def testHex(self): """Test the hexadecimal representation of data.""" hex_string_1 = binary.HexifyBuffer(self._ascii_string_1) hex_compare = ( '\\x57\\x00\\x68\\x00\\x61\\x00\\x74\\x00\\x00\\x00\\x69\\x00' '\\x73\\x00') self.assertEquals(hex_string_1, hex_compare) hex_string_2 = binary.HexifyBuffer(self._unicode_string_1) hex_compare_unicode = ( '\\xff\\xfe\\xfe\\x00\\x72\\x00\\xe1\\x00\\x6e\\x00\\x64\\x00' '\\x75\\x00\\x72\\x00') self.assertEquals(hex_string_2, hex_compare_unicode)
def _ParseMRUListEntryValue(self, parser_mediator, registry_key, entry_index, entry_letter, **kwargs): """Parses the MRUList entry value. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfvfs. registry_key (dfwinreg.WinRegistryKey): Windows Registry key that contains the MRUList value. entry_index (int): MRUList entry index. entry_letter (str): character value representing the entry. Returns: str: MRUList entry value. """ value_string = u'' value = registry_key.GetValueByName(u'{0:s}'.format(entry_letter)) if value is None: logging.debug( u'[{0:s}] Missing MRUList entry value: {1:s} in key: {2:s}.'. format(self.NAME, entry_letter, registry_key.path)) elif value.DataIsString(): value_string = value.GetDataAsObject() elif value.DataIsBinaryData(): logging.debug(( u'[{0:s}] Non-string MRUList entry value: {1:s} parsed as string ' u'in key: {2:s}.').format(self.NAME, entry_letter, registry_key.path)) utf16_stream = binary.ByteStreamCopyToUTF16Stream(value.data) try: value_string = utf16_stream.decode(u'utf-16-le') except UnicodeDecodeError as exception: value_string = binary.HexifyBuffer(utf16_stream) logging.warning(( u'[{0:s}] Unable to decode UTF-16 stream: {1:s} in MRUList entry ' u'value: {2:s} in key: {3:s} with error: {4:s}').format( self.NAME, value_string, entry_letter, registry_key.path, exception)) return value_string
def _ParseMRUListExEntryValue( self, parser_context, key, entry_index, entry_number, text_dict, **unused_kwargs): """Parses the MRUListEx entry value. Args: parser_context: A parser context object (instance of ParserContext). key: the Registry key (instance of winreg.WinRegKey) that contains the MRUListEx value. entry_index: integer value representing the MRUListEx entry index. entry_number: integer value representing the entry number. text_dict: text dictionary object to append textual strings. """ value_string = u'' value = key.GetValue(u'{0:d}'.format(entry_number)) if value is None: logging.debug( u'[{0:s}] Missing MRUListEx entry value: {1:d} in key: {2:s}.'.format( self.NAME, entry_number, key.path)) elif value.DataIsString(): value_string = value.data elif value.DataIsBinaryData(): logging.debug(( u'[{0:s}] Non-string MRUListEx entry value: {1:d} parsed as string ' u'in key: {2:s}.').format(self.NAME, entry_number, key.path)) utf16_stream = binary.ByteStreamCopyToUtf16Stream(value.data) try: value_string = utf16_stream.decode('utf-16-le') except UnicodeDecodeError as exception: value_string = binary.HexifyBuffer(utf16_stream) logging.warning(( u'[{0:s}] Unable to decode UTF-16 stream: {1:s} in MRUListEx entry ' u'value: {2:d} in key: {3:s} with error: {4:s}').format( self.NAME, value_string, entry_number, key.path, exception)) value_text = u'Index: {0:d} [MRU Value {1:d}]'.format( entry_index + 1, entry_number) text_dict[value_text] = value_string
def _ParseMRUListExEntryValue(self, parser_mediator, key, entry_index, entry_number, **unused_kwargs): """Parses the MRUListEx entry value. Args: parser_mediator: A parser mediator object (instance of ParserMediator). key: the Registry key (instance of dfwinreg.WinRegistryKey) that contains the MRUListEx value. entry_index: integer value representing the MRUListEx entry index. entry_number: integer value representing the entry number. Returns: A string containing the value. """ value_string = u'' value = key.GetValueByName(u'{0:d}'.format(entry_number)) if value is None: logging.debug( u'[{0:s}] Missing MRUListEx entry value: {1:d} in key: {2:s}.'. format(self.NAME, entry_number, key.path)) elif value.DataIsString(): value_string = value.GetDataAsObject() elif value.DataIsBinaryData(): logging.debug(( u'[{0:s}] Non-string MRUListEx entry value: {1:d} parsed as string ' u'in key: {2:s}.').format(self.NAME, entry_number, key.path)) utf16_stream = binary.ByteStreamCopyToUTF16Stream(value.data) try: value_string = utf16_stream.decode(u'utf-16-le') except UnicodeDecodeError as exception: value_string = binary.HexifyBuffer(utf16_stream) logging.warning(( u'[{0:s}] Unable to decode UTF-16 stream: {1:s} in MRUListEx entry ' u'value: {2:d} in key: {3:s} with error: {4:s}').format( self.NAME, value_string, entry_number, key.path, exception)) return value_string