Open-AudIT https://www.open-audit.org/phpBB3/ |
|
How To: Audit Custom Software Registry MultiString https://www.open-audit.org/phpBB3/viewtopic.php?f=5&t=3671 |
Page 1 of 1 |
Author: | cmendes0101 [ Fri May 28, 2010 6:55 am ] |
Post subject: | How To: Audit Custom Software Registry MultiString |
I just wanted to post this incase anyone is looking for this solution, since I couldn't find any with a search of this forum. This is an addon to the FAQ located here: viewtopic.php?f=6&t=3095 It does not list that a multistring registry value can be read. Here is how to do it. *Remember GetMultiStringValue returns an array* strKeyPath is our base key folder. szEngineVer is the registry key we want. display_name is what we will register the key's label as in our database. oReg.GetStringValue... pulls the string from the registry. If you are pulling a different data value (IE DWORD, Binary) then you will need to tweak this. Strings = GetSTRINGValue MultiString = GetMultiStringValue Dword = GetDWORDValue Binary = GetBINARYValue This is how to read the name of a Sysprep image: [code] 'Reg-Keys: Add CPR Image to the Software Register strKeyPath = "SYSTEM\Setup" strValueName = "OEMDuplicatorString" display_name = "CPR Image" oReg.GetMultiStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,regArray regValue = regArray(0) form_input = "software^^^" & display_name & "^^^" _ & regValue & "^^^" _ & "" & "^^^" _ & "" & "^^^" _ & OSInstall & "^^^" _ & "Company^^^^^^^^^^^^^^^^^^" _ & "" & "^^^" _ & "" & "^^^" _ & "http://www.company.com" & "^^^ " If regValue <> "" Then entry form_input,comment,objTextFile,oAdd,oComment End If form_input = "" regValue = ""[/code] I know that the desired value is in regArray(0). You can output the values of regArray to find its position. I added a if statement to not collect anything if there is no value since collecting null will just display an empty field and give me more empty fluff. Replace: [code] If regValue <> "" Then entry form_input,comment,objTextFile,oAdd,oComment End If[/code] With this: [code]entry form_input,comment,objTextFile,oAdd,oComment[/code] |
Page 1 of 1 | All times are UTC + 10 hours |
Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/ |