class PEdump::NE::Resource

Public Instance Methods

parse(f, h={}) click to toggle source

NE strings use 8-bit characters

Calls superclass method PEdump::Resource#parse
# File lib/pedump/ne.rb, line 154
def parse f, h={}
  self.data = []
  case type
  when 'STRING'
    f.seek file_offset
    16.times do
      break if f.tell >= file_offset+self.size
      nChars = f.getc.ord
      t =
        if nChars + 1 > self.size
          # TODO: if it's not 1st string in table then truncated size must be less
          PEdump.logger.error "[!] string size(#{nChars*2}) > stringtable size(#{self.size}). truncated to #{self.size-2}"
          f.read(self.size-1)
        else
          f.read(nChars)
        end
      data <<
        begin
          t.force_encoding("CP#{h[:cp]}").encode!('UTF-8')
        rescue
          t.force_encoding('ASCII')
        end
    end
  when 'VERSION'
    f.seek file_offset
    data << PEdump::NE::VS_VERSIONINFO.read(f)
  else
    super(f)
  end
end