LNK module

[BitsOfBinary]

This module will parse the Windows Shell Link (LNK) file format, and make a lot of it's data accessible via YARA. The motivation for creating this module is that the LNK file format is non-standard to parse, and would be difficult to do so within a YARA rule itself (see the documentation here: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943). I hope by making this module that it makes life easier to write YARA rules for LNK files.

This module allows for rules like this to be possible:

import "lnk"

rule is_lnk
{
    condition:
        lnk.is_lnk
}

rule machine_id_tracking
{
    condition:
        lnk.tracker_data.machine_id == "chris-xps"
}

rule local_base_path
{
    condition:
        lnk.link_info.local_base_path == "C:\\test\\a.txt"
}

I'd be very interested to hear feedback on the code itself, or the structure of the data surfaced by the module (e.g. is it easy to access/use).

[BitsOfBinary]

Updated this branch to be compatible with YARA 4.3.0. At time of this comment, all tests pass as expected.

[BitsOfBinary]

Updated for compatibility with YARA v4.3.2; tests passing as expected.

[plusvic]

I tried to merge this PR but it turns out that the tests are failing in big endian platforms: https://github.com/VirusTotal/yara/actions/runs/5960808590/job/16168792006

[BitsOfBinary]

I tried to merge this PR but it turns out that the tests are failing in big endian platforms: https://github.com/VirusTotal/yara/actions/runs/5960808590/job/16168792006

That's weird @plusvic , they seemed to be working before (https://github.com/VirusTotal/yara/actions/runs/5772402091/job/15647348631). I'll debug what is failing in the tests and get back to you.