Example #1
0
        /// <summary>
        /// Compares one snapshot to another and returns the differences
        /// </summary>
        /// <param name="newSnapshot">The snapshot to compare.</param>
        /// <returns>a <see cref="RegistrySnapshot"/> that contains both the added and removed items.</returns>
        public RegistrySnapshot CompareTo(RegistrySnapshot newSnapshot)
        {
            RegistrySnapshot snapshot = new RegistrySnapshot(this.Hive);

            // compare "this" to what is provided, and if what is provided
            // does not have an entry, the consider it deleted.
            foreach (string key in this.Keys)
            {
                if (!newSnapshot.ContainsKey(key))
                {
                    snapshot.Add(key, this[key]);
                    snapshot[key].State = RegistrySnapshotState.Removed;
                }
            }

            // Now compare what was provided to "this" and if entries
            // are missing, then consider then as newly added.
            foreach (string key in newSnapshot.Keys)
            {
                if (!this.ContainsKey(key))
                {
                    snapshot.Add(key, newSnapshot[key]);
                    snapshot[key].State = RegistrySnapshotState.Added;
                }
            }

            return(snapshot);
        }
Example #2
0
        /// <summary>
        /// Takes a snapshot of the registry.
        /// </summary>
        /// <returns></returns>
        public RegistrySnapshot TakeSnapshot()
        {
            RegistrySnapshot snapshot = new RegistrySnapshot(_targetHive);

            using (RegistryKey baseKey = GetRegistryKey(_targetHive))
            {
                CrawlRegistry(snapshot, baseKey, _registryPath);
            }

            return(snapshot);
        }
Example #3
0
        private void CrawlRegistry(RegistrySnapshot snapshot, RegistryKey baseKey, string subTree)
        {
            Collection <string>  subKeyNames  = null;
            RegistrySnapshotKeys snapshotData = null;

            if (!snapshot.TryGetValue(subTree, out snapshotData))
            {
                snapshotData = new RegistrySnapshotKeys(RegistrySnapshotState.Existed);
                snapshot.Add(subTree, snapshotData);
            }

            try
            {
                using (RegistryKey key = baseKey.OpenSubKey(subTree))
                {
                    if (key != null)
                    {
                        foreach (string valueName in key.GetValueNames())
                        {
                            RegistrySnapshotKey data = new RegistrySnapshotKey();
                            data.Name  = valueName;
                            data.Kind  = key.GetValueKind(valueName);
                            data.Value = key.GetValue(valueName);

                            snapshotData.Entries.Add(data);
                        }

                        subKeyNames = new Collection <string>(key.GetSubKeyNames());
                    }
                }
            }
            catch (SecurityException ex)
            {
                // If logging is enabled, capture the error, otherwise just continue
                if (LogErrors)
                {
                    Console.WriteLine("{0}:{1}", ex.Message, subTree);
                }
            }

            if (subKeyNames != null)
            {
                // For any subkeys at this level, call recursively to process them
                foreach (string subKey in subKeyNames)
                {
                    string subTreePath = !string.IsNullOrEmpty(subTree) ? subTree + @"\" + subKey : subKey;
                    CrawlRegistry(snapshot, baseKey, subTreePath);
                }
            }
        }