LnkView - LNK-file Viewer

Announcements of new plug-ins. Plug-ins are discussed in a forum below.
Post Reply
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LnkView - LNK-file Viewer

Post by stasf »

This plugin for FAR Manager 3.0 is intended to parse and show
contents of Windows Shortcut Files (ones with .lnk extension).

The plugin represents an LNK-file as a virtual file system and shows complex objects as folders (and subfolders)
and simple data items as files.

The plugin executes parsing of an LNK-file in strict accordance with [MS-SHLLINK]... but a little bit deeper.

In particular, thanks to the WINE project (from which was borrowed the header file pidl.h) as well as to my own investigations
the plugin successfully parses internal structure of majority of the PIDL formats.

Furthermore, thanks to the brilliant Harry Parsonage's work "The meaning of LIFE", it became possible to decipher the
MS File Tracker's DROIDs (including the MAC address of the computer on which the target file was created).
Last edited by stasf on Thu 02 Apr, 2015 23:39, edited 3 times in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 1.0.1:

- now works with Win XP (due to old advapi32.dll interface I had to change RegGetValue to ReqQueryValueEx);
- supported one more internal PIDL format (0x74)
- added release for x86-64
Last edited by stasf on Sat 28 Mar, 2015 08:44, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 1.1.0:

- added the plugin configuration dialog ;
- added "lnk:" commandline prefix;
- realized "lnk:cat <lnk-file> <text file>" command which exports data from given lnk-file to text file (UTF-8 codepage).
Last edited by stasf on Sat 28 Mar, 2015 08:44, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 1.2.0: Added interface with LUA macro language (see the plugin help file).
Last edited by stasf on Sat 28 Mar, 2015 08:45, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 2.0.0:

1. Now the plugin allows to view contents of Custom Jump Lists (files with the .customDestinations-ms extension).
Besides, it is possible to view Automatic Jump Lists - see the plugin help.

2. Improved parsing of the internal structure of ItemIDLists: the plugin shows more info and structures the info in strict accordance with the
internal structure of .lnk-file (in particular, PIDL extension data blocks are explicitly shown).

3. The plugin now shows names of System properties in a Property Store. Besides, the plugin set s a name of a Property Storage to the
corresponding GUID, which allows to LUA-macrocode to extract specific properties by the GUID and property number.

4. Improved algorithm of extracting the target path (by the LUA-macro's @target query).
LUA-macros could work with Custom Jump List as well, but for @target and @workdir queries it is necessary to specify a
shortcut inside the Jump List (for example: "/ShortCut 3/@target").
Last edited by stasf on Sat 28 Mar, 2015 08:45, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 2.1.0:

1. Starting with this version the plugin is able to export to a set of LNK-files the history of the folders navigated by an user which is keeped for each user in the system registry (BagMRU "database"). See the "commands" chapter of the plugin's help.

2. Further improved parsing of the internal structure of ItemIDLists: implemented parsing of WPD (Windows Portable Devices) properties list.
Also, implemented parsing of a few more formats of PIDL extensions.

3. Minor bugs fixed.
Last edited by stasf on Sat 28 Mar, 2015 08:46, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 3.0.0
---------------

1. The new lnk:follow command allows quick jumping to the target of an LNK-file.
This command could be assigned to, say Ctrl-PgDn key (thru the configuration dialog).
In such a configuration you could do "jump to the target" operation in one click.

2. The new lnk:create command allows to create LNK-files.
By default the command creates shortcuts to the selected files on the ACTIVE panel
and places these to the current directory of the PASSIVE panel.
This command could be assigned to launch from plugins menu key.

NOTE:
This command allows to create shortcuts to shortcuts
(which is not possible to do with the usual means thru the MS Shell interface).
When such an indirect shortcut is handled by the MS Shell, the target of the
last shortcut in the chain is opened.
PLEASE, BE CAREFULL - DO NOT CREATE CYCLIC SHORTCUT CHAINS.

3. Now, the plugin could be launched from the Disk Menu.
Such an invocation opens "Favorite Links" folder (the path to this folder is configurable).
The same folder could be opened with the new lnk:fav command.
The "Favorite Links" folder in combination with lnk:follow assigned to Ctrl-PgDn key
would allow to quickly jump to the preferred folders and files.

One could create favorite links with the lnk:create command when the "Favorite Links" folder
is opened on the PASSIVE panel, but it would more comfortable to do it
with the new lnk:addfav command.
This command is fully equivalent to lnk:create, but places the resulting shortcut
to the "Favorite Links" folder.
The lnk:addfav could be assinged to the launch from plugins menu key also.

4. Now, the lnk:bagmru command can take a hive-file parameter and export data
from a standalone registry hive-file.
In such a case the hive-file is opened in read only mode and is handled manually,
so administrative privileges for accessing the hive are not needed.

5. To support the new features the plugin's configuration dialog was changed.

Please, read the plugin's help to get the full description of the new features.


PS: The last stable build of FAR (build 4242) contains a bug in the conversion of a relative file path to the absolute one.
So, if you are going to use the plugin's commands with this build, ALWAYS use absolute file paths !
The previous stable build of FAR (build 4040) and the latest night builds do not contain this bug.
Last edited by stasf on Sat 28 Mar, 2015 08:47, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 3.1.0
---------------

1. Now, "*" is allowed as the first argument of the lnk:cat command.
This form of the command allows to export at once a set of LNK-files selected on the ACTIVE panel
into a csv-file, which then could be imported into MS Excel or any other SpreadSheet for further digital forensics analysis.

2. Thanks to http://www.symantec.com/connect/article ... escriptors the plugin now parses
the internal structure of Darwin Descriptors in the corresponding block of the ExtraData section of a LNK-file
as well as in a 0xbeef000b PIDL extension.

3. The new lnk:pcache command allows to export the contents of the
HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Explorer\StartPage\ProgramsCache
registry key into a set of LNK-files (see the plugin's help).


PS: The last stable build of FAR (build 4242) contains a bug in the conversion of a relative file path to the absolute one.
So, if you are going to use the plugin's commands with this build, ALWAYS use absolute file paths !
The previous stable build of FAR (build 4040) and the latest night builds do not contain this bug.
Last edited by stasf on Sat 28 Mar, 2015 08:48, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LNK-file viewer

Post by stasf »

Version 3.1.1
---------------

1. Bug fixed in lnk:create command implementation (incorrect target name generation) when the command invoked from plugins menu
or with "*" as the first argument and the ACTIVE far panel is set to a root folder of a drive.
Last edited by stasf on Mon 30 Mar, 2015 23:33, edited 1 time in total.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LnkView - LNK-file Viewer

Post by stasf »

Version 3.2.0
-------------

1. Now, it is allowed to not to specify <out-file> argument for lnk:cat plugin's command.
In such a case the plugin will export the LNK-file data into a temporary file and will open it
in the internal FAR's Viewer.
If <LNK-file> argument would not specified also, the plugin would export and show contents of
the current file of the ACTIVE panel.

2. Now, all the data fields containing TIME information are showed with the maximum precision (100-ns).

3. Now, the plugin's item in the plugins menu shows the command the plugin would execute if
it would invoked from the plugins menu.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LnkView - LNK-file Viewer

Post by stasf »

Version 3.3.0
---------------

1. Now, the lnk:create command, when invoked without <folder name> parameter, creates LNK-file in the folder
currently displayed on the ACTIVE panel if the PASSIVE panel is invisible or is not a regular file panel.

2. Now, the lnk:create command generates the "Command Args" data field in the output LNK-file (see the plugin's help).

3. Now, the lnk:follow command displays the target file on the ACTIVE panel if the PASSIVE panel is invisible.

4. Default path to the "Favorite Links" folder in the configuration dialog is changed to %FARLOCALPROFILE%\..\FavLinks.

5. A new command option "Create shortcuts with full target path" added to the configuration dialog.
When this option is OFF, the lnk:create command does not include the full target-file path in the name of the
created LNK-file. In such a case it generates the LNK-file name based on the target filename only.
The default value for this option is ON.
stasf
Posts: 113
Joined: Wed 10 Dec, 2014 22:53
Has thanked: 3 times
Been thanked: 1 time

LnkView - LNK-file Viewer

Post by stasf »

Current Version:
------------------

See NOTES_en.txt in the plugin's archive for the release notes



Download the plugin

The plugin discussion
Last edited by stasf on Wed 01 Mar, 2017 20:59, edited 1 time in total.
Post Reply

Return to “Announcements of new Plug-Ins”