Certain older Microsoft software (including Windows font files) contains mysterious strings starting with “mtswslnk”, sometimes longer and sometimes shorter. This led some people to wild speculation about the meaning and purpose of the string.
Let’s start with the full string: it’s “mtswslnkmcjklsdlsbdmMICROSOFT”, although it rarely appears in its entirety. Now there are two questions—what is the purpose of the string, and what does it mean?
Answering the first question is easy. When viewing a binary in a hex editor, it is blindingly obvious that the string can start at any offset, but always ends on a 16-byte boundary. It almost exclusively (see below) appears in 16-bit segmented New Executable (NE) binaries, and that includes font files. Comparing the string locations with the output of any NE parser, it is apparent that it always occurs at the end of a “section” of an NE image. In other words, it is padding, perhaps used to avoid the problems caused by leaking uninitialized data.
Where does it come from? Well, there’s just one executable where the string appears in full and not aligned, and that’s not an NE image: the Windows Resource Compiler (RC.EXE). The string appears to be located at the beginning of a 512-byte buffer padded with zeros, and itself not aligned in the file. Continue reading
