| 879 | } |
| 880 | |
| 881 | fn reg_to_py(vm: &VirtualMachine, ret_data: &[u8], typ: u32) -> PyResult { |
| 882 | match typ { |
| 883 | REG_DWORD => { |
| 884 | // If there isn’t enough data, return 0. |
| 885 | let val = ret_data |
| 886 | .first_chunk::<4>() |
| 887 | .copied() |
| 888 | .map_or(0, u32::from_ne_bytes); |
| 889 | Ok(vm.ctx.new_int(val).into()) |
| 890 | } |
| 891 | REG_QWORD => { |
| 892 | let val = ret_data |
| 893 | .first_chunk::<8>() |
| 894 | .copied() |
| 895 | .map_or(0, u64::from_ne_bytes); |
| 896 | Ok(vm.ctx.new_int(val).into()) |
| 897 | } |
| 898 | REG_SZ | REG_EXPAND_SZ => { |
| 899 | let u16_slice = bytes_as_wide_slice(ret_data); |
| 900 | // Only use characters up to the first NUL. |
| 901 | let len = u16_slice |
| 902 | .iter() |
| 903 | .position(|&c| c == 0) |
| 904 | .unwrap_or(u16_slice.len()); |
| 905 | let s = String::from_utf16(&u16_slice[..len]) |
| 906 | .map_err(|e| vm.new_value_error(format!("UTF16 error: {e}")))?; |
| 907 | Ok(vm.ctx.new_str(s).into()) |
| 908 | } |
| 909 | REG_MULTI_SZ => { |
| 910 | if ret_data.is_empty() { |
| 911 | Ok(vm.ctx.new_list(vec![]).into()) |
| 912 | } else { |
| 913 | let u16_slice = bytes_as_wide_slice(ret_data); |
| 914 | let u16_count = u16_slice.len(); |
| 915 | |
| 916 | // Remove trailing null if present (like countStrings) |
| 917 | let len = if u16_count > 0 && u16_slice[u16_count - 1] == 0 { |
| 918 | u16_count - 1 |
| 919 | } else { |
| 920 | u16_count |
| 921 | }; |
| 922 | |
| 923 | let mut strings: Vec<PyObjectRef> = Vec::new(); |
| 924 | let mut start = 0; |
| 925 | for i in 0..len { |
| 926 | if u16_slice[i] == 0 { |
| 927 | let s = String::from_utf16(&u16_slice[start..i]) |
| 928 | .map_err(|e| vm.new_value_error(format!("UTF16 error: {e}")))?; |
| 929 | strings.push(vm.ctx.new_str(s).into()); |
| 930 | start = i + 1; |
| 931 | } |
| 932 | } |
| 933 | // Handle last string if not null-terminated |
| 934 | if start < len { |
| 935 | let s = String::from_utf16(&u16_slice[start..len]) |
| 936 | .map_err(|e| vm.new_value_error(format!("UTF16 error: {e}")))?; |
| 937 | strings.push(vm.ctx.new_str(s).into()); |
| 938 | } |