4

The following are two example filenames from the %WINDIR%\WinSxS\Manifests directory:

wow64_microsoft-windows-ntdll_31bf3856ad364e35_6.2.9200.17584_none_bbf51cfcba52b7f7.manifest
amd64_microsoft-windows-ntdll_31bf3856ad364e35_6.2.9200.17584_none_b1a072aa85f1f5fc.manifest

The scheme is obvious except for the last element: processorArchitecture_AssemblyName_publicKeyToken_Version_Language_UNKNOWN.manifest

What is the meaning of the last 16 hexadecimal characters in the WinSxS\Manifests files' names?

Current research effort:

  • I can rule out that the characters represent the hexadecimal encoded low- and high-order parts of a FILETIME structure since the resulting time stamps are astronomically large.
  • These strings are not found in the registry
  • It is not a CRC-64 checksum of the manifest file itself
  • These strings are already present in the downloads from Microsoft (I've unpacked a .cab file embedded in a windows update .mum file)
gollum
  • 446
  • 4
  • 16
  • 1
    Not the downvoter, but you might want to provide more information on what you're trying to do with this. I agree that the downvote should have been accompanied by some explanation of the issue. – bwDraco Mar 11 '16 at 00:49
  • It's probably just a unique ID. I doubt there's any significant *meaning* other than to distinguish it from identical files which differ only in version. – allquixotic Mar 11 '16 at 01:55
  • allquixotic may be right. I also wonder if this is some sort of standard that StackOverflow users might be more familiar with. – TOOGAM Mar 11 '16 at 17:49
  • @TOOGAM I guess so, although this cleary is not a programming question. – gollum Mar 11 '16 at 17:58
  • 1
    @gollum Agreed. Yet that is where there is a talent base of more people who may know the correct answer. You might need to get borderline infringing in a new question, like "does this WinSxS filename match a known standard that identifies the UNKNOWN segment? (P.S. What I'm really looking for are details of the UNKNOWN segment.)" I agree this question won't be right up their alley, so it may not be highly rated, but some knowledgeable expert may have pity if your question seems intelligent enough. Many of us are, after all, here to help. – TOOGAM Mar 11 '16 at 18:01
  • This does not belong on SO... – Ramhound Mar 11 '16 at 22:34

0 Answers0