/// <summary> /// Gets the recent entries of commands issued in the run bar /// </summary> /// <returns>The recent entries</returns> public List <RunBarEntry> GetRecentlRunBarEntries() { List <RunBarEntry> recentRunEntries = new List <RunBarEntry>(); try { RegistryKey runHistoryRegistryKey = Registry.CurrentUser.OpenSubKey(_RECENTLY_RUN_PATH); string[] runEntries = runHistoryRegistryKey.GetValueNames(); foreach (string runEntry in runEntries) { RunBarEntry rbe = new RunBarEntry(); rbe.Name = runEntry; rbe.Value = runHistoryRegistryKey.GetValue(runEntry).ToString(); // FIX This is missleading. All run bar entries will have the same last write date because all of the data is associated with the same subkey rbe.LastWrite = RegQueryInformationHelper.GetLastWritten(runHistoryRegistryKey); recentRunEntries.Add(rbe); } } catch (Exception exc) { MyDebugger.Instance.LogMessage(exc, DebugVerbocity.Exception); } MyDebugger.Instance.LogMessage($"Loaded {recentRunEntries.Count} recently run entries.", DebugVerbocity.Informational); return(recentRunEntries); }
/// <summary> /// Gets a list of installed programs /// </summary> /// <returns>The list of installed programs</returns> public List <InstalledProgram> GetInstalledPrograms() { List <InstalledProgram> installedPrograms = new List <InstalledProgram>(); try { RegistryKey installedRegistryPath = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_PATH); RegistryKey userSpecificInstalledRegistryPath = Registry.CurrentUser.OpenSubKey(_INSTALLED_PROGRAMS_PATH); RegistryKey installedx86RegistryPath = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_x86_KEY_PATH); string[] machineSpecificInstalledIds = installedRegistryPath.GetSubKeyNames(); string[] userSpecificInstalledIds = userSpecificInstalledRegistryPath.GetSubKeyNames(); string[] installedx86RegistryIds = installedx86RegistryPath.GetSubKeyNames(); foreach (string id in machineSpecificInstalledIds) { RegistryKey installedProgramRegEntry = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_PATH + "\\" + id); InstalledProgram ip = ParseInstalledProgramFromKey(installedProgramRegEntry, id); if (ip.InstallDate == DateTime.MinValue) { ip.InstallDate = RegQueryInformationHelper.GetLastWritten(installedProgramRegEntry); } if (!installedPrograms.Contains(ip)) { installedPrograms.Add(ip); } } foreach (string id in userSpecificInstalledIds) { RegistryKey installedProgramRegEntry = Registry.CurrentUser.OpenSubKey(_INSTALLED_PROGRAMS_PATH + "\\" + id); InstalledProgram ip = ParseInstalledProgramFromKey(installedProgramRegEntry, id); if (ip.InstallDate == DateTime.MinValue) { ip.InstallDate = RegQueryInformationHelper.GetLastWritten(installedProgramRegEntry); } if (!installedPrograms.Contains(ip)) { installedPrograms.Add(ip); } } foreach (string id in installedx86RegistryIds) { RegistryKey installedProgramRegEntry = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_x86_KEY_PATH + "\\" + id); InstalledProgram ip = ParseInstalledProgramFromKey(installedProgramRegEntry, id); if (ip.InstallDate == DateTime.MinValue) { ip.InstallDate = RegQueryInformationHelper.GetLastWritten(installedProgramRegEntry); } if (!installedPrograms.Contains(ip)) { installedPrograms.Add(ip); } } } catch (Exception exc) { MyDebugger.Instance.LogMessage(exc, DebugVerbocity.Exception); } return(installedPrograms); }
/// <summary> /// Gets a list of usb device history entries /// </summary> /// <returns>The list of usb device history entries</returns> public List <USBDeviceHistoryEntry> GetUSBDeviceHistory() { List <USBDeviceHistoryEntry> history = new List <USBDeviceHistoryEntry>(); try { RegistryKey usbstoreKey = Registry.LocalMachine.OpenSubKey(_USBSTOR_REG_KEY); RegistryKey usbKey = Registry.LocalMachine.OpenSubKey(_USB_REG_KEY); foreach (RegistryKey regKey in new RegistryKey[] { usbstoreKey, usbKey }) { foreach (string classKeyName in regKey.GetSubKeyNames()) { RegistryKey classKey = regKey.OpenSubKey(classKeyName); foreach (string instanceKeyName in classKey.GetSubKeyNames()) { RegistryKey instanceKey = classKey.OpenSubKey(instanceKeyName); USBDeviceHistoryEntry entry = new USBDeviceHistoryEntry(); entry.DeviceId = instanceKeyName; object description = instanceKey.GetValue("DeviceDesc"); object name = instanceKey.GetValue("FriendlyName"); entry.DeviceDescription = "Unknown"; entry.DeviceName = "Unknown"; if (description != null) { string dsc = description.ToString(); if (dsc.Contains(';')) { dsc = dsc.Split(';')[1]; } entry.DeviceName = dsc; entry.DeviceDescription = dsc; } if (name != null && name != "") { entry.DeviceName = name.ToString(); } entry.LastSeen = RegQueryInformationHelper.GetLastWritten(instanceKey); if (!history.Contains(entry)) { history.Add(entry); } } } } RegistryKey rki = Registry.LocalMachine.OpenSubKey(_MOUNTED_DEVICES_KEY); string[] names = rki.GetValueNames(); foreach (string name in names) { if (name.Contains("DosDevices")) { object ray = rki.GetValue(name, RegistryValueKind.Binary); string vaks = System.Text.Encoding.Unicode.GetString((byte[])ray); string[] info = vaks.Split('#'); foreach (USBDeviceHistoryEntry entry in history) { if (info.Length > 2 && entry.DeviceId == info[2]) { entry.HasMountPoint = true; entry.MountPoint = name.Split('\\')[2]; } } } } } catch (Exception exc) { MyDebugger.Instance.LogMessage(exc, DebugVerbocity.Exception); } return(history); }