Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I convert a REG_BINARY value from the registry into a string?

I have a registry value which is stored as a binary value (REG_BINARY) holding information about a filepath. The value is read out into an byte array. But how can I transform it into a readable string?

I have read about system.text.encoding.ASCII.GetString(value) but this does not work. As far as I got to know the registry value is arbitrary binary data and not ASCII which is the reason for the method to produce useless data.

How can I convert the data?

Sample: (A piece of the entry)

01 00 00 00 94 00 00 00 14 00 00 00 63 00 3A 00 5C 00 
70 00 72 00 6F 00 67 00 72 00 61 00 6D 00 6d 00 65 00 
5C 00 67 00 65 00 6D 00 65 00 69 00 6E 00 73 00 61 00 
6D 00 65 00 20 00 64 00 61 00 74 00 65 00 69 00 65 00 
6E 00 5C

Due to the regedit this is supposed to be:

............c.:.\.p.r.o.g.r.a.m.m.e.\.g.e.m.e.i.n.s.a.m.e. .d.a.t.e.i.e.n.\

The entry itself was created from Outlook. It's an entry for a disabled adding item (resiliency).

like image 303
Marcus Avatar asked Oct 15 '25 20:10

Marcus


1 Answers

Well, it's not arbitrary binary data - it's text data in some kind of encoding. You need to find out what the encoding is.

I wouldn't be surprised if Encoding.Unicode.GetString(value) worked - but if that doesn't, please post a sample (in hex) and I'll see what I can do. What does the documentation of whatever's put the data in there say?

EDIT: It looks like Encoding.Unicode is your friend, but starting from byte 12. Use

Encoding.Unicode.GetString(bytes, 12, bytes.Length-12)
like image 133
Jon Skeet Avatar answered Oct 18 '25 11:10

Jon Skeet



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!