Skip to content

Instantly share code, notes, and snippets.

@terrbear
Created March 21, 2020 22:31
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save terrbear/78497fb8f6ba8cb8286679c936af8c2d to your computer and use it in GitHub Desktop.
Save terrbear/78497fb8f6ba8cb8286679c936af8c2d to your computer and use it in GitHub Desktop.
package main
import (
"bytes"
"io/ioutil"
"strings"
)
func isLetterWorks(entry []byte) bool {
return strings.Contains(strings.ToLower(compact(entry)), "letterworks")
}
func compact(data []byte) string {
var compacted bytes.Buffer
for _, char := range data {
if char != null {
compacted.WriteByte(char)
}
}
return compacted.String()
}
func explode(s string) []byte {
var exploded bytes.Buffer
for _, char := range s {
exploded.WriteByte(null)
exploded.WriteRune(char)
}
return exploded.Bytes()
}
func filterEntry(entry []byte) []byte {
compacted := compact(entry)
return explode(strings.Replace(compacted, "HKEY_USERS\\S-1-5-21-1941644472-1406884306-2145277243-500", "HKEY_CURRENT_USER", 1))
}
const openingBracket = 91
const null = 0
func main() {
contents, err := ioutil.ReadFile("./registry.reg")
if err != nil {
panic(err)
}
var output []byte
var entry []byte
first := true
for _, char := range contents {
if char == openingBracket {
if first {
first = false
output = append(output, entry[0:len(entry)-1]...)
} else if isLetterWorks(entry) {
output = append(output, filterEntry(entry)...)
}
entry = []byte{null}
}
entry = append(entry, char)
}
err = ioutil.WriteFile("./out.reg", output, 0666)
if err != nil {
panic(err)
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment