powershell - Powershell - 从注册表项转换十六进制

Question

我有来自 MRU 列表的以下输出。如何将其转换为字符串或 ASCII 字符？

'gp "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU"'

18 : {80, 0, 120, 0...}
5 : {50, 0, 109, 0...}

Answer 1

假如说gp "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU"

给出：

PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
PSChildName  : LastVisitedPidlMRU
PSDrive      : HKCU
PSProvider   : Microsoft.PowerShell.Core\Registry
MRUListEx    : {14, 0, 0, 0...}
11           : {114, 0, 117, 0...}
9            : {69, 0, 120, 0...}
19           : {83, 0, 107, 0...}
10           : {78, 0, 79, 0...}
17           : {123, 0, 57, 0...}
15           : {115, 0, 108, 0...}
7            : {123, 0, 57, 0...}
4            : {118, 0, 109, 0...}
21           : {109, 0, 115, 0...}
22           : {100, 0, 101, 0...}
24           : {123, 0, 55, 0...}
8            : {123, 0, 69, 0...}
0            : {123, 0, 69, 0...}
5            : {123, 0, 66, 0...}
12           : {83, 0, 110, 0...}
20           : {123, 0, 55, 0...}
23           : {83, 0, 99, 0...}
2            : {65, 0, 99, 0...}
16           : {110, 0, 111, 0...}
1            : {105, 0, 101, 0...}
18           : {75, 0, 105, 0...}
6            : {99, 0, 104, 0...}
13           : {123, 0, 55, 0...}
3            : {123, 0, 54, 0...}
14           : {123, 0, 57, 0...}

你可以试试：

[System.Text.Encoding]::Unicode.GetString((gp "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU")."11")

这不是很好，但它可以提供帮助

Answer 2

You can use the Get-RegistryKeyValue from the Carbon PowerShell module. It will return this key value as an array, which you can then decode:

$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU'
$result = Get-RegistryKeyValue -Path $path -Name 0
[System.Text.Encoding]::Unicode.GetString( $result )

But it looks like that registry value contains more than just text.

DISCLAIMER: I am the creator/maintainer of the Carbon module.

Answer 3

使用来自“嘿，脚本专家”的这个技巧！博客你可以做这样的事情：

$key = "HKCU:\Softw...dlMRU"
Get-Item $key | select -Expand property | % {
  $value = (Get-ItemProperty -Path $key -Name $_).$_
  [System.Text.Encoding]::Default.GetString($value)
}

请注意，这些值可能包含不可打印的字符，因此仅此还不够。您将不得不做一些额外的清理，例如通过附加-replace '[\x01-\x1F]'到GetString()调用。