)
[Link Target ID List]
CLSID: 20d04fe0-3aea-1069-a2d8-08002b30309d = My Computer
Drive: C:\
Folder attributes: 0x00000010 (FILE_ATTRIBUTE_DIRECTORY)
Short directory name: Program Files
Long directory name: Program Files
Folder attributes: 0x00000010 (FILE_ATTRIBUTE_DIRECTORY)
Short directory name: Vovoid VSXu
Long directory name: Vovoid VSXu
File size: 0 bytes
File attributes: 0x00000000 (None)
8.3 filename: vsxu_player.exe
Long filename: vsxu_player.exe
[String Data]
Relative path (UNICODE): ..\..\..\..\..\..\Program Files\Vovoid VSXu\vsxu_player.exe
Working Directory (UNICODE): C:\Program Files\Vovoid VSXu
[Metadata Property Store]
Property set GUID: 46588ae2-4cbc-4338-bbfc-139326986dce
You can use "Link Target ID" or "Relative path" to find path to executable, and use "Icon Location" and "Icon Index" section for icon. More about lnk file format is in PDF documents [4].
Shortcuts to games from Game Manager fail for different reason. But if you want to support games too, it is possible. Take a look in .lnk and find magic id "GFSI". Next 16 bytes is GUID of game in Game Explorer in little-endian form. Example:
0000000060: 0D 52 20 00 00 00 47 46 │ 53 49 C0 79 15 E9 A9 4E ♪R GFSIАy§й©N
0000000070: 2A 4A A9 B2 04 BE F1 D6 │ DC 29 00 00 00 00 00 00 *J©І♦ѕсЦЬ)
Hex is:
C0 79 15 E9...
GUID is
E91579C0-4EA9-4a2a-A9B2-04BEF1D6DC29
All details (path, icon, etc) can be found here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{E91579C0-4EA9-4a2a-A9B2-04BEF1D6DC29}
More about this format is in lnk specification [5].
Game Manager is used not only for standard games, but also for third party games like StarCraft II Wings of Liberty™.lnk etc, that's why support of games shortcuts is important. Maybe there is some API to get link informations for games.
Some shortcuts in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance or ...\Accessories don't work, because they link to files like %systemroot%\system32\recdisc.exe, but in 32-bit application %systemroot%\system32 is replaced by %systemroot%\SysWOW64, and target applications are not there. You can fix this at link resolving time.
[1] LNK Parser -
http://code.google.c...arser/downloads/list[2] Windows LNK Parsing Utility -
http://www.tzworks.n...page.php?proto_id=11[3] KNOWNFOLDERID (bottom of page)
http://msdn.microsof...57%28v=vs.85%29.aspx[4] liblnk library and documentation -
http://code.google.c...iblnk/downloads/list[5] Windows Shell Item format -
http://liblnk.google...%20Item%20format.pdfOther used references:
- Quick overview of Lnk File Format and Ways of Information Extraction -
https://www.evernote...663f/wishi/crazylazy- LNK format -
http://www.forensicswiki.org/wiki/LNK- LNK Parsing: You’re doing it wrong (I, II) -
http://blog.0x010000...re-doing-it-wrong-i/ ,
http://blog.0x010000...e-doing-it-wrong-ii/- Evidentiary Value of Link Files | ForensicFocus.com -
http://www.forensicf...le-evidentiary-value