Friday, June 15, 2012

Windows 7 Thumbcache hash algorithm

What we know



  int count = 0;
  if (buffer_length) {
    } while (count < buffer_length);
  return seed;

  UInt64 hash = CalculateHashKey (0x95E729BA2C37FD21, VolGUID, 16);
  hash = CalculateHashKey (hash, FileID, 8);
  hash = CalculateHashKey (hash, FileModTime, 4);
  return hash;







  1. What did you use to find the hashing algorithm? And how did you find the input data that goes into it?

  2. I used IDA Pro, the best disassembler out there. The functions are located in shell32.DLL, GetThumbnailCacheId() and CalculateHashKey().

  3. Great information Yogesh - thanks.

    The value in the INDX entry is the MFT sequence number; it's also to be found at offset 16 for 2 bytes in a file's MFT record.

    BTW, you have a slight typo in your code at the point you increment the array count.


    1. Thanks for spotting that Simon, the 'v3' crept in from my enscript, it should have been replaced by 'count'. Fixed now.

  4. It may not work in every case, but one way you can match the ThumbCacheID to the orginal full path is using Windows.edb the Windows Search database.

    1. Yes indeed, from a practical point of view, that is where to match it. However the post was not meant for that, it is more academic and intends to explain the hashing scheme as to how these are generated in the first place.

  5. why do only certain caches get populated? Does it depend on which view you see the images in? extra large, large, small, and medium? (Does that affect which cache is populated?)

    1. That is correct, on first view of a particular file in explorer depending on the view size (small, large, ..) the thumbnail(s) will get created and stored in the appropriate cache file.

  6. This comment has been removed by the author.

  7. I'm using the same algorithm but I have had no luck generating the correct hash yet.
    What are byte arrays here and how is data filled in them?
    Consider this file_id = 46443371157476663
    Is this byte array set correctly?

    Thank you