/// <summary> /// Recursively makes a snapshot of a key and its subkeys. /// </summary> /// <param name="currentKey">The key to snapshot next</param> /// <param name="view">The view currently used (Win64 or Win32)</param> /// <param name="results">The result object to fill out</param> private static void DoRegistrySnapshotKey(RegistryKey currentKey, RegistryView view, LinkedList <SnapshotRegistryItem> results) { // Values string[] valueKeys = currentKey.GetValueNames(); foreach (string key in valueKeys) { SnapshotRegistryValue item = new SnapshotRegistryValue(); item.FullPath = RemoveHive(currentKey.Name + "\\" + key); item.RegistryView = view; try { item.RegistryKeyType = currentKey.GetValueKind(key); item.Value = ValueToString(item.RegistryKeyType, currentKey.GetValue(key)); item.WasReadable = true; } catch (Exception) { item.WasReadable = false; } results.AddLast(item); } // Subkeys string[] subKeys = currentKey.GetSubKeyNames(); foreach (string subKey in subKeys) { SnapshotRegistryKey item = new SnapshotRegistryKey(); item.FullPath = RemoveHive(currentKey.Name + "\\" + subKey); item.RegistryView = view; item.WasReadable = false; try { using (RegistryKey sub = currentKey.OpenSubKey(subKey)) { try { DoRegistrySnapshotKey(sub, view, results); } catch (Exception) { // Set item.WasReadable without taking subkeys exceptions into account } } item.WasReadable = true; } catch (Exception) { item.WasReadable = false; } results.AddLast(item); } }
/// <summary> /// Recursively makes a snapshot of a key and its subkeys. /// </summary> /// <param name="currentKey">The key to snapshot next</param> /// <param name="view">The view currently used (Win64 or Win32)</param> /// <param name="results">The result object to fill out</param> private static void DoRegistrySnapshotKey(RegistryKey currentKey, RegistryView view, LinkedList<SnapshotRegistryItem> results) { // Values string[] valueKeys = currentKey.GetValueNames(); foreach (string key in valueKeys) { SnapshotRegistryValue item = new SnapshotRegistryValue(); item.FullPath = RemoveHive(currentKey.Name + "\\" + key); item.RegistryView = view; try { item.RegistryKeyType = currentKey.GetValueKind(key); item.Value = ValueToString(item.RegistryKeyType, currentKey.GetValue(key)); item.WasReadable = true; } catch (Exception) { item.WasReadable = false; } results.AddLast(item); } // Subkeys string[] subKeys = currentKey.GetSubKeyNames(); foreach (string subKey in subKeys) { SnapshotRegistryKey item = new SnapshotRegistryKey(); item.FullPath = RemoveHive(currentKey.Name + "\\" + subKey); item.RegistryView = view; item.WasReadable = false; try { using (RegistryKey sub = currentKey.OpenSubKey(subKey)) { try { DoRegistrySnapshotKey(sub, view, results); } catch (Exception) { // Set item.WasReadable without taking subkeys exceptions into account } } item.WasReadable = true; } catch (Exception) { item.WasReadable = false; } results.AddLast(item); } }