def _ParseFilenameStrings(self, file_object, file_information):
"""Parses the filename strings.
Args:
file_object: A file-like object to read data from.
file_information: The file information construct object.
Returns:
A dict of filename strings with their byte offset as the key.
"""
filename_strings_offset = file_information.get(
u'filename_strings_offset', 0)
filename_strings_size = file_information.get(u'filename_strings_size',
0)
if filename_strings_offset > 0 and filename_strings_size > 0:
file_object.seek(filename_strings_offset, os.SEEK_SET)
filename_strings_data = file_object.read(filename_strings_size)
filename_strings = binary.ArrayOfUTF16StreamCopyToStringTable(
filename_strings_data)
else:
filename_strings = {}
return filename_strings
def testArrayOfUTF16StreamCopyToStringTable(self):
"""Test copying an array of UTF-16 byte streams to a string table."""
test_file_path = self._GetTestFilePath(['PING.EXE-B29F6629.pf'])
with open(test_file_path, 'rb') as file_object:
byte_stream = file_object.read()
string_table = binary.ArrayOfUTF16StreamCopyToStringTable(
byte_stream[0x1c44:], byte_stream_size=2876)
expected_string_table = {
0: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\NTDLL.DLL',
102: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\KERNEL32.DLL',
210: ('\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\'
'APISETSCHEMA.DLL'),
326: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\KERNELBASE.DLL',
438: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\LOCALE.NLS',
542: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\PING.EXE',
642: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\ADVAPI32.DLL',
750: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSVCRT.DLL',
854: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\SECHOST.DLL',
960: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\RPCRT4.DLL',
1064: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\IPHLPAPI.DLL',
1172: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\NSI.DLL',
1270: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WINNSI.DLL',
1374: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\USER32.DLL',
1478: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\GDI32.DLL',
1580: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\LPK.DLL',
1678: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\USP10.DLL',
1780: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WS2_32.DLL',
1884: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\IMM32.DLL',
1986: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSCTF.DLL',
2088: ('\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\EN-US\\'
'PING.EXE.MUI'),
2208: ('\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\GLOBALIZATION\\'
'SORTING\\SORTDEFAULT.NLS'),
2348: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\MSWSOCK.DLL',
2454: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSHQOS.DLL',
2558: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSHTCPIP.DLL',
2666: '\\DEVICE\\HARDDISKVOLUME1\\WINDOWS\\SYSTEM32\\WSHIP6.DLL'}
self.assertEqual(string_table, expected_string_table)