Пример #1
0
        public static byte[] processModificationRequest(Command command)
        {
            RegistryRequest request    = (RegistryRequest)Util.Serialization.deserialize(command.data);
            bool            success    = false;
            String          errMessage = null;

            if (RegistryIndex.data.ContainsKey((RegistryHive)request.hive))
            {
                RegistryKeyData entry = Util.Metadata.Find(RegistryIndex.data[(RegistryHive)request.hive], request.data);
                if (entry != null)
                {
                    try
                    {
                        entry.value.SetValue(request.newValue.name, request.newValue.value);
                        success = true;
                    }
                    catch (Exception e)
                    {
                        errMessage = e.Message;
                    }
                }
                else
                {
                    errMessage = "Error with internal storage of registry client-side";
                }
            }
            return(Util.Serialization.serialize(new RegistryResponse
            {
                error = (success) ? "Success!" : (errMessage == null) ? "Unknown error!" : errMessage,
                keyData = null
            }));
        }
Пример #2
0
        public static RegistryKeyData buildDataFromKey(int loopCounter, RegistryHive hive, RegistryKey key, bool root, RegistryKeyData parent)
        {
            String[]        values    = key.GetValueNames();
            RegistryValue[] valueData = new RegistryValue[values.Length];
            for (int i = 0; i < valueData.Length; i++)
            {
                valueData[i] = new RegistryValue
                {
                    name  = values[i],
                    value = key.GetValue(values[i])
                };
            }
            RegistryKeyData value = new RegistryKeyData
            {
                data   = new RegistryKeyData[key.GetSubKeyNames().Length],
                key    = key.Name,
                values = valueData,
                hive   = hive,
                value  = key
            };

            if (root)
            {
                if (!data.ContainsKey(hive))
                {
                    data.Add(hive, value);
                }
            }
            else
            {
                parent.data[loopCounter] = value;
            }
            return(value);
        }
Пример #3
0
        public static void index(RegistryHive hive, RegistryView view)
        {
            if (RegistryIndex.data == null)
            {
                RegistryIndex.data = new Dictionary <RegistryHive, RegistryKeyData>();
            }
            RegistryKey     root = RegistryKey.OpenBaseKey(hive, view);
            RegistryKeyData data = buildDataFromKey(-1, hive, root, true, null);

            processChildren(hive, data);
        }
Пример #4
0
        public static void processChildren(RegistryHive hive, RegistryKeyData key)
        {
            int loopCounter = 0;

            foreach (String subKey in key.value.GetSubKeyNames())
            {
                try
                {
                    processChildren(hive, buildDataFromKey(loopCounter, hive, key.value.OpenSubKey(subKey), false, key));
                }
                catch { }
                loopCounter++;
            }
        }
Пример #5
0
            public static RegistryKeyData Find(RegistryKeyData node, RegistryKeyData entry)
            {
                if (node == null)
                {
                    return(null);
                }

                if (node.Equals(entry))
                {
                    return(node);
                }

                foreach (RegistryKeyData child in node.data)
                {
                    RegistryKeyData found = Find(child, entry);
                    if (found != null)
                    {
                        return(found);
                    }
                }

                return(null);
            }
        private static List <RegistryEntry> GetRegistryEntries(string rootKey, RegistryKey hive)
        {
            RegistryKey          key;
            List <RegistryEntry> entries = new List <RegistryEntry>();

            key = hive.OpenSubKey(rootKey);
            if (key == null)
            {
                return(new List <RegistryEntry>());
            }
            if (key != null && key.SubKeyCount > 1)
            {
                foreach (var k in key.GetSubKeyNames())
                {
                    string      rootKeyLocation = Regex.Replace(key.Name, hive.Name + @"\\", "");
                    RegistryKey subkey          = hive.OpenSubKey(rootKeyLocation + "\\" + k);
                    entries.AddRange(GetRegistryEntries(rootKeyLocation + "\\" + k, hive));
                }
            }

            foreach (var valueName in key.GetValueNames())
            {
                var               rawValue = key.GetValue(valueName, "", RegistryValueOptions.DoNotExpandEnvironmentNames);
                RegistryKeyData   keyValue = null;
                RegistryValueKind kvk      = key.GetValueKind(valueName);

                switch (kvk)
                {
                case RegistryValueKind.String:
                    keyValue = new SZRegistryKey(rawValue);
                    break;

                case RegistryValueKind.DWord:
                    keyValue = new DwordRegistryKey(rawValue);
                    break;

                case RegistryValueKind.ExpandString:
                    keyValue = new EXSZRegistryKey(rawValue);
                    break;

                case RegistryValueKind.MultiString:
                    keyValue = new MultiSZRegistryKey(rawValue);
                    break;

                case RegistryValueKind.QWord:
                    object keyValue3 = key.GetValue(valueName);
                    keyValue = new QwordRegistryKey(rawValue);
                    break;

                case RegistryValueKind.Binary:
                    byte[] binary    = (byte[])rawValue;
                    var    hexstring = ConvertUtility.ByteToHexString(binary);
                    keyValue = new BinaryRegistryKey(hexstring);
                    break;

                case RegistryValueKind.Unknown:
                case RegistryValueKind.None:
                    keyValue = new SZRegistryKey(string.Empty);
                    break;

                default:
                    keyValue = new SZRegistryKey(string.Empty);
                    break;
                }

                entries.Add(new RegistryEntry()
                {
                    Name     = valueName,
                    Data     = keyValue,
                    Type     = key.GetValueKind(valueName),
                    FullPath = key.Name + "\\" + valueName,
                    Location = key.Name
                });
            }

            return(entries);
        }