Powershell - converting hex from the registry key

Question

I have the following output from an MRU list. How can I convert it to String or ASCII characters?

'gp "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRU"'

18 : {80, 0, 120, 0...}
5 : {50, 0, 109, 0...}

Answer 1

Assuming that gp "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRU"

gives :

PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
PSChildName  : LastVisitedPidlMRU
PSDrive      : HKCU
PSProvider   : Microsoft.PowerShell.Core\Registry
MRUListEx    : {14, 0, 0, 0...}
11           : {114, 0, 117, 0...}
9            : {69, 0, 120, 0...}
19           : {83, 0, 107, 0...}
10           : {78, 0, 79, 0...}
17           : {123, 0, 57, 0...}
15           : {115, 0, 108, 0...}
7            : {123, 0, 57, 0...}
4            : {118, 0, 109, 0...}
21           : {109, 0, 115, 0...}
22           : {100, 0, 101, 0...}
24           : {123, 0, 55, 0...}
8            : {123, 0, 69, 0...}
0            : {123, 0, 69, 0...}
5            : {123, 0, 66, 0...}
12           : {83, 0, 110, 0...}
20           : {123, 0, 55, 0...}
23           : {83, 0, 99, 0...}
2            : {65, 0, 99, 0...}
16           : {110, 0, 111, 0...}
1            : {105, 0, 101, 0...}
18           : {75, 0, 105, 0...}
6            : {99, 0, 104, 0...}
13           : {123, 0, 55, 0...}
3            : {123, 0, 54, 0...}
14           : {123, 0, 57, 0...}

You can try:

[System.Text.Encoding]::Unicode.GetString((gp "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU")."11")

This not very good, but it can help

Answer 2

You can use the Get-RegistryKeyValue from the Carbon PowerShell module. It will return this key value as an array, which you can then decode:

$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU'
$result = Get-RegistryKeyValue -Path $path -Name 0
[System.Text.Encoding]::Unicode.GetString( $result )

But it looks like that registry value contains more than just text.

DISCLAIMER : I am the creator/maintainer of the Carbon module.

Answer 3

Using this tip from the Hey, Scripting Guy! blog you could do something like this:

$key = "HKCU:\Softw...dlMRU"
Get-Item $key | select -Expand property | % {
  $value = (Get-ItemProperty -Path $key -Name $_).$_
  [System.Text.Encoding]::Default.GetString($value)
}

Note that the values probably contain non-printable characters, so that alone won't suffice. You'll have to do some additional cleanup, eg by appending -replace '[\\x01-\\x1F]' to the GetString() call.