Jump to content

Recommended Posts

Posted (edited)

I try to parse some reg values to get out valid paths

Here are some examples

C:Windowssystem32cmd.exe /D /C start C:\Windows\System32\ie4uinit.exe ie4uinit.exe -ClearIconCache
%SystemRoot%system32regsvr32.exe /s /n /i:/UserInstall %SystemRoot%system32themeui.dll
C:PROGRA~2AvectoPRIVIL~1PGHook.dll,C:WindowsSysWOW64nvinit.dll
%SystemRoot%system32unregmp2.exe /ShowWMP
regsvr32.exe /s /n /i:U shell32.dll
 
Here is what I got
([(? :)|(%(.+?)%)].+?)?[^.|/]+.[^ |,]+
 
for the first one it returns 
             C:Windowssystem32cmd
             start C:\Windows\System32\ie4uinit.exe ie4uinit.exe
Second one 
            %SystemRoot%system32regsvr32.exe
             UserInstall %SystemRoot%system32themeui.dll
third one 
           C:PROGRA~2AvectoPRIVIL~1PGHook.dll
            ,C:WindowsSysWOW64nvinit.dll
fourth one work
 
fifth one returns 
             regsvr32.exe
             i:U shell32.dll
 
 
Any help would be appreciate
Edited by step887
Posted (edited)

And what should precisely be the results for the provided examples ?

Edit

This is *a* possibilty, considering that "regsvr32.exe" is not a "valid path"

#Include <Array.au3>
$str = 'C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe ie4uinit.exe -ClearIconCache' & @crlf & _
    '%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll' & @crlf & _
    'C:\PROGRA~2\Avecto\PRIVIL~1\PGHook.dll,C:\Windows\SysWOW64\nvinit.dll' & @crlf & _
    '%SystemRoot%\system32\unregmp2.exe /ShowWMP' & @crlf & _
    'regsvr32.exe /s /n /i:U shell32.dll'

$res = StringRegExp($str, '(?m)((?:[A-Z]:[^\s,]+)|(?:(?<=^|\h)%\S+))', 3)
_ArrayDisplay($res)
Edited by mikell
Posted (edited)

The valid path

 first one  
             C:Windowssystem32cmd
             C:Windowssystem32ie4uinit.exe
Second one 
            %SystemRoot%system32regsvr32.exe
             %SystemRoot%system32themeui.dll
third one 
           C:PROGRA~2AvectoPRIVIL~1PGHook.dll
           C:WindowsSysWOW64nvinit.dll
fifth one 
             regsvr32.exe
             shell32.dll
 
I am starting to think I should use stringregexpreplace with [/-].+?s to filters out the the switches in the middle
Edited by step887
Posted

Thanks Mike, that works great for the listed ones

what about this one

rundll32.exe "C:Program Files (x86)Common FilesMicrosoft SharedVSTOvstoee.dll"

#include <array.au3?
$str = 'rundll32.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"'
$res = StringRegExp($str, '(?m)((?:[A-Z]:[^\s,]+)|(?<=^|\h)(?:%\S+|[\w.]{4,}\h*(?=/|$)))', 3)
_ArrayDisplay($res,@extended)

Returns C:Program

I tried to modify it but I am only a novice at at reg exp

Posted (edited)

$res = StringRegExp($str, '(?m)((?:[A-Z]:.+?\.\w+)|(?<=^|\h)(?:%\S+|[\w.]{4,}\h*(?="|/|$)))', 3)

Regex need a preliminary precise definition of all the requirements, otherwise there will always be one particular case which will cause trouble

:)

Edited by mikell

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...