LNK: Various findings

[ldy985]

I have found a few LNK files with unknown shellbags and a few that crashes. These LNK's come from random places on the internet so they might be corrupt etc. 0x64 doesn't seem to be documented anywhere, but maybe you have ideas about what it might contain :)

Crashes the parser:
Axure RP 8.lnk
Google Chrome.lnk
IBM Security AppScan Standard.lnk
OpenIV.lnk
WinISO.lnk

Unknown shellbag 0x64:
BRITANIA*.lnk
CADENCE*.lnk

various.zip

[AndrewRathbun]

LECmd version 1.5.0.0

Author: Eric Zimmerman ([email protected])
https://github.com/EricZimmerman/LECmd

Command line: -d M:\Downloads\various --csv M:\Downloads\various

Looking for lnk files in M:\Downloads\various

Found 13 files

Processing M:\Downloads\various\Axure RP 8.lnk

Error opening M:\Downloads\various\Axure RP 8.lnk. Message: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
System.ArgumentException: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
   at System.Buffer.BlockCopy(Array src, Int32 srcOffset, Array dst, Int32 dstOffset, Int32 count)
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\BRITANIA066701057.lnk

Error opening M:\Downloads\various\BRITANIA066701057.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\BRITANIA066701070.lnk

Error opening M:\Downloads\various\BRITANIA066701070.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\BRITANIA066702070.lnk

Error opening M:\Downloads\various\BRITANIA066702070.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\BRITANIA066702074.lnk

Error opening M:\Downloads\various\BRITANIA066702074.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\CADENCECAF142-110V.lnk

Error opening M:\Downloads\various\CADENCECAF142-110V.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\CADENCEMPR511-220V.lnk

Error opening M:\Downloads\various\CADENCEMPR511-220V.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\CADENCESAN250-110V.lnk

Error opening M:\Downloads\various\CADENCESAN250-110V.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\CADENCEVAP902-110V.lnk

Error opening M:\Downloads\various\CADENCEVAP902-110V.lnk. Message: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
System.Exception: Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\Google Chrome.lnk

Error opening M:\Downloads\various\Google Chrome.lnk. Message: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
System.ArgumentException: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
   at System.Buffer.BlockCopy(Array src, Int32 srcOffset, Array dst, Int32 dstOffset, Int32 count)
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\IBM Security AppScan Standard.lnk

Error opening M:\Downloads\various\IBM Security AppScan Standard.lnk. Message: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
System.ArgumentException: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
   at System.Buffer.BlockCopy(Array src, Int32 srcOffset, Array dst, Int32 dstOffset, Int32 count)
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\OpenIV.lnk

Error opening M:\Downloads\various\OpenIV.lnk. Message: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
System.ArgumentException: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
   at System.Buffer.BlockCopy(Array src, Int32 srcOffset, Array dst, Int32 dstOffset, Int32 count)
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processing M:\Downloads\various\WinISO.lnk

Error opening M:\Downloads\various\WinISO.lnk. Message: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
System.ArgumentException: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.
   at System.Buffer.BlockCopy(Array src, Int32 srcOffset, Array dst, Int32 dstOffset, Int32 count)
   at Lnk.LnkFile..ctor(Byte[] rawBytes, String sourceFile, Int32 codepage)
   at Lnk.Lnk.LoadFile(String lnkFile, Int32 codepage)
   at LECmd.Program.ProcessFile(String lnkFile, Boolean quiet, Boolean removableOnly, String datetimeFormat, Boolean nid, Boolean neb, Int32 codepage)

Processed 0 out of 13 files in 0.3156 seconds

Failed files
  M:\Downloads\various\Axure RP 8.lnk ==> (Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.)
  M:\Downloads\various\BRITANIA066701057.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\BRITANIA066701070.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\BRITANIA066702070.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\BRITANIA066702074.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\CADENCECAF142-110V.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\CADENCEMPR511-220V.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\CADENCESAN250-110V.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\CADENCEVAP902-110V.lnk ==> (Unknown shell item ID: 0x64. Please send to [email protected] so support can be added.)
  M:\Downloads\various\Google Chrome.lnk ==> (Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.)
  M:\Downloads\various\IBM Security AppScan Standard.lnk ==> (Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.)
  M:\Downloads\various\OpenIV.lnk ==> (Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.)
  M:\Downloads\various\WinISO.lnk ==> (Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection.)

https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf shows this as potentially where the error is hitting on?