Code pages

AndrewRathbun · Feb 1, 2022 · 9656033 · 9656033
1 parent 302c6a7
commit 9656033
Show file tree

Hide file tree

Showing 9 changed files with 16 additions and 15 deletions.
diff --git a/.gitignore b/.gitignore
@@ -200,3 +200,4 @@ ModelManifest.xml
 /.vs/VSWorkspaceState.json
 /.vs/Registry/DesignTimeBuild/.dtbcache.v2
 /.vs/Registry/v17
+/.vs/Registry/FileContentIndex
diff --git a/Registry/Cells/LKCellRecord.cs b/Registry/Cells/LKCellRecord.cs
@@ -109,7 +109,7 @@ protected internal LkCellRecord(byte[] rawBytes, long relativeOffset)
 
         //  if (Flags.ToString().Contains(FlagEnum.CompressedName.ToString()))
         if ((Flags & FlagEnum.CompressedName) == FlagEnum.CompressedName)
-            Name = Encoding.GetEncoding(1252).GetString(rawBytes, 0x50, NameLength);
+            Name = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(rawBytes, 0x50, NameLength);
         else
             Name = Encoding.Unicode.GetString(rawBytes, 0x50, NameLength);
 

diff --git a/Registry/Cells/NKCellRecord.cs b/Registry/Cells/NKCellRecord.cs
@@ -148,13 +148,13 @@ public string Name
                 if (IsFree)
                 {
                     if (RawBytes.Length >= 0x50 + NameLength)
-                        name = Encoding.GetEncoding(1252).GetString(RawBytes, 0x50, NameLength);
+                        name = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(RawBytes, 0x50, NameLength);
                     else
                         name = "(Unable to determine name)";
                 }
                 else
                 {
-                    name = Encoding.GetEncoding(1252).GetString(RawBytes, 0x50, NameLength);
+                    name = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(RawBytes, 0x50, NameLength);
                 }
             }
             else
@@ -316,7 +316,7 @@ public byte[] RawBytes
 
     public long RelativeOffset { get; }
 
-    public string Signature => Encoding.GetEncoding(1252).GetString(RawBytes, 4, 2);
+    public string Signature => CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(RawBytes, 4, 2);
 
     public int Size => Math.Abs(BitConverter.ToInt32(RawBytes, 0));
 

diff --git a/Registry/Cells/VkCellRecord.cs b/Registry/Cells/VkCellRecord.cs
@@ -572,11 +572,11 @@ public string ValueName
                     {
                         //make sure we have enough data
                         if (RawBytes.Length >= NameLength + 0x18)
-                            valName = Encoding.GetEncoding(1252).GetString(RawBytes, 0x18, NameLength);
+                            valName = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(RawBytes, 0x18, NameLength);
                     }
                     else
                     {
-                        valName = Encoding.GetEncoding(1252).GetString(RawBytes, 0x18, NameLength);
+                        valName = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(RawBytes, 0x18, NameLength);
                     }
                 }
                 else

diff --git a/Registry/Lists/LxListRecord.cs b/Registry/Lists/LxListRecord.cs
@@ -55,7 +55,7 @@ public Dictionary<uint, string> Offsets
 
                 if (Signature == "lf")
                     //first 4 chars of string
-                    hash = Encoding.GetEncoding(1252).GetString(RawBytes, index, 4);
+                    hash = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(RawBytes, index, 4);
                 else
                     //numerical hash
                     hash = BitConverter.ToUInt32(RawBytes, index).ToString();

diff --git a/Registry/Registry.csproj b/Registry/Registry.csproj
@@ -11,7 +11,7 @@
         <Copyright>Eric Zimmerman</Copyright>
         <PackageProjectUrl>https://github.com/EricZimmerman/Registry</PackageProjectUrl>
         <RepositoryUrl>https://github.com/EricZimmerman/Registry</RepositoryUrl>
-        <Version>1.3.2.0</Version>
+        <Version>1.3.3.0</Version>
         <PackageLicenseExpression>MIT</PackageLicenseExpression>
     </PropertyGroup>
 

diff --git a/Registry/RegistryHive.cs b/Registry/RegistryHive.cs
@@ -1549,7 +1549,7 @@ public IEnumerable<SearchHit> FindInValueData(string searchTerm, bool useRegEx =
                     //this takes the raw bytes and converts it to a string, which we can then search
                     //the regex will find us the hit with exact capitalization, which we can then convert to a byte string
                     //and match against the raw data
-                    asAscii = Encoding.GetEncoding(1252).GetString(keyValue.ValueDataRaw);
+                    asAscii = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(keyValue.ValueDataRaw);
                     asUnicode = Encoding.Unicode.GetString(keyValue.ValueDataRaw);
 
                     var hitString = string.Empty;
@@ -1566,7 +1566,7 @@ public IEnumerable<SearchHit> FindInValueData(string searchTerm, bool useRegEx =
 
                     if (hitString.Length > 0)
                     {
-                        var asciihex = Encoding.GetEncoding(1252).GetBytes(hitString);
+                        var asciihex = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetBytes(hitString);
 
                         var asciiHit = BitConverter.ToString(asciihex);
                         yield return new SearchHit(registryKey.Value, keyValue, asciiHit, hitString,
@@ -1622,7 +1622,7 @@ public IEnumerable<SearchHit> FindInValueDataSlack(string searchTerm, bool useRe
                     //this takes the raw bytes and converts it to a string, which we can then search
                     //the regex will find us the hit with exact capitalization, which we can then convert to a byte string
                     //and match against the raw data
-                    var asAscii = Encoding.GetEncoding(1252).GetString(keyValue.ValueSlackRaw);
+                    var asAscii = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(keyValue.ValueSlackRaw);
                     var asUnicode = Encoding.Unicode.GetString(keyValue.ValueSlackRaw);
 
                     var hitString = string.Empty;
@@ -1637,7 +1637,7 @@ public IEnumerable<SearchHit> FindInValueDataSlack(string searchTerm, bool useRe
 
                     if (hitString.Length > 0)
                     {
-                        var asciihex = Encoding.GetEncoding(1252).GetBytes(hitString);
+                        var asciihex = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetBytes(hitString);
 
                         var asciiHit = BitConverter.ToString(asciihex);
                         yield return new SearchHit(registryKey.Value, keyValue, asciiHit, hitString,

diff --git a/Registry/TransactionLog.cs b/Registry/TransactionLog.cs
@@ -160,7 +160,7 @@ public bool ParseLog()
 
         while (index < FileBytes.Length)
         {
-            var sig = Encoding.GetEncoding(1252).GetString(FileBytes, index, 4);
+            var sig = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(FileBytes, index, 4);
 
             if (sig != "HvLE")
                 //things arent always HvLE as logs get reused, so check to see if we have another valid header at our current offset

diff --git a/Registry/TransactionLogEntry.cs b/Registry/TransactionLogEntry.cs
@@ -11,7 +11,7 @@ public class TransactionLogEntry
 
     public TransactionLogEntry(byte[] rawBytes)
     {
-        var sig = Encoding.GetEncoding(1252).GetString(rawBytes, 0, 4);
+        var sig = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(rawBytes, 0, 4);
 
         if (sig != "HvLE") throw new Exception("Data is not a transaction log entry (bad signature)");
 
@@ -63,7 +63,7 @@ public TransactionLogEntry(byte[] rawBytes)
 
         //should be sitting at hbin
 
-        var hbinsig = Encoding.GetEncoding(1252).GetString(rawBytes, index, 4);
+        var hbinsig = CodePagesEncodingProvider.Instance.GetEncoding(1252).GetString(rawBytes, index, 4);
 
         if (hbinsig != "hbin") throw new Exception($"hbin header not found at offset 0x{index}");