Method peek_string

pydevd_attach_to_process/winappdbg/process.py:2323–2377

Tries to read an ASCII or Unicode string from the address space of the process. @see: L{read_string} @type lpBaseAddress: int @param lpBaseAddress: Memory address to begin reading. @type fUnicode: bool @param fUnicode: C{True} is the stri

(self, lpBaseAddress, fUnicode=False, dwMaxSize=0x1000)

        return self.__poke_c_type(lpBaseAddress, "@P", unpackedValue)

    def peek_string(self, lpBaseAddress, fUnicode=False, dwMaxSize=0x1000):
        """
        Tries to read an ASCII or Unicode string
        from the address space of the process.

        @see: L{read_string}

        @type  lpBaseAddress: int
        @param lpBaseAddress: Memory address to begin reading.

        @type  fUnicode: bool
        @param fUnicode: C{True} is the string is expected to be Unicode,
            C{False} if it's expected to be ANSI.

        @type  dwMaxSize: int
        @param dwMaxSize: Maximum allowed string length to read, in bytes.

        @rtype:  str, compat.unicode
        @return: String read from the process memory space.
            It B{doesn't} include the terminating null character.
            Returns an empty string on failure.
        """

        # Validate the parameters.
        if not lpBaseAddress or dwMaxSize == 0:
            if fUnicode:
                return ""
            return ""
        if not dwMaxSize:
            dwMaxSize = 0x1000

        # Read the string.
        szString = self.peek(lpBaseAddress, dwMaxSize)

        # If the string is Unicode...
        if fUnicode:
            # Decode the string.
            szString = compat.unicode(szString, "U16", "replace")
            ##            try:
            ##                szString = compat.unicode(szString, 'U16')
            ##            except UnicodeDecodeError:
            ##                szString = struct.unpack('H' * (len(szString) / 2), szString)
            ##                szString = [ unichr(c) for c in szString ]
            ##                szString = u''.join(szString)

            # Truncate the string when the first null char is found.
            szString = szString[: szString.find("\0")]

        # If the string is ANSI...
        else:
            # Truncate the string when the first null char is found.
            szString = szString[: szString.find("\0")]

        # Return the decoded string.
        return szString

    # TODO
    # try to avoid reading the same page twice by caching it