python 解析.lnk文件,获取源文件地址的简单方法
-
import struct
-
-
target = ''
-
-
try:
-
with open(path, 'rb') as stream:
-
content = stream.read()
-
-
# skip first 20 bytes (HeaderSize and LinkCLSID)
-
# read the LinkFlags structure (4 bytes)
-
lflags = struct.unpack('I', content[0x14:0x18])[0]
-
position = 0x18
-
-
# if the HasLinkTargetIDList bit is set then skip the stored IDList
-
# structure and header
-
if (lflags & 0x01) == 1:
-
position = struct.unpack('H', content[0x4C:0x4E])[0] + 0x4E
-
-
last_pos = position
-
position += 0x04
-
-
# get how long the file information is (LinkInfoSize)
-
length = struct.unpack('I', content[last_pos:position])[0]
-
-
# skip 12 bytes (LinkInfoHeaderSize, LinkInfoFlags, and VolumeIDOffset)
-
position += 0x0C
-
-
# go to the LocalBasePath position
-
lbpos = struct.unpack('I', content[position:position+0x04])[0]
-
position = last_pos + lbpos
-
-
# read the string at the given position of the determined length
-
size= (length + last_pos) - position - 0x02
-
temp = struct.unpack('c' * size, content[position:position+size])
-
target = ''.join([chr(ord(a)) for a in temp])
-
except:
-
# could not read the file
-
pass
-
-
return target
可以正确获取Program Files下的文件路径
获取desktop下文件的时候会拆分为 用户目录 空格 相对目录
其他诸如或去扫雷.lnk估计也不行,但是大致可用了
顺别贴一个lnk文件结构
https://ithreats.files.wordpress.com/2009/05/lnk_the_windows_shortcut_file_format.pdf
看了下好像不太对得上, 不知道是不是我数错了偏移量,反正也懒得纠结了
阅读(3413) | 评论(0) | 转发(0) |