diff --git a/Scripts/Helpers/Get-RegFileOperations.ps1 b/Scripts/Helpers/Get-RegFileOperations.ps1 index c78cdad..b808c44 100644 --- a/Scripts/Helpers/Get-RegFileOperations.ps1 +++ b/Scripts/Helpers/Get-RegFileOperations.ps1 @@ -113,11 +113,14 @@ function Convert-RegValueData { } if ($valueData -match '^hex(?:\((?[0-9a-fA-F]+)\))?:(?[0-9a-fA-F,\s]+)$') { + if ($matches.kind -eq '7') { + throw "Unsupported registry value type hex(7) (REG_MULTI_SZ) encountered." + } + $bytes = Convert-HexStringToByteArray -hexValue $matches.bytes $valueType = if ($matches.kind) { "Hex$($matches.kind)" } else { 'Binary' } $value = switch ($matches.kind) { '2' { Convert-RegistryByteArrayToString -byteData $bytes } - '7' { Convert-RegistryByteArrayToMultiString -byteData $bytes } default { $bytes } } @@ -163,30 +166,3 @@ function Convert-RegistryByteArrayToString { return ([System.Text.Encoding]::Unicode.GetString($byteData)).TrimEnd([char]0) } - -function Convert-RegistryByteArrayToMultiString { - param( - [Parameter(Mandatory)] - [byte[]]$byteData - ) - - $decoded = [System.Text.Encoding]::Unicode.GetString($byteData) - $values = New-Object 'System.Collections.Generic.List[string]' - $current = New-Object System.Text.StringBuilder - - foreach ($character in $decoded.ToCharArray()) { - if ($character -eq [char]0) { - $values.Add($current.ToString()) - $null = $current.Clear() - continue - } - - $null = $current.Append($character) - } - - if ($values.Count -gt 0 -and $values[$values.Count - 1] -eq '') { - $values.RemoveAt($values.Count - 1) - } - - return @($values.ToArray()) -}