public static byte[] processModificationRequest(Command command) { RegistryRequest request = (RegistryRequest)Util.Serialization.deserialize(command.data); bool success = false; String errMessage = null; if (RegistryIndex.data.ContainsKey((RegistryHive)request.hive)) { RegistryKeyData entry = Util.Metadata.Find(RegistryIndex.data[(RegistryHive)request.hive], request.data); if (entry != null) { try { entry.value.SetValue(request.newValue.name, request.newValue.value); success = true; } catch (Exception e) { errMessage = e.Message; } } else { errMessage = "Error with internal storage of registry client-side"; } } return(Util.Serialization.serialize(new RegistryResponse { error = (success) ? "Success!" : (errMessage == null) ? "Unknown error!" : errMessage, keyData = null })); }
public static RegistryKeyData buildDataFromKey(int loopCounter, RegistryHive hive, RegistryKey key, bool root, RegistryKeyData parent) { String[] values = key.GetValueNames(); RegistryValue[] valueData = new RegistryValue[values.Length]; for (int i = 0; i < valueData.Length; i++) { valueData[i] = new RegistryValue { name = values[i], value = key.GetValue(values[i]) }; } RegistryKeyData value = new RegistryKeyData { data = new RegistryKeyData[key.GetSubKeyNames().Length], key = key.Name, values = valueData, hive = hive, value = key }; if (root) { if (!data.ContainsKey(hive)) { data.Add(hive, value); } } else { parent.data[loopCounter] = value; } return(value); }
public static void index(RegistryHive hive, RegistryView view) { if (RegistryIndex.data == null) { RegistryIndex.data = new Dictionary <RegistryHive, RegistryKeyData>(); } RegistryKey root = RegistryKey.OpenBaseKey(hive, view); RegistryKeyData data = buildDataFromKey(-1, hive, root, true, null); processChildren(hive, data); }
public static void processChildren(RegistryHive hive, RegistryKeyData key) { int loopCounter = 0; foreach (String subKey in key.value.GetSubKeyNames()) { try { processChildren(hive, buildDataFromKey(loopCounter, hive, key.value.OpenSubKey(subKey), false, key)); } catch { } loopCounter++; } }
public static RegistryKeyData Find(RegistryKeyData node, RegistryKeyData entry) { if (node == null) { return(null); } if (node.Equals(entry)) { return(node); } foreach (RegistryKeyData child in node.data) { RegistryKeyData found = Find(child, entry); if (found != null) { return(found); } } return(null); }
private static List <RegistryEntry> GetRegistryEntries(string rootKey, RegistryKey hive) { RegistryKey key; List <RegistryEntry> entries = new List <RegistryEntry>(); key = hive.OpenSubKey(rootKey); if (key == null) { return(new List <RegistryEntry>()); } if (key != null && key.SubKeyCount > 1) { foreach (var k in key.GetSubKeyNames()) { string rootKeyLocation = Regex.Replace(key.Name, hive.Name + @"\\", ""); RegistryKey subkey = hive.OpenSubKey(rootKeyLocation + "\\" + k); entries.AddRange(GetRegistryEntries(rootKeyLocation + "\\" + k, hive)); } } foreach (var valueName in key.GetValueNames()) { var rawValue = key.GetValue(valueName, "", RegistryValueOptions.DoNotExpandEnvironmentNames); RegistryKeyData keyValue = null; RegistryValueKind kvk = key.GetValueKind(valueName); switch (kvk) { case RegistryValueKind.String: keyValue = new SZRegistryKey(rawValue); break; case RegistryValueKind.DWord: keyValue = new DwordRegistryKey(rawValue); break; case RegistryValueKind.ExpandString: keyValue = new EXSZRegistryKey(rawValue); break; case RegistryValueKind.MultiString: keyValue = new MultiSZRegistryKey(rawValue); break; case RegistryValueKind.QWord: object keyValue3 = key.GetValue(valueName); keyValue = new QwordRegistryKey(rawValue); break; case RegistryValueKind.Binary: byte[] binary = (byte[])rawValue; var hexstring = ConvertUtility.ByteToHexString(binary); keyValue = new BinaryRegistryKey(hexstring); break; case RegistryValueKind.Unknown: case RegistryValueKind.None: keyValue = new SZRegistryKey(string.Empty); break; default: keyValue = new SZRegistryKey(string.Empty); break; } entries.Add(new RegistryEntry() { Name = valueName, Data = keyValue, Type = key.GetValueKind(valueName), FullPath = key.Name + "\\" + valueName, Location = key.Name }); } return(entries); }