private string GetValue(RegistryCaptureBinaryValue value) { StringBuilder hexadecimalValue = new StringBuilder(); foreach (byte byteValue in value.Value) { hexadecimalValue.Append(byteValue.ToString("X2", CultureInfo.InvariantCulture.NumberFormat)); } return(hexadecimalValue.ToString()); }
private RegistryCaptureValue LoadValue(Match match, bool unicode, StreamReader reader, ref string line) { RegistryCaptureValue registryValue = null; string name = match.Groups["Name"].Value; string value = match.Groups["Value"].Value; if ((match = m_stringValueRegex.Match(value)).Success) { // Unescape. value = Regex.Replace(match.Groups["Value"].Value, @"\\(.)", "$1"); registryValue = new RegistryCaptureStringValue(name, value); } else if ((match = m_dwordValueRegex.Match(value)).Success) { int dwordValue = System.Convert.ToInt32(match.Groups["Value"].Value, 16); registryValue = new RegistryCaptureDWordValue(name, dwordValue); } else if ((match = m_binaryValueRegex.Match(value)).Success) { byte[] bytes = null; GetBytes(match, ref bytes, reader, ref line); registryValue = new RegistryCaptureBinaryValue(name, bytes); } else if ((match = m_expandableValueRegex.Match(value)).Success) { byte[] bytes = null; GetBytes(match, ref bytes, reader, ref line); Encoding encoding = unicode ? Encoding.Unicode : Encoding.ASCII; registryValue = new RegistryCaptureExpandStringValue(name, encoding.GetString(bytes)); } else if ((match = m_multiStringValueRegex.Match(value)).Success) { byte[] bytes = null; GetBytes(match, ref bytes, reader, ref line); Encoding encoding = unicode ? Encoding.Unicode : Encoding.ASCII; string[] strings = encoding.GetString(bytes).Split('\0'); // Remove any empty strings from the end. LinkedList <string> stringList = new LinkedList <string>(strings); LinkedListNode <string> node = stringList.Last; while (node != null) { if (!string.IsNullOrEmpty(node.Value)) { break; } stringList.Remove(node); node = stringList.Last; } strings = new string[stringList.Count]; stringList.CopyTo(strings, 0); registryValue = new RegistryCaptureMultiStringValue(name, strings); } line = reader.ReadLine(); return(registryValue); }