WHX File Format

Format of Backup Files in “WinHex”

Valid as of WinHex 8.3. WHX files are used on the one hand internally by the “undo” function in WinHex and on the other hand as backups created by the user for general purposes. The WHX files managed by WinHex were formerly named “Saved###.whx”, now simply “###.whx”, where ### is a three-digit number. WHX files may be backups of files or disk sectors.

The WHX file format is designed to guarantee backwards and forwards compatibility. The optional “ExtraField” section provides room for future extensions. Any unsupported elements within the ExtraField are to be dealt with gracefully (i. e. ignored/skipped). The WHX standard is open, and anyone is free to create software that reads or writes WHX files, provided that the following requirements are met:

This documentation of the WHX format promotes interoperability. By publishing a formal definition, other vendors are encouraged to create interoperable products. This openness should foster further confidence in this standard.

Offset (0X) Type Element Description
0 char[15]

Signature

 ASCII characters “WHX Backup v1.0” + 0X00. Applications that read from WHX files should compare ten characters (“WHX Backup”) to acknowledge the WHX format.
10 char[255] Name Contains the name of the original file, including its path. Null-terminated. If the WHX file contains the backup of a sector (ObjectType != 0), Name specifies the sector number and the drive, preferably of the following form: “Drive #: \Sector #”.
110 16-bit int DescrLen The number of ASCII characters in “Descr”. May be zero.
112 char[DescrLen] Descr Contains the optional description of the backup (currently only used if UndoType == 1). Not null-terminated. Detailed descriptions can also be added as appropriate chunks within “ExtraField”.
112+DescrLen 8-bit int Reserved Reserved. Must be zero.
113+DescrLen signed 8-bit int ObjectType Determines whether the WHX file is a backup of a file or of a disk sector. Must be zero for files. A positive non-zero value designates a logical drive (A=1, B=2, C=3, ...). A negative value indicates a physical drive (0X00=-1, 0X01=-2, 0X80=-3, 0X81=-4, ...).
114+DescrLen signed 64-bit int FSize The size of the original file in bytes. In case ObjectType != 0 FSize specifies the sector size (typically 512).
11C+DescrLen 32-bit int SectorNo Designates the sector number in case of ObjectType != 0, otherwise equal to zero. The first sector an a disk has the sector number 0.
120+DescrLen 32-bit int #Sectors Designates the number of continuous sectors stored in the WHX file in case of ObjectType != 0, otherwise equal to zero.
124+DescrLen 2×
signed 64-bit int		 BlockLimits The limits of the block (=selection) defined upon the file when the backup was created (beginning and end offset). If no block was defined, the beginning offset is equal to zero and the end offset is equal to -1.
134+DescrLen signed 32-bit int FileID A unique identifier of the original file. This value is designated solely for internal use by the program that created the WHX file. It has no external meaning. May be zero for programs other than WinHex.
138+DescrLen signed 32-bit int InstanceID A unique identifier of the program session (=instance) that created the WHX file. This value is for internal use by this program only and has no external meaning. May be zero for programs other than WinHex.
13C+DescrLen 8-bit int UndoType Describes the nature of the backup. Currently the following values are defined:
0 must not be used
1 created for general purposes; default value
2 must not be used
3 created before the block was cut
4 created before clipboard data or zero bytes were pasted
5 created before clipboard data was written
6 created before the block/file was filled
7 created before the block was removed
8 created before the “modify data” command was used
9 created before a replacement
10 created before a routine was applied
11 created before bytes were swapped
12 created before the file was converted
13 created before the file was encrypted
14 created before the file was decrypted
15 created before disk sectors were overwritten
16 created before template editing
13D+DescrLen 8-bit int PrevUndoType Describes the nature of the previous backup that was created internally (i. e. UndoType > 1) for the same file. If there is none, PrevUndoType is equal to zero.
13E+DescrLen 8-bit int Reserved Reserved. Must be zero.
13F+DescrLen 8-bit boolean IsModified True, if the file was altered since it was last saved, otherwise false.
140+DescrLen signed 16-bit int UndoLevel The undo level designates the number of previous modification steps that can be undone, provided that the corresponding backup files still exist. Initially it is equal to zero. The value of -1 indicates that UndoLevel is of no interest.
142+DescrLen FILETIME CreationTime A FILETIME structure containing the time the original file was created (64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0.
14A+DescrLen FILETIME LastWriteTime This FILETIME structure contains the time that the original file was last written to (64-bit value representing the number of 100-nanosecond intervals since January 1, 1601). Equal to zero in case ObjectType != 0.
152+DescrLen 32-bit int KeyInputSize Determines the size of the following KeyInput field. May be zero.
156+DescrLen (internal) KeyInput Data for reversing keyboard inputs. Optional. The data format is internally defined by WinHex and is subject to change.
156+DescrLen +KeyInputSize 32-bit int ExtraFieldSize The number of bytes in “Extrafield”. May be zero.
15A+DescrLen +KeyInputSize variable chain of chunks ExtraField This optional section is designed for additional data of various formats. Each chunk in this section contains a format identifier (2 bytes), the data size in bytes (2 bytes) and the chunk data itself. The overall size of ExtraField must be carefully calculated and specified in ExtraFieldSize. Valid chunk formats are described below. Chunks should be sorted numerically by their format identifiers. In case the ExtraField exists, it must be terminated with an ending chunk (ID 65535).
15A+DescrLen +KeyInputSize +ExtraFieldSize - WHXData ObjectType == 0: The original file contents, FSize bytes.
ObjectType != 0: The original contents of the sector(s), (#Sectors×FSize) bytes.
May be stored compressed (ExtraField chunk ID 256) and/or encrypted (ExtraField chunk ID 512).

 

Valid ExtraField chunk formats:

Format Identifier Size
(Bytes)		 Type Description
1 4 32-bit int File system attributes of the original file. Currently not in use.
2 8 64-bit int Size of the WHX file in bytes. Currently not in use.
3 8 FILETIME This FILETIME structure specifies the time the WHX file was created. Currently not in use.
4 4 32-bit int Contains the serial number of the disk the original file/sector was taken from. Currently not in use.
5+6 undefined not yet defined Reserved
7 4 32-bit int Previously (WinHex 10.52 and before) used for 32-bit standard checksum, now reserved.
8 undefined not yet defined Reserved
9 4 32-bit int Previously (WinHex 10.52 and before) used for CRC32, now reserved.
10 undefined not yet defined Reserved
11 1 8-bit int 8-bit standard checksum of the original file (sum of all bytes on an 8-bit accumulator). In use.
12 1 16-bit int 16-bit standard checksum. In use.
13 1 32-bit int 32-bit standard checksum. In use.
14 1 64-bit int 64-bit standard checksum. In use.
15 2 16-bit int 16-bit CRC checksum of the original file. Polynomial = 0X8005, initial value = 0X0000.  In use.
16 4 32-bit int 32-bit CRC checksum of the original file. Polynomial: x^32 + x^26 + x^23 + x^22 + x^16 + x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x + 1 (=0XEDB88320), initial value: 0XFFFFFFFF. Compatible with CRCs used in ZIP and zmodem protocol. In use.
17 16 128 bit The common 128-bit MD5 message digest. In use.
18 16 160 bit SHA-1 digest (160 bit). In use.
19 16 256 bit SHA-256 digest (256 bit). In use.
20 32 256 bit A 256-bit digest of the original file, created by the Pukall stream cipher hash function (PSCHF) with the following 128-bit key: F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38. In use.
21-31 undefined not yet defined Reserved for other kinds of checksums (CRC48, Adler32, ...). Currently not in use.
32 32 256 bit Previously (WinHex 10.52 and before) used for PSCHF, now reserved.
33 16 128 bit Previously (WinHex 10.52 and before) used for MD5, now reserved.
64-255 undefined not yet defined Reserved for miscellaneous purposes. Currently not in use.
256 4 32-bit int Specifies the compression algorithm in case the original file contents (at the end of the WHX file) is compressed. In use.
0 not compressed (chunk could be omitted)
1 zlib 1.1.3 deflate (without Adler32 checksum at the end)
>1 not yet defined
257-511 undefined not yet defined Reserved for further information on compression status. Currently not in use.
512 4 2x 16-bit int Specifies the encryption algorithm in case the original file contents (at the end of the WHX file) is encrypted. In use. If the original file contents is both compressed and encrypted, it was first compressed and then encrypted. Therefore the restoration order must be 1. decryption, 2. decompression.

Low 16-bit integer:

0 not encrypted (chunk could be omitted)
1 Pukall Cipher 1 (PC 1) using a 128-bit key that is digested from the 256-bit concatenation of the 128-bit digest of the original password and 128 bits random input (requires ID 513). The 128-bit digests are calculated using the Pukall Stream Cipher hash function with the following 128-bit key: F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38.
2 AES. The 256-bit key version uses a 256-bit key that is digested with SHA-256 from the 384-bit concatenation of the SHA-256 of the original password and 128 bits random input (requires ID 513). Not in use.
>2 not yet defined

High 16-bit integer: Algorithm key size in bytes. 0 indicates a default of 16 bytes = 128 bits).

513 16 128-bit data Random input used by encryption algorithm 1 (cf. ID 512, 514). In use.
514 32 256-bit hash A 256-bit hash that is used to determine whether a password, specified by the user for decryption, is correct or not. The Pukall Stream Cipher hash function (short: PSCHF(DataToBeHashed, Key)) is called several times to calculate this password verification hash. In use.

Hash_1 = PSCHF(OrigPassword, FixedKey); // 256 bit
Hash_2 = Lo_128Bit(Hash_1) xor Hi_128Bit(Hash_1); // 128 bit
Hash_3 = PSCHF(OrigPassword, Hash_2); // 256 bit
Hash_4 = Lo_128Bit(Hash_3) xor Hi_128Bit(Hash_3); //128 bit
PasswordVerifHash = PSCHF(RandomInput + Hash_3, Hash_4); // 256 bit

"+" means concatenation to 384 bit. FixedKey = F6 C7 24 95 17 9F 3F 03 C6 DE F1 56 F8 2A 85 38. RandomInput is stored in chunk ID 513.
515 32 256-bit hash A 256-bit hash that is used to determine whether a password, specified by the user for decryption, is correct or not. The SHA-256 algorithm is called several times to calculate this password verification hash. Not in use.

Hash_1 = SHA-256(OrigPassword);
Hash_2 = SHA-256(OrigPassword + Hash_1);
PasswordVerifHash = SHA-256(RandomInput + Hash_1 + Hash_2);

"+" means concatenation. RandomInput is stored in chunk ID 513.
516-767 undefined not yet defined Reserved for further information on encryption status. Currently not in use.
768 2 16-bit int Designates the program that created the WHX file. Currently not in use. Please note that programs other than WinHex may specify zero for any WinHex-specific elements of the WHX format (such as InstanceID, FileID and #KeyInputs).
0 unknown
1 WinHex
2-255 reserved
>255 still undefined
769 2 16-bit int Designates the version of the program that created the WHX file. The high-order byte specifies the minor version (revision) number. The low-order byte specifies the major version number. Currently not in use.
770 variable (n) char[n] String specifying the name of the program that created the WHX file. May also contain a version number. Currently not in use.
771 variable (n) char[n] String providing a textual description of the version number of that program. Currently not in use.
772 variable (n) char[n] String specifying the name of the company that owns the copyright for that program. Currently not in use.
773 variable (n) char[n] String specifying the name of the user who ran the program. Currently not in use.
774 variable (n) char[n] String specifying the creator or copyright owner of the original file. Currently not in use.
775 variable (n) char[n] String describing the type of the original file. Currently not in use.
776 variable (n) char[n] String describing the type of the disk the original file/sector was taken from. Currently not in use.
777 variable (n) char[n] Filename of the next volume if the backup was split (without path). Optional. In use.
778-1023 undefined not yet defined Reserved. Currently not in use.
1024 4 32-bit int Internal use by WinHex only. In use.
1025 variable (internal) Internal use by WinHex only. In use.
1026-65534 undefined not yet defined Not yet defined. Currently not in use.
65535 0 - Terminating chunk. Indicates the end of ExtraField. Required. In use.

The latest version of this document is available at http://www.winhex.com. The algorithms Pukall Cipher 1 (PC 1) and Pukall Stream Cipher Hash Function are copyright by Alexandre Pukall. Source code available at http://www.multimania.com/pc1. The zlib compression library is copyright by Jean-loup Gailly and Mark Adler. Homepage: ftp://ftp.cdrom.com/pub/infozip/zlib/zlib.html

THE INFORMATION PROVIDED ON THIS PAGE IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. MUST NOT BE PUBLISHED WITHOUT PRIOR CONSENT OF THE AUTHOR.