pwsh/New-RegJump.ps1
|
Set-Alias -Name regjump -Value New-RegJump function New-RegJump { [CmdletBinding()] param( [Parameter(Mandatory, ValueFromPipeline)] [ValidateNotNullOrEmpty()] [ValidateScript({!!($script:rk = Get-Item "Registry::$_" -ErrorAction 0)})] [String]$Key ) process { New-Delegate user32 { ptr FindWindowExW([ptr, ptr, buf, buf]) ptr SendMessageW([ptr, uint, ptr, ptr]) ptr SetFocus([ptr]) bool SetForegroundWindow([ptr]) } try { if (!($ps = Get-Process regedit -ErrorAction 0)) { if (!($ps = Start-Process regedit -ErrorAction 0 -PassThru)) { throw [InvalidOperationException]::new('Cannot start regisrty editor.') } } Start-Sleep -Milliseconds 300 if (($tree = $user32.FindWindowExW.Invoke( $ps.MainWindowHandle, [IntPtr]::Zero, [buf].Uni('SysTreeView32'), $null )) -eq [IntPtr]::Zero) { throw [InvalidOperationException]::new('Cannot find hives tree.') } [void]$user32.SetFocus.Invoke($tree) for ($i = 0; $i -lt 30; $i++) { [void]$user32.SendMessageW.Invoke($tree, 0x100, [IntPtr]0x25, [IntPtr]::Zero) } Start-Sleep -Milliseconds 300 [void]$user32.SendMessageW.Invoke($tree, 0x100, [IntPtr]0x27, [IntPtr]::Zero) for ($arr, $i = [Char[]]$rk.Name, 0; $i -lt $arr.Length; $i++){ $par = ((0x100, 0x27), (0x102, ([Char]$arr[$i])))[$arr[$i] -ne '\'] [void]$user32.SendMessageW.Invoke($tree, $par[0], [IntPtr]$par[1], [IntPtr]::Zero) } [void]$user32.SetForegroundWindow.Invoke($ps.MainWindowHandle) [void]$user32.SetFocus.Invoke($ps.MainWindowHandle) } catch { Write-Verbose $_ } finally { if ($ps) { $ps.Dispose() } } $rk.Dispose() } } Export-ModuleMember -Alias regjump -Function New-RegJump |