Powershell - convert hex from registry key

Question

I have the following output from an MRU list. How can I convert it to String or ASCII characters?

'gp "HKCU: \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ ComDlg32 \ LastVisitedPidlMRU"

18: {80, 0, 120, 0 ...}
5: {50, 0, 109, 0 ...}

Answer 1

Assuming gp "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU"

gives:

 PSPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32 PSChildName : LastVisitedPidlMRU PSDrive : HKCU PSProvider : Microsoft.PowerShell.Core\Registry MRUListEx : {14, 0, 0, 0...} 11 : {114, 0, 117, 0...} 9 : {69, 0, 120, 0...} 19 : {83, 0, 107, 0...} 10 : {78, 0, 79, 0...} 17 : {123, 0, 57, 0...} 15 : {115, 0, 108, 0...} 7 : {123, 0, 57, 0...} 4 : {118, 0, 109, 0...} 21 : {109, 0, 115, 0...} 22 : {100, 0, 101, 0...} 24 : {123, 0, 55, 0...} 8 : {123, 0, 69, 0...} 0 : {123, 0, 69, 0...} 5 : {123, 0, 66, 0...} 12 : {83, 0, 110, 0...} 20 : {123, 0, 55, 0...} 23 : {83, 0, 99, 0...} 2 : {65, 0, 99, 0...} 16 : {110, 0, 111, 0...} 1 : {105, 0, 101, 0...} 18 : {75, 0, 105, 0...} 6 : {99, 0, 104, 0...} 13 : {123, 0, 55, 0...} 3 : {123, 0, 54, 0...} 14 : {123, 0, 57, 0...} 

You can try:

 [System.Text.Encoding]::Unicode.GetString((gp "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU")."11") 

This is not very good, but it can help.

Answer 2

You can use Get-RegistryKeyValue from the Carbon PowerShell module. It will return this key value as an array, which can then be decoded:

 $path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU' $result = Get-RegistryKeyValue -Path $path -Name 0 [System.Text.Encoding]::Unicode.GetString( $result ) 

But it looks like this registry value contains more than just text.

DISCLAIMER: I am the creator / supporter of the Carbon module.

Answer 3

Using this advice from Hey Scriptwriter! blog, you can do something like this:

 $key = "HKCU:\Softw...dlMRU" Get-Item $key | select -Expand property | % { $value = (Get-ItemProperty -Path $key -Name $_).$_ [System.Text.Encoding]::Default.GetString($value) } 

Please note that the values ​​probably contain non-printable characters, so this will not be enough. You will need to perform additional cleaning, for example. adding -replace '[\x01-\x1F]' to the call to GetString() .