Link

Ever wondered about the layout of shortcut files? Those tiny little buggers with the extension LNK you have probably dozens of on your desktop? For years the format was subject to reverse engineering and speculation. Last year Microsoft finally released an official format specification, documenting this surprisingly complex format. This article is the result of analyzing a typical LNK file with the help of Microsoft’s documentation and information from other sources.

Recently I got into a very interesting discussion with my colleague Nicholas Dille on various aspects of Windows x64. One question he brought up was especially intriguing: knowing about registry redirection, it is not astonishing to find that the 32-bit version of the registry key HKLM\Software\Classes (aka HKCR) gets to be HKLM\Software\Classes\Wow6432Node. But there is also HKLM\Software\Wow6432Node\Classes!? How can there be two different Wow6432Node 32-bit keys for one 64-bit key?