public string GetValue(int lcid = 1033)
{
RegistryValueKind kind = ValueKind;
switch (kind)
{
case RegistryValueKind.DWord:
case RegistryValueKind.QWord:
return(ShiftHexValue(String.Format("{0:x4}", Value)) + " (" + Convert.ToString(Value) + ")");
case RegistryValueKind.Binary:
return(ByteArrayToBinaryString((Value as byte[])).ToLower());
case RegistryValueKind.ExpandString:
case RegistryValueKind.MultiString:
case RegistryValueKind.String:
case RegistryValueKind.Unknown:
if (_type == UtilsRegistryEntryType.Faked)
{
return(lcid == 1033 ? "(Value not set)" : "(Wert nicht gesetzt)");
}
else if ((_type == UtilsRegistryEntryType.Default) && (null == Value))
{
return(lcid == 1033 ? "(Value not set)" : "(Wert nicht gesetzt)");
}
return(Value as string);
default:
throw new ArgumentException(kind.ToString() + " is out of range");
}
}
public String ReadValue(string valueName)
{
RegistryKey sk1 = _baseRegistryKey.OpenSubKey(_subKey);
if (sk1 != null)
{
try
{
string retVal = "";
RegistryValueKind rvk = sk1.GetValueKind(valueName);
switch (rvk.ToString().ToUpper())
{
case "BINARY": retVal = "binary data"; break;
default: retVal = sk1.GetValue(valueName).ToString(); break;
}
return(retVal);
}
catch (Exception)
{
return(null);
}
}
else
{
return(null);
}
}
private void KeysTreeView_AfterSelect(object sender, TreeViewEventArgs e)
{
valuesListView.Clear();
valuesListView.Columns.Add("N");
valuesListView.Columns.Add("Values");
valuesListView.Columns.Add("Type");
try
{
string regKeyName = e.Node.FullPath.Replace(currentUserPath, "");
RegistryKey regSubKey = currentUserKey.OpenSubKey(regKeyName);
string[] valuesStr = regSubKey.GetValueNames();
int i = 0;
foreach (string str in valuesStr)
{
RegistryValueKind kind = regSubKey.GetValueKind(str);
ListViewItem item = valuesListView.Items.Add(i++.ToString());
item.SubItems.Add(str);
item.SubItems.Add(kind.ToString());
}
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
valuesListView.Columns[0].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
valuesListView.Columns[1].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
valuesListView.Columns[2].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
}
private async void treeView1_AfterSelect(object sender, TreeViewEventArgs e)
{
listView1.Items.Clear();
toolStripStatusLabel1.Text = e.Node.FullPath;
TreeNode node = e.Node;
if (node.Tag is RegistryKey)
{
RegistryKey selectedKey = node.Tag as RegistryKey;
string[] names = selectedKey.GetValueNames();
foreach (string str in names)
{
try
{
ListViewItem item = null;
if (string.IsNullOrEmpty(str))
{
item = new ListViewItem("(По умолчанию)");
}
else
{
item = new ListViewItem(str);
}
RegistryValueKind valueKind = selectedKey.GetValueKind(str);
item.SubItems.Add(valueKind.ToString());
object keyValue = selectedKey.GetValue(str);
string stringValue = "";
if (keyValue == null || string.IsNullOrEmpty(keyValue.ToString()))
{
stringValue = "(значение не присвоено)";
}
else
if (valueKind == RegistryValueKind.Binary)
{
byte[] buff = (byte[])keyValue;
string temp = "";
foreach (byte elem in buff)
{
temp += $"{elem:X4}";
}
stringValue = temp;
}
else
{
stringValue = keyValue.ToString();
}
item.SubItems.Add(stringValue);
listView1.Items.Add(item);
}
catch { }
}
if (e.Node.FullPath.Contains(@"\"))
{
node.Nodes.Clear();
await Task.Run(() => AddNodes(node, selectedKey, 0));
}
}
}
public UtilsRegistryEntry Add(RegistryValueKind kind, object value)
{
RegistryKey key = _parent.Open(true);
string[] names = key.GetValueNames();
string name = GetNewStringValueName(names, kind.ToString());
key.SetValue(name, value, kind);
key.Close();
return new UtilsRegistryEntry(_parent, name);
}
public virtual UtilsRegistryEntry Add(RegistryValueKind kind, object value)
{
RegistryKey key = _parent.Open(true);
string[] names = key.GetValueNames();
string name = GetNewStringValueName(names, kind.ToString());
key.SetValue(name, value, kind);
key.Close();
return(new UtilsRegistryEntry(_parent, name));
}
// Token: 0x06000223 RID: 547 RVA: 0x00009F94 File Offset: 0x00008194
internal static object ParseRegistryValue(RegistryValueKind valueType, IntPtr value, int valueSize)
{
switch (valueType)
{
case RegistryValueKind.String:
return(Marshal.PtrToStringUni(value));
case RegistryValueKind.ExpandString:
case (RegistryValueKind)5:
case (RegistryValueKind)6:
break;
case RegistryValueKind.Binary:
{
byte[] array = new byte[valueSize];
Marshal.Copy(value, array, 0, valueSize);
return(array);
}
case RegistryValueKind.DWord:
return(Marshal.ReadInt32(value));
case RegistryValueKind.MultiString:
{
List <string> list = new List <string>(4);
int i = 0;
int num = 0;
while (i < valueSize)
{
IntPtr ptr = new IntPtr(value.ToInt64() + (long)i);
string text = Marshal.PtrToStringUni(ptr);
list.Add(text);
i += (text.Length + 1) * 2;
num++;
}
return(list.ToArray());
}
default:
if (valueType == RegistryValueKind.QWord)
{
return(Marshal.ReadInt64(value));
}
break;
}
throw new ClusterUnsupportedRegistryTypeException(valueType.ToString());
}
//Sets the data of the value nametofind, with type type.
public void setValue(RegistryKey parentKey, string nametofind, object data, RegistryValueKind type)
{
log("Setting up data [" + data.ToString() + "] with name <" + type.ToString() + "::" + nametofind + "> under key " + parentKey.Name + ".");
try
{
parentKey.SetValue(nametofind, data, type);
logsub("Success...");
}
catch (ArgumentNullException w)
{
logsub("Data to set is null.");
throw (w);
}
catch (ArgumentException w)
{
logsub("Value name is too long.");
throw (w);
}
catch (ObjectDisposedException w)
{
logsub("Key is closed so it can't be accessed.");
throw (w);
}
catch (SecurityException w)
{
logsub("User has not enough privileges to access this key.");
throw (w);
}
catch (UnauthorizedAccessException w)
{
logsub("The key cannot be written.Maybe it has been open as read-only.");
throw (w);
}
catch (IOException w)
{
///check http://msdn.microsoft.com/en-us/library/k23f0345.aspx
logsub("The key is a root-level node, and you're nobody to do this(kidding). This operation is not permitted in your O.S so I throw this error.");
throw (w);
}
}
public static string AsRegistryValueTypeString(this RegistryValueKind valueKind)
{
switch (valueKind)
{
case RegistryValueKind.DWord:
return("REG_DWORD");
case RegistryValueKind.ExpandString:
return("REG_EXPAND_SZ");
case RegistryValueKind.MultiString:
return("REG_MULTI_SZ");
case RegistryValueKind.String:
return("REG_SZ");
case RegistryValueKind.QWord:
return("REG_QWORD");
default:
return(valueKind.ToString());
}
}
public override void RunTask()
{
if (parseRegKeyNameTypeValue(System.Environment.ExpandEnvironmentVariables(data)))
{
RegistryKey rk = Registry.LocalMachine;
if (hive == "HKCU")
{
rk = Microsoft.Win32.Registry.CurrentUser;
}
if (hive == "HKCC")
{
rk = Microsoft.Win32.Registry.CurrentConfig;
}
if (hive == "HKLM")
{
rk = Microsoft.Win32.Registry.LocalMachine;
}
foreach (string key in keyPathArray)
{
rk = rk.CreateSubKey(key, RegistryKeyPermissionCheck.ReadWriteSubTree);
}
rk.SetValue(name, value, regValueKind);
Console.WriteLine("Created registry key: '{0}' name: '{1}' value: '{2}' of type: '{3}'",
hive + "\\" + keyPath,
name,
value.ToString(),
regValueKind.ToString());
}
else
{
Console.WriteLine("Unable to write registry key.");
}
}
public Value(string name, RegistryValueKind kind, object value)
{
Name = name;
DataType = kind.ToString();
Data = GetValue(kind, value);
}
public static RegistryValueKind GetRegistryValueKind(ILogger logger, string regKey, string regValue)
{
RegistryKey registryKey = GetRegistryKey(logger, regKey, true);
RegistryValueKind registryValueKind = registryKey.GetValueKind(regValue);
logger.LogDebug(string.Format("Registry value {0}/{1} has kind {2}", regKey, regValue, registryValueKind.ToString()));
return(registryValueKind);
}
// Token: 0x06000539 RID: 1337 RVA: 0x00013B08 File Offset: 0x00011D08
private object ParseRegistryValue(RegistryValueKind valueType, IntPtr value, int valueSize)
{
switch (valueType)
{
case RegistryValueKind.String:
return(Marshal.PtrToStringUni(value));
case RegistryValueKind.ExpandString:
case (RegistryValueKind)5:
case (RegistryValueKind)6:
break;
case RegistryValueKind.Binary:
{
byte[] array = new byte[valueSize];
Marshal.Copy(value, array, 0, valueSize);
return(array);
}
case RegistryValueKind.DWord:
return(Marshal.ReadInt32(value));
case RegistryValueKind.MultiString:
return(ClusdbMarshalledProperty.FromIntPtrToStringArray(value, valueSize));
default:
if (valueType == RegistryValueKind.QWord)
{
return(Marshal.ReadInt64(value));
}
break;
}
throw new ClusterApiException("ParseRegistryValue", new ClusterUnsupportedRegistryTypeException(valueType.ToString()));
}
public static void SetValue(string keyName, string valueName, object value, RegistryValueKind valueKind)
{
Logger.ComAddIn.Verbose("RegistrationUtil.SetValue({0}, {1}, {2}, {3})", keyName, valueName, value.ToString(), valueKind.ToString());
Registry.SetValue(keyName, valueName, value, valueKind);
}
public static void KeySetValue(RegistryKey key, string name, object value, RegistryValueKind valueKind)
{
Logger.ComAddIn.Verbose("RegistrationUtil.KeySetValue({0}, {1}, {2}, {3})", key.Name, name, value.ToString(), valueKind.ToString());
key.SetValue(name, value, valueKind);
}
public static string GetRegistryValueAsString(string path, string valueName, RegistryValueKind typeName, object defaultValue)
{
RegistryKey hive = null;
RegistryKey key = null;
object value = null;
try
{
path = path.Trim().ToUpper();
if (path.StartsWith(@"HKEY_LOCAL_MACHINE\"))
{
hive = Registry.LocalMachine;
path = path.Substring(19);
}
else if (path.StartsWith(@"HKLM\"))
{
hive = Registry.LocalMachine;
path = path.Substring(5);
}
else if (path.StartsWith(@"HKEY_CURRENT_USER\"))
{
hive = Registry.CurrentUser;
path = path.Substring(18);
}
else if (path.StartsWith(@"HKCU\"))
{
hive = Registry.CurrentUser;
path = path.Substring(5);
}
else if (path.StartsWith(@"HKEY_CLASSES_ROOT\"))
{
hive = Registry.ClassesRoot;
path = path.Substring(18);
}
else if (path.StartsWith(@"HKEY_CURRENT_CONFIG\"))
{
hive = Registry.CurrentConfig;
path = path.Substring(20);
}
else if (path == "")
{
return("Bad Rule: Unknown hive prefix or no subkey specified");
}
if (path == "")
{
return("Bad Rule: No subkey specified.");
}
key = hive.OpenSubKey(path, RegistryKeyPermissionCheck.ReadSubTree,
System.Security.AccessControl.RegistryRights.ReadPermissions |
System.Security.AccessControl.RegistryRights.ReadKey |
System.Security.AccessControl.RegistryRights.EnumerateSubKeys |
System.Security.AccessControl.RegistryRights.QueryValues);
if (key == null)
{
return(defaultValue == null ? "" : defaultValue.ToString());
}
value = key.GetValue(valueName);
if (value == null)
{
return(defaultValue == null ? "" : defaultValue.ToString());
}
if (key.GetValueKind(valueName) == typeName)
{
if (typeName == RegistryValueKind.MultiString)
{
return(string.Join(", ", (string[])value));
}
return(value.ToString());
}
else
{
return($"{valueName} is of type {key.GetValueKind(valueName).ToString()} instead of type {typeName.ToString()}.");
}
}
finally
{
if (key != null)
{
key.Close();
}
if (hive != null)
{
hive.Close();
}
}
}
public static bool CreateXML(RegistryKey rk, string settingsName, bool withFingerprint, string fingerprintName)
{
XmlWriterSettings xmlSettings = new XmlWriterSettings();
xmlSettings.Indent = true;
xmlSettings.IndentChars = " ";
try
{
XmlWriter xmlWriter = XmlWriter.Create(Directory.GetCurrentDirectory() + @"\" + settingsName + ".xml", xmlSettings);
xmlWriter.WriteStartDocument();
xmlWriter.WriteStartElement("PuttyExport");
xmlWriter.WriteStartElement("Settings");
foreach (var value in rk.GetValueNames())
{
RegistryValueKind rvk = rk.GetValueKind(value);
Console.WriteLine(value + " | " + rvk.ToString() + " | " + rk.GetValue(value).ToString());
// xmlWriter.WriteElementString(value, rk.GetValue(value).ToString());
xmlWriter.WriteStartElement(value);
xmlWriter.WriteAttributeString("type", rvk.ToString());
if (value == "ProxyUsername" || value == "ProxyPassword")
{
xmlWriter.WriteValue("");
}
else
{
xmlWriter.WriteValue(rk.GetValue(value).ToString());
}
xmlWriter.WriteEndElement();
xmlWriter.Flush();
}
xmlWriter.WriteEndElement();
if (withFingerprint)
{
// xmlWriter.WriteElementString("Fingerprint", PuttyRegistry.GetFingerprint(fingerprintName));
xmlWriter.WriteStartElement("Fingerprint");
xmlWriter.WriteAttributeString("type", PuttyRegistry.GetFingerprintKind(fingerprintName));
xmlWriter.WriteValue(PuttyRegistry.GetFingerprint(fingerprintName));
xmlWriter.WriteEndElement();
xmlWriter.Flush();
}
xmlWriter.WriteEndElement();
xmlWriter.WriteEndDocument();
xmlWriter.Close();
}
catch (Exception e)
{
Console.WriteLine(e);
return(false);
}
return(true);
}
private static void processValueNames(RegistryKey Key)
{
output += "[" + Key.Name + "]\n";
string[] valuenames = Key.GetValueNames();
if (valuenames == null || valuenames.Length <= 0)
{
return;
}
foreach (string valuename in valuenames)
{
object obj = Key.GetValue(valuename);
if (obj != null)
{
string type = obj.GetType().Name;
RegistryValueKind valuekind = Key.GetValueKind(valuename);
int len = 0;
switch (valuekind.ToString())
{
case "String":
output += String.Format("\"{0}\"=\"{1}\"\r\n", transformStringReg(valuename), transformStringReg(obj.ToString()));
break;
case "ExpandString":
object tmpvalues = Key.GetValue(valuename, "error", RegistryValueOptions.DoNotExpandEnvironmentNames);
byte[] values = System.Text.Encoding.Unicode.GetBytes(tmpvalues.ToString() + "*");
len = String.Format("\"{0}\"=hex(2):", transformStringReg(valuename)).Length;
output += String.Format("\"{0}\"=hex(2):{1}\r\n", transformStringReg(valuename), transformBinReg(values, len, true));
break;
case "MultiString":
string[] stringvalues = (string[])obj;
byte[] totalbytes = new byte[0];
foreach (string stringvalue in stringvalues)
{
byte[] valuedata = System.Text.Encoding.Unicode.GetBytes(stringvalue + "*");
byte[] rv = new byte[totalbytes.Length + valuedata.Length];
System.Buffer.BlockCopy(totalbytes, 0, rv, 0, totalbytes.Length);
System.Buffer.BlockCopy(valuedata, 0, rv, totalbytes.Length, valuedata.Length);
totalbytes = rv;
}
len = String.Format("\"{0}\"=hex(7):", transformStringReg(valuename)).Length;
output += String.Format("\"{0}\"=hex(7):{1}\r\n", transformStringReg(valuename), transformBinReg(totalbytes, len, true));
break;
case "Binary":
len = String.Format("\"{0}\"=hex:", transformStringReg(valuename)).Length;
output += String.Format("\"{0}\"=hex:{1}\r\n", transformStringReg(valuename), transformBinReg((byte[])obj, len, false));
break;
case "DWord":
string value = String.Format("{0:x8}", (Int32)obj);
output += String.Format("\"{0}\"=dword:{1}\r\n", transformStringReg(valuename), value);
break;
case "QWord":
string qvalue = String.Format("{0:x16}", int.Parse(obj.ToString()));
output += String.Format("\"{0}\"=hex(b):{1}\r\n", transformStringReg(valuename), qvalue.Substring(14, 2) + "," + qvalue.Substring(12, 2) + "," + qvalue.Substring(10, 2) + "," + qvalue.Substring(8, 2) + "," + qvalue.Substring(6, 2) + "," + qvalue.Substring(4, 2) + "," + qvalue.Substring(2, 2) + "," + qvalue.Substring(0, 2));
break;
default:
break;
}
if (outputLocation == "Console")
{
Console.Write(output);
}
else
{
System.IO.File.AppendAllText(outputLocation, output);
}
output = "";
}
}
output += "\r\n";
}
private void ShowButton_Click(object sender, EventArgs e)
{
if (pathTextBox.Text.Contains(currentUserPath))
{
regKeyName = pathTextBox.Text.Replace(currentUserPath, "");
rootKey = Registry.CurrentUser;
}
if (pathTextBox.Text.Contains(localMachinePath))
{
regKeyName = pathTextBox.Text.Replace(localMachinePath, "");
rootKey = Registry.LocalMachine.OpenSubKey(regKeyName);
}
if (rootKey == null)
{
MessageBox.Show("Error");
return;
}
keysListView.Clear();
keysListView.Columns.Add("N");
keysListView.Columns.Add("Keys");
valuesListView.Clear();
valuesListView.Columns.Add("N");
valuesListView.Columns.Add("Values");
valuesListView.Columns.Add("Type");
try
{
RegistryKey regSubKey = rootKey.OpenSubKey(regKeyName);
string[] keysStr = regSubKey.GetSubKeyNames();
int i = 0;
foreach (string str in keysStr)
{
keysListView.Items.Add(i++.ToString()).SubItems.Add(str);
}
string[] valuesStr = regSubKey.GetValueNames();
i = 0;
foreach (string str in valuesStr)
{
RegistryValueKind kind = regSubKey.GetValueKind(str);
ListViewItem item = valuesListView.Items.Add(i++.ToString());
item.SubItems.Add(str);
item.SubItems.Add(kind.ToString());
}
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
keysListView.Columns[0].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
keysListView.Columns[1].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
valuesListView.Columns[0].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
valuesListView.Columns[1].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
valuesListView.Columns[2].AutoResize(
ColumnHeaderAutoResizeStyle.ColumnContent);
}
//Sets the data of the value nametofind, with type type.
public void setValue(RegistryKey parentKey, string nametofind, object data, RegistryValueKind type)
{
log("Setting up data [" + data.ToString() + "] with name <" + type.ToString() +"::" + nametofind + "> under key " + parentKey.Name + ".");
try
{
parentKey.SetValue(nametofind, data, type);
logsub("Success...");
}
catch (ArgumentNullException w)
{
logsub("Data to set is null.");
throw (w);
}
catch (ArgumentException w)
{
logsub("Value name is too long.");
throw (w);
}
catch (ObjectDisposedException w)
{
logsub("Key is closed so it can't be accessed.");
throw (w);
}
catch (SecurityException w)
{
logsub("User has not enough privileges to access this key.");
throw (w);
}
catch (UnauthorizedAccessException w)
{
logsub("The key cannot be written.Maybe it has been open as read-only.");
throw (w);
}
catch (IOException w)
{
///check http://msdn.microsoft.com/en-us/library/k23f0345.aspx
logsub("The key is a root-level node, and you're nobody to do this(kidding). This operation is not permitted in your O.S so I throw this error.");
throw (w);
}
}
public static void SetRegistryValue(RegistryKey appNameKey, string keyName, object keyValue,
RegistryValueKind registryValueKind = RegistryValueKind.String)
{
Console.WriteLine($"SetRegistryValue(\"{appNameKey}\", \"{keyName}\", \"{keyValue}\", \"{registryValueKind.ToString()}\")");
appNameKey?.SetValue(keyName, keyValue, registryValueKind);
}
public void RefreshValues(string keyPath)
{
if (string.IsNullOrEmpty(keyPath))
{
return;
}
RegistryKey key = RegistryUtils.OpenKeyFromPath(keyPath, false);
if (key == null)
{
return;
}
// Populating values
this.Window.lstValues.Items.Clear();
foreach (string valueName in key.GetValueNames())
{
object value = key.GetValue(valueName);
RegistryValueKind valueKind = key.GetValueKind(valueName);
string formattedValue = FormatValue(value, valueKind);
ListViewItem item = new ListViewItem(new[] { valueName, formattedValue, valueKind.ToString() });
item.Tag = valueName;
this.Window.lstValues.Items.Add(item);
item.ImageIndex = GetImageIndex(valueKind);
// This allows us to focus the updated item (Update done by the user) in the list view
if (valueName == frmAddEditValue.Instance.LastEditedValueName)
{
item.Selected = true;
item.Focused = true;
}
}
// Saving a reference to the source key of these values.
this.Window.lstValues.Tag = keyPath;
key.Close(); // Free resources
// Setting the columns
if (this.Window.lstValues.Items.Count > 0)
{
foreach (ColumnHeader column in this.Window.lstValues.Columns)
{
column.Width = -1;
}
}
else
{
this.Window.clmnValueName.Width = 86;
this.Window.clmnValue.Width = 105;
this.Window.clmnValueType.Width = 60;
}
}