lib/pedump/ne.rb
# NE strings use 8-bit characters
NE strings use 8-bit characters
NE strings use 8 - bit characters
def parse f, h={}
        self.data = []
        case type
        when 'STRING'
          f.seek file_offset
          16.times do
            break if f.tell >= file_offset+self.size
            nChars = f.getc.ord
            t =
              if nChars + 1 > self.size
                PEdump.logger.error "[!] string size(#{nChars*2}) > stringtable size(#{self.size}). truncated to #{self.size-2}"
                f.read(self.size-1)
              else
                f.read(nChars)
              end
            data <<
              begin
                t.force_encoding("CP#{h[:cp]}").encode!('UTF-8')
              rescue
                t.force_encoding('ASCII')
              end
          end
        when 'VERSION'
          f.seek file_offset
          data << PEdump::NE::VS_VERSIONINFO.read(f)
        else
          super(f)
        end
      end
def parse f , h = { } self . data = [ ] case type when 'STRING' f . seek file_offset 16 . times do break if f . tell >= file_offset + self . size nChars = f . getc . ord t = if nChars + 1 > self . size PEdump . logger . error "[!] string size(#{nChars*2}) > stringtable size(#{self.size}). truncated to #{self.size-2}" f . read ( self . size - 1 ) else f . read ( nChars ) end data << begin t . force_encoding ( "CP#{h[:cp]}" ) . encode! ( 'UTF-8' ) rescue t . force_encoding ( 'ASCII' ) end end when 'VERSION' f . seek file_offset data << PEdump :: NE :: VS_VERSIONINFO . read ( f ) else super ( f ) end end
NE strings use 8-bit characters
NE strings use 8 - bit characters
# TODO: if it's not 1st string in table then truncated size must be less
f
h