How to read the values of IconLayouts REG_BINARY registry file

Question

I want to make a program that gets the positions of the icons on the screen. And with some research I found out that the values I needed were in a registry binary file called IconLayouts (Located in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop) I used python to get the positions using the winreg module. And succeeded on getting the values.

from winreg import *

aReg = ConnectRegistry(None, HKEY_CURRENT_USER)
aKey = OpenKey(aReg, r"Software\Microsoft\Windows\Shell\Bags\1\Desktop", REG_BINARY)

name, value, type_ = EnumValue(aKey, 9)
value = value.replace(b'\x00', b'')

This is the code I have. But the problem is I don't know what to do with these values. The program returns something like:

b'\x03\x01\x01\x01\x04,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}>  ,::{645FF040-5081-101B-9F08-00AA002F954E}>  \x13Timetables.jpeg>  
folder>\ \x01\x02\x01\x01\x02\x01\x0c\x04\x01\x04\x80?\x01@\x020A\x03'

I would appreciate if you would help me decipher this output and get the positions from it.

user_3439404 · Answer

The following code snippet could help. It's very, very simplified code combined from Windows Shellbag Forensics article and shellbags.py script (the latter is written in Python 2.7 hence unserviceable for me).

import struct
from winreg import *

aReg = ConnectRegistry(None, HKEY_CURRENT_USER)
aKey = OpenKey(aReg, r"Software\Microsoft\Windows\Shell\Bags\1\Desktop", REG_BINARY)

name, value, type_ = EnumValue(aKey, 9)

offset = 0x10

head = [struct.unpack_from("


Output (truncated): .\SO\70039190.py
0 44 ::{59031A47-3F72-44A7-89C5-5595FE6B30EE}
1 44 ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
2 44 ::{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
3 31 Software602 Form Filler.lnk
4 8 test
5 32 Virtual Russian Keyboard.lnk
…
49 22 WTerminalAdmin.lnk
50 22 AVG Secure VPN.lnk
51 44 ::{645FF040-5081-101B-9F08-00AA002F954E}
52 29 powershell - Shortcut.lnk

There is 1176 bytes left

Honestly, I don't fully comprehend offset around entry_name…
Edit
I have found (partial) structure for the rest of value. There are two tables containing row and column along with an index to desktop_items list for each desktop icon.
Current row and column assignment is in the second table (see the picture below). The first table supposedly contains default assignments for automatic sort by (from desktop context menu).
Unfortunately, I have no clue for interpretation of row and column values (e.g. 16256, 16384) to icon indexes (3rd row, 2nd column).
import struct
import winreg
import pprint

aReg = winreg.ConnectRegistry(None, winreg.HKEY_CURRENT_USER)
aKey = winreg.OpenKey(aReg,
          r"Software\Microsoft\Windows\Shell\Bags\1\Desktop",
          winreg.REG_BINARY)
name, value, type_ = winreg.EnumValue(aKey, 9)
aKey.Close()
aReg.Close()

offset = 0x10
head = [struct.unpack_from("

Result (an illustrative picture):

user_7723965 · Answer

it seems that you have an binary file that must be tranformed in floats, strings, etc.

Here you have a function that I have made that uses struct unpack to read an amount of bytes and then transform then in float or int or str, etc.

# Import
import numpy as np
import struct

def ReadBytes(file, fmt, size):
    """
    Function to read an amount of bytes and convert to the desired format.

    Parameters
    ----------
    file : Stream of file.
        Stream from open file.
         - `file = open("file.bin")`
    
    fmt : str
        String containing the format type of the object to be converted.
        - 
    
    size : int
        How many bytes should be read.

    Returns
    -------
    oc : object{int, float, str, ...}
        Desired object read from bytes and converted to desired type.

    """
    
    if size<0:
        # If you have an array you can use size = -n indicating that the array has n positions.
        # Length to be read.
        bs  = file.read(abs(size))
        # Converting length.
        size = struct.unpack('B',bs)[0]
        # Format considering the len.
        fmt = str(size)+fmt
          
    # Object to be read, in bytes.
    o = file.read(size)
    # Converting the object to the format desired.
    oc = struct.unpack(fmt, o)[0]
  
    return oc

In a simple usage, you can just use the struct unpack itself. The following shows how to unpack 4 bytes to int:

struct.unpack('i', b'\x03\x01\x01\x01')

# Output-> (16843011,)

How to read the values of IconLayouts REG_BINARY registry file

2 Answers

Edit