diff --git a/Scripts/Helpers/Get-RegFileOperations.ps1 b/Scripts/Helpers/Get-RegFileOperations.ps1 index b808c44..e3dea03 100644 --- a/Scripts/Helpers/Get-RegFileOperations.ps1 +++ b/Scripts/Helpers/Get-RegFileOperations.ps1 @@ -113,14 +113,11 @@ function Convert-RegValueData { } if ($valueData -match '^hex(?:\((?[0-9a-fA-F]+)\))?:(?[0-9a-fA-F,\s]+)$') { - if ($matches.kind -eq '7') { - throw "Unsupported registry value type hex(7) (REG_MULTI_SZ) encountered." - } - $bytes = Convert-HexStringToByteArray -hexValue $matches.bytes $valueType = if ($matches.kind) { "Hex$($matches.kind)" } else { 'Binary' } $value = switch ($matches.kind) { '2' { Convert-RegistryByteArrayToString -byteData $bytes } + '7' { Convert-RegistryByteArrayToMultiString -byteData $bytes } default { $bytes } } @@ -166,3 +163,12 @@ function Convert-RegistryByteArrayToString { return ([System.Text.Encoding]::Unicode.GetString($byteData)).TrimEnd([char]0) } + +function Convert-RegistryByteArrayToMultiString { + param( + [Parameter(Mandatory)] + [byte[]]$byteData + ) + + return @(([System.Text.Encoding]::Unicode.GetString($byteData)).TrimEnd([char]0) -split "`0" | Where-Object { $_ -ne '' }) +}