You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Advanced Scripting » Convert REG_BINARY data to ASCII
Register User       Forum List       Calendar       FAQ
Page 1 of 1 1
Topic Options
#193923 - 2009-05-19 02:31 AM Convert REG_BINARY data to ASCII
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Can someone assist in how to convert the REG_BINARY data of a key like here into an ASCII readable format.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

This is simple read of first entry, but that key would have multiple entries so I suppose you would need to enum it to do all of them.
1. Read the Key value
 Code:
$RecentDocsKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs'
$Value = ReadValue($RecentDocsKey,0)

2. Step through the data. (not sure how to really do that correctly)
Need to chunk the binary data into pieces and then put back together.
Val("&"+$Value) should put into Decimal format then you can use
Chr(new value) to obtain the ASCII representation.
So I would guess you could somehow maybe do something like:
$AsciiChr = Chr(Val("&"+$Value))

Would like to be able to read and modify all entries eventually.
Then be able to manipulate the MRUListEx in that key to remove/add/edit entries in the list so that they can be changed by script.

So to edit and put back in entries you would need to reverse the process and convert from ASCII back to Hex it looks like.
Top
#193924 - 2009-05-19 03:43 AM Re: Convert REG_BINARY data to ASCII [Re: NTDOC]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
Get the Unicode UDF from the resources page from my site. Not sure if it's the best name, but it will take the "hex" data in those keys and convert it to readable text. It can take your text and convert back to double-byte format.

Just posted some Outlook stuff in Basic forum that uses this to ID the UNC path of the PST files.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#193925 - 2009-05-19 03:48 AM Re: Convert REG_BINARY data to ASCII [Re: Glenn Barnas]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Great. Thanks Glenn - I'll try to grab it tonight, or in the morning.

Cheers.
Top
#193926 - 2009-05-19 03:55 AM Re: Convert REG_BINARY data to ASCII [Re: NTDOC]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
It's at http://www.innotechcg.com/tech/kixlib/main.asp?BODY=Unicode.htm

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#193927 - 2009-05-19 04:01 AM Re: Convert REG_BINARY data to ASCII [Re: Glenn Barnas]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Thanks Glenn. Downloaded it and ran it to get one entry for a quick test.
It returned this.
Pstools.chmT2Ptoscmlk6♥♦ï¶Pstools.chm.lnk▲


Here is basically what that points to in my recents folder so not fully sure yet what the exact formatting of the Recents in the registry mean.
05/18/2009 02:44 PM 590 Pstools.chm.lnk

 Code:
Target:   C:\ADMIN\PSTOOLS\Pstools.chm
Start in: C:\ADMIN\PSTOOLS
Shortcut key: none
Run: Normal Window
Comment:

Top
#193928 - 2009-05-19 04:30 AM Re: Convert REG_BINARY data to ASCII [Re: NTDOC]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
About time to leave but will review this document more tomorrow and see if it helps to understand how that mechanism works or not.

http://msdn.microsoft.com/en-us/library/bb762105(VS.85).aspx
Top
#193929 - 2009-05-19 08:57 AM Re: Convert REG_BINARY data to ASCII [Re: NTDOC]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
 Code:
$HexValue = ReadValue('HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs','0')
For $i=1 to Len($HexValue) Step 2
  $z=$z+Chr(Val("&"+SubStr($HexValue,$i,2)))
Next
$=MessageBox($z,"info")

This is basically how you can read the code.
Top
#193930 - 2009-05-19 09:50 AM Re: Convert REG_BINARY data to ASCII [Re: Arend_]
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
These techniques are very hit-and-miss and will only give you an approximation of the string data - if you are lucky!

Don't forget that binary objects are just that. If you think of them as a database record you will be close to understanding what they are about.

As well as strings (unicode or otherwise) they may contain any type of data of any length - byte arrays, numbers in different formats and so-on.

Picking every fourth character from the entry may get you unicode strings, but it won't decode numerics. Also, if any of the intervening data are not on a four byte boudary then even the simple string decoding will fail.

You may be lucky that strings are zero delimited, in which case you can find the end of a string:
 Code:
$HexValue = ReadValue('HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs','0')
For $i=1 to Len($HexValue) Step 4
	$c=Val("&"+SubStr($HexValue,$i,2))
	$z=$z+IIf($c,Chr($c),"<end>"+@CRLF)
Next
$=MessageBox($z,"info")


However, you really need to be sure of the data format otherwise your chance of success is governed by luck.
Top
#193931 - 2009-05-19 02:23 PM Re: Convert REG_BINARY data to ASCII [Re: Richard H.]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
I'm still not sure ether you are right or not Richard.
My code is based upon the way the registry key is exported and the way the ASCII data is shown when you open the registry key in regedit. Then it shows exactly the output of my code.

To prove my theory:
 Code:
$HexValue = ReadValue('HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs','0')
For $i=1 to Len($HexValue) Step 2
  $y=$y+$comma+SubStr($HexValue,$i,2)
  $comma=","
  $z=$z+Chr(Val("&"+SubStr($HexValue,$i,2)))
Next
$=MessageBox($y+@CRLF+@CRLF+$z,"info")

Top
#193932 - 2009-05-19 03:21 PM Re: Convert REG_BINARY data to ASCII [Re: Arend_]
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Well, you are picking up the "00" characters and adding them to your string. Now, KiXtart is very forgiving and for the most part ignores the Chr(0) when you append it so every thing looks OK. It's not correct, but it works by accident of the language. If you were using another coding language you would get very different results.

Secondly, when I run it I get garbage characters in among the strings on my machine. What are these? They are the non-string data which is present in the binary object.

Attachments
181.jpg
Description:



Top
#193936 - 2009-05-19 06:44 PM Re: Convert REG_BINARY data to ASCII [Re: Richard H.]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Well thank you to everyone for the input. I too like Richard have unknown input data which seems to indicate that unless I can track this down and come up with some work around I won't be able to actually edit the entries as I had wanted to because KiX won't be able to write back that type of data natively.

Of note Bryce has previously written a couple UDFs to attempt to deal with such Registry data and are located here
RegHEXtoASCII
RegASCIItoHEX
Top
#193942 - 2009-05-20 08:24 AM Re: Convert REG_BINARY data to ASCII [Re: Richard H.]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
 Originally Posted By: Richard H.
Secondly, when I run it I get garbage characters in among the strings on my machine. What are these? They are the non-string data which is present in the binary object.


Good question, but if you look inside regedit you will see the same garbage signs...
Top
#193946 - 2009-05-20 10:19 AM Re: Convert REG_BINARY data to ASCII [Re: Arend_]
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
 Originally Posted By: apronk
Good question, but if you look inside regedit you will see the same garbage signs...


Yes, of course you will.

Regedit is doing exactly the same thing that you are - converting BYTE values into a displayable format. It doesn't understand any better than you do what the format of the binary object is, so it just provides a simple character / hex dump. Where the byte values happen to correspond to simple strings they will appear in the display (albeit interspersed with the "." representing the 00 value where the string is wide/unicode). Where the byte is something else such as a interger or floating point number you are likely to get garbage.

To appreciate what is going on it helps to understand how computers store data, especially where they are complex types like floating point. Numbers are not stored in a string form but as a binary version. Even this is not simple and is governed by the chip architecture (big/little endian) and local math library implementation. (Note, some database engines do have an option to store numbers in a portable format which might be string representation)

The binary objects in the registry are not necessarily a single datum. This registry entry is a good example of compound data - there are multiple seperate wide strings and also some other underfined data type(s) mixed in. The undefined data may be integers, floating point numbers, a byte array which represents the bitmap for an icon or just about anything.

Without a definition (schema) which describes the data layout it is very difficult to interpret.
Top
#193955 - 2009-05-20 12:17 PM Re: Convert REG_BINARY data to ASCII [Re: Richard H.]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Ah ok, thank you for explaining that.
Now I understand why I can not read out the stored REG_BINARY object of the Wireless configuration in XP.
Top
#193959 - 2009-05-20 01:21 PM Re: Convert REG_BINARY data to ASCII [Re: Arend_]
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
It gets worse - apparently the content of the registry key has changed with each major version of Windows and there are no well known APIs for managing it.
Top
#193961 - 2009-05-20 01:27 PM Re: Convert REG_BINARY data to ASCII [Re: Richard H.]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
Yeah, exactly.. good explaination, Richard!

I didn't imply that my UDF would magically extract the data from the registry - that's up to you. Once you find the string segment in the data (terminated by "0000"), my UDF would do the byte conversion part to convert it to something meaningful. It's a small part of a 1000 piece puzzle. ;\)

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#193969 - 2009-05-20 06:54 PM Re: Convert REG_BINARY data to ASCII [Re: Glenn Barnas]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Well reading this documentation it appears to be documented at least somewhat. Not that KiX will ever be managing it though.

Managing the File System

SHAddToRecentDocs Function
Top
Page 1 of 1 1


Moderator:  Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2220 anonymous users online.
details
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users
My Cookies · Mark all read Powered by UBB.threads™ Contact Us · KiXtart.org website · Top

Generated in 0.123 seconds in which 0.091 seconds were spent on a total of 14 queries. Zlib compression enabled.
Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org