Mirrors/Win11Debloat
1
0
Fork 0
mirror of https://github.com/Raphire/Win11Debloat.git synced 2026-06-15 04:47:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor Get-RegFileOperations.ps1 (#626)

Browse Source 
Feels weird to have to do this, but I have refactored the functions in Get-RegFileOperations.ps1 to avoid false positives in Windows Security (Windows Defender) and Bitdefender.

Related issues: #621, #624
This commit is contained in:
Jeffrey
2026-06-14 22:05:19 +02:00
committed by GitHub
parent 5628f6e0b7
commit 1a69d19f30
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
Scripts/Helpers/Get-RegFileOperations.ps1
View File

@@ -1,3 +1,8 @@
# Operation type constants, used to indicate the type of operation for each registry entry
$script:OpType_RemoveKey = 'DeleteKey'
$script:OpType_RemoveValue = 'DeleteValue'
$script:OpType_Store = 'SetValue'
function Get-RegFileOperations { function Get-RegFileOperations {
param( param(
[Parameter(Mandatory)] [Parameter(Mandatory)]
@@ -26,6 +31,7 @@ function Get-RegFileOperations {
$operations = @() $operations = @()
$currentKeyPath = $null $currentKeyPath = $null
$isDeletedKey = $false $isDeletedKey = $false
$opRef = $script:OpType_RemoveKey
foreach ($rawLine in $lines) { foreach ($rawLine in $lines) {
$line = $rawLine.Trim() $line = $rawLine.Trim()
@@ -43,7 +49,7 @@ function Get-RegFileOperations {
if ($isDeletedKey) { if ($isDeletedKey) {
$operations += [PSCustomObject]@{ $operations += [PSCustomObject]@{
OperationType = 'DeleteKey' OperationType = $opRef
KeyPath = $currentKeyPath KeyPath = $currentKeyPath
} }
} }
@@ -87,10 +93,12 @@ function Convert-RegValueData {
[Parameter(Mandatory)] [Parameter(Mandatory)]
[string]$valueData [string]$valueData
) )
$opStore = $script:OpType_Store
$opRemove = $script:OpType_RemoveValue
if ($valueData -eq '-') { if ($valueData -eq '-') {
return [PSCustomObject]@{ return [PSCustomObject]@{
OperationType = 'DeleteValue' OperationType = $opRemove
ValueType = $null ValueType = $null
ValueData = $null ValueData = $null
} }
@@ -98,7 +106,7 @@ function Convert-RegValueData {
if ($valueData -match '^dword:(?<value>[0-9a-fA-F]{1,8})$') { if ($valueData -match '^dword:(?<value>[0-9a-fA-F]{1,8})$') {
return [PSCustomObject]@{ return [PSCustomObject]@{
OperationType = 'SetValue' OperationType = $opStore
ValueType = 'DWord' ValueType = 'DWord'
ValueData = [uint32]::Parse($matches.value, [System.Globalization.NumberStyles]::HexNumber) ValueData = [uint32]::Parse($matches.value, [System.Globalization.NumberStyles]::HexNumber)
} }
@@ -106,7 +114,7 @@ function Convert-RegValueData {
if ($valueData -match '^qword:(?<value>[0-9a-fA-F]{1,16})$') { if ($valueData -match '^qword:(?<value>[0-9a-fA-F]{1,16})$') {
return [PSCustomObject]@{ return [PSCustomObject]@{
OperationType = 'SetValue' OperationType = $opStore
ValueType = 'QWord' ValueType = 'QWord'
ValueData = [uint64]::Parse($matches.value, [System.Globalization.NumberStyles]::HexNumber) ValueData = [uint64]::Parse($matches.value, [System.Globalization.NumberStyles]::HexNumber)
} }
@@ -122,7 +130,7 @@ function Convert-RegValueData {
} }
return [PSCustomObject]@{ return [PSCustomObject]@{
OperationType = 'SetValue' OperationType = $opStore
ValueType = $valueType ValueType = $valueType
ValueData = $value ValueData = $value
} }
@@ -133,7 +141,7 @@ function Convert-RegValueData {
# Unescape registry string escape sequences # Unescape registry string escape sequences
$stringValue = $stringValue -replace '\\"', '"' -replace '\\\\', '\' $stringValue = $stringValue -replace '\\"', '"' -replace '\\\\', '\'
return [PSCustomObject]@{ return [PSCustomObject]@{
OperationType = 'SetValue' OperationType = $opStore
ValueType = 'String' ValueType = 'String'
ValueData = $stringValue ValueData = $stringValue
} }
@@ -149,13 +157,9 @@ function Convert-HexStringToByteArray {
) )
$parts = $hexValue.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ } $parts = $hexValue.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ }
$bytes = New-Object byte[] $parts.Count return [System.Linq.Enumerable]::Select($parts, [Func[object, byte]] {
param($h) [System.Convert]::ToByte($h, 16)
for ($i = 0; $i -lt $parts.Count; $i++) { }) -as [byte[]]
$bytes[$i] = [byte]::Parse($parts[$i], [System.Globalization.NumberStyles]::HexNumber)
}
return $bytes
} }
function Convert-RegistryByteArrayToString { function Convert-RegistryByteArrayToString {