none
How to search specific byte pattern (string) in reg_binary from registry? RRS feed

  • Question

  • 've a reg_binary key called fooKey in the registry, and I would like to search if '0x57 0x49' (i.e. "WI") is in the fooKey, how to do it in C#?

     

    Thanks.

     

    Sunday, April 6, 2008 5:01 AM

Answers

  • RegistryKey reg = Registry.LocalMachine; // (could also be something else here, like CurrentUser for instance , depending on where you put your key.).

     

    // drill down through your registry values:

     

    reg = reg.OpenSubKey("SYSTEM");

    reg = reg.OpenSubKey("CurrentControlSet");

    reg = reg.OpenSubKey("Control");

    reg = reg.OpenSubKey("COM Name Arbiter");

     

    // get your value

    byte[] value = reg.GetValue("fooKey");

     

    // iterate through your value and find the result.

    foreach (byte b in value)

    if (b == 0x59)

    return true;

     

    return false;

     

    Sunday, April 6, 2008 5:19 AM
    Moderator
  • That's what the encoding class is for:

     

    Code Snippet

     

    // once you get your byte[] value variable

    // iterate through your value and find the result.

    return Encoding.Unicode.GetString(value).Contains("FOOTEST");

     

     

     

    You may want to try different encoding styles though, because some applications may store data using different encoding types.

    Sunday, April 6, 2008 7:21 PM
    Moderator

All replies

  • RegistryKey reg = Registry.LocalMachine; // (could also be something else here, like CurrentUser for instance , depending on where you put your key.).

     

    // drill down through your registry values:

     

    reg = reg.OpenSubKey("SYSTEM");

    reg = reg.OpenSubKey("CurrentControlSet");

    reg = reg.OpenSubKey("Control");

    reg = reg.OpenSubKey("COM Name Arbiter");

     

    // get your value

    byte[] value = reg.GetValue("fooKey");

     

    // iterate through your value and find the result.

    foreach (byte b in value)

    if (b == 0x59)

    return true;

     

    return false;

     

    Sunday, April 6, 2008 5:19 AM
    Moderator
  •  

    Thanks, David.

     

    Is there an existing method to deal with sequence of byte pattern? e.g. "FOOTEST" (in string representation)

     

    Or do I have to examine the pattern one by one?

     

    Thanks.

    Sunday, April 6, 2008 5:47 AM
  • That's what the encoding class is for:

     

    Code Snippet

     

    // once you get your byte[] value variable

    // iterate through your value and find the result.

    return Encoding.Unicode.GetString(value).Contains("FOOTEST");

     

     

     

    You may want to try different encoding styles though, because some applications may store data using different encoding types.

    Sunday, April 6, 2008 7:21 PM
    Moderator