public static RegChange ReadFromStream(Stream fs) { RegChange tempReg = new RegChange(); bool isBinaryString = false; byte bType = (byte)fs.ReadByte(); //read until the end byte is detected while (!ReadFiles.ReachedEndByte(fs, bType, 0x9E)) { switch (bType) { case 0x01: //RegOperation tempReg.RegOperation = (RegOperations)ReadFiles.ReadInt(fs); break; case 0x02: //load basekey tempReg.RegBasekey = (RegBasekeys)ReadFiles.ReadInt(fs); break; case 0x03: //load valuekind tempReg.RegValueKind = (RegistryValueKind)ReadFiles.ReadInt(fs); break; case 0x04: //subkey tempReg.SubKey = ReadFiles.ReadDeprecatedString(fs); break; case 0x05: //value name tempReg.ValueName = ReadFiles.ReadDeprecatedString(fs); break; case 0x06: //Depreciated: Use 0x07. All 0x06 will be converted to a string "ValueKind" if (tempReg.RegValueKind != RegistryValueKind.ExpandString && tempReg.RegValueKind != RegistryValueKind.String) { //Read in the entry,if it's tempReg.RegValueKind = RegistryValueKind.String; } tempReg.ValueData = ReadFiles.ReadDeprecatedString(fs); break; case 0x80: isBinaryString = true; break; case 0x81: tempReg.Is32BitKey = true; break; case 0x07: //Value data switch (tempReg.RegValueKind) { case RegistryValueKind.Binary: if (isBinaryString) { tempReg.ValueData = ReadFiles.ReadDeprecatedString(fs); } else { tempReg.ValueData = ReadFiles.ReadByteArray(fs); } break; case RegistryValueKind.DWord: tempReg.ValueData = ReadFiles.ReadInt(fs); break; case RegistryValueKind.QWord: tempReg.ValueData = ReadFiles.ReadLong(fs); break; case RegistryValueKind.ExpandString: case RegistryValueKind.MultiString: case RegistryValueKind.String: tempReg.ValueData = ReadFiles.ReadDeprecatedString(fs); break; } break; default: ReadFiles.SkipField(fs, bType); break; } bType = (byte)fs.ReadByte(); } return(tempReg); }