diff --git a/Scripts/Helpers/ApplyRegistryRegFile.ps1 b/Scripts/Helpers/ApplyRegistryRegFile.ps1 index 53488fe..6583a24 100644 --- a/Scripts/Helpers/ApplyRegistryRegFile.ps1 +++ b/Scripts/Helpers/ApplyRegistryRegFile.ps1 @@ -27,60 +27,13 @@ function Convert-RegOperationToValueKind { $value = [BitConverter]::ToInt32([BitConverter]::GetBytes($unsigned), 0) return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::DWord; Value = $value } } - 'QWord' { - $unsigned = [uint64]$Operation.ValueData - $value = [BitConverter]::ToInt64([BitConverter]::GetBytes($unsigned), 0) - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::QWord; Value = $value } - } 'String' { return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::String; Value = [string]$Operation.ValueData } } 'Binary' { return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::Binary; Value = [byte[]]$Operation.ValueData } } - 'Hex0' { - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::None; Value = [byte[]]$Operation.ValueData } - } - 'Hex1' { - $stringValue = ([System.Text.Encoding]::Unicode.GetString([byte[]]$Operation.ValueData)).TrimEnd([char]0) - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::String; Value = $stringValue } - } - 'Hex2' { - $expandStringValue = if ($Operation.ValueData -is [byte[]]) { - ([System.Text.Encoding]::Unicode.GetString([byte[]]$Operation.ValueData)).TrimEnd([char]0) - } - else { - [string]$Operation.ValueData - } - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::ExpandString; Value = $expandStringValue } - } - 'Hex7' { - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::MultiString; Value = [string[]]$Operation.ValueData } - } - { $valueType -in @('Hex3', 'Hex4', 'Hex5') } { - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::Binary; Value = [byte[]]$Operation.ValueData } - } - 'HexB' { - $qwordBytes = [byte[]]$Operation.ValueData - if ($qwordBytes.Count -gt 8) { - throw "Unsupported hex value type '$valueType' with invalid byte count '$($qwordBytes.Count)' while applying reg operation for '$operationKeyPath'." - } - - if ($qwordBytes.Count -lt 8) { - $paddedBytes = New-Object byte[] 8 - [Array]::Copy($qwordBytes, $paddedBytes, $qwordBytes.Count) - $qwordBytes = $paddedBytes - } - - $unsigned = [BitConverter]::ToUInt64($qwordBytes, 0) - $signed = [BitConverter]::ToInt64([BitConverter]::GetBytes($unsigned), 0) - return @{ Name = $valueName; Kind = [Microsoft.Win32.RegistryValueKind]::QWord; Value = $signed } - } default { - if ($valueType -like 'Hex*') { - throw "Unsupported hex value type '$valueType' while applying reg operation for '$operationKeyPath'." - } - throw "Unsupported value type '$valueType' while applying reg operation for '$operationKeyPath'" } }