c#注册表时间属性
本文关键字:属性 时间 注册表 | 更新日期: 2023-09-27 17:53:30
摘要:我能像处理文件和文件夹一样获得注册表的创建、修改和上次写入时间吗?
详细信息:我现在有我的代码设置来显示目录的3个时间属性,文件也是如此。我很想用我正在搜索的注册表值来做这件事。这可能吗?如果是,怎么办?
代码示例:以下是我正在使用的3个片段。下面的目录和文件标题只是我已经在工作的代码的示例,它可以完成我想做的一切。我只是想表明我知道如何获得这些属性。Registry段是我用来循环注册表项的经过净化的代码(如果你愿意,可以使用它;(,我希望在输出中添加时间属性。
目录:
//print out which folders are not whitelisted
string pt = System.String.Concat("'n" + dir, "'n");
Output.AppendText(pt);
DateTime creationTimeUtc = Directory.GetCreationTimeUtc(dir);
DateTime lastWriteTimeUtc = Directory.GetLastWriteTimeUtc(dir);
DateTime lastAccessTimeUtc = Directory.GetLastAccessTimeUtc(dir);
Output.AppendText("creationTimeUtc: " + creationTimeUtc + "'n");
Output.AppendText("lastWriteTimeUtc: " + lastWriteTimeUtc + "'n");
Output.AppendText("lastAccessTimeUtc: " + lastAccessTimeUtc + "'n");
文件:
//print out which folders are not whitelisted
string pt = System.String.Concat("'n" + file, "'n");
Output.AppendText(pt);
DateTime creationTimeUtc = File.GetCreationTimeUtc(file);
DateTime lastWriteTimeUtc = File.GetLastWriteTimeUtc(file);
DateTime lastAccessTimeUtc = File.GetLastAccessTimeUtc(file);
Output.AppendText("creationTimeUtc: " + creationTimeUtc + "'n");
Output.AppendText("lastWriteTimeUtc: " + lastWriteTimeUtc + "'n");
Output.AppendText("lastAccessTimeUtc: " + lastAccessTimeUtc + "'n");
注册表:
//check for malware registry values
private void malwareRegCheck()
{
//lists of registries
List<string> hkey = new List<string>();
List<string> names = new List<string>();
//try
try
{
// Open HKEY_USERS
// on a remote computer.
string remoteName = host;
RegistryKey environmentKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, remoteName);
//put all hkey_user entries in list
foreach (string subKeyName in environmentKey.GetSubKeyNames())
{
//add SID to hkey list
hkey.Add(subKeyName);
}
//go through the list and enumerate each one
foreach (string sid in hkey)
{
//get the subkeys of each SID under hkey
RegistryKey sids = RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, remoteName).OpenSubKey(sid);
//for each id under hkey
foreach (string id in sids.GetSubKeyNames())
{
//create SID path and add to names list
string SIDpath = sid + "''" + id;
names.Add(SIDpath);
}
}
// Close the registry key.
environmentKey.Close();
//check if reg entry is whitelisted
foreach (string fname in names)
{
//create path to check
String fullPath = "''''" + host + "''" + fname;
//split file path in to parts
string[] folders = fname.Split('''');
//get length of array
int folderlen = folders.Length;
//folder is last element in array
string folder = folders[folderlen - 1];
//if folder is whitelisted
if ((xmlmalware2reg.Contains(folder)) || (folder.Length > 6))
{
//do nothing
}
//if folder is not whitelisted
else
{
//print out which folders are not whitelisted
string pt = System.String.Concat(fullPath + ", not whitelisted'n");
Output.AppendText(pt);
}
}
}
//catch all exceptions
catch
{
}
}
有一个Win32调用:RegQueryInfoKey
http://msdn.microsoft.com/en-us/library/ms724902%28VS.85%29.aspx
我不认为它在.NET中公开,所以您需要平台调用。使用RegistryKey中的SafeRegistryHandle。