@@ -192,6 +192,8 @@ private string GetKeyValueNameFromKernelRegistryString(string kernelRegistryStri
192192 keyValueName = "HKEY_CURRENT_USER\\ " + keyValueName . Substring ( keyValueNameCurrentUser . Length ) ;
193193 }
194194 }
195+ } else {
196+ return null ;
195197 }
196198 }
197199
@@ -1559,17 +1561,25 @@ private void ModificationAdded(RegistryTraceData registryTraceData) {
15591561 // KeyHandle is meant to be a uint32, so we discard the rest
15601562 // http://learn.microsoft.com/en-us/windows/win32/etw/registry-typegroup1
15611563 ulong safeKeyHandle = registryTraceData . KeyHandle & 0x00000000FFFFFFFF ;
1564+ string keyName = null ;
15621565 string value = null ;
15631566 RegistryValueKind ? valueKind = null ;
15641567 RegistryView registryView = modificationsElement . RegistryStates . BinaryType == BINARY_TYPE . SCS_64BIT_BINARY ? RegistryView . Registry64 : RegistryView . Registry32 ;
15651568
15661569 if ( safeKeyHandle == 0 ) {
15671570 // we don't need to queue it, we can just add the key right here
1568- registryStateElement . KeyName = GetRedirectedKeyValueName (
1571+ keyName = GetRedirectedKeyValueName (
15691572 GetKeyValueNameFromKernelRegistryString ( registryStateElement . KeyName ) ,
15701573 modificationsElement . RegistryStates . BinaryType
15711574 ) ;
15721575
1576+ // for keys that are not REGISTRY\MACHINE or REGISTRY\USER, ignore
1577+ if ( keyName == null ) {
1578+ ModificationRemoved ( registryTraceData ) ;
1579+ return ;
1580+ }
1581+
1582+ registryStateElement . KeyName = keyName ;
15731583 valueKind = null ;
15741584
15751585 try {
@@ -1635,11 +1645,17 @@ private void ModificationAdded(RegistryTraceData registryTraceData) {
16351645 kcbModificationKeyNames . TryGetValue ( safeKeyHandle , out string kcbModificationKeyName ) ;
16361646
16371647 if ( ! String . IsNullOrEmpty ( kcbModificationKeyName ) ) {
1638- registryStateElement . KeyName = GetRedirectedKeyValueName (
1648+ keyName = GetRedirectedKeyValueName (
16391649 GetKeyValueNameFromKernelRegistryString ( kcbModificationKeyName + "\\ " + registryStateElement . KeyName ) ,
16401650 modificationsElement . RegistryStates . BinaryType
16411651 ) ;
16421652
1653+ if ( keyName == null ) {
1654+ ModificationRemoved ( registryTraceData ) ;
1655+ return ;
1656+ }
1657+
1658+ registryStateElement . KeyName = keyName ;
16431659 valueKind = null ;
16441660
16451661 try {
@@ -1821,6 +1837,7 @@ private void KCBStopped(RegistryTraceData registryTraceData) {
18211837
18221838 // we'll be finding these in a second
18231839 RegistryStateElement registryStateElement = null ;
1840+ string keyName = null ;
18241841 string value = null ;
18251842 RegistryValueKind ? valueKind = null ;
18261843
@@ -1843,64 +1860,69 @@ private void KCBStopped(RegistryTraceData registryTraceData) {
18431860 for ( int j = 0 ; j < registryStateElements . Count ; j ++ ) {
18441861 registryStateElement = registryStateElements [ j ] ;
18451862
1846- registryStateElement . KeyName = GetRedirectedKeyValueName (
1863+ keyName = GetRedirectedKeyValueName (
18471864 GetKeyValueNameFromKernelRegistryString ( registryTraceData . KeyName + "\\ " + registryStateElement . KeyName ) ,
18481865 modificationsElement . RegistryStates . BinaryType
18491866 ) ;
18501867
1851- valueKind = null ;
1868+ if ( keyName == null ) {
1869+ modificationsElement . RegistryStates . Remove ( registryStateElement . Name ) ;
1870+ } else {
1871+ registryStateElement . KeyName = keyName ;
1872+ valueKind = null ;
18521873
1853- try {
1854- value = ReplaceStartupPathEnvironmentVariable (
1855- LengthenValue (
1856- GetValueInRegistryView (
1857- registryStateElement . KeyName ,
1858- registryStateElement . ValueName ,
1859- out valueKind ,
1860- registryView
1861- ) as string ,
1874+ try {
1875+ value = ReplaceStartupPathEnvironmentVariable (
1876+ LengthenValue (
1877+ GetValueInRegistryView (
1878+ registryStateElement . KeyName ,
1879+ registryStateElement . ValueName ,
1880+ out valueKind ,
1881+ registryView
1882+ ) as string ,
1883+
1884+ fullPath ,
1885+ pathNames
1886+ ) ,
18621887
1863- fullPath ,
18641888 pathNames
1865- ) ,
1866-
1867- pathNames
1868- ) ;
1869- } catch ( SecurityException ex ) {
1870- // value exists but we can't get it
1871- // this shouldn't happen because this task requires elevation
1872- LogExceptionToLauncher ( ex ) ;
1873- value = String . Empty ;
1874- } catch ( UnauthorizedAccessException ex ) {
1875- // value exists but we can't get it
1876- // this shouldn't happen because this task requires elevation
1877- LogExceptionToLauncher ( ex ) ;
1878- value = String . Empty ;
1879- } catch {
1880- // value doesn't exist
1881- value = null ;
1882- }
1889+ ) ;
1890+ } catch ( SecurityException ex ) {
1891+ // value exists but we can't get it
1892+ // this shouldn't happen because this task requires elevation
1893+ LogExceptionToLauncher ( ex ) ;
1894+ value = String . Empty ;
1895+ } catch ( UnauthorizedAccessException ex ) {
1896+ // value exists but we can't get it
1897+ // this shouldn't happen because this task requires elevation
1898+ LogExceptionToLauncher ( ex ) ;
1899+ value = String . Empty ;
1900+ } catch {
1901+ // value doesn't exist
1902+ value = null ;
1903+ }
18831904
1884- registryStateElement . Type = TYPE . VALUE ;
1885- registryStateElement . ValueKind = valueKind ;
1905+ registryStateElement . Type = TYPE . VALUE ;
1906+ registryStateElement . ValueKind = valueKind ;
18861907
1887- if ( value == null ) {
1888- try {
1889- if ( String . IsNullOrEmpty ( registryStateElement . ValueName )
1890- && String . IsNullOrEmpty ( TestKeyDeletedInRegistryView ( registryStateElement . KeyName , registryView ) ) ) {
1891- registryStateElement . Type = TYPE . KEY ;
1892- modificationsElement . RegistryStates . Set ( registryStateElement ) ;
1908+ if ( value == null ) {
1909+ try {
1910+ if ( String . IsNullOrEmpty ( registryStateElement . ValueName )
1911+ && String . IsNullOrEmpty ( TestKeyDeletedInRegistryView ( registryStateElement . KeyName , registryView ) ) ) {
1912+ registryStateElement . Type = TYPE . KEY ;
1913+ modificationsElement . RegistryStates . Set ( registryStateElement ) ;
1914+ }
1915+ } catch {
1916+ // fail silently
18931917 }
1894- } catch {
1895- // fail silently
1896- }
18971918
1898- if ( registryStateElement . Type == TYPE . VALUE ) {
1899- modificationsElement . RegistryStates . Remove ( registryStateElement . Name ) ;
1919+ if ( registryStateElement . Type == TYPE . VALUE ) {
1920+ modificationsElement . RegistryStates . Remove ( registryStateElement . Name ) ;
1921+ }
1922+ } else {
1923+ registryStateElement . Value = value ;
1924+ modificationsElement . RegistryStates . Set ( registryStateElement ) ;
19001925 }
1901- } else {
1902- registryStateElement . Value = value ;
1903- modificationsElement . RegistryStates . Set ( registryStateElement ) ;
19041926 }
19051927 }
19061928 }
0 commit comments