powershellregistryhexdumputf-16le

Powershell Reg Multi_SZ into String ( Export / Import Scenario )

Need your help :). Im trying to convert Roger Zanders wonderful Reg2PS into my own Powershell script which i want to use in Intune for some comfortable Registry configs. Greetings at this point to RZ! https://reg2ps.azurewebsites.net/

I found his code here: https://github.com/rzander/Reg2CI/blob/master/Source/REG2PS/RegClass.cs

Relevant Codepart in this topic:

if (DataType == ValueType.MultiString)
{
//return Encoding.UTF8.GetString(Encoding.Unicode.GetBytes(_value.Replace("hex(7):", "").Replace(" ", "")));
string[] aHex = _value.Replace("hex(7):", "").Replace(" ", "").Split(',');
List<byte> bRes = new List<byte>();

foreach (string sVal in aHex)
{
bRes.Add(Convert.ToByte(sVal, 16));
}

string sResult = Encoding.Unicode.GetString(bRes.ToArray());
_svalue = "\"" + string.Join(",", sResult.TrimEnd('\0').Split('\0')) + "\"";
return sResult.TrimEnd('\0').Split('\0');
}

So after some other people tried to translate it or write it by there own, i recognize that Roger did it overall better with Multi_SZ (Whitespaces, "", and so on).

Therefore im fine with every Type but struggle at the Multi_SZ like so many.

I export a Registry Multi_SZ with Reg.exe.

Example:

$PlainValue = '"MultiStringProperty"=hex(7):56,00,61,00,6c,00,75,00,65,00,31,00,00,00,56,00,\61,00,6c,00,75,00,65,00,32,00,00,00,56,00,61,00,6c,00,75,00,65,00,33,00,00,\00,00,00'

# Get the Value itself  
$Value = $PlainValue.Split("=")[1]

 # Remove Hex Descrioption
$Value = $Value.Replace( "hex(7):","" )

# Learned from a HEX to UTF16 Converter the "\" is just ja reg.exe thing to shortening the Line in the File -> Remove!
$Value = $Value.Replace("\","")

And now the Problem begins. What worked for me is for Example:

$Value1 = $Value -split (",") | % { [INT]"0x$_" }
$Value1 = [Text.Encoding]::Unicode.GetString($Value1)

$Value2 = $Value -split (",") | % { [char][byte]"0x$_" }
$Value2 = $Value2 -join ''

My target is to have a final format of an String as: @("Value1","Value2","Value3")

Problem: The String i got in $Value1 or $Value2 isnt recognizing to .split(" ").

If i split before like:

# Splitting Hex Spaces
$Separator = ",00,00,00,"
$ArrValues = $Value -split $separator
$TempValues = @()
ForEach( $Val in $ArrValues )
{
     $Temp = $Val -split (",") | % { [INT]"0x$_" }
     [Text.Encoding]::Unicode.GetString($Temp)
     $TempValues += [Text.Encoding]::Unicode.GetString($Temp) 
}

Then PS has Problems to convert the Digits ...

Do i have some understanding problems or has powershell problems to convert the array? Im trying to find a better separation instead of 00,00,00 in the mean....

Please correct me but as i know in REG_Multi_SZ there is no witespace within the value allowed right?

Solution

  • I suggest a different approach based on -replace, the regular-expression-based string replacement operator, in combination with -split (which is by default also regex-based), which is both more concise and efficient:

    # Convert the hex string to a byte array.
[byte[]] $bytes = 
  $plainValue -replace '^.+=hex\(7\):|\\' -split ',' -replace '^', '0x'

# Interpret the byte array as a Unicode string, remove the trailing NULLs,
# and split the result into individual strings by NULL
$strings = 
  [Text.Encoding]::Unicode.GetString($bytes).TrimEnd("`0") -split "`0"

    Note:

    As for what you tried: