PIF file format: Sections

After the classic header, a PIF holds a chain of named sections. Each has a 22-byte heading giving its name and where its data is. A program reads along the chain until it finds a section it knows. Microsoft did not publish these layouts; the 386 and 286 sections follow Dr. Dobb’s Journal, and the sizes and strings below were checked against 130 real files.

Section heading

0Name a zero-terminated name16
16Next heading a file offset, or FFFF at the end2
18Data offset a file offset2
20Data size in bytes2

A section heading.

The first heading is always at offset 0x171 and named MICROSOFT PIFEX. Its data offset is 0 and its size 0x171: it stands for the classic header, which has no heading of its own. Finding this name at 0x171 is how a Windows PIF is recognised.

The sections

Name	Data size	For	On this site
`MICROSOFT PIFEX`	0x171	Standing for the classic header	Classic header
`WINDOWS 386 3.0`	0x68	Windows 386 enhanced mode	Fields below
`WINDOWS 286 3.0`	6	Windows standard mode	Fields below
`WINDOWS NT 3.1`	0x8C, or 0x8E	Windows NT	Partly below
`WINDOWS VMM 4.0`	0x1AC	Windows 95	Partly below
`WINDOWS NT 4.0`	0x68C	Windows NT 4.0	Not described here

Note the two spaces in the Windows NT names. Other section names have been recorded by other sources, but none is described here.

WINDOWS 386 3.0

Offset	Size	Name	Description
0	2	Memory limit	In KB. `FFFF` means as much as possible.
2	2	Memory required	In KB.
4	2	Foreground priority	The program’s share of the processor when it has the focus.
6	2	Background priority	The share when it does not.
8	2	EMS maximum	Expanded memory it may use, in KB.
10	2	EMS minimum	Expanded memory it needs, in KB.
12	2	XMS maximum	Extended memory it may use, in KB.
14	2	XMS minimum	Extended memory it needs, in KB.
16	2	386 flags	See below.
18	2	Memory flags	Bit 0 XMS locked, 1 fast paste allowed, 2 lock application memory.
20	2	Video flags	See below.
22	2	Reserved	Zero.
24	2	Hot key scan code	The scan code of the application hot key.
26	2	Hot key state	Bit 0 Shift, bit 2 Ctrl, bit 3 Alt.
28	2	Hot key flag	Not established.
30	10	Reserved	Zero.
40	64	Optional parameters	Parameters, used instead of those in the classic header.

386 flags bit	Name
0	Allow close when active
1	Background execution
2	Exclusive
3	Full screen
5	Reserve Alt+Tab
6	Reserve Alt+Esc
7	Reserve Alt+Space
8	Reserve Alt+Enter
9	Reserve Alt+PrtSc
10	Reserve PrtSc
11	Reserve Ctrl+Esc
12	Detect idle time
13	Use the high memory area
15	EMS locked

Video flags bit	Name
0	Emulate text
1	Monitor text
2	Monitor medium graphics
3	Monitor high graphics
4	Initialise in text mode
5	Initialise in medium graphics
6	Initialise in high graphics
7	Retain video memory

WINDOWS 286 3.0

Offset	Size	Name	Description
0	2	XMS limit	Extended memory it may use, in KB.
2	2	XMS required	Extended memory it needs, in KB.
4	1	286 flags	Bit 0 Alt+Tab, 1 Alt+Esc, 2 Alt+PrtSc, 3 PrtSc, 4 Ctrl+Esc, 5 save screen.
5	1	COM ports	Bit 6 COM3, bit 7 COM4.

WINDOWS NT 3.1

Only the two paths below are described here.

Offset	Size	Name	Description
0	12	Not established
12	64	CONFIG file	The file NT uses in place of CONFIG.SYS for the program, named in a zero-terminated path.
76	64	AUTOEXEC file	The file NT uses in place of AUTOEXEC.BAT, named in a zero-terminated path.

In most files checked, this section is two bytes longer than the fields above.

WINDOWS VMM 4.0

Only the strings below are described here; the rest of the section is not. In the files checked, the text strings sit at these fixed offsets.

Offset	Size	Name	Description
0x58	80	Icon file	The file holding the program’s icon, such as a `.DLL` or `.EXE`.
0xA8	2	Icon index	The icon’s number in that file.
0xEA	32	Bitmap font name	A font name.
0x10A	32	TrueType font name	A font name.