Skip to content

Commit

Permalink
Fix Vista idlist parsing
Browse files Browse the repository at this point in the history
  • Loading branch information
Horofic committed Jan 25, 2024
1 parent 0e19fdd commit d809f76
Showing 1 changed file with 21 additions and 19 deletions.
40 changes: 21 additions & 19 deletions dissect/shellitem/lnk/lnk.py
Original file line number Diff line number Diff line change
Expand Up @@ -68,16 +68,16 @@ def _parse(self, fh: BinaryIO) -> None:
)
return

struct = c_lnk.typedefs[block_name](block_data)
if block_name == "VISTA_AND_ABOVE_IDLIST_PROPS":
struct = LnkTargetIdList(BytesIO(block_data), read_size)

Check warning on line 72 in dissect/shellitem/lnk/lnk.py

View check run for this annotation

Codecov / codecov/patch

dissect/shellitem/lnk/lnk.py#L72

Added line #L72 was not covered by tests
else:
struct = c_lnk.typedefs[block_name](block_data)

if block_name == "PROPERTY_STORE_PROPS":
# TODO implement actual serialized property parsing
guid = self._parse_guid(struct.format_id)
struct._values.update({"format_id": guid})

elif block_name == "VISTA_AND_ABOVE_IDLIST_PROPS":
struct = LnkTargetIdList(BytesIO(block_data), read_size)

elif block_name == "TRACKER_PROPS":
for name, value in struct._values.items():
if "droid" in name:
Expand All @@ -103,16 +103,16 @@ def _parse(self, fh: BinaryIO) -> None:
self.extradata.update({block_name: struct})

else:
log.warning(f"Unknown extra data block encountered with signature 0x{signature:x}")
log.warning("Unknown extra data block encountered with signature %x", signature)

Check warning on line 106 in dissect/shellitem/lnk/lnk.py

View check run for this annotation

Codecov / codecov/patch

dissect/shellitem/lnk/lnk.py#L106

Added line #L106 was not covered by tests

# keep calling parse until the TERMINAL_BLOCK is hit.
self._parse(fh)

def _parse_guid(self, guid: bytes, endianness: str = "<") -> UUID:
if endianness == "<":
return UUID(bytes_le=guid)
else:
return UUID(bytes=guid)

return UUID(bytes=guid)

Check warning on line 115 in dissect/shellitem/lnk/lnk.py

View check run for this annotation

Codecov / codecov/patch

dissect/shellitem/lnk/lnk.py#L115

Added line #L115 was not covered by tests

def __getattr__(self, attr: str) -> Any:
try:
Expand Down Expand Up @@ -208,8 +208,8 @@ def __init__(self, fh: Optional[BinaryIO] = None):
# if so the LocalBasePathOffsetUnicode and CommonPathSuffixOffsetUnicode fields are present
if self.linkinfo_header.link_info_header_size >= 0x00000024:
log.error(
"Unicode link_info_header encountered. Size bigger than 0x00000024. Size encountered:"
f"{self.linkinfo_header.link_info_header_size}"
"Unicode link_info_header encountered. Size bigger than 0x00000024. Size encountered: %x",
self.linkinfo_header.link_info_header_size,
)
# TODO parse unicode headers. none encountered yet.

Expand Down Expand Up @@ -323,7 +323,7 @@ class LnkTargetIdList:
size: Size of the TARGET_IDLIST structure
"""

def __init__(self, fh: Optional[BinaryIO] = None, size: Optional[int] = None):
def __init__(self, fh: Optional[BinaryIO] = None, size: Optional[int] = None) -> None:
self.target_idlist = None
self.idlist = None
self.size = None
Expand Down Expand Up @@ -373,7 +373,7 @@ def __init__(
linkinfo: Optional[LnkInfo] = None,
stringdata: Optional[LnkStringData] = None,
extradata: Optional[LnkExtraData] = None,
):
) -> None:
self.fh = fh

self.flags = None
Expand Down Expand Up @@ -435,16 +435,18 @@ def _parse_header(self, fh: Optional[BinaryIO]) -> Optional[c_lnk.SHELL_LINK_HEA

if link_clsid == "00021401-0000-0000-c000-000000000046":
return link_header
else:
log.info(f"Encountered invalid link file header: {link_header}. Skipping.")
return None
else:
log.info(
f"Encountered invalid link file with magic header size 0x{header_size:x} - "
f"magic header size should be 0x{LINK_HEADER_SIZE:x}. Skipping."
)

log.info("Encountered invalid link file header: %s. Skipping.", link_header)

Check warning on line 439 in dissect/shellitem/lnk/lnk.py

View check run for this annotation

Codecov / codecov/patch

dissect/shellitem/lnk/lnk.py#L439

Added line #L439 was not covered by tests
return None

log.info(

Check warning on line 442 in dissect/shellitem/lnk/lnk.py

View check run for this annotation

Codecov / codecov/patch

dissect/shellitem/lnk/lnk.py#L442

Added line #L442 was not covered by tests
"Encountered invalid link file with magic header size 0x%x. \
Magic header size should be 0x%x. Skipping.",
header_size,
LINK_HEADER_SIZE,
)
return None

Check warning on line 448 in dissect/shellitem/lnk/lnk.py

View check run for this annotation

Codecov / codecov/patch

dissect/shellitem/lnk/lnk.py#L448

Added line #L448 was not covered by tests

@property
def clsid(self) -> UUID:
"""Returns the class id (clsid) of the LNK file."""
Expand Down

0 comments on commit d809f76

Please sign in to comment.