public void WriteToStream(Stream fs, bool embedBinaryData) { fs.WriteByte(142); WriteFiles.WriteInt(fs, 1, (int)RegOperation); WriteFiles.WriteInt(fs, 2, (int)RegBasekey); WriteFiles.WriteInt(fs, 3, (int)RegValueKind); WriteFiles.WriteDeprecatedString(fs, 4, SubKey); if (!string.IsNullOrEmpty(ValueName)) { WriteFiles.WriteDeprecatedString(fs, 5, ValueName); } bool flag = !embedBinaryData && RegValueKind == RegistryValueKind.Binary && ValueData is string; if (flag) { fs.WriteByte(128); } if (RegOperation == RegOperations.CreateValue) { switch (RegValueKind) { case RegistryValueKind.Binary: if (flag) { WriteFiles.WriteDeprecatedString(fs, 7, (string)ValueData); } else if (embedBinaryData && RegValueKind == RegistryValueKind.Binary && ValueData is string) { WriteOutFile(fs, 7, (string)ValueData); } else { WriteFiles.WriteByteArray(fs, 7, (byte[])ValueData); } break; case RegistryValueKind.DWord: WriteFiles.WriteInt(fs, 7, (int)ValueData); break; case RegistryValueKind.QWord: WriteFiles.WriteLong(fs, 7, (long)ValueData); break; case RegistryValueKind.MultiString: WriteFiles.WriteDeprecatedString(fs, 7, MultiStringToString(ValueData)); break; case RegistryValueKind.String: case RegistryValueKind.ExpandString: WriteFiles.WriteDeprecatedString(fs, 7, (string)ValueData); break; } } if (Is32BitKey) { fs.WriteByte(129); } fs.WriteByte(158); }
public void WriteToStream(Stream fs, bool embedBinaryData) { // beginning of RegChange fs.WriteByte(0x8E); // save the operation WriteFiles.WriteInt(fs, 0x01, (int)RegOperation); // save BaseKey WriteFiles.WriteInt(fs, 0x02, (int)RegBasekey); // Save the valueKind WriteFiles.WriteInt(fs, 0x03, (int)RegValueKind); // Save SubKey WriteFiles.WriteDeprecatedString(fs, 0x04, SubKey); // Value Name if (!string.IsNullOrEmpty(ValueName)) { WriteFiles.WriteDeprecatedString(fs, 0x05, ValueName); } bool isBinaryString = !embedBinaryData && RegValueKind == RegistryValueKind.Binary && ValueData is string; if (isBinaryString) { fs.WriteByte(0x80); } if (RegOperation == RegOperations.CreateValue) { // Value Data switch (RegValueKind) { case RegistryValueKind.Binary: if (isBinaryString) { //just saving the string pointing to a file on the disk WriteFiles.WriteDeprecatedString(fs, 0x07, (string)ValueData); } else if (embedBinaryData && RegValueKind == RegistryValueKind.Binary && ValueData is string) { //load the file and immediately write it out to fs WriteOutFile(fs, 0x07, (string)ValueData); } else { //the byte array is already in memory, just write it out WriteFiles.WriteByteArray(fs, 0x07, (byte[])ValueData); } break; case RegistryValueKind.DWord: WriteFiles.WriteInt(fs, 0x07, (int)ValueData); break; case RegistryValueKind.QWord: WriteFiles.WriteLong(fs, 0x07, (long)ValueData); break; case RegistryValueKind.MultiString: WriteFiles.WriteDeprecatedString(fs, 0x07, MultiStringToString(ValueData)); break; case RegistryValueKind.ExpandString: case RegistryValueKind.String: WriteFiles.WriteDeprecatedString(fs, 0x07, (string)ValueData); break; } } // should treat as x86 under x64 systems if (Is32BitKey) { fs.WriteByte(0x81); } //end of RegChange fs.WriteByte(0x9E); }