public static RegChange ReadFromStream(Stream fs)
{
RegChange tempReg = new RegChange();
bool isBinaryString = false;
byte bType = (byte)fs.ReadByte();
//read until the end byte is detected
while (!ReadFiles.ReachedEndByte(fs, bType, 0x9E))
{
switch (bType)
{
case 0x01: //RegOperation
tempReg.RegOperation = (RegOperations)ReadFiles.ReadInt(fs);
break;
case 0x02: //load basekey
tempReg.RegBasekey = (RegBasekeys)ReadFiles.ReadInt(fs);
break;
case 0x03: //load valuekind
tempReg.RegValueKind = (RegistryValueKind)ReadFiles.ReadInt(fs);
break;
case 0x04: //subkey
tempReg.SubKey = ReadFiles.ReadDeprecatedString(fs);
break;
case 0x05: //value name
tempReg.ValueName = ReadFiles.ReadDeprecatedString(fs);
break;
case 0x06: //Depreciated: Use 0x07. All 0x06 will be converted to a string "ValueKind"
if (tempReg.RegValueKind != RegistryValueKind.ExpandString &&
tempReg.RegValueKind != RegistryValueKind.String)
{
//Read in the entry,if it's
tempReg.RegValueKind = RegistryValueKind.String;
}
tempReg.ValueData = ReadFiles.ReadDeprecatedString(fs);
break;
case 0x80:
isBinaryString = true;
break;
case 0x81:
tempReg.Is32BitKey = true;
break;
case 0x07: //Value data
switch (tempReg.RegValueKind)
{
case RegistryValueKind.Binary:
if (isBinaryString)
{
tempReg.ValueData = ReadFiles.ReadDeprecatedString(fs);
}
else
{
tempReg.ValueData = ReadFiles.ReadByteArray(fs);
}
break;
case RegistryValueKind.DWord:
tempReg.ValueData = ReadFiles.ReadInt(fs);
break;
case RegistryValueKind.QWord:
tempReg.ValueData = ReadFiles.ReadLong(fs);
break;
case RegistryValueKind.ExpandString:
case RegistryValueKind.MultiString:
case RegistryValueKind.String:
tempReg.ValueData = ReadFiles.ReadDeprecatedString(fs);
break;
}
break;
default:
ReadFiles.SkipField(fs, bType);
break;
}
bType = (byte)fs.ReadByte();
}
return(tempReg);
}