public RegistryInventory[] GetResults()
{
List <RegistryInventory> Results = new List <RegistryInventory>();
RegistryHive Hive = new RegistryHive();
string Path = string.Empty;
// Extract the Hive and Subkey path from the key string
if (!RegistryTools.TryGetRegistryHiveAndPath(Rule.Key, ref Hive, ref Path))
{
return(Results.ToArray());
}
// Get redirection options
// Get target registry key while validating existence and accurate case for path
RegistryKey TargetKey = GetTargetKey(Hive, Path);
// Get values from registry key
if (TargetKey != null)
{
GetKeyValues(Results, TargetKey, Rule.Name);
TargetKey.Dispose();
}
else
{
Log.Write($@"Key doesn't exist {Rule.Key}");
}
return(Results.ToArray());
}
public override void Backup(string backupDirectory)
{
using (var key = OpenRegKey())
{
switch (key.GetValueKind(ValueName))
{
case RegistryValueKind.ExpandString:
case RegistryValueKind.String:
var targetValue = key.GetStringSafe(ValueName);
var dir = CreateBackupDirectory(backupDirectory);
var fileName = PathTools.SanitizeFileName(string.Concat(FullRegKeyPath, " - ", ValueName)
.TrimStart('\\').Replace('.', '_')) + ".reg";
RegistryTools.ExportRegistryStringValues(Path.Combine(dir, fileName), FullRegKeyPath,
new KeyValuePair <string, string>(ValueName, targetValue));
break;
case RegistryValueKind.MultiString:
case RegistryValueKind.Binary:
case RegistryValueKind.DWord:
case RegistryValueKind.QWord:
case RegistryValueKind.Unknown:
Debug.Fail("Unsupported type " + ValueName);
break;
}
}
}
public IEnumerable <IJunkResult> FindJunk(ApplicationUninstallerEntry target)
{
var returnList = new List <IJunkResult>();
if (string.IsNullOrEmpty(target.InstallLocation))
{
return(returnList);
}
string pathRoot;
try
{
pathRoot = Path.GetPathRoot(target.InstallLocation);
}
catch (SystemException ex)
{
Console.WriteLine(ex);
return(returnList);
}
var unrootedLocation = pathRoot.Length >= 1
? target.InstallLocation.Replace(pathRoot, string.Empty)
: target.InstallLocation;
if (string.IsNullOrEmpty(unrootedLocation.Trim()))
{
return(returnList);
}
using (var key = RegistryTools.OpenRegistryKey(Path.Combine(SoftwareRegKeyScanner.KeyCu, AudioPolicyConfigSubkey)))
{
if (key == null)
{
return(returnList);
}
foreach (var subKeyName in key.GetSubKeyNames())
{
using (var subKey = key.OpenSubKey(subKeyName))
{
if (subKey == null)
{
continue;
}
var defVal = subKey.GetStringSafe(null);
if (defVal != null &&
defVal.Contains(unrootedLocation, StringComparison.InvariantCultureIgnoreCase))
{
var junk = new RegistryKeyJunk(subKey.Name, target, this);
junk.Confidence.Add(ConfidenceRecords.ExplicitConnection);
returnList.Add(junk);
}
}
}
}
return(returnList);
}
public override void Backup(string backupDirectory)
{
var fileName = PathTools.SanitizeFileName(FullRegKeyPath.TrimStart('\\')) + ".reg";
var path = Path.Combine(CreateBackupDirectory(backupDirectory), fileName);
RegistryTools.ExportRegistry(path, new[] { FullRegKeyPath });
}
public SettingsWindow()
{
Opacity = 0;
InitializeComponent();
Icon = Resources.editoricon;
var settings = Settings.Default.Binder;
settings.BindControl(checkBoxRestoreSessionSettings, s => s.RestoreSessionSettingsOnExit, this);
settings.SendUpdates(this);
try
{
using (var key = RegistryTools.OpenRegistryKey(RunKeyPath))
{
checkBoxBoot.Checked = key?.GetValue(RunKeyValueName) != null;
}
}
catch (Exception ex)
{
ShowBootException(ex);
checkBoxBoot.Enabled = false;
}
checkBoxBoot.CheckedChanged += checkBoxBoot_CheckedChanged;
}
/// <summary>
/// Look for registry values in the run keys
/// </summary>
private static IEnumerable <StartupEntry> GetRegStartupItems(StartupPointData point)
{
var results = new List <StartupEntry>();
try
{
using (var rKey = RegistryTools.OpenRegistryKey(point.Path))
{
if (rKey != null)
{
results.AddRange(from name in rKey.GetValueNames()
let result = rKey.GetValue(name) as string
where !string.IsNullOrEmpty(result)
select new StartupEntry(point, name, result));
}
}
}
catch (ArgumentException)
{
// Key doesn't exist, create it
RegistryTools.CreateSubKeyRecursively(point.Path)?.Close();
}
return(results);
}
public static void UnregisterServer()
{
// Create a new registry tools object
RegistryTools registry = new RegistryTools()
{
Hive = PluginHive
};
// This is a 32-bit plugin, so determine if the target
// key needs to access a WoW emulation key
string key =
String.Format(
@"{0}\{1}",
((Platform.GetPlatform() == PlatformType.X64) ?
PluginKeyWow : PluginKey),
PluginGuid
);
// Loop through each of the plugin settings and
// delete them from the registry
foreach (var setting in PluginSettings)
{
registry.DeleteValue(
key,
setting.Key
);
}
// Delete the plugin key altogether
registry.DeleteKey(PluginKey);
}
public override void Setup(ICollection <ApplicationUninstallerEntry> allUninstallers)
{
base.Setup(allUninstallers);
// Preload all values into a new cache
_regAppsValueCache = new List <RegAppEntry>();
foreach (var targetRootName in TargetRoots)
{
using (var rootKey = RegistryTools.OpenRegistryKey(targetRootName))
{
using (var regAppsKey = rootKey.OpenSubKey(RegAppsSubKeyPath))
{
if (regAppsKey == null)
{
continue;
}
var names = regAppsKey.GetValueNames();
var results = names.Attempt(n => new { name = n, value = regAppsKey.GetStringSafe(n) })
.Where(x => !string.IsNullOrEmpty(x.value))
.ToList();
_regAppsValueCache.AddRange(results.Select(x => new RegAppEntry(x.name, targetRootName, x.value.Trim('\\', ' ', '"', '\''))));
}
}
}
}
public override void Delete()
{
using (var key = RegistryTools.OpenRegistryKey(ParentPath, true))
{
key?.DeleteValue(Name);
}
}
public static void RegisterServer(Type type)
{
// Create a new registry tools object
RegistryTools registry = new RegistryTools()
{
Hive = PluginHive
};
// This is a 32-bit plugin, so determine if the target
// key needs to access a WoW emulation key
string key =
String.Format(
@"{0}\{1}",
((Platform.GetPlatform() == PlatformType.X64) ?
PluginKeyWow : PluginKey),
PluginGuid
);
// Loop through each of the plugin settings and add
// them to the registry
foreach (var setting in PluginSettings)
{
registry.WriteValue(
key,
setting.Key,
setting.Value,
RegistryValueKind.String
);
}
}
public override void Delete()
{
using (var key = RegistryTools.OpenRegistryKey(FullRegKeyPath, true))
{
key?.DeleteValue(ValueName);
}
}
/// <summary>
/// Setups the registry path.
/// </summary>
/// <param name="rootPath">The root path.</param>
/// <param name="regKeyName">Name of the registry key.</param>
/// <param name="defaultValue">The default value.</param>
/// <param name="environmentVariableKey">The environment variable key.</param>
/// <returns></returns>
protected string SetupRegistryPath(string rootPath, string regKeyName, string defaultValue,
string environmentVariableKey = null)
{
string result;
if (!RegistryTools.ExistsCurrentUserRoot(rootPath))
{
RegistryTools.CreateCurrentUserRoot(rootPath);
}
var keyValue = RegistryTools.GetValueCurrentUserRoot(rootPath, regKeyName);
if (keyValue == null)
{
RegistryTools.SetValueCurrentUserRoot(rootPath, regKeyName, defaultValue);
result = defaultValue;
}
else
{
result = keyValue.ToString();
}
if (!string.IsNullOrEmpty(environmentVariableKey))
{
EnvironmentVariables.Add(environmentVariableKey, result);
}
return(result);
}
public override void Delete()
{
using (var key = RegistryTools.OpenRegistryKey(RegKeyParentPath, true))
{
key?.DeleteSubKeyTree(RegKeyName);
}
}
public static IEnumerable <BrowserHelperEntry> GetBrowserHelpers()
{
using (var clsidKey = RegistryTools.OpenRegistryKey(ClsidPath))
{
foreach (var registryStartupPoint in RegistryStartupPoints)
{
using (var mainKey = RegistryTools.CreateSubKeyRecursively(registryStartupPoint))
{
foreach (var browserHelperEntry in
GatherBrowserHelpersFromKey(mainKey, clsidKey, registryStartupPoint, false))
{
yield return(browserHelperEntry);
}
using (var disabledKey = mainKey.OpenSubKey(AutorunsDisabledKeyName))
{
if (disabledKey == null)
{
continue;
}
foreach (var browserHelperEntry in
GatherBrowserHelpersFromKey(disabledKey, clsidKey, registryStartupPoint, true))
{
yield return(browserHelperEntry);
}
}
}
}
}
}
/// <summary>
/// Open locations of the startup entries in respective applications. (regedit, win explorer, task scheduler)
/// </summary>
public static void OpenStartupEntryLocations(IEnumerable <StartupEntryBase> selection)
{
var startupEntryBases = selection as IList <StartupEntryBase> ?? selection.ToList();
var regOpened = false;
if (startupEntryBases.Any(x => x is TaskEntry))
{
TaskService.Instance.StartSystemTaskSchedulerManager();
}
var browserAddon = startupEntryBases.OfType <BrowserHelperEntry>().FirstOrDefault();
if (browserAddon != null)
{
RegistryTools.OpenRegKeyInRegedit(browserAddon.FullLongName);
regOpened = true;
}
foreach (var item in startupEntryBases)
{
if (item is StartupEntry s && s.IsRegKey)
{
if (!regOpened)
{
RegistryTools.OpenRegKeyInRegedit(item.ParentLongName);
regOpened = true;
}
}
private IEnumerable <JunkNode> ScanAppCompatFlags()
{
if (string.IsNullOrEmpty(Uninstaller.InstallLocation))
{
yield break;
}
foreach (var fullCompatKey in AppCompatFlags.SelectMany(compatKey => new[]
{
compatKey + @"\Layers",
compatKey + @"\Compatibility Assistant\Store"
}))
{
using (var key = RegistryTools.OpenRegistryKey(fullCompatKey))
{
if (key == null)
{
continue;
}
foreach (var valueName in key.GetValueNames())
{
// Check for matches
if (valueName.StartsWith(Uninstaller.InstallLocation,
StringComparison.InvariantCultureIgnoreCase))
{
var junk = new RegistryValueJunkNode(key.Name, valueName, Uninstaller.DisplayName);
junk.Confidence.Add(ConfidencePart.ExplicitConnection);
yield return(junk);
}
}
}
}
}
public IEnumerable <IJunkResult> FindJunk(ApplicationUninstallerEntry target)
{
if (string.IsNullOrEmpty(target.InstallLocation))
{
yield break;
}
foreach (var fullCompatKey in AppCompatFlags.SelectMany(compatKey => new[]
{
compatKey + @"\Layers",
compatKey + @"\Compatibility Assistant\Store"
}))
{
using (var key = RegistryTools.OpenRegistryKey(fullCompatKey))
{
if (key == null)
{
continue;
}
foreach (var valueName in key.GetValueNames())
{
// Check for matches
if (valueName.StartsWith(target.InstallLocation,
StringComparison.InvariantCultureIgnoreCase))
{
var junk = new RegistryValueJunk(key.Name, valueName, target, this);
junk.Confidence.Add(ConfidenceRecord.ExplicitConnection);
yield return(junk);
}
}
}
}
}
public override void Setup(ICollection <ApplicationUninstallerEntry> allUninstallers)
{
base.Setup(allUninstallers);
_comEntries = new List <ComEntry>();
_extensionKeyNames = new Dictionary <string, string[]>();
foreach (var classesKeyPath in _classesKeys)
{
using (var classesKey = RegistryTools.OpenRegistryKey(classesKeyPath, false, true))
{
if (classesKey == null)
{
continue;
}
_extensionKeyNames.Add(classesKeyPath, classesKey.GetSubKeyNames().Where(x => x.Length > 0 && x[0] == '.').ToArray());
try
{
GetClsidEntries(_comEntries, classesKey);
GetTypeLibEntries(_comEntries, classesKey);
}
catch (SystemException ex)
{
Console.WriteLine(@"Unexpected error while scanning COM entries, the registry might be corrupted. COM junk detection will not work.");
Console.WriteLine(ex);
}
}
}
// Gather com interface info
// https://docs.microsoft.com/en-us/windows/desktop/com/interface-key
foreach (var classesKeyPath in _classesKeys)
{
using (var interfacesKey = RegistryTools.OpenRegistryKey(Path.Combine(classesKeyPath, "Interface"), false, true))
{
if (interfacesKey == null)
{
continue;
}
foreach (var singleInterfaceKey in interfacesKey.GetSubKeyNames())
{
using (var proxyKey = interfacesKey.OpenSubKey(Path.Combine(singleInterfaceKey, "ProxyStubClsid32")))
{
var proxyGuid = proxyKey?.GetValue(null, null) as string;
if (proxyGuid == null)
{
continue;
}
var matchClass = _comEntries.FirstOrDefault(x => string.Equals(x.Guid, proxyGuid, StringComparison.OrdinalIgnoreCase));
matchClass?.InterfaceNames.Add(Path.Combine(interfacesKey.Name, singleInterfaceKey));
}
}
}
}
}
private static void SetDisabled(StartupEntry startupEntry, bool disabled)
{
using (var key = RegistryTools.CreateSubKeyRecursively(GetStartupApprovedKey(startupEntry)))
{
key.SetValue(startupEntry.EntryLongName, disabled ? DisabledBytes : EnabledBytes,
RegistryValueKind.Binary);
}
}
private static bool GetDisabled(StartupEntry startupEntry)
{
using (var key = RegistryTools.CreateSubKeyRecursively(GetStartupApprovedKey(startupEntry)))
{
var bytes = key.GetValue(startupEntry.EntryLongName) as byte[];
return(bytes != null && bytes.Length > 0 && !bytes[0].Equals(0x02));
}
}
public static string GetSysManagementSerialNumber64(string string_0)
{
string str = "HKEY_LOCAL_MACHINE";
string str1 = string.Concat("SOFTWARE\\", string_0);
string str2 = "AELicenseInfo";
string empty = string.Empty;
return(RegistryTools.Get64BitRegistryKey(str, str1, str2));
}
/// <summary>
/// Sets the provider up
/// </summary>
public virtual void Setup()
{
if (!RegistryTools.ExistsCurrentUserRoot(RegistryRootPath))
{
RegistryTools.CreateCurrentUserRoot(RegistryRootPath);
}
SetupApplicationLocation();
SetupProfile();
}
public override void Open()
{
if (!RegKeyExists())
{
throw new IOException($"Key \"{FullRegKeyPath}\" doesn't exist or can't be accessed");
}
RegistryTools.OpenRegKeyInRegedit(FullRegKeyPath);
}
private void LoadRegestrySessionsList()
{
try {
TreeNode node = RegistryTools.ImportSessionsFromRegistry();
trvRegistrySessions.Nodes.Add(node);
node.Expand();
} catch (Exception ex) {
Program.LogWriter.Log("Could not load Team Sessions - {0}", ex.Message);
}
}
public bool StillExists(StartupEntry startupEntry)
{
if (startupEntry.IsRegKey)
{
using (var key = RegistryTools.OpenRegistryKey(startupEntry.ParentLongName))
return(!string.IsNullOrEmpty(key.GetStringSafe(startupEntry.EntryLongName)));
}
return(File.Exists(startupEntry.FullLongName));
}
/// <summary>
/// Create a registry value for the specified entry. Works for drive links as well.
/// </summary>
/// <param name="startupEntry"></param>
internal static void CreateRegValue(StartupEntry startupEntry)
{
if (string.IsNullOrEmpty(startupEntry.Command))
{
return;
}
using (var runKey = RegistryTools.CreateSubKeyRecursively(startupEntry.ParentLongName))
{
runKey.SetValue(startupEntry.EntryLongName, startupEntry.Command, RegistryValueKind.String);
}
}
private static Microsoft.Win32.RegistryKey GetFirewallRulesKey()
{
try
{
return(RegistryTools.OpenRegistryKey(FirewallRulesKey));
}
catch (SystemException ex)
{
Console.WriteLine(ex);
return(null);
}
}
private IEnumerable <JunkNode> ScanRelatedKeys(IEnumerable <JunkNode> itemsToCompare)
{
var input = itemsToCompare.ToList();
var output = new List <JunkNode>();
foreach (var registryJunkNode in input)
{
var nodeName = registryJunkNode.FullName;
// Check Wow first because non-wow path will match wow path
var softwareKey = new[] { KeyLmWow, KeyCuWow, KeyLm, KeyCu }.First(
key => nodeName.StartsWith(key, StringComparison.InvariantCultureIgnoreCase));
nodeName = nodeName.Substring(softwareKey.Length + 1);
foreach (var keyToTest in SoftwareRegKeys.Except(new[] { softwareKey }))
{
var nodePath = Path.Combine(keyToTest, nodeName);
// Check if the same node exists in other root keys
var node = input.FirstOrDefault(x => PathTools.PathsEqual(x.FullName, nodePath));
if (node != null)
{
// Add any non-duplicate confidence to the existing node
node.Confidence.AddRange(registryJunkNode.Confidence.ConfidenceParts
.Where(x => !node.Confidence.ConfidenceParts.Any(x.Equals)));
}
else
{
try
{
// Check if the key acually exists
using (var nodeKey = RegistryTools.OpenRegistryKey(nodePath, false))
{
if (nodeKey != null)
{
var newNode = new RegistryKeyJunkNode(Path.GetDirectoryName(nodePath),
Path.GetFileName(nodePath), Uninstaller.DisplayName);
newNode.Confidence.AddRange(registryJunkNode.Confidence.ConfidenceParts);
output.Add(newNode);
}
}
}
catch
{
// Ignore keys that don't exist
}
}
}
}
return(output);
}
/// <summary>
/// Gets or creates a HKCU registry entry
/// </summary>
/// <param name="key">The key of the registry entry</param>
/// <param name="path">The relative registry path to the entry.
/// When <see cref="path" /> is <see langword="null" /> only the root path will be used</param>
/// <param name="defaultValue">The value which should be used when the entry must be created</param>
/// <returns>
/// The value of the registry entry
/// </returns>
public string GetOrCreateRegistryVariable(string key, string path, string defaultValue)
{
var fullPath = path == null ? RegistryRootPath : Path.Combine(RegistryRootPath, path);
var value = RegistryTools.GetValueCurrentUserRoot(fullPath, key);
if (value == null)
{
value = defaultValue;
RegistryTools.SetValueCurrentUserRoot(fullPath, key, defaultValue);
}
return(value.ToString());
}
private static void GetTypeLibEntries(ICollection <ComEntry> results, RegistryKey classes)
{
using (var typeLibKey = RegistryTools.OpenRegistryKey(Path.Combine(classes.Name, "TypeLib"), false, true))
{
if (typeLibKey == null)
{
return;
}
foreach (var typeLibKeyGuid in typeLibKey.GetSubKeyNames())
{
if (IsSystemGuid(typeLibKeyGuid))
{
continue;
}
using (var guidKey = typeLibKey.OpenSubKey(typeLibKeyGuid))
{
var versionKeyName = guidKey?.GetSubKeyNames().FirstOrDefault();
if (versionKeyName == null)
{
continue;
}
var result = results.FirstOrDefault(x => string.Equals(x.Guid, typeLibKeyGuid, StringComparison.OrdinalIgnoreCase)) ?? new ComEntry(typeLibKeyGuid);
foreach (var fileKeyPath in new[] { Path.Combine(versionKeyName, "0\\win32"), Path.Combine(versionKeyName, "0\\win64") })
{
using (var fileKey = guidKey.OpenSubKey(fileKeyPath))
{
var path = fileKey?.GetValue(null, null) as string;
if (string.IsNullOrEmpty(path))
{
continue;
}
path = PathTools.NormalizePath(path);
if (UninstallToolsGlobalConfig.IsSystemDirectory(path))
{
continue;
}
result.FullFilename = PathTools.NormalizePath(Environment.ExpandEnvironmentVariables(path));
results.Add(result);
break;
}
}
}
}
}
}
