.msstyles Format
.msstyles files are just regular PE files. They seem to contain no code (.text) section, just resources. Commonly in .msstyles found are:
Name | Meaning | Description |
---|---|---|
AMAP | Animation Map | Animation info for the STREAM(?) resources? |
BCMAP | Base Class Map | Info about class inheritance |
CMAP | Class Map | Contains all class names in sequential order as UTF-16 |
PACKTHEM_VERSION | Theme format or theme creator version? WinXP: 03 00, newer: 04 00 | |
RMAP | Root Map | Contains global properties in a binary format |
IMAGE | Image resources | |
STREAM | Image atlas resources, intended for animations | |
VARIANT | Folder that contains all properties in a binary format - per variant in VMAP | |
VMAP | Variant Map | List of style variants in the file |
Most interesting is the VARIANT/ resource as it contains the properties that describe the style. The properties reference stuff from other resources, for example class names from the CMAP resource and images from the IMAGE and STREAM resource.
With Win8 new resources were introduced:
Name | Meaning | Description |
---|---|---|
DESKTOP | Win10: 06 00 41 01 - 0x0141 pointing to TaskbarShowDesktop? Win8: 06 00 11 01 - 0x0111 pointing to VerticalShowDesktop8::Button? |
|
PVL | Win10: 47 01 02 00 - 0x0147 pointing to timingfunction? Win8: 17 01 02 00 - 0x0117 pointing to animations? |
|
IMMERSIVE | Win10: 47 01 00 00 - 0x0147 pointing to timingfunction? Win8: 17 01 00 00 - 0x0117 pointing to animations? |
They look like they contain two shorts: classId
and some other
.
classId
because it points to classes that seem to have a relation with the pointer.
other
could be a part or state id? It doesn't make much sense to me yet. DESKTOP
seems to have got the shorts in the wrong order.
The data in the variants is a list properties. Properties consist of some kind of header and data and can be of different size. Each entry looks as follows:
32 Byte | Header |
varies | Data |
varies | Padding |
Padding: Pad until size of Header+Data is a multiple of 8 byte.
struct PropertyHeader
{
int32_t nameID; // Offset: 0, Size: 4, ID for the property name, described in MSDN
int32_t typeID; // Offset: 4, Size: 4, ID for the type of the property, described in MSDN
int32_t classID; // Offset: 8, Size: 4, Index to the class from CMAP the propery belongs to
int32_t partID; // Offset: 12, Size: 4 ID for the part of the class the property belongs to, see vsstyle.h
int32_t stateID; // Offset: 16, Size: 4 ID for the state map, see vsstyle.h
int32_t shortFlag; // Offset: 20, Size: 4 If not 0, ignore 'sizeInBytes' as no data follows. Instead this field may contain data.
int32_t reserved; // Offset: 24, Size: 4 Seems to be always zero
int32_t sizeInBytes;// Offset: 28, Size: 4 The size of the data that follows. Does not include padding
};
Note: List properties just show the first element.
union PropertyData
{
struct
{
int32_t value;
}inttype;
struct
{
int32_t size;
}sizetype;
struct
{
int32_t boolvalue;
}booltype;
struct
{
unsigned char r;
unsigned char g;
unsigned char b;
unsigned char a; // not used
}colortype;
struct
{
int32_t left;
int32_t top;
int32_t right;
int32_t bottom;
}recttype;
struct
{
int32_t left;
int32_t top;
int32_t right;
int32_t bottom;
}margintype;
struct
{
int32_t enumvalue;
}enumtype;
struct
{
int32_t x;
int32_t y;
}positiontype;
struct // INTLIST struct (uxtheme.h)
{
int32_t numInts;
int32_t firstInt;
}intlist;
struct // Type 240
{
int32_t firstColorBGR; // first BGR color, probably a COLORREF -> 0x00bbggrr
}colorlist;
struct
{
wchar_t firstChar; // first UTF16 character of the string. Not sure if null terminated...
}texttype;
};
The properties have to be in strict order, sorted ascending by the following keys:
- classId
- partId
- stateId
- nameId
If the order is not kept, the OS will reject the theme.
User Wiki
Technical Wiki