binary parser: parsing binary gets bytes

Author: Willi Ballenthin

Evtx/BinaryParser.py

@@ -508,7 +508,7 @@ def unpack_binary(self, offset, length=False):
             return ""
         o = self._offset + offset
         try:
-            return struct.unpack_from("<{}s".format(length), self._buf, o)[0]
+            return bytes(struct.unpack_from("<{}s".format(length), self._buf, o)[0])
         except struct.error:
             raise OverrunBufferException(o, len(self._buf))
 
@@ -521,7 +521,7 @@ def unpack_string(self, offset, length):
         Throws:
         - `OverrunBufferException`
         """
-        return self.unpack_binary(offset, length)
+        return self.unpack_binary(offset, length).decode('ascii')
 
     def unpack_wstring(self, offset, length):
         """
@@ -534,11 +534,14 @@ def unpack_wstring(self, offset, length):
         - `UnicodeDecodeError`
         """
         try:
-            return self._buf[self._offset + offset:self._offset + offset + \
-                             2 * length].tostring().decode("utf16")
+            return bytes(self._buf[self._offset + offset:self._offset + offset + \
+                                   2 * length]).decode("utf16")
         except AttributeError: # already a 'str' ?
-            return self._buf[self._offset + offset:self._offset + offset + \
-                             2 * length].decode("utf16")
+            return bytes(self._buf[self._offset + offset:self._offset + offset + \
+                                   2 * length]).decode("utf16")
+        except:
+            from IPython import embed; embed()
+            import sys; sys.exit()
 
     def unpack_dosdate(self, offset):
         """

Evtx/Views.py

@@ -143,7 +143,7 @@ def rec(root_node):
         f = _make_template_xml_view(root_node, cache=cache)
         subs_strs = []
         for sub in root_node.fast_substitutions():
-            if isinstance(sub, basestring):
+            if isinstance(sub, str):
                 subs_strs.append((xml_sax_escape(sub, {'"': """})).encode("ascii", "xmlcharrefreplace"))
             elif isinstance(sub, RootNode):
                 subs_strs.append(rec(sub))