Gültig ab der WinHex-Version 8.3. WHX-Dateien werden einerseits intern von der Rückgängig-Funktion angelegt und benutzt und andererseits als allgemeine Sicherungsdateien auf Befehl des Anwenders erzeugt. Die von WinHex verwalteten WHX-Dateien hatten früher alle einen Namen der Form Saved###.whx, inzwischen einfach ###.whx, wobei ### eine dreistellige Zahl ist. WHX-Dateien können Sicherungen von Dateien oder Datenträger-Sektoren enthalten.
Das WHX-Dateiformat wurde mit dem Vorsatz der Auf- und Abwärtskompatibilität entwickelt. Die optionale ExtraField-Sektion schafft Raum für zukünftige Erweiterungen. Nicht unterstützte Elemente im ExtraField werden souverän gehandhabt (d. h. ignoriert). Der WHX-Standard ist ein offener Standard; jedermann darf Software entwickeln, die WHX-Dateien liest oder schreibt, sofern die folgenden Bedingungen erfüllt werden:
Diese Dokumentation des WHX-Formats soll die Interoperabilität fördern. Durch die Veröffentlichung einer formalen Definition sollen sich andere Entwickler ermutigt fühlen, austauschfähige Produkte zu schaffen. Die Offenheit des Standards soll das Vertrauen darin bestärken.
Offset (0X) | Type | Element | Description | ||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
0 | char[15] | Signature |
ASCII characters WHX Backup v1.0 + 0X00. Applications that read from WHX files should compare ten characters (WHX Backup) to acknowledge the WHX format. | ||||||||||||||||||||||||||||||||||
10 | char[255] | Name | Contains the name of the original file, including its path. Null-terminated. If the WHX file contains the backup of a sector (ObjectType != 0), Name specifies the sector number and the drive, preferably of the following form: Drive #: \Sector #. | ||||||||||||||||||||||||||||||||||
110 | 16 bit | DescrLen | The number of ASCII characters in Descr. May be zero. | ||||||||||||||||||||||||||||||||||
112 | char[DescrLen] | Descr | Contains the optional description of the backup (currently only used if UndoType == 1). Not null-terminated. Detailed descriptions can also be added as appropriate chunks within ExtraField. | ||||||||||||||||||||||||||||||||||
112+DescrLen | 8 bit | Reserved | Reserved. Must be zero. | ||||||||||||||||||||||||||||||||||
113+DescrLen | signed 8 bit | ObjectType | Determines whether the WHX file is a backup of a file or of a disk sector. Must be zero for files. A positive non-zero value designates a logical drive (A=1, B=2, C=3, ...). A negative value indicates a physical drive (0X00=-1, 0X01=-2, 0X80=-3, 0X81=-4, ...). | ||||||||||||||||||||||||||||||||||
114+DescrLen | signed 64 bit | FSize | The size of the original file in bytes. In case ObjectType != 0 FSize specifies the sector size (typically 512). | ||||||||||||||||||||||||||||||||||
11C+DescrLen | 32 bit | SectorNo | Designates the sector number in case of ObjectType != 0, otherwise equal to zero. | ||||||||||||||||||||||||||||||||||
120+DescrLen | 32 bit | #Sectors | Designates the number of continuous sectors stored in the WHX file in case of ObjectType != 0, otherwise equal to zero. | ||||||||||||||||||||||||||||||||||
124+DescrLen | 2× signed 64 bit |
BlockLimits | The limits of the block (=selection) defined upon the file when the backup was created (beginning and end offset). If no block was defined, the beginning offset is equal to zero and the end offset is equal to -1. | ||||||||||||||||||||||||||||||||||
134+DescrLen | signed 32 bit | FileID | A unique identifier of the original file. This value is designated solely for internal use by the program that created the WHX file. It has no external meaning. May be zero for programs other than WinHex. | ||||||||||||||||||||||||||||||||||
138+DescrLen | signed 32 bit | InstanceID | A unique identifier of the program session (=instance) that created the WHX file. This value is for internal use by this program only and has no external meaning. May be zero for programs other than WinHex. | ||||||||||||||||||||||||||||||||||
13C+DescrLen | 8 bit | UndoType | Describes the nature of the backup. Currently the following
values are defined:
|
||||||||||||||||||||||||||||||||||
13D+DescrLen | 8 bit | PrevUndoType | Describes the nature of the previous backup that was created internally (i. e. UndoType > 1) for the same file. If there is none, PrevUndoType is equal to zero. | ||||||||||||||||||||||||||||||||||
13E+DescrLen | 8 bit | Reserved | Reserved. Must be zero. | ||||||||||||||||||||||||||||||||||
13F+DescrLen | 8 bit boolean | IsModified | True, if the file was altered since it was last saved, otherwise false. | ||||||||||||||||||||||||||||||||||
140+DescrLen | signed 16 bit | UndoLevel | The undo level designates the number of previous modification steps that can be undone, provided that the corresponding backup files still exist. Initially it is equal to zero. The value of -1 indicates that UndoLevel is of no interest. | ||||||||||||||||||||||||||||||||||
142+DescrLen | FILETIME | CreationTime | A FILETIME structure containing the time the original file was created (a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0. | ||||||||||||||||||||||||||||||||||
14A+DescrLen | FILETIME | LastWriteTime | This FILETIME structure contains the time that the original file was last written to (a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0. | ||||||||||||||||||||||||||||||||||
152+DescrLen | 32 bit | KeyInputSize | Determines the size of the following KeyInput field. May be zero. | ||||||||||||||||||||||||||||||||||
156+DescrLen | (internal) | KeyInput | Data for reversing keyboard inputs. Optional. The data format is internally defined by WinHex and is subject to change. | ||||||||||||||||||||||||||||||||||
156+DescrLen +KeyInputSize | 32 bit | ExtraFieldSize | The number of bytes in Extrafield. May be zero. | ||||||||||||||||||||||||||||||||||
15A+DescrLen +KeyInputSize | variable chain of chunks | ExtraField | This optional section is designed for additional data of various formats. Each chunk in this section contains a format identifier (2 bytes), the data size in bytes (2 bytes) and the chunk data itself. The overall size of ExtraField must be carefully calculated and specified in ExtraFieldSize. Valid chunk formats are described below. Chunks should be sorted numerically by their format identifiers. In case the ExtraField exists, it must be terminated with an ending chunk (ID 65535). | ||||||||||||||||||||||||||||||||||
15A+DescrLen +KeyInputSize +ExtraFieldSize | - | WHXData | ObjectType == 0: The original file contents, FSize bytes. ObjectType != 0: The original contents of the sector(s), (#Sectors×FSize) bytes. May be stored compressed (ExtraField chunk ID 256) and/or encrypted (ExtraField chunk ID 512). |
Valid ExtraField chunk formats:
Format Identifier | Size (Bytes) |
Type | Description | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
1 | 4 | 32 bit | File system attributes of the original file. Currently not in use. | ||||||||
2 | 8 | 64 bit | Size of the WHX file in bytes. Currently not in use. | ||||||||
3 | 8 | FILETIME | This FILETIME structure specifies the time the WHX file was created. Currently not in use. | ||||||||
4 | 4 | 32 bit | Contains the serial number of the disk the original file/sector was taken from. Currently not in use. | ||||||||
5+6 | undefined | not yet defined | Reserved | ||||||||
7 | 4 | 32-bit int | Previously (WinHex 10.52 and before) used for 32-bit standard checksum, now reserved. | ||||||||
8 | undefined | not yet defined | Reserved | ||||||||
9 | 4 | 32-bit int | Previously (WinHex 10.52 and before) used for CRC32, now reserved. | ||||||||
10 | undefined | not yet defined | Reserved | ||||||||
11 | 1 | 8-bit int | 8-bit standard checksum of the original file (sum of all bytes on an 8-bit accumulator). In use. | ||||||||
12 | 1 | 16-bit int | 16-bit standard checksum. In use. | ||||||||
13 | 1 | 32-bit int | 32-bit standard checksum. In use. | ||||||||
14 | 1 | 64-bit int | 64-bit standard checksum. In use. | ||||||||
15 | 2 | 16-bit int | 16-bit CRC checksum of the original file. Polynomial = 0X8005, initial value = 0X0000. In use. | ||||||||
16 | 4 | 32-bit int | 32-bit CRC checksum of the original file. Polynomial: x^32 + x^26 + x^23 + x^22 + x^16 + x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x + 1 (=0XEDB88320), initial value: 0XFFFFFFFF. Compatible with CRCs used in ZIP and zmodem protocol. In use. | ||||||||
17 | 16 | 128 bit | The common 128-bit MD5 message digest. In use. | ||||||||
18 | 16 | 160 bit | SHA-1 digest (160 bit). In use. | ||||||||
19 | 16 | 256 bit | SHA-256 digest (256 bit). In use. | ||||||||
20 | 32 | 256 bit | A 256-bit digest of the original file, created by the Pukall stream cipher hash function (PSCHF) with the following 128-bit key: F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38. In use. | ||||||||
21-31 | undefined | not yet defined | Reserved for other kinds of checksums (CRC48, Adler32, ...). Currently not in use. | ||||||||
32 | 32 | 256 bit | Previously (WinHex 10.52 and before) used for PSCHF, now reserved. | ||||||||
33 | 16 | 128 bit | Previously (WinHex 10.52 and before) used for MD5, now reserved. | ||||||||
34-63 | undefined | not yet defined | Reserved for other kinds of digests. Currently not in use. | ||||||||
64-255 | undefined | not yet defined | Reserved for miscellaneous purposes. Currently not in use. | ||||||||
256 | 4 | 32 bit | Specifies the compression algorithm in case the
original file contents (at the end of the WHX file) is compressed. In use.
|
||||||||
257-511 | undefined | not yet defined | Reserved for further information on compression status. Currently not in use. | ||||||||
512 | 4 | 32 bit | Specifies the encryption algorithm in case the
original file contents (at the end of the WHX file) is encrypted. In use.
If the original file contents is both compressed and encrypted, it was first compressed
and then encrypted. Therefore the restoration order must be 1. decryption, 2.
decompression.
|
||||||||
513 | 16 | 128 bit | Random input used by encryption algorithm 1 (cf. ID 512, 514). In use. | ||||||||
514 | 32 | 256 bit | A 256-bit digest that is used to determine
whether a password, specified by the user for decryption, is correct or not. The Pukall
Stream Cipher hash function (short: PSCHF(DataToBeHashed, Key)) is called several times to
calculate this PasswordVerificationTestDigest. In use. Hash_1 = PSCHF(OrigPassword, FixedKey); // 256 bit |
||||||||
515-767 | undefined | not yet defined | Reserved for further information on encryption status. Currently not in use. | ||||||||
768 | 2 | 16 bit | Designates the program that created the WHX file. Currently
not in use. Please note that programs other than WinHex may specify zero for any
WinHex-specific elements of the WHX format (such as InstanceID, FileID and #KeyInputs).
|
||||||||
769 | 2 | 16 bit | Designates the version of the program that created the WHX file. The high-order byte specifies the minor version (revision) number. The low-order byte specifies the major version number. Currently not in use. | ||||||||
770 | variable (n) | char[n] | String specifying the name of the program that created the WHX file. May also contain a version number. Currently not in use. | ||||||||
771 | variable (n) | char[n] | String providing a textual description of the version number of that program. Currently not in use. | ||||||||
772 | variable (n) | char[n] | String specifying the name of the company that owns the copyright for that program. Currently not in use. | ||||||||
773 | variable (n) | char[n] | String specifying the name of the user who ran the program. Currently not in use. | ||||||||
774 | variable (n) | char[n] | String specifying the creator or copyright owner of the original file. Currently not in use. | ||||||||
775 | variable (n) | char[n] | String describing the type of the original file. Currently not in use. | ||||||||
776 | variable (n) | char[n] | String describing the type of the disk the original file/sector was taken from. Currently not in use. | ||||||||
777 | variable (n) | char[n] | Filename of the next volume if the backup was split (without path). Optional. In use. | ||||||||
778-1023 | undefined | not yet defined | Reserved. Currently not in use. | ||||||||
1024 | 4 | 32-bit int | Internal use by WinHex only. In use. | ||||||||
1025 | variable | (internal) | Internal use by WinHex only. In use. | ||||||||
1026-65534 | undefined | not yet defined | Not yet defined. Currently not in use. | ||||||||
65535 | 0 | - | Terminating chunk. Indicates the end of ExtraField. Required. In use. |
The latest version of this document is available at http://www.winhex.com. The algorithms Pukall Cipher 1 (PC 1) and Pukall Stream Cipher Hash Function are copyright by Alexandre Pukall. Source code available at http://www.multimania.com/pc1. The zlib compression library is copyright by Jean-loup Gailly and Mark Adler. Homepage: ftp://ftp.cdrom.com/pub/infozip/zlib/zlib.html
THE INFORMATION PROVIDED ON THIS PAGE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. MUST NOT BE PUBLISHED WITHOUT PRIOR CONSENT OF THE AUTHOR.