An INF file is a file used by the Windows family of operating systems; normally in the setup of hardware or the installation of software. INF files tell Windows what registry keys and files to install or delete, what shortcuts to create, and a number of other useful things. INF files are interpreted by whichever part of Windows handles installations, which varies from version to version. Two DLL's commonly responsible are setupx.dll and advpack.dll.
INF files also contain all the information about what drivers are when you run the "Add New Hardware" wizard or attempt to install a driver.
INF files work by performing actions defined in sections. Section
names are enclosed by square brackets ([, ]) where the section
is being defined. The program executing the INF file looks at the
[Version] section, checks to make sure everything is correct,
and them proceeds to execute the specified Install section. If none is
given, it will execute the [DefaultInstall]
section. The Install section contains a list of actions, AddReg to add
registry entries for instance, which is followed by a list of section
names which contain the registry keys to add. It is the action name,
and not the section itself, that really tells the process executing
the INF file what to do. An example:
[Version]
Signature="$Windows NT$"
[DefaultInstall]
AddReg=AddRegistryEntries
[AddRegistryEntries]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Policies\System","NoDispCpl",0x00010001,1
INF files are divided into sections. These are:
- [Version] - This section tell Windows what version of Windows the INF file is for. It may include the following values:
- Signature - One of $Windows$, $Windows NT$, or $Chicago$.
- Class - Only used when installing device drivers, but identifies the device class the device belongs to.
- ClassGUID - The GUID of the class, again only used for installing device drivers.
- Provider - The name of the company that provides the INF. An arbitrary string really.
- LayoutFile - The INF files that contain the SourceDiskFiles and SourceDiskNames sections.
- Install Sections - These sections can have arbitrary names and are used to call other sections to perform actions. Each item can have multiple section names separated by commas. Most of these items are self-explanatory, those that are not will be covered in detail below.
- LogFile=log-config-section
- CopyFiles=file-list-section
- RenFiles=file-list-section
- DelFiles=file-list-section
- UpdateInis=update-ini-section
- UpdateIniFields=update-inifields-section
- AddReg=add-registry-section
- DelReg=del-registry-section
- Ini2Reg=ini-to-registry-section
- [LogFile] - This is specific to device drivers. I'll node device driver specific INF stuff later.
- [CopyFiles] - This section lists files to be copied. It's
format
is:
source-filename[,destination-filename][,temp-filename][,flag]
I'll assume that everything except flag is self explanatory, except that
the temporary-filename is ignored. Valid flags are:
- 0x00000001 - Display a warning if the user tries to skip a file
after an error has occurred.
- 0x00000002 - Don't allow the file
to be skipped.
- 0x00000004 - Ignore versions and always
overwrite the destination file.
- 0x00000008 - Force in-use,
treat the file as if something is using the file during the copy
operation.
- 0x00000010 - Don't overwrite destination
files.
- 0x00000020 - Don't overwrite if the destination is
newer than the source.
- 0x00000040 - Only copy the file if the
destination already exists.
- [RenFiles] - Renames files.
new-filename,old-filename
- [DelFiles] - Deletes files.
filename[,flags]
Valid Flags:
- 0x00000001 - If the file is in use, queue the delete and do it
when the system is rebooted.
- [UpdateInis] - Updates an INI file.
ini-file,ini-section[,old-ini-entry][,new-ini-entry],flags]
Pretty self explanitory, flags are:
- 0 - default, if old-ini-entry is found in the file, then it is
replaced with new-ini-entry. Only the keys need match; the values
are ignored.
- 1 - same as above, except the old-ini-entry value must match as
well for the entry to be replaced.
- 2 - if the old-ini-entry key is not found in the file, nothing
is done. If the key for both the old-ini-entry and the new-ini-entry
are found, then the new-ini-entry is deleted and the key of the
found old-ini-entry is replaced by the key from the
new-ini-entry. If the old-ini-entry key is found but the
new-ini-entry key is not, then the new-ini-entry key is created and
assigned the value associated with the old-ini-entry key found in
the file.
- 3 - same as for 2, except all matches are on both key and
value.
- [UpdateIniFields] - Replaces, add, or deletes portions of a value
rather than replacing the whole value.
ini-file,ini-section,profile-name[,old-field][,new-field][,flags]
The profile name is the key; the name of the entry to change. Flags:
- Bit 0, value 0 - Treat the * literally and not as a wildcard.
- Bit 0, value 1 - Treat * as a wildcard when matching fields.
- Bit 1, value 0 - Use a blank to separate new fields.
- Bit 1, value 1 - Use a comma to separate new fields.
- [AddReg] - Adds registry entries.
reg-root-string[,subkey]l[,value-name][,flags][,value]
reg-root-string may be one of HKCR, HKCU, HKLM, or HKU, which
correspond to HKEY_CLASSES_ROOT, HKEY_CURRENT_USER,
HKEY_LOCAL_MACHINE, and HKEY_USERS. The subkey is the path to the
value, enclosed in quotes. Flags are:
- 0 - REG_SZ, string
- 1 - REG_BINARY, binary data
- 0x00010001 - REG_DWORD, binary
- [DelReg] - Deletes registry entries.
reg-root-string,subkey[,value-name]
See the AddReg section for entry information.
- [Ini2Reg] - Copies settings from an ini file into the registry.
ini-file,ini-section,[ini-key][,reg-root-string,subkey[,flags]
Pretty self explanatory, refer to AddReg for registry key info. Flags
are:
- Bit 0, value 0 - default, don't delete the entry from the ini
file after importing it the the registry.
- Bit 0, value 1 - delete the ini entry after moving it to the
registry.
- Bit 1, value 0 - default, if the registry sub key already exists,
don't delete it's current value.
- Bit 0, value 1 - if the registry subkey already exists, replace
it's current value with the one from the ini file.
- [DestinationDirs] - Specifies the directories to perform file
actions on (CopyFiles, RenFiles, DelFiles).
file-list-section=DIRD[,subdir]
The file-list-section is a section name of the type CopyFiles,
RenFiles, or DelFiles. The subdir is the sub path within the path
specified by the DIRD. The DIRD is one of the following:
- -01 - The directory from which the INF file was
installed.
- 01 - sourcedrive:\path
- 10 - Windows directory
- 11 - System directory
- 12 - Drivers directory
- 17 - INF file directory
- 18 - Help directory
- 20 - Fonts directory
- 21 - Viewers directory
- 24 - Applications directory
- 25 - Shared directory
- 30 - Root directory of the boot drive
- 50 - %windir%\system
- 51 - Spool directory
- 52 - Spool drivers directory
- 53 - User profile directory
- 54 - Path to ntldr or OSLOADER.exe
[Strings] - A group of string keys and values that can be replaced
in the rest of the INF by using %string-key-name% where you what the
constant to show up. The [Strings] is the default, but you can
specify languages by creating sections named
[Strings.lang-id], where lang-id is the four digit hex
number identifying a language.
string-key="string-value"
The only section that has to be included is the Version section.
You can for INF files to run by right clicking on them in Windows explorer and selecting the "install" item from the popup. In order for this trick to work, there must be an install section defined called [DefaultInstall]. You can also execute individual sections of an INF file with commands like the following:
rundll32.exe advpack.dll,LaunchINFSection filename.inf, infSection
Replace filename.inf with the filename or your INF file, and infSection with the section you want to run.
Cool things to do with INF files:
- Create an INF file that installs all of the system policy keys in the registry, effectively rendering the machine useless. Set this up to run when ever a new profile is created on the machine, or just take it to computer stored on floppy and install it.
-
- Change the Internet Explorer and Outlook INF files so that they don't install icons all over the place when a new profile is created on the machine (useful on corporate machines).
- You can use INF files to delete system policies in the registry if your BOFH has the "disable registry editing tools" policy set. Write an INF file to delete that policy key and others to get full access to your machine.
- ...
- Use your imagination.
Note that playing with INF files can seriously pooch your system. Keep a ghost image on CD or a backup or use dd in Linux to copy you Windows partition to a file for easy restoration or something.
For more information about INF files and the setup process in
general, refer to the Windows Resource Kits, the Windows DDK, and
the Win32 SDK. Some of this information came from the MSDN library.