Valid as of WinHex 8.3. WHX files are used on the one hand internally by the undo function in WinHex and on the other hand as backups created by the user for general purposes. The WHX files managed by WinHex were formerly named Saved###.whx, now simply ###.whx, where ### is a three-digit number. WHX files may be backups of files or disk sectors.
The WHX file format is designed to guarantee backwards and forwards compatibility. The optional ExtraField section provides room for future extensions. Any unsupported elements within the ExtraField are to be dealt with gracefully (i. e. ignored/skipped). The WHX standard is open, and anyone is free to create software that reads or writes WHX files, provided that the following requirements are met:
This documentation of the WHX format promotes interoperability. By publishing a formal definition, other vendors are encouraged to create interoperable products. This openness should foster further confidence in this standard.
|ASCII characters WHX Backup v1.0 + 0X00. Applications that read from WHX files should compare ten characters (WHX Backup) to acknowledge the WHX format.|
|10||char||Name||Contains the name of the original file, including its path. Null-terminated. If the WHX file contains the backup of a sector (ObjectType != 0), Name specifies the sector number and the drive, preferably of the following form: Drive #: \Sector #.|
|110||16-bit int||DescrLen||The number of ASCII characters in Descr. May be zero.|
|112||char[DescrLen]||Descr||Contains the optional description of the backup (currently only used if UndoType == 1). Not null-terminated. Detailed descriptions can also be added as appropriate chunks within ExtraField.|
|112+DescrLen||8-bit int||Reserved||Reserved. Must be zero.|
|113+DescrLen||signed 8-bit int||ObjectType||Determines whether the WHX file is a backup of a file or of a disk sector. Must be zero for files. A positive non-zero value designates a logical drive (A=1, B=2, C=3, ...). A negative value indicates a physical drive (0X00=-1, 0X01=-2, 0X80=-3, 0X81=-4, ...).|
|114+DescrLen||signed 64-bit int||FSize||The size of the original file in bytes. In case ObjectType != 0 FSize specifies the sector size (typically 512).|
|11C+DescrLen||32-bit int||SectorNo||Designates the sector number in case of ObjectType != 0, otherwise equal to zero. The first sector an a disk has the sector number 0.|
|120+DescrLen||32-bit int||#Sectors||Designates the number of continuous sectors stored in the WHX file in case of ObjectType != 0, otherwise equal to zero.|
signed 64-bit int
|BlockLimits||The limits of the block (=selection) defined upon the file when the backup was created (beginning and end offset). If no block was defined, the beginning offset is equal to zero and the end offset is equal to -1.|
|134+DescrLen||signed 32-bit int||FileID||A unique identifier of the original file. This value is designated solely for internal use by the program that created the WHX file. It has no external meaning. May be zero for programs other than WinHex.|
|138+DescrLen||signed 32-bit int||InstanceID||A unique identifier of the program session (=instance) that created the WHX file. This value is for internal use by this program only and has no external meaning. May be zero for programs other than WinHex.|
|13C+DescrLen||8-bit int||UndoType||Describes the nature of the backup. Currently the following
values are defined:
|13D+DescrLen||8-bit int||PrevUndoType||Describes the nature of the previous backup that was created internally (i. e. UndoType > 1) for the same file. If there is none, PrevUndoType is equal to zero.|
|13E+DescrLen||8-bit int||Reserved||Reserved. Must be zero.|
|13F+DescrLen||8-bit boolean||IsModified||True, if the file was altered since it was last saved, otherwise false.|
|140+DescrLen||signed 16-bit int||UndoLevel||The undo level designates the number of previous modification steps that can be undone, provided that the corresponding backup files still exist. Initially it is equal to zero. The value of -1 indicates that UndoLevel is of no interest.|
|142+DescrLen||FILETIME||CreationTime||A FILETIME structure containing the time the original file was created (64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0.|
|14A+DescrLen||FILETIME||LastWriteTime||This FILETIME structure contains the time that the original file was last written to (64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0.|
|152+DescrLen||32-bit int||KeyInputSize||Determines the size of the following KeyInput field. May be zero.|
|156+DescrLen||(internal)||KeyInput||Data for reversing keyboard inputs. Optional. The data format is internally defined by WinHex and is subject to change.|
|156+DescrLen +KeyInputSize||32-bit int||ExtraFieldSize||The number of bytes in Extrafield. May be zero.|
|15A+DescrLen +KeyInputSize||variable chain of chunks||ExtraField||This optional section is designed for additional data of various formats. Each chunk in this section contains a format identifier (2 bytes), the data size in bytes (2 bytes) and the chunk data itself. The overall size of ExtraField must be carefully calculated and specified in ExtraFieldSize. Valid chunk formats are described below. Chunks should be sorted numerically by their format identifiers. In case the ExtraField exists, it must be terminated with an ending chunk (ID 65535).|
|15A+DescrLen +KeyInputSize +ExtraFieldSize||-||WHXData||ObjectType == 0: The original file contents, FSize bytes.
ObjectType != 0: The original contents of the sector(s), (#Sectors×FSize) bytes.
May be stored compressed (ExtraField chunk ID 256) and/or encrypted (ExtraField chunk ID 512).
Valid ExtraField chunk formats:
|1||4||32-bit int||File system attributes of the original file. Currently not in use.|
|2||8||64-bit int||Size of the WHX file in bytes. Currently not in use.|
|3||8||FILETIME||This FILETIME structure specifies the time the WHX file was created. Currently not in use.|
|4||4||32-bit int||Contains the serial number of the disk the original file/sector was taken from. Currently not in use.|
|5+6||undefined||not yet defined||Reserved|
|7||4||32-bit int||Previously (WinHex 10.52 and before) used for 32-bit standard checksum, now reserved.|
|8||undefined||not yet defined||Reserved|
|9||4||32-bit int||Previously (WinHex 10.52 and before) used for CRC32, now reserved.|
|10||undefined||not yet defined||Reserved|
|11||1||8-bit int||8-bit standard checksum of the original file (sum of all bytes on an 8-bit accumulator). In use.|
|12||1||16-bit int||16-bit standard checksum. In use.|
|13||1||32-bit int||32-bit standard checksum. In use.|
|14||1||64-bit int||64-bit standard checksum. In use.|
|15||2||16-bit int||16-bit CRC checksum of the original file. Polynomial = 0X8005, initial value = 0X0000. In use.|
|16||4||32-bit int||32-bit CRC checksum of the original file. Polynomial: x^32 + x^26 + x^23 + x^22 + x^16 + x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x + 1 (=0XEDB88320), initial value: 0XFFFFFFFF. Compatible with CRCs used in ZIP and zmodem protocol. In use.|
|17||16||128 bit||The common 128-bit MD5 message digest. In use.|
|18||16||160 bit||SHA-1 digest (160 bit). In use.|
|19||16||256 bit||SHA-256 digest (256 bit). In use.|
|20||32||256 bit||A 256-bit digest of the original file, created by the Pukall stream cipher hash function (PSCHF) with the following 128-bit key: F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38. In use.|
|21-31||undefined||not yet defined||Reserved for other kinds of checksums (CRC48, Adler32, ...). Currently not in use.|
|32||32||256 bit||Previously (WinHex 10.52 and before) used for PSCHF, now reserved.|
|33||16||128 bit||Previously (WinHex 10.52 and before) used for MD5, now reserved.|
|64-255||undefined||not yet defined||Reserved for miscellaneous purposes. Currently not in use.|
|256||4||32-bit int||Specifies the compression algorithm in case the
original file contents (at the end of the WHX file) is compressed. In use.
|257-511||undefined||not yet defined||Reserved for further information on compression status. Currently not in use.|
|512||4||2x 16-bit int||Specifies the encryption algorithm in case the
original file contents (at the end of the WHX file) is encrypted. In use.
If the original file contents is both compressed and encrypted, it was first compressed
and then encrypted. Therefore the restoration order must be 1. decryption, 2.
Low 16-bit integer:
High 16-bit integer: Algorithm key size in bytes. 0 indicates a default of 16 bytes = 128 bits).
|513||16||128-bit data||Random input used by encryption algorithm 1 (cf. ID 512, 514). In use.|
|514||32||256-bit hash||A 256-bit hash that is used to determine whether
a password, specified by the user for decryption, is correct or not. The Pukall Stream
Cipher hash function (short: PSCHF(DataToBeHashed, Key)) is called several times to
calculate this password verification hash. In use.
Hash_1 = PSCHF(OrigPassword, FixedKey); // 256 bit
|515||32||256-bit hash||A 256-bit hash that is used to determine whether
a password, specified by the user for decryption, is correct or not. The SHA-256 algorithm
is called several times to calculate this password verification hash. Not in use.
Hash_1 = SHA-256(OrigPassword);
|516-767||undefined||not yet defined||Reserved for further information on encryption status. Currently not in use.|
|768||2||16-bit int||Designates the program that created the WHX file. Currently
not in use. Please note that programs other than WinHex may specify zero for any
WinHex-specific elements of the WHX format (such as InstanceID, FileID and #KeyInputs).
|769||2||16-bit int||Designates the version of the program that created the WHX file. The high-order byte specifies the minor version (revision) number. The low-order byte specifies the major version number. Currently not in use.|
|770||variable (n)||char[n]||String specifying the name of the program that created the WHX file. May also contain a version number. Currently not in use.|
|771||variable (n)||char[n]||String providing a textual description of the version number of that program. Currently not in use.|
|772||variable (n)||char[n]||String specifying the name of the company that owns the copyright for that program. Currently not in use.|
|773||variable (n)||char[n]||String specifying the name of the user who ran the program. Currently not in use.|
|774||variable (n)||char[n]||String specifying the creator or copyright owner of the original file. Currently not in use.|
|775||variable (n)||char[n]||String describing the type of the original file. Currently not in use.|
|776||variable (n)||char[n]||String describing the type of the disk the original file/sector was taken from. Currently not in use.|
|777||variable (n)||char[n]||Filename of the next volume if the backup was split (without path). Optional. In use.|
|778-1023||undefined||not yet defined||Reserved. Currently not in use.|
|1024||4||32-bit int||Internal use by WinHex only. In use.|
|1025||variable||(internal)||Internal use by WinHex only. In use.|
|1026-65534||undefined||not yet defined||Not yet defined. Currently not in use.|
|65535||0||-||Terminating chunk. Indicates the end of ExtraField. Required. In use.|
The latest version of this document is available at http://www.winhex.com. The algorithms Pukall Cipher 1 (PC 1) and Pukall Stream Cipher Hash Function are copyright by Alexandre Pukall. Source code available at http://www.multimania.com/pc1. The zlib compression library is copyright by Jean-loup Gailly and Mark Adler. Homepage: ftp://ftp.cdrom.com/pub/infozip/zlib/zlib.html
THE INFORMATION PROVIDED ON THIS PAGE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. MUST NOT BE PUBLISHED WITHOUT PRIOR CONSENT OF THE AUTHOR.