Please read the glossary as all abbreviations in the document that are used many times are defined there.

All binary data in all structures described in this document are little-endian, unless otherwise indicated.

Where part of a structure is variable length then the offset of the next item will be shown as +0.

BYTE, WORD & DWORD have their normal meanings (8, 16 & 32-bit integers) and QWORD indicates a 64-bit integer.

The FILETIME structure is a QWORD representing the number of 100-nanosecond intervals since January 1, 1601. This is one of three types of timestamps used in Windows.

The time_t structure is a DWORD representing the the number of seconds elapsed since midnight (00:00:00), January 1, 1970, coordinated universal time. This is the standard Unix timestamp, and is also used on Windows.

An LCID is a DWORD locale identifier made up of a language ID in the lower WORD and a sort ID in the upper WORD.

A GUID is a "Globally Unique IDentifier". 0x10 bytes, arranged as 1 DWORD, 2 WORDs, and 8 BYTEs. It is based on UUIDs from DCE and is a combination of a timestamp, A clock sequence and related persistent state to deal with retrograde motion of clocks, A forcibly incremented counter to deal with high-frequency allocations, The truly globally unique IEEE machine identifier, obtained from a network card (the implementation does not require a network card; if no network card is present, a machine identifier can be synthesized from highly variable machine states and stored persistently).

This specification is extensively hyperlinked, which ensures that unknown concepts and reference information are only a click away. For those who prefer to read this specification as printed onto dead trees (or hemp) there is an glossary and index, all intradocument hyperlinks have chapter.section.subsection numbers and all external hyperlinks have the URLs printed.

The table below indicates the styles used to indicate various things.