WIN7 SHD文件格式

最新推荐文章于 2024-07-30 16:15:02 发布

binzhongbi757

最新推荐文章于 2024-07-30 16:15:02 发布

阅读量4.3k

点赞数 1

分类专栏： IT 文章标签： win7 SHD File Format

本文链接：https://blog.csdn.net/binzhongbi757/article/details/38399073

版权

IT 专栏收录该内容

17 篇文章 0 订阅

订阅专栏

SHD - 即Windows Shadow FIle ，WIN98/NT/2000/XP/2003的SHD文件格式在 http://www.undocprint.org/formats/winspool/shd 已有描述。WIN7下SHD文件格式略有差异，如下图：

00002.SHD为WIN7的SHD文件，00003.SHD为WIN2003的SHD文件。观察结果：第一行是一致的，第4~7字节记录头长度，WIN7下是0XD0，即208，WIN2003是0X78，即120，相差88字节。WIN2003的SHD文件格式从第17字节开始有22个DWORD型数据（4字节），由此推测WIN7下这些数据为8字节。实际测试与推测相符，WIN7的SHD文件头文件格式可如此表示：

//SHD文件结构体 WIN7
typedef struct _SHADOW_FILE_HEADER_WIN7 {
	DWORD dwSignature;        //SHD_SIGNATURE_WIN7
	DWORD dwHeaderSize;
	WORD wStatus;
	WORD wUnknown1;
	DWORD dwJobID;
	UINT64 dwPriority;
	UINT64 offUserName;        //Offset of WideChar+0
	UINT64 offNotifyName;      //Offset of WideChar+0
	UINT64 offDocumentName;    //Offset of WideChar+0
	UINT64 offPort;            //Offset of WideChar+0
	UINT64 offPrinterName;     //Offset of WideChar+0
	UINT64 offDriverName;      //Offset of WideChar+0
	UINT64 offDevMode;         //Offset of DEVMODE
	//Note that the dmCopies in this structure will hold
	//the wrong value when the Microsoft Word multiple 
	//copies bug occurs.
	//In this case use the dmCopies from the SPL file
	UINT64 offPrintProcessor;  //Offset of WideChar+0
	UINT64 offDataFormat;      //Offset of WideChar+0
	UINT64 dwUnknown2;
	SYSTEMTIME stSubmitTime;
	UINT64 dwStartTime;
	UINT64 dwUntilTime;
	UINT64 dwUnknown6;          
	UINT64 dwPageCount;
	UINT64 dwSizeSecurityInfo; //Size of SecurityInfo
	UINT64 offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
	UINT64 dwUnknown3;
	UINT64 dwUnknown4;
	UINT64 dwUnknown5;
	UINT64 offComputername;    //Offset of WideChar+0
	UINT64 dwSPLSize;          //Size of SPL File
} SHADOW_FILE_HEADER_WIN7, *PSHADOW_FILE_HEADER_WIN7;

----------------------------------

2015.11.10更新，上面的结构体后半部分存在问题，更新一下。WIN7 SHD头部长度为0XD0，而旧的系统（如WIN2000/2003）的头部长度为0X78。

//SHD文件结构体 WIN7
typedef struct _SHADOW_FILE_HEADER_WIN7 {
	DWORD dwSignature;        //SHD_SIGNATURE_WIN7
	DWORD dwHeaderSize;
	WORD wStatus;
	WORD wUnknown1;
	DWORD dwJobID;
	UINT64 dwPriority;
	UINT64 offUserName;        //Offset of WideChar+0
	UINT64 offNotifyName;      //Offset of WideChar+0
	UINT64 offDocumentName;    //Offset of WideChar+0
	UINT64 offPort;            //Offset of WideChar+0
	UINT64 offPrinterName;     //Offset of WideChar+0
	UINT64 offDriverName;      //Offset of WideChar+0
	UINT64 offDevMode;         //Offset of DEVMODE
	//Note that the dmCopies in this structure will hold
	//the wrong value when the Microsoft Word multiple 
	//copies bug occurs.
	//In this case use the dmCopies from the SPL file
	UINT64 offPrintProcessor;  //Offset of WideChar+0
	UINT64 offDataFormat;      //Offset of WideChar+0
	UINT64 dwUnknown2;
	SYSTEMTIME stSubmitTime;
	UINT32 dwStartTime; 
	UINT32 dwUntilTime;
	UINT32 dwUnknown6;          
	UINT32 dwPageCount;
	UINT64 dwSizeSecurityInfo; //Size of SecurityInfo
	UINT64 offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
	UINT32 dwUnknown3;
	UINT32 dwUnknown4;
	UINT64 dwUnknown5;
	UINT64 offComputername;    //Offset of WideChar+0
	UINT64 dwSPLSize;          //Size of SPL File
	UINT64 offUserID;
	UINT64 dwUnknown7;
	UINT64 dwUnknown8;
} SHADOW_FILE_HEADER_WIN7, *PSHADOW_FILE_HEADER_WIN7;