Learning Python for Forensics
上QQ阅读APP看书,第一时间看更新

Forming the prep_usb_lookup() function

In this function, we call out to the usb_lookup.py script's .get_usb_file() function. Using the local_usb_ids parameter that's provided, we can confirm whether there is a known usb.ids file path that we should use for this lookup, or whether we should reach out to the online resource at http://linux-usb.org/usb.ids to read the known USB information into the usb_file variable on line 147. This database is an open source project that hosts the VID/PID lookup database, allowing users to reference and expand on the database:

137 def prep_usb_lookup(local_usb_ids=None):
138 """
139 Prepare the lookup of USB devices through accessing the most
140 recent copy of the database at http://linux-usb.org/usb.ids
141 or using the provided file and parsing it into a queriable
142 dictionary format.
143 """
144 if local_usb_ids:
145 usb_file = open(local_usb_ids, encoding='latin1')
146 else:
147 usb_file = usb_lookup.get_usb_file()

After downloading or using a local copy, we pass the file object to the .parse_file() function to process and then return the USB VID/PID data as a Python dictionary. Instead of creating a new variable for this functionality, we can just place the return keyword in front of the function call to immediately pass the value back, as shown on line 148:

148     return usb_lookup.parse_file(usb_file)