8 replies to this topic

[olegpov]

RegMulti,HKLM,Section,Key,DELETE,SubVal Not correctly deletes value if it one.

How to reproduce:
1.Write down in registry of PE system such value:
 2010_03_06_15_52_17.jpg   32.91KB   6 downloads
2. Try to execute this code:

[main]

Title=CodeBox test

Description=Running custom commands



[variables]



[process]



Hive_Load,System

If,EXISTREGMULTI,HKLM,%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318},UpperFilters,partmgr,begin

RegMulti,HKLM,%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318},UpperFilters,DELETE,partmgr

end

If,EXISTREGMULTI,HKLM,%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318},UpperFilters,partmgr,begin

RegMulti,HKLM,%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318},UpperFilters,DELETE,partmgr

end

Hive_Unload

And you receive such result:
 2010_03_06_15_48_35.jpg   19.13KB   10 downloads

[Lancelot]

nice finding olegpov ,

And you receive such result:

and loaded hive stuck (can not be unloaded with wb) . wb should be closed to unload hive .

well olegpov, new functions never tested (and test results ignored) since development asked us to test only the existant (before wb080) ones.

Since you find first, Here is "found born death syntax" award .

[pscEx]

@Olegpov!

I cannot reproduce your issue.

Try this simple snippet:

[process]

RegHiveLoad,WB-Software,%Target_sys%\config\software

RegWrite,HKLM,0x7,WB-Software\psc,Bla,hi,NOWARN

RegMulti,HKLM,WB-Software\psc,Bla,DELETE,hi

RegHiveUnLoad,WB-Software

It works as it should work.

If you comment the DELETE line and run, there is an 0x7 entry

If you uncomment the DELETE line and run, you get an "Empty" 0x7 value.

Can you check what's the difference in your constellation?

Peter

EDIT: I found it!

It is an issue of If,EXISTREGMULTI ...

[pecd.net]

great that you found it...

[olegpov]

@psc
Peter Try it:

RegHiveLoad,WB-Software,%Target_sys%\config\software

RegWrite,HKLM,0x7,WB-Software\psc,Bla,hi,NOWARN

RegMulti,HKLM,WB-Software\psc,Bla,DELETE,hi

RegMulti,HKLM,WB-Software\psc,Bla,DELETE,hi

RegHiveUnLoad,WB-Software

[Lancelot]

psc, try this

RegHiveLoad,WB-Software,%Target_sys%\config\software

RegWrite,HKLM,0x7,WB-Software\psc,Bla,hi,NOWARN

If,EXISTREGMULTI,HKLM,WB-Software\psc,bla,hi,Begin

RegMulti,HKLM,WB-Software\psc,Bla,DELETE,hi

End

RegHiveUnLoad,WB-Software

have fun

[pscEx]

Sorry!
I do not want to try anything because I told here that I SOLVED!

And maybe anywhen 'development' decides to publish the fix.

Currently it is not reasonable for me.
Here it works, but I do not have the time to test.

And Lancelote critisized correctly that untested versions should not be published.

When it is tested, I'll publish ASAP.

Peter

EDIT: @Olegpov: your sample works here ok

[Lancelot]

Sorry!
I do not want to try anything because I told here that I SOLVED!

you edit you solved probably after our posts.

anyway, happy ending is good....


@ctmag
Be carelfull ctmag, things could be replied delusional for some outsiders, but it should not be for you.

[pscEx]

Sometimes something crosses ...

And sometimes it seams to be reasonable to wait with comments "for some time" ...

Peter