For backward compatibility, string values passed from and to Python scripts and the source code of Python scripts are by default ISO-8859-1 (latin1) encoded. If you need to process any non-latin1 characters in Python scripts, you can change the encoding in the options dialog, under the Python Settings tab. A new setting will not affect those scripts that have been compiled before this change.
Since Rekall uses Unicode strings internally, it is in most cases reasonable to select UTF-8 encoding, but be aware of possible pitfalls. For example, the number of bytes of a UTF-8 encoded string does not necessarily equal the number of its characters
Binary DataRekall generally assumes, that a string value passed as an argument in a method call like item.setValue(row, data) contains text data. This causes problems, if data contains binary data, like a pixmap image: If the binary data contains a byte with the value 0, Rekall truncates the data at the position of this byte. A change of the encoding can lead to corrupted data.
To tell Rekall that an argument contains data of a certain type, pass it as an instance of the class RekallMain.KBValue:
def eventFunc(button): # load the image data of the current row of the pixmap field called # imfield, rotate the picture by 90 degree and write it back to the # field. This example requires the Python Imaging Library. import Image, cStringIO from RekallMain import KBValue imfield = button.getNamedCtrl('../imfield') data = imfield.getValue(-1) if data == None: return im = Image.open(cStringIO.StringIO(data)) im = im.transpose(Image.ROTATE_90) buff = cStringIO.StringIO() im.save(buff, 'JPEG') data = buff.getvalue() imfield.setValue(-1, KBValue(data, KBValue.BINARY)) |
KBValue instances are useful as arguments for the methods item.setValue, block.setRowValue and cursor.execute, i.e. as values which are directly or indirectly passed to an SQL statement.
The following methods can handle KBValue instances:
object.__setattr__ (implicitly called in expressions like object.myAttribute = 'something")
block.setRowValue
cursor.execute
block.gotoQueryRowByKey
form.openForm
form.openReport
item.setValue
slot methods
event methods
If a KBValue instance is used as a parameter for other Rekall functions or methods, its content is converted into a string.
The second argument of the KBValue constructor defines the type of the data. Its value should be one class properties KBValue.FIXED (for integer data), KBValue.FLOAT, KBValue.DATE, KBValue.TIME, KBValue.DATETIME, KBValue.STRING, KBValue.BINARY, KBValue.BOOL.