Crate lnk_core 

lnk-core — a reader for Windows Shell Link (.lnk) files.

Parses the [MS-SHLLINK] Shell Link (.LNK) Binary File Format into a typed ShellLink: the ShellLinkHeader (flags, attributes, the three target FILETIMEs, file size, icon index, show command, hotkey), the optional LinkInfo (the VolumeID drive type / volume serial number / label and the local base path, plus a CommonNetworkRelativeLink for network targets), the StringData block, and the ExtraData TrackerDataBlock (the origin machine NetBIOS name and the distributed-link-tracking droid GUIDs).

The input is attacker-controllable evidence: parsing is bounds-checked, never panics, and never trusts a length field. No unsafe. Malformed headers yield None rather than a partial/garbage value. The format constants live in forensicnomicon::shlink (knowledge-only); the parsing algorithm lives here.

Authoritative source

[MS-SHLLINK] — Shell Link (.LNK) Binary File Format: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943

Modules

drive_type

DriveType values ([MS-SHLLINK] §2.3.1 / Win32 GetDriveType).

Structs

CommonNetworkRelativeLink

The CommonNetworkRelativeLink ([MS-SHLLINK] §2.3.2).

DestListEntry

A DestList stream entry — the per-target MRU metadata that accompanies an embedded shell link in an automatic-destinations Jump List.

DroidGuids

A Droid volume/object GUID pair, rendered in the canonical 8-4-4-4-12 form.

JumpList

A parsed Jump List.

JumpListEntry

One Jump List entry: an embedded shell link plus, for automatic destinations, its DestList MRU metadata.

LinkInfo

The LinkInfo block ([MS-SHLLINK] §2.3).

LinkTargetIdList

The LinkTargetIDList ([MS-SHLLINK] §2.2) — the target’s shell-namespace path as an ITEMIDLIST (PIDL). The raw blob is kept verbatim and also decoded into typed shell items + a reconstructed path via the shellitem primitive.

ShellLink

A fully parsed Windows Shell Link.

ShellLinkHeader

The ShellLinkHeader ([MS-SHLLINK] §2.1).

StringData

The decoded StringData block ([MS-SHLLINK] §2.4).

TrackerDataBlock

The TrackerDataBlock ([MS-SHLLINK] §2.5.10) — origin machine + droid GUIDs.

VolumeId

The VolumeID ([MS-SHLLINK] §2.3.1).

Enums

JumpListKind

Which Jump List family a JumpList was parsed from.

Functions

parse_automatic_destinations

Parse a *.automaticDestinations-ms Jump List from its bytes.

parse_custom_destinations

Parse a *.customDestinations-ms Jump List from its bytes.

parse_shell_link

Parse a Shell Link from its bytes.