Stupid Tricks with REG_BINARY Registry Data

  • Article

This is one of those 'duh' moments.  [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('HIVE', $computer).OpenSubKey($subKey) returns REG_BINARY data as an array of [byte]. 

To convert to [string]:

[string]::Join($null, ($regBinaryData | % { [char][int]$_; }));

Working from the inside out, we take the [byte[]] array and toss each one through a foreach loop.  Each $_ byte gets cast as [int], then re-cast as [char] (because [char] can cast [int], but PowerShell insists on treating [byte]65 as [string] for some reason.)  So we now have a [char[]] array.  Next, we use [string]::Join($delimiter, $array) to collapse it all into a single [string].

This actually gives away the punchline for the next problem I faced.  I needed to find the [array]::IndexOf() a given character.  Assuming the $regBinaryData contains the letter 'a', I tried the usual:

[array]::IndexOf($regBinaryData, 'a');

No luck.  Next, I tried casting it to [byte], but that didn't work.  Turns out, I had to first cast the [string] 'a' to [char], then to [byte].

[array]::UndexOf($regBinaryData, [byte][char]'a');

Like I said, "Duh" moments.