Пример #1
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="hivePath"></param>
        /// <returns></returns>
        public static RunMRU[] Get(string hivePath)
        {
            if (RegistryHelper.isCorrectHive(hivePath, "NTUSER.DAT"))
            {
                string user = RegistryHelper.GetUserHiveOwner(hivePath);
                string Key  = @"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU";

                byte[] bytes = Registry.RegistryHelper.GetHiveBytes(hivePath);

                NamedKey RunMRUKey = null;
                ValueKey MRUList   = null;

                try
                {
                    RunMRUKey = NamedKey.Get(bytes, hivePath, Key);
                }
                catch
                {
                    return(null);
                }

                try
                {
                    MRUList = ValueKey.Get(bytes, hivePath, Key, "MRUList");
                }
                catch
                {
                    return(null);
                }

                RunMRU[] RunMRUStrings = new RunMRU[RunMRUKey.NumberOfValues - 1];

                byte[] MRUListBytes = (byte[])MRUList.GetData(bytes);

                for (int i = 0; i <= MRUListBytes.Length - 4; i += 4)
                {
                    string MRUValue = Encoding.ASCII.GetString(MRUListBytes).TrimEnd('\0');
                    RunMRUStrings[i / 4] = new RunMRU(user, (string)ValueKey.Get(bytes, hivePath, Key, MRUValue.ToString()).GetData(bytes));
                }

                return(RunMRUStrings);
            }
            else
            {
                throw new Exception("Invalid NTUSER.DAT hive provided to -HivePath parameter.");
            }
        }
Пример #2
0
        public static RunMRU[] Get(string hivePath)
        {
            if (RegistryHelper.isCorrectHive(hivePath, "NTUSER.DAT"))
            {
                string user = RegistryHelper.GetUserHiveOwner(hivePath);
                string Key = @"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU";

                byte[] bytes = Registry.RegistryHelper.GetHiveBytes(hivePath);

                NamedKey RunMRUKey = null;
                ValueKey MRUList = null;

                try
                {
                    RunMRUKey = NamedKey.Get(bytes, hivePath, Key);
                }
                catch
                {
                    return null;
                }

                try
                {
                    MRUList = ValueKey.Get(bytes, hivePath, Key, "MRUList");
                }
                catch
                {
                    return null;
                }

                RunMRU[] RunMRUStrings = new RunMRU[RunMRUKey.NumberOfValues - 1];

                byte[] MRUListBytes = (byte[])MRUList.GetData(bytes);

                for(int i = 0; i <= MRUListBytes.Length - 4; i += 4)
                {
                    string MRUValue = Encoding.ASCII.GetString(MRUListBytes).TrimEnd('\0');
                    RunMRUStrings[i / 4] = new RunMRU(user, (string)ValueKey.Get(bytes, hivePath, Key, MRUValue.ToString()).GetData(bytes));
                }

                return RunMRUStrings;
            }
            else
            {
                throw new Exception("Invalid NTUSER.DAT hive provided to -HivePath parameter.");
            }
        }