lnk_parser

lnk_parser 是一个完整的 Rust 实现来解析 Windows LNK 文件。解析后的数据可以格式化为 JSON、JSONL 和 CSV（默认）。

如何使用库？

首先将库添加到您的 Cargo.toml 文件中，如下所示

lnk_parser = "0.1.0"

或从 GitHub 仓库（最新更新）

lnk_parser = { git="https://github.com/AbdulRhmanAlfaifi/lnk_parser" }

示例

以下是一个使用库从路径解析 LNK 文件的示例

use std::fs::File;
fn main(){
    // Open the LNK file
    let file = File::open("samples\\WIN10\\1607_14393\\windows_generated.lnk").unwrap();
    // Pass the `File` instance to `from_reader` function.
    // `std::fs::File` implements `Read` & `Seek` traits.
    let lnk_file = LNKParser::from_reader(file);
    println!("{:?}", lnk_file);
}

JSON 格式的输出示例

{
    "target_full_path": "C:\\Users\\u0041\\Desktop\\test\\test.txt",
    "lnk_file_metadata": {
        "full_path": "C:\\Users\\u0041\\Documents\\Projects\\LNKParser-rs\\samples\\WIN10\\1607_14393\\windows_generated.lnk",
        "mtime": "2021-02-08T12:52:20Z",
        "atime": "2021-02-13T19:14:07Z",
        "ctime": "2021-02-08T12:52:13Z"
    },
    "shell_link_header": {
        "file_attr": [
            "ARCHIVE"
        ],
        "mtime": "2021-02-08T12:41:58Z",
        "atime": "2021-02-08T12:41:03Z",
        "ctime": "2021-02-08T12:41:03Z",
        "file_size": 4
    },
    "link_target_id_list": {
        "id_list": [
            {
                "shell_item_data": {
                    "FileEntry": {
                        "is_file": false,
                        "file_size": 0,
                        "last_modified": "2021-02-08T12:46:24Z",
                        "file_attr_flags": [
                            "DIRECTORY"
                        ],
                        "name": "test",
                        "extention_block": {
                            "ctime": "2021-02-08T12:46:24Z",
                            "atime": "2021-02-08T12:46:24Z",
                            "file_ref": {
                                "mft_entry": 91461,
                                "sequence_number": 3
                            },
                            "primary_name": "test"
                        }
                    }
                }
            },
            {
                "shell_item_data": {
                    "FileEntry": {
                        "is_file": true,
                        "file_size": 4,
                        "last_modified": "2021-02-08T12:42:00Z",
                        "file_attr_flags": [
                            "ARCHIVE"
                        ],
                        "name": "test.txt",
                        "extention_block": {
                            "ctime": "2021-02-08T12:41:04Z",
                            "atime": "2021-02-08T12:41:04Z",
                            "file_ref": {
                                "mft_entry": 90070,
                                "sequence_number": 3
                            },
                            "primary_name": "test.txt"
                        }
                    }
                }
            }
        ]
    },
    "link_info": {
        "volume_id": {
            "drive_type": "DRIVE_FIXED",
            "serial_number": "E02E-8A93"
        },
        "local_base_path": "C:\\Users\\u0041\\Desktop\\test\\test.txt"
    },
    "relative_path": "..\\..\\..\\..\\..\\Desktop\\test\\test.txt",
    "working_dir": "C:\\Users\\u0041\\Desktop\\test",
    "extra_data": {
        "extra_data_blocks": [
            {
                "Tracker": {
                    "machine_id": "win10",
                    "file_droid": "BD4FAD74-6A0A-11EB-8ECF-5076AFA95947",
                    "file_droid_birth": "BD4FAD74-6A0A-11EB-8ECF-5076AFA95947",
                    "volume_droid": "00D2581C-4749-44BD-9381-9BDFADF8A9DE",
                    "volume_droid_birth": "00D2581C-4749-44BD-9381-9BDFADF8A9DE"
                }
            }
        ]
    }
}

如何使用二进制文件？

您可以从发布部分或使用以下命令从 crates.io 下载二进制文件

cargo install lnk_parser

这样就可以了！您可以按以下方式执行

lnk_parser -h

LNK 文件结构

我写了一篇关于 LNK 文件结构的博客文章，您可以从 这里 查看它。