What is the SYS file format?
The .sys extension indicates system files used in Windows and MS-DOS operating systems. Such files contain data regarding loadable drivers, device settings, and other low-level functions. Without .sys files, operating the system would be impossible, because they enable communication between the Windows kernel, hardware devices, and external peripherals.
The extension covers two distinct generations. In the MS-DOS era, .sys files were text-based or simple binary configuration and driver descriptors. In modern Windows NT (Windows 2000 and later), a .sys file is a Portable Executable kernel-mode driver binary - the same MZ/PE format as .exe and .dll files, but loaded and executed directly by the Windows kernel rather than by user-mode code.
Typical .sys files
The most common legacy .sys file is CONFIG.SYS, well known because it contains all driver declarations and configuration settings necessary to run MS-DOS. Other .sys files from that era include:
MSDOS.SYS- Contains the basic code of the DOS system, called the DOS kernel.IO.SYS- Contains standard DOS drivers and the program responsible for starting DOS; used in DOS and Windows 9x.KEYBOARD.SYS- Contains information about keyboard layout.
Modern Windows ships numerous driver .sys files, such as ntfs.sys (NTFS file-system driver) and tcpip.sys (TCP/IP network stack).
Location of .sys files
A large part of .sys files within the system is hidden. They can usually be found in the main Windows folder; in Vista and newer, .sys files are most often located in C:\Windows\System32\drivers\ and C:\Windows\WinSxS\. Hardware drivers are also staged in C:\Windows\System32\DriverStore\FileRepository\.
Additional notes
- Modern Windows kernel-mode
.sysdrivers run at Ring 0 and have full, unrestricted access to system memory and hardware. - On 64-bit Windows, all kernel-mode drivers must carry a valid digital signature; unsigned drivers are blocked at boot.
.sysfiles are sensitive to virus infections and malicious software - a corrupted driver is a leading cause of Blue Screen of Death (BSOD) crashes..sysfiles are PE binaries, not plain text, and can be inspected with tools such as PE-bear or Resource Hacker. An associated.inffile typically handles driver installation.
Security & safety
RISK: MEDIUMMost driver .sys files are legitimate, signed Windows components and are safe - the real dangers are two: (1) deleting/editing the wrong one. Removing a driver .sys can cause boot failure or a blue screen; let Windows Update and Device Manager manage drivers rather than touching the files. (2) Malicious drivers: because .sys drivers run in the kernel, rootkits and "BYOVD" (bring-your-own-vulnerable-driver) attacks abuse signed or fake .sys files for the deepest level of system access. Treat any unsigned/unknown .sys in an odd location with suspicion - check its digital signature (Properties > Digital Signatures, or Sigcheck) and scan it. A genuine Windows driver should be signed by Microsoft or a known hardware vendor.
Format details
in a nutshellFULL NAMEWindows Driver File
DEVELOPERMicrosoftsince 1981 (MS-DOS used .SYS for drivers); modern Windows NT drivers are PE binaries
CATEGORYSystem Files
MIME TYPEapplication/octet-stream
TYPEPortable Executable (PE) kernel-mode driver binary
This extension is also used by…
- Reserved system data blobs (pagefile.sys, hiberfil.sys, swapfile.sys) - Large reserved disk regions Windows manages for virtual memory and hibernation - not programs and not openable.
- Legacy DOS configuration/text files (CONFIG.SYS, HIMEM.SYS) - Plain-text MS-DOS startup scripts and old real-mode drivers that open in any text editor.
MAGIC BYTES · FILE SIGNATURE
OFFSET
0001
HEX
4D5A
ASCII
MZ
A Windows driver .sys is a Portable Executable binary: it begins with "MZ" (4D 5A) at offset 0, with the "PE\0\0" marker further in (like an EXE or DLL). The difference from a user-mode program is the PE subsystem field marking it as a native/kernel driver.
Programs that open SYS files
Windows3 apps
Leave it to Windows (do not open a driver .sys)
Built-in Driver .sys files are loaded and managed by Windows; you don't open them. Don't delete or edit them - it can break booting or cause a blue screen.
File Properties > Details / Sigcheck
Free To identify a driver .sys, right-click > Properties > Details (product/company), or run Sysinternals Sigcheck to see its signature and origin.
PE viewer (PE-bear / Resource Hacker / Dependency Walker)
Free For developers/analysts: open a driver .sys in a PE inspector to view its headers, imports and version info (read-only analysis). Technical details
deep spec| Binary format | Portable Executable (PE) kernel-mode driver; identical container format to .exe and .dll files |
| Magic bytes | 4D 5A ("MZ") at offset 0; PE signature 50 45 00 00 at the offset stored in the MZ header |
| PE subsystem | 1 - IMAGE_SUBSYSTEM_NATIVE; marks the binary as a kernel/native driver, not a user-mode application |
| Execution privilege level | Ring 0 (kernel mode); full unrestricted access to hardware registers, physical memory and system data structures |
| MIME type | application/octet-stream |
| Kernel-mode code signing | Mandatory on 64-bit Windows Vista and later; drivers must be WHQL- or EV-signed; Secure Boot enforces the signing policy at boot |
| Typical install location | C:\Windows\System32\drivers\; staging copy kept in C:\Windows\System32\DriverStore\FileRepository\ |
| File visibility | Hidden system attribute set by default; not shown in Explorer without enabling both Show hidden files and Show protected operating system files |
| Loading mechanism | Windows Service Control Manager (SCM) at boot or on demand; boot-start drivers listed under HKLM\SYSTEM\CurrentControlSet\Services in the registry |
| MS-DOS legacy role | Text-based or simple binary configuration descriptor (CONFIG.SYS, IO.SYS, MSDOS.SYS); predates the PE driver format by over a decade |
| Architecture variants | Separate builds required for x86 (32-bit), x86-64 (AMD64) and ARM64; a single .sys file targets one architecture only |
| Driver development framework | WDM (Windows Driver Model) or WDF/KMDF (Windows Driver Frameworks - Kernel-Mode Driver Framework); compiled with the Windows Driver Kit (WDK) |
| Security sensitivity | Critical - a faulty or malicious kernel driver can cause Blue Screen of Death (BSOD), data corruption or full system compromise |
| Developer | Microsoft for Windows built-in drivers; hardware vendors supply additional signed .sys files via INF-based driver packages |
| Related formats | .exe and .dll share the PE container; .drv is a legacy user-mode driver DLL; .inf provides installation metadata; .vxd was the Win9x virtual device driver format |
| Released | 1981 (MS-DOS used .SYS for drivers); modern Windows NT drivers are PE binaries |
| Specification | learn.microsoft.com |
SYS conversions
Not possible
Community Q&A
asked by users
S
Frequently asked questions
How do I open a .sys file?
A driver .sys isn't meant to be opened - Windows loads it. To find out what it is, right-click > Properties > Details (company/product) or run Sigcheck. Don't try to open a driver .sys as text; it's a binary.
A blue screen mentioned a .sys file - what does that mean?
It names the driver Windows believes caused the crash (e.g. a graphics or storage driver). The fix is usually to update, roll back or reinstall that driver, not to touch the file. Search the exact .sys name to find which device it belongs to.
Is a .sys file a virus?
Usually no - most are legitimate signed drivers. But because drivers run in the kernel, malware (rootkits) can masquerade as .sys files. Check the digital signature (Properties > Digital Signatures) and scan unknown ones; a real Windows driver is signed by Microsoft or the hardware vendor.
Can I delete a .sys file to free up space?
Don't delete driver .sys files - removing one can disable hardware or stop Windows booting. (Some other .sys files you may notice, like pagefile.sys or hiberfil.sys, are reserved Windows data, not drivers, and are also best managed through Windows settings, not deleted by hand.)
Can I convert a .sys file to .exe or .dll?
No. A driver .sys is a kernel-mode binary, not a runnable application or a user-mode library, so there's no meaningful conversion.
How do I update the driver named in a crash?
Identify the device the .sys belongs to (Properties > Details, or search the filename), then update it via Device Manager or the hardware vendor's site. If a recent update caused the crash, roll the driver back instead.
References
1Microsoft - Windows Driver Kit / drivers documentationlearn.microsoft.com
2Microsoft - PE Format (Portable Executable)learn.microsoft.com
