fix: support QWord, ExpandString and MultiString in the .reg fallback writer (#715)

This commit is contained in:
Sashank
2026-07-26 22:33:28 +02:00
committed by GitHub
parent 32cedaf65d
commit 0f30b62221
2 changed files with 21 additions and 1 deletions
+18 -1
View File
@@ -11,28 +11,45 @@ function Get-NormalizedRegistryValueName {
return [string]$ValueName
}
<#
.SYNOPSIS
Converts a parsed .reg operation into a Name/Kind/Value set for RegistryKey.SetValue.
#>
function Convert-RegOperationToValueKind {
param(
[Parameter(Mandatory)]
$Operation
)
$valueName = if ([string]::IsNullOrEmpty([string]$Operation.ValueName)) { '' } else { [string]$Operation.ValueName }
$valueName = Get-NormalizedRegistryValueName -ValueName $Operation.ValueName
$valueType = [string]$Operation.ValueType
$operationKeyPath = [string]$Operation.KeyPath
# ValueType here is whatever Get-RegFileOperations parsed it as.
# Hex2/Hex7 are its names for REG_EXPAND_SZ/REG_MULTI_SZ, already decoded to string/string[].
switch ($valueType) {
'DWord' {
$unsigned = [uint32]$Operation.ValueData
$value = [BitConverter]::ToInt32([BitConverter]::GetBytes($unsigned), 0)
return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::DWord; Value = $value }
}
'QWord' {
$unsigned = [uint64]$Operation.ValueData
$value = [BitConverter]::ToInt64([BitConverter]::GetBytes($unsigned), 0)
return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::QWord; Value = $value }
}
'String' {
return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::String; Value = [string]$Operation.ValueData }
}
'Hex2' {
return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::ExpandString; Value = [string]$Operation.ValueData }
}
'Binary' {
return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::Binary; Value = [byte[]]$Operation.ValueData }
}
'Hex7' {
return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::MultiString; Value = [string[]]@($Operation.ValueData) }
}
default {
throw "Unsupported value type '$valueType' while applying reg operation for '$operationKeyPath'"
}