Question

我有一个从注册表编辑.reg文件转换而来的csv。数据框如下：

Path,Key,Type,Value,date_time
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\1,Key,hex(0),0000000180000600,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\1,KeyLength,dword,00000008,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\1,Rw,hex(0),ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000ffffffffffffffffffffffff,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\1,RwLength,dword,000000e8,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\1,RwMask,hex(0),ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\2,Key,hex(0),0000000080000600,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\2,KeyLength,dword,00000008,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\2,Rw,hex(0),ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000ffffffffffffffffffffffff0000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000ffffffffffffffffffffffff,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\2,RwLength,dword,000000e8,1487463163.916084
HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\NsiMigrationRoot\7\2,RwMask,hex(0),ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp,@,NONE,Paint.Picture,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp,Content Type,NONE,image/bmp,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp,PerceivedType,NONE,image,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\OpenWithList,NONE,NONE,NONE,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\OpenWithList\MSPaint.exe,@,NONE,,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\OpenWithProgids,Paint.Picture,NONE,,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\PersistentHandler,@,NONE,{098f2470-bae0-11cd-b579-08002b30bfeb},1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\ShellNew,ItemName,hex(2),40002500730079007300740065006d0072006f006f00740025005c00730079007300740065006d00330032005c006d0073007000610069006e0074002e006500780065002c002d00350039003400310034000000,1487463163.916084
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\ShellNew,NullFile,NONE,,1487463163.916084

我有一个函数，我在导出到csv之前调用它，将hex（7）和hex（2）类型转换为ascii字符，如下所示：

def fn(foo):
    if "NONE" in foo:
        return foo
    else:
        try:
            x = re.sub(' |\n|\t|00', '', foo)
            return "".join(binascii.unhexlify(x).decode())
        except:
            binascii.Error

我已经验证此功能有效。

我的问题是，当我转换如下：

df['Value'] = df[df['Type'].str.contains('hex\\(2\\)')]['Value'].apply(lambda x: fn("".join(x)))

这会将我的类型hex（2）转换为ascii，但会删除其他类型的剩余值。

我也尝试过以下内容：

df[df['Type'].str.contains('hex\\(2\\)')]['Value'] = df[df['Type'].str.contains('hex\\(2\\)')]['Value'].apply(lambda x: fn("".join(x)))

如何仅引用十六进制（7）和十六进制（2）值并仅在我的数据框中替换它们的值并保留其余值？谢谢你的帮助。

Answer 1

试试这个：

In [229]: df.loc[df.Type.str.contains('hex\((?:2|7)\)'), 'Value'] = \
              df.loc[df.Type.str.contains('hex\((?:2|7)\)'), 'Value'].map(fn)

In [230]: df
Out[230]:
                                       Path            Key    Type                                    Value     date_time
0   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...            Key  hex(0)                         0000000180000600  1.487463e+09
1   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...      KeyLength   dword                                 00000008  1.487463e+09
2   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...             Rw  hex(0)  ffffffffffffffffffffffffffffffffffff...  1.487463e+09
3   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...       RwLength   dword                                 000000e8  1.487463e+09
4   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...         RwMask  hex(0)  ffffffffffffffffffffffffffffffffffff...  1.487463e+09
5   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...            Key  hex(0)                         0000000080000600  1.487463e+09
6   HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgr...      KeyLength   dword                                 00000008  1.487463e+09
..                                      ...            ...     ...                                      ...           ...
12  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...  PerceivedType    NONE                                    image  1.487463e+09
13  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...           NONE    NONE                                     NONE  1.487463e+09
14  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...              @    NONE                                      NaN  1.487463e+09
15  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...  Paint.Picture    NONE                                      NaN  1.487463e+09
16  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...              @    NONE   {098f2470-bae0-11cd-b579-08002b30bfeb}  1.487463e+09
17  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...       ItemName  hex(2)  @%systemroot%\system32\mspaint.exe,-...  1.487463e+09
18  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\...       NullFile    NONE                                      NaN  1.487463e+09

[19 rows x 5 columns]

根据不同的列值将值分配给数据框中的列

1 个答案: