How Windows 3.11 Executed Program Group Shortcuts
In Microsoft Windows 3.11, the desktop shell was managed by Program
Manager (PROGMAN.EXE), which organized application
shortcuts into distinct groups saved as binary files with the
.GRP extension. Rather than using individual shortcut files
like the .LNK format introduced in Windows 95, Windows 3.11
centralized collections of shortcuts inside these structured group
containers. This article examines the internal architecture of
.GRP files, how Program Manager retrieved stored metadata,
and the exact system routines the Win16 environment executed to launch
applications.
The Architecture of
.GRP Files
In Windows 3.11, individual program shortcuts did not exist as
standalone files on the file system. Instead, Program Manager referenced
group files (such as MAIN.GRP or ACCESSOR.GRP)
stored in the Windows directory.
Each .GRP file was a proprietary 16-bit binary format
containing:
- The Group Header: A signature (identifiable by the
ASCII string
PMGROUP), file size indicators, icon coordinates, and offsets to individual item descriptors. - The Item Array: A lookup table containing offsets pointing to the location of each shortcut entry within the file.
- Item Descriptors (
ITEMDATAstructures): Records holding the specific parameters of each shortcut, including:- Application display name.
- Command line string (the path to the executable and any runtime parameters).
- Working directory.
- Hotkey assignments.
- Icon resource data (path to the source
.ICO,.EXE, or.DLLand the corresponding icon index). - Run flags (such as whether to launch the application minimized).
Parsing and Event Handling in Program Manager
When Windows 3.11 started, Program Manager read
PROGMAN.INI to locate all configured .GRP
files and mapped their contents into memory. Within the Program Manager
window, each shortcut was rendered using the cached icon and title
specified in its respective ITEMDATA block.
When a user double-clicked a shortcut or pressed Enter on a highlighted icon:
- Program Manager captured the
WM_LBUTTONDBLCLKor keyboard event. - The application mapped the selected icon's UI element back to its
corresponding
ITEMDATAentry in memory. - Program Manager parsed the command line string, separating the target binary from any appended flags or file arguments.
- If a working directory was specified, Program Manager switched the
current drive and directory using internal DOS/Win16 calls
(
_chdriveand_chdir).
The Execution
Phase: WinExec and Kernel Processing
Once the command string and execution flags were extracted, Program
Manager called the Win16 API function WinExec().
The WinExec() call took two parameters: the
null-terminated command line string and a display flag (such as
SW_SHOWNORMAL or SW_SHOWMINIMIZED, derived
from the shortcut's properties). The execution flow then shifted to the
Windows core kernel (KRNL386.EXE in 386 Enhanced Mode):
- Target Identification: The kernel determined whether the target file was a 16-bit Windows application (New Executable or "NE" format), an MS-DOS program, or a dynamic wrapper.
- Win16 Executables: If the target was a native Windows executable, the kernel's module loader loaded the required segments into memory, resolved references via dynamic link libraries (DLLs), allocated a task database (TDB), and scheduled the program's primary thread into the cooperative multitasking loop.
- MS-DOS Applications: If the target was a
.COM,.EXE, or.BATfile designed for DOS, the kernel checked for an associated Program Information File (.PIF). In 386 Enhanced Mode, the system created a new virtual 8086 mode machine (Virtual Machine/VM) usingWINOLDAP.MOD(the Windows Old Application Manager), allocating memory and environment parameters according to the PIF settings before passing execution to MS-DOS.
Through this sequence, Windows 3.11 translated double-click events
into low-level execution calls, relying entirely on the internal records
of .GRP files rather than discrete file-system
shortcuts.