internal static ValueKey Get(byte[] bytes, string path, string key, string val) { NamedKey hiveroot = Helper.GetRootKey(bytes, path); NamedKey nk = hiveroot; if (key != null) { foreach (string k in key.Split('\\')) { foreach (NamedKey n in nk.GetSubKeys(bytes)) { if (n.Name.ToUpper() == k.ToUpper()) { nk = n; } } } } ValueKey[] values = nk.GetValues(bytes); foreach (ValueKey v in values) { if (v.Name.ToUpper() == val.ToUpper()) { return(v); } } return(null); }
internal NetworkList(NamedKey nk, byte[] bytes) { WriteTime = nk.WriteTime; foreach (ValueKey vk in nk.GetValues(bytes)) { switch (vk.Name) { case "ProfileGuid": ProfileGuid = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "Description": Description = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "Source": Source = BitConverter.ToUInt32(vk.GetData(bytes), 0x00); break; case "DnsSuffix": DnsSuffix = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "FirstNetwork": FirstNetwork = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "DefaultGatewayMac": DefaultGatewayMac = new PhysicalAddress(vk.GetData(bytes)); break; default: break; } } }
internal AppCompat(NamedKey nk, byte[] bytes) { foreach(ValueKey vk in nk.GetValues(bytes)) { switch(vk.Name) { case "0": ProductName = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "1": CompanyName = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "6": FileSize = BitConverter.ToUInt32(vk.GetData(bytes), 0x00); break; case "c": Description = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "f": CompileTime = new DateTime(1970, 1, 1).AddSeconds(BitConverter.ToInt32(vk.GetData(bytes), 0x00)); break; case "11": ModifiedTime = DateTime.FromFileTimeUtc(BitConverter.ToInt64(vk.GetData(bytes), 0x00)); break; case "12": BornTime = DateTime.FromFileTimeUtc(BitConverter.ToInt64(vk.GetData(bytes), 0x00)); break; case "15": Path = Encoding.Unicode.GetString(vk.GetData(bytes)); break; case "17": ModifiedTime2 = DateTime.FromFileTimeUtc(BitConverter.ToInt64(vk.GetData(bytes), 0x00)); break; case "101": Hash = Encoding.Unicode.GetString(vk.GetData(bytes)).TrimStart('0'); break; default: break; } } }
internal static ValueKey[] GetInstances(byte[] bytes, string path, string key) { NamedKey hiveroot = Helper.GetRootKey(bytes, path); NamedKey nk = hiveroot; if (key != null) { foreach (string k in key.Split('\\')) { foreach (NamedKey n in nk.GetSubKeys(bytes)) { if (n.Name.ToUpper() == k.ToUpper()) { nk = n; } } } } return(nk.GetValues(bytes)); }
internal NamedKey[] GetSubKeys(byte[] bytes) { if (this.NumberOfSubKeys > 0) { byte[] subKeyListBytes = NativeMethods.GetSubArray(bytes, (uint)this.SubKeysListOffset, (uint)Math.Abs(BitConverter.ToInt32(bytes, this.SubKeysListOffset))); string type = Encoding.ASCII.GetString(subKeyListBytes, 0x04, 0x02); List list = List.Factory(bytes, subKeyListBytes, type); NamedKey[] nkArray = new NamedKey[list.Count]; for (int i = 0; i < list.Count; i++) { int size = Math.Abs(BitConverter.ToInt32(bytes, (int)list.Offset[i])); nkArray[i] = new NamedKey(NativeMethods.GetSubArray(bytes, (uint)list.Offset[i], (uint)size), this.HivePath); } return(nkArray); } else { return(null); } }
internal NamedKey[] GetSubKeys(byte[] bytes) { if (this.NumberOfSubKeys > 0) { byte[] subKeyListBytes = NativeMethods.GetSubArray(bytes, (uint)this.SubKeysListOffset, (uint)Math.Abs(BitConverter.ToInt32(bytes, this.SubKeysListOffset))); string type = Encoding.ASCII.GetString(subKeyListBytes, 0x04, 0x02); List list = List.Factory(bytes, subKeyListBytes, type); NamedKey[] nkArray = new NamedKey[list.Count]; for (int i = 0; i < list.Count; i++) { int size = Math.Abs(BitConverter.ToInt32(bytes, (int)list.Offset[i])); nkArray[i] = new NamedKey(NativeMethods.GetSubArray(bytes, (uint)list.Offset[i], (uint)size), this.HivePath); } return nkArray; } else { return null; } }