Windows Registry Rekursiv auslesen

[TKC]

so habe ich das mal gemacht ... benötigt aber die JCL für Registry Binär Daten.

Delphi-Quellcode:

function TfrmMain.ReadKeyToString(hkRoot: HKEY; sPath: string; sName: string; bForBartPE: Boolean = True): string;
var
  reg                         : TRegistry;
  sl                          : TStringList;
  x                           : Integer;
  rgdt                        : Cardinal;
  sRegType                    : string;
  Buff                        : array[0..1023] of Byte;
  Size                        : Cardinal;

begin
  sl := TStringList.Create;
  Result := '';

  reg := TRegistry.Create(KEY_READ);
  reg.RootKey := hkRoot;
  reg.OpenKeyReadOnly(sPath);

  RegGetDataType(hkRoot, sPath, sName, rgdt);
  case rgdt of
    REG_SZ:
      begin
        sRegType := KeyTypeToStr(rgdt, bForBartPE);
        if bForBartPE then
          Result := '"' + reg.ReadString(sName) + '"'
        else
          Result := reg.ReadString(sName);
      end;

    REG_EXPAND_SZ:
      begin
        sRegType := KeyTypeToStr(rgdt, bForBartPE);
        if bForBartPE then
          Result := '"' + reg.ReadString(sName) + '"'
        else
          Result := reg.ReadString(sName);
      end;

    REG_DWORD:
      begin
        sRegType := KeyTypeToStr(rgdt, bForBartPE);
        if bForBartPE then
          Result := '0x' + IntToHex(reg.ReadInteger(sName), 1)
        else
          Result := '0x' + IntToHex(reg.ReadInteger(sName), 1) + ' (' + IntToStr(reg.ReadInteger(sName)) + ')';
      end;

    REG_MULTI_SZ:
      begin
        sRegType := KeyTypeToStr(rgdt, bForBartPE);

        RegReadMultiSz(hkRoot, sPath, sName, sl);

        for x := 0 to sl.Count - 1 do
          begin
            if bForBartPE then
              Result := Result + '"' + sl[x] + '",'
            else
              Result := Result + sl[x] + ',';
          end;
        Result := StrLeft(Result, Length(Result) - 1);
      end;

    REG_BINARY:
      begin
        sRegType := KeyTypeToStr(rgdt, bForBartPE);

        ZeroMemory(@Buff, SizeOf(Buff));
        RegGetDataSize(hkRoot, sPath, sName, Size);
        RegReadBinary(hkRoot, sPath, sName, Buff, Size);

        if (bForBartPE) and (Size > 50) then Result := Result + '\'#13#10;

        for x := 1 to Size do
          begin
            if bForBartPE then
              begin
                Result := Result + IntToHex(Buff[x - 1], 2) + ',';
                if ((x mod 50) = 0) and (x < Integer(Size)) then
                  Result := Result + '\'#13#10;
              end
            else
              Result := Result + IntToHex(Buff[x], 2) + ' ';
          end;

        Result := StrLeft(Result, Length(Result) - 1);
      end;

    REG_NONE: sRegType := KeyTypeToStr(rgdt, bForBartPE);
    else
      Result := '!UNKNOWN!';
  end;

  reg.CloseKey;
  reg.Free;

end;