private static object ToObject(RegistryValueType type, byte[] data) { switch (type) { case RegistryValueType.String: case RegistryValueType.ExpandString: case RegistryValueType.Link: return(Encoding.Unicode.GetString(data)); case RegistryValueType.MultiString: return(NtObjectUtils.ParseMultiString(data)); case RegistryValueType.Dword: return(BitConverter.ToUInt32(data, 0)); case RegistryValueType.DwordBigEndian: return(BitConverter.ToUInt32(data.Reverse().ToArray(), 0)); case RegistryValueType.Qword: return(BitConverter.ToUInt64(data, 0)); default: return(data); } }
/// <summary> /// Convert the value to a string /// </summary> /// <returns>The value as a string</returns> public override string ToString() { switch (Type) { case RegistryValueType.String: case RegistryValueType.ExpandString: case RegistryValueType.Link: return(Encoding.Unicode.GetString(Data).TrimEnd('\0')); case RegistryValueType.MultiString: return(string.Join(", ", NtObjectUtils.ParseMultiString(Data))); case RegistryValueType.Dword: return(BitConverter.ToUInt32(Data, 0).ToString()); case RegistryValueType.DwordBigEndian: return(BitConverter.ToUInt32(Data.Reverse().ToArray(), 0).ToString()); case RegistryValueType.Qword: return(BitConverter.ToUInt64(Data, 0).ToString()); default: return(Convert.ToBase64String(Data)); } }