Source code for plaso.formatters.winreg
# -*- coding: utf-8 -*-
"""Windows Registry custom event formatter helpers."""
from plaso.formatters import interface
from plaso.formatters import manager
[docs]class WindowsRegistryValuesFormatterHelper(
interface.CustomEventFormatterHelper):
"""Windows Registry values formatter helper."""
IDENTIFIER = 'windows_registry_values'
[docs] def FormatEventValues(self, output_mediator, event_values):
"""Formats event values using the helper.
Args:
output_mediator (OutputMediator): output mediator.
event_values (dict[str, object]): event values.
"""
values = event_values.get('values', None)
if not values:
values = '(empty)'
elif isinstance(values, list):
values = ' '.join([
'{0:s}: [{1:s}] {2:s}'.format(
name or '(default)', data_type, data or '(empty)')
for name, data_type, data in sorted(values)])
event_values['values'] = values
manager.FormattersManager.RegisterEventFormatterHelper(
WindowsRegistryValuesFormatterHelper)