Ejemplo n.º 1
0
        private string GetValue(RegistryCaptureBinaryValue value)
        {
            StringBuilder hexadecimalValue = new StringBuilder();

            foreach (byte byteValue in value.Value)
            {
                hexadecimalValue.Append(byteValue.ToString("X2", CultureInfo.InvariantCulture.NumberFormat));
            }
            return(hexadecimalValue.ToString());
        }
Ejemplo n.º 2
0
        private RegistryCaptureValue LoadValue(Match match, bool unicode, StreamReader reader, ref string line)
        {
            RegistryCaptureValue registryValue = null;
            string name  = match.Groups["Name"].Value;
            string value = match.Groups["Value"].Value;

            if ((match = m_stringValueRegex.Match(value)).Success)
            {
                // Unescape.

                value         = Regex.Replace(match.Groups["Value"].Value, @"\\(.)", "$1");
                registryValue = new RegistryCaptureStringValue(name, value);
            }
            else if ((match = m_dwordValueRegex.Match(value)).Success)
            {
                int dwordValue = System.Convert.ToInt32(match.Groups["Value"].Value, 16);
                registryValue = new RegistryCaptureDWordValue(name, dwordValue);
            }
            else if ((match = m_binaryValueRegex.Match(value)).Success)
            {
                byte[] bytes = null;
                GetBytes(match, ref bytes, reader, ref line);
                registryValue = new RegistryCaptureBinaryValue(name, bytes);
            }
            else if ((match = m_expandableValueRegex.Match(value)).Success)
            {
                byte[] bytes = null;
                GetBytes(match, ref bytes, reader, ref line);
                Encoding encoding = unicode ? Encoding.Unicode : Encoding.ASCII;
                registryValue = new RegistryCaptureExpandStringValue(name, encoding.GetString(bytes));
            }
            else if ((match = m_multiStringValueRegex.Match(value)).Success)
            {
                byte[] bytes = null;
                GetBytes(match, ref bytes, reader, ref line);
                Encoding encoding = unicode ? Encoding.Unicode : Encoding.ASCII;
                string[] strings  = encoding.GetString(bytes).Split('\0');

                // Remove any empty strings from the end.

                LinkedList <string>     stringList = new LinkedList <string>(strings);
                LinkedListNode <string> node       = stringList.Last;
                while (node != null)
                {
                    if (!string.IsNullOrEmpty(node.Value))
                    {
                        break;
                    }
                    stringList.Remove(node);
                    node = stringList.Last;
                }

                strings = new string[stringList.Count];
                stringList.CopyTo(strings, 0);

                registryValue = new RegistryCaptureMultiStringValue(name, strings);
            }

            line = reader.ReadLine();
            return(registryValue);
        }