public void ShellItemRegistryDecoratorTest() { var shellItem = new MockShellItem("Test", 0x99); var regKey = new RegistryKeyWrapper(null, "testUser", "testPath"); int existingPropCount = shellItem.GetAllProperties().Count; //test injection of additional properties var regShellItem = new RegistryShellItemDecorator(shellItem, regKey); Assert.IsTrue(regShellItem.GetAllProperties().Count > existingPropCount); }
/// <summary> /// Identifies and gathers ShellBag items from raw binary registry data. /// </summary> /// <returns>a list of different variety ShellBag items</returns> public static List <IShellItem> GetShellItems(IRegistryReader registryReader) { List <IShellItem> shellItems = new List <IShellItem>(); Dictionary <RegistryKeyWrapper, IShellItem> keyShellMappings = new Dictionary <RegistryKeyWrapper, IShellItem>(); foreach (RegistryKeyWrapper keyWrapper in registryReader.GetRegistryKeys()) { if (keyWrapper.Value != null) // Some Registry Keys are null { ShellItemList shellItemList = new ShellItemList(keyWrapper.Value); foreach (IShellItem shellItem in shellItemList.Items()) { IShellItem parentShellItem = null; //obtain the parent shellitem from the parent registry key (if it exists) if (keyWrapper.Parent != null) { if (keyShellMappings.TryGetValue(keyWrapper.Parent, out IShellItem pShellItem)) { parentShellItem = pShellItem; } } RegistryShellItemDecorator decoratedShellItem = new RegistryShellItemDecorator(shellItem, keyWrapper, parentShellItem); try { keyShellMappings.Add(keyWrapper, decoratedShellItem); } catch (ArgumentException ex) { //*should* never happen, if it does Absolute Path finding need to be reworked. Potentially should be a fatal exception // as now the shellbags involved are misleading. (contain incomplete data) logger.Error(ex, $"Registry Item {keyWrapper.RegistryPath} already had an associated Shellbag ({keyShellMappings[keyWrapper].Name}), Absolute Path's are no longer accurate."); } shellItems.Add(decoratedShellItem); } } } return(shellItems); }