Manipulate Registry Hive files from C#

问题:

1.) How do Load, Edit and Save binary Hive files for registry from C#?

I found this Win32 api. http://msdn.microsoft.com/en-us/library/ee210770%28VS.85%29.aspx

This guy shared the code to dump the content of binary Hive files to text. http://www.codeproject.com/KB/recipes/RegistryDumper.aspx

2.) In addition to manipulating the Hive files, I also search for a method to load the Hive file into registry at runtime using C# (similar to the Load Hive and Unload Hive commands on the File many in regedit)

/Thanks

回答1:

Have you looked at the Registry and RegistryKey classes in Microsoft.Win32?

http://msdn.microsoft.com/en-us/library/microsoft.win32.aspx

It sounds like you may need to create your own representation to read the hive file and either queue up or immediately make the corresponding registry changes. Likewise you would need to write your own converter back to disk.

回答2:

The article below explains how to analyze the registry file without using WinAPI (advapi32.dll). In this particular case the guy is using Mono:

http://volatile-minds.blogspot.com/2011/01/analyzing-windows-nt-registry-without.html

using (FileStream fs = File.OpenRead (path)) {
 var data = new byte[checked((int)fs.Length)];
 int i = 0;
 int read;

 using (var ms = new MemoryStream (checked((int)fs.Length))) {

  while ((read = fs.Read (data, 0, data.Length)) > 0) {
   ms.Write (data, 0, read);
   i += read;
  }

  byte[] hive = ms.ToArray ();
  char[] cList = new char[fs.Length];

  i = 0;
  foreach (byte b in hive)
   cList[i++] = (char)b;

         string d = new string (cList);


  int all = 0;

  foreach (Match mx in lf.Matches (d)) { //you can change out the regex you want here.
   byte[] bb = new byte[mx.Value.Length];
   char[] cb = new char[mx.Value.Length];

   for (int k = 0; k < mx.Value.Length; k++) {
    bb[k] = (byte)mx.Value[k];
    cb[k] = (char)bb[k];

   }

   all++;

   //Console.WriteLine (new string (cb));
  }

  Console.WriteLine (all.ToString ());
  all = 0;
 }
}

回答3:

please see: https://github.com/brandonprry/volatile_reader

It reads offline hives in C# with a GTK interface. No write support yet though.