Internet Shortcut IDList value decoding

Question

I have been trying to find any information on a value that is stored in an url shortcut that is generated from MS-Office for SharePoint Libraries. We are moving away from Office 2007 to Office 365 and the feature of 2007 that creates these links doesn't appear to be available in Office 365.

If a .url file doesn't have the IDList value when you click on it in a save-as dialog it changes the file name to the shortcut. I tried changing the .url to .lnk but non-office applications can't handle them.

Contents of .url file

[InternetShortcut]
IDList=UAwHYBGLNCi66kGEieNCAsCMw0pTAMcAlzFXj9mZr5yalx2b35WYuMWYcRUY2d1VXJ1bvRHAXVmYgMEbpVmb0BiTlR3dvJ3aAgGd0BnOv8yYvZ2ausWZs92duFmLjFGAuAATAEDAAAAAAAAAAAAEAQXZh12cAgDAIAABA8uvAAAAAAAAAAgKAAAAAAAAAAAAAAAAAAAA8gPuuBAAAAAAAQHAlBQYA0GAzBAAAQBAKBQMAAAAAAAAAAAAQAQZk12cAAgNAgAAEAw7+CAAAAAAAAAAqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQZAQGAtBwcAAAAUAAAAA
URL=file://blart/DavWWWRoot/teams/edms
IconFile=C:\ProgramData\Microsoft\Office\SharePointTeamSite.ico
IconIndex=0
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,9

Same user regenerated file

IDList=UAwHYBGLNCi66kGEieNCAsCMw0pTAMcAlzFXj9mZr5yalx2b35WYuMWYcRUY2d1VXJ1bvRHAXVmYgMEbpVmb0BiTlR3dvJ3aAgGd0BnOv8yYvZ2ausWZs92duFmLjFGAuAATAEDAAAAAAAAAAAAEAQXZh12cAgDAIAABA8uvAAAAAAAAAAgKAAAAAAAAAAAAAAAAAAAA0baRNAAAAAAAAQHAlBQYA0GAzBAAAQBAKBQMAAAAAAAAAAAAQAQZk12cAAgNAgAAEAw7+CAAAAAAAAAAqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQZAQGAtBwcAAAAUAAAAA

Value from a file from another user

IDList=UAwHYBGLNCi66kGEieNCAsCMw0pTAMcAlzFXj9mZr5yalx2b35WYuMWYcRUY2d1VXJ1bvRHAXVmYgMEbpVmb0BiTlR3dvJ3aAgGd0BnOv8yYvZ2ausWZs92duFmLjFGAuAATAEDAAAAAAAAAAAAEAQXZh12cAgDAIAABA8uvAAAAAAAAAAgKAAAAAAAAAAAAAAAAAAAA4BZpCAAAAAAAAQHAlBQYA0GAzBAAAQBAKBQMAAAAAAAdHBlfQAQZk12cAAgNAgAAEAw7+qXQJdJdHBlfqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQZAQGAtBwcAAAAUAAAAA

I have not been able to figure out how to decode this value or have I been able to figure out what data is being stored in it. I have read through a bunch of different ways to create shortcuts programmatically with Windows scripting and shell 32 in Powershell and C# wrappers, C++ looking for any info. The only glimmer of hope I have is that shell links also have an item id list of pidl's, but I can't confirm if this is related.

What I do know is that the IDList can be moved to another .url and it will take you to the original path. There are some sections of the IDList that change depending on the user who created them and or when the url files are recreated.

Internet shortcuts https://msdn.microsoft.com/en-us/library/bb776784(v=vs.85).aspx

Shell link https://msdn.microsoft.com/en-us/library/dd891312.aspx

Answer 1

The .URL file format is not officially documented and only the first 2 bytes of the IDList format is documented.

I believe the IDList string used to be stored by calling WritePrivateProfileStruct and at some point changed to the format you posted. A function called TextToBinary decodes the string into a IStream instance but I did not bother trying to figure out the format. The stream is stuffed into a PROPVARIANT and the documented IUniformResourceLocator interface knows how to deal with all of this for you but unfortunately the idlist entry is not documented as a property you can read/write.

The PIDL (IDList) after .INI string decoding and some basic formating looks like this:

:1: 20 bytes
  {208D2C60-3AEA-1069-A2D7-08002B30309D}:Network
:2: 78 bytes
  4E 00 C3 01 E5 5C 5C 63  6F 66 6B 2E 6B 65 6C 6F  N....\\c ofk.kelo
  77 6E 61 2E 63 61 5C 44  61 76 57 57 57 52 6F 6F  wna.ca\D avWWWRoo
  74 00 57 65 62 20 43 6C  69 65 6E 74 20 4E 65 74  t.Web Cl ient Net
  77 6F 72 6B 00 68 74 74  70 3A 2F 2F 63 6F 66 6B  work.htt p://cofk
  2E 6B 65 6C 6F 77 6E 61  2E 63 61 00 2E 00 __ __  .kelowna .ca...
:3: 76 bytes
  4C 00 31 00 00 00 00 00  00 00 00 00 10 00 74 65  L.1..... ......te
  61 6D 73 00 38 00 08 00  04 00 EF BE 00 00 00 00  ams.8... ........
  00 00 00 00 2A 00 00 00  00 00 00 00 00 00 00 00  ....*... ........
  00 00 00 00 3C F8 B8 6E  00 00 00 00 00 00 74 00  ....<..n ......t.
  65 00 61 00 6D 00 73 00  00 00 14 00 __ __ __ __  e.a.m.s. ....
:4: 74 bytes
  4A 00 31 00 00 00 00 00  00 00 00 00 10 00 65 64  J.1..... ......ed
  6D 73 00 00 36 00 08 00  04 00 EF BE 00 00 00 00  ms..6... ........
  00 00 00 00 2A 00 00 00  00 00 00 00 00 00 00 00  ....*... ........
  00 00 00 00 00 00 00 00  00 00 00 00 00 00 65 00  ........ ......e.
  64 00 6D 00 73 00 00 00  14 00 __ __ __ __ __ __  d.m.s... ..
:5: 0 bytes

and the result after asking the shell to convert this PIDL is \\cofk.kelowna.ca\DavWWWRoot\teams\edms.

The difference between the 3 examples you posted is just in the path part of the PIDL (teams\edms), probably the modified date of the folder or uninitialized data.