@@ -1544,11 +1544,10 @@ private void ModificationAdded(RegistryTraceData registryTraceData) {
1544
1544
//if (!modificationsElement.ElementInformation.IsPresent) {
1545
1545
//return;
1546
1546
//}
1547
-
1548
- // comparable names, since registry key/value names shouldn't have null bytes in them according to Win32
1547
+
1549
1548
RegistryStateElement registryStateElement = new RegistryStateElement {
1550
- KeyName = GetComparableName ( registryTraceData . KeyName ) ,
1551
- ValueName = GetComparableName ( registryTraceData . ValueName )
1549
+ KeyName = registryTraceData . KeyName ,
1550
+ ValueName = registryTraceData . ValueName
1552
1551
} ;
1553
1552
1554
1553
// KeyHandle is meant to be a uint32, so we discard the rest
@@ -1741,8 +1740,8 @@ private void ModificationRemoved(RegistryTraceData registryTraceData) {
1741
1740
1742
1741
// create filler element to get name
1743
1742
RegistryStateElement registryStateElement = new RegistryStateElement {
1744
- KeyName = GetComparableName ( registryTraceData . KeyName ) ,
1745
- ValueName = GetComparableName ( registryTraceData . ValueName )
1743
+ KeyName = registryTraceData . KeyName ,
1744
+ ValueName = registryTraceData . ValueName
1746
1745
} ;
1747
1746
1748
1747
ulong safeKeyHandle = registryTraceData . KeyHandle & 0x00000000FFFFFFFF ;
@@ -1796,7 +1795,7 @@ private void KCBStarted(RegistryTraceData registryTraceData) {
1796
1795
kcbModificationKeyNames = new Dictionary < ulong , string > ( ) ;
1797
1796
}
1798
1797
1799
- kcbModificationKeyNames [ safeKeyHandle ] = GetComparableName ( registryTraceData . KeyName ) ;
1798
+ kcbModificationKeyNames [ safeKeyHandle ] = registryTraceData . KeyName ;
1800
1799
}
1801
1800
1802
1801
private void KCBStopped ( RegistryTraceData registryTraceData ) {
@@ -1855,7 +1854,7 @@ private void KCBStopped(RegistryTraceData registryTraceData) {
1855
1854
registryStateElement = registryStateElements [ j ] ;
1856
1855
1857
1856
keyName = GetRedirectedKeyValueName (
1858
- GetKeyValueNameFromKernelRegistryString ( GetComparableName ( registryTraceData . KeyName ) + "\\ " + registryStateElement . KeyName ) ,
1857
+ GetKeyValueNameFromKernelRegistryString ( registryTraceData . KeyName + "\\ " + registryStateElement . KeyName ) ,
1859
1858
modificationsElement . RegistryStates . BinaryType
1860
1859
) ;
1861
1860
0 commit comments