WHX-Dateiformat

Format der Backup-Dateien in „WinHex“

Gültig ab der WinHex-Version 8.3. WHX-Dateien werden einerseits intern von der „Rückgängig“-Funktion angelegt und benutzt und andererseits als allgemeine Sicherungsdateien auf Befehl des Anwenders erzeugt. Die von WinHex verwalteten WHX-Dateien hatten früher alle einen Namen der Form „Saved###.whx“, inzwischen einfach „###.whx“, wobei ### eine dreistellige Zahl ist. WHX-Dateien können Sicherungen von Dateien oder Datenträger-Sektoren enthalten.

Das WHX-Dateiformat wurde mit dem Vorsatz der Auf- und Abwärtskompatibilität entwickelt. Die optionale „ExtraField“-Sektion schafft Raum für zukünftige Erweiterungen. Nicht unterstützte Elemente im ExtraField werden souverän gehandhabt (d. h. ignoriert). Der WHX-Standard ist ein offener Standard; jedermann darf Software entwickeln, die WHX-Dateien liest oder schreibt, sofern die folgenden Bedingungen erfüllt werden:

Diese Dokumentation des WHX-Formats soll die Interoperabilität fördern. Durch die Veröffentlichung einer formalen Definition sollen sich andere Entwickler ermutigt fühlen, austauschfähige Produkte zu schaffen. Die Offenheit des Standards soll das Vertrauen darin bestärken.

Offset (0X) Type Element Description
0 char[15]

Signature

ASCII characters “WHX Backup v1.0” + 0X00. Applications that read from WHX files should compare ten characters (“WHX Backup”) to acknowledge the WHX format.
10 char[255] Name Contains the name of the original file, including its path. Null-terminated. If the WHX file contains the backup of a sector (ObjectType != 0), Name specifies the sector number and the drive, preferably of the following form: “Drive #: \Sector #”.
110 16 bit DescrLen The number of ASCII characters in “Descr”. May be zero.
112 char[DescrLen] Descr Contains the optional description of the backup (currently only used if UndoType == 1). Not null-terminated. Detailed descriptions can also be added as appropriate chunks within “ExtraField”.
112+DescrLen 8 bit Reserved Reserved. Must be zero.
113+DescrLen signed 8 bit ObjectType Determines whether the WHX file is a backup of a file or of a disk sector. Must be zero for files. A positive non-zero value designates a logical drive (A=1, B=2, C=3, ...). A negative value indicates a physical drive (0X00=-1, 0X01=-2, 0X80=-3, 0X81=-4, ...).
114+DescrLen signed 64 bit FSize The size of the original file in bytes. In case ObjectType != 0 FSize specifies the sector size (typically 512).
11C+DescrLen 32 bit SectorNo Designates the sector number in case of ObjectType != 0, otherwise equal to zero.
120+DescrLen 32 bit #Sectors Designates the number of continuous sectors stored in the WHX file in case of ObjectType != 0, otherwise equal to zero.
124+DescrLen
signed 64 bit
BlockLimits The limits of the block (=selection) defined upon the file when the backup was created (beginning and end offset). If no block was defined, the beginning offset is equal to zero and the end offset is equal to -1.
134+DescrLen signed 32 bit FileID A unique identifier of the original file. This value is designated solely for internal use by the program that created the WHX file. It has no external meaning. May be zero for programs other than WinHex.
138+DescrLen signed 32 bit InstanceID A unique identifier of the program session (=instance) that created the WHX file. This value is for internal use by this program only and has no external meaning. May be zero for programs other than WinHex.
13C+DescrLen 8 bit UndoType Describes the nature of the backup. Currently the following values are defined:
0 must not be used
1 created for general purposes; default value
2 must not be used
3 created before the block was cut
4 created before clipboard data or zero bytes were pasted
5 created before clipboard data was written
6 created before the block/file was filled
7 created before the block was removed
8 created before the “modify data” command was used
9 created before a replacement
10 created before a routine was applied
11 created before bytes were swapped
12 created before the file was converted
13 created before the file was encrypted
14 created before the file was decrypted
15 created before disk sectors were overwritten
16 created before template editing
13D+DescrLen 8 bit PrevUndoType Describes the nature of the previous backup that was created internally (i. e. UndoType > 1) for the same file. If there is none, PrevUndoType is equal to zero.
13E+DescrLen 8 bit Reserved Reserved. Must be zero.
13F+DescrLen 8 bit boolean IsModified True, if the file was altered since it was last saved, otherwise false.
140+DescrLen signed 16 bit UndoLevel The undo level designates the number of previous modification steps that can be undone, provided that the corresponding backup files still exist. Initially it is equal to zero. The value of -1 indicates that UndoLevel is of no interest.
142+DescrLen FILETIME CreationTime A FILETIME structure containing the time the original file was created (a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0.
14A+DescrLen FILETIME LastWriteTime This FILETIME structure contains the time that the original file was last written to (a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0.
152+DescrLen 32 bit KeyInputSize Determines the size of the following KeyInput field. May be zero.
156+DescrLen (internal) KeyInput Data for reversing keyboard inputs. Optional. The data format is internally defined by WinHex and is subject to change.
156+DescrLen +KeyInputSize 32 bit ExtraFieldSize The number of bytes in “Extrafield”. May be zero.
15A+DescrLen +KeyInputSize variable chain of chunks ExtraField This optional section is designed for additional data of various formats. Each chunk in this section contains a format identifier (2 bytes), the data size in bytes (2 bytes) and the chunk data itself. The overall size of ExtraField must be carefully calculated and specified in ExtraFieldSize. Valid chunk formats are described below. Chunks should be sorted numerically by their format identifiers. In case the ExtraField exists, it must be terminated with an ending chunk (ID 65535).
15A+DescrLen +KeyInputSize +ExtraFieldSize - WHXData ObjectType == 0: The original file contents, FSize bytes.
ObjectType != 0: The original contents of the sector(s), (#Sectors×FSize) bytes.
May be stored compressed (ExtraField chunk ID 256) and/or encrypted (ExtraField chunk ID 512).

 

Valid ExtraField chunk formats:

Format Identifier Size
(Bytes)
Type Description
1 4 32 bit File system attributes of the original file. Currently not in use.
2 8 64 bit Size of the WHX file in bytes. Currently not in use.
3 8 FILETIME This FILETIME structure specifies the time the WHX file was created. Currently not in use.
4 4 32 bit Contains the serial number of the disk the original file/sector was taken from. Currently not in use.
5+6 undefined not yet defined Reserved
7 4 32-bit int Previously (WinHex 10.52 and before) used for 32-bit standard checksum, now reserved.
8 undefined not yet defined Reserved
9 4 32-bit int Previously (WinHex 10.52 and before) used for CRC32, now reserved.
10 undefined not yet defined Reserved
11 1 8-bit int 8-bit standard checksum of the original file (sum of all bytes on an 8-bit accumulator). In use.
12 1 16-bit int 16-bit standard checksum. In use.
13 1 32-bit int 32-bit standard checksum. In use.
14 1 64-bit int 64-bit standard checksum. In use.
15 2 16-bit int 16-bit CRC checksum of the original file. Polynomial = 0X8005, initial value = 0X0000.  In use.
16 4 32-bit int 32-bit CRC checksum of the original file. Polynomial: x^32 + x^26 + x^23 + x^22 + x^16 + x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x + 1 (=0XEDB88320), initial value: 0XFFFFFFFF. Compatible with CRCs used in ZIP and zmodem protocol. In use.
17 16 128 bit The common 128-bit MD5 message digest. In use.
18 16 160 bit SHA-1 digest (160 bit). In use.
19 16 256 bit SHA-256 digest (256 bit). In use.
20 32 256 bit A 256-bit digest of the original file, created by the Pukall stream cipher hash function (PSCHF) with the following 128-bit key: F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38. In use.
21-31 undefined not yet defined Reserved for other kinds of checksums (CRC48, Adler32, ...). Currently not in use.
32 32 256 bit Previously (WinHex 10.52 and before) used for PSCHF, now reserved.
33 16 128 bit Previously (WinHex 10.52 and before) used for MD5, now reserved.
34-63 undefined not yet defined Reserved for other kinds of digests. Currently not in use.
64-255 undefined not yet defined Reserved for miscellaneous purposes. Currently not in use.
256 4 32 bit Specifies the compression algorithm in case the original file contents (at the end of the WHX file) is compressed. In use.
0 not compressed (chunk could be omitted)
1 zlib 1.1.3 deflate (without Adler32 checksum at the end)
>1 not yet defined
257-511 undefined not yet defined Reserved for further information on compression status. Currently not in use.
512 4 32 bit Specifies the encryption algorithm in case the original file contents (at the end of the WHX file) is encrypted. In use. If the original file contents is both compressed and encrypted, it was first compressed and then encrypted. Therefore the restoration order must be 1. decryption, 2. decompression.
0 not encrypted (chunk could be omitted)
1 Pukall Cipher 1 (PC 1) using a 128-bit key that is digested from the 256-bit concatenation of the 128-bit digest of the original password and 128 bits random input (requires ID 513). The 128-bit digests are calculated using the Pukall Stream Cipher hash function with the following 128-bit key: F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38.
>1 not yet defined
513 16 128 bit Random input used by encryption algorithm 1 (cf. ID 512, 514). In use.
514 32 256 bit A 256-bit digest that is used to determine whether a password, specified by the user for decryption, is correct or not. The Pukall Stream Cipher hash function (short: PSCHF(DataToBeHashed, Key)) is called several times to calculate this “PasswordVerificationTestDigest”. In use.

Hash_1 = PSCHF(OrigPassword, FixedKey); // 256 bit
Hash_2 = Lo_128Bit(Hash_1) xor Hi_128Bit(Hash_1); // 128 bit
Hash_3 = PSCHF(OrigPassword, Hash_2); // 256 bit
Hash_4 = Lo_128Bit(Hash_3) xor Hi_128Bit(Hash_3); //128 bit
PasswordTestDigest = PSCHF(RandomInput + Hash_3, Hash_4); // 256 bit

"+" means concatenation to 384 bit. FixedKey = F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38. RandomInput is stored in chunk ID 513.

515-767 undefined not yet defined Reserved for further information on encryption status. Currently not in use.
768 2 16 bit Designates the program that created the WHX file. Currently not in use. Please note that programs other than WinHex may specify zero for any WinHex-specific elements of the WHX format (such as InstanceID, FileID and #KeyInputs).
0 unknown
1 WinHex
2-255 reserved
>255 still undefined
769 2 16 bit Designates the version of the program that created the WHX file. The high-order byte specifies the minor version (revision) number. The low-order byte specifies the major version number. Currently not in use.
770 variable (n) char[n] String specifying the name of the program that created the WHX file. May also contain a version number. Currently not in use.
771 variable (n) char[n] String providing a textual description of the version number of that program. Currently not in use.
772 variable (n) char[n] String specifying the name of the company that owns the copyright for that program. Currently not in use.
773 variable (n) char[n] String specifying the name of the user who ran the program. Currently not in use.
774 variable (n) char[n] String specifying the creator or copyright owner of the original file. Currently not in use.
775 variable (n) char[n] String describing the type of the original file. Currently not in use.
776 variable (n) char[n] String describing the type of the disk the original file/sector was taken from. Currently not in use.
777 variable (n) char[n] Filename of the next volume if the backup was split (without path). Optional. In use.
778-1023 undefined not yet defined Reserved. Currently not in use.
1024 4 32-bit int Internal use by WinHex only. In use.
1025 variable (internal) Internal use by WinHex only. In use.
1026-65534 undefined not yet defined Not yet defined. Currently not in use.
65535 0 - Terminating chunk. Indicates the end of ExtraField. Required. In use.

The latest version of this document is available at http://www.winhex.com. The algorithms Pukall Cipher 1 (PC 1) and Pukall Stream Cipher Hash Function are copyright by Alexandre Pukall. Source code available at http://www.multimania.com/pc1. The zlib compression library is copyright by Jean-loup Gailly and Mark Adler. Homepage: ftp://ftp.cdrom.com/pub/infozip/zlib/zlib.html

THE INFORMATION PROVIDED ON THIS PAGE IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. MUST NOT BE PUBLISHED WITHOUT PRIOR CONSENT OF THE AUTHOR.