Source code for plaso.helpers.windows.resource_files

# -*- coding: utf-8 -*-
"""Windows PE/COFF resource file helper."""

import re


[docs]class WindowsResourceFileHelper(object): """Windows PE/COFF resource file helper.""" # Message string specifiers that are considered white space. _MESSAGE_STRING_WHITE_SPACE_SPECIFIER_RE = re.compile(r'(%[0b]|[\r\n])') # Message string specifiers that expand to text. _MESSAGE_STRING_TEXT_SPECIFIER_RE = re.compile(r'%([ .!%nrt])') # Curly brackets in a message string. _MESSAGE_STRING_CURLY_BRACKETS = re.compile(r'([\{\}])') # Message string specifiers that expand to a variable place holder. _MESSAGE_STRING_PLACE_HOLDER_SPECIFIER_RE = re.compile( r'%([1-9][0-9]?)[!]?[s]?[!]?') @classmethod def _MessageStringPlaceHolderSpecifierReplacer(cls, match_object): """Replaces message string place holders into Python format() style. Args: match_object (re.Match): regular expression match object. Returns: str: message string with Python format() style place holders. """ expanded_groups = [] for group in match_object.groups(): try: place_holder_number = int(group, 10) - 1 expanded_group = '{{{0:d}:s}}'.format(place_holder_number) except ValueError: expanded_group = group expanded_groups.append(expanded_group) return ''.join(expanded_groups)
[docs] @classmethod def FormatMessageStringInPEP3101(cls, message_string): """Formats a message string in Python format() (PEP 3101) style. Args: message_string (str): message string. Returns: str: message string in Python format() (PEP 3101) style. """ if not message_string: return None message_string = message_string.rstrip('\0') message_string = cls._MESSAGE_STRING_WHITE_SPACE_SPECIFIER_RE.sub( r'', message_string) message_string = cls._MESSAGE_STRING_TEXT_SPECIFIER_RE.sub( r'\\\1', message_string) message_string = cls._MESSAGE_STRING_CURLY_BRACKETS.sub( r'\1\1', message_string) return cls._MESSAGE_STRING_PLACE_HOLDER_SPECIFIER_RE.sub( cls._MessageStringPlaceHolderSpecifierReplacer, message_string)