/// <summary>
/// Gets the recent entries of commands issued in the run bar
/// </summary>
/// <returns>The recent entries</returns>
public List <RunBarEntry> GetRecentlRunBarEntries()
{
List <RunBarEntry> recentRunEntries = new List <RunBarEntry>();
try
{
RegistryKey runHistoryRegistryKey = Registry.CurrentUser.OpenSubKey(_RECENTLY_RUN_PATH);
string[] runEntries = runHistoryRegistryKey.GetValueNames();
foreach (string runEntry in runEntries)
{
RunBarEntry rbe = new RunBarEntry();
rbe.Name = runEntry;
rbe.Value = runHistoryRegistryKey.GetValue(runEntry).ToString();
// FIX This is missleading. All run bar entries will have the same last write date because all of the data is associated with the same subkey
rbe.LastWrite = RegQueryInformationHelper.GetLastWritten(runHistoryRegistryKey);
recentRunEntries.Add(rbe);
}
}
catch (Exception exc)
{
MyDebugger.Instance.LogMessage(exc, DebugVerbocity.Exception);
}
MyDebugger.Instance.LogMessage($"Loaded {recentRunEntries.Count} recently run entries.", DebugVerbocity.Informational);
return(recentRunEntries);
}
/// <summary>
/// Gets a list of installed programs
/// </summary>
/// <returns>The list of installed programs</returns>
public List <InstalledProgram> GetInstalledPrograms()
{
List <InstalledProgram> installedPrograms = new List <InstalledProgram>();
try
{
RegistryKey installedRegistryPath = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_PATH);
RegistryKey userSpecificInstalledRegistryPath = Registry.CurrentUser.OpenSubKey(_INSTALLED_PROGRAMS_PATH);
RegistryKey installedx86RegistryPath = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_x86_KEY_PATH);
string[] machineSpecificInstalledIds = installedRegistryPath.GetSubKeyNames();
string[] userSpecificInstalledIds = userSpecificInstalledRegistryPath.GetSubKeyNames();
string[] installedx86RegistryIds = installedx86RegistryPath.GetSubKeyNames();
foreach (string id in machineSpecificInstalledIds)
{
RegistryKey installedProgramRegEntry = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_PATH + "\\" + id);
InstalledProgram ip = ParseInstalledProgramFromKey(installedProgramRegEntry, id);
if (ip.InstallDate == DateTime.MinValue)
{
ip.InstallDate = RegQueryInformationHelper.GetLastWritten(installedProgramRegEntry);
}
if (!installedPrograms.Contains(ip))
{
installedPrograms.Add(ip);
}
}
foreach (string id in userSpecificInstalledIds)
{
RegistryKey installedProgramRegEntry = Registry.CurrentUser.OpenSubKey(_INSTALLED_PROGRAMS_PATH + "\\" + id);
InstalledProgram ip = ParseInstalledProgramFromKey(installedProgramRegEntry, id);
if (ip.InstallDate == DateTime.MinValue)
{
ip.InstallDate = RegQueryInformationHelper.GetLastWritten(installedProgramRegEntry);
}
if (!installedPrograms.Contains(ip))
{
installedPrograms.Add(ip);
}
}
foreach (string id in installedx86RegistryIds)
{
RegistryKey installedProgramRegEntry = Registry.LocalMachine.OpenSubKey(_INSTALLED_PROGRAMS_x86_KEY_PATH + "\\" + id);
InstalledProgram ip = ParseInstalledProgramFromKey(installedProgramRegEntry, id);
if (ip.InstallDate == DateTime.MinValue)
{
ip.InstallDate = RegQueryInformationHelper.GetLastWritten(installedProgramRegEntry);
}
if (!installedPrograms.Contains(ip))
{
installedPrograms.Add(ip);
}
}
} catch (Exception exc)
{
MyDebugger.Instance.LogMessage(exc, DebugVerbocity.Exception);
}
return(installedPrograms);
}
/// <summary>
/// Gets a list of usb device history entries
/// </summary>
/// <returns>The list of usb device history entries</returns>
public List <USBDeviceHistoryEntry> GetUSBDeviceHistory()
{
List <USBDeviceHistoryEntry> history = new List <USBDeviceHistoryEntry>();
try
{
RegistryKey usbstoreKey = Registry.LocalMachine.OpenSubKey(_USBSTOR_REG_KEY);
RegistryKey usbKey = Registry.LocalMachine.OpenSubKey(_USB_REG_KEY);
foreach (RegistryKey regKey in new RegistryKey[] { usbstoreKey, usbKey })
{
foreach (string classKeyName in regKey.GetSubKeyNames())
{
RegistryKey classKey = regKey.OpenSubKey(classKeyName);
foreach (string instanceKeyName in classKey.GetSubKeyNames())
{
RegistryKey instanceKey = classKey.OpenSubKey(instanceKeyName);
USBDeviceHistoryEntry entry = new USBDeviceHistoryEntry();
entry.DeviceId = instanceKeyName;
object description = instanceKey.GetValue("DeviceDesc");
object name = instanceKey.GetValue("FriendlyName");
entry.DeviceDescription = "Unknown";
entry.DeviceName = "Unknown";
if (description != null)
{
string dsc = description.ToString();
if (dsc.Contains(';'))
{
dsc = dsc.Split(';')[1];
}
entry.DeviceName = dsc;
entry.DeviceDescription = dsc;
}
if (name != null && name != "")
{
entry.DeviceName = name.ToString();
}
entry.LastSeen = RegQueryInformationHelper.GetLastWritten(instanceKey);
if (!history.Contains(entry))
{
history.Add(entry);
}
}
}
}
RegistryKey rki = Registry.LocalMachine.OpenSubKey(_MOUNTED_DEVICES_KEY);
string[] names = rki.GetValueNames();
foreach (string name in names)
{
if (name.Contains("DosDevices"))
{
object ray = rki.GetValue(name, RegistryValueKind.Binary);
string vaks = System.Text.Encoding.Unicode.GetString((byte[])ray);
string[] info = vaks.Split('#');
foreach (USBDeviceHistoryEntry entry in history)
{
if (info.Length > 2 && entry.DeviceId == info[2])
{
entry.HasMountPoint = true;
entry.MountPoint = name.Split('\\')[2];
}
}
}
}
} catch (Exception exc)
{
MyDebugger.Instance.LogMessage(exc, DebugVerbocity.Exception);
}
return(history);
}
