### Install LnkParse3

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Use pip to install the package.

```bash
pip install LnkParse3
```

--------------------------------

### Get Shortcut Target Command

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Returns the full command that the shortcut would execute, including the relative path and any command line arguments.

```APIDOC
## lnk_command Property - Get Shortcut Target Command

Returns the full command that the shortcut would execute, including the relative path and any command line arguments.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Get the full command the shortcut executes
command = lnk.lnk_command
print(f"Command: {command}")
# Output: ".\a.txt" or "C:\Program Files\app.exe -arg1 -arg2"

# Check for suspicious hidden commands (forensic use case)
if len(command) > 260:
    print("Warning: Command exceeds visible length in Windows Explorer!")
    print("Potential malicious padding detected")
```
```

--------------------------------

### View CLI Usage

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Display the help menu for the command-line interface.

```text
usage: lnkparse [-h] [-t] [-j] [-c CP] [-a] FILE

Windows Shortcut file (LNK) parser

positional arguments:
  FILE                  absolute or relative path to the file

optional arguments:
  -h, --help            show this help message and exit
  -t, --target          print target only
  -j, --json            print output in JSON
  -c CP, --codepage CP  set codepage of ASCII strings
  -a, --all             print all extracted data (i.e. offsets and sizes)
```

--------------------------------

### CLI Usage

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Use the command-line interface for quick analysis of LNK files.

```APIDOC
## CLI Usage

Use the command-line interface for quick analysis of LNK files.

```bash
# Basic usage - human-readable output
lkparse shortcut.lnk

# JSON output
lkparse -j shortcut.lnk

# Print only the target command
lkparse -t shortcut.lnk
```
```

--------------------------------

### Run CLI Parser

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Execute the parser on a shortcut file via the command line.

```console
$ lnkparse tests/samples/microsoft_example
Windows Shortcut Information:
   Guid: 00021401-0000-0000-C000-000000000046
   Link flags: HasTargetIDList | HasLinkInfo | HasRelativePath | HasWorkingDir | IsUnicode | EnableTargetMetadata - (524443)
   File flags: FILE_ATTRIBUTE_ARCHIVE - (32)
   Creation time: 2008-09-12 20:27:17.101000+00:00
   Accessed time: 2008-09-12 20:27:17.101000+00:00
   Modified time: 2008-09-12 20:27:17.101000+00:00
   File size: 0
   Icon index: 0
   Windowstyle: SW_SHOWNORMAL
   Hotkey: UNSET - UNSET {0x0000}

   ...more data...

   EXTRA:
      DISTRIBUTED LINK TRACKER BLOCK:
         Size: 96
         Length: 88
         Version: 0
         Machine identifier: chris-xps
         Droid volume identifier: 94C77840-FA47-46C7-B356-5C2DC6B6D115
         Droid file identifier: 7BCD46EC-7F22-11DD-9499-00137216874A
         Birth droid volume identifier: 94C77840-FA47-46C7-B356-5C2DC6B6D115
         Birth droid file identifier: 7BCD46EC-7F22-11DD-9499-00137216874A
```

--------------------------------

### Run tests with coverage report

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Execute tests and generate an HTML coverage report, failing if coverage is below 80%.

```sh
pytest --cov=LnkParse3 tests --cov-fail-under=80 --cov-report=html --no-cov-on-fail
```

--------------------------------

### CLI Usage for LNK Analysis

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Command-line interface commands for quick file analysis.

```bash
# Basic usage - human-readable output
lnkparse shortcut.lnk

# JSON output
lnkparse -j shortcut.lnk

# Print only the target command
lnkparse -t shortcut.lnk
```

--------------------------------

### Run tests with unittest

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Execute the test suite using the built-in unittest module without external dependencies.

```sh
python -m unittest discover tests
```

--------------------------------

### Analyze LNK files via CLI

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Various command-line flags for extracting metadata, JSON output, and handling legacy file encodings.

```bash
lnkparse -t -j shortcut.lnk
```

```bash
lnkparse -a shortcut.lnk
```

```bash
lnkparse -c cp1251 shortcut.lnk
```

```bash
lnkparse -j -a shortcut.lnk
```

```bash
lnkparse -j shortcut.lnk | jq '.header.creation_time'
```

```bash
for f in *.lnk; do echo "=== $f ==="; lnkparse -j "$f"; done
```

--------------------------------

### Print Internal Offsets and Sizes

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Outputs the internal structure of the LNK file including offsets and sizes.

```python
lnk.print_json(print_all=True)
```

--------------------------------

### Output Shortcut Target Only

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Extracts the target path as plain text or JSON.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Print target as plain text
lnk.print_shortcut_target()
# Output: .\a.txt

# Print target as JSON
lnk.print_shortcut_target(pjson=True)
# Output: {"shortcut_target": ".\\a.txt"}
```

--------------------------------

### Parse LNK Files with LnkFile Class

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Use the LnkFile class to parse Windows shortcut files. It accepts a file handle or raw binary data and can handle custom code pages or chained LNK files.

```python
import LnkParse3

# Parse from file
with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Parse from raw bytes
raw_data = open('shortcut.lnk', 'rb').read()
lnk = LnkParse3.lnk_file(indata=raw_data)

# Parse with custom code page for non-Unicode strings
with open('legacy_shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f, cp='cp1252')

# Parse chained LNK files (e.g., customDestinations-ms)
with open('file.customDestinations-ms', 'rb') as f:
    data = f.read()[20:]  # Skip header
    lnk = LnkParse3.lnk_file(indata=data, allow_terminal_blocks=False)
    print(f"LNK size: {lnk.size} bytes")
```

--------------------------------

### LnkFile Class - Parse LNK Files

Source: https://context7.com/matmaus/lnkparse3/llms.txt

The primary class for initializing the parsing of a Windows shortcut file from a file handle or raw binary data.

```APIDOC
## LnkFile Class

### Description
Initializes the LnkFile object to parse Windows shortcut binary structures.

### Parameters
#### Request Body
- **f** (file handle) - Optional - File handle to the .lnk file.
- **indata** (bytes) - Optional - Raw binary data of the .lnk file.
- **cp** (string) - Optional - Custom code page for non-Unicode strings (e.g., 'cp1252').
- **allow_terminal_blocks** (boolean) - Optional - Flag to allow or disallow terminal blocks (default True).
```

--------------------------------

### Header Flag Methods

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Boolean methods to check which optional structures are present in the LNK file.

```APIDOC
## Header Flag Methods - Check LNK Structure Presence

Boolean methods to check which optional structures are present in the LNK file.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Check which structures are present
print(f"Has target ID list: {lnk.has_target_id_list()}")
print(f"Has link info: {lnk.has_link_info()}")
print(f"Has relative path: {lnk.has_relative_path()}")
print(f"Has working directory: {lnk.has_working_dir()}")
print(f"Has arguments: {lnk.has_arguments()}")
print(f"Has icon location: {lnk.has_icon_location()}")
print(f"Has name/description: {lnk.has_name()}")
print(f"Is Unicode: {lnk.is_unicode()}")
print(f"Force no link info: {lnk.force_no_link_info()}")

# Conditional processing based on structure presence
if lnk.has_arguments():
    args = lnk.string_data.command_line_arguments()
    print(f"Arguments: {args}")

if lnk.has_working_dir():
    work_dir = lnk.string_data.working_directory()
    print(f"Working directory: {work_dir}")
```
```

--------------------------------

### Parse LNK Files in Python

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Use the LnkParse3 library to open a file and print its contents as JSON.

```python
>>> import LnkParse3
>>> with open('tests/samples/microsoft_example', 'rb') as indata:
>>> 	lnk = LnkParse3.lnk_file(indata)
>>> 	lnk.print_json()
{
	"data": {
        "relative_path": ".\\a.txt",
        "working_directory": "C:\\test"
    },
    "extra": {
        "DISTRIBUTED_LINK_TRACKER_BLOCK": {
            "birth_droid_file_identifier": "7BCD46EC-7F22-11DD-9499-00137216874A",
            "birth_droid_volume_identifier": "94C77840-FA47-46C7-B356-5C2DC6B6D115",
            "droid_file_identifier": "7BCD46EC-7F22-11DD-9499-00137216874A",
            "droid_volume_identifier": "94C77840-FA47-46C7-B356-5C2DC6B6D115",
            "length": 88,
            "machine_identifier": "chris-xps",
            "size": 96,
            "version": 0
        }
    },
	...more data...
}
```

--------------------------------

### Check LNK Structure Presence

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Verifies the existence of optional LNK structures like arguments or working directories before accessing them.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Check which structures are present
print(f"Has target ID list: {lnk.has_target_id_list()}")
print(f"Has link info: {lnk.has_link_info()}")
print(f"Has relative path: {lnk.has_relative_path()}")
print(f"Has working directory: {lnk.has_working_dir()}")
print(f"Has arguments: {lnk.has_arguments()}")
print(f"Has icon location: {lnk.has_icon_location()}")
print(f"Has name/description: {lnk.has_name()}")
print(f"Is Unicode: {lnk.is_unicode()}")
print(f"Force no link info: {lnk.force_no_link_info()}")

# Conditional processing based on structure presence
if lnk.has_arguments():
    args = lnk.string_data.command_line_arguments()
    print(f"Arguments: {args}")

if lnk.has_working_dir():
    work_dir = lnk.string_data.working_directory()
    print(f"Working directory: {work_dir}")
```

--------------------------------

### Print Shortcut Target Only

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Prints only the shortcut target command, useful for quick extraction of what a shortcut points to.

```APIDOC
## print_shortcut_target() - Output Target Only

Prints only the shortcut target command, useful for quick extraction of what a shortcut points to.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Print target as plain text
lnk.print_shortcut_target()
# Output: .\a.txt

# Print target as JSON
lnk.print_shortcut_target(pjson=True)
# Output: {"shortcut_target": ".\\a.txt"}
```
```

--------------------------------

### Run tests with pytest

Source: https://github.com/matmaus/lnkparse3/blob/master/README.md

Execute the test suite using the pytest framework.

```sh
pytest tests
```

--------------------------------

### Print LNK File Human-Readable

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Prints the parsed LNK data in a human-readable YAML-like format to standard output. Ideal for manual analysis and reports.

```APIDOC
## print_lnk_file() - Human-Readable Output

Prints the parsed LNK data in a human-readable YAML-like format to standard output. Ideal for manual analysis and reports.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Print human-readable output
lnk.print_lnk_file()
# Output:
# Windows Shortcut Information:
#    Guid: 00021401-0000-0000-C000-000000000046
#    Link flags: HasTargetIDList | HasLinkInfo | HasRelativePath | IsUnicode - (524443)
#    File flags: FILE_ATTRIBUTE_ARCHIVE - (32)
#    Creation time: 2008-09-12 20:27:17.101000+00:00
#    Accessed time: 2008-09-12 20:27:17.101000+00:00
#    Modified time: 2008-09-12 20:27:17.101000+00:00
#    File size: 0
#    ...

# Print with all details for forensic analysis
lnk.print_lnk_file(print_all=True)
```
```

--------------------------------

### Accessing LNK Components Directly

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Access parsed components directly for detailed analysis of specific LNK structures.

```APIDOC
## Accessing LNK Components Directly

Access parsed components directly for detailed analysis of specific LNK structures.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Access header data directly
header = lnk.header
print(f"GUID: {header.link_cls_id()}")
print(f"Creation time: {header.creation_time()}")
print(f"Access time: {header.access_time()}")
print(f"Write time: {header.write_time()}")
print(f"File size: {header.file_size()}")
print(f"Icon index: {header.icon_index()}")
print(f"Window style: {header.window_style()}")
print(f"Hotkey: {header.hot_key()}")
print(f"Raw link flags: {header.r_link_flags()}")
print(f"Link flags: {header.link_flags()}")
print(f"Raw file flags: {header.r_file_flags()}")
print(f"File flags: {header.file_flags()}")

# Access string data directly
string_data = lnk.string_data
print(f"Description: {string_data.description()}")
print(f"Relative path: {string_data.relative_path()}")
print(f"Working directory: {string_data.working_directory()}")
print(f"Command line arguments: {string_data.command_line_arguments()}")
print(f"Icon location: {string_data.icon_location()}")

# Access target ID list
if lnk.targets:
    targets = lnk.targets.as_list()
    for target in targets:
        print(f"Target item: {target}")

# Access link info (local or network)
if lnk.info:
    print(f"Info type: {type(lnk.info).__name__}")
    print(f"Location: {lnk.info.location()}")
    if hasattr(lnk.info, 'local_base_path'):
        print(f"Local base path: {lnk.info.local_base_path()}")

# Access extra data blocks
for extra in lnk.extras:
    print(f"Extra block: {extra.name()}")
    print(f"Block data: {extra.as_dict()}")
```
```

--------------------------------

### Retrieve Shortcut Target Command

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Accesses the full execution command and arguments. Useful for detecting malicious padding or long command strings.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Get the full command the shortcut executes
command = lnk.lnk_command
print(f"Command: {command}")
# Output: ".\a.txt" or "C:\Program Files\app.exe -arg1 -arg2"

# Check for suspicious hidden commands (forensic use case)
if len(command) > 260:
    print("Warning: Command exceeds visible length in Windows Explorer!")
    print("Potential malicious padding detected")
```

--------------------------------

### Access LNK Components Directly

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Provides low-level access to header data, string data, target IDs, and extra data blocks.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Access header data directly
header = lnk.header
print(f"GUID: {header.link_cls_id()}")
print(f"Creation time: {header.creation_time()}")
print(f"Access time: {header.access_time()}")
print(f"Write time: {header.write_time()}")
print(f"File size: {header.file_size()}")
print(f"Icon index: {header.icon_index()}")
print(f"Window style: {header.window_style()}")
print(f"Hotkey: {header.hot_key()}")
print(f"Raw link flags: {header.r_link_flags()}")
print(f"Link flags: {header.link_flags()}")
print(f"Raw file flags: {header.r_file_flags()}")
print(f"File flags: {header.file_flags()}")

# Access string data directly
string_data = lnk.string_data
print(f"Description: {string_data.description()}")
print(f"Relative path: {string_data.relative_path()}")
print(f"Working directory: {string_data.working_directory()}")
print(f"Command line arguments: {string_data.command_line_arguments()}")
print(f"Icon location: {string_data.icon_location()}")

# Access target ID list
if lnk.targets:
    targets = lnk.targets.as_list()
    for target in targets:
        print(f"Target item: {target}")

# Access link info (local or network)
if lnk.info:
    print(f"Info type: {type(lnk.info).__name__}")
    print(f"Location: {lnk.info.location()}")
    if hasattr(lnk.info, 'local_base_path'):
        print(f"Local base path: {lnk.info.local_base_path()}")

# Access extra data blocks
for extra in lnk.extras:
    print(f"Extra block: {extra.name()}")
    print(f"Block data: {extra.as_dict()}")
```

--------------------------------

### print_json() - Output JSON to Console

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Prints the parsed LNK data as formatted JSON to standard output.

```APIDOC
## print_json()

### Description
Outputs the parsed LNK data to stdout in a formatted JSON structure, useful for command-line analysis and piping.
```

--------------------------------

### Extract Parsed Data as Dictionary using get_json()

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Retrieve all parsed LNK data as a Python dictionary using the get_json() method. This includes header, target, link info, string data, and extra blocks. Use get_all=True to include offsets and sizes.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Get all extracted data
data = lnk.get_json()

# Access header information
print(f"GUID: {data['header']['guid']}")
print(f"Creation time: {data['header']['creation_time']}")
print(f"Modified time: {data['header']['modified_time']}")
print(f"Accessed time: {data['header']['accessed_time']}")
print(f"File size: {data['header']['file_size']}")
print(f"Link flags: {data['header']['link_flags']}")
print(f"File flags: {data['header']['file_flags']}")
print(f"Window style: {data['header']['windowstyle']}")

# Access target information
if 'target' in data:
    for item in data['target']['items']:
        print(f"Target class: {item.get('class')}")
        print(f"Primary name: {item.get('primary_name')}")

# Access string data (paths, arguments)
print(f"Relative path: {data['data'].get('relative_path')}")
print(f"Working directory: {data['data'].get('working_directory')}")
print(f"Command arguments: {data['data'].get('command_line_arguments')}")
print(f"Icon location: {data['data'].get('icon_location')}")

# Access link info (local/network location)
if data['link_info']:
    print(f"Location type: {data['link_info'].get('location')}")
    print(f"Local base path: {data['link_info'].get('local_base_path')}")
    location_info = data['link_info'].get('location_info', {})
    print(f"Drive type: {location_info.get('drive_type')}")
    print(f"Volume label: {location_info.get('volume_label')}")

# Access extra data blocks
for block_name, block_data in data['extra'].items():
    print(f"Extra block: {block_name}")
    if block_name == 'DISTRIBUTED_LINK_TRACKER_BLOCK':
        print(f"  Machine ID: {block_data.get('machine_identifier')}")
        print(f"  Droid volume: {block_data.get('droid_volume_identifier')}")

# Get all data including offsets and sizes (for forensic analysis)
full_data = lnk.get_json(get_all=True)
print(f"Header size: {full_data['header']['header_size']}")
print(f"Reserved fields: {full_data['header']['reserved0']}, {full_data['header']['reserved1']}")
```

--------------------------------

### Output JSON to Console using print_json()

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Use the print_json() method to output the parsed LNK data as formatted JSON to standard output. This is useful for quick analysis or piping to other tools.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Print standard JSON output
lnk.print_json()
# Output:
# {
#     "data": {
#         "relative_path": ".\\a.txt",
#         "working_directory": "C:\\test"
#     },
#     "extra": {
#         "DISTRIBUTED_LINK_TRACKER_BLOCK": {
#             "machine_identifier": "chris-xps",
#             "droid_volume_identifier": "94C77840-FA47-46C7-B356-5C2DC6B6D115",
#             ...
#         }
#     },
#     "header": {
#         "creation_time": "2008-09-12T20:27:17+00:00",
#         "file_flags": ["FILE_ATTRIBUTE_ARCHIVE"],
#         "link_flags": ["HasTargetIDList", "HasLinkInfo", "IsUnicode"],
#         ...
#     },
#     ...
# }
```

--------------------------------

### Print Human-Readable LNK Data

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Displays parsed LNK data in a YAML-like format. Use print_all=True for forensic-level detail.

```python
import LnkParse3

with open('shortcut.lnk', 'rb') as f:
    lnk = LnkParse3.lnk_file(f)

# Print human-readable output
lnk.print_lnk_file()
# Output:
# Windows Shortcut Information:
#    Guid: 00021401-0000-0000-C000-000000000046
#    Link flags: HasTargetIDList | HasLinkInfo | HasRelativePath | IsUnicode - (524443)
#    File flags: FILE_ATTRIBUTE_ARCHIVE - (32)
#    Creation time: 2008-09-12 20:27:17.101000+00:00
#    Accessed time: 2008-09-12 20:27:17.101000+00:00
#    Modified time: 2008-09-12 20:27:17.101000+00:00
#    File size: 0
#    ...

# Print with all details for forensic analysis
lnk.print_lnk_file(print_all=True)
```

--------------------------------

### get_json() - Extract Parsed Data

Source: https://context7.com/matmaus/lnkparse3/llms.txt

Retrieves the parsed LNK file data as a structured Python dictionary.

```APIDOC
## get_json()

### Description
Returns all parsed LNK data as a dictionary, including header information, target details, link info, string data, and extra data blocks.

### Parameters
#### Query Parameters
- **get_all** (boolean) - Optional - If True, includes additional forensic details like offsets and sizes.

### Response
#### Success Response (200)
- **header** (object) - Contains GUID, timestamps, file size, and flags.
- **target** (object) - Contains target class and primary name information.
- **data** (object) - Contains paths, working directory, and command arguments.
- **link_info** (object) - Contains local/network location details.
- **extra** (object) - Contains extra data blocks like DISTRIBUTED_LINK_TRACKER_BLOCK.
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.