def _ParseMRUListExEntryValue( self, parser_context, key, entry_index, entry_number, text_dict, **unused_kwargs): """Parses the MRUListEx entry value. Args: parser_context: A parser context object (instance of ParserContext). key: the Registry key (instance of winreg.WinRegKey) that contains the MRUListEx value. entry_index: integer value representing the MRUListEx entry index. entry_number: integer value representing the entry number. text_dict: text dictionary object to append textual strings. """ value_string = u'' value = key.GetValue(u'{0:d}'.format(entry_number)) if value is None: logging.debug( u'[{0:s}] Missing MRUListEx entry value: {1:d} in key: {2:s}.'.format( self.NAME, entry_number, key.path)) elif value.DataIsString(): value_string = value.data elif value.DataIsBinaryData(): logging.debug(( u'[{0:s}] Non-string MRUListEx entry value: {1:d} parsed as string ' u'in key: {2:s}.').format(self.NAME, entry_number, key.path)) utf16_stream = binary.ByteStreamCopyToUtf16Stream(value.data) try: value_string = utf16_stream.decode('utf-16-le') except UnicodeDecodeError as exception: value_string = binary.HexifyBuffer(utf16_stream) logging.warning(( u'[{0:s}] Unable to decode UTF-16 stream: {1:s} in MRUListEx entry ' u'value: {2:d} in key: {3:s} with error: {4:s}').format( self.NAME, value_string, entry_number, key.path, exception)) value_text = u'Index: {0:d} [MRU Value {1:d}]'.format( entry_index + 1, entry_number) text_dict[value_text] = value_string
def _ParseMRUListEntryValue(self, parser_mediator, key, entry_index, entry_letter, **unused_kwargs): """Parses the MRUList entry value. Args: parser_mediator: A parser context object (instance of ParserContext). key: the Registry key (instance of winreg.WinRegKey) that contains the MRUList value. entry_index: integer value representing the MRUList entry index. entry_letter: character value representing the entry. Returns: A string containing the value. """ value_string = u'' value = key.GetValue(u'{0:s}'.format(entry_letter)) if value is None: logging.debug( u'[{0:s}] Missing MRUList entry value: {1:s} in key: {2:s}.'. format(self.NAME, entry_letter, key.path)) elif value.DataIsString(): value_string = value.data elif value.DataIsBinaryData(): logging.debug(( u'[{0:s}] Non-string MRUList entry value: {1:s} parsed as string ' u'in key: {2:s}.').format(self.NAME, entry_letter, key.path)) utf16_stream = binary.ByteStreamCopyToUtf16Stream(value.data) try: value_string = utf16_stream.decode('utf-16-le') except UnicodeDecodeError as exception: value_string = binary.HexifyBuffer(utf16_stream) logging.warning(( u'[{0:s}] Unable to decode UTF-16 stream: {1:s} in MRUList entry ' u'value: {2:s} in key: {3:s} with error: {4:s}').format( self.NAME, value_string, entry_letter, key.path, exception)) return value_string