Skip to content

Latest commit

 

History

History
133 lines (89 loc) · 8.57 KB

README.md

File metadata and controls

133 lines (89 loc) · 8.57 KB
Raw

INI file-format reverse engineering

This place is intended to provide details of the INI file format and INI file APIs as supported by Microsoft.

What is the INI file format?

Basically it's a key-value-store with a few limitations. The intended use looks like this:

[section1]
key1=value1
;next line defines key2
key2=value2
[section2]
;keys can repeat in another section
key1=value1
key2=value2

Straight-forward you may think. But it is a file format that has no specification - which is unfortunate. You can read more on Wikipedia. I will dissect the statements from there as soon as I have enough evidence.

File formats without a real specification seem to be popular again recently (like JSON, Markdown), after we went through a period of potentially over-specified file formats (like XML, of course with DTD only).

Why?

At least to my experience (working full time for three companies), there are still a lot of applications out there that store configuration information in INI files.

Parsing INI files seems trivial and I have written at least three INI file parsers in my life already - and probably none of them was 100% compatible to the INI file format of the Windows API - at least when it comes to humans editing the file in a text editor. They all "worked", sort of.

So, before I implement the next INI file parser, I want to make sure I understand what Microsoft does and provide a compatible implementation, and maybe a configurable one in order to be able to convert files from one INI dialect into another.

How?

For the moment I'll follow the law of the instrument and make progress using the tools I'm familiar with. As there are

  • Visual Studio
  • .NET Framework
  • Unit Tests

This approach should quickly give me some insights.

Later, I could try a few things I'm not overly comfortable with, like

  • C++

  • Reverse Engineering using disassembly in WinDbg

  • Reverse Engineering using IDA Free

at which point I'd certainly appreciate someone of the RCE community. At least I hope that I have found enough evidence before, so that I can always confirm my reverse engineering against the results of the unit tests.

What's the problem?

The problem? Many problems ;-)

Documentation

Analysis of GetPrivateProfileString()

Analysis of WritePrivateProfileString()

Analysis of Comments

Analysis of Registry Redirection

References

Top questions on Stack Overflow regarding INI files:

Methods for reading INI files, focusing on the "private" ones. The non-private ones will only read from c:\windows\win.ini:

The Registry key that maps INI files is at

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping

Implementations

Of course, people have implemented INI parsers already. My implementations are not published, luckily :-)

Giving back to the community

As a result of my research I came across a few things and I can hopefully give back to the community, to whomever is interested. I left my traces here: