internal static ValueKey Get(byte[] bytes, string path, string key, string val)
{
NamedKey hiveroot = Helper.GetRootKey(bytes, path);
NamedKey nk = hiveroot;
if (key != null)
{
foreach (string k in key.Split('\\'))
{
foreach (NamedKey n in nk.GetSubKeys(bytes))
{
if (n.Name.ToUpper() == k.ToUpper())
{
nk = n;
}
}
}
}
ValueKey[] values = nk.GetValues(bytes);
foreach (ValueKey v in values)
{
if (v.Name.ToUpper() == val.ToUpper())
{
return(v);
}
}
return(null);
}
internal NetworkList(NamedKey nk, byte[] bytes)
{
WriteTime = nk.WriteTime;
foreach (ValueKey vk in nk.GetValues(bytes))
{
switch (vk.Name)
{
case "ProfileGuid":
ProfileGuid = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "Description":
Description = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "Source":
Source = BitConverter.ToUInt32(vk.GetData(bytes), 0x00);
break;
case "DnsSuffix":
DnsSuffix = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "FirstNetwork":
FirstNetwork = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "DefaultGatewayMac":
DefaultGatewayMac = new PhysicalAddress(vk.GetData(bytes));
break;
default:
break;
}
}
}
internal AppCompat(NamedKey nk, byte[] bytes)
{
foreach(ValueKey vk in nk.GetValues(bytes))
{
switch(vk.Name)
{
case "0":
ProductName = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "1":
CompanyName = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "6":
FileSize = BitConverter.ToUInt32(vk.GetData(bytes), 0x00);
break;
case "c":
Description = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "f":
CompileTime = new DateTime(1970, 1, 1).AddSeconds(BitConverter.ToInt32(vk.GetData(bytes), 0x00));
break;
case "11":
ModifiedTime = DateTime.FromFileTimeUtc(BitConverter.ToInt64(vk.GetData(bytes), 0x00));
break;
case "12":
BornTime = DateTime.FromFileTimeUtc(BitConverter.ToInt64(vk.GetData(bytes), 0x00));
break;
case "15":
Path = Encoding.Unicode.GetString(vk.GetData(bytes));
break;
case "17":
ModifiedTime2 = DateTime.FromFileTimeUtc(BitConverter.ToInt64(vk.GetData(bytes), 0x00));
break;
case "101":
Hash = Encoding.Unicode.GetString(vk.GetData(bytes)).TrimStart('0');
break;
default:
break;
}
}
}
internal static ValueKey[] GetInstances(byte[] bytes, string path, string key)
{
NamedKey hiveroot = Helper.GetRootKey(bytes, path);
NamedKey nk = hiveroot;
if (key != null)
{
foreach (string k in key.Split('\\'))
{
foreach (NamedKey n in nk.GetSubKeys(bytes))
{
if (n.Name.ToUpper() == k.ToUpper())
{
nk = n;
}
}
}
}
return(nk.GetValues(bytes));
}