class PEdump::NE::Resource
Public Instance Methods
parse(f, h={})
click to toggle source
NE
strings use 8-bit characters
Calls superclass method
PEdump::Resource#parse
# File lib/pedump/ne.rb, line 154 def parse f, h={} self.data = [] case type when 'STRING' f.seek file_offset 16.times do break if f.tell >= file_offset+self.size nChars = f.getc.ord t = if nChars + 1 > self.size # TODO: if it's not 1st string in table then truncated size must be less PEdump.logger.error "[!] string size(#{nChars*2}) > stringtable size(#{self.size}). truncated to #{self.size-2}" f.read(self.size-1) else f.read(nChars) end data << begin t.force_encoding("CP#{h[:cp]}").encode!('UTF-8') rescue t.force_encoding('ASCII') end end when 'VERSION' f.seek file_offset data << PEdump::NE::VS_VERSIONINFO.read(f) else super(f) end end