URL Substitutions

Internet Explorer recognises substitutable parameters in URLs. Each parameter stands for some such thing as a browser version or locale ID. Substitution is handled through several undocumented SHDOCVW and IEFRAME functions. The most general is URLSubstitution, which processes a URL directly as a string. Two others first get the string from elsewhere: URLSubLoadString from a string resource; and URLSubRegQuery from a registry value.

Though the relevant functions are undocumented, Microsoft does grant the notion of substitutable parameters in URLs a passing mention in two Knowledge Base articles. In How to configure your Internet Explorer settings after your computer has had malicious software removed, users who have to reset their search options are directed to enter various strings into registry values. Two of these “default” URLs depend on the {SUB_RFC1766} parameter. The much older article How to Change the Internet Explorer Initial Start Web Page shows a URL that expects resolution of {SUB_CLSID}, {SUB_PRD} and {SUB_PVER}.

Whether any websites other than Microsoft’s actually do use these substitutions as a means to direct Internet Explorer users to different pages depending on their operating system or locale, I do not know but I would not be surprised. Examples that presumably do work for Microsoft’s sites are readily available in the SHDOCVW and IEFRAME resource strings, and the computer industry is very competent at copying from examples.

Whether any browsers other than Microsoft’s support any of these substitutable parameters is even more an open question. That they have some knowledge of the parameters is at least plausible. After all, some such browsers offer at installation to transfer settings from Internet Explorer. It will be shown below that Microsoft’s main use for URL substitutions has been for standard locations, such as a home page or search page. How is a non-Microsoft browser to conform to its user’s existing choice of such locations, if the URLs as given in the registry contain substitutable parameters?

Parameters

Eight substitutable parameters are presently defined. The relevant functions resolve only the first occurrence of each parameter that is indicated by a dwFlags argument to the function.

Browser Product and Version

The {SUB_PRD} and {SUB_PVER} parameters are resolved from string resources: numbers 556 and 557, respectively. In U.S. editions of Internet Explorer and Windows, these evaluate as follows:

Note that {SUB_PVER} continues to resolve as “6.0” even for the IEFRAME from Windows 7. Perhaps Microsoft no longer uses this parameter in any of its own URLs.

Operating System and Version

The original evaluation of {SUB_OS} depends on answers from the SHLWAPI function IsOS (as computed when SHDOCVW initialises):

In version 6.0 from before Windows Vista, the testing is a little more elaborate and makes two new cases (and is computed from IsOS while substituting):

If none of these conditions are satisfied, {SUB_OS} resolves to nothing. Note that ME is not a possible evaluation of {SUB_OS} on Windows Me unless Internet Explorer 6.0 is installed.

In version 6.0 from Windows Vista, and higher, installation on older systems is not expected, and description of newer systems seems not to be wanted: {SUB_OS} has the hard-coded evaluation N6.

The {OS_OVER} parameter is not recognised until version 6.0. In the early builds, if IsOS answers that the operating system is not OS_WINDOWS but is OS_NT and OS_XPORGREATER, then {OS_OVER} evaluates to “5.1”, else to nothing. In version 6.0 from Windows Vista, and higher, evaluation of {SUB_OVER} to “5.1” is hard-coded.

Web Locale

The web locale for {SUB_RFC1766} is obtained from the following registry value:

Within the string data for this value, the web locale consists of everything up to but not including the first comma or semicolon. If this is not a locale in RFC1766 format already, or if there is no string data for the registry value, then {SUB_RFC1766} is resolved by converting the user-default locale ID to RFC1766 format.

System and User Locales

For {SUB_CLCID} and {SUB_OLCID}, the user-default and system-default locales are expressed in C-language hexadecimal format, with the prefix 0x and a width of four digits, padding from the left with zeros.

The {SUB_CLSID} parameter is the original {SUB_CLCID}, and continues to be recognised as an alias.

Use By Microsoft

Substitutable parameters aren’t recognised in arbitrary URLs that become known to Internet Explorer for arbitrary reasons. They are interpreted only when some module, not necessarily of Internet Explorer, makes a point of asking that substitutable parameters be resolved.

Standard Locations

Arguably the main use of URL substitutions is in the several URLs that are defined in the registry to provide Internet Explorer with standard locations such as a home page or search page. These are retrieved programmatically by the _GetStdLocation function from the following registry values in either of two keys, which are listed below in decreasing order of precedence:

or from one other registry value in any of four keys:

The data for each registry value (necessarily of type REG_SZ or REG_EXPAND_SZ in version 7.0 and higher) is the corresponding URL.

Help Menu URLs

This section is in progress. Take more than your usual care.

Also configurable through the registry but subject to URL substitutions are the URLs for various items on Internet Explorer’s Help menu. One menu item is represented by name, the others by numbers. Again, each registry value may be in either of two keys:

The data for each registry value (necessarily of type REG_SZ or REG_EXPAND_SZ in version 7.0 and higher) is the corresponding URL. If no URL can be found from the registry, a default is loaded from string resources. The table below presents the known interpretations. To keep the table to a satisfactory width, two shorthands are used:

• ar=title and whatever follows means in full the URL “http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=title” and whatever follows;
• LinkId=number means in full the URL “http://go.microsoft.com/fwlink/?LinkId=number&clcid={SUB_CLCID}”.

Not all the following menu items will show on the Help menu in all circumstances. Indeed, most are still being investigated for ways that the relevant code can get executed.

It is at least plausible that the last two (and especially the last) are configurable in the registry only by oversight. The last anyway does not apply if running on Windows Vista or higher (in which case, IEFRAME runs WUAPP.EXE instead of navigating to a URL).