Cerbero SDK

    Guides

    • Command-line scripting in Cerbero Suite
    • The Cerbero Shell language
    • Creating plugins and extensions for Cerbero Suite and Cerbero Engine
    • Understanding structures

    Core Modules

    • Pro.Core — Core API for parsing and scanning files
    • Pro.Carbon — API for disassembling and decompiling native binaries
    • Pro.Crypto — Crypto API
    • Pro.MP — Multi-Processing API
    • Pro.Package — API for handling packages
    • Pro.Shell — API for the Cerbero Shell language
    • Pro.SiliconSpreadsheet — Spreadsheet macro emulation API
    • Pro.Strings — API for string detection
    • Pro.UI — User-interface API for views, dialogs and workspaces

    Built-in File Format Modules

    • Pro.CAB — API for parsing Microsoft Cabinet files
    • Pro.Certificates — API for parsing certificates
    • Pro.CFBF — API for parsing legacy Office documents
    • Pro.Class — API for parsing Java Class files
    • Pro.DEX — API for parsing Android DEX files
    • Pro.DIB — API for parsing DIB images
    • Pro.ELF — API for parsing ELF executables
    • Pro.GIF — API for parsing GIF images
    • Pro.GZ — API for parsing GZip archives
    • Pro.ITSF — API for parsing Microsoft CHM files
    • Pro.JPEG — API for parsing JPEG images
    • Pro.Lnk — API for parsing Windows Link files
      • Overview
      • Printing the Contents of a Link
      • Module API
    • Pro.MachO — API for parsing Mach-O executables
    • Pro.PDB — API for parsing Microsoft debug files
    • Pro.PDF — API for parsing PDF documents
    • Pro.PE — API for parsing Portable Executables
    • Pro.PNG — API for parsing PNG images
    • Pro.RTF — API for parsing Rich-Text documents
    • Pro.SQLite3 — API for parsing SQLite3 databases
    • Pro.SWF — API for parsing Adobe Flash files
    • Pro.TIFF — API for parsing TIFF images
    • Pro.WScript — API for parsing Windows Script files
    • Pro.XML — API for parsing XML documents
    • Pro.Zip — API for parsing Zip archives

    Installable File Format Modules

    • Pkg.ACE — API for parsing ACE archives
    • Pkg.AD1 — API for parsing AD1 files
    • Pkg.ActiveMime — API for parsing ActiveMime files
    • Pkg.AR — API for parsing AR archives
    • Pkg.APFS — API for parsing APFS containers and volumes
    • Pkg.ASAR — API for parsing ASAR archives
    • Pkg.CDEX — API for parsing Android CompactDex containers
    • Pkg.CPIO — API for parsing CPIO archives
    • Pkg.CRAMFS — API for parsing CRAMFS file system images
    • Pkg.CRX — API for parsing Chrome extensions
    • Pkg.Disk — API for parsing disks
    • Pkg.DMG — API for parsing Apple Disk Image (DMG) files
    • Pkg.DotNETBinaryFormatter — API for parsing .NET BinaryFormatter data
    • Pkg.DotNETManifestResources — API for parsing .NET manifest resources
    • Pkg.DSStore — API for parsing Apple’s .DS_Store files
    • Pkg.EML — API for parsing EML email messages
    • Pkg.EROFS — API for parsing EROFS file system images
    • Pkg.EVTX — API for parsing Windows Event Logs
    • Pkg.ExFAT — API for parsing ExFAT file systems
    • Pkg.EXT — API for parsing EXT2, EXT3 and EXT4 file systems
    • Pkg.F2FS — API for parsing F2FS file system images
    • Pkg.FAT — API for parsing FAT12, FAT16 and FAT32 file systems
    • Pkg.FDT — API for parsing Flattened Device Tree blobs
    • Pkg.HFSPlus — API for parsing HFS+ file systems
    • Pkg.IFPS — API for parsing IFPS files
    • Pkg.InnoSetup — API for parsing Inno Setup installers
    • Pkg.ISO — API for parsing ISO file systems
    • Pkg.JFFS2 — API for parsing JFFS2 file system images
    • Pkg.LittleFS — API for parsing LittleFS file system images
    • Pkg.LUAC — API for parsing Lua compiled bytecode files
    • Pkg.MSI — API for parsing MSI files
    • Pkg.NSIS — API for parsing NSIS installers
    • Pkg.NTFS — API for parsing NTFS file systems
    • Pkg.OneNote — API for parsing Microsoft OneNote documents
    • Pkg.PCAP — API for parsing PCAP and PCAPNG packet capture files
    • Pkg.PList — API for parsing Apple’s property list files
    • Pkg.PYC — API for parsing Python compiled bytecode files
    • Pkg.RAR — API for parsing RAR archives
    • Pkg.RegHive — API for parsing Windows Registry hive files
    • Pkg.ROMFS — API for parsing ROMFS file system images
    • Pkg.RPM — API for parsing RPM archives
    • Pkg.SevenZip — API for parsing 7z archives
    • Pkg.SPIFFS
    • Pkg.SquashFS — API for parsing SquashFS file systems
    • Pkg.TAR — API for parsing TAR archives
    • Pkg.Torrent — API for parsing torrent files
    • Pkg.UBI — API for parsing UBI images and UBIFS file systems
    • Pkg.UEFIFirmwareImage — API for parsing UEFI firmware images
    • Pkg.VDEX — API for parsing Android VDEX containers
    • Pkg.WASM — API for parsing WebAssembly (WASM) modules
    • Pkg.WIM — API for parsing Windows Imaging Format file systems
    • Pkg.WinDMP — API for parsing Windows crash dump files
    • Pkg.XAR — API for parsing XAR archives
    • Pkg.XLSB — API for parsing Microsoft Excel XLSB files
    • Pkg.XLSX — API for parsing Microsoft Excel XLSX files
    • Pkg.XST — API for parsing Microsoft Outlook PST/OST files
    • Pkg.XZ — API for parsing XZ archives
    • Pkg.YAFFS — API for parsing YAFFS/YAFFS2 file system images

    Other Installable Module Packages

    • Pkg.AIAssistant — API for using Large Language Models
    • Pkg.APISolver — API for resolving API names from their checksums
    • Pkg.DEXDecompiler — API for decompiling Android DEX files
    • Pkg.DotNETDecompiler — API for decompiling .NET assemblies
    • Pkg.FileMiner — API for carving files
    • Pkg.JavaDecompiler — API for decompiling Java Class files
    • Pkg.LuaDecompiler — API for decompiling Lua compiled bytecode
    • Pkg.Memory — API for memory analysis
    • Pkg.PowerShellBeautifier — API for deobfuscating Microsoft PowerShell scripts
    • Pkg.SiliconShellcodeEmulator — API for emulating Windows shellcodes
    • Pkg.SimpleBatchEmulator — API for emulating Windows batch scripts
    • Pkg.UPXUnpacker — API for unpacking UPX compressed executables
    • Pkg.VBABeautifier — API for beautifying and deobfuscating VBA/VBS scripts
    • Pkg.WASMDecompiler — API for decompiling WebAssembly (WASM) modules
    • Pkg.YARARules — API for scanning with YARA rules

    External Built-in Modules

    • Pro.magic — magic library API
    • Pro.SQLite — API for handling SQLite3 databases
    • Pro.yara — YARA engine API
    • Pro.zmq — ZeroMQ API
    Cerbero SDK
    • »
    • Pro.Lnk — API for parsing Windows Link files

    Pro.Lnk — API for parsing Windows Link files¶

    Overview¶

    The Pro.Lnk module contains the API for parsing Windows Link files.

    Printing the Contents of a Link¶

    The following code example demonstrates how to output the contents of a link file:

    from Pro.Core import *
    from Pro.Lnk import *
    
    def parseLink(fname):
        c = createContainerFromFile(fname)
        if c.isNull():
            return
        obj = LnkObject()
        if not obj.Load(c) or not obj.Initialize():
            return
        out = proTextStream()
        obj.Dump(out)
        print(out.buffer)
    

    Module API¶

    Pro.Lnk module API.

    Classes:

    LnkObject()

    This class represents a Windows link file.

    class LnkObject¶

    Bases: Pro.Core.CFFObject

    This class represents a Windows link file.

    See also Dump() and GetTarget().

    Methods:

    Dump(out)

    Dumps the contents of the link to the specifed text stream.

    DumpExtraData(out)

    Dumps the extra data to the specifed text stream.

    DumpFileHeader(out)

    Dumps the file header to the specifed text stream.

    DumpLinkInfo(out)

    Dumps the link information to the specifed text stream.

    DumpLinkTargetIDList(out)

    Dumps the target ID list to the specifed text stream.

    DumpStringData(out)

    Dumps the string data to the specifed text stream.

    GetTarget()

    Returns the target of the link.

    HasExtraData()

    Returns True if extra data is present; otherwise returns False.

    HasLinkInfo()

    Returns True if link information is present; otherwise returns False.

    HasLinkTargetIDList()

    Returns True if a target ID list is present; otherwise returns False.

    HasStringData()

    Returns True if string data is present; otherwise returns False.

    Dump(out: Pro.Core.NTTextStream) → None¶

    Dumps the contents of the link to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    DumpExtraData(out: Pro.Core.NTTextStream) → None¶

    Dumps the extra data to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasExtraData().

    DumpFileHeader(out: Pro.Core.NTTextStream) → None¶

    Dumps the file header to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    DumpLinkInfo(out: Pro.Core.NTTextStream) → None¶

    Dumps the link information to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasLinkInfo().

    DumpLinkTargetIDList(out: Pro.Core.NTTextStream) → None¶

    Dumps the target ID list to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasLinkTargetIDList().

    DumpStringData(out: Pro.Core.NTTextStream) → None¶

    Dumps the string data to the specifed text stream.

    Parameters

    out (NTTextStream) – The output text stream.

    See also HasStringData().

    GetTarget() → str¶
    Returns

    Returns the target of the link.

    Return type

    str

    HasExtraData() → bool¶
    Returns

    Returns True if extra data is present; otherwise returns False.

    Return type

    bool

    See also DumpExtraData().

    HasLinkInfo() → bool¶
    Returns

    Returns True if link information is present; otherwise returns False.

    Return type

    bool

    See also DumpLinkInfo().

    HasLinkTargetIDList() → bool¶
    Returns

    Returns True if a target ID list is present; otherwise returns False.

    Return type

    bool

    See also DumpLinkTargetIDList().

    HasStringData() → bool¶
    Returns

    Returns True if string data is present; otherwise returns False.

    Return type

    bool

    See also DumpStringData().

    Next Previous

    © Copyright Cerbero Labs.