dissect.shellitem.lnk
#
Submodules#
Package Contents#
Classes#
This class represents a LNK file's SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. |
Attributes#
- class dissect.shellitem.lnk.Lnk(fh: Optional[BinaryIO] = None, link_header: Optional[dissect.shellitem.lnk.c_lnk.c_lnk.SHELL_LINK_HEADER] = None, target_idlist: Optional[LnkTargetIdList] = None, linkinfo: Optional[LnkInfo] = None, stringdata: Optional[LnkStringData] = None, extradata: Optional[LnkExtraData] = None)#
This class represents a LNK file’s SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. This SHELL_LINK_HEADER structure contains identification information, timestamps, and flags that specify the pressence of optional structures.
Parses a .lnk file (aka Microsoft Shell Item) according to the MS-SHLLINK specification reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf
- Parameters:
fh – A file-like object to a link file.
link_header – A SHELL_LINK_HEADER structure.
target_idlist – A LnkTargetIdList object.
linkinfo – A LnkInfo object.
stringdata – A LnkStringData object.
extradata – A LnkExtraData object.
- property clsid: uuid.UUID#
Returns the class id (clsid) of the LNK file.
- flag(name: str) int #
Retuns whether supplied flag is set.
- Parameters:
name – Name of the flag
- Returns:
>0 if flag is set
- Return type:
int
- __repr__() str #
Return repr(self).
- dissect.shellitem.lnk.c_lnk#