public ShellBag0X00(byte[] rawBytes)
{
_guids = new List<string>();
ShortName = string.Empty;
FriendlyName = "Variable";
PropertyStore = new PropertyStore();
ExtensionBlocks = new List<IExtensionBlock>();
// There are a few special cases for 0x00 items, so pull a special sig and see if we have one of those
var specialDataSig = BitConverter.ToUInt32(rawBytes, 4);
switch (specialDataSig)
{
case 0xc001b000: //00-B0-01-C0-
ProcessUrlContainer(rawBytes);
return;
case 0x49534647: // this is a game folder shell item “GFSI”
ProcessGameFolderShellItem(rawBytes);
return;
case 0xffffff38: // Control panel CPL file shell item
throw new Exception("Send this hive to [email protected] so support can be added!");
// return;
}
//if we are here this should be a users property view
var index = 0;
var shellItemSize = BitConverter.ToUInt16(rawBytes, index);
index += 2;
index += 1; // move past signature
index += 1; // move past unknown
var dataSize = BitConverter.ToUInt16(rawBytes, index);
index += 2;
// SiAuto.Main.LogMessage("dataSize: {0}", dataSize);
var dataSig = BitConverter.ToUInt32(rawBytes, index);
index += 4;
// SiAuto.Main.LogMessage("dataSig: {0:X}", dataSig);
var identifierSize = BitConverter.ToUInt16(rawBytes, index);
index += 2;
// SiAuto.Main.LogMessage("identifierSize: {0}", identifierSize);
switch (dataSig)
{
case 0x00030005:
case 0x00000005:
ProcessFtpSubItem(rawBytes);
break;
case 0x23febbee:
ProcessPropertyViewGuid(rawBytes);
return;
case 0x10312005:
ProcessMtpType2(rawBytes);
return;
case 0x00:
//this is the contents of a zip file?
ProcessZipFileContents(rawBytes);
return;
case 0x7192006:
ProcessMtpType1(rawBytes);
return;
default: // includes known 0xbeebee00
if (rawBytes.Length <= 0x64)
{
FriendlyName = "Server name";
Value = Encoding.Unicode.GetString(rawBytes, 6, rawBytes.Length - 6).Replace("\0", string.Empty);
}
else
{
ProcessPropertyViewDefault(rawBytes);
}
break;
}
}