Learning Python for Forensics
上QQ阅读APP看书,第一时间看更新

Constructing the get_device_names() function

This function's purpose is to pass the VID and PID information into the usb_lookup library and return resolved USB names. As defined by the docstring mentioned later, this function takes two dictionaries—the first contains the database of known devices from prep_usb_lookup(), and the second contains the extracted device entries from parse_device_info(). With this provided data, we will return a dictionary, updated with resolved vendor and product names:

151 def get_device_names(usb_dict, device_info):
152 """
153 Query `usb_lookup.py` for device information based on VID/PID.
154 :param usb_dict: Dictionary from usb_lookup.py of known
155 devices.
156 :param device_info: Dictionary containing 'Vendor ID' and
157 'Product ID' keys and values.
158 :return: original dictionary with 'Vendor Name' and
159 'Product Name' keys and values
160 """

This function calls the usb_lookup.search_key() function, passing the processed online USB dictionary and a two-element list containing the device's VID and PID as the first and second element, respectively. The .search_key() function returns either a responsive match or the Unknown string if no matches are discovered. This data is returned as a tuple and assigned to the device_name variable on line 161. We then split the two resolved values into new keys of our device_info dictionary on lines 165 and 166. Once we have expanded device_info, we can return it so that it can be printed to the console. See the following lines:

161     device_name = usb_lookup.search_key(
162 usb_dict, [device_info['Vendor ID'],
163 device_info['Product ID']])
164
165 device_info['Vendor Name'] = device_name[0]
166 device_info['Product Name'] = device_name[1]
167
168 return device_info