Mark0's software support board
April 23, 2018, 09:43:09 am *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the new forum! Guests can posts without registration.
   Home   Help Search Login Register  
Pages: [1]
Author Topic: TrID update of autorun.trid.xml + variant for Autorun.inf file  (Read 844 times)
Jr. Member
Posts: 56

« on: July 15, 2017, 04:52:37 pm »


when i run TrID on on hundreds of AUTORUN*.INF files dozens are misidentified
( "Generic INI configuration" see appended output/trid-old.txt ).

The newest file(1) command version ( identifies most
of these examples correct as "Microsoft Windows Autorun file"
( see appended output/file-new.txt ).

After updating definition file autorun.trid.xml by tridscan i manually fine
tuned XML file.

Unfortunately Microsoft still has not registered an official mime by IANA for their
own file types. Because these files are just simple text files, "text/plain"
could be used, but this is too general. Maybe "text/x-autorun" would be sufficient.
But finally i use type find for WINE emulator on Linux by line:

Furthermore i add Wikipedia page about Autorun as reference URL.

Most autorun examples ( see examples in directory OK_AUTORUN) start with text lines like
open=notepad readme.txt

This give in old definition file for offset 15 a pattern construct:
         <ASCII> =</ASCII>

This is not always true. The section can start with another directive like
"action" found in BitLocker file autorun-bitlocker.inf for example. Equal sign
is also at other position if variable assignment is white space padded found
on Norton product DVD (see AUTORUN-norton.INF) like:
open = NCDStart.EXE
So above mentioned pattern vanish.

In most autorun files after the right bracket "]" a DOS line feed "CRLF ~ 0D0A"
is found. This is expressed by XML pattern like
         <ASCII> [ a u t o r u n ]</ASCII>
Unfortunately this is not always true. Autorun files created on UNIX system sometimes
use "LF ~ 0A" as end of line ( See example autorun-kalilinux.inf ).
I also found examples (autorun-garmin.inf, Autorun-becker.inf) on some
navigation software CD-ROM where additional space is behind right bracket.
So XML construct must be reduced like:
         <ASCII> [ a u t o r u n ]</ASCII>

Some autorun start with directive for 64 bit systems, found for example on
Windows 10 install medium. This looks like:
So XML construct must be more reduced like:
         <ASCII> [ a u t o r u n</ASCII>

In most cases the section name is in low case like "[autorun]", but i found
examples with mixed case name "[AutoRun]" found on Windows XP CD ( see
AUTORUN-xp.INF ) or Lenovo PC ( see AUTORUN-lenovo.INF )
So above pattern is finally replaced by 3 new sub part patterns like
         <ASCII> [</ASCII>
         <ASCII> u t o</ASCII>
         <ASCII> u n</ASCII>
and a new string in global strings section like:

Like other INI configuration files lines starting with semicolon are comment
lines. Unfortunately some AUTORUN files contains comments at the beginning.
Such example is found on Virtualbox VBoxGuestAdditions CD ( See file
no-bracket/AUTORUN-VBoxGuestAdditions.INF). It looks like:
; Copyright (C) 2006-2016 Oracle Corporation
So this file is still classified by TrID as "plain text/ASCII" ( See
So i generate a variant autorun-comment.trid.xml with new pattern like:
         <ASCII> ;</ASCII>
Assuming that at least 2 directive are used to give data medium an other label
and an own icon this results in a global string section like:

With this second definition file such autorun examples are now recognized as
"Autorun.inf file (Wink". (see no-bracket/output/trid-v-newer.txt)

TrID definitions, some examples and output are stored in archive
I hope that my two XML files can be used in future version of triddefs.

With best wishes
Jörg Jenderek

Hero Member
Posts: 1632

« Reply #1 on: July 19, 2017, 01:27:53 am »

Hi Joerg!

Thanks for the new/updated defs.
I think I'll go with "text/inf" for the mime type.
Pages: [1]

Jump to:  

Powered by MySQL Powered by PHP Powered by SMF | SMF © 2001-2010, Lewis Media Valid XHTML 1.0! Valid CSS!
Page created in 0.16 seconds with 16 queries.