c#注册表时间属性

本文关键字:属性 时间 注册表 | 更新日期: 2023-09-27 17:53:30

摘要:我能像处理文件和文件夹一样获得注册表的创建、修改和上次写入时间吗?

详细信息:我现在有我的代码设置来显示目录的3个时间属性,文件也是如此。我很想用我正在搜索的注册表值来做这件事。这可能吗?如果是,怎么办?

代码示例:以下是我正在使用的3个片段。下面的目录和文件标题只是我已经在工作的代码的示例,它可以完成我想做的一切。我只是想表明我知道如何获得这些属性。Registry段是我用来循环注册表项的经过净化的代码(如果你愿意,可以使用它;(,我希望在输出中添加时间属性。

目录:

//print out which folders are not whitelisted
string pt = System.String.Concat("'n" + dir, "'n");
Output.AppendText(pt);
DateTime creationTimeUtc = Directory.GetCreationTimeUtc(dir);
DateTime lastWriteTimeUtc = Directory.GetLastWriteTimeUtc(dir);
DateTime lastAccessTimeUtc = Directory.GetLastAccessTimeUtc(dir);
Output.AppendText("creationTimeUtc: " + creationTimeUtc + "'n");
Output.AppendText("lastWriteTimeUtc: " + lastWriteTimeUtc + "'n");
Output.AppendText("lastAccessTimeUtc: " + lastAccessTimeUtc + "'n");

文件:

//print out which folders are not whitelisted
string pt = System.String.Concat("'n" + file, "'n");
Output.AppendText(pt);
DateTime creationTimeUtc = File.GetCreationTimeUtc(file);
DateTime lastWriteTimeUtc = File.GetLastWriteTimeUtc(file);
DateTime lastAccessTimeUtc = File.GetLastAccessTimeUtc(file);
Output.AppendText("creationTimeUtc: " + creationTimeUtc + "'n");
Output.AppendText("lastWriteTimeUtc: " + lastWriteTimeUtc + "'n");
Output.AppendText("lastAccessTimeUtc: " + lastAccessTimeUtc + "'n");

注册表:

//check for malware registry values
private void malwareRegCheck()
{
    //lists of registries
    List<string> hkey = new List<string>();
    List<string> names = new List<string>();
    //try
    try
    {
        // Open HKEY_USERS
        // on a remote computer.
        string remoteName = host;
        RegistryKey environmentKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, remoteName);
        //put all hkey_user entries in list
        foreach (string subKeyName in environmentKey.GetSubKeyNames())
        {
            //add SID to hkey list
            hkey.Add(subKeyName);
        }
        //go through the list and enumerate each one
        foreach (string sid in hkey)
        {
            //get the subkeys of each SID under hkey
            RegistryKey sids = RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, remoteName).OpenSubKey(sid);
            //for each id under hkey
            foreach (string id in sids.GetSubKeyNames())
            {
                //create SID path and add to names list
                string SIDpath = sid + "''" + id;
                names.Add(SIDpath);
            }
        }
        // Close the registry key.
        environmentKey.Close();
        //check if reg entry is whitelisted
        foreach (string fname in names)
        {
            //create path to check
            String fullPath = "''''" + host + "''" + fname;
            //split file path in to parts
            string[] folders = fname.Split('''');
            //get length of array
            int folderlen = folders.Length;
            //folder is last element in array
            string folder = folders[folderlen - 1];
            //if folder is whitelisted
            if ((xmlmalware2reg.Contains(folder)) || (folder.Length > 6))
            {
                //do nothing 
            }
            //if folder is not whitelisted
            else
            {
                //print out which folders are not whitelisted
                string pt = System.String.Concat(fullPath + ", not whitelisted'n");
                Output.AppendText(pt);
            }
        }
    }
    //catch all exceptions
    catch
    {
    }
}

c#注册表时间属性

有一个Win32调用:RegQueryInfoKey

http://msdn.microsoft.com/en-us/library/ms724902%28VS.85%29.aspx

我不认为它在.NET中公开,所以您需要平台调用。使用RegistryKey中的SafeRegistryHandle。

这个问题没有答案。无法通过此方法收集注册表项的时间变量。