The below code works, but assigns each newline of a multiline string to a new row vs. the desired state of one cell.
While researching a possible solutions I read:
- That I should try enclose the string in double quotes
- That replacing
newline
withcarriage return
helps - Parsing as a list/tuple via
[]
declaration
Having tried all the above, I'm thoroughly confused as to why this isn't working. If I remove newline
it assigns everything to a single cell in the row but then it's hard to read.
Is there no way to preserve format when outputting a string with csv.writer
?
def run_rip():
os.chdir('/REGRIPPERDIR/RegRipper2.8')
for k in ntDict:
run_command = "".join(["./rip.pl", " -r /APATH/NTUSER.DAT -p ", str(k)])
process = subprocess.Popen(run_command,
shell=True,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
out, err = process.communicate()
pattern = re.compile('lastwrite|(\d{2}:\d{2}:\d{2})|alert|trust|Value')
grouping = re.compile('(?P<first>.+?)(\n)(?P<second>.+?)([\n]{2})(?P<rest>.+[\n])', re.MULTILINE | re.DOTALL)
if pattern.findall(out):
match = re.search(grouping, out)
first = match.group('first')
second =match.group('second')
rest = ('"%s' % os.linesep.join([s for s in match.group('rest').splitlines() if s]))
rest = rest.replace('\n','\r\n')
headers = ['Name', 'Description', 'Found']
f = csv.writer(open('/APATH/ntuser.csv', 'ab'),
dialect=csv.excel,
delimiter='\t')
f.writerow(headers)
f.writerow((first, second, rest))
print(out)
ntDict.popitem(last=False)
run_rip()
/edit: I was requested in the comments below to post a sample of the third string rest
as it is collected. The below text is what would be passed to csv.writer
.
Baseline\n #First string as defined by the regex
(All) scans a hive\n #Second String as defined by the regex
Total values checked : 64\n #This and below is the rest string
Number of binary value lengths : 11\n
...\n
Value -5: 176 bytes [# times: 1]\n
Value -4: 712 bytes [# times: 5]\n