Exemple #1
0
        public static void Win32RegValueKind(RegistryKey hKey, string sValue, SubKeyValueInfo keyValueInfo)
        {
            string        sDataType = string.Empty;
            StringBuilder sbTemp    = new StringBuilder();

            keyValueInfo.sData    = string.Empty;
            keyValueInfo.sDataBuf = null;
            object            sDataBuf = null;
            int               type;
            RegistryValueKind valueKind = hKey.GetValueKind(sValue);

            switch (valueKind)
            {
            case RegistryValueKind.Unknown:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_RESOURCE_LIST;
                string[] sKey = hKey.ToString().Split(new char[] { '\\' }, 2);
                sDataBuf = RegGetValue(GetRegistryHive(keyValueInfo.hKey), sKey[1], sValue, out type);
                keyValueInfo.intDataType = type;
                if (sDataBuf != null)
                {
                    byte[] sBinaryData = sDataBuf as byte[];
                    foreach (byte byt in sBinaryData)
                    {
                        string stringValue = BitConverter.ToString(new byte[] { byt });
                        if (stringValue.Length == 1)
                        {
                            stringValue = "0" + stringValue;
                        }
                        sbTemp.Append(stringValue);
                        sbTemp.Append(" ");
                    }
                    keyValueInfo.sData = sbTemp.ToString();
                }
                break;

            case RegistryValueKind.Binary:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_BINARY;
                sDataBuf = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (sDataBuf != null)
                {
                    byte[] sBinaryData = sDataBuf as byte[];
                    if (sBinaryData != null)
                    {
                        foreach (byte byt in sBinaryData)
                        {
                            string stringValue = BitConverter.ToString(new byte[] { byt });
                            if (stringValue.Length == 1)
                            {
                                stringValue = "0" + stringValue;
                            }
                            sbTemp.Append(stringValue);
                            sbTemp.Append(" ");
                        }
                    }
                }
                keyValueInfo.sData = sbTemp.ToString();
                break;

            case RegistryValueKind.DWord:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_DWORD;
                keyValueInfo.sDataBuf    = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (keyValueInfo.sDataBuf != null)
                {
                    string sTemp = keyValueInfo.sDataBuf.ToString();
                    sTemp = RegistryUtils.DecimalToBase((UInt32)Convert.ToInt32(keyValueInfo.sDataBuf), 16);
                    keyValueInfo.sData = string.Concat("0x", sTemp.PadLeft(8, '0'), "(", ((uint)Convert.ToInt32(keyValueInfo.sDataBuf)).ToString(), ")");
                }
                break;

            case RegistryValueKind.ExpandString:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_EXPAND_SZ;
                sDataBuf = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (sDataBuf != null)
                {
                    keyValueInfo.sData = sDataBuf.ToString();
                }
                break;

            case RegistryValueKind.MultiString:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_MULTI_SZ;
                sDataBuf = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (sDataBuf != null)
                {
                    string[] sStringData = sDataBuf as string[];
                    if (sStringData != null)
                    {
                        foreach (string sr in sStringData)
                        {
                            sbTemp.Append(sr);
                            sbTemp.Append(" ");
                        }
                    }
                }
                keyValueInfo.sData = sbTemp.ToString();
                break;

            case RegistryValueKind.QWord:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_QUADWORD;
                sDataBuf = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (sDataBuf != null)
                {
                    string sTemp = sDataBuf.ToString();
                    sTemp = RegistryUtils.DecimalToBase((UInt64)Convert.ToInt64(sDataBuf), 16);
                    keyValueInfo.sData = string.Concat("0x", sTemp.PadLeft(16, '0'), "(", ((ulong)Convert.ToInt64(sDataBuf)).ToString(), ")");
                }
                break;

            case RegistryValueKind.String:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_SZ;
                sDataBuf = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (sDataBuf != null)
                {
                    keyValueInfo.sData = sDataBuf.ToString();
                }
                break;

            default:
                keyValueInfo.RegDataType = LWRegistryValueKind.REG_NONE;
                sDataBuf = hKey.GetValue(sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                if (sDataBuf != null)
                {
                    keyValueInfo.sData = sDataBuf.ToString();
                }
                else
                {
                    keyValueInfo.sData = "(zero-length binary value)";
                }
                break;
            }
        }
        public static object GetFormatSpecificData(SubKeyValueInfo valueInfo)
        {
            object sData = null;

            switch (valueInfo.RegDataType)
            {
            case LWRegistryValueKind.REG_BINARY:
                valueInfo.sDataBuf = valueInfo.sParentKey.GetValue(valueInfo.sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                byte[] byts = valueInfo.sDataBuf as byte[];
                sData = GetBinaryData(byts);
                break;

            case LWRegistryValueKind.REG_DWORD:
                valueInfo.sDataBuf = valueInfo.sParentKey.GetValue(valueInfo.sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                sData = RegistryUtils.DecimalToBase((UInt32)Convert.ToInt32(valueInfo.sDataBuf), 16).PadLeft(8, '0');
                break;

            case LWRegistryValueKind.REG_EXPAND_SZ:
                valueInfo.sDataBuf = valueInfo.sParentKey.GetValue(valueInfo.sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                byte[]      eByts    = new ASCIIEncoding().GetBytes(valueInfo.sDataBuf.ToString() + "\r\n");
                List <byte> eBytList = new List <byte>();
                foreach (byte byt in eByts)
                {
                    if (byt == 10 || byt == 13)
                    {
                        eBytList.Add((byte)00);
                    }
                    else
                    {
                        eBytList.Add(byt);
                        eBytList.Add((byte)00);
                    }
                }
                eByts = new byte[eBytList.Count];
                eBytList.CopyTo(eByts);
                sData = GetBinaryData(eByts);
                break;

            case LWRegistryValueKind.REG_SZ:
                valueInfo.sDataBuf = valueInfo.sParentKey.GetValue(valueInfo.sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                sData = string.Concat("\"", valueInfo.sDataBuf, "\"");
                break;

            case LWRegistryValueKind.REG_MULTI_SZ:
                string[]      sDataArry = valueInfo.sParentKey.GetValue(valueInfo.sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames) as string[];
                StringBuilder sTempArry = new StringBuilder();
                List <byte>   bytList   = new List <byte>();
                foreach (string value in sDataArry)
                {
                    sTempArry.AppendLine(value);
                }
                byte[] sByts = new ASCIIEncoding().GetBytes(sTempArry.ToString() + "\r\n");
                foreach (byte byt in sByts)
                {
                    if (byt == 10 || byt == 13)
                    {
                        bytList.Add((byte)00);
                    }
                    else
                    {
                        bytList.Add(byt);
                        bytList.Add((byte)00);
                    }
                }
                sByts = new byte[bytList.Count];
                bytList.CopyTo(sByts);
                sData = GetBinaryData(sByts);
                break;

            case LWRegistryValueKind.REG_QUADWORD:
                valueInfo.sDataBuf = valueInfo.sParentKey.GetValue(valueInfo.sValue, null, RegistryValueOptions.DoNotExpandEnvironmentNames);
                sData = RegistryUtils.DecimalToBase((UInt64)Convert.ToUInt32(valueInfo.sDataBuf), 16).PadLeft(16, '0');
                break;

            case LWRegistryValueKind.REG_RESOURCE_LIST:
            case LWRegistryValueKind.REG_UNKNOWN:
                string[] sKey        = valueInfo.sParentKey.ToString().Split(new char[] { '\\' }, 2);
                object   data        = RegistryInteropWrapperWindows.RegGetValue(RegistryInteropWrapperWindows.GetRegistryHive(valueInfo.hKey), sKey[1], valueInfo.sValue, out valueInfo.intDataType);
                byte[]   bBinarydata = data as byte[];
                sData = GetBinaryData(bBinarydata);
                break;

            default:
                break;
            }
            return(sData);
        }