def _ParseMRUListExKey(
      self, parser_mediator, registry_key, codepage='cp1252'):
    """Extract event objects from a MRUListEx Registry key.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      registry_key (dfwinreg.WinRegistryKey): Windows Registry key.
      codepage (Optional[str]): extended ASCII string codepage.
    """
    try:
      mrulistex = self._ParseMRUListExValue(registry_key)
    except (ValueError, errors.ParseError) as exception:
      parser_mediator.ProduceExtractionWarning(
          'unable to parse MRUListEx value with error: {0!s}'.format(exception))
      return

    if not mrulistex:
      return

    values_dict = {}
    found_terminator = False
    for entry_index, entry_number in enumerate(mrulistex):
      # The MRU list is terminated with -1 (0xffffffff).
      if entry_number == -1:
        break

      if found_terminator:
        parser_mediator.ProduceExtractionWarning((
            'found additional MRUListEx entries after terminator in key: '
            '{0:s}.').format(registry_key.path))

        # Only create one parser error per terminator.
        found_terminator = False

      value_string = self._ParseMRUListExEntryValue(
          parser_mediator, registry_key, entry_index, entry_number,
          codepage=codepage)

      value_text = 'Index: {0:d} [MRU Value {1:d}]'.format(
          entry_index + 1, entry_number)

      values_dict[value_text] = value_string

    event_data = windows_events.WindowsRegistryEventData()
    event_data.key_path = registry_key.path
    event_data.offset = registry_key.offset
    event_data.regvalue = values_dict
    event_data.source_append = self._SOURCE_APPEND

    event = time_events.DateTimeValuesEvent(
        registry_key.last_written_time, definitions.TIME_DESCRIPTION_WRITTEN)
    parser_mediator.ProduceEventWithEventData(event, event_data)
def _ParseMRUListExKey ( self , parser_mediator , registry_key , codepage = 'cp1252' ) : try : mrulistex = self . _ParseMRUListExValue ( registry_key ) except ( ValueError , errors . ParseError ) as exception : parser_mediator . ProduceExtractionWarning ( 'unable to parse MRUListEx value with error: {0!s}' . format ( exception ) ) return if not mrulistex : return values_dict = { } found_terminator = False for entry_index , entry_number in enumerate ( mrulistex ) : if entry_number == - 1 : break if found_terminator : parser_mediator . ProduceExtractionWarning ( ( 'found additional MRUListEx entries after terminator in key: ' '{0:s}.' ) . format ( registry_key . path ) ) found_terminator = False value_string = self . _ParseMRUListExEntryValue ( parser_mediator , registry_key , entry_index , entry_number , codepage = codepage ) value_text = 'Index: {0:d} [MRU Value {1:d}]' . format ( entry_index + 1 , entry_number ) values_dict [ value_text ] = value_string event_data = windows_events . WindowsRegistryEventData ( ) event_data . key_path = registry_key . path event_data . offset = registry_key . offset event_data . regvalue = values_dict event_data . source_append = self . _SOURCE_APPEND event = time_events . DateTimeValuesEvent ( registry_key . last_written_time , definitions . TIME_DESCRIPTION_WRITTEN ) parser_mediator . ProduceEventWithEventData ( event , event_data )
Extract event objects from a MRUListEx Registry key.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      registry_key (dfwinreg.WinRegistryKey): Windows Registry key.
      codepage (Optional[str]): extended ASCII string codepage.