views:

322

answers:

3

I am currently writing a program that will read part of the windows system registry however some of the values of these keys are of type System.Byte[] when i try and decode these values I can produce a string that has some readable characters that makes but mostly the string is jiberish. I have tried several encoding types but none seem to produce the correct results. I am just wondering if there is anything that is known to fix this. this is the code i have

public void getMRU()
{
   String mru = @"Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU";

   RegistryKey rk = Registry.CurrentUser.OpenSubKey(mru);

   foreach (string skName in rk.GetSubKeyNames())
   {
       RegistryKey sk = rk.OpenSubKey(skName);

       System.Text.Encoding enc = System.Text.Encoding.UTF8;
       string myString = enc.GetString((Byte[])sk.GetValue("0"));
       Console.WriteLine(myString)
   }
}
+1  A: 

It's not guaranteed that the bytes that are stored in the registry for any value are necessarily encoded strings. If they were to be strings, then the type of the registry value would be just that, a string.

If it is a byte value, then it usually means that it is an encoding of some sort of data structure that is custom to the application, so you have to figure out what the format is for the application which owns the key that you are reading.

casperOne
+2  A: 

The correct decoding and interpretation varies from key to key. For binary values there is no enforced format, applications are free to store any bytes they wish. You must know what you read in order to interpret it. If the key content is documented, then you can apply the documentation specifications to decode the content. If is undocumented, then you have no business reading it.

Remus Rusanu
+2  A: 

From the name of the registry key, I would guess that those blobs aren't encoded filename strings at all, but instead are PIDLs (or rather ITEMIDLISTs). A PIDL is a shell structure representing an entity in the shell namespace, which need not be a file (e.g. Control Panel).

If that's the case, you'll probably need to use the SHGetPathFromIDList API to convert the PIDL to a filesystem path: pass in the address of the byte[] array as the pidl parameter.

itowlson