本帖最后由 邪恶海盗 于 2012-6-22 13:16 编辑 "ShowOpenPreview"=hex:01
"OpenDefFilter"=hex:00,00,00,00
"ShellViewAssoc"=hex:01
"ShellPrintAssoc"=hex:01
"ShellBrowseAssoc"=hex:01
"ImageHiliteClr"=hex:ff,ff,c8,00
"ImageHiliteClr8"=hex:ff,ff,00,00
"ViewerTBStyle"=hex:02
"PrintSetup"=hex:00,00,80,3f,00,00,80,3f,00,00,80,3f,00,00,80,3f,01,01,01,00,\
01,01,01,00,2c,01,00,00,9a,99,99,3f,00,00,c0,40,00,00,c0,40,00,00,80,3f,00,\
00,80,3f
这个某软件写入的注册表键值,导出为.reg,可以直接双击添加至注册表,
仔细观察发现貌似是2进制和16进制混合的,用Reg2Au3转换后不管2进制还是16进制都直接将上面的hex后的值直接原样调用了,
如:RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ShowOpenPreview","REG_BINARY",'01')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"OpenDefFilter","REG_BINARY",'00000000')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ShellViewAssoc","REG_BINARY",'01')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ShellPrintAssoc","REG_BINARY",'01')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ShellBrowseAssoc","REG_BINARY",'01')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ImageHiliteClr","REG_BINARY",'ffffc800')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ImageHiliteClr8","REG_BINARY",'ffff0000')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"ViewerTBStyle","REG_BINARY",'02')
RegWrite ('HKEY_LOCAL_MACHINE\SOFTWARE\XXX',"PrintSetup","REG_BINARY",'0000803f0000803f0000803f0000803f01010100010101002c0100009a99993f0000c0400000c0400000803f0000803f')
这样运行之后写入的数据部分会出错..
求高淫释疑... |