Cerbero SDK

    Guides

    • Command-line scripting in Cerbero Suite
    • Creating plugins and extensions for Cerbero Suite and Cerbero Engine
    • Understanding structures

    Core Modules

    • Pro.Core — Core API for parsing and scanning files
    • Pro.UI — User-interface API for views, dialogs and workspaces
    • Pro.Crypto — Crypto API
    • Pro.Carbon — API for disassembling and decompiling native binaries
    • Pro.MP — Multi-Processing API
    • Pro.SiliconSpreadsheet — Spreadsheet macro emulation API
    • Pro.Package — API for handling packages

    Built-in File Format Modules

    • Pro.CAB — API for parsing Microsoft Cabinet files
    • Pro.Certificates — API for parsing certificates
    • Pro.CFBF — API for parsing legacy Office documents
    • Pro.Class — API for parsing Java Class files
    • Pro.DEX — API for parsing Android DEX files
    • Pro.DIB — API for parsing DIB images
    • Pro.ELF — API for parsing ELF executables
    • Pro.GIF — API for parsing GIF images
    • Pro.GZ — API for parsing GZip archives
    • Pro.ITSF — API for parsing Microsoft CHM files
    • Pro.JPEG — API for parsing JPEG images
    • Pro.Lnk — API for parsing Windows Link files
      • Overview
      • Printing the Contents of a Link
      • Module API
    • Pro.MachO — API for parsing Mach-O executables
    • Pro.PDB — API for parsing Microsoft debug files
    • Pro.PDF — API for parsing PDF documents
    • Pro.PE — API for parsing Portable Executables
    • Pro.PNG — API for parsing PNG images
    • Pro.RTF — API for parsing Rich-Text documents
    • Pro.SQLite3 — API for parsing SQLite3 databases
    • Pro.SWF — API for parsing Adobe Flash files
    • Pro.TIFF — API for parsing TIFF images
    • Pro.WScript — API for parsing Windows Script files
    • Pro.XML — API for parsing XML documents
    • Pro.Zip — API for parsing Zip archives

    Installable File Format Modules

    • Pkg.ActiveMime — API for parsing ActiveMime files
    • Pkg.AR — API for parsing AR archives
    • Pkg.CRX — API for parsing Chrome extensions
    • Pkg.DotNETManifestResources — API for parsing .NET manifest resources
    • Pkg.DSStore — API for parsing Apple’s .DS_Store files
    • Pkg.ISO — API for parsing ISO file systems
    • Pkg.OneNote — API for parsing Microsoft OneNote documents
    • Pkg.PCAP — API for parsing PCAP and PCAPNG packet capture files
    • Pkg.PList — API for parsing Apple’s property list files
    • Pkg.PYC — API for parsing Python compiled bytecode files
    • Pkg.RAR — API for parsing RAR archives
    • Pkg.RegHive — API for parsing Windows Registry hive files
    • Pkg.RPM — API for parsing RPM archives
    • Pkg.SevenZip — API for parsing 7z archives
    • Pkg.TAR — API for parsing TAR archives
    • Pkg.Torrent — API for parsing torrent files
    • Pkg.XAR — API for parsing XAR archives
    • Pkg.XLSX — API for parsing Microsoft Excel XLSX files
    • Pkg.XZ — API for parsing XZ archives

    Other Installable Module Packages

    • Pkg.APISolver — API for resolving API names from their checksums
    • Pkg.DEXDecompiler — API for decompiling Android DEX files
    • Pkg.DotNETDecompiler — API for decompiling .NET assemblies
    • Pkg.FileMiner — API for carving files
    • Pkg.JavaDecompiler — API for decompiling Java Class files
    • Pkg.Memory — API for memory analysis
    • Pkg.PowerShellBeautifier — API for deobfuscating Microsoft PowerShell scripts
    • Pkg.SiliconShellcodeEmulator — API for emulating Windows shellcodes
    • Pkg.SimpleBatchEmulator — API for emulating Windows batch scripts
    • Pkg.UPXUnpacker — API for unpacking UPX compressed executables
    • Pkg.YARARules — API for scanning with YARA rules

    External Built-in Modules

    • Pro.magic — magic library API
    • Pro.SQLite — API for handling SQLite3 databases
    • Pro.yara — YARA engine API
    • Pro.zmq — ZeroMQ API
    Cerbero SDK
    • »
    • Pro.Lnk — API for parsing Windows Link files

    Pro.Lnk — API for parsing Windows Link files¶

    Overview¶

    The Pro.Lnk module contains the API for parsing Windows Link files.

    Printing the Contents of a Link¶

    The following code example demonstrates how to output the contents of a link file:

    from Pro.Core import *
    from Pro.Lnk import *
    
    def parseLink(fname):
        c = createContainerFromFile(fname)
        if c.isNull():
            return
        obj = LnkObject()
        if not obj.Load(c) or not obj.Initialize():
            return
        out = proTextStream()
        obj.Dump(out)
        print(out.buffer)
    

    Module API¶

    Pro.Lnk module API.

    Classes:

    LnkObject()

    This class represents a Windows link file.

    class LnkObject¶

    Bases: Pro.Core.CFFObject

    This class represents a Windows link file.

    See also Dump() and GetTarget().

    Methods:

    Dump(out)

    Dumps the contents of the link to the specifed text stream.

    DumpExtraData(out)

    Dumps the extra data to the specifed text stream.

    DumpFileHeader(out)

    Dumps the file header to the specifed text stream.

    DumpLinkInfo(out)

    Dumps the link information to the specifed text stream.

    DumpLinkTargetIDList(out)

    Dumps the target ID list to the specifed text stream.

    DumpStringData(out)

    Dumps the string data to the specifed text stream.

    GetTarget()

    Returns the target of the link.

    HasExtraData()

    Returns True if extra data is present; otherwise returns False.

    HasLinkInfo()

    Returns True if link information is present; otherwise returns False.

    HasLinkTargetIDList()

    Returns True if a target ID list is present; otherwise returns False.

    HasStringData()

    Returns True if string data is present; otherwise returns False.

    Dump(out: Pro.Core.NTTextStream) → None¶

    Dumps the contents of the link to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    DumpExtraData(out: Pro.Core.NTTextStream) → None¶

    Dumps the extra data to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasExtraData().

    DumpFileHeader(out: Pro.Core.NTTextStream) → None¶

    Dumps the file header to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    DumpLinkInfo(out: Pro.Core.NTTextStream) → None¶

    Dumps the link information to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasLinkInfo().

    DumpLinkTargetIDList(out: Pro.Core.NTTextStream) → None¶

    Dumps the target ID list to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasLinkTargetIDList().

    DumpStringData(out: Pro.Core.NTTextStream) → None¶

    Dumps the string data to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasStringData().

    GetTarget() → str¶
    Returns

    Returns the target of the link.

    Return type

    str

    HasExtraData() → bool¶
    Returns

    Returns True if extra data is present; otherwise returns False.

    Return type

    bool

    See also DumpExtraData().

    HasLinkInfo() → bool¶
    Returns

    Returns True if link information is present; otherwise returns False.

    Return type

    bool

    See also DumpLinkInfo().

    HasLinkTargetIDList() → bool¶
    Returns

    Returns True if a target ID list is present; otherwise returns False.

    Return type

    bool

    See also DumpLinkTargetIDList().

    HasStringData() → bool¶
    Returns

    Returns True if string data is present; otherwise returns False.

    Return type

    bool

    See also DumpStringData().

    Next Previous

    © Copyright Cerbero Labs.