从C#操作注册表配置单元文件

本文关键字：单元 元文件 配置 注册表 操作 | 更新日期: 2023-09-27 17:52:44

1.(如何从C#为注册表加载、编辑和保存二进制配置单元文件？

我找到了这个Win32 api。http://msdn.microsoft.com/en-us/library/ee210770%28VS.85%29.aspx

这家伙分享了将二进制Hive文件的内容转储为文本的代码。http://www.codeproject.com/KB/recipes/RegistryDumper.aspx

2.(除了操作配置单元文件外，我还搜索了一种方法，可以在运行时使用C将配置单元文件加载到注册表中#(类似于regedit中File many上的Load Hive和Unload Hive命令(

/感谢

从C#操作注册表配置单元文件

您看过Microsoft.Win32中的Registry和RegistryKey类吗？

http://msdn.microsoft.com/en-us/library/microsoft.win32.aspx

听起来您可能需要创建自己的表示来读取配置单元文件，然后排队或立即进行相应的注册表更改。同样，您需要将自己的转换器写回磁盘。

下面的文章解释了如何在不使用WinAPI(advapi32.dll(的情况下分析注册表文件

http://volatile-minds.blogspot.com/2011/01/analyzing-windows-nt-registry-without.html

using (FileStream fs = File.OpenRead (path)) {
 var data = new byte[checked((int)fs.Length)];
 int i = 0;
 int read;
 using (var ms = new MemoryStream (checked((int)fs.Length))) {
  while ((read = fs.Read (data, 0, data.Length)) > 0) {
   ms.Write (data, 0, read);
   i += read;
  }
  byte[] hive = ms.ToArray ();
  char[] cList = new char[fs.Length];
  i = 0;
  foreach (byte b in hive)
   cList[i++] = (char)b;
         string d = new string (cList);

  int all = 0;
  foreach (Match mx in lf.Matches (d)) { //you can change out the regex you want here.
   byte[] bb = new byte[mx.Value.Length];
   char[] cb = new char[mx.Value.Length];
   for (int k = 0; k < mx.Value.Length; k++) {
    bb[k] = (byte)mx.Value[k];
    cb[k] = (char)bb[k];
   }
   all++;
   //Console.WriteLine (new string (cb));
  }
  Console.WriteLine (all.ToString ());
  all = 0;
 }
}

这已经9岁了，但我认为这可以帮助其他人。我写了这个类，允许你做这样的事情：

Hive.AcquirePrivileges() // Acquires the privileges necessary for loading the hive
Hive myregistryhive = Hive.LoadFromFile("hivepathhere") // Loads the hive
// use myregistryhive.RootKey (a RegistryKey), read and/or write to it and its sub keys
myregistryhive.SaveAndUnload() // Unloads the hive
Hive.ReturnPrivileges() // De-elevate back to normal privileges.

类的代码：

class Hive
{
    [DllImport("advapi32.dll", SetLastError = true)]
    static extern int RegLoadKey(IntPtr hKey, string lpSubKey, string lpFile);
    [DllImport("advapi32.dll", SetLastError = true)]
    static extern int RegSaveKey(IntPtr hKey, string lpFile, uint securityAttrPtr = 0);
    [DllImport("advapi32.dll", SetLastError = true)]
    static extern int RegUnLoadKey(IntPtr hKey, string lpSubKey);
    [DllImport("ntdll.dll", SetLastError = true)]
    static extern IntPtr RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);
    [DllImport("advapi32.dll")]
    static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, ref UInt64 lpLuid);
    [DllImport("advapi32.dll")]
    static extern bool LookupPrivilegeValue(IntPtr lpSystemName, string lpName, ref UInt64 lpLuid);
    private RegistryKey parentKey;
    private string name;
    private string originalPath;
    public RegistryKey RootKey;
    private Hive() { }
    public static Hive LoadFromFile(string Path)
    {
        Hive result = new Hive();
        result.parentKey = RegistryKey.OpenBaseKey(RegistryHive.Users, RegistryView.Default);
        result.name = Guid.NewGuid().ToString();
        result.originalPath = Path;
        IntPtr parentHandle = result.parentKey.Handle.DangerousGetHandle();
        RegLoadKey(parentHandle, result.name, Path);
        //Console.WriteLine(Marshal.GetLastWin32Error());
        result.RootKey = result.parentKey.OpenSubKey(result.name, true);
        return result;
    }
    public static void AcquirePrivileges()
    {
        ulong luid = 0;
        bool throwaway;
        LookupPrivilegeValue(IntPtr.Zero, "SeRestorePrivilege", ref luid);
        RtlAdjustPrivilege((int)luid, true, false, out throwaway);
        LookupPrivilegeValue(IntPtr.Zero, "SeBackupPrivilege", ref luid);
        RtlAdjustPrivilege((int)luid, true, false, out throwaway);
    }
    public static void ReturnPrivileges()
    {
        ulong luid = 0;
        bool throwaway;
        LookupPrivilegeValue(IntPtr.Zero, "SeRestorePrivilege", ref luid);
        RtlAdjustPrivilege((int)luid, false, false, out throwaway);
        LookupPrivilegeValue(IntPtr.Zero, "SeBackupPrivilege", ref luid);
        RtlAdjustPrivilege((int)luid, false, false, out throwaway);
    }
    public void SaveAndUnload()
    {
        RootKey.Close();
        RegUnLoadKey(parentKey.Handle.DangerousGetHandle(), name);
        parentKey.Close();
    }
}

编辑：请注意，这需要管理员权限。

相关文章：