/// <summary> /// Returns the registry that must be used to handle te specified <see cref="RegistryRequest"/> with. /// </summary> /// <param name="request">The <see cref="RegistryRequest"/> to get the handling registry for.</param> /// <param name="recoverHandle">Indicates whether or not a possible unknown <see cref="RegistryRequest.Handle"/> should be recovered and virtualized.</param> /// <returns></returns> public RegistryBase GetRegistryFor(RegistryRequest request, bool recoverHandle) { if (request == null) { throw new ArgumentNullException("request"); } RegistryBase result = null; if (_virtualRegistry.IsKnownKey(request)) { result = _virtualRegistry; } else if (_transparentRegistry.IsKnownKey(request)) { result = _transparentRegistry; } else if (HiveHelper.IsHiveHandle(request.Handle)) { request.KeyFullPath = HiveHelper.GetHive(request.Handle).AsRegistryHiveName(); result = GetDefaultRegistryFor(request); } else if (recoverHandle) { // Unknown handle, and allowed to be recovered and virtualized. result = TryRecoverUnknownHandle(request); } else { EngineCore.Log.Error("Unknown registry key handle => {0}", request.Handle); } request.VirtualizationType = GetVirtualizationType(request.KeyFullPath); return(result); }
private void ReplaceItemsCollection(ObservableCollection <TItem> items) { RegistryBase <TItem> registry = _registry; lock (_replaceItemsLocker) { if (_items != null) { _items.CollectionChanged -= Items_CollectionChanged; } if (registry != null && _items != null) { _registry.RemoveCollectionFromTrace(_items); } _items = items; if (registry != null && _items != null) { _registry.AddCollectionToTrace(items); } if (items != null) { items.CollectionChanged += Items_CollectionChanged; } IDisposable safeUsageOperation = EnterSafeUsage(); if (safeUsageOperation == null) { return; } using (safeUsageOperation) using (_itemsLocker.EnterWriteLock()) _itemsAreModified = true; } }
public RegistryUpdater17( RegistryBase <TMember, IMember> registry, Action <TMember> onMemberCreatedOrUpdated) { _registry = registry; _onMemberCreatedOrUpdated = onMemberCreatedOrUpdated; }
public void Windows10ExtraData() { var r = new RegistryBase(@"D:\SynologyDrive\Registry\SOFTWARE_win10"); Check.That(r.Header.KtmFlags).IsEqualTo(KtmFlag.Unset); Check.That(r.Header.LastReorganizedTimestamp.HasValue).IsTrue(); }
protected virtual IMethodCallTransformerProvider CreateMethodCallTransformerProvider() { var methodInfoBasedRegistry = RegistryBase <MethodInfoBasedMethodCallTransformerRegistry, MethodInfo, IMethodCallTransformer> .CreateDefault(); var nameBasedRegistry = RegistryBase <NameBasedMethodCallTransformerRegistry, string, IMethodCallTransformer> .CreateDefault(); return(new CompoundMethodCallTransformerProvider(methodInfoBasedRegistry, nameBasedRegistry)); }
internal RegistryNode(RegistryBase registry, RegHive hive) { Hive = hive; Key = string.Empty; Registry = registry; Children = new LinkedList <RegistryNode>(); _searchElements.Add(this); }
public void Test() { var cfg = RegistryBase.Config.New().Add <ITestService, TestService>(); RegistryBase.ChangeConfig(cfg); var service = Registry.GetTestService(); Assert.NotNull(service); }
protected virtual ResultOperatorHandlerRegistry CreateResultOperatorHandlerRegistry() { var resultOperatorHandlerRegistry = RegistryBase <ResultOperatorHandlerRegistry, Type, IResultOperatorHandler> .CreateDefault(); var handler = new FetchResultOperatorHandler(); resultOperatorHandlerRegistry.Register(handler.SupportedResultOperatorType, handler); return(resultOperatorHandlerRegistry); }
public void ShouldThrowExceptionWhenNotRegistryHiveAndByteArray() { var fileStream = new FileStream(@"..\..\Hives\NotAHive", FileMode.Open, FileAccess.Read, FileShare.Read); var binaryReader = new BinaryReader(fileStream); binaryReader.BaseStream.Seek(0, SeekOrigin.Begin); var fileBytes = binaryReader.ReadBytes((int)binaryReader.BaseStream.Length); binaryReader.Close(); fileStream.Close(); Check.ThatCode(() => { var rb = new RegistryBase(fileBytes); }).Throws <ArgumentException>(); }
public void ShouldTakeByteArrayInConstructor() { var fileStream = new FileStream(@".\Hives\SAM", FileMode.Open, FileAccess.Read, FileShare.Read); var binaryReader = new BinaryReader(fileStream); binaryReader.BaseStream.Seek(0, SeekOrigin.Begin); var fileBytes = binaryReader.ReadBytes((int)binaryReader.BaseStream.Length); binaryReader.Close(); fileStream.Close(); var r = new RegistryBase(fileBytes, @".\Hives\SAM"); Check.That(r.Header).IsNotNull(); Check.That(r.HivePath).IsEqualTo(@".\Hives\SAM"); Check.That(r.HiveType).IsEqualTo(HiveTypeEnum.Sam); }
public void SoftwareHiveShouldHaveSoftwareHiveType() { var r = new RegistryBase(@".\Hives\software"); Check.That(HiveTypeEnum.Software).IsEqualTo(r.HiveType); }
public void SecurityHiveShouldHaveSecurityHiveType() { var r = new RegistryBase(@".\Hives\Security"); Check.That(HiveTypeEnum.Security).IsEqualTo(r.HiveType); }
public void SystemHiveShouldHaveSystemHiveType() { var r = new RegistryBase(@"..\..\Hives\system"); Check.That(HiveTypeEnum.System).IsEqualTo(r.HiveType); }
public void SamHiveShouldHaveSamHiveType() { var r = new RegistryBase(@"..\..\Hives\SAM"); Check.That(HiveTypeEnum.Sam).IsEqualTo(r.HiveType); }
public void DriversHiveShouldHaveDriversHiveType() { var r = new RegistryBase(@".\Hives\Drivers"); Check.That(HiveTypeEnum.Drivers).IsEqualTo(r.HiveType); }
public void SoftwareHiveShouldHaveSoftwareHiveType() { var r = new RegistryBase(@"..\..\Hives\software"); Check.That(HiveTypeEnum.Software).IsEqualTo(r.HiveType); }
public void ShouldThrowExceptionWhenNotRegistryHiveAndByteArray() { var fileStream = new FileStream(@"..\..\Hives\NotAHive", FileMode.Open, FileAccess.Read, FileShare.Read); var binaryReader = new BinaryReader(fileStream); binaryReader.BaseStream.Seek(0, SeekOrigin.Begin); var fileBytes = binaryReader.ReadBytes((int) binaryReader.BaseStream.Length); binaryReader.Close(); fileStream.Close(); Check.ThatCode(() => { var rb = new RegistryBase(fileBytes); }).Throws<ArgumentException>(); }
public void OtherHiveShouldHaveOtherHiveType() { var r = new RegistryBase(@".\Hives\SAN(OTHER)"); Check.That(HiveTypeEnum.Other).IsEqualTo(r.HiveType); }
public void BcdHiveShouldHaveBcdHiveType() { var r = new RegistryBase(@"..\..\Hives\BCD"); Check.That(HiveTypeEnum.Bcd).IsEqualTo(r.HiveType); }
public void DriversHiveShouldHaveDriversHiveType() { var r = new RegistryBase(@"..\..\Hives\Drivers"); Check.That(HiveTypeEnum.Drivers).IsEqualTo(r.HiveType); }
public void AddToRegistry(RegistryBase <TItem> registry) { _registry = registry; }
public void NtuserHiveShouldHaveNtuserHiveType() { var r = new RegistryBase(@"..\..\Hives\NTUSER.DAT"); Check.That(HiveTypeEnum.NtUser).IsEqualTo(r.HiveType); }
public void SecurityHiveShouldHaveSecurityHiveType() { var r = new RegistryBase(@"..\..\Hives\Security"); Check.That(HiveTypeEnum.Security).IsEqualTo(r.HiveType); }
public void SystemHiveShouldHaveSystemHiveType() { var r = new RegistryBase(@".\Hives\system"); Check.That(HiveTypeEnum.System).IsEqualTo(r.HiveType); }
public void UsrclassHiveShouldHaveUsrclassHiveType() { var r = new RegistryBase(@".\Hives\UsrClass 1.dat"); Check.That(HiveTypeEnum.UsrClass).IsEqualTo(r.HiveType); }
/// <summary> /// Initializes a new instance of <see cref="RegistrySwitch"/>. /// </summary> /// <param name="indexGenerator">The <see cref="IndexGenerator"/> to use for generating virtual key handles.</param> /// <param name="knownKeys">A list of all known virtual registry keys.</param> /// <param name="ruleCollection">The collection of engine rules to consider when deciding on a target registry.</param> public RegistrySwitch(IndexGenerator indexGenerator, IDictionary <uint, VirtualRegistryKey> knownKeys, RegistryRuleCollection ruleCollection) { _transparentRegistry = new TransparentRegistry(indexGenerator); _virtualRegistry = new VirtualRegistry(indexGenerator, knownKeys); _engineRules = ruleCollection; }
public void BcdHiveShouldHaveBcdHiveType() { var r = new RegistryBase(@".\Hives\BCD"); Check.That(HiveTypeEnum.Bcd).IsEqualTo(r.HiveType); }
public void UsrclassHiveShouldHaveUsrclassHiveType() { var r = new RegistryBase(@"..\..\Hives\UsrClass 1.dat"); Check.That(HiveTypeEnum.UsrClass).IsEqualTo(r.HiveType); }
public void NtuserHiveShouldHaveNtuserHiveType() { var r = new RegistryBase(@".\Hives\NTUSER.DAT"); Check.That(HiveTypeEnum.NtUser).IsEqualTo(r.HiveType); }
public void OtherHiveShouldHaveOtherHiveType() { var r = new RegistryBase(@"..\..\Hives\SAN(OTHER)"); Check.That(HiveTypeEnum.Other).IsEqualTo(r.HiveType); }
public void SamHiveShouldHaveSamHiveType() { var r = new RegistryBase(@".\Hives\SAM"); Check.That(HiveTypeEnum.Sam).IsEqualTo(r.HiveType); }
public void ShouldTakeByteArrayInConstructor() { var fileStream = new FileStream(@"..\..\Hives\SAM", FileMode.Open, FileAccess.Read, FileShare.Read); var binaryReader = new BinaryReader(fileStream); binaryReader.BaseStream.Seek(0, SeekOrigin.Begin); var fileBytes = binaryReader.ReadBytes((int) binaryReader.BaseStream.Length); binaryReader.Close(); fileStream.Close(); var r = new RegistryBase(fileBytes); Check.That(r.Header).IsNotNull(); Check.That(r.HivePath).IsEqualTo("None"); Check.That(r.HiveType).IsEqualTo(HiveTypeEnum.Sam); }