File type associations in Windows 10

Ever since Windows 3.1, the association between a file type (like png, or txt) and an application has been done through a few keys in the Windows Registry, as explained in the documentation on MSDN.

HKEY_CLASSES_ROOT
    .jpg
        (Default) = Bearly.jpg
    .Bearly.jpg
       (Default) = BearlyPhotoViewer
    BearlyPhotoViewer
       (Default) = "Bearly.exe" "%1"

But starting with Windows 8 and continuing in Windows 10, this is not enough anymore. Windows now allows the user to associate a file type with a certain application only via the built-in GUI. The above registry keys, although still necessary, are not enough anymore to achieve this association.

The key is a special hash value in:

HKEY_CURRENT_USER
    Software\Microsof t\Windows\CurrentVersion\Explorer\FileExts
        .jpg
            UserChoice
                "Hash"="p3ahKz450J2="
                "ProgId"="Bearly.jpg"

that is computed and set when the the user selects a program in the “Open with…” window.

The hash is computed from the following values:

extension = ".jpg"
userSID = "S-1-5-21-463486358-3398762107-1964875780-1001"
progId = "Bearly.jpg"
keyTimeStamp = "01d3442a29887400"; timestamp of the UserChoice key
experience = "User Choice set via Windows User Experience {D18B6DD5-6124-4341-9318-804003BAFA0B}"
hash = Base64(MicrosoftHash(MD5(toLower(extension, sid, progid, regdate, experience))))

For computing the actual hash, there is a SetUserFTA command line tool or another open source implementation on github that also shows how to extract the experience string from Shell32.dll.

Leave a Reply

Your email address will not be published. Required fields are marked *