mtswslnk

Certain older Microsoft software (including Windows font files) contains mysterious strings starting with “mtswslnk”, sometimes longer and sometimes shorter. This led some people to wild speculation about the meaning and purpose of the string.

Let’s start with the full string: it’s “mtswslnkmcjklsdlsbdmMICROSOFT”, although it rarely appears in its entirety. Now there are two questions—what is the purpose of the string, and what does it mean?

Answering the first question is easy. When viewing a binary in a hex editor, it is blindingly obvious that the string can start at any offset, but always ends on a 16-byte boundary. It almost exclusively (see below) appears in 16-bit segmented New Executable (NE) binaries, and that includes font files. Comparing the string locations with the output of any NE parser, it is apparent that it always occurs at the end of a “section” of an NE image. In other words, it is padding, perhaps used to avoid the problems caused by leaking uninitialized data.

Where does it come from? Well, there’s just one executable where the string appears in full and not aligned, and that’s not an NE image: the Windows Resource Compiler (RC.EXE). The string appears to be located at the beginning of a 512-byte buffer padded with zeros, and itself not aligned in the file.

Examining a few versions of Microsoft’s Windows SDKs, it’s clear that the string was used as padding by RC.EXE shipped with Windows 1.x and 2.x SDKs. However, the string was no longer present in the Windows 3.0 SDK RC.EXE, and hence it does not appear in Windows 3.0 and later NE images. The Windows 3.0 RC naturally still pads NE images, but with zeros… boring.

The mtswslnk string does not appear in a very old RC.EXE shipped with Windows Developer Release 5 (October 1984). However, the string is present in the Windows 1.01 SDK (RC.EXE dated November 1985). It also appears in the Windows 1.03 and 1.04 SDK, the Windows 2.03 SDK, and miscellaneous other tool collections.

Because most executables shipped with Windows 1.x and 2.x included resources, the string is very common in any Windows 1.x or 2.x installation. It also exposes the fact that RC.EXE was a surprisingly complex utility—due to the design of the NE format, the resource compiler had to restructure the entire image. It had to expand the header and then shift everything else in the file; not a trivial operation.

Now the second question… what does “mtswslnk…” mean? That may be impossible to answer nowadays. Most of it (especially “jklsdlsdbm”) looks like random banging on the keyboard more than anything else. It could have some meaning (apart from the obvious “MICROSOFT”) but then again it might not. If it does, the meaning may be lost to the winds of time. Or does anyone know?