Created
March 21, 2020 22:31
-
-
Save terrbear/78497fb8f6ba8cb8286679c936af8c2d to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package main | |
import ( | |
"bytes" | |
"io/ioutil" | |
"strings" | |
) | |
func isLetterWorks(entry []byte) bool { | |
return strings.Contains(strings.ToLower(compact(entry)), "letterworks") | |
} | |
func compact(data []byte) string { | |
var compacted bytes.Buffer | |
for _, char := range data { | |
if char != null { | |
compacted.WriteByte(char) | |
} | |
} | |
return compacted.String() | |
} | |
func explode(s string) []byte { | |
var exploded bytes.Buffer | |
for _, char := range s { | |
exploded.WriteByte(null) | |
exploded.WriteRune(char) | |
} | |
return exploded.Bytes() | |
} | |
func filterEntry(entry []byte) []byte { | |
compacted := compact(entry) | |
return explode(strings.Replace(compacted, "HKEY_USERS\\S-1-5-21-1941644472-1406884306-2145277243-500", "HKEY_CURRENT_USER", 1)) | |
} | |
const openingBracket = 91 | |
const null = 0 | |
func main() { | |
contents, err := ioutil.ReadFile("./registry.reg") | |
if err != nil { | |
panic(err) | |
} | |
var output []byte | |
var entry []byte | |
first := true | |
for _, char := range contents { | |
if char == openingBracket { | |
if first { | |
first = false | |
output = append(output, entry[0:len(entry)-1]...) | |
} else if isLetterWorks(entry) { | |
output = append(output, filterEntry(entry)...) | |
} | |
entry = []byte{null} | |
} | |
entry = append(entry, char) | |
} | |
err = ioutil.WriteFile("./out.reg", output, 0666) | |
if err != nil { | |
panic(err) | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment