@@ -1544,11 +1544,10 @@ private void ModificationAdded(RegistryTraceData registryTraceData) {
15441544 //if (!modificationsElement.ElementInformation.IsPresent) {
15451545 //return;
15461546 //}
1547-
1548- // comparable names, since registry key/value names shouldn't have null bytes in them according to Win32
1547+
15491548 RegistryStateElement registryStateElement = new RegistryStateElement {
1550- KeyName = GetComparableName ( registryTraceData . KeyName ) ,
1551- ValueName = GetComparableName ( registryTraceData . ValueName )
1549+ KeyName = registryTraceData . KeyName ,
1550+ ValueName = registryTraceData . ValueName
15521551 } ;
15531552
15541553 // KeyHandle is meant to be a uint32, so we discard the rest
@@ -1741,8 +1740,8 @@ private void ModificationRemoved(RegistryTraceData registryTraceData) {
17411740
17421741 // create filler element to get name
17431742 RegistryStateElement registryStateElement = new RegistryStateElement {
1744- KeyName = GetComparableName ( registryTraceData . KeyName ) ,
1745- ValueName = GetComparableName ( registryTraceData . ValueName )
1743+ KeyName = registryTraceData . KeyName ,
1744+ ValueName = registryTraceData . ValueName
17461745 } ;
17471746
17481747 ulong safeKeyHandle = registryTraceData . KeyHandle & 0x00000000FFFFFFFF ;
@@ -1796,7 +1795,7 @@ private void KCBStarted(RegistryTraceData registryTraceData) {
17961795 kcbModificationKeyNames = new Dictionary < ulong , string > ( ) ;
17971796 }
17981797
1799- kcbModificationKeyNames [ safeKeyHandle ] = GetComparableName ( registryTraceData . KeyName ) ;
1798+ kcbModificationKeyNames [ safeKeyHandle ] = registryTraceData . KeyName ;
18001799 }
18011800
18021801 private void KCBStopped ( RegistryTraceData registryTraceData ) {
@@ -1855,7 +1854,7 @@ private void KCBStopped(RegistryTraceData registryTraceData) {
18551854 registryStateElement = registryStateElements [ j ] ;
18561855
18571856 keyName = GetRedirectedKeyValueName (
1858- GetKeyValueNameFromKernelRegistryString ( GetComparableName ( registryTraceData . KeyName ) + "\\ " + registryStateElement . KeyName ) ,
1857+ GetKeyValueNameFromKernelRegistryString ( registryTraceData . KeyName + "\\ " + registryStateElement . KeyName ) ,
18591858 modificationsElement . RegistryStates . BinaryType
18601859 ) ;
18611860
0 commit comments