URL Substitutions

Internet Explorer recognises substitutable parameters in URLs. Each parameter stands for some such thing as a browser version or locale ID. Substitution is handled through several undocumented SHDOCVW and IEFRAME functions. The most general is URLSubstitution, which processes a URL directly as a string. Two others first get the string from elsewhere: URLSubLoadString from a string resource; and URLSubRegQuery from a registry value.

Though the relevant functions are undocumented, Microsoft does grant the notion of substitutable parameters in URLs a passing mention in two Knowledge Base articles. In How to configure your Internet Explorer settings after your computer has had malicious software removed, users who have to reset their search options are directed to enter various strings into registry values. Two of these “default” URLs depend on the {SUB_RFC1766} parameter. The much older article How to Change the Internet Explorer Initial Start Web Page shows a URL that expects resolution of {SUB_CLSID}, {SUB_PRD} and {SUB_PVER}.

Whether any websites other than Microsoft’s actually do use these substitutions as a means to direct Internet Explorer users to different pages depending on their operating system or locale, I do not know but I would not be surprised. Examples that presumably do work for Microsoft’s sites are readily available in the SHDOCVW and IEFRAME resource strings, and the computer industry is very competent at copying from examples.

Whether any browsers other than Microsoft’s support any of these substitutable parameters is even more an open question. That they have some knowledge of the parameters is at least plausible. After all, some such browsers offer at installation to transfer settings from Internet Explorer. It will be shown below that Microsoft’s main use for URL substitutions has been for standard locations, such as a home page or search page. How is a non-Microsoft browser to conform to its user’s existing choice of such locations, if the URLs as given in the registry contain substitutable parameters?


Eight substitutable parameters are presently defined. The relevant functions resolve only the first occurrence of each parameter that is indicated by a dwFlags argument to the function.

Substitutable Parameter Evaluation Flag Applicable Versions
{SUB_CLCID} user-default locale ID, as hexadecimal digits 0x80 6.0 and higher
{SUB_CLSID} user-default locale ID, as hexadecimal digits 0x01 4.71 to 5.50 only
0x80 6.0 and higher
{SUB_OLCID} system-default locale ID, as hexadecimal digits 0x40 6.0 and higher
{SUB_OS} operating system, e.g., “N6” 0x08 4.72 from Windows 98, and higher
{SUB_OVER} operating-system version, e.g., “5.1” 0x20 6.0 and higher
{SUB_PRD} product (or browser), e.g., “ie” 0x02 4.71 and higher
{SUB_PVER} product version, e.g., “6.0” 0x04 4.71 and higher
{SUB_RFC1766} web locale, in RFC1766 format, e.g., “en-US” 0x10 5.0 and higher

Browser Product and Version

The {SUB_PRD} and {SUB_PVER} parameters are resolved from string resources: numbers 556 and 557, respectively. In U.S. editions of Internet Explorer and Windows, these evaluate as follows:

4.71 and 4.72 ie 4.0
5.0 ie 5.0
5.50 ie 5.5
6.0 and higher ie 6.0

Note that {SUB_PVER} continues to resolve as “6.0” even for the IEFRAME from Windows 7. Perhaps Microsoft no longer uses this parameter in any of its own URLs.

Operating System and Version

The original evaluation of {SUB_OS} depends on answers from the SHLWAPI function IsOS (as computed when SHDOCVW initialises):

Condition Evaluation
if not OS_NT “95”
else “N4”

In version 6.0 from before Windows Vista, the testing is a little more elaborate and makes two new cases (and is computed from IsOS while substituting):

Conditions Evaluation

If none of these conditions are satisfied, {SUB_OS} resolves to nothing. Note that ME is not a possible evaluation of {SUB_OS} on Windows Me unless Internet Explorer 6.0 is installed.

In version 6.0 from Windows Vista, and higher, installation on older systems is not expected, and description of newer systems seems not to be wanted: {SUB_OS} has the hard-coded evaluation N6.

The {OS_OVER} parameter is not recognised until version 6.0. In the early builds, if IsOS answers that the operating system is not OS_WINDOWS but is OS_NT and OS_XPORGREATER, then {OS_OVER} evaluates to “5.1”, else to nothing. In version 6.0 from Windows Vista, and higher, evaluation of {SUB_OVER} to “5.1” is hard-coded.

Web Locale

The web locale for {SUB_RFC1766} is obtained from the following registry value:

Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International
Value AcceptLanguage

Within the string data for this value, the web locale consists of everything up to but not including the first comma or semicolon. If this is not a locale in RFC1766 format already, or if there is no string data for the registry value, then {SUB_RFC1766} is resolved by converting the user-default locale ID to RFC1766 format.

System and User Locales

For {SUB_CLCID} and {SUB_OLCID}, the user-default and system-default locales are expressed in C-language hexadecimal format, with the prefix 0x and a width of four digits, padding from the left with zeros.

The {SUB_CLSID} parameter is the original {SUB_CLCID}, and continues to be recognised as an alias.

Use By Microsoft

Substitutable parameters aren’t recognised in arbitrary URLs that become known to Internet Explorer for arbitrary reasons. They are interpreted only when some module, not necessarily of Internet Explorer, makes a point of asking that substitutable parameters be resolved.

Standard Locations

Arguably the main use of URL substitutions is in the several URLs that are defined in the registry to provide Internet Explorer with standard locations such as a home page or search page. These are retrieved programmatically by the _GetStdLocation function from the following registry values in either of two keys, which are listed below in decreasing order of precedence:

Key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Values: Extensions Off Page (version 7.0 and higher)
First Home Page
Local Page
Search Bar
Search Page
Security Risk Page (version 7.0 and higher)

or from one other registry value in any of four keys:

Key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Values: Start Page

The data for each registry value (necessarily of type REG_SZ or REG_EXPAND_SZ in version 7.0 and higher) is the corresponding URL.

Help Menu URLs

This section is in progress. Take more than your usual care.

Also configurable through the registry but subject to URL substitutions are the URLs for various items on Internet Explorer’s Help menu. One menu item is represented by name, the others by numbers. Again, each registry value may be in either of two keys:

Key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Help_Menu_URLs
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Help_Menu_URLs
Values: Online_Support

The data for each registry value (necessarily of type REG_SZ or REG_EXPAND_SZ in version 7.0 and higher) is the corresponding URL. If no URL can be found from the registry, a default is loaded from string resources. The table below presents the known interpretations. To keep the table to a satisfactory width, two shorthands are used:

Not all the following menu items will show on the Help menu in all circumstances. Indeed, most are still being investigated for ways that the relevant code can get executed.

Registry Value Menu Item Default URL Applicable Versions
0 Web Tutorial ar=tutorial 5.0 to 6.0
LinkId=58472 7.0 and higher
2 Free Stuff ar=free 5.0 to 6.0
LinkId=55028 7.0 and higher
3 Product Updates ar=ienews&os={SUB_OS} 5.0 to 6.0
4 Frequently Asked Questions ar=faq 5.0 to 6.0
LinkId=54796 7.0 and higher
Online_Support Online Support ar=support 5.0 to 6.0
LinkId=54796 7.0 and higher
6 Send Feedback
Send Feedback...
ar=feedback 5.0 to 6.0
LinkId=54537 7.0 and higher
7 Best of the Web
Customer Feedback Options...
ar=best 5.0 to 6.0
LinkId=55107 7.0 and higher
8 Search the Web ar=allinone 5.0 to 6.0
LinkId=54896 7.0 and higher
9 Microsoft Home Page ar=ms 5.0 to 6.0
LinkId=55027 7.0 and higher
10 Get Faster Internet Access ar=isdn 5.0 to 6.0
LinkId=58473 7.0 and higher
11 Internet Start Page ar=inetstart 5.0 to 6.0
LinkId=54729 7.0 and higher
161 Enhanced Security Configuration res://ieframe.dll/IESecHelp.htm 6.0 from Windows 2003 to 7.0
-32525 Product Updates http://windowsupdate.microsoft.com 7.0 and higher

It is at least plausible that the last two (and especially the last) are configurable in the registry only by oversight. The last anyway does not apply if running on Windows Vista or higher (in which case, IEFRAME runs WUAPP.EXE instead of navigating to a URL).