ericzimmerman/extensionblocks

Extension blocks as found in ShellBags and other places in the Registry

Hi there 👋

extensionblocks's Issues

Exception throw while parsing null byte array on GetStringsFromMultistring

Hi Eric,

I came across a new malicious lnk sample on wild but it throw an exception when I tried parsing by LNK project because GetStringsFromMultistring function on Utility.cs doesn't check properly to the byte array that is given to it as an argument. If the byte array filled with 0x00 (zero) then calculation (instancePosition - index) is wrong! Because the index can be a negative number!

I fixed the problem by adding an "if condition" at the beginning of the function that checks for zero bytes.

Arithmetic Overflow issue

Hi Eric,

Note: This issue is related to LNK Repository Issue 8 which opened where in the "LNK" repository yesterday.

An unexceptional throw occurs while processing a value of integer that includes buffer size. The exception occurs when this value of buffer.length is used with the 'Array.Copy' argument code on line 30 in PropertyStore.cs and line 305 in PropertySheet.cs.

I want to send a "Pull Request" to based on your consent.