public void ShellItemRegistryDecoratorTest()
{
var shellItem = new MockShellItem("Test", 0x99);
var regKey = new RegistryKeyWrapper(null, "testUser", "testPath");
int existingPropCount = shellItem.GetAllProperties().Count;
//test injection of additional properties
var regShellItem = new RegistryShellItemDecorator(shellItem, regKey);
Assert.IsTrue(regShellItem.GetAllProperties().Count > existingPropCount);
}
/// <summary>
/// Identifies and gathers ShellBag items from raw binary registry data.
/// </summary>
/// <returns>a list of different variety ShellBag items</returns>
public static List <IShellItem> GetShellItems(IRegistryReader registryReader)
{
List <IShellItem> shellItems = new List <IShellItem>();
Dictionary <RegistryKeyWrapper, IShellItem> keyShellMappings = new Dictionary <RegistryKeyWrapper, IShellItem>();
foreach (RegistryKeyWrapper keyWrapper in registryReader.GetRegistryKeys())
{
if (keyWrapper.Value != null) // Some Registry Keys are null
{
ShellItemList shellItemList = new ShellItemList(keyWrapper.Value);
foreach (IShellItem shellItem in shellItemList.Items())
{
IShellItem parentShellItem = null;
//obtain the parent shellitem from the parent registry key (if it exists)
if (keyWrapper.Parent != null)
{
if (keyShellMappings.TryGetValue(keyWrapper.Parent, out IShellItem pShellItem))
{
parentShellItem = pShellItem;
}
}
RegistryShellItemDecorator decoratedShellItem = new RegistryShellItemDecorator(shellItem, keyWrapper, parentShellItem);
try
{
keyShellMappings.Add(keyWrapper, decoratedShellItem);
}
catch (ArgumentException ex)
{
//*should* never happen, if it does Absolute Path finding need to be reworked. Potentially should be a fatal exception
// as now the shellbags involved are misleading. (contain incomplete data)
logger.Error(ex, $"Registry Item {keyWrapper.RegistryPath} already had an associated Shellbag ({keyShellMappings[keyWrapper].Name}), Absolute Path's are no longer accurate.");
}
shellItems.Add(decoratedShellItem);
}
}
}
return(shellItems);
}
