When HasLinkInfo is set, this structure comes next. It records where the target was, so the link can be resolved when the target has moved. Every offset here is from the start of the structure that holds it. All offsets must fall inside it.
LinkInfo
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 4 | LinkInfoSize | The size of the whole structure in bytes. |
| 4 | 4 | LinkInfoHeaderSize | 0x1C: no Unicode offsets follow. 0x24 or more: they do. |
| 8 | 4 | LinkInfoFlags | Bit 0: VolumeIDAndLocalBasePath. Bit 1: CommonNetworkRelativeLinkAndPathSuffix. |
| 12 | 4 | VolumeIDOffset | Where the VolumeID is, or zero when bit 0 is clear. |
| 16 | 4 | LocalBasePathOffset | Where the local path is, or zero when bit 0 is clear. |
| 20 | 4 | CommonNetworkRelativeLinkOffset | Where the network link is, or zero when bit 1 is clear. |
| 24 | 4 | CommonPathSuffixOffset | Where the common path suffix is. |
| 28 | 4 | LocalBasePathOffsetUnicode | Present when LinkInfoHeaderSize is 0x24 or more. |
| 32 | 4 | CommonPathSuffixOffsetUnicode | Present when LinkInfoHeaderSize is 0x24 or more. |
After the offsets, and in the places they name:
| Name | Description |
|---|---|
VolumeID | The volume the target was on, when bit 0 is set. |
LocalBasePath | The path up to the common suffix, in the system code page, zero-terminated, when bit 0 is set. |
CommonNetworkRelativeLink | The network location, when bit 1 is set. |
CommonPathSuffix | The rest of the path, in the system code page, zero-terminated. The full path is the two strings joined. |
LocalBasePathUnicode | The same base path in UTF-16. |
CommonPathSuffixUnicode | The same suffix in UTF-16. |
VolumeID
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 4 | VolumeIDSize | The size of this structure; must be more than 0x10. |
| 4 | 4 | DriveType | See the table below. |
| 8 | 4 | DriveSerialNumber | The volume’s serial number. |
| 12 | 4 | VolumeLabelOffset | Where a zero-terminated label in the system code page is. If this is 0x14, it is ignored and the Unicode offset is used. |
| 16 | 4 | VolumeLabelOffsetUnicode | Where a zero-terminated UTF-16 label is. Present only when VolumeLabelOffset is 0x14. |
| … | varies | Data | The label. |
| Value | Drive type | Meaning |
|---|---|---|
| 0 | DRIVE_UNKNOWN | The type cannot be determined. |
| 1 | DRIVE_NO_ROOT_DIR | The root path is invalid. |
| 2 | DRIVE_REMOVABLE | Removable media. |
| 3 | DRIVE_FIXED | A hard drive or flash drive. |
| 4 | DRIVE_REMOTE | A network drive. |
| 5 | DRIVE_CDROM | A CD-ROM drive. |
| 6 | DRIVE_RAMDISK | A RAM disk. |
CommonNetworkRelativeLink
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 4 | CommonNetworkRelativeLinkSize | The size of this structure; at least 0x14. |
| 4 | 4 | CommonNetworkRelativeLinkFlags | Bit 0 ValidDevice: the device name offset is set. Bit 1 ValidNetType: the provider type is set. |
| 8 | 4 | NetNameOffset | Where the share path is. |
| 12 | 4 | DeviceNameOffset | Where the device name is, or zero. |
| 16 | 4 | NetworkProviderType | See below. |
| 20 | 4 | NetNameOffsetUnicode | Present when NetNameOffset is more than 0x14. |
| 24 | 4 | DeviceNameOffsetUnicode | Present when NetNameOffset is more than 0x14. |
| … | varies | NetName | A share path, such as \\server\share, in the system code page. |
| … | varies | DeviceName | A device, such as D:. |
| … | varies | NetNameUnicode | The same share path in UTF-16. |
| … | varies | DeviceNameUnicode | The same device in UTF-16. |
The provider type is a WNNC_NET_ value. MS-SHLLINK lists 41 of them, from
0x001A0000 (AVID) to 0x00430000 (GOOGLE).
Among them are 0x002E0000 (DAV), 0x003B0000
(DFS), 0x00360000 (TERMSRV) and
0x00420000 (MS_NFS).