Function EnumRegistryPeristence

windowsregistry.go:48–69

EnumRegistryPeristence get all the potential registry values used for persistence

()

// EnumRegistryPeristence get all the potential registry values used for persistence
func EnumRegistryPeristence() (values []RegistryValue, errors []error) {

	keys := []registry.Key{registry.USERS, registry.LOCAL_MACHINE}
	subkeys := []string{`SOFTWARE\Microsoft\Windows\CurrentVersion\Run`, `SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce`}

	for _, k := range keys {
		for _, s := range subkeys {
			v, err := EnumRegHivePersistence(k, s)
			if err != nil {
				errMsg := fmt.Errorf("%s\\%s - %s", GetRegistryHiveNameFromConst(k), s, err)
				errors = append(errors, errMsg)
			}

			for _, value := range v {
				values = append(values, value)
			}

		}
	}

	return values, errors
}

// GetRegistryHiveNameFromConst format registry.Key hive name as a string
func GetRegistryHiveNameFromConst(key registry.Key) string {