Skip to content

.msstyles Format

nptr edited this page Oct 31, 2019 · 4 revisions

.msstyles files are just regular PE files. They seem to contain no code (.text) section, just resources. Commonly in .msstyles found are:

Name Meaning Description
AMAP Animation Map Animation info for the STREAM(?) resources?
BCMAP Base Class Map Info about class inheritance
CMAP Class Map Contains all class names in sequential order as UTF-16
PACKTHEM_VERSION Theme format or theme creator version? WinXP: 03 00, newer: 04 00
RMAP Root Map Contains global properties in a binary format
IMAGE Image resources
STREAM Image atlas resources, intended for animations
VARIANT Folder that contains all properties in a binary format - per variant in VMAP
VMAP Variant Map List of style variants in the file

Most interesting is the VARIANT/ resource as it contains the properties that describe the style. The properties reference stuff from other resources, for example class names from the CMAP resource and images from the IMAGE and STREAM resource.

With Win8 new resources were introduced:

Name Meaning Description
DESKTOP Win10: 06 00 41 01 - 0x0141 pointing to TaskbarShowDesktop?
Win8: 06 00 11 01 - 0x0111 pointing to VerticalShowDesktop8::Button?
PVL Win10: 47 01 02 00 - 0x0147 pointing to timingfunction?
Win8: 17 01 02 00 - 0x0117 pointing to animations?
IMMERSIVE Win10: 47 01 00 00 - 0x0147 pointing to timingfunction?
Win8: 17 01 00 00 - 0x0117 pointing to animations?

They look like they contain two shorts: classId and some other. classId because it points to classes that seem to have a relation with the pointer. other could be a part or state id? It doesn't make much sense to me yet. DESKTOP seems to have got the shorts in the wrong order.

VARIANT Format

The data in the variants is a list properties. Properties consist of some kind of header and data and can be of different size. Each entry looks as follows:

32 Byte Header
varies Data
varies Padding

Padding: Pad until size of Header+Data is a multiple of 8 byte.

Header

struct PropertyHeader
{
    int32_t nameID;	// Offset: 0, Size: 4,	ID for the property name, described in MSDN
    int32_t typeID;	// Offset: 4, Size: 4,	ID for the type of the property, described in MSDN
    int32_t classID;	// Offset: 8, Size: 4,	Index to the class from CMAP the propery belongs to
    int32_t partID;	// Offset: 12, Size: 4	ID for the part of the class the property belongs to, see vsstyle.h
    int32_t stateID;	// Offset: 16, Size: 4	ID for the state map, see vsstyle.h
    int32_t shortFlag;	// Offset: 20, Size: 4	If not 0, ignore 'sizeInBytes' as no data follows. Instead this field may contain data.
    int32_t reserved;	// Offset: 24, Size: 4	Seems to be always zero
    int32_t sizeInBytes;// Offset: 28, Size: 4	The size of the data that follows. Does not include padding
};

Data

Note: List properties just show the first element.

union PropertyData
{
    struct
    {
        int32_t value;
    }inttype;
    struct
    {
        int32_t size;
    }sizetype;
    struct
    {
        int32_t boolvalue;
    }booltype;
    struct
    {
        unsigned char r;
        unsigned char g;
        unsigned char b;
        unsigned char a;		// not used
    }colortype;
    struct
    {
        int32_t left;
        int32_t top;
        int32_t right;
        int32_t bottom;
    }recttype;
    struct
    {
        int32_t left;
        int32_t top;
        int32_t right;
        int32_t bottom;
    }margintype;
    struct
    {
        int32_t enumvalue;
    }enumtype;
    struct
    {
        int32_t x;
        int32_t y;
    }positiontype;
    struct // INTLIST struct (uxtheme.h)
    {
        int32_t numInts;
        int32_t firstInt;
    }intlist;
    struct // Type 240
    {
        int32_t firstColorBGR;	// first BGR color, probably a COLORREF -> 0x00bbggrr
    }colorlist;
    struct
    {
        wchar_t firstChar;      // first UTF16 character of the string. Not sure if null terminated...
    }texttype;
};

The properties have to be in strict order, sorted ascending by the following keys:

  1. classId
  2. partId
  3. stateId
  4. nameId

If the order is not kept, the OS will reject the theme.