| 1 | // Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. |
| 2 | |
| 3 | #if NETFRAMEWORK |
| 4 | using System; |
| 5 | using System.Collections.Generic; |
| 6 | using System.Diagnostics; |
| 7 | using System.IO; |
| 8 | using System.Management; |
| 9 | using Microsoft.Win32; |
| 10 | |
| 11 | namespace TestExe |
| 12 | { |
| 13 | public class ProcessInfoTask : Task |
| 14 | { |
| 15 | public ProcessInfoTask(string Data) : base(Data) { } |
| 16 | |
| 17 | public override void RunTask() |
| 18 | { |
| 19 | try |
| 20 | { |
| 21 | string processInfoXml = ""; |
| 22 | |
| 23 | // Get information about the process and who is running it |
| 24 | Process thisProc = Process.GetCurrentProcess(); |
| 25 | string username = thisProc.StartInfo.EnvironmentVariables["username"].ToString(); |
| 26 | |
| 27 | int parentProcId = GetParentProcess(thisProc.Id); |
| 28 | Process parentProc = Process.GetProcessById(parentProcId); |
| 29 | string parentUsername = parentProc.StartInfo.EnvironmentVariables["username"].ToString(); |
| 30 | |
| 31 | int grandparentProcId = GetParentProcess(parentProc.Id); |
| 32 | Process grandparentProc = Process.GetProcessById(grandparentProcId); |
| 33 | string grandparentUsername = grandparentProc.StartInfo.EnvironmentVariables["username"].ToString(); |
| 34 | |
| 35 | processInfoXml += "<ProcessInfo>"; |
| 36 | processInfoXml += " <ProcessName>" + thisProc.ProcessName + "</ProcessName>"; |
| 37 | processInfoXml += " <Id>" + thisProc.Id.ToString() + "</Id>"; |
| 38 | processInfoXml += " <SessionId>" + thisProc.SessionId.ToString() + "</SessionId>"; |
| 39 | processInfoXml += " <MachineName>" + thisProc.MachineName + "</MachineName>"; |
| 40 | // this stuff isn't set since we didn't start the process and tell it what to use. So don't bother |
| 41 | //processInfoXml += " <StartInfo>"; |
| 42 | //processInfoXml += " <FileName>" + thisProc.StartInfo.FileName + "</FileName>"; |
| 43 | //processInfoXml += " <UserName>" + thisProc.StartInfo.UserName + "</UserName>"; |
| 44 | //processInfoXml += " <WorkingDirectory>" + thisProc.StartInfo.WorkingDirectory + "</WorkingDirectory>"; |
| 45 | //processInfoXml += " <Arguments>" + thisProc.StartInfo.Arguments + "</Arguments>"; |
| 46 | //processInfoXml += " </StartInfo>"; |
| 47 | processInfoXml += " <StartTime>" + thisProc.StartTime.ToString() + "</StartTime>"; |
| 48 | processInfoXml += " <Username>" + username + "</Username>"; |
| 49 | processInfoXml += " <ParentProcess>"; |
| 50 | processInfoXml += " <ProcessName>" + parentProc.ProcessName + "</ProcessName>"; |
| 51 | processInfoXml += " <Id>" + parentProc.Id.ToString() + "</Id>"; |
| 52 | processInfoXml += " <StartTime>" + parentProc.StartTime.ToString() + "</StartTime>"; |
| 53 | processInfoXml += " <Username>" + parentUsername + "</Username>"; |
| 54 | processInfoXml += " </ParentProcess>"; |
| 55 | processInfoXml += " <GrandparentProcess>"; |
| 56 | processInfoXml += " <ProcessName>" + grandparentProc.ProcessName + "</ProcessName>"; |
| 57 | processInfoXml += " <Id>" + grandparentProc.Id.ToString() + "</Id>"; |
| 58 | processInfoXml += " <StartTime>" + grandparentProc.StartTime.ToString() + "</StartTime>"; |
| 59 | processInfoXml += " <Username>" + grandparentUsername + "</Username>"; |
| 60 | processInfoXml += " </GrandparentProcess>"; |
| 61 | processInfoXml += "</ProcessInfo>"; |
| 62 | |
| 63 | string logFile = System.Environment.ExpandEnvironmentVariables(this.data); |
| 64 | Console.WriteLine("Creating Process Info data file: " + logFile); |
| 65 | StreamWriter textFile = File.CreateText(logFile); |
| 66 | textFile.WriteLine(processInfoXml); |
| 67 | textFile.Close(); |
| 68 | } |
| 69 | catch (Exception eX) |
| 70 | { |
| 71 | Console.WriteLine("Creating Process Info data file failed"); |
| 72 | Console.WriteLine(eX.Message); |
| 73 | } |
| 74 | |
| 75 | |
| 76 | } |
| 77 | |
| 78 | private static int GetParentProcess(int Id) |
| 79 | { |
| 80 | int parentPid = 0; |
| 81 | using (ManagementObject mo = new ManagementObject("win32_process.handle='" + Id.ToString() + "'")) |
| 82 | { |
| 83 | mo.Get(); |
| 84 | parentPid = Convert.ToInt32(mo["ParentProcessId"]); |
| 85 | } |
| 86 | return parentPid; |
| 87 | } |
| 88 | } |
| 89 | |
| 90 | /// <summary> |
| 91 | /// Task class that will create a registry key and write a name and value in it |
| 92 | /// </summary> |
| 93 | public class RegistryWriterTask : Task |
| 94 | { |
| 95 | private string hive; |
| 96 | private string keyPath; |
| 97 | private string[] keyPathArray; |
| 98 | private string name; |
| 99 | private RegistryValueKind regValueKind; |
| 100 | private object value; |
| 101 | |
| 102 | public RegistryWriterTask(string Data) : base(Data) { } |
| 103 | |
| 104 | public override void RunTask() |
| 105 | { |
| 106 | if (this.parseRegKeyNameTypeValue(System.Environment.ExpandEnvironmentVariables(this.data))) |
| 107 | { |
| 108 | RegistryKey rk = Registry.LocalMachine; |
| 109 | |
| 110 | if (this.hive == "HKCU") { rk = Microsoft.Win32.Registry.CurrentUser; } |
| 111 | if (this.hive == "HKCC") { rk = Microsoft.Win32.Registry.CurrentConfig; } |
| 112 | if (this.hive == "HKLM") { rk = Microsoft.Win32.Registry.LocalMachine; } |
| 113 | |
| 114 | foreach (string key in this.keyPathArray) |
| 115 | { |
| 116 | rk = rk.CreateSubKey(key, RegistryKeyPermissionCheck.ReadWriteSubTree); |
| 117 | } |
| 118 | |
| 119 | rk.SetValue(this.name, this.value, this.regValueKind); |
| 120 | Console.WriteLine("Created registry key: '{0}' name: '{1}' value: '{2}' of type: '{3}'", |
| 121 | this.hive + "\\" + this.keyPath, |
| 122 | this.name, |
| 123 | this.value.ToString(), |
| 124 | this.regValueKind.ToString()); |
| 125 | } |
| 126 | else |
| 127 | { |
| 128 | Console.WriteLine("Unable to write registry key."); |
| 129 | } |
| 130 | |
| 131 | } |
| 132 | |
| 133 | private bool parseRegKeyNameTypeValue(string delimittedData) |
| 134 | { |
| 135 | string[] splitString = delimittedData.Split(new string[] { "," }, StringSplitOptions.None); |
| 136 | if (splitString.Length != 4) |
| 137 | { |
| 138 | Console.WriteLine("Invalid regkey. Unable to parse key,name,type,value from: \"" + delimittedData + "\""); |
| 139 | return false; |
| 140 | } |
| 141 | else |
| 142 | { |
| 143 | this.keyPath = splitString[0]; |
| 144 | this.name = splitString[1]; |
| 145 | string datatype = splitString[2]; |
| 146 | if (datatype == "DWord") |
| 147 | { |
| 148 | this.value = UInt32.Parse(splitString[3]); |
| 149 | } |
| 150 | else if (datatype == "QWord") |
| 151 | { |
| 152 | this.value = UInt64.Parse(splitString[3]); |
| 153 | } |
| 154 | else |
| 155 | { |
| 156 | this.value = splitString[3]; |
| 157 | } |
| 158 | |
| 159 | if (this.keyPath.ToUpper().StartsWith("HKLM\\")) |
| 160 | { |
| 161 | this.hive = "HKLM"; |
| 162 | this.keyPath = this.keyPath.Replace("HKLM\\", ""); |
| 163 | } |
| 164 | else if (this.keyPath.ToUpper().StartsWith("HKCC\\")) |
| 165 | { |
| 166 | this.hive = "HKCC"; |
| 167 | this.keyPath = this.keyPath.Replace("HKCC\\", ""); |
| 168 | } |
| 169 | else if (this.keyPath.ToUpper().StartsWith("HKCU\\")) |
| 170 | { |
| 171 | this.hive = "HKCU"; |
| 172 | this.keyPath = this.keyPath.Replace("HKCU\\", ""); |
| 173 | } |
| 174 | else |
| 175 | { |
| 176 | Console.WriteLine("Invalid regkey. Unable to determin hive. regkey must start with either: [HKLM], [HKCU], or [HKCC]"); |
| 177 | return false; |
| 178 | } |
| 179 | this.keyPathArray = this.keyPath.Split(new string[] { "\\" }, StringSplitOptions.None); |
| 180 | |
| 181 | try |
| 182 | { |
| 183 | this.regValueKind = (RegistryValueKind)System.Enum.Parse(typeof(RegistryValueKind), datatype); |
| 184 | } |
| 185 | catch (Exception ex) |
| 186 | { |
| 187 | Console.WriteLine("Invalid datatype. It must be: String, DWord, or QWord (case sensitive)"); |
| 188 | Console.WriteLine(ex.Message); |
| 189 | return false; |
| 190 | } |
| 191 | } |
| 192 | return true; |
| 193 | } |
| 194 | } |
| 195 | |
| 196 | /// <summary> |
| 197 | /// Task class that will delete a registry key value or registry key and all of its children |
| 198 | /// </summary> |
| 199 | public class RegistryDeleterTask : Task |
| 200 | { |
| 201 | private string hive; |
| 202 | private string keyPath; |
| 203 | private string[] keyPathArray; |
| 204 | private string name; |
| 205 | |
| 206 | public RegistryDeleterTask(string Data) : base(Data) { } |
| 207 | |
| 208 | public override void RunTask() |
| 209 | { |
| 210 | if (this.parseRegKeyName(System.Environment.ExpandEnvironmentVariables(this.data))) |
| 211 | { |
| 212 | try |
| 213 | { |
| 214 | RegistryKey rk = Registry.LocalMachine; |
| 215 | |
| 216 | if (this.hive == "HKCU") { rk = Microsoft.Win32.Registry.CurrentUser; } |
| 217 | if (this.hive == "HKCC") { rk = Microsoft.Win32.Registry.CurrentConfig; } |
| 218 | if (this.hive == "HKLM") { rk = Microsoft.Win32.Registry.LocalMachine; } |
| 219 | |
| 220 | RegistryKey rkParent = null; |
| 221 | foreach (string key in this.keyPathArray) |
| 222 | { |
| 223 | rkParent = rk; |
| 224 | rk = rk.OpenSubKey(key, true); |
| 225 | } |
| 226 | |
| 227 | if (String.IsNullOrEmpty(this.name)) |
| 228 | { |
| 229 | // delete the key and all of its children |
| 230 | string subkeyToDelete = this.keyPathArray[this.keyPathArray.Length - 1]; |
| 231 | rkParent.DeleteSubKeyTree(subkeyToDelete); |
| 232 | Console.WriteLine("Deleted registry key: '{0}'", this.hive + "\\" + this.keyPath); |
| 233 | } |
| 234 | else |
| 235 | { |
| 236 | // just delete this value |
| 237 | rk.DeleteValue(this.name); |
| 238 | Console.WriteLine("Deleted registry key: '{0}' name: '{1}'", this.hive + "\\" + this.keyPath, this.name); |
| 239 | } |
| 240 | } |
| 241 | catch (Exception ex) |
| 242 | { |
| 243 | Console.WriteLine("Unable to delete registry key: '{0}'", this.hive + "\\" + this.keyPath); |
| 244 | Console.WriteLine(ex.Message); |
| 245 | } |
| 246 | } |
| 247 | else |
| 248 | { |
| 249 | Console.WriteLine("Unable to delete registry key."); |
| 250 | } |
| 251 | |
| 252 | } |
| 253 | |
| 254 | private bool parseRegKeyName(string delimittedData) |
| 255 | { |
| 256 | string[] splitString = delimittedData.Split(new string[] { "," }, StringSplitOptions.None); |
| 257 | |
| 258 | if (splitString.Length > 2) |
| 259 | { |
| 260 | Console.WriteLine("Unable to parse registry key and name."); |
| 261 | return false; |
| 262 | } |
| 263 | |
| 264 | this.keyPath = splitString[0]; |
| 265 | if (splitString.Length == 2) |
| 266 | { |
| 267 | this.name = splitString[1]; |
| 268 | } |
| 269 | |
| 270 | if (this.keyPath.ToUpper().StartsWith("HKLM\\")) |
| 271 | { |
| 272 | this.hive = "HKLM"; |
| 273 | this.keyPath = this.keyPath.Replace("HKLM\\", ""); |
| 274 | } |
| 275 | else if (this.keyPath.ToUpper().StartsWith("HKCC\\")) |
| 276 | { |
| 277 | this.hive = "HKCC"; |
| 278 | this.keyPath = this.keyPath.Replace("HKCC\\", ""); |
| 279 | } |
| 280 | else if (this.keyPath.ToUpper().StartsWith("HKCU\\")) |
| 281 | { |
| 282 | this.hive = "HKCU"; |
| 283 | this.keyPath = this.keyPath.Replace("HKCU\\", ""); |
| 284 | } |
| 285 | else |
| 286 | { |
| 287 | Console.WriteLine("Invalid regkey. Unable to determine hive. regkey must start with either: [HKLM], [HKCU], or [HKCC]"); |
| 288 | return false; |
| 289 | } |
| 290 | this.keyPathArray = this.keyPath.Split(new string[] { "\\" }, StringSplitOptions.None); |
| 291 | return true; |
| 292 | } |
| 293 | } |
| 294 | } |
| 295 | #endif |