dissect.shellitem.lnk#

Submodules#

Package Contents#

Classes#

Lnk

This class represents a LNK file's SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures.

Attributes#

c_lnk

class dissect.shellitem.lnk.Lnk(fh: Optional[BinaryIO] = None, link_header: Optional[dissect.shellitem.lnk.c_lnk.c_lnk.SHELL_LINK_HEADER] = None, target_idlist: Optional[LnkTargetIdList] = None, linkinfo: Optional[LnkInfo] = None, stringdata: Optional[LnkStringData] = None, extradata: Optional[LnkExtraData] = None)#

This class represents a LNK file’s SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. This SHELL_LINK_HEADER structure contains identification information, timestamps, and flags that specify the pressence of optional structures.

Parses a .lnk file (aka Microsoft Shell Item) according to the MS-SHLLINK specification reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf

Parameters:

  • fh – A file-like object to a link file.

  • link_header – A SHELL_LINK_HEADER structure.

  • target_idlist – A LnkTargetIdList object.

  • linkinfo – A LnkInfo object.

  • stringdata – A LnkStringData object.

  • extradata – A LnkExtraData object.

property clsid: uuid.UUID#

Returns the class id (clsid) of the LNK file.

flag(name: str) → int#

Retuns whether supplied flag is set.

Parameters:

name – Name of the flag

Returns:

>0 if flag is set

Return type:

int

__repr__() → str#

Return repr(self).

dissect.shellitem.lnk.c_lnk#