MCPcopy Create free account
hub / github.com/ELMERIKH/PyinMemoryPE / read_wstring

Method read_wstring

windows/winobject/process.py:366–393  ·  view source on GitHub ↗

Read a windows UTF16 string at ``addr``

(self, addr)

Source from the content-addressed store, hash-verified

364 return b"".join(res).decode("ascii")
365
366 def read_wstring(self, addr):
367 """Read a windows UTF16 string at ``addr``"""
368 res = []
369 read_size = 0x100
370 readden = 0
371 # I am trying to do something smart here..
372 while True:
373 try:
374 x = self.read_memory(addr + readden, read_size)
375 except WindowsError as e:
376 if read_size == 2:
377 raise
378 # handle read_wstring at end of page
379 # Of read failed: read only the half of size
380 # read_size must remain a multiple of 2
381 read_size = read_size // 2
382 continue
383 readden += read_size
384 # Bytearray will work on py2 & py3
385 # Py2: bytearray((0, 0)) == b"\x00\x00"
386 # Py2: bytearray((0, 0)) == b"\x00\x00"
387 utf16_chars = [bytearray(c) for c in zip(*[iter(x)] * 2)]
388 if b"\x00\x00" in utf16_chars:
389 # Translate bytearray to str/bytes for both py2 & py3
390 res.extend(x[:utf16_chars.index(b"\x00\x00") * 2])
391 break
392 res.extend(x)
393 return bytearray(res).decode("utf-16")
394
395 def write_byte(self, addr, byte):
396 """write a byte at ``addr``"""

Callers 3

valueMethod · 0.45
_extract_environmentMethod · 0.45
_get_loaded_dllMethod · 0.45

Calls 3

indexMethod · 0.80
decodeMethod · 0.80
read_memoryMethod · 0.45

Tested by

no test coverage detected