This example does some validation calculations for CHM header's parameters beyond simple file size extraction. GUID: 7C01FD11-7BAA-11D0-9E0C-00A0-C922-E6ECĬHM file size, File Recovery Custom Scripting Example Windows Language ID, for example 0x0409 = LANG_ENGLISH/SUBLANG_ENGLISH_US Timestamp, big-endian DWORD, contains seconds (MSB) and fractional seconds (second byte). Version of Microsoft Help CHM file, 3 in most cases Header provide us with all CHM file data, provided that file is not fragmented. Thus reading of all 815,211 consecutive bytes starting from the position of detected ITSF Total CHM file size is 815,211 bytes (6B 70 0C hex), four bytes, little-endian order, at offset 8 in the section (or offset 0圆8 from the beginning of the file). Next to the initial header we see Header Section 0, starting from signature 0xFE 0x01. Initial header total size is 96 bytes (4 bytes at offset 8, little-endian, hex: 60 00 00 00). Version check confirms that it is a valid CHM file v. When inspecting example.chm file's binary data using any Hex Viewer, like Disk Editor we can see it starts Is located at offset 8 at this header section, 4 bytes, little-endian order. It has a signature 0x01 0xFE, and CHM total file size Next to the initial header is located Header Section 0. Initial header size is defined at offset 8: 4 bytes, little-endian order (lowest byte first). This is followed by the header section table and the offset to the content.įile version is in initial header - four bytes at offset 3, little-endian order. Microsoft Help CHM files start with a signature ITSF (characters 'I','T','S','F' or bytes 0x49, 0x54, 0x53, 0x46).Įxcept signature, it begins with a short initial header (56 bytes).

CHM Signature Format: Specification & CHM Recovery Example

Chm file