Class: PEdump::NE::Resource

Inherits:
Resource show all
Defined in:
lib/pedump/ne.rb

Instance Attribute Summary

Attributes inherited from Resource

#cp, #data, #file_offset, #id, #lang, #name, #reserved, #size, #type, #valid

Instance Method Summary collapse

Methods inherited from Resource

#bitmap_hdr, #bitmap_mask, #restore_bitmap, #validate

Instance Method Details

#parse(f, h = {}) ⇒ Object

NE strings use 8-bit characters



154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
 
# File 'lib/pedump/ne.rb', line 154

def parse f, h={}
  self.data = []
  case type
  when 'STRING'
    f.seek file_offset
    16.times do
      break if f.tell >= file_offset+self.size
      nChars = f.getc.ord
      t =
        if nChars + 1 > self.size
          # TODO: if it's not 1st string in table then truncated size must be less
          PEdump.logger.error "[!] string size(#{nChars*2}) > stringtable size(#{self.size}). truncated to #{self.size-2}"
          f.read(self.size-1)
        else
          f.read(nChars)
        end
      data <<
        begin
          t.force_encoding("CP#{h[:cp]}").encode!('UTF-8')
        rescue
          t.force_encoding('ASCII')
        end
    end
  when 'VERSION'
    f.seek file_offset
    data << PEdump::NE::VS_VERSIONINFO.read(f)
  else
    super(f)
  end
end